Function at 0x427f90
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x5bb7e0
call fcn.0058f985
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.004039d7
mov eax, dword [ebp - 0x18]
or dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
mov esi, 0xf003f
mov byte [ebp + 0xb], bl
cmp dword [eax - 0xc], ebx
jne 0x428001
push str.Skipping_CleanupReferenceCountRegistry__no_ProductCode_was_defined.
call fcn.004437b6
inc ebx
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov eax, ebx
call fcn.0058fa5d
ret 4
call fcn.00446344
test eax, eax
je 0x428016
mov esi, 0xf013f
mov dword [ebp - 0x1c], 0xf023f
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.00401518
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push dword [ebp - 0x10]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call edi
test eax, eax
je 0x428074
cmp dword [ebp - 0x1c], 0xffffffff
je 0x428061
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
mov byte [ebp + 0xb], 1
push ebx
push dword [ebp - 0x10]
push esi
call edi
test eax, eax
je 0x428074
push dword [ebp - 0x10]
push str.Error:_CleanupReferenceCountRegistry:_Unable_to_open_uninstall_registry_key__s.
call fcn.004437b6
pop ecx
jmp 0x427fe0
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.RefCount
push dword [ebp - 0x14]
call edi
cmp eax, ebx
je 0x42809c
cmp eax, 2
je 0x42809c
push dword [ebp - 0x10]
push str.Error:_CleanupReferenceCountRegistry:_Unable_to_delete_RefCount_value_under__s.
call fcn.004437b6
pop ecx
pop ecx
push str.UsedBy
push dword [ebp - 0x14]
call edi
cmp eax, ebx
je 0x4280be
cmp eax, 2
je 0x4280be
push dword [ebp - 0x10]
push str.Error:_CleanupReferenceCountRegistry:_Unable_to_delete_UsedBy_value_under__s.
call fcn.004437b6
pop ecx
pop ecx
push str.InstallDateTime
push dword [ebp - 0x14]
call edi
cmp eax, ebx
je 0x4280e0
cmp eax, 2
je 0x4280e0
push dword [ebp - 0x10]
push str.Error:_CleanupReferenceCountRegistry:_Unable_to_delete_InstallDateTime_value_under__s.
call fcn.004437b6
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x42810a
push dword [ebp - 0x10]
push str.Error:_CleanupReferenceCountRegistry:_Unable_to_query_number_of_values_of_uninstall_registry_key__s.
call fcn.004437b6
pop ecx
pop ecx
cmp dword [ebp - 0x20], ebx
je 0x428138
push ebx
push ebx
push ebx
push ebx
push str.UninstallString
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x428138
push dword [ebp - 0x10]
mov dword [ebp - 0x20], ebx
push str.Warning:_Uninstall_Key_is_not_empty_and_Cannot_find__UninstallString__value__Safe_to_delete_this_uninstall_Key__s.
call fcn.004437b6
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x20], ebx
je 0x42815c
push str.CleanupReferenceCountRegistry:_Uninstall_registry_key_is_not_empty___can_not_delete
call fcn.004437b6
pop ecx
xor ebx, ebx
inc ebx
jmp 0x427fe1
call fcn.00446344
test eax, eax
je 0x4281c7
push str.RegDeleteKeyExW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x4281b6
xor eax, eax
cmp byte [ebp + 0xb], bl
mov ecx, 0x100
sete al
push ebx
dec eax
and eax, ecx
add eax, ecx
push eax
push dword [ebp - 0x10]
push esi
call edi
cmp eax, ebx
je 0x428154
push eax
push dword [ebp - 0x10]
push str.Error:_CleanupReferenceCountRegistry:_Unable_to_delete_uninstall_regitsry_key__s__error_code___d.
call fcn.004437b6
add esp, 0xc
jmp 0x427fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_load_system_function_RegDeleteKeyEx__error_code___d
jmp 0x428069
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x42819c