Function at 0x432a6b
Capabilities:
Get common file path
Get startup folder
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
sub esp, 0x58
mov eax, 0x66e964
call fcn.0062921c
sub esp, 0x96c
push ebx
push esi
push edi
push str.classic_uninstall
lea ecx, [ebp - 0x24]
call fcn.0040a58f
sub esp, 0x18
lea eax, [ebp - 0x24]
mov ecx, esp
mov dword [ebp - 0x40], esp
xor ebx, ebx
mov dword [ebp], ecx
mov dword [ebp - 4], ebx
push eax
call fcn.0040ab3b
xor eax, eax
lea ecx, [ebp + 0x5b]
inc eax
mov byte [ebp - 4], al
call fcn.005908c2
push eax
lea ecx, [ebp + 0x5b]
mov byte [ebp - 4], bl
call fcn.005909ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
xor esi, esi
push ebx
inc esi
push esi
call fcn.0040abbf
push 0x104
lea eax, [ebp - 0x770]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call fcn.0045dffe
test al, al
jne 0x432b89
cmp byte [0x76b578], 6
jb 0x432b89
push str._UNINSTALL
lea ecx, [ebp + 0x28]
call fcn.00424ff1
mov dword [ebp - 4], 2
cmp byte [ebp + 0x64], bl
je 0x432b2f
mov esi, 0x68f290
push esi
call fcn.00423ad9
pop ecx
push eax
push esi
lea ecx, [ebp + 0x28]
call fcn.00423947
cmp byte [ebp + 0x68], 0
je 0x432b4b
mov esi, str.__REMSETTINGS
push esi
call fcn.00423ad9
pop ecx
push eax
push esi
lea ecx, [ebp + 0x28]
call fcn.00423947
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x24], ax
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
mov byte [ebp - 4], 3
jae 0x432b6b
lea eax, [ebp + 0x28]
push ebx
xor esi, esi
lea ecx, [ebp - 0x24]
inc esi
push esi
push ebx
push ecx
push eax
lea eax, [ebp - 0x770]
push eax
call fcn.0042f5bf
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov bl, byte [ebp + 0x64]
test bl, bl
jne 0x432be4
lea ecx, [ebp - 0xa8]
call fcn.0057d332
mov dword [ebp - 0xa8], 0x68f07c
lea eax, [ebp + 0x68]
mov dword [ebp - 4], 4
push eax
push 0xfe
call fcn.0057c787
push eax
lea ecx, [ebp - 0xa8]
call fcn.0057e073
lea ecx, [ebp - 0xa8]
cmp byte [ebp - 0x74], bl
jne 0x432bdb
call fcn.0057d3c9
jmp 0x4331ae
or dword [ebp - 4], 0xffffffff
call fcn.0057d3c9
call fcn.0043289a
test al, al
jne 0x432c16
test bl, bl
jne 0x432c16
push 0x10
push 0x7e7
call fcn.0057b788
push eax
push 0x7e8
call fcn.0057b788
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4331ae
push dword [ebp + 0x68]
call fcn.0047f94b
xor ebx, ebx
mov dword [0x7a0218], ebx
mov dword [0x7a0210], ebx
mov dword [0x7a0214], ebx
call fcn.0046fc62
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 8
pop edi
push edi
call fcn.0042e910
lea ecx, [ebp - 0x158]
call fcn.005885cf
push edi
push 0x76d124
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 5
call fcn.00588e21
xor eax, eax
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x50], ebx
mov word [ebp + 0x40], ax
push 0x104
lea eax, [ebp - 0x978]
mov byte [ebp - 4], 6
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push reloc.WS2_32.dll_accept
call fcn.00480252
test al, al
je 0x432efd
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x978]
push eax
call fcn.0047fd4f
test eax, eax
je 0x432cbf
push ebx
jmp 0x43319a
push esi
lea eax, [ebp - 0x770]
push eax
call fcn.0045b811
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004249d0
push eax
sub esp, 0x18
mov byte [ebp - 4], 7
lea eax, [ebp + 0x40]
mov ecx, esp
push eax
call fcn.00423207
lea eax, [ebp + 0x28]
push eax
call fcn.0045b712
xor ebx, ebx
mov byte [ebp - 4], 9
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.0042386b
push esi
lea eax, [ebp - 0x770]
push eax
call fcn.0045b811
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.004249d0
push eax
sub esp, 0x18
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x978]
mov ecx, esp
push eax
call fcn.00424ff1
lea eax, [ebp - 0x3c]
push eax
call fcn.0045b712
push ebx
push esi
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xc
call fcn.0042386b
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x432d57
lea eax, [ebp + 0x28]
push eax
call fcn.00475e68
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], edi
jae 0x432d68
lea eax, [ebp - 0x3c]
push eax
call fcn.00475e68
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x432d79
lea eax, [ebp + 0x28]
push eax
call fcn.004331c2
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], edi
jae 0x432d8a
lea eax, [ebp - 0x3c]
push eax
call fcn.004331c2
push esi
push 0x28
lea eax, [ebp - 0x360]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp + 0x64], 0x18
test eax, eax
je 0x432ea4
lea ecx, [ebp - 0x360]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x432db9
mov eax, dword [ebp + 0x40]
sub ecx, edx
sar ecx, 1
cmp dword [ebp + 0x54], edi
jae 0x432dd3
lea eax, [ebp + 0x40]
push ecx
lea ecx, [ebp - 0x360]
push ecx
push eax
call fcn.00638b1f
add esp, 0xc
test eax, eax
jne 0x432ea4
lea eax, [ebp - 0x568]
push eax
call fcn.0042a51d
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x70]
call fcn.00424ff1
push esi
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xd
push eax
sub esp, 0x18
lea eax, [ebp - 0x360]
mov ecx, esp
push eax
call fcn.00424ff1
lea eax, [ebp - 0x24]
push eax
call fcn.0045b712
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.0042386b
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x10], edi
jae 0x432e4c
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp + 4]
push eax
call fcn.0045c4a6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
sub eax, ecx
cdq
idiv dword [ebp + 0x64]
cmp eax, esi
jne 0x432e92
push 0x68ec3c
call fcn.0043429b
test eax, eax
jne 0x432e92
lea eax, [ebp - 0x360]
push eax
call fcn.00423ad9
pop ecx
push eax
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp + 0x40]
call fcn.004340c0
lea ecx, [ebp + 4]
call fcn.00433f3f
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.0042386b
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
mov eax, dword [ebp + 0x40]
mov byte [ebp - 4], 0x11
cmp dword [ebp + 0x54], edi
jae 0x432ebc
lea eax, [ebp + 0x40]
push ebx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0045c4a6
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp + 0x1c]
push 0x18
pop ecx
cdq
idiv ecx
lea ecx, [ebp + 0x1c]
cmp esi, eax
sbb bl, bl
inc bl
call fcn.00433f3f
xor edi, edi
lea ecx, [ebp - 0x3c]
push edi
push esi
call fcn.0042386b
push edi
push esi
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 6
call fcn.0042386b
jmp 0x432eff
xor edi, edi
push 0x68eb70
lea eax, [ebp - 0x58]
push eax
call fcn.0046dfa2
cmp byte [ebp + 0x68], 0
mov byte [ebp - 4], 0x12
je 0x432fa6
cmp dword [ebp - 0x48], 0
je 0x432fa6
cmp dword [ebp - 0x44], 8
mov eax, dword [ebp - 0x58]
jae 0x432f31
lea eax, [ebp - 0x58]
push eax
call fcn.0045c1b0
push 0x68f354
push 0x68f370
sub esp, 0x18
lea eax, [ebp + 0x28]
lea esi, [ebp + 0x40]
push 6
pop ecx
mov edi, esp
push 0x68f374
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.004607f4
add esp, 0x28
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
mov byte [ebp - 4], 0x13
jae 0x432f6f
lea eax, [ebp + 0x28]
push eax
call fcn.0046db54
test eax, eax
je 0x432f91
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
jae 0x432f85
lea eax, [ebp + 0x28]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
xor eax, eax
mov byte [ebp - 4], 0x12
xor edi, edi
lea ecx, [ebp + 0x28]
inc eax
push edi
push eax
mov bl, al
call fcn.0042386b
call fcn.0042da09
test al, al
je 0x432fc3
push 0x68ec3c
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call fcn.0047ffe4
push 0x68f384
push 0x68f3b8
call fcn.0042e68c
push str.application_x_bittorrentsearchdescriptionxml
push 0x68f42c
call fcn.0042e68c
push str.application_x_bittorrent_skin
push 0x68f47c
call fcn.0042e68c
push str.application_x_bittorrent_key
push 0x68f4c8
call fcn.0042e68c
push str.application_x_bittorrent_app
push 0x68f514
call fcn.0042e68c
push str.application_x_bittorrent_appinst
push 0x68f56c
call fcn.0042e68c
push str.Magnet
call fcn.0042e882
push 0x68f594
call fcn.0042e882
push 0x68f516
call fcn.0042e882
push 0x68f56e
call fcn.0042e882
push 0x68f47e
call fcn.0042e882
push 0x68f4ca
call fcn.0042e882
movzx eax, byte [0x76b578]
cmp eax, 5
push str.SoftwareClassesuTorrent
sbb esi, esi
neg esi
add esi, reloc.WS2_32.dll_accept
push esi
call fcn.0047fbb5
push str.SoftwareClassesApplicationsuTorrent.exe
push esi
call fcn.0047fbb5
push str.SoftwareBitTorrent
mov esi, reloc.WS2_32.dll_accept
push esi
call fcn.0047fbb5
push str.SoftwareBitTorrentuTorrent
push esi
call fcn.0047fbb5
push str.SoftwareBitTorrentengine
push esi
call fcn.0047fbb5
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push esi
call fcn.0047fb6b
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047fb6b
test bl, bl
je 0x433187
xor eax, eax
mov dword [ebp + 0x24], 7
mov dword [ebp + 0x20], edi
mov word [ebp + 0x10], ax
cmp dword [0x76b578], 0x80000000
mov esi, str.rmdir__S__Q
mov byte [ebp - 4], 0x14
jb 0x4330f5
mov esi, str.deltree__Y
push esi
call fcn.00423ad9
pop ecx
push eax
push esi
lea ecx, [ebp + 0x10]
call fcn.004340c0
cmp dword [ebp + 0x54], 8
mov eax, dword [ebp + 0x40]
jae 0x433112
lea eax, [ebp + 0x40]
mov esi, dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
push edi
push edi
push eax
call esi
cmp dword [ebp + 0x54], 8
mov ecx, dword [ebp + 0x40]
jae 0x433129
lea ecx, [ebp + 0x40]
push eax
lea eax, [ebp - 0x568]
push eax
push ecx
call esi
test eax, eax
jne 0x433149
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x10]
call fcn.004238b7
jmp 0x433166
lea eax, [ebp - 0x568]
push eax
call fcn.00423ad9
pop ecx
push eax
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp + 0x10]
call fcn.00423947
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x433172
lea eax, [ebp + 0x10]
push eax
call fcn.0058b892
xor esi, esi
lea ecx, [ebp + 0x10]
push edi
inc esi
push esi
call fcn.0042386b
jmp 0x43318f
call fcn.0058ba94
xor esi, esi
inc esi
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.0042386b
push edi
push esi
lea ecx, [ebp + 0x40]
call fcn.0042386b
lea ecx, [ebp - 0x158]
call fcn.00425941
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
lea esp, [ebp + 0x5c]
pop ebp
ret 8