Function at 0x411dc0
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x4563c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3f4
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
lea eax, [esp + 0xfc]
push str.CleanUpAfterRebootFromNoEnum_entry_n
mov ebp, ecx
push eax
call fcn.0043a4a0
add esp, 0xc
mov ecx, 0x475b68
call fcn.0042f5e0
lea ecx, [esp + 0xf8]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
mov eax, dword [0x471df4]
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x40c], esi
mov dword [esp + 0x10], eax
push 0xa
lea ecx, [esp + 0x54]
mov byte [esp + 0x410], 1
mov dword [ebp + 0xd70], 1
call fcn.00449a9b
push 0xa
lea ecx, [esp + 0x38]
mov byte [esp + 0x410], 2
call fcn.00449a9b
push 0xa
lea ecx, [esp + 0x8c]
mov byte [esp + 0x410], 3
call fcn.00449a9b
push 0xa
lea ecx, [esp + 0x70]
mov byte [esp + 0x410], 4
call fcn.00449a9b
lea edx, [esp + 0x34]
lea eax, [esp + 0x50]
push edx
push eax
push ecx
mov byte [esp + 0x418], 5
mov ecx, esp
mov dword [esp + 0x38], esp
push str.SoftwareUIUUIU_CLEAN_UPDEVICEID
call fcn.0044a442
call fcn.00431400
add esp, 0xc
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], esi
push ecx
mov ecx, ebp
call fcn.004089e0
push str.UIUWait
push esi
push esi
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, 0x9c4
mov dword [ebp + 0xd60], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x24], edi
cmp eax, esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], eax
je 0x41202d
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x41202d
xor esi, esi
test eax, eax
jbe 0x411fe0
push esi
lea ecx, [esp + 0x54]
call fcn.00449d23
mov edi, eax
lea ecx, [esp + 0x14]
lea eax, [edi + 8]
push eax
call fcn.0044a4c1
push esi
lea ecx, [esp + 0x38]
call fcn.00449d23
mov ebx, eax
lea ecx, [ebx + 8]
push ecx
lea ecx, [esp + 0x14]
call fcn.0044a4c1
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0044a149
mov ecx, ebp
call fcn.0040d7e0
test eax, eax
jne 0x411f71
mov eax, dword [esp + 0x28]
inc esi
cmp esi, eax
jb 0x411f18
jmp 0x411fdb
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xf8]
push eax
push str.Device_Installed_:__s_n
push ecx
call fcn.0043a4a0
add esp, 0xc
lea edx, [esp + 0xf8]
mov ecx, 0x475b68
push edx
call fcn.0042f820
push edi
lea ecx, [esp + 0x54]
call fcn.00449cec
push ebx
lea ecx, [esp + 0x38]
call fcn.00449cec
lea eax, [esp + 0x10]
lea ecx, [esp + 0x88]
push eax
call fcn.00449c44
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
inc eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], eax
mov edi, 0x9c4
cmp dword [esp + 0x24], 0x1d4c0
jae 0x41202d
push str.UIUWait
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push eax
mov dword [ebp + 0xd60], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
add esi, edi
add edx, edi
mov dword [esp + 0x24], esi
test eax, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x28], eax
jne 0x411efe
push 0xa
lea ecx, [esp + 0xe0]
call fcn.00449a9b
lea ecx, [esp + 0xdc]
mov byte [esp + 0x40c], 6
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.SoftwareUIUUIU_CLEAN_UPFILES
call fcn.0044a442
call fcn.004312e0
add esp, 8
lea ecx, [esp + 0xa4]
push 0xa
call fcn.00449a9b
lea edx, [esp + 0xa4]
mov bl, 7
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.SoftwareUIUUIU_CLEAN_UPDEVICEPATHS
mov byte [esp + 0x418], bl
call fcn.0044a442
call fcn.004312e0
add esp, 8
lea ecx, [esp + 0xc0]
push 0xa
call fcn.00449a9b
lea eax, [esp + 0xc0]
mov byte [esp + 0x40c], 8
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.SoftwareUIUUIU_CLEAN_UPUNINSTALLERFILE
call fcn.0044a442
call fcn.004312e0
lea ecx, [esp + 0x100]
push 0x104
push ecx
push str.SourcePath
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430370
lea edx, [esp + 0x218]
push 0x104
push edx
push str.SearchLocation
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430370
add esp, 0x30
test eax, eax
je 0x412142
mov edi, str.EMPTY
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1fc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1fc]
lea edx, [esp + 0xf8]
push ecx
lea eax, [esp + 0xc4]
push edx
lea ecx, [esp + 0xac]
push eax
lea edx, [esp + 0xe8]
push ecx
push edx
mov ecx, ebp
call fcn.0040a5b0
lea eax, [esp + 0x300]
push 0x104
push eax
push str.Win98SEQFEFilePath
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430370
add esp, 0x14
test eax, eax
jne 0x4121a9
lea ecx, [esp + 0x300]
push ecx
call fcn.0042cc40
add esp, 4
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430ab0
push str.UIUCU
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.004304b0
mov esi, dword [esp + 0x428]
add esp, 0x14
test esi, esi
je 0x4122aa
mov eax, dword [esp + 0x94]
mov edi, dword [esp + 0x8c]
test eax, eax
jbe 0x412247
mov ebp, eax
mov eax, edi
mov edi, dword [edi]
add eax, 8
lea ecx, [esp + 0x10]
push eax
call fcn.0044a4c1
mov edx, dword [esp + 0x10]
push 0
push edx
lea ecx, [esp + 0x74]
call fcn.00449d49
test eax, eax
jne 0x412244
lea eax, [esp + 0x10]
lea ecx, [esp + 0x6c]
push eax
call fcn.00449c44
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + edx*8 + 4]
call fcn.0044a4c1
mov eax, dword [esi]
mov dword [esi + eax*8 + 8], 4
mov eax, dword [esi]
inc eax
mov dword [esi], eax
dec ebp
jne 0x4121f2
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
test eax, eax
jbe 0x4122aa
mov ebp, eax
mov eax, edi
mov edi, dword [edi]
add eax, 8
lea ecx, [esp + 0x10]
push eax
call fcn.0044a4c1
mov ecx, dword [esp + 0x10]
push 0
push ecx
lea ecx, [esp + 0x74]
call fcn.00449d49
test eax, eax
jne 0x4122a7
lea edx, [esp + 0x10]
lea ecx, [esp + 0x6c]
push edx
call fcn.00449c44
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + ecx*8 + 4]
call fcn.0044a4c1
mov edx, dword [esi]
mov dword [esi + edx*8 + 8], 5
mov eax, dword [esi]
inc eax
mov dword [esi], eax
dec ebp
jne 0x412255
lea ecx, [esp + 0xc0]
mov byte [esp + 0x40c], bl
call fcn.00449b0f
lea ecx, [esp + 0xa4]
mov byte [esp + 0x40c], 6
call fcn.00449b0f
lea ecx, [esp + 0xdc]
mov byte [esp + 0x40c], 5
call fcn.00449b0f
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x1fc]
push esi
push str.CleanUpAfterRebootFromNoEnum_exit_:_bDeviceInstalled___d_n
push eax
call fcn.0043a4a0
add esp, 0xc
lea ecx, [esp + 0x1fc]
push ecx
mov ecx, 0x475b68
call fcn.0042f820
mov ecx, 0x475b68
call fcn.0042f5f0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x40c], 4
call fcn.00449b0f
lea ecx, [esp + 0x88]
mov byte [esp + 0x40c], 3
call fcn.00449b0f
lea ecx, [esp + 0x34]
mov byte [esp + 0x40c], 2
call fcn.00449b0f
lea ecx, [esp + 0x50]
mov byte [esp + 0x40c], 1
call fcn.00449b0f
lea ecx, [esp + 0x10]
mov byte [esp + 0x40c], 0
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov dword [esp + 0x40c], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x404]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x400
ret 4