Function at 0x4044fe
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x720
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x134]
xor ebx, ebx
cmp dword [eax + 0xd9a0], ebx
mov dword [ebp - 8], ebx
je 0x404527
cmp dword [0x415b48], ebx
je 0x40452f
push 1
pop eax
jmp 0x404ab8
test byte [eax + 0x3401], 2
push edi
mov edi, 0xb5e
je 0x4045a1
lea ecx, [eax + 0x42]
push ecx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0x134]
add eax, edi
push eax
call fcn.0040878e
mov eax, dword [esi + 0x134]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
lea ecx, [eax + 0x32fc]
push ecx
add eax, edi
push eax
call ebx
mov eax, dword [esi + 0x134]
add eax, edi
push eax
call fcn.0040878e
mov eax, dword [esi + 0x134]
add eax, edi
mov dword [esp], str.epuninst.exe
push eax
call ebx
mov eax, dword [esi + 0x134]
and byte [eax + 0xc62], 0
xor ebx, ebx
mov eax, dword [esi + 0x134]
push dword [eax + 0xd9a0]
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x134]
add eax, edi
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 0x80
push 2
push ebx
push 3
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x21c]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4046c7
and dword [ebp - 0xc], 0
mov ecx, dword [esi + 0x134]
mov ecx, dword [ecx + 0xd9a0]
mov byte [ecx], 0x49
mov ecx, dword [esi + 0x134]
mov ecx, dword [ecx + 0xd9a0]
and byte [ecx + 1], 0
mov ecx, dword [esi + 0x134]
mov ecx, dword [ecx + 0xd9a0]
mov byte [ecx + 2], 0x2d
mov ecx, dword [esi + 0x134]
mov ecx, dword [ecx + 0xd9a0]
mov byte [ecx + 3], 0x6c
push 0
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 4]
mov ecx, dword [esi + 0x134]
push dword [ecx + 0xd9a0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40466a
mov dword [0x415b48], 8
jmp 0x404a7e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x21c]
push str.epuninst.exe
push eax
call fcn.00402f81
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], eax
jne 0x40469c
mov dword [0x415b48], 8
jmp 0x404a90
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 0x80
push 2
push 0
push 3
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x21c]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 8], ebx
jne 0x4046d6
mov dword [0x415b48], 7
jmp 0x404a90
and dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40465b
push str._EXEpress_Uninstaller_
push ebx
call fcn.00404abc
test eax, eax
pop ecx
pop ecx
je 0x404a7e
push str._Options_
push ebx
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
push str.DeleteSubFolders0
push ebx
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add eax, 0xa5a
push eax
lea eax, [ebp - 0x114]
push str.UninstallKey_s
push eax
call edi
lea eax, [ebp - 0x114]
push eax
push ebx
call fcn.00404b1f
add esp, 0x14
test eax, eax
je 0x404a7e
push str._Files_
push ebx
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
and dword [ebp - 4], 0
cmp dword [0x415b48], 0
jne 0x404a7e
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.00403f2c
test eax, eax
pop ecx
pop ecx
je 0x404854
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x720]
push eax
call ebx
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x721], 0x5c
je 0x40481a
cmp byte [ebp - 0x113], 0x3a
je 0x40481a
mov eax, dword [esi + 0x134]
add eax, 0x42
push eax
lea eax, [ebp - 0x720]
push eax
call ebx
lea eax, [ebp - 0x720]
push eax
call fcn.0040878e
pop ecx
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x720]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x114]
push str._d_s
push eax
call edi
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call fcn.00404b1f
add esp, 0x18
test eax, eax
je 0x404a7e
inc dword [ebp - 4]
jmp 0x40478c
push str._Registry_CLASSES_ROOT_
push dword [ebp + 8]
xor edi, edi
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
cmp dword [eax + 0x1278], edi
mov ebx, 0x104
jle 0x4048bd
and dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
cmp byte [ecx + eax + 0x127c], 0x30
lea eax, [ecx + eax + 0x127c]
jne 0x4048bd
inc eax
push eax
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
add dword [ebp - 4], ebx
inc edi
cmp edi, dword [eax + 0x1278]
jl 0x404883
push str._Registry_CURRENT_USER_
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
cmp edi, dword [eax + 0x1278]
jge 0x404929
mov ecx, edi
imul ecx, ecx, 0x104
mov dword [ebp - 4], ecx
jmp 0x4048f2
mov ecx, dword [ebp - 4]
cmp byte [ecx + eax + 0x127c], 0x31
lea eax, [ecx + eax + 0x127c]
jne 0x404929
inc eax
push eax
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
add dword [ebp - 4], ebx
inc edi
cmp edi, dword [eax + 0x1278]
jl 0x4048ef
push str._Registry_LOCAL_MACHINE_
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
cmp edi, dword [eax + 0x1278]
jge 0x404995
mov ecx, edi
imul ecx, ecx, 0x104
mov dword [ebp - 4], ecx
jmp 0x40495e
mov ecx, dword [ebp - 4]
cmp byte [ecx + eax + 0x127c], 0x32
lea eax, [ecx + eax + 0x127c]
jne 0x404995
inc eax
push eax
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
add dword [ebp - 4], ebx
inc edi
cmp edi, dword [eax + 0x1278]
jl 0x40495b
push str._Registry_USERS_
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
cmp edi, dword [eax + 0x1278]
jge 0x404a01
mov ecx, edi
imul ecx, ecx, 0x104
mov dword [ebp - 4], ecx
jmp 0x4049ca
mov ecx, dword [ebp - 4]
cmp byte [ecx + eax + 0x127c], 0x33
lea eax, [ecx + eax + 0x127c]
jne 0x404a01
inc eax
push eax
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
mov eax, dword [esi + 0x134]
add dword [ebp - 4], ebx
inc edi
cmp edi, dword [eax + 0x1278]
jl 0x4049c7
push str._Group_
push dword [ebp + 8]
call fcn.00404b1f
test eax, eax
pop ecx
pop ecx
je 0x404a7e
call fcn.004086ef
test eax, eax
je 0x404a33
mov eax, dword [esi + 0x134]
test byte [eax + 0x3402], 4
je 0x404a33
push str.CommonGroup1
jmp 0x404a38
push str.CommonGroup0
push dword [ebp + 8]
call fcn.00404b1f
pop ecx
pop ecx
push 0x412680
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0x134]
add eax, 0xd66
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call fcn.00404b1f
pop ecx
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x415b48], 0
je 0x404a9d
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 8], 0
pop edi
je 0x404aad
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
cmp dword [0x415b48], eax
sete al
pop esi
pop ebx
leave
ret