Function at 0x422b30
Capabilities:
Check if file exists
Delete registry key
Get common file path
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x471c78
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1ad4
call fcn.0045cf20
mov eax, dword [0x48e110]
xor eax, esp
mov dword [esp + 0x1ad0], eax
push ebx
push esi
push edi
mov eax, dword [0x48e110]
xor eax, esp
push eax
lea eax, [esp + 0x1ae8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], esi
call fcn.00403680
movzx eax, al
cmp eax, esi
je 0x422b9a
lea ecx, [esp + 0x28]
push ecx
push 0x20119
jmp 0x422ba4
lea edx, [esp + 0x28]
push edx
push 0x20019
push esi
push str.CLSID16076CC1_DE6A_4EB5_9356_201305201800InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x422d74
push 0x206
lea ecx, [esp + 0x9a]
xor eax, eax
push esi
push ecx
mov word [esp + 0xa0], ax
call fcn.0045c960
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push esi
push edx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x54], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x422d74
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x47a850
lea eax, [esp + 0x98]
push eax
call edi
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, esi
je 0x422d74
lea edx, [esp + 0x94]
push edx
push str.CUninstManager::GetEngineInfo__Engine_Path___s
call fcn.00411240
push 0x206
lea ecx, [esp + 0x8c2]
xor eax, eax
push esi
push ecx
mov word [esp + 0x8c8], ax
call fcn.0045c960
add esp, 0x14
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x94]
mov word [esp + eax + 0x8b4], cx
add eax, 2
cmp cx, si
jne 0x422c70
push str.bfDesktopAPI.dll
lea edx, [esp + 0x8b8]
push edx
call edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x1af0], esi
mov dword [esp + 0x14], esi
lea eax, [esp + 0x8b4]
lea ebx, [esp + 0x40]
mov byte [esp + 0x1af0], 1
call fcn.00418440
test eax, eax
je 0x422cd2
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.004183b0
mov eax, dword [esp + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x422d74
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0x4783b0
push eax
call edx
test eax, eax
je 0x422dff
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1af0], 2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x422dff
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
cmp ecx, ebx
je 0x422d43
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0x47ab08
push ecx
call eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x1c], ebx
jne 0x422d9c
mov byte [esp + 0x1af0], 1
cmp eax, ebx
je 0x422d61
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x1af0], bl
cmp ecx, ebx
je 0x422d74
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
xor eax, eax
mov ecx, dword [esp + 0x1ae8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1ad0]
xor ecx, esp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x18], ebx
mov byte [esp + 0x1af0], 4
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
lea ecx, [esp + 0x18]
push ecx
push eax
call edx
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x422e1f
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x1af0], 2
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x422de7
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x1af0], 1
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x422dff
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1af0], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x422d74
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x422d74
push 0x206
lea ecx, [esp + 0x4aa]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x4b0], ax
call fcn.0045c960
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x4b0]
add esp, 0xc
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x422e50
push str.AppConfig.ini
lea edx, [esp + 0x4a8]
push edx
call edi
lea esi, [esp + 0x4c]
call fcn.00403a30
push ecx
mov byte [esp + 0x1af4], 5
mov eax, esp
mov dword [esp + 0x3c], esp
push eax
lea ecx, [esp + 0x4ac]
call fcn.00403080
mov ecx, esi
call fcn.00403ba0
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, str.AppConfig
call fcn.00403080
push ecx
mov edx, esp
mov dword [esp + 0x50], esp
push edx
mov ecx, str.ClientPath
mov byte [esp + 0x1afc], 6
call fcn.00403080
lea edi, [esp + 0x28]
mov byte [esp + 0x1af8], 5
call fcn.00403ac0
push 0x206
lea ecx, [esp + 0xcca]
xor eax, eax
push ebx
mov byte [esp + 0x1af8], 7
push ecx
mov word [esp + 0xcd0], ax
call fcn.0045c960
add esp, 0xc
mov esi, edi
call fcn.00412290
lea edx, [esp + 0xcc4]
sub edx, eax
nop
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x422f10
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0045ae41
add esp, 8
cmp eax, ebx
jl 0x42325e
mov ecx, dword [esp + 0x20]
cmp eax, dword [ecx - 8]
jg 0x42325e
mov dword [ecx - 0xc], eax
mov ecx, dword [esp + 0x20]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [esp + 0x2c]
push edx
call fcn.00423270
push 0x206
lea ecx, [esp + 0x2a2]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x2a8], ax
call fcn.0045c960
add esp, 0xc
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0xcc4]
mov word [esp + eax + 0x29c], cx
add eax, 2
cmp cx, bx
jne 0x422f80
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x478048
lea edx, [esp + 0x2a0]
push edx
call esi
push 0x206
lea ecx, [esp + 0xed2]
xor eax, eax
push ebx
push ecx
mov word [esp + 0xed8], ax
call fcn.0045c960
add esp, 0xc
xor eax, eax
nop
movzx ecx, word [eax + str._Module_Uninstall_]
mov word [esp + eax + 0xecc], cx
add eax, 2
cmp cx, bx
jne 0x422fd0
lea edx, [esp + 0x29c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x423011
lea eax, [esp + 0xecc]
push eax
lea ecx, [esp + 0x2a0]
push ecx
call fcn.00401080
add esp, 8
mov ecx, 0x479040
call fcn.0041ec30
mov ecx, 0x478020
call fcn.0041ec30
mov ecx, 0x47905c
call fcn.0041ec30
mov ecx, 0x479078
call fcn.0041ec30
mov ecx, str.bugreport.exe
call fcn.0041ec30
mov ecx, 0x478048
call fcn.0041ec30
mov ecx, 0x478064
call fcn.0041ec30
mov ecx, 0x4790b8
call fcn.0041ec30
mov ecx, 0x4790d4
call fcn.0041ec30
mov ecx, 0x4790ec
call fcn.0041ec30
mov ecx, 0x478844
call fcn.0041ec30
mov ecx, 0x479110
call fcn.0041ec30
lea edx, [esp + 0xcc4]
push ebx
push edx
call fcn.004028a0
push 0x206
lea ecx, [esp + 0x6ba]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x6c0], ax
call fcn.0045c960
add esp, 0x14
lea edx, [esp + 0x30]
push edx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x423107
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x6ac]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x477ac0
lea eax, [esp + 0x6b0]
push eax
call esi
lea ecx, [esp + 0x6ac]
push ebx
push ecx
call fcn.004028a0
add esp, 8
push 0x206
lea eax, [esp + 0xac2]
xor edx, edx
push ebx
push eax
mov word [esp + 0xac8], dx
call fcn.0045c960
add esp, 0xc
push 1
push 0x17
lea ecx, [esp + 0xac4]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x47aac4
lea edx, [esp + 0xac0]
push edx
call esi
lea eax, [esp + 0xabc]
push ebx
push eax
call fcn.004028a0
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallBFVKanDianYing
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, 5
jne 0x4231df
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x10d8]
push edx
mov dword [esp + 0x34], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallBFVKanDianYing
push str.MACHINE
push 0x476a00
lea eax, [esp + 0x12e8]
push 0x800
push eax
call fcn.0045ac31
add esp, 0x14
push 0xf003f
lea ecx, [esp + 0x10d8]
push ecx
push 2
lea edi, [esp + 0x12e8]
call fcn.00403780
cmp eax, ebx
je 0x4231df
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallBFVKanDianYing
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
push 0x4783b0
push eax
mov eax, dword [edx + 0x24]
call eax
lea ecx, [esp + 0x20]
call fcn.00403440
lea esi, [esp + 0x4c]
call fcn.00403a70
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x1af0], 2
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x423225
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x1af0], 1
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x42323d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x1af0], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x423254
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
jmp 0x422d76
push 0x80070057
call fcn.00401950
int3