Function at 0x413300
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path
Get startup folder
Persist via run registry key
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4887bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x818
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push 0
lea ecx, [esp + 0x430]
call fcn.00406710
lea ecx, [esp + 0x42c]
mov dword [esp + 0x830], 0
call fcn.0047cce0
cmp eax, 1
jne 0x413ed2
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [0x4b20c8]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x2c]
push 0x400
push ecx
mov byte [esp + 0x838], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x18]
push edx
call fcn.0047c161
push 0x5c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 2
call fcn.00475dd3
dec eax
lea ecx, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00475d5b
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 3
call fcn.0047c22c
lea ecx, [esp + 0x20]
mov byte [esp + 0x830], 2
call fcn.0047c0f3
lea ecx, [esp + 0x18]
push str.:Program_Files
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 4
call fcn.0047c22c
lea ecx, [esp + 0x20]
mov byte [esp + 0x830], 2
call fcn.0047c0f3
lea ecx, [esp + 0x10]
call fcn.0047c607
mov ecx, ebp
call fcn.0044af10
push ecx
test eax, eax
mov ecx, esp
je 0x413436
lea eax, [esp + 0x14]
mov dword [esp + 0x18], esp
push eax
call fcn.0047be68
mov ecx, ebp
call fcn.00413f50
jmp 0x41344b
lea edx, [esp + 0x14]
mov dword [esp + 0x18], esp
push edx
call fcn.0047be68
mov ecx, ebp
call fcn.00414420
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SOFTWARENo_AD
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallNo_AD
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREN2Sweeper.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWARE_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREPCGuardian
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsGuardUp.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallPCGuardian
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREircommdanmuzycure
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.pcguardian
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.DanmuzyCurePatch.exe
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.SOFTWARENo_AD
push SysReAllocStringLen
call esi
push str.SOFTWARENoAD2
push SysReAllocStringLen
call esi
push str.SOFTWAREN2Sweeper.exe
push SysReAllocStringLen
call esi
push str.SOFTWARE_
push SysReAllocStringLen
call esi
push str.SoftwarePCGUARDIAN
push SysReAllocStringLen
call esi
push str.SoftwareircommDanmuzyCure
push SysReAllocStringLen
call esi
push str.SoftwareNoadASP
push SysReAllocStringLen
call esi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov ecx, ebp
call fcn.0044af10
test eax, eax
je 0x41366a
lea eax, [esp + 0x2c]
push 0x400
push eax
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x28]
call fcn.0047c161
mov bl, 5
push 0x5c
lea ecx, [esp + 0x28]
mov byte [esp + 0x834], bl
call fcn.00475dd3
lea edx, [esp + 0x20]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00475d5b
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x834], 6
call fcn.0047c22c
lea ecx, [esp + 0x20]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
push 0
lea eax, [esp + 0x30]
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x20]
call fcn.0047c161
mov edx, dword [esp + 0x1c]
push 0x5c
lea ecx, [esp + 0x20]
mov byte [esp + 0x834], 7
mov esi, dword [edx - 8]
call fcn.00475dd3
sub esi, eax
lea eax, [esp + 0x20]
dec esi
lea ecx, [esp + 0x1c]
push esi
push eax
call fcn.00475cdf
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x834], 8
call fcn.0047c22c
lea ecx, [esp + 0x20]
mov byte [esp + 0x830], 7
call fcn.0047c0f3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x18]
push str._sAll_Users_s
push eax
call fcn.0047617b
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
lea ecx, [esp + 0x24]
mov byte [esp + 0x830], 2
call fcn.0047c0f3
jmp 0x413689
push 0
lea ecx, [esp + 0x30]
push 0x10
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x10]
push edx
call fcn.0047c27c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
call fcn.0047be68
mov bl, 9
push str.No_AD.lnk
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], bl
call fcn.0047c4cf
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ecx
call esi
lea edx, [esp + 0x28]
push str.PCGuardian.lnk
lea eax, [esp + 0x24]
push edx
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0xa
call fcn.0047c22c
lea ecx, [esp + 0x20]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov ecx, dword [esp + 0x10]
push ecx
call esi
xor eax, eax
lea edx, [esp + 0x2c]
push eax
mov ecx, 0x100
lea edi, [esp + 0x30]
push 0x10
push edx
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
call fcn.0047c27c
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0047c22c
push 0x4af0b4
lea ecx, [esp + 0x14]
call fcn.0047c4cf
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x28]
push 0x4af0a4
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0xb
call fcn.0047c22c
lea ecx, [esp + 0x20]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov ecx, ebp
call fcn.0044af10
test eax, eax
je 0x413938
lea eax, [esp + 0x2c]
push 0x400
push eax
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x28]
call fcn.0047c161
push 0x5c
lea ecx, [esp + 0x28]
mov byte [esp + 0x834], 0xc
call fcn.00475dd3
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00475d5b
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x834], 0xd
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], 0xc
call fcn.0047c0f3
push 0
lea eax, [esp + 0x30]
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x20]
call fcn.0047c161
mov edx, dword [esp + 0x1c]
push 0x5c
lea ecx, [esp + 0x20]
mov byte [esp + 0x834], 0xe
mov edi, dword [edx - 8]
call fcn.00475dd3
sub edi, eax
lea eax, [esp + 0x20]
dec edi
lea ecx, [esp + 0x1c]
push edi
push eax
call fcn.00475cdf
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [esp + 0x830], 0xf
mov eax, dword [ecx - 8]
mov edi, dword [edx - 8]
sub eax, edi
lea ecx, [esp + 0x1c]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00475d5b
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x834], 0x10
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], 0xf
call fcn.0047c0f3
mov ecx, dword [esp + 0x1c]
push 0x5c
mov edi, dword [ecx - 8]
lea ecx, [esp + 0x20]
call fcn.00475dd3
sub edi, eax
lea edx, [esp + 0x14]
dec edi
push edi
push edx
lea ecx, [esp + 0x24]
call fcn.00475cdf
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x834], 0x11
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], 0xf
call fcn.0047c0f3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push str._sAll_Users_s_s
push eax
call fcn.0047617b
add esp, 0x14
lea ecx, [esp + 0x20]
mov byte [esp + 0x830], 0xe
call fcn.0047c0f3
lea ecx, [esp + 0x1c]
mov byte [esp + 0x830], 0xc
call fcn.0047c0f3
lea ecx, [esp + 0x24]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
jmp 0x413957
push 0
lea ecx, [esp + 0x30]
push 2
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x10]
push edx
call fcn.0047c27c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
call fcn.0047c22c
push str.No_AD
lea ecx, [esp + 0x14]
call fcn.0047c4cf
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.0040f680
lea edx, [esp + 0x28]
push str.PCGuardian
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x12
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.0040f680
xor eax, eax
lea edx, [esp + 0x2c]
push eax
mov ecx, 0x100
lea edi, [esp + 0x30]
push 2
push edx
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
call fcn.0047c27c
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0047c22c
push 0x4af05c
lea ecx, [esp + 0x14]
call fcn.0047c4cf
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0040f680
lea eax, [esp + 0x28]
push 0x4af038
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x13
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x28]
push 0x4af018
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
mov byte [esp + 0x830], 0x14
push eax
lea ecx, [esp + 0x14]
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x2c]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push 0xb
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0047c27c
push 0x4af0a4
lea ecx, [esp + 0x14]
call fcn.0047c4cf
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x2c]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0047c27c
push 0x5c
lea ecx, [esp + 0x1c]
call fcn.00475dd3
dec eax
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x20]
call fcn.00475d5b
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 0x15
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
lea eax, [esp + 0x18]
push str.:Program_FilesNo_AD
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x16
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0040f680
lea eax, [esp + 0x18]
push str.:Program_FilesNoAD2
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x17
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0040f680
lea eax, [esp + 0x18]
push str.:Program_FilesPCGuardian
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x18
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0040f680
lea eax, [esp + 0x18]
push str.:Program_FilesU2U2Clean
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x19
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0040f680
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzySpOrder.Dll
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x1a
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzyNoADU.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x1b
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzyNoADS.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x1c
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzyNoADM.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x1d
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzyNoADE.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x1e
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzy_noad.tcv
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x1f
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzy_noad.sys
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x20
call fcn.0047c22c
mov byte [esp + 0x830], bl
lea ecx, [esp + 0x14]
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzy_noad.cdv
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x21
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzyDanmuzyCureUI.exe
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x22
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x18]
push str.:Program_FilesDanmuzyDanmuzyCurePatch.exe
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047c388
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x834], 0x23
call fcn.0047c22c
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x10]
push edx
call esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x830], 2
call fcn.0047c0f3
lea ecx, [esp + 0x18]
mov byte [esp + 0x830], 1
call fcn.0047c0f3
lea ecx, [esp + 0x10]
mov byte [esp + 0x830], 0
call fcn.0047c0f3
lea ecx, [esp + 0x770]
mov dword [esp + 0x830], 0x26
call fcn.00459e70
lea ecx, [esp + 0x5fc]
mov byte [esp + 0x830], 0x25
call fcn.00459040
lea ecx, [esp + 0x488]
mov byte [esp + 0x830], 0x24
call fcn.00459040
lea ecx, [esp + 0x42c]
mov dword [esp + 0x830], 0xffffffff
call fcn.0047c921
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x824
ret