Function at 0x40ad07
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x44dd60]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x4380f9
call fcn.00425684
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
push str.Advanced_System_Repair_Pro_App
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40ad4b
push eax
call fcn.00410274
pop ecx
mov dword [ebp - 4], 5
call fcn.00418d5e
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 7
lea eax, [ebp - 0x20]
push eax
call fcn.00418cb3
pop ecx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x40add9
push str._asrrealtimesrv.exe
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0x20]
call fcn.0041d775
mov byte [ebp - 4], 9
add esp, 4
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, str.tscmon
call fcn.0041310d
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 9
call fcn.0041c13b
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, str.asrrealtimesrv
call fcn.0041310d
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 9
call fcn.0041c13b
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.0040f6db
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x40afd9
mov edi, 0x441b4c
push edi
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0x20]
call fcn.0041d775
mov byte [ebp - 4], 0xc
push str.AdvancedSystemRepairPro.exe
lea ecx, [ebp - 0x18]
push ecx
mov esi, eax
call fcn.0041d775
add esp, 0x10
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c]
call fcn.0040f6db
push dword [ebp - 0x18]
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov ebx, SysReAllocString
push ebx
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call esi
push dword [ebp - 0x18]
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push ebx
call esi
call fcn.0041cc55
test al, al
jne 0x40afc0
xor eax, eax
mov word [ebp], ax
push 0x206
push eax
lea eax, [ebp + 2]
push eax
call fcn.00423ac0
add esp, 0xc
push 1
push 2
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
lea eax, [ebp]
push eax
call fcn.004245bd
push 0x441bb4
lea eax, [ebp]
push eax
call fcn.004245bd
add esp, 0x10
push 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0040ba95
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x24]
push eax
call fcn.004075cd
mov byte [ebp - 4], 0x10
mov eax, 0x441ddc
push eax
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
push eax
lea ecx, [ebp]
call fcn.0041310d
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x10
call fcn.00408f4b
pop ecx
pop ecx
mov byte [ebp - 4], 0x12
push dword [eax]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
push eax
call fcn.00416790
add esp, 0x14
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x14]
call fcn.004075aa
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
push eax
mov ecx, str.asrtskrb.vbs
call fcn.0041310d
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x10
lea ebx, [ebp - 0x2c]
call fcn.00414b81
mov byte [ebp - 4], 0x14
mov eax, esp
mov dword [ebp - 0x28], esp
mov ecx, ebx
push ecx
push eax
call fcn.0040f3c0
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax - 0xc]
lea esi, [ebp - 0x24]
call fcn.0041bdac
push eax
mov byte [ebp - 4], 0x14
call fcn.00416224
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
call fcn.0040d11f
mov byte [ebp - 4], 0x16
lea esi, [ebp - 0x2c]
call fcn.00415d83
push eax
push str.wscript.exe___B___T:10___s_
lea eax, [ebp - 0x30]
call fcn.0040a1d8
pop ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.0040f3c0
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x16
call fcn.00408b0c
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x30]
call fcn.0040f6db
mov byte [ebp - 4], 0x10
mov ecx, esi
call fcn.0040f6db
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x24]
call fcn.004075aa
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c]
call fcn.004075aa
push 1
lea eax, [ebp - 0x20]
push eax
call fcn.0040a7a0
pop ecx
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x18]
call fcn.0040f6db
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.0040f6db
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x19
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAdvanced_System_Repair_Pro
push SysReAllocString
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call edi
xor ebx, ebx
push ebx
push ebx
call fcn.004119a8
push 2
lea eax, [ebp - 0x18]
push eax
call fcn.0040ea3a
mov byte [ebp - 4], 0x1a
push 0x441b4c
lea ecx, [ebp - 0x14]
push ecx
mov esi, eax
call fcn.0041d775
mov byte [ebp - 4], 0x1b
push 0x441bb4
lea ecx, [ebp - 0x1c]
push ecx
mov esi, eax
call fcn.0041d775
add esp, 0x20
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x14]
call fcn.0040f6db
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x18]
call fcn.0040f6db
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a7a0
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.0041d641
add esp, 0x10
mov byte [ebp - 4], 0x1f
mov eax, dword [eax]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.0041d641
pop ecx
pop ecx
mov byte [ebp - 4], 0x20
mov eax, dword [eax]
push eax
call esi
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x14]
call fcn.0040f6db
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c]
call fcn.0040f6db
or dword [ebp - 4], 0xffffffff
jmp 0x40b0ee
mov dword [ebp - 4], 0x22
cmp byte [ebp + 0x214], 0
jne 0x40b103
call fcn.00410bca
mov esi, str.SoftwareAdvancedSystemRepairPro
push esi
push SysReAllocString
call edi
push esi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call edi
or dword [ebp - 4], 0xffffffff
jmp 0x40b134
mov dword [ebp - 4], 0x24
or dword [ebp - 4], 0xffffffff
jmp 0x40b156
mov dword [ebp - 4], 0x26
cmp byte [ebp + 0x214], 0
jne 0x40b2ec
push 0x23
lea eax, [ebp - 0x18]
push eax
call fcn.0040ea3a
pop ecx
pop ecx
mov byte [ebp - 4], 0x27
push 0x441b50
lea eax, [ebp - 0x18]
push eax
call fcn.004171dd
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.0040a7a0
pop ecx
pop ecx
push 0x6d
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x28
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x6e
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x29
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x6f
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x2a
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x70
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x2b
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x71
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x2c
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x72
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x2d
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x73
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x2e
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x74
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x2f
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x75
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x30
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
push 0x76
lea eax, [ebp - 0x14]
push eax
call fcn.00406d3c
mov byte [ebp - 4], 0x31
mov eax, dword [eax]
push eax
push esi
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x14]
call fcn.0040f6db
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x18]
call fcn.0040f6db
or dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.004098a2
add ebp, 0x20c
leave
ret