Function at 0x479d90
Capabilities:
Check if file exists
Delete file
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5211d2
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x56f790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.00410b40
mov ecx, eax
test ecx, ecx
je 0x47a7c4
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x834], edi
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
call fcn.004768f0
mov esi, eax
lea ecx, [ebx + 4]
mov byte [ebp - 4], 1
push esi
call fcn.00408360
lea ecx, [esi + 4]
push ecx
lea ecx, [ebx + 8]
call fcn.00408360
lea eax, [esi + 8]
push eax
lea ecx, [ebx + 0xc]
call fcn.00408360
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0x10]
call fcn.00408360
lea eax, [esi + 0x10]
push eax
lea ecx, [ebx + 0x14]
call fcn.00408360
lea eax, [esi + 0x14]
push eax
lea ecx, [ebx + 0x18]
call fcn.00408360
lea eax, [esi + 0x18]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00408360
mov eax, dword [esi + 0x1c]
lea ecx, [ebx + 4]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x34]
push eax
add ecx, 0x34
call fcn.00408360
lea eax, [esi + 0x38]
lea esi, [ebx + 4]
push eax
lea ecx, [esi + 0x38]
call fcn.00477370
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0
call fcn.004771f0
call fcn.0040ed70
mov ecx, eax
call fcn.0040caa0
test eax, eax
je 0x479eb8
push esi
mov ecx, ebx
call fcn.0047cac0
push esi
mov ecx, ebx
call fcn.0047c6d0
mov dword [ebp - method.mf_bind_t_class_CInstaller__class_CInstaller___void_.virtual_0], vtable.mf_bind_t_class_CInstaller__class_CInstaller___void_.0
mov dword [ebp - 0x818], 0x479320
mov dword [ebp - 0x814], ebx
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 2
push eax
call fcn.00454db0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 0
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 3
push eax
call fcn.00454db0
add esp, 8
mov byte [ebp - 4], 0
lea esi, [ebx + 0xd0]
push esi
call fcn.00472220
mov ecx, eax
call fcn.00472440
push eax
call fcn.004884c0
push str.GmSvc.dll
lea eax, [ebp - 0x840]
push esi
push eax
call fcn.00410610
push 0x537e98
push dword [ebp - 0x840]
mov byte [ebp - 4], 4
call fcn.00474250
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 2
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 5
push eax
call fcn.00454db0
mov esi, dword [esi]
lea ecx, [ebp - 0x820]
add esp, 0x20
mov byte [ebp - 4], 4
call fcn.00487240
push esi
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 6
call fcn.00487820
lea ecx, [ebp - 0x820]
call fcn.00487b30
lea ecx, [ebp - 0x820]
call fcn.00487350
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 3
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 7
push eax
call fcn.00454db0
add esp, 4
mov byte [ebp - 4], 4
push str.ldsgamecenter_uninst
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b17e0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x47a07d
push str.removelds_gcenter.bat
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x47a07d
lea eax, [ebp - 0x218]
push eax
push str.Delete_temp_file:__s
call fcn.00441ac0
add esp, 8
push str..tmp
push dword [ebx + 0xd0]
lea esi, [ebx + 0xd0]
call fcn.00474b30
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 4
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 8
push eax
call fcn.00454db0
push dword [esi]
mov byte [ebp - 4], 4
push 0x53a530
call fcn.00441ac0
push str.update
lea eax, [ebp - 0x830]
push esi
push eax
call fcn.00410610
push dword [eax]
mov byte [ebp - 4], 9
call fcn.004744c0
mov edx, dword [ebp - 0x830]
add esp, 0x24
mov byte [ebp - 4], 4
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a119
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.update
lea eax, [ebp - 0x830]
push esi
push eax
call fcn.00410610
push dword [eax]
mov byte [ebp - 4], 0xa
push str.Delete_directory_recursively:__s
call fcn.00441ac0
mov edx, dword [ebp - 0x830]
add esp, 0x14
mov byte [ebp - 4], 4
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a160
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 5
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0xb
push eax
call fcn.00454db0
add esp, 4
mov byte [ebp - 4], 4
mov ecx, ebx
call fcn.00477bc0
and eax, 1
mov dword [ebp - 0x830], eax
jne 0x47a1c5
push 0xf
push str.copy_file_fail
lea ecx, [ebp - 0x834]
call fcn.0040ad10
mov edi, dword [ebp - 0x834]
push str.updatecefcef.7z
lea eax, [ebp - 0x838]
push esi
push eax
call fcn.00410610
push str.cef
lea eax, [ebp - 0x83c]
mov byte [ebp - 4], 0xc
push esi
push eax
call fcn.00410610
add esp, 0x18
push dword [ebp - 0x838]
mov byte [ebp - 4], 0xd
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a23a
push 0
push dword [ebp - 0x83c]
push dword [ebp - 0x838]
call fcn.00508180
add esp, 0xc
test eax, eax
jns 0x47a233
push dword [ebp - 0x838]
push str.Extract7z::Unzip7zFileToDir_faild:_cef_7z_file__s
call fcn.00441ac0
add esp, 8
jmp 0x47a247
push str.Extract7z::Unzip7zFileToDir_success_file
jmp 0x47a23f
push str.Extract7z::Unzip7zFileToDir_cef_7z_is_not_exist
call fcn.00441ac0
add esp, 4
push str.start_call_program
call fcn.00441ac0
mov eax, dword [esi]
add esp, 4
push dword [eax - 0xc]
push eax
call fcn.00472220
mov ecx, eax
call fcn.00472440
mov ecx, eax
call fcn.00482450
push dword [esi]
call fcn.004887e0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 0x60
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0xe
push eax
call fcn.00454db0
add esp, 8
mov byte [ebp - 4], 0xd
call fcn.0040ed70
mov ecx, eax
call fcn.0040cb00
test eax, eax
je 0x47a405
push str.CInstaller::_WriteEmbedRegistry
call fcn.00441ac0
add esp, 4
call fcn.00410b40
mov ecx, eax
test ecx, ecx
je 0x47a7ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x828], eax
mov byte [ebp - 4], 0xf
call fcn.0040ed70
mov ecx, eax
call fcn.0040b120
push dword [eax]
lea eax, [ebp - 0x828]
push str.InstallDate__s
push eax
call fcn.0040ecb0
lea eax, [ebp - 0x82c]
push eax
call fcn.00438f40
push dword [ebp - 0x82c]
mov esi, dword [ebp - 0x828]
push esi
push 0x52ed34
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x10
call fcn.0043e0c0
mov edx, dword [ebp - 0x82c]
add esp, 0x20
mov byte [ebp - 4], 0xf
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a361
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47a37d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea esi, [ebx + 0xd0]
call fcn.0040ed70
mov ecx, eax
call fcn.0040ca80
test eax, eax
jne 0x47a3d6
push esi
mov ecx, ebx
call fcn.0047aa60
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 0x61
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0x11
push eax
call fcn.00454db0
add esp, 4
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x828], 0
call fcn.0040ed70
mov ecx, eax
call fcn.0040caa0
test eax, eax
je 0x47a491
call fcn.00410b40
mov ecx, eax
test ecx, ecx
je 0x47a7d8
jmp 0x47a437
mov ecx, ebx
call fcn.0047a7f0
test eax, eax
jne 0x47a383
push 0x17
push str.WritePathRegister_fail
lea ecx, [ebp - 0x834]
mov dword [ebp - 0x830], eax
call fcn.0040ad10
mov edi, dword [ebp - 0x834]
jmp 0x47a383
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x82c]
mov ecx, ebx
push eax
lea eax, [ebx + 4]
push eax
call fcn.0047c270
mov edx, dword [ebp - 0x82c]
or eax, 0xffffffff
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a484
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x828], 0
jne 0x47a580
push 0x52bd6c
push str.DelayCreateIconEmbedPID
push 0x52ed34
lea eax, [ebp - 0x828]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.0043c960
add esp, 0x14
mov eax, dword [ebp - 0x828]
mov byte [ebp - 4], 0x13
cmp dword [eax - 0xc], 0
jne 0x47a4d2
call fcn.0040ed70
mov ecx, eax
call fcn.0040cb00
jmp 0x47a51b
call fcn.0040ed70
mov ecx, eax
call fcn.0040b120
mov eax, dword [eax]
test eax, eax
je 0x47a7e2
mov ecx, dword [ebp - 0x828]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x47a516
test dx, dx
je 0x47a512
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x47a516
add ecx, 4
add eax, 4
test dx, dx
jne 0x47a4f0
xor eax, eax
jmp 0x47a51b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47a55e
push str.DelayCreateIconEmbedPID
push 0x52ed34
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x539fec
push 0x52ed34
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.DelayCreateIconFrom
push 0x52ed34
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edx, dword [ebp - 0x828]
or eax, 0xffffffff
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a580
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040ed70
mov ecx, eax
call fcn.0040caa0
test eax, eax
je 0x47a5a2
mov eax, dword [ebx + 0x14]
cmp dword [eax - 0xc], 0
je 0x47a5a2
mov eax, dword [ebx + 0x10]
cmp dword [eax - 0xc], 0
jne 0x47a5d0
call fcn.0040ed70
mov ecx, eax
call fcn.0040cac0
test eax, eax
je 0x47a5d0
call fcn.0040ed70
mov ecx, eax
call fcn.0040cef0
mov ecx, ebx
push esi
test eax, eax
je 0x47a5c9
push 1
jmp 0x47a5cb
push 0
call fcn.00477f50
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.004b17e0
add esp, 0xc
lea eax, [ebp - 0x810]
push 1
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x82c]
push eax
call fcn.0040ed70
mov ecx, eax
call fcn.0040af70
push dword [eax]
lea eax, [ebp - 0x810]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x82c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a63a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a66b
lea eax, [ebp - 0x810]
push eax
call fcn.00474de0
lea eax, [ebp - 0x810]
push eax
push str.Delete_old_start_menu_directory_:__s
call fcn.00441ac0
add esp, 0xc
call fcn.0040ed70
mov ecx, eax
call fcn.0040cae0
test eax, eax
je 0x47a683
push esi
mov ecx, ebx
call fcn.004775c0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x479330
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 0x62
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0x14
push eax
call fcn.00454db0
push str.install_end.
mov byte [ebp - 4], 0xd
call fcn.00441ac0
mov eax, dword [ebp - 0x830]
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x820], 0x479300
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], edi
lea eax, [ebp - 0x824]
mov byte [ebp - 4], 0x15
push eax
call fcn.00454db0
mov edx, dword [ebp - 0x83c]
or ebx, 0xffffffff
add esp, 0xc
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x820], 0
add edx, 0xfffffff0
mov dword [ebp - 0x81c], 0
mov eax, ebx
mov byte [ebp - 4], 0xc
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a746
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x838]
mov eax, ebx
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a767
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x840]
mov eax, ebx
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47a788
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x47a7a4
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac4b8
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00404400
push 0x80004005
call fcn.00404400
push 0x80004005
call fcn.00404400
push 0x80004005
call fcn.00404400
int3