Function at 0x4702d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efdbd
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x5c]
push 0x38
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.005dd740
push 0x62fdc4
push 0x6311c4
push str.FileInfo
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.005dd0c0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x68]
movq qword [ebp - 0x68], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x74], xmm0
call fcn.005dc5e0
push 0
push 0x20019
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
mov dword [ebp - 0x18], 0
call fcn.005d6a80
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
push str.MBinder
lea ecx, [ebp - 0x18]
call fcn.005d6740
lea ecx, [ebp - 0x24]
call fcn.005dc3a0
test eax, eax
je 0x4703f6
push ecx
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x24]
call fcn.00477530
test eax, eax
je 0x4703f6
lea ecx, [ebp - 0x68]
call fcn.005dc3a0
cmp eax, 7
jle 0x4703f6
push 5
push 1
push 1
push 1
push str.Pass:
lea ecx, [ebp - 0x68]
call fcn.005daa70
test eax, eax
mov eax, 0x62a118
jne 0x4703fb
mov eax, 0x62796c
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc510
push str.PasswordEnabled
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x74]
call fcn.005db130
push str.Password
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
xor edx, edx
mov ecx, str.HKCRDirectory_shellForce_Deletecommand
call fcn.005d3780
test al, al
je 0x470455
xor edx, edx
mov ecx, str.HKCR_shellForce_Deletecommand
call fcn.005d3780
test al, al
mov eax, 0x62a118
jne 0x47045a
mov eax, 0x62796c
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc510
push str.ContextMenu
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
lea eax, [ebp - 0x68]
push eax
push 0x62439c
push str.HKCR.uvk
lea ecx, [ebp - 0x18]
call fcn.005d65d0
test al, al
je 0x4704a9
push str.UVKCommandsScript
lea ecx, [ebp - 0x68]
call fcn.005dc4c0
test al, al
mov eax, 0x62a118
jne 0x4704ae
mov eax, 0x62796c
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc510
push str.AssociateUVKScripts
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x630518
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
push 1
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc260
mov ecx, eax
call fcn.005d9bd0
mov ecx, eax
call fcn.005da510
mov ecx, eax
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
lea ecx, [ebp - 0x68]
call fcn.005dc200
lea ecx, [ebp - 0x68]
call fcn.005dc190
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x47058d
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
call esi
test eax, eax
mov eax, 0x62796c
je 0x470592
mov eax, 0x62a118
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc510
push str.DesktopShortcut
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
push ecx
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x18]
call fcn.005d6a30
lea eax, [ebp - 0x78]
push eax
push 0x6c4f48
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push 0x6c4f48
push 0x64ea58
test al, al
je 0x4705f8
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
jmp 0x470600
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
lea eax, [ebp - 0x24]
push eax
push str.BrandOEMData
lea ecx, [ebp - 0x18]
call fcn.005d6740
push str.BrandOEMData
push 0x64ea58
test al, al
je 0x47062d
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
jmp 0x470635
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
lea eax, [ebp - 0x78]
push eax
push str.AutoUpdate
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x470654
mov eax, 1
mov dword [ebp - 0x78], eax
jmp 0x470657
mov eax, dword [ebp - 0x78]
push str.AutoUpdate
push 0x64ea58
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.ShowTooltips
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x470694
mov eax, 1
mov dword [ebp - 0x78], eax
jmp 0x470697
mov eax, dword [ebp - 0x78]
push str.ShowTooltips
push 0x64ea58
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.AlwaysOnTop
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.AlwaysOnTop
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.AutoLoadLastSR
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.AutoLoadLastSR
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
push 0
push 1
mov ecx, edi
call fcn.0043d720
lea eax, [ebp - 0x78]
push eax
push str.DontUse2Browse
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x470741
mov eax, 1
mov dword [ebp - 0x78], eax
jmp 0x470744
mov eax, dword [ebp - 0x78]
push str.DontUse2Browse
push 0x64ea58
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.VersionLabelIsLink
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.VersionLabelIsLink
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.UAKAutoRemove
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.UAKAutoRemove
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.MSSoftness
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.MSSoftness
push 0x64ea58
test al, al
jne 0x4707ed
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
jmp 0x470803
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.ConfigureImmunization
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.ConfigureImmunization
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.VT_AutoScans
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x470853
mov eax, 1
mov dword [ebp - 0x78], eax
jmp 0x470856
mov eax, dword [ebp - 0x78]
push str.VT_AutoScans
push 0x64ea58
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.VT_AutoUpload
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x470893
mov eax, 1
mov dword [ebp - 0x78], eax
jmp 0x470896
mov eax, dword [ebp - 0x78]
push str.VT_AutoUpload
push 0x64ea58
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.VT_AnalysisUI
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x4708d3
mov eax, 1
mov dword [ebp - 0x78], eax
jmp 0x4708d6
mov eax, dword [ebp - 0x78]
push str.VT_AnalysisUI
push 0x64ea58
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea esi, [edi + 0x1f78]
push esi
push str.VT_SafeThreshold
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x470912
mov dword [esi], 5
push str.VT_SafeThreshold
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [esi]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x24]
push eax
push str.ThirdParty
lea ecx, [ebp - 0x18]
call fcn.005d6740
push str.ThirdParty
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
lea eax, [ebp - 0x24]
push eax
push str.MoreCustomApps
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x47099a
push 0x28
lea ecx, [ebp - 0x24]
call fcn.005dae00
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x47099a
push str.MoreCustomApps
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
jmp 0x4709ac
push str.MoreCustomApps
push 0x64ea58
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
push str.AutoCloudSync
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [edi + 0x1f74]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.CloudSyncAsked
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.CloudSyncAsked
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.NoOEMCloudUpload
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.NoOEMCloudUpload
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.HelpButtonsFlag
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.HelpButtonsFlag
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.DisableHybridShutdownWarning
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.DisableHybridShutdownWarning
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
lea eax, [ebp - 0x78]
push eax
push str.HomepageDesktopShortcut
lea ecx, [ebp - 0x18]
call fcn.005d66b0
push str.HomepageDesktopShortcut
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x24]
call fcn.005db290
mov ecx, eax
call fcn.005db130
cmp dword [ebp - 0x78], 0
je 0x470b5a
lea eax, [ebp - 0x24]
push eax
push str.HomepageDSURL
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x470aef
lea ecx, [ebp - 0x24]
call fcn.005dbeb0
test al, al
je 0x470afe
lea eax, [edi + 0x120]
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc4e0
push str.HomepageDSURL
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
lea eax, [ebp - 0x24]
push eax
push str.HomepageDSName
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x470b35
lea ecx, [ebp - 0x24]
call fcn.005dbeb0
test al, al
je 0x470b44
lea eax, [edi + 0x108]
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc4e0
push str.HomepageDSName
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
lea eax, [ebp - 0x24]
push eax
push str.CurrentSkin
lea ecx, [ebp - 0x18]
call fcn.005d6740
push str.CurrentSkin
push 0x64ea58
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
lea eax, [ebp - 0x24]
push eax
push str.ExecutePreventAllowed
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea ecx, [ebp - 0x18]
call fcn.005d65d0
push str.ExecutePreventAllowed
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
lea eax, [ebp - 0x24]
push eax
push str.ExecutePreventDisallowed
lea ecx, [ebp - 0x18]
call fcn.005d6740
push str.ExecutePreventDisallowed
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db130
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerDelete___Replace_files
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerLogAnalyzer
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerProcessExplorer
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerServices___Drivers
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystemBooster
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystem_repair
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerStreamsManager
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerModulesManager
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerRegistry_seeker
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystem_info
lea eax, [ebp - 0x5c]
push eax
mov ecx, edi
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerDesktop_Watermark
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerStartupEntries
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerAutoLoad
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerExtraButton1
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerExtraButton2
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerDeviceRescue
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
xor edx, edx
mov ecx, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerExtraButtons
call fcn.005d3780
test al, al
je 0x470d32
mov esi, 3
nop dword [eax]
sub esp, 0xc
lea ecx, [ebp - 0x24]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerExtraButtonsButton
push esi
call fcn.005db320
mov ecx, eax
call fcn.005da510
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
inc esi
cmp esi, 0x20
jle 0x470cf0
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSmart_Uninstaller
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerReporting
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemRepair
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.00470170
push str.InstallerUnlocked
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSmart_Uninstaller
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
push str.LastEmailSent
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerReporting
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
push str.LastFTPUpload
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerReporting
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
push str.ClientName
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemRepair
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
push str.ReportID
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemRepair
lea ecx, [ebp - 0x5c]
call fcn.005dcff0
push ecx
push 0x2e
push ebx
lea ecx, [ebp - 0x5c]
call fcn.005dca80
lea ecx, [ebp - 0x18]
movzx esi, al
call fcn.005d69e0
lea ecx, [ebp - 0x74]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x5c]
call fcn.005dd5d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4