Function at 0x421100
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4536c8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x138
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x148], esi
test esi, esi
jne 0x421155
or eax, 0xffffffff
jmp 0x4234b0
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0x423a
call fcn.0040d850
test eax, eax
je 0x421177
push eax
call fcn.0042524f
add esp, 4
add esi, 0x18
mov ecx, esi
mov dword [ebp - 0x140], esi
call fcn.00409c40
mov ecx, eax
call fcn.00411050
test al, al
jne 0x42119c
mov eax, 2
jmp 0x4234b0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
xor esi, esi
nop dword [eax]
push 0
push str.UVK_Ultra_GUI
call edi
push 0
push str.Log_analyzerW
mov dword [ebp - 0x144], eax
call edi
mov edi, eax
mov eax, dword [ebp - 0x144]
test eax, eax
jne 0x4211da
test edi, edi
je 0x421218
jmp 0x4211f1
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
je 0x421204
push 0
push 0xf060
push 0x112
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
inc esi
cmp esi, 0xa
jl 0x4211b0
mov ecx, 0x46f40c
call fcn.00411da0
mov ecx, 0x46f424
call fcn.00411da0
mov ecx, 0x46f448
call fcn.00411da0
xorps xmm0, xmm0
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0xa8]
movq qword [ebp - 0xa8], xmm0
call fcn.004099b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x38], xmm0
call fcn.004099b0
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x44]
movq qword [ebp - 0x44], xmm0
call fcn.004099b0
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
lea ecx, [ebp - 0xb4]
movq qword [ebp - 0xb4], xmm0
call fcn.004099b0
mov esi, dword [ebp - 0x140]
sub esp, 0x1c
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x54], xmm0
mov dword [ebp - 0x4c], 0
push 0
push 0
push 0
push str.UVK.zip
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409a30
push 0
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.00409c40
push eax
push 0xa
push 0xcd
call fcn.00418100
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c40
mov ecx, eax
call fcn.0041e800
lea ecx, [ebp - 0x54]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
xorps xmm0, xmm0
lea ecx, [ebp - 0xe4]
movups xmmword [ebp - 0xe4], xmm0
movups xmmword [ebp - 0xd4], xmm0
call fcn.00410260
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x139], 1
push 0x23
call fcn.00409e80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKUltra_Adware_Killer
lea ecx, [ebp - 0x44]
call fcn.0040aa90
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0xa8]
call fcn.00409be0
lea ecx, [ebp - 0xa8]
call fcn.00409c40
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x421423
push 0
lea ecx, [ebp - 0xa8]
call fcn.00409c40
push eax
lea ecx, [ebp - 0xe4]
call fcn.00410480
test eax, eax
je 0x42140a
push ecx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xe4]
call fcn.004107d0
test eax, eax
je 0x42140a
lea ecx, [ebp - 0xa8]
call fcn.0040a570
cmp eax, 0x413
setb byte [ebp - 0x139]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.00410bc0
cmp byte [ebp - 0x139], 0
je 0x4215a5
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.zip
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409be0
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov ecx, eax
call fcn.00411050
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.dat
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0xb4]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x54]
call fcn.00409c40
push eax
push 0xa
push 0xce
call fcn.00418100
test al, al
je 0x4214b9
lea ecx, [ebp - 0xb4]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c40
mov ecx, eax
call fcn.0041e800
lea ecx, [ebp - 0xb4]
call fcn.00409c40
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
or eax, 2
lea ecx, [ebp - 0xb4]
push eax
call fcn.00409c40
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x44]
call fcn.0040aa90
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push 2
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0xe4]
call fcn.00410480
push 0x413
lea ecx, [ebp - 0x38]
call fcn.0040a390
push eax
lea ecx, [ebp - 0xe4]
call fcn.00410920
push ecx
lea ecx, [ebp - 0xe4]
call fcn.00410bc0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
call edi
or eax, 2
lea ecx, [ebp - 0x44]
push eax
call fcn.00409c40
push eax
call esi
lea ecx, [ebp - 0x54]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [ebp - 0x140]
sub esp, 0x1c
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x78], xmm0
push 0
push 0
push 0
push str.UVK_en.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x78]
call fcn.00409a30
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 6
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
call fcn.00411010
push ecx
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x421744
push str.UVK_x64_.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push 1
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push 1
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call esi
push ecx
mov esi, dword [ebp - 0x140]
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
jmp 0x421867
push str.UVK.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push 1
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x64_.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x140]
push 0
push str.UVK.dll
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
push 1
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call esi
mov esi, dword [ebp - 0x140]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
sub esp, 8
lea ecx, [ebp - 0x44]
push 0x23
call fcn.00409e80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKImmunizationRebootExec.exe
lea ecx, [ebp - 0x44]
call fcn.0040aa90
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x4218e7
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._bluescreenview.zip
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x54]
call fcn.00409c40
push eax
push 0xa
push 0xc9
call fcn.00418100
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c40
mov ecx, eax
call fcn.0041e800
lea ecx, [ebp - 0x54]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_tool.zip
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x54]
call fcn.00409c40
push eax
push 0xa
push 0xca
call fcn.00418100
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c40
mov ecx, eax
call fcn.0041e800
lea ecx, [ebp - 0x54]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Pictures.zip
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x54]
call fcn.00409c40
push eax
push 0xa
push 0xcb
call fcn.00418100
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c40
mov ecx, eax
call fcn.0041e800
lea ecx, [ebp - 0x54]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesAbstract.jpg
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
push 0x46e194
push 0x65
call fcn.00418100
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesUVK.png
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
push 0x46e194
push 0x64
call fcn.00418100
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Icons.zip
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x54]
call fcn.00409c40
push eax
push 0xa
push 0xcc
call fcn.00418100
mov ecx, esi
call fcn.00409c40
push eax
lea ecx, [ebp - 0x54]
call fcn.00409c40
mov ecx, eax
call fcn.0041e800
lea ecx, [ebp - 0x54]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
mov esi, dword [ebp - 0x148]
mov byte [ebp - 0x139], 0
cmp dword [esi + 0xc], 0
je 0x421fff
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.key.uvkey
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [esi + 0x24]
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esi + 0xc], 2
jne 0x421c51
lea eax, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 0x144], eax
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x421c51
push dword [ebp - 0x144]
lea ecx, [ebp - 0x44]
call fcn.00409a80
push ecx
lea ecx, [ebp - 0x44]
call fcn.00409d50
mov ecx, dword [ebp - 0x140]
sub esp, 0x28
push 0x46d668
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.0040ada0
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
mov ecx, dword [ebp - 0x144]
push eax
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x38]
call fcn.00409a80
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.BrandIco.ico
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x44]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
movaps xmm0, xmmword [0x4729e0]
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], 0x100
movups xmmword [ebp - 0x28], xmm0
call fcn.00409c40
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.00409c40
mov edx, esi
mov ecx, eax
call fcn.0041fbd0
mov esi, dword [ebp - 0x148]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esi + 0x54]
push 0
push str.UVKSettings.ini
mov ecx, eax
mov dword [ebp - 0x140], eax
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
cmp dword [esi + 0x10], 0
je 0x421ce3
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x421ce3
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSettings.ini
lea ecx, [esi + 0x18]
mov byte [ebp - 0x139], 1
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x421cea
mov byte [ebp - 0x139], 0
cmp dword [esi + 0x10], 0
je 0x421fff
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x6c]
movq qword [ebp - 0x6c], xmm0
call fcn.004099b0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
sub esp, 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6c]
push 0x23
call fcn.00409e80
mov ecx, eax
call fcn.0040aa90
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_SR_settings.uvksr
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.DefaultsUVK_SR_settings.uvksr
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x421dbf
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
call esi
jmp 0x421dc5
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_Repair.uvk
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.DefaultsUVK_Repair.uvk
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x421e3f
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_Maintenance.uvk
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.DefaultsUVK_Maintenance.uvk
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x421eb9
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_SU_whitelist.ini
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Smart_uninstallerWhitelist.ini
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x421f53
push ecx
lea ecx, [ebp - 0x38]
call fcn.00409c40
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.00409c40
mov edx, esi
mov ecx, eax
call fcn.00419110
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAK_White_list.ini
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Ultra_Adware_KillerSettingsWhitelist.ini
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x421fed
push ecx
lea ecx, [ebp - 0x38]
call fcn.00409c40
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.00409c40
mov edx, esi
mov ecx, eax
call fcn.00419110
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.00409af0
mov esi, dword [ebp - 0x148]
push ecx
push 0x20019
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call fcn.0040c670
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
lea ecx, [ebp - 0x9c]
movq qword [ebp - 0x9c], xmm0
call fcn.004099b0
xorps xmm0, xmm0
mov dword [ebp - 0x88], 0
lea ecx, [ebp - 0x90]
movq qword [ebp - 0x90], xmm0
call fcn.004099b0
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push eax
lea ecx, [ebp - 0x84]
movq qword [ebp - 0x84], xmm0
call fcn.004099d0
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xb
call fcn.00418fd0
sub esp, 8
lea ecx, [ebp - 0x9c]
push 0x10
call fcn.00409e80
sub esp, 8
lea ecx, [ebp - 0x90]
push 0x19
call fcn.00409e80
cmp byte [ebp - 0x139], 0
jne 0x4222fd
lea eax, [ebp - 0x38]
push eax
push str.DisplayName
lea ecx, [ebp - 0x2c]
call fcn.0040c800
test al, al
je 0x4222fd
lea ecx, [ebp - 0x38]
call fcn.00409b70
test eax, eax
je 0x4222fd
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
jne 0x42224a
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
jne 0x42224a
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK.lnk
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
jne 0x42224a
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
jne 0x42224a
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
jne 0x42224a
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
jne 0x42224a
and dword [esi + 8], 0xffffffef
mov edx, 0x46c60c
mov ecx, str.HKCR64_shellForce_Deletecommand
call fcn.0040d9f0
test al, al
jne 0x422274
mov edx, 0x46c60c
mov ecx, str.HKCR_shellDelete_with_UVKcommand
call fcn.0040d9f0
test al, al
jne 0x422274
and dword [esi + 8], 0xfffffffb
mov edx, 0x46c60c
mov ecx, str.HKCR.uvk
call fcn.0040d9f0
test al, al
jne 0x42229e
mov edx, 0x46c60c
mov ecx, str.HKCRUVKCommandsScript
call fcn.0040d9f0
test al, al
jne 0x42229e
and dword [esi + 8], 0xfffffff7
push ecx
push 0x20019
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x48], 0
call fcn.0040c690
lea eax, [ebp - 0x48]
push eax
push str.AutoUpdate
lea ecx, [ebp - 0x2c]
call fcn.0040c940
test al, al
je 0x4222d3
cmp dword [ebp - 0x48], 0
jne 0x4222d7
and dword [esi + 8], 0xffffffdf
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push str.ShowTooltips
lea ecx, [ebp - 0x2c]
call fcn.0040c940
test al, al
je 0x4222f9
cmp dword [ebp - 0x48], 0
jne 0x4222fd
and dword [esi + 8], 0xffffffbf
sub esp, 0x1c
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x78]
movq qword [ebp - 0x20], xmm0
push 0
push 0
push 0
push str.__Uninst
call fcn.00409c40
push eax
lea ecx, [ebp - 0x20]
call fcn.00409a30
xorps xmm0, xmm0
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xc4]
movq qword [ebp - 0xc4], xmm0
call fcn.004099b0
sub esp, 0x1c
mov byte [ebp - 4], 0xd
cmp dword [esi + 0xc], 2
mov ecx, 0x46f40c
mov eax, str.Brandico.ico
mov dword [ebp - 0x64], 0
cmovne eax, ecx
xorps xmm0, xmm0
push 0
push 0
push eax
push 0x46d668
lea ecx, [esi + 0x18]
movq qword [ebp - 0x6c], xmm0
call fcn.00409c40
push eax
lea ecx, [ebp - 0x6c]
call fcn.00409a30
push ecx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xe
call fcn.00409c40
push eax
push 1
push str.DisplayName
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
push 1
push str.InstallLocation
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea ecx, [ebp - 0x20]
call fcn.00409c40
push eax
push 1
push str.UninstallString
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
push 1
push str.DisplayIcon
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea ecx, [esi + 0x6c]
call fcn.00409c40
push eax
push 1
push str.Publisher
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
sub esp, 0xc
lea ecx, [ebp - 0xc4]
push 0x46faa4
call fcn.0040b220
push 0
lea ecx, [ebp - 0xc4]
call fcn.00409c40
push eax
push 1
push str.DisplayVersion
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
lea ecx, [esi + 0x18]
call fcn.00409c40
mov ecx, eax
call fcn.0040f9d0
shrd eax, edx, 0xa
push 0
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x48]
shr edx, 0xa
push eax
push 4
push str.EstimatedSize
call fcn.0040cba0
push 0
push str.http:__www.carifred.com_uvk_help
push 1
push str.HelpLink
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
push str.http:__www.carifred.com_uvk
push 1
push str.URLInfoAbout
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 1
push eax
push 4
push str.NoModify
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea eax, [ebp - 0x48]
push eax
push 4
push str.NoRepair
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 7
push eax
push 4
push str.VersionMajor
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 8
push eax
push 4
push str.VersionMinor
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push ecx
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
push 1
push 0x46c60c
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsUVK_en.exe
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push 0
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
push 1
push str.Path
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push str.HKCRShellDelete_with_UVK
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKCRShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKCRDirectoryShellDelete_with_UVK
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKCRDirectoryShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKCRShellFile_Information
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
test byte [esi + 8], 4
je 0x4226ae
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Delete
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellFile_Information
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
sub esp, 0x1c
mov dword [ebp - 0x58], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x78]
movq qword [ebp - 0x60], xmm0
push 0
push 0
push str.____1_
call fcn.00409c40
push eax
push 0x46de90
lea ecx, [ebp - 0x60]
call fcn.00409a30
push ecx
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xf
call fcn.00409c40
push eax
push 1
push 0x46c60c
push str.HKLM64SOFTWAREClassesShellForce_Deletecommand
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push ecx
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
push 1
push 0x46c60c
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Deletecommand
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___FileInfo___1_
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
push 0x46de90
lea ecx, [ebp - 0x60]
call fcn.00409be0
push ecx
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
push 1
push 0x46c60c
push str.HKLM64SOFTWAREClassesShellFile_Informationcommand
lea ecx, [ebp - 0x2c]
call fcn.0040cc20
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xe
call fcn.00409af0
push str.HKCRUVKCommandsFile
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKLM64SOFTWAREClassesUVKCommandsScriptDefaultIcon
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKLM64SOFTWAREClassesSrSettingsFileDefaultIcon
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
cmp dword [esi + 0xc], 2
jne 0x4226eb
lea ecx, [ebp - 0x6c]
call fcn.00409c40
mov dword [ebp - 0x140], eax
jmp 0x4226f5
mov dword [ebp - 0x140], 0
test byte [esi + 8], 8
je 0x42280d
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___readfile___1_
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
push 0x46de90
lea ecx, [ebp - 0x44]
call fcn.00409be0
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
push str.UVK_commands_script
mov edx, str.UVKCommandsScript
mov ecx, str..uvk
call fcn.00418b00
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___ImportSr___1_
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
push 0x46de90
lea ecx, [ebp - 0x44]
call fcn.00409be0
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
push str.System_repair_settings_file
mov edx, str.SrSettingsFile
mov ecx, str..uvksr
call fcn.00418b00
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe_
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
push 0x46de90
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4702b4
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
call fcn.00418e30
jmp 0x422841
push str.HKCR.uvk
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKCRUVKCommandsScript
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKCR.uvksr
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push str.HKCRSrSettingsFile
lea ecx, [ebp - 0x2c]
call fcn.0040cd80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____1_
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
push 0x46de90
lea ecx, [ebp - 0x44]
call fcn.00409be0
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
push str.UVK_license_key
mov edx, str.UVKLicenseKey
mov ecx, str..uvkey
call fcn.00418b00
mov eax, dword [esi + 8]
shr eax, 5
and eax, 1
push ecx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x48]
push eax
push 4
push str.AutoUpdate
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
call fcn.0040cc20
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x2c]
shr eax, 6
and eax, 1
push 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push 4
push str.ShowTooltips
call fcn.0040cba0
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x2c]
shr eax, 4
and eax, 1
push 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push 4
push str.DesktopShortcut
call fcn.0040cba0
push 0
lea ecx, [esi + 0x60]
call fcn.00409c40
push eax
push 1
push str.InstallSource
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
push 1
push str.InstallDir
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push str.GuiBkColor
lea ecx, [ebp - 0x2c]
call fcn.0040cd10
push str.GroupBorderColor
lea ecx, [ebp - 0x2c]
call fcn.0040cd10
push str.GroupBkColor
lea ecx, [ebp - 0x2c]
call fcn.0040cd10
push str.ButtonColor0
lea ecx, [ebp - 0x2c]
call fcn.0040cd10
push str.ButtonColor1
lea ecx, [ebp - 0x2c]
call fcn.0040cd10
push str.ButtonColor2
lea ecx, [ebp - 0x2c]
call fcn.0040cd10
push str.ButtonColor3
lea ecx, [ebp - 0x2c]
call fcn.0040cd10
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 1
push eax
push 4
push str.PortableVersion
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push 0
lea eax, [ebp - 0x48]
push eax
push 4
push str.EulaAccepted
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
push str.TBinder
push str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
lea ecx, [ebp - 0x2c]
call fcn.0040cd40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemBooster
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0xf003f
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c690
test al, al
je 0x422a4f
lea eax, [ebp - 0x44]
push eax
push str.JunkFileExtensions
lea ecx, [ebp - 0x2c]
call fcn.0040c800
test al, al
je 0x422a4f
push 0
push 0
push 0x46db20
push str.bak
lea ecx, [ebp - 0x44]
call fcn.0040aef0
push 0
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
push 1
push str.JunkFileExtensions
lea ecx, [ebp - 0x2c]
call fcn.0040cba0
lea ecx, [ebp - 0x78]
call fcn.00409c40
mov ecx, eax
call fcn.004182c0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov ecx, eax
call fcn.004182c0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov ecx, eax
call fcn.004182c0
sub esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.00409c40
mov edx, str.Ultra_virus_killer
mov ecx, eax
call fcn.004114b0
call fcn.004183c0
call fcn.00419020
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x60]
movq qword [ebp - 0x60], xmm0
call fcn.004099b0
sub esp, 8
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x60]
push 2
call fcn.00409e80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422b63
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422baf
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470630
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422bfb
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470678
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422c47
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422c9d
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
sub esp, 8
lea ecx, [ebp - 0x60]
push 0x17
call fcn.00409e80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422cf6
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422d42
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470630
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422d8e
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470678
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422dda
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 2
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x422e30
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov edx, 6
mov ecx, eax
call fcn.0040fc40
lea ecx, [ebp - 0x38]
call fcn.00409c40
mov ecx, eax
call fcn.00411050
push 0x4c
lea eax, [ebp - 0x138]
push 0
push eax
call fcn.0043eb00
add esp, 0xc
lea ecx, [ebp - 0x138]
call fcn.0040eeb0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x11
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x38]
call fcn.0040aa90
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f060
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f160
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f1b0
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f200
sub esp, 8
lea ecx, [ebp - 0x138]
call fcn.0040f1e0
lea ecx, [ebp - 0x138]
call fcn.0040f230
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.lnk
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x44]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f060
lea ecx, [ebp - 0x44]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f160
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f200
lea ecx, [ebp - 0x138]
call fcn.0040f230
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Uninstall.lnk
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x60]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f060
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f160
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f1b0
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f200
push ecx
lea ecx, [ebp - 0x138]
call fcn.0040f190
lea ecx, [ebp - 0x138]
call fcn.0040f230
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x42308a
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x4230d6
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470700
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x423122
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470738
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x42316e
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x9c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x4231c7
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x423213
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
test byte [esi + 8], 0x10
je 0x42322d
push 0x46eb4c
lea ecx, [ebp - 0x84]
call fcn.00409ac0
test al, al
je 0x423279
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x423279
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470700
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x4232c5
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x470738
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
lea ecx, [ebp - 0x38]
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x423311
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x84]
call fcn.00409c40
push eax
push 0x46d668
lea ecx, [ebp - 0x90]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x38]
call fcn.00409be0
test byte [esi + 8], 0x10
lea ecx, [ebp - 0x38]
je 0x4233ae
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f060
lea ecx, [ebp - 0x78]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f160
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f1b0
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x138]
call fcn.0040f200
lea ecx, [ebp - 0x138]
call fcn.0040f230
jmp 0x4233cb
call fcn.00409c40
push eax
call edi
test eax, eax
je 0x4233cb
lea ecx, [ebp - 0x38]
call fcn.00409c40
xor edx, edx
mov ecx, eax
call fcn.0040fc40
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
sub esp, 8
lea ecx, [esi + 0x18]
call fcn.00409c40
push eax
lea ecx, [ebp - 0x78]
call fcn.00409c40
mov edx, dword [esi + 0x14]
mov ecx, eax
call fcn.00410db0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x138]
call fcn.0040f260
lea ecx, [ebp - 0x60]
call fcn.00409af0
lea ecx, [ebp - 0x6c]
call fcn.00409af0
lea ecx, [ebp - 0xc4]
call fcn.00409af0
lea ecx, [ebp - 0x20]
call fcn.00409af0
lea ecx, [ebp - 0x84]
call fcn.00409af0
lea ecx, [ebp - 0x90]
call fcn.00409af0
lea ecx, [ebp - 0x9c]
call fcn.00409af0
lea ecx, [ebp - 0x2c]
call fcn.0040c6c0
lea ecx, [ebp - 0x78]
call fcn.00409af0
lea ecx, [ebp - 0xdc]
call fcn.0040b700
mov eax, dword [ebp - 0xe4]
cmp eax, 0xffffffff
je 0x423480
test eax, eax
je 0x423480
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x54]
call fcn.00409af0
lea ecx, [ebp - 0xb4]
call fcn.00409af0
lea ecx, [ebp - 0x44]
call fcn.00409af0
lea ecx, [ebp - 0x38]
call fcn.00409af0
lea ecx, [ebp - 0xa8]
call fcn.00409af0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret