Function at 0x40aab0
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x4552a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x340
mov eax, dword [0x471df4]
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], eax
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x358], edi
mov dword [esp + 0x10], eax
push str.SoftwareUIUUIU_CLEAN_UPFILES
push 0x80000002
mov byte [esp + 0x360], 2
call fcn.0042ffc0
mov ebp, dword [ebx + 0x98c]
mov esi, dword [ebx + 0x984]
add esp, 8
test ebp, ebp
jbe 0x40ab5d
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0x10]
push eax
call fcn.0044a4c1
push edi
lea eax, [esp + 0x18]
push 0x46b1d8
push eax
call fcn.004497ea
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0
push ecx
push edx
push str.SoftwareUIUUIU_CLEAN_UPFILES
push 0x80000002
call fcn.004301e0
add esp, 0x20
inc edi
cmp edi, ebp
jb 0x40ab19
mov eax, dword [ebx + 0xd64]
test eax, eax
mov eax, str.Enum_
je 0x40ab71
mov eax, str.SystemCurrentControlSetEnum_
push eax
lea ecx, [esp + 0x3c]
call fcn.0044a442
push str.SoftwareUIUUIU_CLEAN_UPDEVICEID
push 0x80000002
mov byte [esp + 0x360], 3
call fcn.0042ffc0
mov eax, dword [ebx + 0x884]
mov esi, dword [ebx + 0x87c]
mov edi, dword [ebx + 0x860]
mov ebp, dword [ebx + 0x898]
add esp, 8
test eax, eax
jbe 0x40acb6
mov dword [esp + 0x34], eax
mov ebx, esi
mov esi, dword [esi]
push 0x46a404
lea ecx, [esp + 0x2c]
call fcn.0044a442
mov dword [esp + 0x40], eax
mov eax, edi
mov edi, dword [edi]
add eax, 8
lea ecx, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
mov byte [esp + 0x364], 4
call fcn.0044a5b7
mov edx, dword [esp + 0x40]
mov byte [esp + 0x358], 5
push edx
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0044a5b7
add ebx, 8
lea ecx, [esp + 0x2c]
push ebx
push eax
push ecx
mov byte [esp + 0x364], 6
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x35c], 7
call fcn.0044a4c1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x358], 6
call fcn.0044a3d4
lea ecx, [esp + 0x30]
mov byte [esp + 0x358], 5
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x358], 4
call fcn.0044a3d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x358], 3
call fcn.0044a3d4
mov eax, ebp
mov ebp, dword [ebp]
add eax, 8
lea ecx, [esp + 0x14]
push eax
call fcn.0044a4c1
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push edx
push eax
push str.SoftwareUIUUIU_CLEAN_UPDEVICEID
push 0x80000002
call fcn.004301e0
mov eax, dword [esp + 0x48]
add esp, 0x14
dec eax
mov dword [esp + 0x34], eax
jne 0x40abb9
mov ebx, dword [esp + 0x18]
push str.SoftwareUIUUIU_CLEAN_UPDEVICEPATHS
push 0x80000002
call fcn.0042ffc0
mov ebp, dword [ebx + 0x9f4]
mov esi, dword [ebx + 0x9ec]
add esp, 8
xor edi, edi
test ebp, ebp
jbe 0x40ad1e
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0x10]
push eax
call fcn.0044a4c1
push edi
lea ecx, [esp + 0x18]
push 0x46b1d8
push ecx
call fcn.004497ea
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push 0
push edx
push eax
push str.SoftwareUIUUIU_CLEAN_UPDEVICEPATHS
push 0x80000002
call fcn.004301e0
add esp, 0x20
inc edi
cmp edi, ebp
jb 0x40acda
lea ecx, [esp + 0x44]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.SoftwareUIUUIU_CLEAN_UPUNINSTALLERFILE
push 0x80000002
call fcn.0042ffc0
mov esi, dword [ebx + 0x8d8]
mov ebp, dword [ebx + 0x8d0]
add esp, 8
xor edi, edi
test esi, esi
mov dword [esp + 0x2c], esi
jbe 0x40ae7d
mov eax, ebp
mov ebp, dword [ebp]
add eax, 8
lea ecx, [esp + 0x10]
push eax
call fcn.0044a4c1
push 0x46a404
lea ecx, [esp + 0x14]
call fcn.00449464
cmp eax, 0xffffffff
jne 0x40ae46
push 0x46af68
lea ecx, [esp + 0x14]
call fcn.00449464
cmp eax, 0xffffffff
jne 0x40ae46
push 0x46a404
lea ecx, [esp + 0x34]
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x44]
lea ecx, [esp + 0x24]
push edx
mov byte [esp + 0x35c], 8
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x360], 9
push eax
call fcn.0044a5b7
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x364], 0xa
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x35c], 0xb
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x358], 0xa
call fcn.0044a3d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x358], 9
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x358], 8
call fcn.0044a3d4
lea ecx, [esp + 0x30]
mov byte [esp + 0x358], 3
call fcn.0044a3d4
mov esi, dword [esp + 0x2c]
push edi
lea eax, [esp + 0x18]
push 0x46b1d8
push eax
call fcn.004497ea
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0
push ecx
push edx
push str.SoftwareUIUUIU_CLEAN_UPUNINSTALLERFILE
push 0x80000002
call fcn.004301e0
add esp, 0x20
inc edi
cmp edi, esi
jb 0x40ad5a
mov eax, dword [ebx + 0xd64]
test eax, eax
jne 0x40aec4
lea eax, [ebx + 0x600]
push 0
push eax
push str.SourcePath
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.004301e0
lea ecx, [ebx + 0x704]
push 0
push ecx
push str.SearchLocation
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.004301e0
add esp, 0x28
lea edx, [esp + 0x24c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x471df4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x148]
mov byte [esp + 0x358], 0xd
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.UIUCU.EXE
lea ecx, [esp + 0x28]
call fcn.0044a442
mov esi, eax
lea ecx, [esp + 0x148]
mov byte [esp + 0x358], 0xe
push ecx
lea ecx, [esp + 0x2c]
call fcn.0044a442
push esi
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x364], 0xf
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x35c], 0x10
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x358], 0xf
call fcn.0044a3d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x358], 0xe
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x358], 0xd
call fcn.0044a3d4
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24c]
push eax
push ecx
call fcn.0042cf30
mov eax, dword [ebx + 0x5dc]
add esp, 8
test eax, 0x80000000
je 0x40afd9
lea edx, [esp + 0x20]
push str.__CLEAN_UP__S
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.0044a61d
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x35c], 0x11
call fcn.0044a4c1
mov byte [esp + 0x358], 0xd
lea ecx, [esp + 0x18]
jmp 0x40b00b
lea ecx, [esp + 0x20]
push str.__CLEAN_UP
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0044a61d
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x35c], 0x12
call fcn.0044a4c1
mov byte [esp + 0x358], 0xd
lea ecx, [esp + 0x18]
call fcn.0044a3d4
push str.__S2
lea ecx, [esp + 0x20]
call fcn.0044a764
mov al, byte [ebx + 0x5dc]
pop edi
pop esi
pop ebp
test al, 8
pop ebx
je 0x40b03a
push str.__ACF_POST_QFE
lea ecx, [esp + 0x10]
call fcn.0044a764
mov eax, dword [esp + 0xc]
push 0
push eax
push str.UIUCU
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.004301e0
add esp, 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x348], 0xc
call fcn.0044a3d4
lea ecx, [esp + 0x10]
mov byte [esp + 0x348], 3
call fcn.0044a3d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x348], 2
call fcn.0044a3d4
lea ecx, [esp]
mov byte [esp + 0x348], 1
call fcn.0044a3d4
lea ecx, [esp + 4]
mov byte [esp + 0x348], 0
call fcn.0044a3d4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x348], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x340]
mov dword fs:[0], ecx
add esp, 0x34c
ret