Function at 0x412fb0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451cb6
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x468738]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov esi, edx
xor eax, eax
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa20], 7
mov dword [ebp - 0xa24], ebx
mov word [ebp - 0xa34], ax
mov eax, esi
mov dword [ebp - 4], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413011
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [ebp - 0xa34]
call fcn.004065a0
push 0xa
mov eax, str.Uninstall
mov ecx, esi
call fcn.00403690
cmp dword [ebp - 0xa20], 8
mov eax, dword [ebp - 0xa34]
jae 0x41304d
mov eax, esi
lea ecx, [ebp - 0xa60]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0xa5c]
push edx
lea eax, [ebp - 0xa18]
push eax
mov eax, dword [ebp - 0xa60]
push 0
push 0
lea ecx, [ebp - 0xa68]
push ecx
lea edx, [ebp - 0x218]
push edx
push ebx
push eax
mov dword [ebp - 0xa68], 0x104
mov dword [ebp - 0xa5c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x4131c5
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0x218]
shr ecx, 1
xor edx, edx
push str.Folder
push eax
mov word [ebp + ecx*2 - 0xa18], dx
call fcn.004398d8
add esp, 8
test eax, eax
je 0x413124
lea ecx, [ebp - 0xa18]
push 0x458684
push ecx
call fcn.004398d8
add esp, 8
test eax, eax
je 0x413109
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004133c0
jmp 0x413124
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_Folder:__s
push 0x4699dc
xor eax, eax
call fcn.0042c820
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.004398d8
add esp, 8
test eax, eax
je 0x413183
lea ecx, [ebp - 0xa18]
push 0x458684
push ecx
call fcn.004398d8
add esp, 8
test eax, eax
je 0x413168
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004133c0
jmp 0x413183
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_File:__s
push 0x4699dc
xor eax, eax
call fcn.0042c820
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.004398d8
add esp, 8
test eax, eax
jne 0x4131c5
lea ecx, [ebp - 0x218]
push str.Folder
push ecx
call fcn.004398d8
add esp, 8
test eax, eax
jne 0x4131c5
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004133c0
inc ebx
test esi, esi
je 0x413067
mov edx, dword [ebp - 0xa60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa64]
push eax
mov ecx, edi
call fcn.00421990
push str.dump
call fcn.00402130
test eax, eax
je 0x41320a
mov ecx, str.dump
call fcn.00402200
mov edx, eax
mov ecx, edi
call fcn.0041efa0
mov eax, dword [edi]
mov esi, dword [eax]
mov dword [ebp - 0xa58], esi
cmp esi, eax
je 0x413347
jmp 0x413226
mov esi, dword [ebp - 0xa58]
lea ecx, [ebp - 0xa50]
add esi, 8
push ecx
mov edx, 0x4585d8
mov ecx, esi
call fcn.00410e30
mov ebx, dword [eax + 0x10]
mov ecx, ebx
cmp ecx, ebx
jae 0x413245
mov edx, ebx
cmp ebx, 6
jb 0x413251
mov edx, 6
cmp dword [eax + 0x14], 8
jb 0x41325b
mov ecx, dword [eax]
jmp 0x41325d
mov ecx, eax
mov eax, str.ignore
test edx, edx
je 0x41327d
mov di, word [ecx]
cmp di, word [eax]
jne 0x413287
add ecx, 2
add eax, 2
dec edx
jne 0x413266
mov edi, dword [ebp - 0xa54]
cmp ebx, 6
jae 0x413297
or eax, 0xffffffff
jmp 0x41329f
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x413277
mov edi, dword [ebp - 0xa54]
jmp 0x41329f
xor eax, eax
cmp ebx, 6
setne al
test eax, eax
sete al
mov byte [ebp - 4], 0
cmp dword [ebp - 0xa3c], 8
mov byte [edi + 0x41], al
jb 0x4132c3
mov ecx, dword [ebp - 0xa50]
push ecx
call fcn.00438b5b
add esp, 4
mov eax, dword [esi]
dec eax
cmp eax, 0xb
ja case.0x4132cb.3
jmp dword [eax*4 + 0x413390]
push edi
mov ecx, esi
call fcn.0041c390
jmp case.0x4132cb.3
push edi
mov ecx, esi
call fcn.0041c7c0
jmp case.0x4132cb.3
mov ecx, esi
call fcn.0041ca10
jmp case.0x4132cb.3
push edi
mov ecx, esi
call fcn.0041cfd0
jmp case.0x4132cb.3
push edi
mov ecx, esi
call fcn.0041d2d0
jmp case.0x4132cb.3
mov ecx, esi
mov ebx, edi
call fcn.0041d810
jmp case.0x4132cb.3
push edi
mov ecx, esi
call fcn.0041d990
jmp case.0x4132cb.3
call fcn.0041a740
jmp case.0x4132cb.3
push edi
mov ecx, esi
call fcn.0041dcc0
jmp case.0x4132cb.3
push edi
mov ecx, esi
call fcn.0041dd80
mov edx, dword [ebp - 0xa58]
mov eax, dword [edx]
mov dword [ebp - 0xa58], eax
cmp eax, dword [edi]
jne 0x413220
mov eax, dword [ebp - 0xa64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp - 0xa20], 8
jb 0x413371
mov ecx, dword [ebp - 0xa34]
push ecx
call fcn.00438b5b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004377d1
mov esp, ebp
pop ebp
ret