Function at 0x402190
Capabilities:
Create process on windows
Delete file
Get common file path
Get program files directory
Identify system language via api

Disassembly:
sub esp, 0x73c
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ebx, eax
cmp bx, 0x804
jne 0x4021b8
lea eax, [esp + 0x4b8]
push 0x409884
push eax
jmp 0x4021db
cmp bx, 0x404
jne 0x4021ce
lea ecx, [esp + 0x4b8]
push 0x409868
push ecx
jmp 0x4021db
lea edx, [esp + 0x4b8]
push 0x409848
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._NDAR1
mov esi, dword [esp + 0x75c]
push esi
call fcn.00403750
mov edi, eax
add esp, 8
test edi, edi
je 0x402221
push str._NDAR1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, edi
push eax
call fcn.00401970
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x73c
ret 0x10
push str._NDAR2
push esi
call fcn.00403750
mov edi, eax
add esp, 8
test edi, edi
je 0x40225a
push str._NDAR2
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, edi
push eax
call fcn.00401df0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x73c
ret 0x10
push 0x409834
push esi
call fcn.00403750
add esp, 8
test eax, eax
je 0x40228d
push 0x2c2
add eax, 2
push 0xf
push eax
push 0
call fcn.00403500
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x73c
ret 0x10
push 0x409830
push esi
call fcn.00403750
add esp, 8
test eax, eax
je 0x4022bf
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x73c
ret 0x10
push 0x40982c
push esi
call fcn.00403750
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x402b5c
call fcn.00401840
cmp eax, 0x10000020
jb 0x4034e2
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1ac]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1ac]
push eax
push 0
push 0
push 0x26
push 0
call esi
test eax, eax
jge 0x402339
lea ecx, [esp + 0x1ac]
push ecx
push 1
push 0
push 0x26
push 0
call esi
test eax, eax
jge 0x402339
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1ac]
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x1ac]
push edx
call ebx
test eax, eax
jle 0x4034e2
lea eax, [esp + 0x1ac]
push eax
call ebx
cmp byte [esp + eax + 0x1ab], 0x5c
jne 0x402377
lea ecx, [esp + 0x1ac]
push ecx
call ebx
mov byte [esp + eax + 0x1ab], 0
add ebp, 2
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3b4]
lea edx, [esp + 0x3b4]
push ebp
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3b4]
push eax
call ebx
test eax, eax
jle 0x4034e2
lea ecx, [esp + 0x1ac]
push ecx
call ebx
mov byte [esp + eax + 0x3b4], 0
lea edx, [esp + 0x1ac]
lea eax, [esp + 0x3b4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4034e2
lea ecx, [esp + 0x3b4]
push ecx
call ebx
lea ebp, [esp + eax + 0x3b5]
lea edx, [esp + 0x2b0]
xor eax, eax
push edx
push eax
mov ecx, 0x41
lea edi, [esp + 0x2b8]
push eax
push 0x1c
push eax
rep stosd dword es:[edi], eax
call esi
test eax, eax
jge 0x402435
lea eax, [esp + 0x2b0]
push eax
push 1
push 0
push 0x1c
push 0
call esi
test eax, eax
jge 0x402435
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2b0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2b0]
push ecx
call ebx
test eax, eax
jle 0x4034e2
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x2b0]
push str.VirtualStoreProgram_Files
push edx
call esi
push ebp
call ebx
test eax, eax
je 0x40246e
lea eax, [esp + 0x2b0]
push ebp
push eax
call esi
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str..exe
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
mov ebp, dword [sym.imp.SHELL32.dll_SHFileOperationA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea edx, [esp + 0x3c]
mov ebx, 0x1694
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str..dll
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str..ini
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str..red
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.NewClass.dat
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.Language.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.Resource.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.Skin.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.DriversMirrorw2k.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.DriversLanguage.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea edx, [esp + 0x3c]
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.DriversSkin.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.Drivers.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.upgrade.
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], edx
mov word [esp + 0x20], bx
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.ExamPaperEnglish_Testing_Sample.emp
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.ExamPaperEnglish_Testing_Sample.txt
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str..udf
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str..err
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str..log
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
lea ecx, [esp + 0x2b0]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push str.Scene.dat
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.004020e0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], edx
mov word [esp + 0x24], bx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x73c
ret 0x10
push 0x4096e0
push esi
call fcn.00403750
add esp, 8
test eax, eax
je 0x402c01
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
push str.GlobalWindows_Application_Checker_StopEvent.2.TRY
push 0
push 2
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x402ba6
push esi
call ebx
push esi
call ebp
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Windows_Application_Checker_StopEvent.2.TRY
push 0
push 2
call edi
mov esi, eax
test esi, esi
je 0x402bc8
push esi
call ebx
push esi
call ebp
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x40a138]
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push ecx
push 0xffff
call esi
mov edx, dword [0x40a12c]
push 0
push 0
push edx
push 0xffff
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x73c
ret 0x10
xor edi, edi
push 0x40967c
push esi
mov dword [esp + 0x38], edi
call fcn.00403750
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebp, dword [sym.imp.USER32.dll_GetDesktopWindow]
add esp, 8
test eax, eax
je 0x402c30
mov edi, 1
mov dword [esp + 0x30], edi
jmp 0x402cac
cmp bx, 0x804
jne 0x402c4e
lea eax, [esp + 0x4b8]
lea ecx, [esp + 0x5b8]
push eax
push 0x409664
push ecx
jmp 0x402c81
cmp bx, 0x404
jne 0x402c6c
lea edx, [esp + 0x4b8]
lea eax, [esp + 0x5b8]
push edx
push 0x40964c
push eax
jmp 0x402c81
lea ecx, [esp + 0x4b8]
lea edx, [esp + 0x5b8]
push ecx
push str.Are_you_sure_to_uninstall_the_previous_installed_version_of__s_
push edx
call fcn.004036c7
add esp, 0xc
lea eax, [esp + 0x4b8]
lea ecx, [esp + 0x5b8]
push 0x40124
push eax
push ecx
call ebp
push eax
call esi
cmp eax, 7
je 0x4034e2
push 0
push str.IsNormalVersion
call fcn.004020a0
add esp, 8
test eax, eax
je 0x402d0b
test edi, edi
jne 0x402d0b
cmp bx, 0x804
jne 0x402cde
lea edx, [esp + 0x4b8]
push 0x40030
push edx
push 0x4095c4
jmp 0x402d06
cmp bx, 0x404
push 0x40030
jne 0x402cf9
lea eax, [esp + 0x4bc]
push eax
push 0x40958c
jmp 0x402d06
lea ecx, [esp + 0x4bc]
push ecx
push str.This_UNINST.EXE__from_a_Trial_Version__cant_be_used_to_uninstall_a_normal_versiaon
call ebp
push eax
call esi
mov esi, dword [esp + 0x750]
xor ebp, ebp
push 0x7f00
push ebp
mov dword [esp + 0x148], ebp
mov dword [esp + 0x14c], 0x401750
mov dword [esp + 0x150], ebp
mov dword [esp + 0x154], ebp
mov dword [esp + 0x158], esi
mov dword [esp + 0x15c], ebp
call dword [sym.imp.USER32.dll_LoadCursorA]
lea edx, [esp + 0x140]
mov dword [esp + 0x15c], 0xc
push edx
mov dword [esp + 0x15c], eax
mov dword [esp + 0x164], ebp
mov dword [esp + 0x168], str.RS_UNINSTALL
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x4034e2
cmp bx, 0x804
jne 0x402da7
lea eax, [esp + 0x4b8]
lea ecx, [esp + 0x5b8]
push eax
push 0x409514
push ecx
jmp 0x402dda
cmp bx, 0x404
jne 0x402dc5
lea edx, [esp + 0x4b8]
lea eax, [esp + 0x5b8]
push edx
push 0x409500
push eax
jmp 0x402dda
lea ecx, [esp + 0x4b8]
lea edx, [esp + 0x5b8]
push ecx
push str.uninstalling__s...
push edx
call fcn.004036c7
add esp, 0xc
lea eax, [esp + 0x5b8]
push ebp
push esi
push ebp
push ebp
push 0x14
push 0x15e
push 0xc8
push 0xc8
push 0xc00000
push eax
push str.RS_UNINSTALL
push 8
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
cmp edi, ebp
mov dword [esp + 0x34], esi
jne 0x402e31
mov ecx, dword [esp + 0x75c]
push ecx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00401840
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0x10000008
jne 0x402f8d
lea edx, [esp + 0x1ac]
push 0x104
push edx
call ebp
test eax, eax
je 0x402ef0
lea eax, [esp + 0x1ac]
push str.checkapp.exe
push eax
call esi
lea ecx, [esp + 0x1ac]
push ecx
call fcn.00401780
add esp, 4
test eax, eax
je 0x402ef0
lea edx, [esp + 0x1ac]
push 0x4094d8
push edx
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x168]
lea edx, [esp + 0x1ac]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x168]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x190], 0x44
call ebx
test eax, eax
je 0x402ef0
mov eax, dword [esp + 0x10]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x1ac]
push 0x104
push ecx
call ebp
test eax, eax
je 0x402f8d
lea edx, [esp + 0x1ac]
push str.checkrs.exe
push edx
call esi
lea eax, [esp + 0x1ac]
push eax
call fcn.00401780
add esp, 4
test eax, eax
je 0x402f8d
lea ecx, [esp + 0x1ac]
push 0x4094c4
push ecx
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x168]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x168]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c8]
push 0
push ecx
push 0
mov dword [esp + 0x190], 0x44
call ebx
test eax, eax
je 0x402f8d
mov edx, dword [esp + 0x10]
push 0xea60
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00401840
test eax, 0x10000000
je 0x40326e
mov ebp, dword [sym.imp.KERNEL32.dll_OpenEventA]
push str.GlobalWindows_Application_Checker_StopEvent.2.TRY
push 0
push 2
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x402fd1
push esi
call edi
push esi
call ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Windows_Application_Checker_StopEvent.2.TRY
push 0
push 2
call ebp
mov esi, eax
test esi, esi
je 0x402ff3
push esi
call edi
push esi
call ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Windows_Application_Checker_StopEvent
push 0
push 2
call ebp
mov esi, eax
test esi, esi
je 0x403015
push esi
call edi
push esi
call ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.GlobalApplication_Checker_StopEvent_for_Windows.2
push 0
push 2
call ebp
mov esi, eax
test esi, esi
je 0x403042
push esi
call edi
push esi
call ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Application_Checker_StopEvent_for_Windows.2
push 0
push 2
call ebp
mov esi, eax
test esi, esi
je 0x403064
push esi
call edi
push esi
call ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Application_Checker_StopEvent_for_Windows
push 0
push 2
call ebp
mov esi, eax
test esi, esi
je 0x403086
push esi
call edi
push esi
call ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
push 0x104
push eax
call esi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jbe 0x40310d
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x3c]
push ecx
call ebp
cmp byte [esp + eax + 0x3b], 0x5c
je 0x4030d3
lea edx, [esp + 0x3c]
push 0x409174
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x3c]
push 0x409404
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x3c]
push ecx
call fcn.00401780
add esp, 4
test eax, eax
je 0x403113
push 0
push 0
lea edx, [esp + 0x44]
push 0x409400
push edx
push str.open
push 0
call ebx
jmp 0x403113
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
push eax
call esi
test eax, eax
jbe 0x403186
lea ecx, [esp + 0x3c]
push ecx
call ebp
cmp byte [esp + eax + 0x3b], 0x5c
je 0x40314e
lea edx, [esp + 0x3c]
push 0x409174
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x3c]
push 0x4093e8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x3c]
push ecx
call fcn.00401780
add esp, 4
test eax, eax
je 0x403186
push 0
push 0
lea edx, [esp + 0x44]
push 0x4093e4
push edx
push str.open
push 0
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
push eax
call esi
test eax, eax
jbe 0x4031f9
lea ecx, [esp + 0x3c]
push ecx
call ebp
cmp byte [esp + eax + 0x3b], 0x5c
je 0x4031c1
lea edx, [esp + 0x3c]
push 0x409174
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x3c]
push str.rscheck.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x3c]
push ecx
call fcn.00401780
add esp, 4
test eax, eax
je 0x4031f9
push 0
push 0
lea edx, [esp + 0x44]
push 0x409400
push edx
push str.open
push 0
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
push eax
call esi
test eax, eax
jbe 0x403274
lea ecx, [esp + 0x3c]
push ecx
call ebp
cmp byte [esp + eax + 0x3b], 0x5c
je 0x403234
lea edx, [esp + 0x3c]
push 0x409174
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x3c]
push str.appcheck.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x3c]
push ecx
call fcn.00401780
add esp, 4
test eax, eax
je 0x403274
push 0
push 0
lea edx, [esp + 0x44]
push 0x4093e4
push edx
push str.open
push 0
call ebx
jmp 0x403274
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [0x40a138]
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push eax
push 0xffff
call esi
mov ecx, dword [0x40a12c]
push 0
push 0
push ecx
push 0xffff
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.EPOINTER.EXE
call section..text
push str.LANCHAT.EXE
call section..text
push str.NETTALK.EXE
call section..text
push str.MONITOR.EXE
call section..text
push str.RSPIDER.EXE
call section..text
push str.RSAGENT.EXE
call section..text
push str.repview.exe
call section..text
push str.reviewer.exe
call section..text
add esp, 0x20
lea edx, [esp + 0x6b8]
mov dword [esp + 0x6b8], 0x94
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x6c8], 2
jne 0x403425
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1ac]
mov dword [esp + 0x38], 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
lea ecx, [esp + 0x1ac]
push eax
push ecx
push 0
push str.RTCONFIG.EXE
call fcn.004017c0
mov al, byte [esp + 0x1bc]
mov bl, 0x22
add esp, 0x10
xor edx, edx
cmp al, bl
lea ecx, [esp + 0x3b4]
sete dl
lea eax, [esp + edx + 0x1ac]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x3b4]
push edx
call ebp
cmp byte [esp + eax + 0x3b3], bl
jne 0x4033a1
lea eax, [esp + 0x3b4]
push eax
call ebp
mov byte [esp + eax + 0x3b3], 0
lea ecx, [esp + 0x3b4]
push ecx
call ebp
test eax, eax
je 0x403425
lea edx, [esp + 0x3b4]
push edx
call fcn.00401780
add esp, 4
test eax, eax
je 0x403425
lea eax, [esp + 0x1ac]
push 0x40934c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x168]
lea edx, [esp + 0x168]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x168], 0x44
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x1cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403425
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0x409340
call fcn.004011b0
push 0
push 0
push 0x409330
call fcn.004011b0
push 0
push 0
push 0x40931c
call fcn.004011b0
push str.Software3000softRed_Point
push 1
push 0
call fcn.004011b0
push str.Software_shenlikejiShenLi
push 1
push 0
call fcn.004011b0
push str.SoftwareEasyVieweClass
push 1
push 0
call fcn.004011b0
add esp, 0x48
push str.SoftwareEasys_workshopRed_Spider
push 1
push 0
call fcn.004011b0
push str.Software3000softRed_Spider
push 1
push 0
call fcn.004011b0
mov edx, dword [esp + 0x4c]
add esp, 0x18
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push str._NO55U
mov eax, dword [esp + 0x75c]
push eax
call fcn.00403750
add esp, 8
test eax, eax
jne 0x4034e2
mov ecx, dword [esp + 0x30]
push ecx
push str.Software3000softRed_Spider
call fcn.004012d0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x73c
ret 0x10