Function at 0x4064a0
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43edc7
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x455d50]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
push str.Advanced_System_Repair_Pro_App
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4064f7
mov ecx, eax
call fcn.0040e3d0
mov dword [ebp - 4], 5
call fcn.00420150
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 7
lea eax, [ebp - 0x234]
push eax
call fcn.0041b450
add esp, 4
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x234]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4065a1
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x22c]
push eax
mov ebx, str._asrrealtimesrv.exe
call fcn.0040dbe0
mov bl, 9
mov byte [ebp - 4], bl
add esp, 4
mov ecx, esp
mov dword [ebp - 0x230], esp
push ecx
mov ecx, str.tscmon
call fcn.0041f290
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], bl
call fcn.00406bd0
mov edx, esp
mov dword [ebp - 0x230], esp
push edx
mov ecx, str.asrrealtimesrv
call fcn.0041f290
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], bl
call fcn.00406bd0
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.0041d7d0
mov eax, dword [ebp - 0x234]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x406832
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x22c]
push edx
mov ebx, 0x448b5c
call fcn.0040dbe0
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x228]
push eax
mov ebx, str.AdvancedSystemRepairPro.exe
call fcn.0040dbe0
add esp, 0x10
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x22c]
call fcn.0041d7d0
mov ecx, dword [ebp - 0x228]
push ecx
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push SysReAllocString
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call esi
mov edx, dword [ebp - 0x228]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call esi
call fcn.0040e350
test al, al
jne 0x406812
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push eax
lea ecx, [ebp - 0x222]
push ecx
call fcn.0042ab60
add esp, 0xc
push 1
push 2
lea edx, [ebp - 0x224]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x224]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x406665
mov eax, dword [0x448b5c]
mov dword [edi], eax
lea edi, [ebp - 0x224]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x406681
mov ecx, 0xd
mov esi, 0x448bc4
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 3
lea ecx, [ebp - 0x22c]
push ecx
call fcn.004198f0
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x238]
push edx
call fcn.00401cd0
mov bl, 0x10
mov byte [ebp - 4], bl
push str.Advanced_System_Repair_Pro
push str.Advanced_System_Repair_Pro
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
lea ecx, [ebp - 0x224]
call fcn.0041f290
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0041c1e0
add esp, 4
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
lea edi, [ebp - 0x238]
call fcn.0040c2e0
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0040d670
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
mov ecx, str.asrtskrb.vbs
call fcn.0041f290
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x244]
push ecx
mov byte [ebp - 4], bl
call fcn.00408e70
mov byte [ebp - 4], 0x14
add esp, 4
mov edx, esp
mov dword [ebp - 0x240], esp
lea eax, [ebp - 0x244]
push eax
push edx
call fcn.0041f900
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x238]
mov edi, dword [ecx - 0xc]
lea esi, [ebp - 0x238]
call fcn.00409550
push eax
mov byte [ebp - 4], 0x14
call fcn.00412890
add esp, 8
lea edx, [ebp - 0x23c]
push edx
call fcn.004163f0
mov byte [ebp - 4], 0x16
lea esi, [ebp - 0x244]
call fcn.0040dcc0
push eax
push str.wscript.exe___B___T:10___s_
lea edi, [ebp - 0x23c]
call fcn.00415be0
add esp, 4
mov eax, esp
mov dword [ebp - 0x240], esp
mov ecx, edi
push ecx
push eax
call fcn.0041f900
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x16
call fcn.0041a160
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x14
mov ecx, edi
call fcn.0041d7d0
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.0041d7d0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x238]
call fcn.0040d670
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x22c]
call fcn.0040d670
push 1
lea edx, [ebp - 0x234]
push edx
call fcn.0040f650
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x228]
call fcn.0041d7d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x234]
call fcn.0041d7d0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x19
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAdvanced_System_Repair_Pro
push SysReAllocString
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call esi
push 0
xor ecx, ecx
call fcn.004096b0
add esp, 4
push 2
lea edi, [ebp - 0x228]
call fcn.00410480
add esp, 4
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x230]
push eax
mov ebx, 0x448b5c
call fcn.0040dbe0
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x22c]
push ecx
mov ebx, 0x448bc4
call fcn.0040dbe0
add esp, 0x10
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x230]
call fcn.0041d7d0
mov bl, 0x1e
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0041d7d0
push 1
lea edx, [ebp - 0x22c]
push edx
call fcn.0040f650
push 1
lea eax, [ebp - 0x230]
push eax
call fcn.00417fb0
add esp, 0x10
mov byte [ebp - 4], 0x1f
mov eax, dword [eax]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0041d7d0
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.00417fb0
add esp, 8
mov byte [ebp - 4], 0x20
mov eax, dword [eax]
push eax
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0041d7d0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x22c]
call fcn.0041d7d0
mov dword [ebp - 4], 0xffffffff
jmp 0x40697d
mov dword [ebp - 4], 0x22
cmp byte [ebp + 8], 0
jne 0x40698f
call fcn.004138b0
push str.SoftwareAdvancedSystemRepairPro
push SysReAllocString
call esi
push str.SoftwareAdvancedSystemRepairPro
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x24
mov dword [ebp - 4], 0xffffffff
jmp 0x4069f4
mov ebx, 0x26
mov dword [ebp - 4], ebx
cmp byte [ebp + 8], 0
jne 0x406ab3
push 0x23
lea edi, [ebp - 0x228]
call fcn.00410480
add esp, 4
mov byte [ebp - 4], 0x27
mov edx, 0x448b60
call fcn.0040e0c0
push 1
mov edx, edi
push edx
call fcn.0040f650
add esp, 8
push str.SOFTWAREClassesAppID_asrrealtimesrv.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesAppID233F8F82_F91E_4E49_2222_BD21AB39D1BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesAppID2245B082_41FA_478E_8DEA_86177F1394BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesCLSID233F8F82_F91E_4E49_2222_BD21AB39D1BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface23387882_DEAA_4971_2222_5D5046F2B3BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface2532D782_C4FC_4ED8_2222_D654E27AF7F8
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface2F343382_EFC2_49C9_2222_FC0C403B0EBB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesTypeLib23311E82_B997_11CF_2222_0080C7B2D6BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClasses_asrrealtimesrv.Gate
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClasses_asrrealtimesrv.Gate.1
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0041d7d0
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00422c3d
mov esp, ebp
pop ebp
ret