Function at 0x41c910
Capabilities:
Check if file exists
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b5b78
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x284], esi
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 8]
call fcn.0041d530
cmp dword [esi + 0x18], 0
je 0x41d4cf
cmp dword [esi + 0x90], 0
lea edi, [esi + 0x80]
mov dword [ebp - 0x28c], edi
je 0x41d4cf
mov ecx, esi
call fcn.0041d620
cmp byte [esi + 0xb0], 0
je 0x41cbb5
lea ecx, [ebp - 0x27a]
call fcn.0040f1b0
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 1
call fcn.0050cef6
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 2
call fcn.0050cf2a
test eax, eax
mov edx, str.WinDoc32.dll
mov ecx, str.WinDoc64.dll
cmove ecx, edx
push ecx
lea ecx, [ebp - 0x88]
call fcn.004033d0
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00403020
mov byte [ebp - 4], 4
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x78]
cmovae eax, dword [ebp - 0x88]
push eax
call fcn.004032b0
call fcn.0050e897
test al, al
je 0x41ca72
mov eax, dword [0x77ce78]
test eax, eax
je 0x41ca72
cmp dword [eax + 4], 4
jl 0x41ca72
sub esp, 0xc
push 0x48
push str.CDoTaskItemByAppID::DoUnInstall
push ecx
lea ecx, [ebp - 0x278]
call fcn.00422090
mov esi, eax
mov byte [ebp - 4], 5
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea eax, [esi + 0x30]
mov ecx, str._null_
cmovae edx, dword [ebp - 0x40]
test edx, edx
cmovne ecx, edx
push ecx
push eax
call fcn.004202d0
mov ecx, dword [0x77ce78]
add esp, 8
push esi
call fcn.00422240
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 4
call fcn.00420630
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41cafd
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00403020
lea ecx, [ebp - 0x27a]
call fcn.0050ce81
call fcn.0050e897
test al, al
je 0x41cafd
mov eax, dword [0x77ce78]
test eax, eax
je 0x41cafd
cmp dword [eax + 4], 4
jl 0x41cafd
sub esp, 0xc
push 0x4c
push str.CDoTaskItemByAppID::DoUnInstall
push ecx
lea ecx, [ebp - 0x278]
call fcn.00422090
mov esi, eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 6
push str.uninst_docvw
push ecx
call fcn.004202d0
mov ecx, dword [0x77ce78]
add esp, 8
push esi
call fcn.00422240
lea ecx, [ebp - 0x278]
call fcn.00420630
call fcn.0041f0e0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x41cb40
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cb36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d4f4
push edx
push ecx
call fcn.00468d54
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x41cb95
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cb8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d4f9
push edx
push ecx
call fcn.00468d54
add esp, 8
lea ecx, [ebp - 0x2b4]
call fcn.0050cf09
lea ecx, [ebp - 0x27a]
mov byte [ebp - 4], 0
call fcn.00402140
mov esi, dword [ebp - 0x284]
lea edi, [esi + 0x38]
push edi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x280], edi
call fcn.00403020
push 7
push str.Service
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 7
call fcn.004032b0
cmp dword [ebp - 0x48], 0
jbe 0x41ccef
call fcn.0050e897
test al, al
je 0x41ccba
mov eax, dword [0x77ce78]
test eax, eax
je 0x41ccba
cmp dword [eax + 4], 4
jl 0x41ccba
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
push str.1284
cmovae eax, dword [ebp - 0x58]
mov dword [ebp - 0x290], eax
call fcn.0050e686
push str.1283
mov edi, eax
call fcn.0050e686
push ecx
push 0x59
push str.CDoTaskItemByAppID::DoUnInstall
push ecx
lea ecx, [ebp - 0x278]
mov esi, eax
call fcn.00422090
mov dword [ebp - 0x288], eax
test esi, esi
mov byte [ebp - 4], 8
mov ecx, str._null_
cmovne ecx, esi
lea esi, [eax + 0x30]
push ecx
push esi
call fcn.004202d0
test edi, edi
mov eax, str._null_
cmovne eax, edi
push eax
push esi
call fcn.004202d0
mov ecx, dword [ebp - 0x290]
mov eax, str._null_
test ecx, ecx
cmovne eax, ecx
push eax
push esi
call fcn.004202d0
mov ecx, dword [0x77ce78]
add esp, 0x18
push dword [ebp - 0x288]
call fcn.00422240
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 7
call fcn.00420630
mov esi, dword [ebp - 0x284]
mov edi, dword [ebp - 0x280]
lea ecx, [ebp - 0x27a]
call fcn.0040f1b0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x27a]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.0051066c
lea ecx, [ebp - 0x27a]
mov byte [ebp - 4], 7
call fcn.00402140
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41ccf9
mov eax, dword [edi]
push eax
lea eax, [ebp - 0xd0]
push str.Software_s
push eax
call fcn.0050b7ff
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xd0]
cmp dword [ebp - 0xbc], 8
push 0
cmovae eax, dword [ebp - 0xd0]
push eax
push reloc.gdiplus.dll_Ordinal_1
call fcn.005108b4
mov ecx, esp
push edi
call fcn.00403020
push reloc.gdiplus.dll_Ordinal_1
call fcn.0041d830
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00403020
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041d830
lea ecx, [ebp - 0x279]
call fcn.0040f1b0
lea edi, [esi + 0x20]
mov byte [ebp - 4], 0xb
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41cd73
mov eax, dword [edi]
push eax
lea ecx, [ebp - 0x279]
call fcn.00510ace
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41cd89
mov eax, dword [edi]
push eax
lea ecx, [ebp - 0x279]
call fcn.00510ace
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41cd9f
mov eax, dword [edi]
push eax
lea ecx, [ebp - 0x279]
call fcn.00510bc1
add esi, 0x98
mov dword [ebp - 0x288], esi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41cdc1
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x279]
call fcn.00510ace
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41cdd7
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x279]
call fcn.00510ace
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41cded
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x279]
call fcn.00510bc1
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0xc
push eax
call fcn.0050a656
add esp, 4
push 0x42
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xd
call fcn.004032b0
cmp dword [ebp - 0xa4], 8
lea eax, [ebp - 0xb8]
push str.Desktop
cmovae eax, dword [ebp - 0xb8]
push eax
lea eax, [ebp - 0x70]
push reloc.WS2_32.dll_closesocket
push eax
call fcn.005108f1
sub esp, 8
mov byte [ebp - 4], 0xe
mov ecx, esp
xor eax, eax
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x744ab8
mov word [ecx], ax
call fcn.00402440
lea eax, [ebp - 0x70]
push eax
call fcn.0050b68f
add esp, 0x1c
cmp dword [edi + 0x14], 8
jb 0x41ce99
mov edi, dword [edi]
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push edi
cmovae eax, dword [ebp - 0x70]
push eax
lea eax, [ebp - 0x88]
push str._s_s.lnk
push eax
call fcn.0050b7ff
mov edi, eax
add esp, 0x10
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x41ceee
mov ecx, eax
call fcn.00402630
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x41cf2b
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cf21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d4fe
push edx
push ecx
call fcn.00468d54
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41cf55
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
call fcn.0050e897
test al, al
je 0x41cff1
mov eax, dword [0x77ce78]
test eax, eax
je 0x41cff1
cmp dword [eax + 4], 4
jl 0x41cff1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0xc
mov dword [ebp - 0x280], eax
push 0x7c
push str.CDoTaskItemByAppID::DoUnInstall
push ecx
lea ecx, [ebp - 0x278]
call fcn.00422090
mov edi, eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 0xf
push str.del_lnk_0:
push esi
call fcn.004202d0
mov eax, dword [ebp - 0x280]
mov ecx, str._null_
test eax, eax
cmovne ecx, eax
push ecx
push esi
call fcn.004202d0
mov ecx, dword [0x77ce78]
add esp, 0x10
push edi
call fcn.00422240
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xe
call fcn.00420630
mov esi, dword [ebp - 0x288]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x14], 8
jb 0x41cff9
mov esi, dword [esi]
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push esi
cmovae eax, dword [ebp - 0x70]
push eax
lea eax, [ebp - 0x88]
push str._s_s.lnk
push eax
call fcn.0050b7ff
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x41d04e
mov ecx, eax
call fcn.00402630
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x41d08b
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d081
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d503
push edx
push ecx
call fcn.00468d54
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d0af
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
call fcn.0050e897
test al, al
je 0x41d13e
mov eax, dword [0x77ce78]
test eax, eax
je 0x41d13e
cmp dword [eax + 4], 4
jl 0x41d13e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0xc
mov dword [ebp - 0x280], eax
push 0x84
push str.CDoTaskItemByAppID::DoUnInstall
push ecx
lea ecx, [ebp - 0x278]
call fcn.00422090
mov edi, eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 0x10
push str.del_lnk_:
push esi
call fcn.004202d0
mov eax, dword [ebp - 0x280]
mov ecx, str._null_
test eax, eax
cmovne ecx, eax
push ecx
push esi
call fcn.004202d0
mov ecx, dword [0x77ce78]
add esp, 0x10
push edi
call fcn.00422240
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xe
call fcn.00420630
call fcn.0041f430
mov ecx, eax
call fcn.00510f0e
mov eax, dword [ebp - 0x28c]
cmp dword [eax + 0x14], 8
jb 0x41d158
mov eax, dword [eax]
push eax
call fcn.00512047
add esp, 4
lea eax, [ebp - 0xa0]
push eax
call fcn.0041f370
mov ecx, eax
call fcn.0051263d
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x11
push eax
call fcn.0050b9a7
add esp, 4
test eax, eax
jne 0x41d19d
push 1
push 0x741a3c
lea ecx, [ebp - 0xa0]
call fcn.004032b0
cmp dword [ebp - 0x8c], 8
lea eax, [ebp - 0xa0]
cmovae eax, dword [ebp - 0xa0]
push eax
call fcn.00512047
mov edi, dword [ebp - 0x284]
add esp, 4
mov ecx, edi
call fcn.0041df80
lea ecx, [ebp - 0x158]
call fcn.0051ba60
push 0
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x12
call fcn.0051d5d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x28c], esp
push 8
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str._soft_i3
mov byte [ecx], 0
call fcn.00410120
sub esp, 0x18
mov byte [ebp - 4], 0x13
mov ecx, esp
push 3
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x744304
mov byte [ecx], 0
call fcn.00410120
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x12
call fcn.0051c840
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x28c], esp
call fcn.00513099
push eax
push esi
call fcn.0050b97d
sub esp, 0x10
mov byte [ebp - 4], 0x14
mov ecx, esp
push 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x744b0c
mov byte [ecx], 0
call fcn.00410120
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x12
call fcn.0051c840
push 0
lea eax, [ebp - 0x158]
push 0
push eax
call fcn.0041f2c0
mov ecx, eax
call fcn.0051d950
mov ecx, dword [edi]
test ecx, ecx
je 0x41d2bc
mov eax, dword [edi + 4]
test eax, eax
je 0x41d2bc
push 0
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x158]
call fcn.0051c330
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x41d307
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d2fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d508
push edx
push ecx
call fcn.00468d54
add esp, 8
mov edx, dword [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
cmp edx, 8
jb 0x41d35e
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d354
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d50d
push edx
push ecx
call fcn.00468d54
add esp, 8
mov edx, dword [ebp - 0xa4]
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x41d3b2
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d3a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d512
push edx
push ecx
call fcn.00468d54
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
cmp edx, 8
jb 0x41d409
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d3ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d517
push edx
push ecx
call fcn.00468d54
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x279]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00402140
mov edx, dword [ebp - 0xbc]
cmp edx, 8
jb 0x41d468
mov ecx, dword [ebp - 0xd0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d45e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d51c
push edx
push ecx
call fcn.00468d54
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 7
mov word [ebp - 0xd0], ax
cmp edx, 8
jb 0x41d4bb
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d4b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d521
push edx
push ecx
call fcn.00468d54
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
lea ecx, [ebp + 8]
call fcn.0041c6c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 0xac
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
int3