Function at 0x420ca0
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452e00
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x138
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x148], esi
test esi, esi
jne 0x420cf5
or eax, 0xffffffff
jmp 0x422d2a
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0x423a
call fcn.0040d8d0
test eax, eax
je 0x420d17
push eax
call fcn.00424a4f
add esp, 4
add esi, 0x18
mov ecx, esi
mov dword [ebp - 0x140], esi
call fcn.00409cd0
mov ecx, eax
call fcn.00410f60
test al, al
jne 0x420d3c
mov eax, 2
jmp 0x422d2a
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
xor esi, esi
nop dword [eax]
push 0
push str.UVK_Ultra_GUI
call edi
push 0
push str.Log_analyzerW
mov dword [ebp - 0x144], eax
call edi
mov edi, eax
mov eax, dword [ebp - 0x144]
test eax, eax
jne 0x420d7a
test edi, edi
je 0x420db8
jmp 0x420d91
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
je 0x420da4
push 0
push 0xf060
push 0x112
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
inc esi
cmp esi, 0xa
jl 0x420d50
mov ecx, 0x46f3f8
call fcn.00411c90
mov ecx, 0x46f410
call fcn.00411c90
mov ecx, 0x46f434
call fcn.00411c90
xorps xmm0, xmm0
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0xa8]
movq qword [ebp - 0xa8], xmm0
call fcn.00409a40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x38], xmm0
call fcn.00409a40
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
call fcn.00409a40
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
lea ecx, [ebp - 0xb4]
movq qword [ebp - 0xb4], xmm0
call fcn.00409a40
mov esi, dword [ebp - 0x140]
sub esp, 0x1c
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x54], xmm0
mov dword [ebp - 0x4c], 0
push 0
push 0
push 0
push str.UVK.zip
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409ac0
push 0
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.00409cd0
push eax
push 0xa
push 0xcd
call fcn.00417f70
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409cd0
mov ecx, eax
call fcn.0041e420
lea ecx, [ebp - 0x54]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
xorps xmm0, xmm0
lea ecx, [ebp - 0xe4]
movups xmmword [ebp - 0xe4], xmm0
movups xmmword [ebp - 0xd4], xmm0
call fcn.004101f0
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x139], 1
push 0x23
call fcn.00409f10
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKUltra_Adware_Killer
lea ecx, [ebp - 0x48]
call fcn.0040aaf0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0xa8]
call fcn.00409c70
lea ecx, [ebp - 0xa8]
call fcn.00409cd0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x420fc3
push 0
lea ecx, [ebp - 0xa8]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0xe4]
call fcn.00410390
test eax, eax
je 0x420faa
push ecx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xe4]
call fcn.004106e0
test eax, eax
je 0x420faa
lea ecx, [ebp - 0xa8]
call fcn.0040a5d0
cmp eax, 0x413
setb byte [ebp - 0x139]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.00410ad0
cmp byte [ebp - 0x139], 0
je 0x421145
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.zip
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c70
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov ecx, eax
call fcn.00410f60
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.dat
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0xb4]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x54]
call fcn.00409cd0
push eax
push 0xa
push 0xce
call fcn.00417f70
test al, al
je 0x421059
lea ecx, [ebp - 0xb4]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409cd0
mov ecx, eax
call fcn.0041e420
lea ecx, [ebp - 0xb4]
call fcn.00409cd0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
or eax, 2
lea ecx, [ebp - 0xb4]
push eax
call fcn.00409cd0
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x48]
call fcn.0040aaf0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push 2
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0xe4]
call fcn.00410390
push 0x413
lea ecx, [ebp - 0x38]
call fcn.0040a420
push eax
lea ecx, [ebp - 0xe4]
call fcn.00410830
push ecx
lea ecx, [ebp - 0xe4]
call fcn.00410ad0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
call edi
or eax, 2
lea ecx, [ebp - 0x48]
push eax
call fcn.00409cd0
push eax
call esi
lea ecx, [ebp - 0x54]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [ebp - 0x140]
sub esp, 0x1c
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x6c], xmm0
push 0
push 0
push 0
push str.UVK_en.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x6c]
call fcn.00409ac0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
call fcn.00410f20
push ecx
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x4212e4
push str.UVK_x64_.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
push 1
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push 1
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call esi
push ecx
mov esi, dword [ebp - 0x140]
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
jmp 0x421407
push str.UVK.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
push 1
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x64_.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x140]
push 0
push str.UVK.dll
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
push 1
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call esi
mov esi, dword [ebp - 0x140]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
sub esp, 8
lea ecx, [ebp - 0x48]
push 0x23
call fcn.00409f10
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKImmunizationRebootExec.exe
lea ecx, [ebp - 0x48]
call fcn.0040aaf0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x421487
push 0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._bluescreenview.zip
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x54]
call fcn.00409cd0
push eax
push 0xa
push 0xc9
call fcn.00417f70
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409cd0
mov ecx, eax
call fcn.0041e420
lea ecx, [ebp - 0x54]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_tool.zip
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x54]
call fcn.00409cd0
push eax
push 0xa
push 0xca
call fcn.00417f70
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409cd0
mov ecx, eax
call fcn.0041e420
lea ecx, [ebp - 0x54]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Pictures.zip
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x54]
call fcn.00409cd0
push eax
push 0xa
push 0xcb
call fcn.00417f70
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409cd0
mov ecx, eax
call fcn.0041e420
lea ecx, [ebp - 0x54]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesAbstract.jpg
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
push 0x46e184
push 0x65
call fcn.00417f70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesUVK.png
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
push 0x46e184
push 0x64
call fcn.00417f70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Icons.zip
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x54]
call fcn.00409cd0
push eax
push 0xa
push 0xcc
call fcn.00417f70
mov ecx, esi
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x54]
call fcn.00409cd0
mov ecx, eax
call fcn.0041e420
lea ecx, [ebp - 0x54]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
mov esi, dword [ebp - 0x148]
mov byte [ebp - 0x139], 0
cmp dword [esi + 0xc], 0
je 0x421882
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.key.uvkey
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [esi + 0x24]
call fcn.00409cd0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esi + 0xc], 2
jne 0x4217f1
lea eax, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 0x144], eax
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x4217f1
push dword [ebp - 0x144]
lea ecx, [ebp - 0x48]
call fcn.00409b10
push ecx
lea ecx, [ebp - 0x48]
call fcn.00409de0
mov ecx, dword [ebp - 0x140]
sub esp, 0x28
push 0x46d658
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.0040ae00
push 0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
mov ecx, dword [ebp - 0x144]
push eax
call fcn.00409cd0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x38]
call fcn.00409b10
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.BrandIco.ico
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x48]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
movaps xmm0, xmmword [0x4727e0]
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x18], 0x100
movups xmmword [ebp - 0x28], xmm0
call fcn.00409cd0
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.00409cd0
mov edx, esi
mov ecx, eax
call fcn.0041f7f0
mov esi, dword [ebp - 0x148]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSettings.ini
lea ecx, [esi + 0x54]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
cmp dword [esi + 0x10], 0
je 0x42187b
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x42187b
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSettings.ini
lea ecx, [esi + 0x18]
mov byte [ebp - 0x139], 1
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
push 0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x421882
mov byte [ebp - 0x139], 0
push ecx
push 0x20019
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call fcn.0040c6e0
xorps xmm0, xmm0
mov dword [ebp - 0x88], 0
lea ecx, [ebp - 0x90]
movq qword [ebp - 0x90], xmm0
call fcn.00409a40
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x84]
movq qword [ebp - 0x84], xmm0
call fcn.00409a40
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 9
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
push eax
lea ecx, [ebp - 0x78]
movq qword [ebp - 0x78], xmm0
call fcn.00409a60
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0xa
call fcn.00418e40
sub esp, 8
lea ecx, [ebp - 0x90]
push 0x10
call fcn.00409f10
sub esp, 8
lea ecx, [ebp - 0x84]
push 0x19
call fcn.00409f10
cmp byte [ebp - 0x139], 0
jne 0x421b6e
lea eax, [ebp - 0x38]
push eax
push str.DisplayName
lea ecx, [ebp - 0x2c]
call fcn.0040c880
test al, al
je 0x421b6e
lea ecx, [ebp - 0x38]
call fcn.00409c00
test eax, eax
je 0x421b6e
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
jne 0x421abb
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
jne 0x421abb
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK.lnk
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
jne 0x421abb
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
jne 0x421abb
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
jne 0x421abb
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
jne 0x421abb
and dword [esi + 8], 0xffffffef
mov edx, 0x46c5fc
mov ecx, str.HKCR64_shellForce_Deletecommand
call fcn.0040da70
test al, al
jne 0x421ae5
mov edx, 0x46c5fc
mov ecx, str.HKCR_shellDelete_with_UVKcommand
call fcn.0040da70
test al, al
jne 0x421ae5
and dword [esi + 8], 0xfffffffb
mov edx, 0x46c5fc
mov ecx, str.HKCR.uvk
call fcn.0040da70
test al, al
jne 0x421b0f
mov edx, 0x46c5fc
mov ecx, str.HKCRUVKCommandsScript
call fcn.0040da70
test al, al
jne 0x421b0f
and dword [esi + 8], 0xfffffff7
push ecx
push 0x20019
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x3c], 0
call fcn.0040c700
lea eax, [ebp - 0x3c]
push eax
push str.AutoUpdate
lea ecx, [ebp - 0x2c]
call fcn.0040c9c0
test al, al
je 0x421b44
cmp dword [ebp - 0x3c], 0
jne 0x421b48
and dword [esi + 8], 0xffffffdf
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push str.ShowTooltips
lea ecx, [ebp - 0x2c]
call fcn.0040c9c0
test al, al
je 0x421b6a
cmp dword [ebp - 0x3c], 0
jne 0x421b6e
and dword [esi + 8], 0xffffffbf
sub esp, 0x1c
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x6c]
movq qword [ebp - 0x20], xmm0
push 0
push 0
push 0
push str.__Uninst
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x20]
call fcn.00409ac0
xorps xmm0, xmm0
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xc4]
movq qword [ebp - 0xc4], xmm0
call fcn.00409a40
sub esp, 0x1c
mov byte [ebp - 4], 0xc
cmp dword [esi + 0xc], 2
mov ecx, 0x46f3f8
mov eax, str.Brandico.ico
mov dword [ebp - 0x94], 0
cmovne eax, ecx
xorps xmm0, xmm0
push 0
push 0
push eax
push 0x46d658
lea ecx, [esi + 0x18]
movq qword [ebp - 0x9c], xmm0
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x9c]
call fcn.00409ac0
push ecx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xd
call fcn.00409cd0
push eax
push 1
push str.DisplayName
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
push 0
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
push 1
push str.InstallLocation
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea ecx, [ebp - 0x20]
call fcn.00409cd0
push eax
push 1
push str.UninstallString
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
push eax
push 1
push str.DisplayIcon
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea ecx, [esi + 0x6c]
call fcn.00409cd0
push eax
push 1
push str.Publisher
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
sub esp, 0xc
lea ecx, [ebp - 0xc4]
push 0x46f89c
call fcn.0040b280
push 0
lea ecx, [ebp - 0xc4]
call fcn.00409cd0
push eax
push 1
push str.DisplayVersion
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
lea ecx, [esi + 0x18]
call fcn.00409cd0
mov ecx, eax
call fcn.0040f960
shrd eax, edx, 0xa
push 0
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x3c]
shr edx, 0xa
push eax
push 4
push str.EstimatedSize
call fcn.0040cc20
push 0
push str.http:__www.carifred.com_uvk_help
push 1
push str.HelpLink
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
push str.http:__www.carifred.com_uvk
push 1
push str.URLInfoAbout
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 1
push eax
push 4
push str.NoModify
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea eax, [ebp - 0x3c]
push eax
push 4
push str.NoRepair
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 7
push eax
push 4
push str.VersionMajor
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 8
push eax
push 4
push str.VersionMinor
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
push 1
push 0x46c5fc
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsUVK_en.exe
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
push 0
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
push 1
push str.Path
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push str.HKCRShellDelete_with_UVK
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKCRShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKCRDirectoryShellDelete_with_UVK
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKCRDirectoryShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKCRShellFile_Information
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
test byte [esi + 8], 4
je 0x421f34
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellFile_Information
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
sub esp, 0x1c
mov dword [ebp - 0x58], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x6c]
movq qword [ebp - 0x60], xmm0
push 0
push 0
push str.____1_
call fcn.00409cd0
push eax
push 0x46de80
lea ecx, [ebp - 0x60]
call fcn.00409ac0
push ecx
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xe
call fcn.00409cd0
push eax
push 1
push 0x46c5fc
push str.HKLM64SOFTWAREClassesShellForce_Deletecommand
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
push ecx
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
push 1
push 0x46c5fc
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Deletecommand
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___FileInfo___1_
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
push 0x46de80
lea ecx, [ebp - 0x60]
call fcn.00409c70
push ecx
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
push 1
push 0x46c5fc
push str.HKLM64SOFTWAREClassesShellFile_Informationcommand
lea ecx, [ebp - 0x2c]
call fcn.0040cca0
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xd
call fcn.00409b80
push str.HKCRUVKCommandsFile
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKLM64SOFTWAREClassesUVKCommandsScriptDefaultIcon
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKLM64SOFTWAREClassesSrSettingsFileDefaultIcon
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
cmp dword [esi + 0xc], 2
jne 0x421f74
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
mov dword [ebp - 0x140], eax
jmp 0x421f7e
mov dword [ebp - 0x140], 0
test byte [esi + 8], 8
je 0x422096
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___readfile___1_
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
push 0x46de80
lea ecx, [ebp - 0x48]
call fcn.00409c70
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
push str.UVK_commands_script
mov edx, str.UVKCommandsScript
mov ecx, str..uvk
call fcn.00418970
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___ImportSr___1_
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
push 0x46de80
lea ecx, [ebp - 0x48]
call fcn.00409c70
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
push str.System_repair_settings_file
mov edx, str.SrSettingsFile
mov ecx, str..uvksr
call fcn.00418970
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe_
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
push 0x46de80
lea ecx, [ebp - 0x38]
call fcn.00409c70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4700ac
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
call fcn.00418ca0
jmp 0x4220ca
push str.HKCR.uvk
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKCRUVKCommandsScript
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKCR.uvksr
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push str.HKCRSrSettingsFile
lea ecx, [ebp - 0x2c]
call fcn.0040ce00
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____1_
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
push 0x46de80
lea ecx, [ebp - 0x48]
call fcn.00409c70
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
push str.UVK_license_key
mov edx, str.UVKLicenseKey
mov ecx, str..uvkey
call fcn.00418970
mov eax, dword [esi + 8]
shr eax, 5
and eax, 1
push ecx
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x3c]
push eax
push 4
push str.AutoUpdate
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
call fcn.0040cca0
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x2c]
shr eax, 6
and eax, 1
push 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push 4
push str.ShowTooltips
call fcn.0040cc20
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x2c]
shr eax, 4
and eax, 1
push 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push 4
push str.DesktopShortcut
call fcn.0040cc20
push 0
lea ecx, [esi + 0x60]
call fcn.00409cd0
push eax
push 1
push str.InstallSource
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
push 1
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push str.GuiBkColor
lea ecx, [ebp - 0x2c]
call fcn.0040cd90
push str.GroupBorderColor
lea ecx, [ebp - 0x2c]
call fcn.0040cd90
push str.GroupBkColor
lea ecx, [ebp - 0x2c]
call fcn.0040cd90
push str.ButtonColor0
lea ecx, [ebp - 0x2c]
call fcn.0040cd90
push str.ButtonColor1
lea ecx, [ebp - 0x2c]
call fcn.0040cd90
push str.ButtonColor2
lea ecx, [ebp - 0x2c]
call fcn.0040cd90
push str.ButtonColor3
lea ecx, [ebp - 0x2c]
call fcn.0040cd90
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 1
push eax
push 4
push str.PortableVersion
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea eax, [ebp - 0x3c]
push eax
push 4
push str.EulaAccepted
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push str.TBinder
push str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
lea ecx, [ebp - 0x2c]
call fcn.0040cdc0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemBooster
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x38]
call fcn.00409c70
push ecx
push 0xf003f
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c700
test al, al
je 0x4222d8
lea eax, [ebp - 0x48]
push eax
push str.JunkFileExtensions
lea ecx, [ebp - 0x2c]
call fcn.0040c880
test al, al
je 0x4222d8
push 0
push 0
push 0x46db10
push str.bak
lea ecx, [ebp - 0x48]
call fcn.0040af50
push 0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
push 1
push str.JunkFileExtensions
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
mov ecx, eax
call fcn.00418130
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov ecx, eax
call fcn.00418130
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov ecx, eax
call fcn.00418130
sub esp, 0xc
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
mov edx, str.Ultra_virus_killer
mov ecx, eax
call fcn.004113a0
call fcn.00418230
call fcn.00418e90
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x60]
movq qword [ebp - 0x60], xmm0
call fcn.00409a40
sub esp, 8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x60]
push 2
call fcn.00409f10
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x4223ec
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422438
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470428
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422484
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470470
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x4224d0
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422523
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
sub esp, 8
lea ecx, [ebp - 0x60]
push 0x17
call fcn.00409f10
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x42257c
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x4225c8
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470428
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422614
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470470
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422660
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 2
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x4226b3
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov edx, 6
mov ecx, eax
call fcn.0040fbd0
lea ecx, [ebp - 0x38]
call fcn.00409cd0
mov ecx, eax
call fcn.00410f60
push 0x4c
lea eax, [ebp - 0x138]
push 0
push eax
call fcn.0043e2c0
add esp, 0xc
lea ecx, [ebp - 0x138]
call fcn.0040ee50
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x10
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x38]
call fcn.0040aaf0
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040eff0
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0f0
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f140
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f190
sub esp, 8
lea ecx, [ebp - 0x138]
call fcn.0040f170
lea ecx, [ebp - 0x138]
call fcn.0040f1c0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.lnk
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040eff0
lea ecx, [ebp - 0x48]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0f0
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f190
lea ecx, [ebp - 0x138]
call fcn.0040f1c0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Uninstall.lnk
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x60]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040eff0
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0f0
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f140
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f190
push ecx
lea ecx, [ebp - 0x138]
call fcn.0040f120
lea ecx, [ebp - 0x138]
call fcn.0040f1c0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x42290a
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422956
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4704f8
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x4229a2
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470530
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x4229ee
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x90]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422a44
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422a90
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
test byte [esi + 8], 0x10
je 0x422aa7
push 0x46eb38
lea ecx, [ebp - 0x78]
call fcn.00409b50
test al, al
je 0x422af3
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422af3
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4704f8
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422b3f
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470530
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
lea ecx, [ebp - 0x38]
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422b8b
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x78]
call fcn.00409cd0
push eax
push 0x46d658
lea ecx, [ebp - 0x84]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c70
test byte [esi + 8], 0x10
lea ecx, [ebp - 0x38]
je 0x422c28
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040eff0
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f0f0
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f140
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f190
lea ecx, [ebp - 0x138]
call fcn.0040f1c0
jmp 0x422c45
call fcn.00409cd0
push eax
call edi
test eax, eax
je 0x422c45
lea ecx, [ebp - 0x38]
call fcn.00409cd0
xor edx, edx
mov ecx, eax
call fcn.0040fbd0
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
sub esp, 8
lea ecx, [esi + 0x18]
call fcn.00409cd0
push eax
lea ecx, [ebp - 0x6c]
call fcn.00409cd0
mov edx, dword [esi + 0x14]
mov ecx, eax
call fcn.00410cc0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x138]
call fcn.0040f1f0
lea ecx, [ebp - 0x60]
call fcn.00409b80
lea ecx, [ebp - 0x9c]
call fcn.00409b80
lea ecx, [ebp - 0xc4]
call fcn.00409b80
lea ecx, [ebp - 0x20]
call fcn.00409b80
lea ecx, [ebp - 0x78]
call fcn.00409b80
lea ecx, [ebp - 0x84]
call fcn.00409b80
lea ecx, [ebp - 0x90]
call fcn.00409b80
lea ecx, [ebp - 0x2c]
call fcn.0040c740
lea ecx, [ebp - 0x6c]
call fcn.00409b80
lea ecx, [ebp - 0xdc]
call fcn.0040b710
mov eax, dword [ebp - 0xe4]
cmp eax, 0xffffffff
je 0x422cfa
test eax, eax
je 0x422cfa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x54]
call fcn.00409b80
lea ecx, [ebp - 0xb4]
call fcn.00409b80
lea ecx, [ebp - 0x48]
call fcn.00409b80
lea ecx, [ebp - 0x38]
call fcn.00409b80
lea ecx, [ebp - 0xa8]
call fcn.00409b80
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424a0b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret