Function at 0x401a90
Capabilities:
Delete directory
Delete file
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0x610
push ebx
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
mov byte [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x520], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x521]
mov byte [esp + 0x420], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x421]
mov byte [esp + 0x320], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x321]
mov dword [esp + 0x18], 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push str.zbtFilePath
push str.SoftwarezbtVersion
call fcn.00401570
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x530]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x430]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esp
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x324]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, esp
push str.cbt.dll
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.cbt_zh_CN.qm
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push edx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.cbte.exe
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.config.dat
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.default.css
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push edx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.logo.ico
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.logo.jpg
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.normal_feed.css
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push edx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.normal_feed.html
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.phonon4.dll
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.plain_author_feed.html
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push edx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.plain_feed.html
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.QtCore4.dll
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.QtGui4.dll
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push edx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.QtNetwork4.dll
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.QtWebKit4.dll
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.repost_feed.html
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push edx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.sysConfig.in
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.weibo.emo
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.UHARC.EXE
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push edx
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ifvs2008.bat
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004017e0
add esp, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push str.vcredist_2008_x86.exe
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
call fcn.004017e0
mov edi, str.codecs_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x228]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x228]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401640
mov edi, str.imageformats_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x52c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
lea eax, [esp + 0x52c]
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00401640
mov edi, str.images_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x430]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x430]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401640
mov edi, str.skin_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x334]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x334]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401640
push str.DisplayName
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallzhoubotong
call fcn.004015f0
push str.DisplayVersion
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallzhoubotong
call fcn.004015f0
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallzhoubotong
call fcn.004015f0
push str.zbtVersion
push str.Software_
push 0x80000002
call fcn.00401160
push str.chouboto
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004015f0
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0x44
lea ecx, [esp + 0x11c]
push 0
push 0
push ecx
push 0
call ebp
mov edi, 0x404230
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
and ecx, 3
lea eax, [esp + 0x11c]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11c]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x120]
push 0x16
push ecx
push 0
stosb byte es:[edi], al
call ebp
mov edi, 0x404218
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x11c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40420c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11c]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x120]
push 0x16
push ecx
push 0
stosb byte es:[edi], al
call ebp
lea edx, [esp + 0x11c]
mov edi, 0x404218
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x11c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x404230
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11c]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x120]
push 0x16
push ecx
push 0
stosb byte es:[edi], al
call ebp
mov edi, 0x404218
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x14]
push 0
push 0x404050
push 0x4041dc
call sub.MFC42.DLL_CWnd::MessageBoxA
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x610
ret