Function at 0x424dd0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557caa
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x5d7b20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf4], ecx
mov ebx, dword [ebp + 8]
mov esi, 7
xor edi, edi
xor eax, eax
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
xor ecx, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], cx
mov dword [ebp - 0x88], 0xf
mov dword [ebp - 0x8c], edi
mov byte [ebp - 0x9c], cl
mov dword [ebp - 0xd8], edi
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x140], edi
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 6
call fcn.0043f020
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 7
call fcn.0043f020
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 8
call fcn.0043f020
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 9
call fcn.0043f020
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xa0], 1
call fcn.00413de0
cmp ax, 0xc
je 0x425423
call fcn.00413de0
cmp ax, 0xb
je 0x425423
push 0x568928
push SysReAllocStringLen
lea ecx, [ebp - 0xfc]
call fcn.0043f030
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0xfc]
call fcn.0043faa0
test eax, eax
jne 0x424fc6
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 9
call fcn.0043f640
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 8
call fcn.0043f640
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 7
call fcn.0043f640
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 6
call fcn.0043f640
lea ecx, [ebp - 0x148]
call fcn.004233a0
lea ecx, [ebp - 0x138]
call fcn.004233a0
lea ecx, [ebp - 0xc4]
call fcn.00406a50
lea ecx, [ebp - 0xd8]
call fcn.00406a50
mov ebx, 8
cmp dword [ebp - 0x34], ebx
jb 0x424fa2
mov eax, dword [ebp - 0x48]
push eax
call fcn.00449b7c
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], cx
cmp dword [ebp - 0x18], ebx
jb 0x424fbf
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00449b7c
add esp, 4
xor eax, eax
jmp 0x425f48
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xb4], eax
cmp eax, dword [ebp - 0xd4]
je 0x425e33
mov dword [ebp - 0xc8], 0x2a
jmp 0x424ff0
mov edx, dword [ebp - 0xb4]
mov edi, 8
mov ebx, SysReAllocStringLen
mov dword [ebp - 0xb0], ebx
cmp dword [edx + 0x14], edi
jb 0x42500d
mov edx, dword [edx]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425012
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.004021b0
push 1
push 0x56825c
lea ecx, [ebp - 0x2c]
call fcn.00402090
mov esi, dword [ebp - 0x118]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425045
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00402090
push 1
push 0
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00415630
cmp eax, 0xffffffff
jne 0x4250ac
push 1
push 0
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], 0x3f
call fcn.00415630
cmp eax, 0xffffffff
jne 0x4250ac
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0xc4]
call fcn.00423c70
jmp 0x4251e9
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00401f90
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0xa4]
push ecx
mov esi, 0x5c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], esi
call fcn.004156f0
lea ecx, [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x42515d
push 1
push 0xffffffffffffffff
lea edx, [ebp - 0xa4]
push edx
mov dword [ebp - 0xa4], esi
call fcn.004156f0
push eax
push 0
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041af10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
call fcn.00405ca0
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x50], edi
jb 0x425129
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.00449b7c
add esp, 4
push 1
push 0xffffffffffffffff
lea edx, [ebp - 0xa4]
push edx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0xa4], esi
call fcn.004156f0
inc eax
push eax
push 0
lea ecx, [ebp - 0x48]
call fcn.00401350
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x48]
call fcn.00401f90
jmp 0x425166
push 0xffffffffffffffff
push 0
call fcn.00401350
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x425171
lea eax, [ebp - 0x2c]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0xe0]
call fcn.0043f030
mov esi, eax
test esi, esi
je 0x4251ce
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa4], esp
xor eax, eax
push 0xffffffffffffffff
push eax
lea edx, [ebp - 0x48]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push edx
mov word [ecx], ax
call fcn.00401f90
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xe0]
call fcn.00440050
mov ebx, esi
mov dword [ebp - 0xb0], ebx
jmp 0x4251e9
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x4251d9
lea eax, [ebp - 0x2c]
push eax
push str.Cannot_open_the_key___1_s___by_CMpReg_n
push 5
call fcn.00403ab0
add esp, 0xc
mov edi, dword [ebp - 0xc4]
cmp edi, dword [ebp - 0xc0]
je 0x425403
jmp 0x425200
cmp dword [edi + 0x14], 8
jb 0x42520a
mov eax, dword [edi]
jmp 0x42520c
mov eax, edi
push eax
push ebx
lea ecx, [ebp - 0xac]
call fcn.0043f030
test eax, eax
je 0x4253f4
lea ecx, [ebp - 0x114]
call fcn.0043f020
xor eax, eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov esi, dword [ebp + 0xc]
and esi, 0xff00
mov byte [ebp - 4], 0xd
cmp esi, 0x200
jg 0x4252f1
je 0x4252cb
test esi, esi
je 0x4252a3
cmp esi, 0x100
jne 0x4252f9
push str.CMD_UNINSTREG_DELETEKEY_NOSUB_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0xac]
call fcn.0043faa0
test eax, eax
jne 0x425391
lea edx, [ebp - 0xf0]
push edx
jmp 0x425358
push str.CMD_UNINSTREG_DELETEKEY_FORCE_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea ecx, [ebp - 0xac]
call fcn.0043fe40
and dword [ebp - 0xa0], eax
jmp 0x425367
push str.CMD_UNINSTREG_DELETEKEY_NOSUBKEY_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xac]
call fcn.0043faa0
jmp 0x425363
cmp esi, 0x300
je 0x42533f
push esi
push str.CUninstallActions::DeleteUsersRegistryKey_CMD_UNINSTREG_DELTEKEY_others__nAct__0xFF00__0x_1_lx___n
push 5
call fcn.00403ab0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x425327
mov eax, dword [edi]
mov ecx, dword [ebp - 0xf4]
push esi
push eax
push ebx
call fcn.00421bc0
mov dword [ebp - 0xa0], eax
jmp 0x425391
mov ecx, dword [ebp - 0xf4]
push esi
mov eax, edi
push eax
push ebx
call fcn.00421bc0
mov dword [ebp - 0xa0], eax
jmp 0x425391
push str.CMD_UNINSTREG_DELETEKEY_NOSUBVALUE_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x114]
call fcn.0043fbd0
test eax, eax
jne 0x425391
lea ecx, [ebp - 0xac]
call fcn.0043f290
cmp dword [edi + 0x14], 8
jb 0x42537c
mov eax, dword [edi]
jmp 0x42537e
mov eax, edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
inc eax
and dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0xf0]
test esi, esi
je 0x4253d1
mov ebx, dword [ebp - 0xec]
cmp esi, ebx
je 0x4253c2
lea edx, [ebp - 0xe4]
push esi
push edx
call fcn.00405d20
add esi, 0x1c
add esp, 8
cmp esi, ebx
jne 0x4253a5
mov esi, dword [ebp - 0xf0]
push esi
call fcn.00449b7c
mov ebx, dword [ebp - 0xb0]
add esp, 4
xor eax, eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov byte [ebp - 4], 0xa
call fcn.0043f640
add edi, 0x1c
cmp edi, dword [ebp - 0xc0]
jne 0x425200
mov eax, dword [ebp - 0xb4]
add eax, 0x1c
mov dword [ebp - 0xb4], eax
cmp eax, dword [ebp - 0xd4]
jne 0x424ff0
jmp 0x425e31
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x120]
call fcn.0043f030
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x120]
call fcn.0043faa0
push 0x568928
push SysReAllocStringLen
lea ecx, [ebp - 0xfc]
call fcn.0043f030
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xb4], eax
cmp eax, dword [ebp - 0xd4]
je 0x425e33
mov esi, eax
jmp 0x425488
mov ebx, dword [ebp - 0x118]
xor edi, edi
cmp dword [esi + 0x14], 8
jb 0x425492
mov eax, dword [esi]
jmp 0x425494
mov eax, esi
push eax
lea ecx, [ebp - 0xfc]
call fcn.0043f070
test eax, eax
je 0x425993
cmp dword [esi + 0x14], 8
mov dword [ebp - 0xb0], SysReAllocStringLen
jb 0x4254bc
mov edx, dword [esi]
jmp 0x4254be
mov edx, esi
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4254c3
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.004021b0
push 1
push 0x56825c
lea ecx, [ebp - 0x2c]
call fcn.00402090
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4254f0
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00402090
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa4], 0x2a
cmp eax, edi
jbe 0x42558a
mov ecx, eax
mov dword [ebp - 0xc8], ecx
cmp eax, 1
jb 0x42558a
cmp dword [ebp - 0x18], 8
mov edi, dword [ebp - 0x2c]
jae 0x425533
lea edi, [ebp - 0x2c]
mov eax, edi
test ecx, ecx
je 0x42558a
lea esp, [esp]
cmp word [eax], 0x2a
je 0x42554e
add eax, 2
dec ecx
jne 0x425540
jmp 0x42558a
test eax, eax
je 0x42558a
mov esi, 1
lea edx, [ebp - 0xa4]
mov ecx, eax
nop
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x4255c0
add ecx, 2
add edx, 2
dec esi
jne 0x425560
mov ecx, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x425581
lea ecx, [ebp - 0x2c]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4255ee
push 1
push 0
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], 0x3f
call fcn.00415630
cmp eax, 0xffffffff
jne 0x4255e9
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00423c70
jmp 0x425730
sbb edx, edx
and edx, 0xfffffffe
inc edx
je 0x425571
mov ecx, eax
sub ecx, edi
sar ecx, 1
or edx, 0xffffffff
sub edx, ecx
mov ecx, dword [ebp - 0xc8]
add ecx, edx
mov dword [ebp - 0xc8], ecx
lea edi, [eax + 2]
jmp 0x425533
mov edi, 8
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x48]
mov esi, 0x5c
call fcn.00401f90
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], esi
call fcn.004156f0
cmp eax, 0xffffffff
je 0x4256a3
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], esi
call fcn.004156f0
push eax
push 0
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0041af10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.00405ca0
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x6c], edi
jb 0x42566f
mov eax, dword [ebp - 0x80]
push eax
call fcn.00449b7c
add esp, 4
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0xa4], esi
call fcn.004156f0
inc eax
push eax
push 0
lea ecx, [ebp - 0x48]
call fcn.00401350
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x48]
call fcn.00401f90
jmp 0x4256af
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
call fcn.00401350
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x4256ba
lea eax, [ebp - 0x2c]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0xe0]
call fcn.0043f030
mov esi, eax
test esi, esi
je 0x425715
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x110], esp
xor edx, edx
push 0xffffffffffffffff
push edx
lea eax, [ebp - 0x48]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.00401f90
lea ecx, [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0xe0]
call fcn.00440050
mov dword [ebp - 0xb0], esi
jmp 0x425730
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x425720
lea eax, [ebp - 0x2c]
push eax
push str.Cannot_open_the_key___1_s___by_CMpReg_n
push 5
call fcn.00403ab0
add esp, 0xc
mov edi, dword [ebp - 0xc4]
cmp edi, dword [ebp - 0xc0]
je 0x425e16
mov ebx, dword [ebp - 0xb0]
cmp dword [edi + 0x14], 8
jb 0x425752
mov eax, dword [edi]
jmp 0x425754
mov eax, edi
push eax
push ebx
lea ecx, [ebp - 0xac]
call fcn.0043f030
test eax, eax
je 0x42597f
lea ecx, [ebp - 0x128]
call fcn.0043f020
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov esi, dword [ebp + 0xc]
and esi, 0xff00
mov byte [ebp - 4], 0x10
cmp esi, 0x200
jg 0x42588d
je 0x425867
test esi, esi
je 0x4257ef
cmp esi, 0x100
jne 0x425895
push str.CMD_UNINSTREG_DELETEKEY_NOSUB_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0xac]
call fcn.0043faa0
test eax, eax
jne 0x42591c
lea eax, [ebp - 0x10c]
push eax
jmp 0x4258e8
push str.CMD_UNINSTREG_DELETEKEY_FORCE_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea ecx, [ebp - 0xac]
call fcn.0043f290
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x425902
push str.SHDeleteKeyW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42585b
cmp dword [edi + 0x14], 8
jb 0x42584f
mov ecx, dword [edi]
push ecx
push ebx
call eax
and dword [ebp - 0xa0], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42591c
mov ecx, edi
push ecx
push ebx
call eax
and dword [ebp - 0xa0], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42591c
push str.CMD_UNINSTREG_DELETEKEY_NOSUBKEY_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp - 0xac]
call fcn.0043faa0
jmp 0x4258f3
cmp esi, 0x300
je 0x4258cf
push esi
push str.CUninstallActions::DeleteUsersRegistryKey_CMD_UNINSTREG_DELTEKEY_others__nAct__0xFF00__0x_1_lx___n
push 5
call fcn.00403ab0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4258bd
mov eax, dword [edi]
mov ecx, dword [ebp - 0xf4]
push esi
push eax
push ebx
call fcn.00421bc0
jmp 0x425916
mov ecx, dword [ebp - 0xf4]
push esi
mov eax, edi
push eax
push ebx
call fcn.00421bc0
jmp 0x425916
push str.CMD_UNINSTREG_DELETEKEY_NOSUBVALUE_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x128]
call fcn.0043fbd0
test eax, eax
jne 0x42591c
lea ecx, [ebp - 0xac]
call fcn.0043f290
cmp dword [edi + 0x14], 8
jb 0x42590c
mov eax, dword [edi]
jmp 0x42590e
mov eax, edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0x10c]
test esi, esi
je 0x42595c
mov ebx, dword [ebp - 0x108]
cmp esi, ebx
je 0x42594d
lea eax, [ebp - 0x100]
push esi
push eax
call fcn.00405d20
add esi, 0x1c
add esp, 8
cmp esi, ebx
jne 0x425930
mov esi, dword [ebp - 0x10c]
push esi
call fcn.00449b7c
mov ebx, dword [ebp - 0xb0]
add esp, 4
xor eax, eax
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov byte [ebp - 4], 0xa
call fcn.0043f640
add edi, 0x1c
cmp edi, dword [ebp - 0xc0]
jne 0x425748
jmp 0x425e16
push 1
push str.SeRestorePrivilege
call fcn.00417000
add esp, 8
test eax, eax
je 0x425e16
cmp dword [esi + 0x14], 8
jb 0x4259b4
mov eax, dword [esi]
jmp 0x4259b6
mov eax, esi
push eax
call fcn.00414e70
add esp, 4
test eax, eax
je 0x425e08
cmp dword [esi + 0x14], 8
mov dword [ebp - 0xb0], SysReAllocStringLen
jb 0x4259db
mov edx, dword [esi]
jmp 0x4259dd
mov edx, esi
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4259e2
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.004021b0
push 1
push 0x56825c
lea ecx, [ebp - 0x2c]
call fcn.00402090
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x425a10
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00402090
push 1
push edi
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], 0x2a
call fcn.00415630
cmp eax, 0xffffffff
jne 0x425a7f
push 1
push edi
lea edx, [ebp - 0xa4]
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], 0x3f
call fcn.00415630
cmp eax, 0xffffffff
jne 0x425a7f
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00423c70
jmp 0x425bba
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00401f90
push 1
push 0xffffffffffffffff
lea edx, [ebp - 0xa4]
mov esi, 0x5c
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xa4], esi
call fcn.004156f0
lea ecx, [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x425b31
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], esi
call fcn.004156f0
push eax
push edi
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0041af10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
call fcn.00405ca0
cmp dword [ebp - 0x6c], 8
mov byte [ebp - 4], 0xa
jb 0x425aff
mov edx, dword [ebp - 0x80]
push edx
call fcn.00449b7c
add esp, 4
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0xa4], esi
call fcn.004156f0
inc eax
push eax
push edi
lea ecx, [ebp - 0x48]
call fcn.00401350
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x48]
call fcn.00401f90
jmp 0x425b39
push 0xffffffffffffffff
push edi
call fcn.00401350
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x425b45
lea eax, [ebp - 0x2c]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0xe0]
call fcn.0043f030
mov esi, eax
cmp esi, edi
je 0x425b9e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x110], esp
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x48]
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.00401f90
lea ecx, [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0xe0]
call fcn.00440050
mov ebx, esi
mov dword [ebp - 0xb0], ebx
jmp 0x425bc0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x425baa
lea eax, [ebp - 0x2c]
push eax
push str.Cannot_open_the_key___1_s___by_CMpReg_n
push 5
call fcn.00403ab0
add esp, 0xc
mov ebx, dword [ebp - 0xb0]
mov edi, dword [ebp - 0xc4]
cmp edi, dword [ebp - 0xc0]
je 0x425def
cmp dword [edi + 0x14], 8
jb 0x425bdc
mov eax, dword [edi]
jmp 0x425bde
mov eax, edi
push eax
push ebx
lea ecx, [ebp - 0xac]
call fcn.0043f030
test eax, eax
je 0x425de0
lea ecx, [ebp - 0xe8]
call fcn.0043f020
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov esi, dword [ebp + 0xc]
and esi, 0xff00
mov byte [ebp - 4], 0x13
cmp esi, 0x200
jg 0x425d05
je 0x425ce2
test esi, esi
je 0x425c6a
cmp esi, 0x100
jne 0x425d0d
push str.CMD_UNINSTREG_DELETEKEY_NOSUB_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0xac]
call fcn.0043faa0
test eax, eax
jne 0x425d91
lea eax, [ebp - 0x58]
push eax
jmp 0x425d5d
push str.CMD_UNINSTREG_DELETEKEY_FORCE_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea ecx, [ebp - 0xac]
call fcn.0043f290
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x425d77
push str.SHDeleteKeyW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x425cd6
cmp dword [edi + 0x14], 8
jb 0x425cca
mov ecx, dword [edi]
push ecx
push ebx
call eax
and dword [ebp - 0xa0], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x425d91
mov ecx, edi
push ecx
push ebx
call eax
and dword [ebp - 0xa0], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x425d91
push str.CMD_UNINSTREG_DELETEKEY_NOSUBKEY_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0xac]
call fcn.0043faa0
jmp 0x425d68
cmp esi, 0x300
je 0x425d47
push esi
push str.CUninstallActions::DeleteUsersRegistryKey_CMD_UNINSTREG_DELTEKEY_others__nAct__0xFF00__0x_1_lx___n
push 5
call fcn.00403ab0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x425d35
mov eax, dword [edi]
mov ecx, dword [ebp - 0xf4]
push esi
push eax
push ebx
call fcn.00421bc0
jmp 0x425d8b
mov ecx, dword [ebp - 0xf4]
push esi
mov eax, edi
push eax
push ebx
call fcn.00421bc0
jmp 0x425d8b
push str.CMD_UNINSTREG_DELETEKEY_NOSUBVALUE_n
push 0x56dce8
call fcn.00415550
add esp, 8
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0xe8]
call fcn.0043fbd0
test eax, eax
jne 0x425d91
lea ecx, [ebp - 0xac]
call fcn.0043f290
cmp dword [edi + 0x14], 8
jb 0x425d81
mov eax, dword [edi]
jmp 0x425d83
mov eax, edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x425dc6
mov ebx, dword [ebp - 0x54]
cmp esi, ebx
je 0x425db7
nop
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.00405d20
add esi, 0x1c
add esp, 8
cmp esi, ebx
jne 0x425da0
mov esi, dword [ebp - 0x58]
push esi
call fcn.00449b7c
mov ebx, dword [ebp - 0xb0]
add esp, 4
xor eax, eax
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0xa
call fcn.0043f640
add edi, 0x1c
cmp edi, dword [ebp - 0xc0]
jne 0x425bd2
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x14], 8
jb 0x425dfd
mov eax, dword [eax]
push eax
call fcn.00414fe0
add esp, 4
xor edi, edi
push edi
push str.SeRestorePrivilege
call fcn.00417000
add esp, 8
mov esi, dword [ebp - 0xb4]
add esi, 0x1c
mov dword [ebp - 0xb4], esi
cmp esi, dword [ebp - 0xd4]
jne 0x425480
xor edi, edi
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 9
call fcn.0043f640
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 8
call fcn.0043f640
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 7
call fcn.0043f640
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 6
call fcn.0043f640
mov esi, dword [ebp - 0xc4]
cmp esi, edi
je 0x425eab
mov edi, dword [ebp - 0xc0]
cmp esi, edi
je 0x425ea0
lea ecx, [ebp - 0xb8]
push esi
push ecx
call fcn.00405d20
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x425e83
mov esi, dword [ebp - 0xc4]
push esi
call fcn.00449b7c
add esp, 4
xor edi, edi
mov esi, dword [ebp - 0xd8]
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xbc], edi
cmp esi, edi
je 0x425ef9
mov edi, dword [ebp - 0xd4]
cmp esi, edi
je 0x425eee
lea edx, [ebp - 0xcc]
push esi
push edx
call fcn.00405d20
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x425ed1
mov esi, dword [ebp - 0xd8]
push esi
call fcn.00449b7c
add esp, 4
xor edi, edi
mov esi, 8
mov dword [ebp - 0xd8], edi
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xd0], edi
cmp dword [ebp - 0x34], esi
jb 0x425f21
mov eax, dword [ebp - 0x48]
push eax
call fcn.00449b7c
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], cx
cmp dword [ebp - 0x18], esi
jb 0x425f42
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00449b7c
add esp, 4
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053e1ad
mov esp, ebp
pop ebp
ret 8