Function at 0x40d480
Capabilities:
Create directory
Delete file
Delete registry key
Delete registry value
Get common file path
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x487e81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3f4
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x2c], ecx
call fcn.004834fa
mov ebp, dword [eax + 4]
mov eax, dword [0x4b20c8]
mov dword [esp + 0x38], eax
lea ebx, [ebp + 0xd0]
push str.data
lea ecx, [esp + 0x28]
push ebx
push ecx
mov dword [esp + 0x418], 0
call fcn.0047c388
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x410], 1
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0
call fcn.0047c0f3
lea ecx, [esp + 0xe0]
call fcn.0045c65a
mov edx, dword [esp + 0x38]
push 0
push edx
lea ecx, [esp + 0xe8]
mov byte [esp + 0x414], 2
call fcn.0045c71d
test eax, eax
jne 0x40d54d
lea eax, [esp + 0x38]
push 0x4ad124
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
mov edx, dword [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x14]
call fcn.0047c0f3
lea ecx, [esp + 0xe0]
call fcn.0045c6d3
push str.PCClearTB.exe
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.0047c388
lea ecx, [esp + 0x44]
mov byte [esp + 0x40c], 3
call fcn.0045c65a
mov ecx, dword [esp + 0x20]
push 0
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x414], 4
call fcn.0045c71d
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40d5a3
mov edx, dword [esp + 0x20]
push edx
call esi
lea ecx, [esp + 0x44]
call fcn.0045c6d3
push str.PCClearPlusTB.exe
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x410], 5
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 4
call fcn.0047c0f3
mov ecx, dword [esp + 0x20]
push 0
push ecx
lea ecx, [esp + 0x4c]
call fcn.0045c71d
test eax, eax
je 0x40d5fa
mov edx, dword [esp + 0x20]
push edx
call esi
lea ecx, [esp + 0x44]
call fcn.0045c6d3
push str._bar.exe
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x410], 6
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 4
call fcn.0047c0f3
mov ecx, dword [esp + 0x20]
push 0
push ecx
lea ecx, [esp + 0x4c]
call fcn.0045c71d
test eax, eax
je 0x40d651
mov edx, dword [esp + 0x20]
push edx
call esi
lea ecx, [esp + 0x44]
call fcn.0045c6d3
push str._setup_oneclick.exe
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x410], 7
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 4
call fcn.0047c0f3
mov ecx, dword [esp + 0x20]
push 0
push ecx
lea ecx, [esp + 0x4c]
call fcn.0045c71d
test eax, eax
je 0x40d6a8
mov edx, dword [esp + 0x20]
push edx
call esi
lea ecx, [esp + 0x44]
call fcn.0045c6d3
push str._setup_activex.exe
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x410], 8
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 4
call fcn.0047c0f3
mov ecx, dword [esp + 0x20]
push 0
push ecx
lea ecx, [esp + 0x4c]
call fcn.0045c71d
test eax, eax
je 0x40d6ff
mov edx, dword [esp + 0x20]
push edx
call esi
lea ecx, [esp + 0x44]
call fcn.0045c6d3
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1fc]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x1fc]
push ecx
lea ecx, [esp + 0x24]
call fcn.0047c27c
push str.PCClearPlusCG.exe
lea ecx, [esp + 0x24]
call fcn.0047c4cf
mov edx, dword [esp + 0x20]
push edx
call esi
lea eax, [esp + 0x1fc]
lea ecx, [esp + 0x20]
push eax
call fcn.0047c27c
push str.PCClearPlusSH.exe
lea ecx, [esp + 0x24]
call fcn.0047c4cf
mov ecx, dword [esp + 0x20]
push ecx
call esi
lea edx, [esp + 0x1fc]
lea ecx, [esp + 0x20]
push edx
call fcn.0047c27c
push str.PCClearL.dll
lea ecx, [esp + 0x24]
call fcn.0047c4cf
mov eax, dword [esp + 0x20]
push eax
call esi
lea ecx, [esp + 0x1fc]
push ecx
lea ecx, [esp + 0x24]
call fcn.0047c27c
push str.PCClearR.exe
lea ecx, [esp + 0x24]
call fcn.0047c4cf
mov edx, dword [esp + 0x20]
push edx
call esi
lea eax, [esp + 0x1fc]
lea ecx, [esp + 0x20]
push eax
call fcn.0047c27c
push str.PCClearPlusR.exe
lea ecx, [esp + 0x24]
call fcn.0047c4cf
mov ecx, dword [esp + 0x20]
push ecx
call esi
lea edx, [esp + 0x1fc]
lea ecx, [esp + 0x20]
push edx
call fcn.0047c27c
push str.PCClear_Plus_R.exe
lea ecx, [esp + 0x24]
call fcn.0047c4cf
mov eax, dword [esp + 0x20]
push eax
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1fc]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x200]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
lea edx, [esp + 0x308]
lea eax, [esp + 0x48]
push edx
lea ecx, [esp + 0x208]
push eax
push ecx
call fcn.004640ad
add esp, 0x14
lea edx, [esp + 0x40]
lea ecx, [esp + 0x3c]
push edx
call fcn.0047c161
push str.ViPath.ini
lea eax, [esp + 0x34]
push ebx
push eax
mov byte [esp + 0x418], 9
call fcn.0047c388
lea ecx, [esp + 0x70]
mov byte [esp + 0x40c], 0xa
call fcn.00401650
mov ecx, dword [esp + 0x30]
push 0
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x414], 0xb
call fcn.0045c71d
test eax, eax
je 0x40d90f
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x30]
mov eax, dword [edx - 8]
push eax
call fcn.0047c523
push eax
lea ecx, [esp + 0x74]
call fcn.00401900
lea ecx, [esp + 0x70]
call fcn.00401c40
test eax, eax
je 0x40d90f
lea ecx, [esp + 0x70]
xor esi, esi
call fcn.00401c40
test eax, eax
jbe 0x40d90f
lea edi, [ebp + 0xc8]
push esi
lea ecx, [esp + 0x74]
call fcn.004016f0
push eax
mov ecx, edi
call fcn.0047c4cf
push 0x4ae968
mov ecx, edi
call fcn.0047c4cf
lea ecx, [esp + 0x70]
inc esi
call fcn.00401c40
cmp esi, eax
jb 0x40d8e3
lea ecx, [esp + 0x44]
call fcn.0045c6d3
lea ecx, [esp + 0x70]
call fcn.00401690
lea eax, [ebp + 0xd0]
push str.AdPath.ini
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x410], 0xc
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0xb
call fcn.0047c0f3
lea ecx, [esp + 0x60]
call fcn.00401650
mov ecx, dword [esp + 0x30]
push 0
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x414], 0xd
call fcn.0045c71d
test eax, eax
je 0x40d9e8
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x30]
mov eax, dword [edx - 8]
push eax
call fcn.0047c523
push eax
lea ecx, [esp + 0x64]
call fcn.00401900
lea ecx, [esp + 0x60]
call fcn.00401c40
test eax, eax
je 0x40d9e8
lea ecx, [esp + 0x60]
xor esi, esi
call fcn.00401c40
test eax, eax
jbe 0x40d9e8
lea edi, [ebp + 0xcc]
push esi
lea ecx, [esp + 0x64]
call fcn.004016f0
push eax
mov ecx, edi
call fcn.0047c4cf
push 0x4ae968
mov ecx, edi
call fcn.0047c4cf
lea ecx, [esp + 0x60]
inc esi
call fcn.00401c40
cmp esi, eax
jb 0x40d9bc
lea ecx, [esp + 0x44]
call fcn.0045c6d3
lea ecx, [esp + 0x60]
call fcn.00401690
mov eax, dword [ebp + 0xc8]
lea esi, [ebp + 0xc8]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40da4d
lea eax, [esp + 0x3c]
push 0x4ad124
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.0047c388
push eax
mov ecx, esi
mov byte [esp + 0x410], 0xe
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0xd
call fcn.0047c0f3
mov eax, dword [ebp + 0xcc]
lea esi, [ebp + 0xcc]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40daa0
lea edx, [esp + 0x3c]
push 0x4ad124
lea eax, [esp + 0x28]
push edx
push eax
call fcn.0047c388
push eax
mov ecx, esi
mov byte [esp + 0x410], 0xf
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0xd
call fcn.0047c0f3
lea esi, [ebp + 0xd0]
push str._temp
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.0047c388
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x410], 0x10
call fcn.0040f680
push str.Config.dat
lea eax, [esp + 0x28]
push esi
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x410], 0x11
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0x10
call fcn.0047c0f3
lea ecx, [esp + 0x84]
call fcn.0045c65a
mov ecx, dword [esp + 0x10]
xor esi, esi
push esi
push ecx
lea ecx, [esp + 0x8c]
mov byte [esp + 0x414], 0x12
call fcn.0045c71d
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x40dd01
push ecx
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Start_Page
mov dword [ebp + 0xfc], ebx
mov dword [ebp + 0x100], ebx
mov dword [ebp + 0x104], ebx
mov dword [ebp + 0x108], 0x5a
mov dword [ebp + 0xf0], esi
mov dword [ebp + 0xf4], esi
call fcn.0047c161
push ecx
mov byte [esp + 0x414], 0x13
mov ecx, esp
mov dword [esp + 0x88], esp
push str.SoftwareMicrosoftInternet_ExplorerMain
call fcn.0047c161
lea edx, [esp + 0x2c]
push SysReAllocStringLen
push edx
mov ecx, ebp
mov byte [esp + 0x41c], 0x12
call fcn.0044dc70
lea edi, [ebp + 0x118]
push eax
mov ecx, edi
mov byte [esp + 0x410], 0x14
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0x12
call fcn.0047c0f3
push ecx
mov ecx, esp
mov dword [esp + 0x84], esp
push edi
call fcn.0047be68
mov ecx, ebp
call fcn.0044dda0
cmp eax, 0xffffffff
jle 0x40dbf3
mov dword [ebp + 0xf8], eax
jmp 0x40dc05
push str.http:__www.naver.com
mov ecx, edi
call fcn.0047c27c
mov dword [ebp + 0xf8], ebx
mov eax, dword [0x4b20c8]
mov dword [esp + 0x14], eax
mov ecx, dword [ebp + 0xf8]
lea edx, [esp + 0x14]
push ecx
push 0x4ad424
push edx
mov byte [esp + 0x418], 0x15
call fcn.0047617b
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0xc
push eax
push 0x4adb9c
push str.B_START
push str.Config
call esi
mov ecx, dword [esp + 0x10]
push ecx
push 0x4adb9c
push str.B_SCAN
push str.Config
call esi
mov edx, dword [esp + 0x10]
push edx
push 0x4adb9c
push str.P_MODE
push str.Config
call esi
mov eax, dword [esp + 0x10]
push eax
push 0x4ad454
push str.P_TIME
push str.Config
call esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ecx
push edx
push str.DEFAULT_MODE
push str.Config
call esi
mov eax, dword [esp + 0x10]
mov edi, dword [edi]
push eax
push edi
push str.DEFAULT_PAGE
push str.Config
call esi
mov ecx, dword [esp + 0x10]
push ecx
push 0x4ad458
push str.VI_SCAN_TYPE
push str.Config
call esi
mov edx, dword [esp + 0x10]
push edx
push 0x4ad458
push str.AD_SCAN_TYPE
push str.Config
call esi
mov ecx, dword [esp + 0x2c]
push 1
push 1
call fcn.0040d2e0
mov byte [esp + 0x40c], 0x12
lea ecx, [esp + 0x14]
jmp 0x40e195
mov eax, dword [0x4b20c8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
mov byte [esp + 0x40c], 0x17
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xfc]
push eax
push 0x100
push ecx
push esi
push str.B_START
push str.Config
call ebx
lea edx, [esp + 0xfc]
lea ecx, [esp + 0x14]
push edx
call fcn.0047c27c
mov eax, dword [esp + 0x14]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40dda1
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ecx
push 0x4adb9c
push str.B_START
push str.Config
call esi
mov ecx, dword [esp + 0x2c]
push 0
push 1
mov dword [ebp + 0xfc], 1
call fcn.0040d2e0
jmp 0x40ddfa
mov edx, dword [esp + 0x14]
push edx
call fcn.00463fa1
add esp, 4
cmp eax, esi
mov dword [ebp + 0xfc], eax
je 0x40ddd1
mov ecx, dword [esp + 0x2c]
push 1
push 1
call fcn.0040d2e0
mov eax, dword [esp + 0x10]
push eax
push 0x4adb9c
jmp 0x40dde8
mov ecx, dword [esp + 0x2c]
push 0
push 0
call fcn.0040d2e0
mov ecx, dword [esp + 0x10]
push ecx
push 0x4ad458
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.B_SCAN
push str.Config
call esi
mov edx, dword [esp + 0x10]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x100]
push 0x100
push eax
push 0
push str.P_MODE
push str.Config
call ebx
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x18]
call fcn.0047c27c
mov edx, dword [esp + 0x14]
push 0x4b61a0
push edx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40de73
mov eax, dword [esp + 0x10]
push eax
push 0x4adb9c
push str.P_MODE
push str.Config
call esi
mov dword [ebp + 0x104], 1
jmp 0x40de86
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00463fa1
add esp, 4
mov dword [ebp + 0x104], eax
mov edx, dword [esp + 0x10]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x100]
push 0x100
push eax
push 0
push str.P_TIME
push str.Config
call ebx
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x18]
call fcn.0047c27c
mov edx, dword [esp + 0x14]
push 0x4b61a0
push edx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40deff
mov eax, dword [esp + 0x10]
push eax
push 0x4ad454
push str.P_TIME
push str.Config
call esi
mov dword [ebp + 0x108], 0x5a
jmp 0x40df12
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00463fa1
add esp, 4
mov dword [ebp + 0x108], eax
mov edx, dword [esp + 0x10]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x100]
push 0x100
push eax
push 0
push str.DEFAULT_MODE
push str.Config
call ebx
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x18]
call fcn.0047c27c
mov edx, dword [esp + 0x14]
push 0x4b61a0
push edx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40df8b
mov eax, dword [esp + 0x10]
push eax
push 0x4adb9c
push str.DEFAULT_MODE
push str.Config
call esi
mov dword [ebp + 0xf8], 1
jmp 0x40df9e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00463fa1
add esp, 4
mov dword [ebp + 0xf8], eax
mov edx, dword [esp + 0x10]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x100]
push 0x100
push eax
push 0
push str.DEFAULT_PAGE
push str.Config
call ebx
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x18]
call fcn.0047c27c
mov edx, dword [esp + 0x14]
push 0x4b61a0
push edx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40e01f
mov eax, dword [esp + 0x10]
push eax
push str.http:__www.naver.com
push str.DEFAULT_PAGE
push str.Config
call esi
lea edi, [ebp + 0x118]
push str.http:__www.naver.com
mov ecx, edi
call fcn.0047c27c
jmp 0x40e031
lea ecx, [esp + 0x14]
lea edi, [ebp + 0x118]
push ecx
mov ecx, edi
call fcn.0047c22c
mov eax, dword [ebp + 0xf8]
cmp eax, 1
jne 0x40e043
push str.http:__www.naver.com_
jmp 0x40e059
cmp eax, 2
jne 0x40e04f
push str.http:__www.daum.net_
jmp 0x40e059
cmp eax, 3
jne 0x40e060
push str.http:__www.yahoo.co.kr_
mov ecx, edi
call fcn.0047c27c
mov edx, dword [esp + 0x10]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x100]
push 0x100
push eax
push 0
push str.VI_SCAN_TYPE
push str.Config
call ebx
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x18]
call fcn.0047c27c
mov edx, dword [esp + 0x14]
push 0x4b61a0
push edx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40e0d9
mov eax, dword [esp + 0x10]
push eax
push 0x4ad458
push str.VI_SCAN_TYPE
push str.Config
call esi
mov dword [ebp + 0xf0], 0
jmp 0x40e0ec
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00463fa1
add esp, 4
mov dword [ebp + 0xf0], eax
mov edx, dword [esp + 0x10]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x100]
push 0x100
push eax
push 0
push str.AD_SCAN_TYPE
push str.Config
call ebx
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x18]
call fcn.0047c27c
mov edx, dword [esp + 0x14]
push 0x4b61a0
push edx
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40e165
mov eax, dword [esp + 0x10]
push eax
push 0x4ad458
push str.AD_SCAN_TYPE
push str.Config
call esi
mov dword [ebp + 0xf4], 0
jmp 0x40e178
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00463fa1
add esp, 4
mov dword [ebp + 0xf4], eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0x16
call fcn.0047c0f3
mov byte [esp + 0x40c], 0x12
lea ecx, [esp + 0x14]
call fcn.0047c0f3
lea eax, [ebp + 0xd0]
push str.Version.dat
lea edx, [esp + 0x28]
push eax
push edx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x410], 0x18
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0x12
call fcn.0047c0f3
mov eax, dword [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x8c]
call fcn.0045c71d
test eax, eax
jne 0x40e64b
mov ecx, dword [0x4b20c8]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0xa0]
mov byte [esp + 0x40c], 0x19
push edx
call fcn.0045d2e8
lea ecx, [esp + 0xa0]
call fcn.0045d3c0
push eax
lea ecx, [esp + 0xa4]
call fcn.0045d396
push eax
lea ecx, [esp + 0xa8]
call fcn.0045d339
push eax
lea eax, [esp + 0x20]
push 0x4ae8c8
push eax
call fcn.0047617b
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
add esp, 0x14
push ecx
push edx
push str.LAST_DAY
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007080200
push str.addb.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007080200
push str.xdb.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007013100
push str.tdb.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.20060220
push str.addbs.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007080200
push str.adpdb.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.20060412
push str.vidbs.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007051800
push str.uninstall.exe
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.20060615
push 0x4ae820
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007021600
push str.acbdb.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007080200
push str.xndb.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007020800
push str.hstdb.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007080200
push str.vidx.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007021600
push str.vi001.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007021600
push str.vi002.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007021600
push str.vi003.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007021600
push str.vi004.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007021600
push str.vi005.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007021600
push str.vi006.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007021600
push str.vi007.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007021600
push str.vi008.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007021600
push str.vi009.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007021600
push str.vi010.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007021600
push str.vi011.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007021600
push str.vi012.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007021600
push str.vi013.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007021600
push str.vi014.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007021600
push str.vi015.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007042600
push str.vi016.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007042600
push str.vi017.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007042600
push str.vi018.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007042600
push str.vi019.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007042600
push str.vi020.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007042600
push str.vi021.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007042600
push str.vi022.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007042600
push str.vi023.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007042600
push str.vi024.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007042600
push str.vi025.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007042600
push str.vi026.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007042600
push str.vi027.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007042600
push str.vi028.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007042600
push str.vi029.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007042600
push str.vi030.ads
push str.VERSION
call esi
mov eax, dword [esp + 0x10]
push eax
push str.2007042600
push str.vi031.ads
push str.VERSION
call esi
mov ecx, dword [esp + 0x10]
push ecx
push str.2007042600
push str.vi032.ads
push str.VERSION
call esi
mov edx, dword [esp + 0x10]
push edx
push str.2007080200
push str.vi033.ads
push str.VERSION
call esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x40c], 0x12
call fcn.0047c0f3
lea ecx, [esp + 0x84]
call fcn.0045c6d3
lea eax, [ebp + 0xd0]
push str.partner.ini
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x410], 0x1a
call fcn.0047c22c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40c], 0x12
call fcn.0047c0f3
mov eax, dword [ebp + 0xd4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x28]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40e701
lea edx, [esp + 0x28]
push edx
push str.SOFTWAREPCClear
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp + 0xd4]
je 0x40e6dd
lea ecx, [esp + 0x28]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
jmp 0x40e701
lea edx, [esp + 0x28]
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov eax, dword [esp + 0x28]
push 0
push eax
push str.SOFTWAREPCClear
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xdc]
lea edx, [esp + 0x28]
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40e84f
mov eax, dword [0x4b20c8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0xac]
mov esi, 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xac]
push eax
push 0x32
push ecx
push 0
push 0x4ae63c
push str.PARTNERID
mov byte [esp + 0x424], 0x1c
mov dword [esp + 0x3c], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0xac]
lea ecx, [esp + 0x14]
push edx
call fcn.0047c27c
mov eax, dword [esp + 0x14]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40e81d
mov ecx, 0x40
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0xfc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x38]
push 0x4ae62c
push eax
mov dword [esp + 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e7ee
lea ecx, [esp + 0xfc]
lea edx, [esp + 0x14]
push ecx
push 0x4ad12c
push edx
call fcn.0047617b
add esp, 0xc
mov eax, dword [esp + 0x14]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40e816
push str.pcclear
lea ecx, [ebp + 0x110]
call fcn.0047c27c
jmp 0x40e82d
lea ecx, [esp + 0x14]
push ecx
jmp 0x40e822
lea edx, [esp + 0x14]
push edx
lea ecx, [ebp + 0x110]
call fcn.0047c22c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40c], 0x1b
call fcn.0047c0f3
mov byte [esp + 0x40c], 0x12
lea ecx, [esp + 0x14]
jmp 0x40eaa0
mov eax, dword [ebp + 0xd8]
lea ecx, [esp + 0x28]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40e951
mov edx, dword [0x4b20c8]
mov dword [esp + 0x14], edx
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0xac]
mov byte [esp + 0x40c], 0x1d
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xac]
push eax
push 0x32
push ecx
push 0
push 0x4ae63c
push str.PARTNERID
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0xac]
lea ecx, [esp + 0x14]
push edx
call fcn.0047c27c
mov eax, dword [esp + 0x14]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
lea esi, [ebp + 0x110]
test eax, eax
jne 0x40e8ea
push str.pcclear
mov ecx, esi
call fcn.0047c27c
jmp 0x40e8f6
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0047c22c
mov ebp, dword [ebp + 0xdc]
lea edx, [esp + 0x28]
push edx
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax - 8]
push eax
push eax
call fcn.0047c523
mov ecx, dword [esp + 0x2c]
push eax
push 1
push 0
push 0x4ae62c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2c]
call fcn.0040f420
mov byte [esp + 0x40c], 0x12
lea ecx, [esp + 0x14]
jmp 0x40eaa0
mov eax, dword [0x4b20c8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0xac]
mov esi, 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xac]
push eax
push 0x32
push ecx
push 0
push 0x4ae63c
push str.PARTNERID
mov byte [esp + 0x424], 0x1f
mov dword [esp + 0x3c], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0xac]
lea ecx, [esp + 0x14]
push edx
call fcn.0047c27c
mov eax, dword [esp + 0x14]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40ea47
mov ecx, 0x40
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0xfc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x38]
push 0x4ae62c
push eax
mov dword [esp + 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ea18
lea ecx, [esp + 0xfc]
lea edx, [esp + 0x14]
push ecx
push 0x4ad12c
push edx
call fcn.0047617b
add esp, 0xc
mov eax, dword [esp + 0x14]
push 0x4b61a0
push eax
call fcn.00463ffe
add esp, 8
test eax, eax
jne 0x40ea40
push str.pcclear
lea ecx, [ebp + 0x110]
call fcn.0047c27c
jmp 0x40ea57
lea ecx, [esp + 0x14]
push ecx
jmp 0x40ea4c
lea edx, [esp + 0x14]
push edx
lea ecx, [ebp + 0x110]
call fcn.0047c22c
mov eax, dword [ebp + 0xdc]
lea ecx, [esp + 0x28]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov edx, dword [esp + 0x28]
mov ebp, dword [ebp + 0xd8]
push 0
push edx
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40c], 0x1e
call fcn.0047c0f3
mov byte [esp + 0x40c], 0x12
lea ecx, [esp + 0x14]
call fcn.0047c0f3
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1fc]
push 0x100
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x200]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x1fc]
lea ecx, [esp + 0x34]
push edx
call fcn.0047c161
mov bl, 0x20
push 0x5c
lea ecx, [esp + 0x38]
mov byte [esp + 0x410], bl
call fcn.00475dd3
dec eax
lea ecx, [esp + 0x34]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00475d5b
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x410], 0x21
call fcn.0047c22c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40c], bl
call fcn.0047c0f3
lea ecx, [esp + 0x34]
push str.:Program_FilesPCClear
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0047c388
mov eax, dword [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x8c]
mov byte [esp + 0x414], 0x22
call fcn.0045c71d
test eax, eax
lea ecx, [esp + 0x84]
je 0x40eb79
call fcn.0045c6d3
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.0040f680
jmp 0x40eb7e
call fcn.0045c6d3
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SOFTWAREUniSpaceLic
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREPCClear
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREPCClear
push SysReAllocStringLen
call edi
push str.CLSIDB2B2F4DC_9C17_4216_AEC7_D20CC61BEFBF
push SysReAllocStringLen
call edi
push str.CLSID72019CA5_C9F1_4F2A_92AD_B65D5AA63D35
push SysReAllocStringLen
call edi
push str.CLSIDCBFF902D_C85D_412E_9E53_73D9FB8C2D82
push SysReAllocStringLen
call edi
push str.CLSID44F44BD3_4611_4D95_995A_2050ACB63476
push SysReAllocStringLen
call edi
push str.InterfaceFDAC7399_D0D4_48F1_9AB0_978365738480
push SysReAllocStringLen
call edi
push str.Interface18A695F3_470C_48C7_BD09_F54C32D747EF
push SysReAllocStringLen
call edi
push str.InterfaceBF3A2CD7_D20D_43E9_B0D2_3A225D1CF2EF
push SysReAllocStringLen
call edi
push str.Interface895B2B20_FBF7_4C64_80E1_A356C175EEA4
push SysReAllocStringLen
call edi
push str.TypeLib8F963043_0C61_4EB3_AC25_F1166BB55917
push SysReAllocStringLen
call edi
push str.TypeLib8C1F98D4_FDC7_4211_914F_F93891CA97C3
push SysReAllocStringLen
call edi
push str.CLEARAX.ClearAXCtrl.1
push SysReAllocStringLen
call edi
push str.SOFTWAREClassesCLEARAX.ClearAXCtrl.1
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesCLSIDB2B2F4DC_9C17_4216_AEC7_D20CC61BEFBF
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesCLSID72019CA5_C9F1_4F2A_92AD_B65D5AA63D35
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesCLSIDCBFF902D_C85D_412E_9E53_73D9FB8C2D82
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesCLSID44F44BD3_4611_4D95_995A_2050ACB63476
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesInterfaceFDAC7399_D0D4_48F1_9AB0_978365738480
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesInterface18A695F3_470C_48C7_BD09_F54C32D747EF
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesInterfaceBF3A2CD7_D20D_43E9_B0D2_3A225D1CF2EF
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesInterface895B2B20_FBF7_4C64_80E1_A356C175EEA4
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesTypeLib8F963043_0C61_4EB3_AC25_F1166BB55917
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREClassesTypeLib8C1F98D4_FDC7_4211_914F_F93891CA97C3
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_Menu2ProgramsPC_
push SysReAllocStringLen
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuProgramsPC_
push SysReAllocStringLen
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov ebp, 1
lea edx, [esp + 0x1fc]
push ebp
push edx
lea eax, [esp + 0x20]
push str._sDownloaded_Program_FilesCONFLICT._dClearAX.ocx
push eax
call fcn.0047617b
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 0
push ecx
lea ecx, [esp + 0x8c]
call fcn.0045c71d
test eax, eax
je 0x40ed31
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
push 0
push edx
call fcn.0040f280
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x18]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDlls
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x84]
call fcn.0045c6d3
lea edx, [esp + 0x1fc]
push ebp
push edx
lea eax, [esp + 0x20]
push str._sDownloaded_Program_FilesCONFLICT._dClearAX.ocx
push eax
call fcn.0047617b
add esp, 0x10
lea ecx, [esp + 0x18]
push 0x4ae00c
push 0x4ad124
call fcn.00475ae6
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push edx
call fcn.0047c3fc
mov eax, dword [eax]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
inc ebp
cmp ebp, 0x32
jl 0x40ecd3
lea eax, [esp + 0x1fc]
lea ecx, [esp + 0x18]
push eax
push str._sDownloaded_Program_FilesClearAX.ocx
push ecx
call fcn.0047617b
add esp, 0xc
lea ecx, [esp + 0x18]
push 0x4ae00c
push 0x4ad124
call fcn.00475ae6
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push eax
call fcn.0047c3fc
mov eax, dword [eax]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea ecx, [esp + 0x1fc]
lea edx, [esp + 0x18]
push ecx
push str._sDownloaded_Program_FilesClearAX.inf
push edx
call fcn.0047617b
mov eax, dword [esp + 0x24]
add esp, 0xc
lea ecx, [esp + 0x84]
push 0
push eax
call fcn.0045c71d
test eax, eax
je 0x40ee2c
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x84]
call fcn.0045c6d3
lea edx, [esp + 0x1fc]
lea eax, [esp + 0x18]
push edx
push str._sDownloaded_Program_FilesClearAX.ocx
push eax
call fcn.0047617b
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 0
push ecx
lea ecx, [esp + 0x8c]
call fcn.0045c71d
test eax, eax
je 0x40ee84
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
push 0
push edx
call fcn.0040f280
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x84]
call fcn.0045c6d3
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats72019CA5_C9F1_4F2A_92AD_B65D5AA63D35
push SysReAllocStringLen
call edi
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units72019CA5_C9F1_4F2A_92AD_B65D5AA63D35
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_UnitsB2B2F4DC_9C17_4216_AEC7_D20CC61BEFBF
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_UnitsCBFF902D_C85D_412E_9E53_73D9FB8C2D82
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units44F44BD3_4611_4D95_995A_2050ACB63476
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1fc]
push 0x100
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x200]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x1fc]
lea eax, [esp + 0x18]
push edx
push str._smfc42.dll
push eax
call fcn.0047617b
add esp, 0xc
lea ecx, [esp + 0x18]
push 0x4ae00c
push 0x4ad124
call fcn.00475ae6
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push edx
call fcn.0047c3fc
mov eax, dword [eax]
push str.72019CA5_C9F1_4F2A_92AD_B65D5AA63D35
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push ecx
call fcn.0047c3fc
mov eax, dword [eax]
push str.B2B2F4DC_9C17_4216_AEC7_D20CC61BEFBF
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push eax
call fcn.0047c3fc
mov eax, dword [eax]
push str.CBFF902D_C85D_412E_9E53_73D9FB8C2D82
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push edx
call fcn.0047c3fc
mov eax, dword [eax]
push str.44F44BD3_4611_4D95_995A_2050ACB63476
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea eax, [esp + 0x1fc]
lea ecx, [esp + 0x18]
push eax
push str._smsvcrt.dll
push ecx
call fcn.0047617b
add esp, 0xc
lea ecx, [esp + 0x18]
push 0x4ae00c
push 0x4ad124
call fcn.00475ae6
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push eax
call fcn.0047c3fc
mov eax, dword [eax]
push str.72019CA5_C9F1_4F2A_92AD_B65D5AA63D35
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push edx
call fcn.0047c3fc
mov eax, dword [eax]
push str.B2B2F4DC_9C17_4216_AEC7_D20CC61BEFBF
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push ecx
call fcn.0047c3fc
mov eax, dword [eax]
push str.CBFF902D_C85D_412E_9E53_73D9FB8C2D82
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push eax
call fcn.0047c3fc
mov eax, dword [eax]
push str.44F44BD3_4611_4D95_995A_2050ACB63476
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea ecx, [esp + 0x1fc]
lea edx, [esp + 0x18]
push ecx
push str._solepro32.dll
push edx
call fcn.0047617b
add esp, 0xc
lea ecx, [esp + 0x18]
push 0x4ae00c
push 0x4ad124
call fcn.00475ae6
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push ecx
call fcn.0047c3fc
mov eax, dword [eax]
push str.72019CA5_C9F1_4F2A_92AD_B65D5AA63D35
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push eax
call fcn.0047c3fc
mov eax, dword [eax]
push str.B2B2F4DC_9C17_4216_AEC7_D20CC61BEFBF
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push edx
call fcn.0047c3fc
mov eax, dword [eax]
push str.CBFF902D_C85D_412E_9E53_73D9FB8C2D82
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionModeleUsage_
push ecx
call fcn.0047c3fc
mov eax, dword [eax]
push str.44F44BD3_4611_4D95_995A_2050ACB63476
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x1c]
call fcn.0047c0f3
lea ecx, [esp + 0x18]
mov byte [esp + 0x40c], bl
call fcn.0047c0f3
lea ecx, [esp + 0x34]
mov byte [esp + 0x40c], 0x12
call fcn.0047c0f3
lea ecx, [esp + 0x84]
mov byte [esp + 0x40c], 0x10
call fcn.0045c697
lea ecx, [esp + 0x10]
mov byte [esp + 0x40c], 0xd
call fcn.0047c0f3
lea ecx, [esp + 0x60]
mov byte [esp + 0x40c], 0xb
call fcn.004016e0
lea ecx, [esp + 0x70]
mov byte [esp + 0x40c], 0xa
call fcn.004016e0
lea ecx, [esp + 0x30]
mov byte [esp + 0x40c], 9
call fcn.0047c0f3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x40c], 4
call fcn.0047c0f3
lea ecx, [esp + 0x44]
mov byte [esp + 0x40c], 3
call fcn.0045c697
mov byte [esp + 0x40c], 2
lea ecx, [esp + 0x20]
call fcn.0047c0f3
lea ecx, [esp + 0xe0]
mov byte [esp + 0x40c], 0
call fcn.0045c697
lea ecx, [esp + 0x38]
mov dword [esp + 0x40c], 0xffffffff
call fcn.0047c0f3
mov ecx, dword [esp + 0x404]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x400
ret