Function at 0x44d040
Capabilities:
Check os version
Copy file
Delete file
Get common file path
Get installed programs
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48ef26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5f4
push ebx
push ebp
mov ebp, ecx
push esi
push edi
push 0x4b61a0
lea ebx, [ebp + 0xc4]
mov dword [esp + 0x4c], ebp
mov ecx, ebx
mov dword [esp + 0x3c], ebx
call fcn.0047c27c
lea esi, [ebp + 0xd0]
push str.PCClearPlusUpdate_1_.exe
lea eax, [esp + 0x34]
push esi
push eax
call fcn.0047c388
xor edi, edi
lea ecx, [esp + 0xa4]
mov dword [esp + 0x60c], edi
call fcn.0045c65a
mov ecx, dword [esp + 0x30]
push edi
push ecx
lea ecx, [esp + 0xac]
mov byte [esp + 0x614], 1
call fcn.0045c71d
test eax, eax
je 0x44d13a
push str.PCClearPlusUpdate.exe
lea edx, [esp + 0x28]
push esi
push edx
call fcn.0047c388
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push eax
push ecx
xor esi, esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test eax, eax
je 0x44d120
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
push 0
push edx
push eax
call edi
call ebp
cmp esi, 0xa
jg 0x44d11c
inc esi
test eax, eax
jne 0x44d0fb
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x24]
call fcn.0047c0f3
mov ebp, dword [esp + 0x48]
xor edi, edi
lea ecx, [esp + 0xa4]
call fcn.0045c6d3
lea ecx, [esp + 0x88]
mov dword [esp + 0x28], edi
call fcn.0047de67
lea ecx, [esp + 0x54]
mov byte [esp + 0x60c], 2
call fcn.0047d0cc
mov edx, dword [0x4b20c8]
mov dword [esp + 0x64], edx
mov dword [esp + 0x5c], edi
mov esi, vtable.CFileException.0
or edi, 0xffffffff
push 0
lea ecx, [esp + 0x68]
mov byte [esp + 0x610], 4
mov dword [esp + 0x58], esi
mov dword [esp + 0x64], edi
call fcn.0047c27c
lea eax, [ebp + 0xd0]
push 0x4ad124
push eax
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x618], 5
call fcn.0047c388
push str.VerChk_01.txt
lea ecx, [esp + 0x40]
mov byte [esp + 0x610], 6
call fcn.0047c4cf
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x54]
push ecx
push 0
push edx
lea ecx, [esp + 0x94]
call fcn.0047df75
test eax, eax
mov eax, dword [0x4b20c8]
jne 0x44d23d
mov dword [esp + 0x38], eax
push 0
push 0x400
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x618], 7
call fcn.0047dade
lea ecx, [esp + 0x38]
mov byte [esp + 0x60c], 6
call fcn.0047c0f3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60c], 5
call fcn.0047c0f3
mov dword [esp + 0x54], esi
mov byte [esp + 0x60c], 8
jmp 0x44dc14
mov dword [esp + 0x18], eax
mov byte [esp + 0x60c], 9
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x8c]
call fcn.0047e158
test eax, eax
je 0x44db46
mov edx, dword [esp + 0x18]
push 0x4b61a0
push edx
call fcn.00463ffe
add esp, 8
test eax, eax
je 0x44db46
mov eax, dword [0x4b20c8]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x18]
push 9
push 0
lea ecx, [esp + 0x3c]
push eax
push ecx
mov byte [esp + 0x61c], 0x14
call fcn.0047c72f
mov edx, dword [esp + 0x18]
push 9
push 1
lea eax, [esp + 0x24]
push edx
push eax
call fcn.0047c72f
mov ecx, dword [esp + 0x1c]
push 0x4b1218
push ecx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x44d3b5
lea ecx, [esp + 0x4c]
mov byte [esp + 0x60c], 0x13
call fcn.0047c0f3
lea ecx, [esp + 0x40]
mov byte [esp + 0x60c], 0x12
call fcn.0047c0f3
lea ecx, [esp + 0x50]
mov byte [esp + 0x60c], 0x11
call fcn.0047c0f3
lea ecx, [esp + 0x44]
mov byte [esp + 0x60c], 0x10
call fcn.0047c0f3
lea ecx, [esp + 0x24]
mov byte [esp + 0x60c], 0xf
call fcn.0047c0f3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60c], 0xe
call fcn.0047c0f3
lea ecx, [esp + 0x20]
mov byte [esp + 0x60c], 0xd
call fcn.0047c0f3
lea ecx, [esp + 0x10]
mov byte [esp + 0x60c], 0xc
call fcn.0047c0f3
lea ecx, [esp + 0x14]
mov byte [esp + 0x60c], 0xb
call fcn.0047c0f3
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60c], 0xa
call fcn.0047c0f3
lea ecx, [esp + 0x34]
mov byte [esp + 0x60c], 9
call fcn.0047c0f3
jmp 0x44d249
mov edx, dword [esp + 0x18]
push 9
push 3
lea eax, [esp + 0x28]
push edx
push eax
call fcn.0047c72f
mov ecx, dword [esp + 0x18]
push 9
push 4
lea edx, [esp + 0x34]
push ecx
push edx
call fcn.0047c72f
mov eax, dword [esp + 0x18]
push 9
push 5
lea ecx, [esp + 0x48]
push eax
push ecx
call fcn.0047c72f
mov edx, dword [esp + 0x18]
push 9
push 6
lea eax, [esp + 0x58]
push edx
push eax
call fcn.0047c72f
mov ecx, dword [esp + 0x18]
push 9
push 7
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0047c72f
mov eax, dword [esp + 0x18]
push 9
push 8
lea ecx, [esp + 0x4c]
push eax
push ecx
call fcn.0047c72f
mov edx, dword [esp + 0x2c]
push edx
call fcn.00463fa1
add esp, 4
cmp eax, 6
jne 0x44d44c
mov eax, dword [esp + 0x18]
push 9
push 9
lea ecx, [esp + 0x54]
push eax
push ecx
call fcn.0047c72f
mov edx, dword [esp + 0x20]
push edx
call fcn.00463fa1
add esp, 4
test eax, eax
jne 0x44d496
lea eax, [ebp + 0xd0]
push 0x4ad124
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x610], 0x15
call fcn.0047c22c
mov byte [esp + 0x60c], 0x14
lea ecx, [esp + 0x6c]
jmp 0x44d5d8
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00463fa1
add esp, 4
cmp eax, 1
jne 0x44d4ef
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1fc]
lea edx, [esp + 0x1fc]
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x14]
call fcn.0047c27c
push 0x4ad124
lea ecx, [esp + 0x14]
call fcn.0047c4cf
jmp 0x44d5dd
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00463fa1
add esp, 4
cmp eax, 2
jne 0x44d52d
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x400]
lea edx, [esp + 0x400]
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x400]
jmp 0x44d4d2
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00463fa1
add esp, 4
cmp eax, 3
jne 0x44d58c
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xf8]
lea edx, [esp + 0xf8]
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
lea eax, [esp + 0x508]
push 0
lea ecx, [esp + 0x70]
push eax
lea edx, [esp + 0x104]
push ecx
push edx
call fcn.004640ad
add esp, 0x14
lea eax, [esp + 0x68]
jmp 0x44d4d2
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00463fa1
add esp, 4
cmp eax, 4
jne 0x44d5dd
lea eax, [ebp + 0xd0]
push str.data_
lea edx, [esp + 0x88]
push eax
push edx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x610], 0x16
call fcn.0047c22c
mov byte [esp + 0x60c], 0x14
lea ecx, [esp + 0x84]
call fcn.0047c0f3
lea eax, [esp + 0x34]
lea ecx, [esp + 0x10]
push eax
call fcn.0047c50b
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00463fa1
add esp, 4
sub eax, 0
je 0x44d6b4
sub eax, 4
je 0x44d60f
sub eax, 2
jne 0x44d6fd
push 0x4b61a0
lea ecx, [esp + 0x18]
call fcn.0047c27c
lea eax, [ebp + 0xd0]
push str.Version.dat
lea edx, [esp + 0x4c]
push eax
push edx
call fcn.0047c388
mov edx, dword [esp + 0x34]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x300]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x300]
push eax
push 0x100
push ecx
push 0
push edx
push str.VERSION
mov byte [esp + 0x624], 0x18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x300]
lea ecx, [esp + 0x14]
push eax
call fcn.0047c27c
mov ecx, dword [esp + 0x34]
push str.xndb.ads
push ecx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x44d6a6
lea edx, [esp + 0x14]
lea ecx, [ebp + 0xc0]
push edx
call fcn.0047c22c
mov byte [esp + 0x60c], 0x14
lea ecx, [esp + 0x48]
jmp 0x44d6f8
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0xa4], esp
push eax
call fcn.0047be68
lea ecx, [esp + 0x84]
push ecx
mov ecx, ebp
call fcn.0044c9e0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x610], 0x17
call fcn.0047c22c
mov byte [esp + 0x60c], 0x14
lea ecx, [esp + 0x80]
call fcn.0047c0f3
push 0x4b61a0
push 0x4ad5e8
lea ecx, [esp + 0x1c]
call fcn.00475ae6
push 0x4b61a0
push 0x4ad5ec
lea ecx, [esp + 0x1c]
call fcn.00475ae6
push 0x4b61a0
push 0x4ad134
lea ecx, [esp + 0x1c]
call fcn.00475ae6
push 0x4b61a0
push 0x4ad5e8
lea ecx, [esp + 0x24]
call fcn.00475ae6
push 0x4b61a0
push 0x4ad5ec
lea ecx, [esp + 0x24]
call fcn.00475ae6
push 0x4b61a0
push 0x4ad134
lea ecx, [esp + 0x24]
call fcn.00475ae6
mov edx, dword [esp + 0x2c]
xor esi, esi
push edx
call fcn.00463fa1
add esp, 4
cmp eax, 6
je 0x44daa9
mov eax, dword [esp + 0x14]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
je 0x44d9f5
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00463fa1
mov edx, dword [esp + 0x20]
mov edi, eax
push edx
call fcn.00463fa1
add esp, 8
cmp eax, edi
jle 0x44d7cb
mov dword [esp + 0x28], 1
jmp 0x44d856
mov eax, dword [esp + 0x10]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
je 0x44d92d
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00463fa1
add esp, 4
test eax, eax
jne 0x44d92d
lea ecx, [esp + 0xdc]
call fcn.0045c65a
mov edx, dword [esp + 0x10]
push 0
push edx
lea ecx, [esp + 0xe4]
mov byte [esp + 0x614], 0x19
call fcn.0045c71d
test eax, eax
jne 0x44d82e
mov esi, 1
mov dword [esp + 0x28], esi
lea ecx, [esp + 0xdc]
call fcn.0045c6d3
mov byte [esp + 0x60c], 0x14
lea ecx, [esp + 0xdc]
call fcn.0045c697
test esi, esi
je 0x44d92d
lea ecx, [esp + 0x24]
push 0x4ae968
lea edx, [esp + 0x7c]
push ecx
push edx
call fcn.0047c388
push eax
mov ecx, ebx
mov byte [esp + 0x610], 0x1b
call fcn.0047c50b
lea ecx, [esp + 0x78]
mov byte [esp + 0x60c], 0x14
call fcn.0047c0f3
lea eax, [esp + 0x44]
push 0x4ae968
lea ecx, [esp + 0x74]
push eax
push ecx
call fcn.0047c388
push eax
mov ecx, ebx
mov byte [esp + 0x610], 0x1c
call fcn.0047c50b
lea ecx, [esp + 0x70]
mov byte [esp + 0x60c], 0x14
call fcn.0047c0f3
lea edx, [esp + 0x34]
push 0x4ad5ec
lea eax, [esp + 0x78]
push edx
push eax
call fcn.0047c388
push eax
mov ecx, ebx
mov byte [esp + 0x610], 0x1d
call fcn.0047c50b
lea ecx, [esp + 0x74]
mov byte [esp + 0x60c], 0x14
call fcn.0047c0f3
lea ecx, [esp + 0x1c]
push 0x4ae968
lea edx, [esp + 0x80]
push ecx
push edx
call fcn.0047c388
push eax
mov ecx, ebx
mov byte [esp + 0x610], 0x1e
call fcn.0047c50b
lea ecx, [esp + 0x7c]
mov byte [esp + 0x60c], 0x14
call fcn.0047c0f3
lea ecx, [esp + 0x4c]
mov byte [esp + 0x60c], 0x13
call fcn.0047c0f3
lea ecx, [esp + 0x40]
mov byte [esp + 0x60c], 0x12
call fcn.0047c0f3
lea ecx, [esp + 0x50]
mov byte [esp + 0x60c], 0x11
call fcn.0047c0f3
lea ecx, [esp + 0x44]
mov byte [esp + 0x60c], 0x10
call fcn.0047c0f3
lea ecx, [esp + 0x24]
mov byte [esp + 0x60c], 0xf
call fcn.0047c0f3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60c], 0xe
call fcn.0047c0f3
lea ecx, [esp + 0x20]
mov byte [esp + 0x60c], 0xd
call fcn.0047c0f3
lea ecx, [esp + 0x10]
mov byte [esp + 0x60c], 0xc
call fcn.0047c0f3
lea ecx, [esp + 0x14]
mov byte [esp + 0x60c], 0xb
call fcn.0047c0f3
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60c], 0xa
call fcn.0047c0f3
lea ecx, [esp + 0x34]
mov byte [esp + 0x60c], 9
call fcn.0047c0f3
or edi, 0xffffffff
mov esi, vtable.CFileException.0
jmp 0x44d249
mov eax, dword [esp + 0x10]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
je 0x44d92d
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00463fa1
add esp, 4
test eax, eax
jne 0x44da86
lea ecx, [esp + 0xc0]
call fcn.0045c65a
mov edx, dword [esp + 0x10]
push 0
push edx
lea ecx, [esp + 0xc8]
mov byte [esp + 0x614], 0x1a
call fcn.0045c71d
test eax, eax
je 0x44da5d
mov eax, dword [esp + 0x2c]
push eax
call fcn.00463fa1
add esp, 4
cmp eax, 4
jne 0x44da66
mov esi, 1
mov dword [esp + 0x28], esi
lea ecx, [esp + 0xc0]
call fcn.0045c6d3
mov byte [esp + 0x60c], 0x14
lea ecx, [esp + 0xc0]
jmp 0x44d849
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00463fa1
add esp, 4
cmp eax, 4
jne 0x44d92d
mov dword [esp + 0x28], 1
jmp 0x44d856
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x38]
xor esi, esi
push edx
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x44daef
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x9c]
push eax
push 0x20019
push esi
push ecx
push edx
call edi
test eax, eax
jne 0x44daef
mov esi, 1
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x44d92d
mov ecx, dword [esp + 0x14]
push 0x4b61a0
push ecx
call fcn.00463ffe
add esp, 8
test eax, eax
je 0x44db39
mov edx, dword [esp + 0x14]
push edx
call fcn.00463fa1
mov esi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00463fa1
add esp, 8
cmp eax, esi
jle 0x44d92d
mov dword [esp + 0x28], 1
jmp 0x44d856
lea ecx, [esp + 0x18]
mov byte [esp + 0x60c], 6
call fcn.0047c0f3
lea ecx, [esp + 0x88]
call fcn.0047e2a5
mov eax, dword [ebx]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x44db96
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60c], 5
call fcn.0047c0f3
mov dword [esp + 0x54], esi
mov byte [esp + 0x60c], 0x1f
jmp 0x44dc14
mov eax, dword [esp + 0x28]
mov byte [esp + 0x60c], 5
test eax, eax
lea ecx, [esp + 0x3c]
je 0x44dc03
call fcn.0047c0f3
mov dword [esp + 0x54], esi
lea ecx, [esp + 0x64]
mov byte [esp + 0x60c], 0x20
call fcn.0047c0f3
lea ecx, [esp + 0x88]
mov byte [esp + 0x60c], 1
call fcn.0047df32
lea ecx, [esp + 0xa4]
mov byte [esp + 0x60c], 0
call fcn.0045c697
lea ecx, [esp + 0x30]
mov dword [esp + 0x60c], edi
call fcn.0047c0f3
mov eax, 1
jmp 0x44dc57
call fcn.0047c0f3
mov dword [esp + 0x54], esi
mov byte [esp + 0x60c], 0x21
lea ecx, [esp + 0x64]
call fcn.0047c0f3
lea ecx, [esp + 0x88]
mov byte [esp + 0x60c], 1
call fcn.0047df32
lea ecx, [esp + 0xa4]
mov byte [esp + 0x60c], 0
call fcn.0045c697
lea ecx, [esp + 0x30]
mov dword [esp + 0x60c], edi
call fcn.0047c0f3
xor eax, eax
mov ecx, dword [esp + 0x604]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x600
ret