Function at 0x451240
Capabilities:
Delete directory
Delete file

Disassembly:
mov dword [rsp + 0x10], edx
mov eax, 0x3c28
call fcn.00499730
sub rsp, rax
mov qword [rsp + 0x3c20], rbx
mov qword [rsp + 0x3c18], rbp
mov qword [rsp + 0x3c10], rsi
mov qword [rsp + 0x3c08], rdi
mov qword [rsp + 0x3c00], r12
mov qword [rsp + 0x3bf8], r13
mov qword [rsp + 0x3bf0], r14
mov qword [rsp + 0x3be8], r15
mov r12, r8
mov r14, rcx
mov qword [rsp + 0x50], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x451321
xor r8d, r8d
lea rdx, str.KINIFile::UninstallINIFiles_n
lea rcx, [rsp + 0x60]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x370], rdx
lea rdi, [rsp + 0x370]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x60]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4512f0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x370]
call fcn.004548a0
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x2a40], rbp
mov r8d, 0x1f4
mov edx, 0x4b
lea rcx, [rsp + 0x2a48]
call fcn.00499630
lea rax, [rsp + 0x2c40]
mov ecx, 0x3e
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
add rax, 0x40
mov qword [rax - 0x28], rbp
mov qword [rax - 0x20], rbp
mov qword [rax - 0x18], rbp
mov qword [rax - 0x10], rbp
mov qword [rax - 8], rbp
dec rcx
jne 0x451354
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
lea rbx, [r14 + 0x1698]
cmp dword [rbx], 0
jne 0x4513e1
mov rdi, rbp
mov rax, qword [rsp + 0x2a40]
test rax, rax
je 0x4513da
nop
nop
nop
mov rcx, qword [rsp + rdi*8 + 0x2c40]
test rcx, rcx
je 0x4513d2
call fcn.0049bb84
mov qword [rsp + rdi*8 + 0x2c40], rbp
mov rax, qword [rsp + 0x2a40]
inc rdi
cmp rdi, rax
jb 0x4513b0
xor eax, eax
jmp 0x451c4c
mov r8d, 1
lea rdx, [rsp + 0x580]
mov ecx, 0x104
call fcn.0047fd20
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rbp
lea r15, [r14 + 0x16a0]
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.00402030
mov rdi, qword [rsp + 0x48]
mov r8, rdi
xor edx, edx
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call fcn.00499630
mov rdx, rbp
mov r13, qword [rsp + 0x38]
test rdi, rdi
je 0x451456
mov rcx, rsi
nop
movzx eax, byte [rdx + r13]
cmp al, 0x5c
je 0x45144e
mov byte [rcx], al
inc rcx
inc rdx
cmp rdx, rdi
jb 0x451440
mov rcx, rsi
mov rdx, r13
sub rdx, rsi
nop
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
inc rcx
test al, al
jne 0x451460
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
dec rcx
mov qword [rsp + 0x48], rcx
lea rdi, [rsp + 0x580]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [r13 + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4514a0
lea r8, [rsp + 0x2a40]
lea rdx, [rsp + 0x580]
mov rcx, r14
call fcn.0044c0a0
mov rbp, qword [rsp + 0x2a40]
test eax, eax
je 0x451b48
test rbp, rbp
je 0x451b3a
lea rsi, [rsp + 0x2a48]
mov r13d, dword [rsp + 0x30]
nop
test rsi, rsi
je 0x45152d
lea rax, [rsp + 0x2a48]
sub rsi, rax
inc rsi
mov rcx, rsi
lea rax, [rsi - 1]
cmp rax, 0x1f3
ja 0x45152d
cmp rsi, rbp
jae 0x451521
lea rsi, [rsp + rsi + 0x2a48]
jmp 0x451523
xor esi, esi
dec rcx
cmp rcx, rbp
jae 0x451541
jmp 0x451531
xor esi, esi
jmp 0x451541
cmp rcx, 0xffffffffffffffff
je 0x451541
mov rcx, qword [rsp + rcx*8 + 0x2c40]
jmp 0x451543
xor ecx, ecx
lea rdx, [rsp + 0x470]
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x451550
lea rdx, [rsp + 0x470]
lea rcx, [r14 + 0x298]
call fcn.00428550
mov dword [rsp + 0x34], 0
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x260]
mov rcx, r14
call fcn.00450730
test eax, eax
je 0x451b20
mov rax, qword [r14]
lea r8, [rsp + 0x470]
mov edi, dword [rsp + 0x34]
mov edx, edi
mov rcx, r14
call qword [rax]
test eax, eax
je 0x451b20
or r13d, edi
mov dword [rsp + 0x30], r13d
mov r8d, 0x200
lea rdx, [rsp + 0x260]
mov rcx, r14
call fcn.0044a690
test eax, eax
je 0x451b20
bts r13d, 0x1f
mov dword [rsp + 0x30], r13d
xor edi, edi
mov qword [rsp + 0x690], rdi
mov r8d, 0x1f4
mov edx, 0x4b
lea rcx, [rsp + 0x698]
call fcn.00499630
lea rax, [rsp + 0x890]
mov ecx, 0x3e
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
add rax, 0x40
mov qword [rax - 0x28], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov qword [rax - 8], rdi
dec rcx
jne 0x451615
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
lea rax, [rsp + 0x690]
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.HKLM
lea rdx, [rsp + 0x260]
lea rcx, [r14 + 0x298]
call fcn.0042bf50
test eax, eax
je 0x451750
lea rcx, [rsp + 0x690]
call fcn.00402150
mov rdi, rax
test rax, rax
je 0x45174e
nop
nop
test rdi, rdi
je 0x4516e5
lea rax, [rsp + 0x698]
sub rdi, rax
inc rdi
mov rcx, rdi
lea rax, [rdi - 1]
cmp rax, 0x1f3
ja 0x4516e5
mov rax, qword [rsp + 0x690]
cmp rdi, rax
jae 0x4516d9
lea rdi, [rsp + rdi + 0x698]
jmp 0x4516db
xor edi, edi
dec rcx
cmp rcx, rax
jae 0x4516f9
jmp 0x4516e9
xor edi, edi
jmp 0x4516f9
cmp rcx, 0xffffffffffffffff
je 0x4516f9
mov rdx, qword [rsp + rcx*8 + 0x890]
jmp 0x4516fb
xor edx, edx
mov r8, 0xffffffff80000002
mov rdx, qword [rdx + 0x18]
lea rcx, [rsp + 0x60]
call fcn.00465d20
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.00464960
test eax, eax
je 0x451743
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.00464cc0
test rdi, rdi
jne 0x4516a0
jmp 0x451750
xor edi, edi
mov rax, qword [rsp + 0x690]
test rax, rax
je 0x4517a0
nop
mov rbx, qword [rsp + rdi*8 + 0x890]
test rbx, rbx
je 0x451791
mov rcx, rbx
call fcn.00413b50
mov rcx, rbx
call fcn.0049bb84
mov qword [rsp + rdi*8 + 0x890], 0
mov rax, qword [rsp + 0x690]
inc rdi
cmp rdi, rax
jb 0x451760
lea rbx, [r14 + 0x1698]
xor edi, edi
mov qword [rsp + 0x690], rdi
mov r8d, 0x1f4
mov edx, 0x4b
lea rcx, [rsp + 0x698]
call fcn.00499630
lea rdx, [rsp + 0x690]
mov qword [rsp + 0x20], rdx
mov r9d, 3
lea r8, str.HKCR
lea rdx, [rsp + 0x260]
lea rcx, [r14 + 0x298]
call fcn.0042bf50
test eax, eax
je 0x4518c1
lea rcx, [rsp + 0x690]
call fcn.00402150
mov rdi, rax
test rax, rax
je 0x4518bf
test rdi, rdi
je 0x451856
lea rax, [rsp + 0x698]
sub rdi, rax
inc rdi
mov rcx, rdi
lea rax, [rdi - 1]
cmp rax, 0x1f3
ja 0x451856
mov rax, qword [rsp + 0x690]
cmp rdi, rax
jae 0x45184a
lea rdi, [rsp + rdi + 0x698]
jmp 0x45184c
xor edi, edi
dec rcx
cmp rcx, rax
jae 0x45186a
jmp 0x45185a
xor edi, edi
jmp 0x45186a
cmp rcx, 0xffffffffffffffff
je 0x45186a
mov rdx, qword [rsp + rcx*8 + 0x890]
jmp 0x45186c
xor edx, edx
mov r8, 0xffffffff80000000
mov rdx, qword [rdx + 0x18]
lea rcx, [rsp + 0x60]
call fcn.00465d20
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.00464960
test eax, eax
je 0x4518b4
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.00464cc0
test rdi, rdi
jne 0x451811
jmp 0x4518c1
xor edi, edi
bt dword [rsp + 0x3c38], 0x1e
jae 0x451a98
test r12, r12
je 0x451a98
mov qword [rsp + 0x1830], rdi
mov r8d, 0x1f4
mov edx, 0x4b
lea rcx, [rsp + 0x1838]
call fcn.00499630
mov qword [rsp + 0x29d0], rdi
mov qword [rsp + 0x29e0], rdi
mov qword [rsp + 0x29e8], rdi
mov qword [rsp + 0x29f8], rdi
mov qword [rsp + 0x2a00], rdi
mov qword [rsp + 0x2a10], rdi
mov qword [rsp + 0x2a20], rdi
mov qword [rsp + 0x2a30], rdi
lea rax, [rsp + 0x1a30]
mov ecx, 0x3e
nop
nop
nop
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
add rax, 0x40
mov qword [rax - 0x28], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov qword [rax - 8], rdi
dec rcx
jne 0x451950
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rsp + 0x1830]
mov r8d, 1
lea rdx, [rsp + 0x260]
lea rcx, [r14 + 0x298]
call fcn.0042a560
test eax, eax
je 0x451a8b
lea rcx, [rsp + 0x1830]
call fcn.00402150
mov rdi, rax
test rax, rax
je 0x451a89
nop
test rdi, rdi
je 0x451a25
lea rax, [rsp + 0x1838]
sub rdi, rax
inc rdi
mov rcx, rdi
lea rax, [rdi - 1]
cmp rax, 0x1f3
ja 0x451a25
mov rax, qword [rsp + 0x1830]
cmp rdi, rax
jae 0x451a19
lea rdi, [rsp + rdi + 0x1838]
jmp 0x451a1b
xor edi, edi
dec rcx
cmp rcx, rax
jae 0x451a39
jmp 0x451a29
xor edi, edi
jmp 0x451a39
cmp rcx, 0xffffffffffffffff
je 0x451a39
mov rcx, qword [rsp + rcx*8 + 0x1a30]
jmp 0x451a41
lea rcx, [rsp + 0x29d0]
lea rdx, [rsp + 0x60]
mov rcx, qword [rcx + 0x30]
call fcn.00488120
test eax, eax
jne 0x451a7e
mov dword [r12], 1
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdx, rax
nop
nop
movzx eax, byte [rcx]
mov byte [rcx + rdx + 4], al
inc rcx
test al, al
jne 0x451a70
test rdi, rdi
jne 0x4519e0
jmp 0x451a8b
xor edi, edi
lea rcx, [rsp + 0x1830]
call fcn.00404640
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x470]
mov rcx, rbx
call fcn.0047cf70
lea rcx, [r14 + 0x298]
call fcn.00424ec0
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov rax, qword [rsp + 0x690]
test rax, rax
je 0x451b20
nop
nop
mov rbx, qword [rsp + rdi*8 + 0x890]
test rbx, rbx
je 0x451b11
mov rcx, rbx
call fcn.00413b50
mov rcx, rbx
call fcn.0049bb84
mov qword [rsp + rdi*8 + 0x890], 0
mov rax, qword [rsp + 0x690]
inc rdi
cmp rdi, rax
jb 0x451ae0
lea rbx, [r14 + 0x1698]
test rsi, rsi
jne 0x4514f0
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
lea r15, [r14 + 0x16a0]
lea rcx, [rsp + 0x580]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea r9, [rsp + 0x30]
mov r8, r15
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov rcx, r14
call fcn.0044cc40
lea r9, [rsp + 0x30]
mov r8, r15
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
mov rcx, r14
call fcn.0044cc40
call fcn.004545a0
mov ebx, dword [rsp + 0x30]
test eax, eax
je 0x451bf5
mov r8d, ebx
lea rdx, str.KINIFile::UninstallINIFiles_:_dwRetFlags___d_n
lea rcx, [rsp + 0x60]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x370], rdx
lea rdi, [rsp + 0x370]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x451bc3
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x370]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
test r13, r13
je 0x451c0b
mov rcx, rsi
call fcn.0049bb84
mov rcx, r13
call fcn.0049bb84
nop
xor esi, esi
mov rdi, rsi
test rbp, rbp
je 0x451c4a
nop
nop
nop
mov rcx, qword [rsp + rdi*8 + 0x2c40]
test rcx, rcx
je 0x451c42
call fcn.0049bb84
mov qword [rsp + rdi*8 + 0x2c40], rsi
mov rbp, qword [rsp + 0x2a40]
inc rdi
cmp rdi, rbp
jb 0x451c20
mov eax, ebx
mov rbx, qword [rsp + 0x3c20]
mov rbp, qword [rsp + 0x3c18]
mov rsi, qword [rsp + 0x3c10]
mov rdi, qword [rsp + 0x3c08]
mov r12, qword [rsp + 0x3c00]
mov r13, qword [rsp + 0x3bf8]
mov r14, qword [rsp + 0x3bf0]
mov r15, qword [rsp + 0x3be8]
add rsp, 0x3c28
ret