Function at 0x414400
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ef77
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x455d50]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
push str.Advanced_System_Repair_Pro_App
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x414457
mov ecx, eax
call fcn.00411e10
cmp byte [0x45a377], 0
jne 0x414473
mov dword [ebp - 4], 5
call fcn.00406690
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 7
lea eax, [ebp - 0x234]
push eax
call fcn.00421080
add esp, 4
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x234]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x41450a
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x22c]
push eax
mov ebx, str._asrrealtimesrv.exe
call fcn.0040b740
mov bl, 9
mov byte [ebp - 4], bl
add esp, 4
mov ecx, esp
mov dword [ebp - 0x230], esp
push ecx
mov ecx, str.tscmon
call fcn.00411fe0
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], bl
call fcn.00416650
mov edx, esp
mov dword [ebp - 0x230], esp
push edx
mov ecx, str.asrrealtimesrv
call fcn.00411fe0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], bl
call fcn.00416650
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.0040d9c0
mov eax, dword [ebp - 0x234]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4147a1
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x22c]
push edx
mov ebx, 0x448b5c
call fcn.0040b740
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x228]
push eax
mov ebx, str.AdvancedSystemRepairPro.exe
call fcn.0040b740
add esp, 0x10
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x22c]
call fcn.0040d9c0
mov ecx, dword [ebp - 0x228]
push ecx
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push SysReAllocString
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call esi
mov edx, dword [ebp - 0x228]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call esi
call fcn.00403f40
test al, al
jne 0x414781
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push eax
lea ecx, [ebp - 0x222]
push ecx
call fcn.0042ace0
add esp, 0xc
push 1
push 2
lea edx, [ebp - 0x224]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x224]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4145d0
mov eax, dword [0x448b5c]
mov dword [edi], eax
lea edi, [ebp - 0x224]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4145f0
mov ecx, 0xd
mov esi, 0x448bc4
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 3
lea ecx, [ebp - 0x22c]
push ecx
call fcn.0040c860
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x238]
push edx
call fcn.0041e5e0
mov bl, 0x10
mov byte [ebp - 4], bl
push 0x448dec
push 0x448dec
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
lea ecx, [ebp - 0x224]
call fcn.00411fe0
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0040ea50
add esp, 4
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
lea edi, [ebp - 0x238]
call fcn.00416b20
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.00421e80
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
mov ecx, str.asrtskrb.vbs
call fcn.00411fe0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x244]
push ecx
mov byte [ebp - 4], bl
call fcn.00412d10
mov byte [ebp - 4], 0x14
add esp, 4
mov edx, esp
mov dword [ebp - 0x240], esp
lea eax, [ebp - 0x244]
push eax
push edx
call fcn.00413070
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x238]
mov edi, dword [ecx - 0xc]
lea esi, [ebp - 0x238]
call fcn.00411d30
push eax
mov byte [ebp - 4], 0x14
call fcn.00412740
add esp, 8
lea edx, [ebp - 0x23c]
push edx
call fcn.0041b1c0
mov byte [ebp - 4], 0x16
lea esi, [ebp - 0x244]
call fcn.0041fd00
push eax
push str.wscript.exe___B___T:10___s_
lea edi, [ebp - 0x23c]
call fcn.004062c0
add esp, 4
mov eax, esp
mov dword [ebp - 0x240], esp
mov ecx, edi
push ecx
push eax
call fcn.00413070
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x16
call fcn.00406040
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x14
mov ecx, edi
call fcn.0040d9c0
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.0040d9c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x238]
call fcn.00421e80
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x22c]
call fcn.00421e80
push 1
lea edx, [ebp - 0x234]
push edx
call fcn.00415660
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x228]
call fcn.0040d9c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x234]
call fcn.0040d9c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x19
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAdvanced_System_Repair_Pro
push SysReAllocString
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call esi
push 0
xor ecx, ecx
call fcn.00418e20
add esp, 4
push 2
lea edi, [ebp - 0x228]
call fcn.00415110
add esp, 4
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x230]
push eax
mov ebx, 0x448b5c
call fcn.0040b740
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x22c]
push ecx
mov ebx, 0x448bc4
call fcn.0040b740
add esp, 0x10
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x230]
call fcn.0040d9c0
mov bl, 0x1e
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0040d9c0
push 1
lea edx, [ebp - 0x22c]
push edx
call fcn.00415660
push 1
lea eax, [ebp - 0x230]
push eax
call fcn.0040d110
add esp, 0x10
mov byte [ebp - 4], 0x1f
mov eax, dword [eax]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0040d9c0
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.0040d110
add esp, 8
mov byte [ebp - 4], 0x20
mov eax, dword [eax]
push eax
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0040d9c0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x22c]
call fcn.0040d9c0
mov dword [ebp - 4], 0xffffffff
jmp 0x4148ec
mov dword [ebp - 4], 0x22
cmp byte [ebp + 8], 0
jne 0x4148fe
call fcn.004178d0
push str.SoftwareAdvancedSystemRepairPro
push SysReAllocString
call esi
push str.SoftwareAdvancedSystemRepairPro
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x24
mov dword [ebp - 4], 0xffffffff
jmp 0x414963
mov ebx, 0x26
mov dword [ebp - 4], ebx
cmp byte [ebp + 8], 0
jne 0x414a22
push 0x23
lea edi, [ebp - 0x228]
call fcn.00415110
add esp, 4
mov byte [ebp - 4], 0x27
mov edx, 0x448b60
call fcn.00416450
push 1
mov edx, edi
push edx
call fcn.00415660
add esp, 8
push str.SOFTWAREClassesAppID_asrrealtimesrv.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesAppID233F8F82_F91E_4E49_2222_BD21AB39D1BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesAppID2245B082_41FA_478E_8DEA_86177F1394BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesCLSID233F8F82_F91E_4E49_2222_BD21AB39D1BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface23387882_DEAA_4971_2222_5D5046F2B3BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface2532D782_C4FC_4ED8_2222_D654E27AF7F8
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface2F343382_EFC2_49C9_2222_FC0C403B0EBB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesTypeLib23311E82_B997_11CF_2222_0080C7B2D6BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClasses_asrrealtimesrv.Gate
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClasses_asrrealtimesrv.Gate.1
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0040d9c0
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00404b64
mov esp, ebp
pop ebp
ret