Function at 0x406650
Capabilities:
Delete directory
Delete file
Delete registry key
Delete registry value
Get common file path
Get installed programs
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d776
mov eax, dword fs:[0]
push eax
sub esp, 0x4fc
mov eax, dword [0x49f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004013f0
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x4e0], eax
test ecx, ecx
je 0x406699
lock inc dword [ecx + 8]
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
movq xmm0, qword [esi + 0x28]
mov dword [ebp - 0x470], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x460], eax
mov al, byte [esi + 0x34]
mov byte [ebp - 0x45c], al
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x46c], ecx
movq qword [ebp - 0x468], xmm0
mov dword [ebp - 0x458], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x4b8], 0
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 1
call fcn.00408ea0
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 4], 2
or edi, 0xffffffff
mov ecx, dword [ebp - 0x46c]
test ecx, ecx
je 0x406718
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x406718
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 3
call fcn.0040dd40
push 0
lea eax, [ebp - 0x498]
push eax
call fcn.0040de00
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x498]
test ecx, ecx
jne 0x406746
mov byte [ebp - 4], 5
jmp 0x406756
mov eax, dword [ecx]
lea edx, [ebp - 0x4dc]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x494]
test ebx, ebx
je 0x40677f
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x40677f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lock xadd dword [ebx + 8], eax
jne 0x40677f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x4b8]
test ecx, ecx
je 0x4067a4
mov edx, dword [ecx]
lea eax, [ebp - 0x4dc]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xorps xmm0, xmm0
mov dword [ebp - 0x448], 0
movq qword [ebp - 0x450], xmm0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 4], 8
movq qword [ebp - 0x444], xmm0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
lea eax, [ebp - 0x444]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0x450]
mov ecx, esi
call fcn.0040b260
mov ecx, dword [ebp - 0x44c]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x450]
add esp, 4
imul ecx
mov ecx, dword [ebp - 0x440]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x444]
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
imul ecx
mov dword [ebp - 0x494], ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebx
xor ebx, ebx
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4a8], ebx
test eax, eax
jle 0x406a2d
mov eax, dword [ebp - 0x494]
xor ecx, ecx
imul edx, eax, 0xffffffe8
mov dword [ebp - 0x4ac], ecx
mov dword [ebp - 0x4b0], edx
cmp ebx, eax
jge 0x4068b5
mov eax, dword [ebp - 0x450]
add eax, ecx
cmp dword [eax + 0x14], 8
jb 0x4068ac
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4068cc
mov eax, dword [ebp - 0x444]
add eax, edx
cmp dword [eax + 0x14], 8
jb 0x4068c5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esi + 0x44]
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4dc], ebx
mov dword [ebp - 0x4d8], eax
test ecx, ecx
je 0x4068ec
lock inc dword [ecx + 8]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
movq xmm0, qword [esi + 0x48]
mov dword [ebp - 0x4d4], eax
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x4c4], eax
movzx eax, byte [esi + 0x54]
mov byte [ebp - 0x4c0], al
movzx eax, byte [esi + 0x55]
mov byte [ebp - 0x4bf], al
mov eax, dword [esi + 0x58]
mov dword [ebp - 0x4d0], ecx
movq qword [ebp - 0x4cc], xmm0
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x454], 0
lea ecx, [ebp - 0x4dc]
mov byte [ebp - 4], 0xb
call fcn.00408f00
mov dword [ebp - 0x454], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x4d0]
test ecx, ecx
je 0x406969
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x406969
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
call fcn.0040dd40
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040de00
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x4a4]
test ecx, ecx
jne 0x406994
mov byte [ebp - 4], 0xf
jmp 0x4069a4
mov eax, dword [ecx]
lea edx, [ebp - 0x478]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov ebx, dword [ebp - 0x4a0]
test ebx, ebx
je 0x4069cd
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x4069cd
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lock xadd dword [ebx + 8], eax
jne 0x4069cd
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x454]
test ecx, ecx
je 0x4069ef
mov edx, dword [ecx]
lea eax, [ebp - 0x478]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ebx, dword [ebp - 0x4a8]
mov ecx, dword [ebp - 0x4ac]
inc ebx
mov edx, dword [ebp - 0x4b0]
add ecx, 0x18
add edx, 0x18
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4ac], ecx
mov dword [ebp - 0x4b0], edx
cmp ebx, dword [ebp - 0x4b4]
jge 0x406a2d
mov eax, dword [ebp - 0x494]
jmp 0x406898
cmp byte [esi + 0x18], 0
jne 0x406f7d
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x406a45
lock inc dword [ecx + 8]
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
movq xmm0, qword [esi + 0x28]
mov dword [ebp - 0x4d4], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x4c4], eax
mov al, byte [esi + 0x34]
mov byte [ebp - 0x4c0], al
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x4d0], ecx
movq qword [ebp - 0x4cc], xmm0
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4e4], 0
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0x13
call fcn.00408f20
mov dword [ebp - 0x4e4], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x4d0]
test ecx, ecx
je 0x406ab7
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x406ab7
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
call fcn.0040dd40
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040de00
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x4a4]
test ecx, ecx
jne 0x406ae2
mov byte [ebp - 4], 0x17
jmp 0x406af2
mov eax, dword [ecx]
lea edx, [ebp - 0x508]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x18
mov ebx, dword [ebp - 0x4a0]
test ebx, ebx
je 0x406b1b
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x406b1b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lock xadd dword [ebx + 8], eax
jne 0x406b1b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x4e4]
test ecx, ecx
je 0x406b3d
mov edx, dword [ecx]
lea eax, [ebp - 0x508]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 9
push 0
push eax
call fcn.00465030
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0x4e0]
add eax, 0xb0
cmp dword [eax + 0x14], 8
jb 0x406b81
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x468]
push str._s_s
push eax
call fcn.0040cd90
xorps xmm0, xmm0
mov dword [ebp - 0x430], 0
movq qword [ebp - 0x438], xmm0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
movq qword [ebp - 0x42c], xmm0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x1c
push eax
lea edx, [ebp - 0x438]
lea ecx, [ebp - 0x468]
call fcn.0040b260
mov ecx, dword [ebp - 0x434]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x438]
add esp, 0x14
imul ecx
mov ecx, dword [ebp - 0x428]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x42c]
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
imul ecx
mov dword [ebp - 0x4a8], ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebx
xor ebx, ebx
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x494], ebx
test eax, eax
jle 0x406e25
mov eax, dword [ebp - 0x4a8]
xor ecx, ecx
imul edx, eax, 0xffffffe8
mov dword [ebp - 0x4b4], ecx
mov dword [ebp - 0x4b0], edx
nop dword [eax + eax]
cmp ebx, eax
jge 0x406cad
mov eax, dword [ebp - 0x438]
add eax, ecx
cmp dword [eax + 0x14], 8
jb 0x406ca4
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406cc4
mov eax, dword [ebp - 0x42c]
add eax, edx
cmp dword [eax + 0x14], 8
jb 0x406cbd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esi + 0x44]
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x4dc], ebx
mov dword [ebp - 0x4d8], eax
test ecx, ecx
je 0x406ce4
lock inc dword [ecx + 8]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
movq xmm0, qword [esi + 0x48]
mov dword [ebp - 0x4d4], eax
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x4c4], eax
movzx eax, byte [esi + 0x54]
mov byte [ebp - 0x4c0], al
movzx eax, byte [esi + 0x55]
mov byte [ebp - 0x4bf], al
mov eax, dword [esi + 0x58]
mov dword [ebp - 0x4d0], ecx
movq qword [ebp - 0x4cc], xmm0
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4e4], 0
lea ecx, [ebp - 0x4dc]
mov byte [ebp - 4], 0x1e
call fcn.00408f80
mov dword [ebp - 0x4e4], eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x4d0]
test ecx, ecx
je 0x406d61
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x406d61
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x20
call fcn.0040dd40
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040de00
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x4a4]
test ecx, ecx
jne 0x406d8c
mov byte [ebp - 4], 0x22
jmp 0x406d9c
mov eax, dword [ecx]
lea edx, [ebp - 0x508]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x23
mov ebx, dword [ebp - 0x4a0]
test ebx, ebx
je 0x406dc5
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x406dc5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lock xadd dword [ebx + 8], eax
jne 0x406dc5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x4e4]
test ecx, ecx
je 0x406de7
mov edx, dword [ecx]
lea eax, [ebp - 0x508]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ebx, dword [ebp - 0x494]
mov ecx, dword [ebp - 0x4b4]
inc ebx
mov edx, dword [ebp - 0x4b0]
add ecx, 0x18
add edx, 0x18
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x4b4], ecx
mov dword [ebp - 0x4b0], edx
cmp ebx, dword [ebp - 0x4ac]
jge 0x406e25
mov eax, dword [ebp - 0x4a8]
jmp 0x406c90
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x406eaf
mov edx, dword [ebp - 0x428]
push ecx
mov ecx, eax
call fcn.00408010
mov ecx, dword [ebp - 0x424]
mov eax, 0x2aaaaaab
mov ebx, dword [ebp - 0x42c]
add esp, 4
sub ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, ebx
shl ecx, 3
cmp ecx, 0x1000
jb 0x406e87
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407553
push ecx
push ebx
call fcn.00463043
add esp, 8
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x438]
test eax, eax
je 0x406f39
mov edx, dword [ebp - 0x434]
push ecx
mov ecx, eax
call fcn.00408010
mov ecx, dword [ebp - 0x430]
mov eax, 0x2aaaaaab
mov ebx, dword [ebp - 0x438]
add esp, 4
sub ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, ebx
shl ecx, 3
cmp ecx, 0x1000
jb 0x406f11
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407558
push ecx
push ebx
call fcn.00463043
add esp, 8
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x454]
cmp edx, 8
jb 0x406f7d
mov ecx, dword [ebp - 0x468]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406f73
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40755d
push edx
push ecx
call fcn.00463043
add esp, 8
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x406f8b
lock inc dword [ecx + 8]
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
movq xmm0, qword [esi + 0x28]
mov dword [ebp - 0x4d4], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x4c4], eax
mov al, byte [esi + 0x34]
mov byte [ebp - 0x4c0], al
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x4d0], ecx
movq qword [ebp - 0x4cc], xmm0
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4e4], 0
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0x26
call fcn.00408fa0
mov dword [ebp - 0x4e4], eax
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x4d0]
test ecx, ecx
je 0x406ffd
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x406ffd
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x28
call fcn.0040dd40
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040de00
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x4a4]
test ecx, ecx
jne 0x407028
mov byte [ebp - 4], 0x2a
jmp 0x407038
mov eax, dword [ecx]
lea edx, [ebp - 0x508]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x2b
mov ebx, dword [ebp - 0x4a0]
test ebx, ebx
je 0x407061
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x407061
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lock xadd dword [ebx + 8], eax
jne 0x407061
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x4e4]
test ecx, ecx
je 0x407083
mov edx, dword [ecx]
lea eax, [ebp - 0x508]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 9
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00465030
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x49c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x4e0]
cmp dword [eax + 0xac], 8
lea ecx, [eax + 0x98]
jb 0x4070dc
mov ecx, dword [eax + 0x98]
push ecx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x490]
push str._s_s.lnk
push eax
call fcn.0040cd90
add esp, 0x10
cmp dword [ebp - 0x47c], 8
lea eax, [ebp - 0x490]
cmovae eax, dword [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00466e5f
cdq
mov ecx, 5
idiv ecx
imul eax, edx, 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x40713b
lock inc dword [ecx + 8]
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
movq xmm0, qword [esi + 0x28]
mov dword [ebp - 0x4d4], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x4c4], eax
mov al, byte [esi + 0x34]
mov byte [ebp - 0x4c0], al
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x4d0], ecx
movq qword [ebp - 0x4cc], xmm0
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4e4], 0
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0x2f
call fcn.00409000
mov dword [ebp - 0x4e4], eax
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x4d0]
test ecx, ecx
je 0x4071ad
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x4071ad
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x31
call fcn.0040dd40
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040de00
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x4a4]
test ecx, ecx
jne 0x4071d8
mov byte [ebp - 4], 0x33
jmp 0x4071e8
mov eax, dword [ecx]
lea edx, [ebp - 0x508]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x34
mov ebx, dword [ebp - 0x4a0]
test ebx, ebx
je 0x407211
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x407211
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lock xadd dword [ebx + 8], eax
jne 0x407211
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov byte [ebp - 4], 0x35
mov ecx, dword [ebp - 0x4e4]
test ecx, ecx
je 0x407233
mov edx, dword [ecx]
lea eax, [ebp - 0x508]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
lea eax, [ebp - 0x494]
push eax
push 0x2001b
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x407283
mov eax, dword [ebp - 0x4e0]
add eax, 0x98
cmp dword [eax + 0x14], 8
jb 0x40726e
mov eax, dword [eax]
push eax
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x494]
call ebx
lea eax, [ebp - 0x494]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4072ca
mov eax, dword [ebp - 0x4e0]
add eax, 0xb0
cmp dword [eax + 0x14], 8
jb 0x4072b5
mov eax, dword [eax]
push eax
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x494]
call ebx
call fcn.00466e5f
cdq
mov ecx, 5
idiv ecx
imul eax, edx, 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x4072f2
lock inc dword [ecx + 8]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x60]
movq xmm0, qword [esi + 0x68]
mov dword [ebp - 0x470], eax
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x460], eax
movzx eax, byte [esi + 0x74]
mov byte [ebp - 0x45c], al
movzx eax, byte [esi + 0x75]
mov byte [ebp - 0x45b], al
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x46c], ecx
movq qword [ebp - 0x468], xmm0
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x4e4], 0
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 0x37
call fcn.00409060
mov dword [ebp - 0x4e4], eax
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x46c]
test ecx, ecx
je 0x40736f
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x40736f
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x39
call fcn.0040dd40
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040de00
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x4a4]
test ecx, ecx
jne 0x40739a
mov byte [ebp - 4], 0x3b
jmp 0x4073aa
mov eax, dword [ecx]
lea edx, [ebp - 0x508]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x3c
mov esi, dword [ebp - 0x4a0]
test esi, esi
je 0x4073d2
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4073d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4073d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x4e4]
test ecx, ecx
je 0x4073f4
mov edx, dword [ecx]
lea eax, [ebp - 0x508]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov edx, dword [ebp - 0x47c]
cmp edx, 8
jb 0x407434
mov ecx, dword [ebp - 0x490]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40742a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407562
push edx
push ecx
call fcn.00463043
add esp, 8
mov ecx, dword [ebp - 0x444]
xor eax, eax
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x47c], 7
mov word [ebp - 0x490], ax
test ecx, ecx
je 0x4074d5
mov edx, dword [ebp - 0x440]
push ecx
call fcn.00408010
mov ecx, dword [ebp - 0x43c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x444]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x4074ad
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407567
push ecx
push esi
call fcn.00463043
add esp, 8
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov ecx, dword [ebp - 0x450]
test ecx, ecx
je 0x407537
mov edx, dword [ebp - 0x44c]
push ecx
call fcn.00408010
mov ecx, dword [ebp - 0x448]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x450]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40752d
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40756c
push ecx
push esi
call fcn.00463043
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462ae1
mov esp, ebp
pop ebp
ret
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
int3