Function at 0x48f380
Capabilities:
Link many functions at runtime
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x144], eax
mov dword [esi + 0x148], eax
mov dword [esi + 0x154], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x17c], 0xffffffff
mov dword [esi + 0x70], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x178], ebx
mov dword [esi + 0x174], ebx
mov dword [esi + 0x170], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x210]
push 0x5c
push ecx
call fcn.004ea650
xor edx, edx
mov word [eax + 2], dx
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48f4f0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x210]
lea edi, [esi + 0xec]
push ecx
mov ecx, edi
call fcn.00403060
push str.RubbishFileDB.bin
lea edx, [ebp - 0x22c]
push edi
push edx
call fcn.0046f700
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0xb4]
push eax
call fcn.00402df0
cmp dword [ebp - 0x214], 8
jb 0x48f550
mov eax, dword [ebp - 0x228]
push eax
call fcn.004ea481
add esp, 4
push 0x512088
push edi
lea ecx, [ebp - 0x248]
push 0x512084
push ecx
call fcn.0046f670
add esp, 0xc
push eax
lea edx, [ebp - 0x22c]
push edx
call fcn.0046f700
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esi + 0xd0]
call fcn.00402df0
cmp dword [ebp - 0x214], 8
jb 0x48f5a1
mov eax, dword [ebp - 0x228]
push eax
call fcn.004ea481
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x230], 8
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], cx
jb 0x48f5d2
mov edx, dword [ebp - 0x244]
push edx
call fcn.004ea481
add esp, 4
push str.___q__I
lea eax, [esi + 0xb4]
push eax
lea eax, [ebp - 0x248]
push str.__d__
push eax
call fcn.0046f670
add esp, 0xc
push eax
lea ecx, [ebp - 0x22c]
push ecx
call fcn.0046f700
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.00402df0
mov edi, 8
cmp dword [ebp - 0x214], edi
jb 0x48f629
mov edx, dword [ebp - 0x228]
push edx
call fcn.004ea481
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], ax
cmp dword [ebp - 0x230], edi
jb 0x48f659
mov ecx, dword [ebp - 0x244]
push ecx
call fcn.004ea481
add esp, 4
push str.SystemCheck.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x10], eax
cmp eax, ebx
je 0x48f7b4
push str.IsRegeditLocked
push eax
call edi
mov edx, dword [esi + 0x10]
push str.UnlockRegedit
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
push str.IsGuestUserEnabled
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.DisableGuestUser
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 0x10]
push str.IsRemoteDesktopEnabled
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x10]
push str.DisableRemoteDesktop
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.IsRemoteAssistanceEnabled
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi + 0x10]
push str.DisableRemoteAssistance
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x10]
push str.IsFirewallOn
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.TurnOnFirewall
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi + 0x10]
push str.CheckHostsFile
push edx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x10]
push str.FixHostsFile
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.GetNetShareNumber
push ecx
mov dword [esi + 0x40], eax
call edi
mov edx, dword [esi + 0x10]
push str.DisableAllNetShare
push edx
mov dword [esi + 0x4c], eax
call edi
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x10]
push str.CheckSystemTime
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.SyncSystemTime
push ecx
mov dword [esi + 0x44], eax
call edi
mov edx, dword [esi + 0x10]
mov dword [esi + 0x48], eax
push str.CheckAutorun
push edx
call edi
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x10]
push str.GetAutorunNumber
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.GetAutorunItemInfo
push ecx
mov dword [esi + 0x58], eax
call edi
mov edx, dword [esi + 0x10]
push str.DeleteAutorunItem
push edx
mov dword [esi + 0x5c], eax
call edi
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x10]
push str.EnumAntiVirusProduct
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.EnumFireWallProduct
push ecx
mov dword [esi + 0x64], eax
call edi
mov edx, dword [esi + 0x10]
push str.EnumAntiSpywareProduct
push edx
mov dword [esi + 0x68], eax
call edi
mov dword [esi + 0x6c], eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [esi + 0x12c]
push str._ssoftAngel.ini
push ecx
call fcn.0046cc40
add esp, 0xc
push str.RegEditScanner.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, ebx
je 0x48f888
push str.CreateRegEditScanner
push eax
call edi
mov edx, dword [esi]
push str.CloseRegEditScanner
push edx
mov dword [esi + 0x78], eax
call edi
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push str.DefaultScanRegEdit
push eax
call edi
mov ecx, dword [esi]
push str.ScanSystemHisRegEdit
push ecx
mov dword [esi + 0x88], eax
call edi
mov edx, dword [esi]
push str.ScanSoftWareHisRegEdit
push edx
mov dword [esi + 0x90], eax
call edi
mov dword [esi + 0x94], eax
mov eax, dword [esi]
push str.ScanIEHisRegEdit
push eax
call edi
mov ecx, dword [esi]
push str.DeleteRegKey
push ecx
mov dword [esi + 0x98], eax
call edi
mov edx, dword [esi]
push str.StopScan
push edx
mov dword [esi + 0x9c], eax
call edi
mov dword [esi + 0xa0], eax
mov eax, dword [esi]
push str.DefBackupRegEdit
push eax
call edi
mov ecx, dword [esi]
push str.thdDefBackupReg
push ecx
mov dword [esi + 0xa8], eax
call edi
mov dword [esi + 0xac], eax
mov eax, dword [esi + 0x78]
cmp eax, ebx
je 0x48f888
call eax
mov dword [esi + 0x70], eax
push str.IEPluginScanner.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x48f8ee
push str.CreateRegEditScanner
push eax
call edi
mov edx, dword [esi + 4]
push str.CloseRegEditScanner
push edx
mov dword [esi + 0x80], eax
call edi
mov dword [esi + 0x84], eax
mov eax, dword [esi + 4]
push str.ScanIEHelperObject
push eax
call edi
mov ecx, dword [esi + 4]
push str.DeleteIEHelper
push ecx
mov dword [esi + 0x8c], eax
call edi
mov dword [esi + 0xa4], eax
cmp dword [esi + 0x84], ebx
je 0x48f8ee
mov edx, dword [esi + 0x80]
call edx
mov dword [esi + 0x74], eax
push str.RubbishFileScanner.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x48f9ac
push str.CreateRubbishFileScanner
push eax
call edi
mov dword [esi + 0x108], eax
mov eax, dword [esi + 8]
push str.CloseRubbishFileScanner
push eax
call edi
mov ecx, dword [esi + 8]
push str.RubbishFileScannerStopScan
push ecx
mov dword [esi + 0x10c], eax
call edi
mov edx, dword [esi + 8]
push str.RubbishFileScannerCreateDB
push edx
mov dword [esi + 0x120], eax
call edi
mov dword [esi + 0x110], eax
mov eax, dword [esi + 8]
push str.RubbishFileScannerScanPath
push eax
call edi
mov ecx, dword [esi + 8]
push str.RubbishFileScannerScanPath4DB
push ecx
mov dword [esi + 0x114], eax
call edi
mov edx, dword [esi + 8]
push str.RubbishFileScannerScanIECache
push edx
mov dword [esi + 0x118], eax
call edi
mov dword [esi + 0x11c], eax
mov eax, dword [esi + 8]
push str.RubbishFileScannerDeleteFile
push eax
call edi
mov ecx, dword [esi + 8]
push str.RubbishFileScannerDeleteIECache
push ecx
mov dword [esi + 0x124], eax
call edi
mov dword [esi + 0x128], eax
mov eax, dword [esi + 0x108]
cmp eax, ebx
je 0x48f9ac
call eax
mov dword [esi + 0xb0], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret