Function at 0x4143a0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x453bab
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0xa38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663d8]
xor eax, esp
push eax
lea eax, [esp + 0xa50]
mov dword fs:[0], eax
xor ebp, ebp
mov edi, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], bp
mov eax, edx
mov dword [esp + 0xa58], ebp
xor ebx, ebx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x414402
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x30]
call fcn.004040c0
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00403f40
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x414439
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push ebp
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x250]
push eax
mov eax, dword [esp + 0x28]
push ebp
push ebp
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x58]
push edx
push ebx
push eax
mov dword [esp + 0x44], 0x104
mov dword [esp + 0x3c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, ebp
jne 0x4144aa
mov ecx, dword [esp + 0x1c]
shr ecx, 1
mov word [esp + ecx*2 + 0x24c], bp
push edi
lea edx, [esp + 0x250]
lea ecx, [esp + 0x48]
call fcn.00414690
add ebx, 1
cmp esi, ebp
je 0x414450
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
push eax
push edi
call fcn.004231d0
mov edx, str.dump
call fcn.00401e60
test eax, eax
je 0x4144e8
mov ecx, str.dump
call fcn.00401f00
mov edx, eax
mov ecx, edi
call fcn.0041fc90
mov ecx, dword [edi + 4]
mov ebx, dword [ecx]
mov ebp, edi
nop
test ebp, ebp
mov esi, dword [edi + 4]
je 0x4144fb
cmp ebp, edi
je 0x414500
call fcn.00439412
cmp ebx, esi
je 0x41460d
test ebp, ebp
jne 0x414511
call fcn.00439412
cmp ebx, dword [ebp + 4]
jne 0x41451b
call fcn.00439412
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
add eax, 0xffffffff
cmp eax, 0xb
ja case.0x41452d.2
jmp dword [eax*4 + 0x41465c]
cmp ebx, dword [ebp + 4]
jne 0x41453e
call fcn.00439412
push edi
mov ecx, esi
call fcn.0041cf80
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x414555
call fcn.00439412
push edi
mov ecx, esi
call fcn.0041d340
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x41456c
call fcn.00439412
mov ecx, esi
call fcn.0041d520
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x414582
call fcn.00439412
push edi
mov ecx, esi
call fcn.0041dbb0
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x414596
call fcn.00439412
push edi
mov ecx, esi
call fcn.0041df10
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x4145aa
call fcn.00439412
mov ecx, esi
call fcn.0041e400
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x4145bd
call fcn.00439412
push edi
call fcn.0041e5a0
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x4145cf
call fcn.00439412
call fcn.0041b7b0
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x4145e0
call fcn.00439412
push edi
mov eax, esi
call fcn.0041e820
jmp case.0x41452d.2
cmp ebx, dword [ebp + 4]
jne 0x4145f4
call fcn.00439412
push edi
mov ecx, esi
call fcn.0041e8e0
cmp ebx, dword [ebp + 4]
jne 0x414606
call fcn.00439412
mov ebx, dword [ebx]
jmp 0x4144f0
mov edx, dword [esp + 0x18]
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x40], 8
jb 0x414631
mov eax, dword [esp + 0x2c]
push eax
call fcn.00439935
add esp, 4
mov ecx, dword [esp + 0xa50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.00437ffa
add esp, 0xa48
ret