Function at 0x471050
Capabilities:
Check if file exists
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efe65
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x80]
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x94], eax
push eax
movq qword [ebp - 0x80], xmm0
mov dword [ebp - 0x78], 0
call fcn.005dc570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x74], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.005dbeb0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test al, al
jne 0x4710fa
call fcn.005dc190
push eax
call esi
test eax, eax
jne 0x471127
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c8118
lea ecx, [ebx + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc200
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
call esi
test eax, eax
jne 0x47113d
xor esi, esi
jmp 0x472005
push 0
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6a80
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backups
mov dword [ebp - 0x28], 0
call fcn.005d6a80
test byte [ebp + 0xc], 1
mov byte [ebp - 4], 4
je 0x47123a
lea ecx, [ebp - 0x80]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
call fcn.005dc190
mov ecx, eax
call fcn.005cf370
add dword [ebp - 0x30], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x24]
adc dword [ebp - 0x2c], edx
push eax
push str.SettingsINI
call fcn.005d6740
test al, al
je 0x47120b
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc4c0
test al, al
je 0x47120b
lea eax, [ebp - 0x90]
push eax
push str.SettingsTS
lea ecx, [ebp - 0x18]
call fcn.005d6620
test al, al
je 0x47120b
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x30]
jne 0x47120b
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x2c]
jne 0x47120b
mov esi, 1
jmp 0x471ff5
push 0
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
push 1
push str.SettingsINI
lea ecx, [ebp - 0x18]
call fcn.005d5f20
push 0
lea eax, [ebp - 0x30]
push eax
push 0xb
push str.SettingsTS
lea ecx, [ebp - 0x18]
call fcn.005d5f20
push 0x38
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005dd680
push str.InstallerUnlocked
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSmart_Uninstaller
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.005dcff0
push str.LastEmailSent
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerReporting
lea ecx, [ebp - 0x68]
call fcn.005dcff0
push str.LastFTPUpload
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerReporting
lea ecx, [ebp - 0x68]
call fcn.005dcff0
push str.ClientName
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemRepair
lea ecx, [ebp - 0x68]
call fcn.005dcff0
push str.ReportID
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemRepair
lea ecx, [ebp - 0x68]
call fcn.005dcff0
push 0
push 0x6311c4
push str.FileInfo
lea ecx, [ebp - 0x68]
call fcn.005dd290
push 0x62796c
push 0x6c4f48
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x24]
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x4713d8
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
push 0x6c4f48
lea ecx, [ebp - 0x18]
call fcn.005d66b0
lea ecx, [ebp - 0x24]
call fcn.005dafe0
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push 0x6c4f48
call fcn.005d5f20
push 0
push str.BrandOEMData
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x74]
call fcn.005db160
lea ecx, [ebp - 0x74]
call fcn.005dc3a0
test eax, eax
je 0x471378
push 0
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
push 1
push str.BrandOEMData
lea ecx, [ebp - 0x18]
call fcn.005d5f20
jmp 0x471385
push str.BrandOEMData
lea ecx, [ebp - 0x18]
call fcn.005d5df0
test byte [ebx + 0x13dc], 8
je 0x4713d8
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x84]
je 0x4713d8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c7be0
lea ecx, [ebx + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
mov ecx, ebx
call fcn.004757f0
push 1
push str.ContextMenu
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
test eax, eax
je 0x4713f9
mov ecx, ebx
call fcn.00472400
jmp 0x4713fe
call fcn.0046ed50
push 1
push str.AssociateUVKScripts
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
test eax, eax
mov ecx, ebx
setne al
movzx eax, al
push eax
call fcn.00473480
push 1
push str.DesktopShortcut
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
mov ecx, ebx
test eax, eax
je 0x471443
call fcn.004727d0
jmp 0x47144a
push 0
call fcn.00472d40
push 0
push str.AlwaysOnTop
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.AlwaysOnTop
call fcn.005d5f20
mov ecx, dword [ebx + 0x1f68]
movzx esi, al
mov eax, ecx
and ecx, 0xffffffbf
or eax, 0x40
cmp dword [ebp - 0x14], 0
push 1
cmovne ecx, eax
push str.ShowTooltips
mov dword [ebx + 0x1f68], ecx
lea ecx, [ebp - 0x68]
push 0x64ea58
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.ShowTooltips
call fcn.005d5f20
mov ecx, dword [ebx + 0x1f68]
movzx eax, al
add esi, eax
mov eax, ecx
and ecx, 0xffffffdf
or eax, 0x20
cmp dword [ebp - 0x14], 0
push 1
cmovne ecx, eax
push str.AutoUpdate
mov dword [ebx + 0x1f68], ecx
lea ecx, [ebp - 0x68]
push 0x64ea58
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.AutoUpdate
call fcn.005d5f20
mov ecx, dword [ebx + 0x1f68]
movzx eax, al
add esi, eax
mov eax, ecx
and ecx, 0xffffffef
or eax, 0x10
cmp dword [ebp - 0x14], 0
push 1
cmovne ecx, eax
push str.AutoLoadLastSR
mov dword [ebx + 0x1f68], ecx
lea ecx, [ebp - 0x68]
push 0x64ea58
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.AutoLoadLastSR
call fcn.005d5f20
mov ecx, dword [ebx + 0x1f68]
movzx eax, al
add esi, eax
mov eax, ecx
and ecx, 0xffffff7f
or eax, 0x80
cmp dword [ebp - 0x14], 0
push 1
cmovne ecx, eax
push str.DontUse2Browse
mov dword [ebx + 0x1f68], ecx
lea ecx, [ebp - 0x68]
push 0x64ea58
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.DontUse2Browse
call fcn.005d5f20
mov ecx, dword [ebx + 0x1f68]
movzx eax, al
add esi, eax
mov eax, ecx
and ecx, 0xffffefff
or eax, 0x1000
cmp dword [ebp - 0x14], 0
push 0
cmovne ecx, eax
push str.VersionLabelIsLink
mov dword [ebx + 0x1f68], ecx
lea ecx, [ebp - 0x68]
push 0x64ea58
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.VersionLabelIsLink
call fcn.005d5f20
push 0
push str.UAKAutoRemove
movzx eax, al
lea ecx, [ebp - 0x68]
push 0x64ea58
add esi, eax
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.UAKAutoRemove
call fcn.005d5f20
movzx eax, al
lea ecx, [ebp - 0x18]
add esi, eax
lea eax, [ebp - 0x74]
push eax
push str.CurrentSkin
call fcn.005d6740
test al, al
jne 0x471652
push str.Fantasy
lea ecx, [ebp - 0x74]
call fcn.005dc510
push str.Fantasy
push str.CurrentSkin
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471698
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc480
test al, al
je 0x471698
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00467670
push 0
push str.MSSoftness
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4716e7
mov dword [ebx + 0x1f7c], eax
cmp eax, 0xe
je 0x4716cd
cmp eax, 0xa
je 0x4716cd
mov dword [ebx + 0x1f7c], 0xc
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push str.MSSoftness
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
add esi, eax
push 0
push 1
mov ecx, ebx
call fcn.0043d720
push 0
push str.HelpButtonsFlag
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
mov dword [ebp - 0x14], eax
test eax, eax
je 0x471727
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push str.HelpButtonsFlag
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
add esi, eax
push 0
push str.DisableHybridShutdownWarning
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
mov dword [ebp - 0x14], eax
test eax, eax
je 0x47175c
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push str.DisableHybridShutdownWarning
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
add esi, eax
push 0
push str.HomepageDesktopShortcut
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
mov dword [ebp - 0x14], eax
test eax, eax
je 0x471819
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push str.HomepageDesktopShortcut
lea ecx, [ebp - 0x18]
call fcn.005d5f20
push 0
movzx eax, al
lea ecx, [ebp - 0x24]
push str.HomepageDSURL
add esi, eax
lea eax, [ebp - 0x68]
push 0x64ea58
push eax
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x4717d7
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push str.HomepageDSURL
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
add esi, eax
push 0
push str.HomepageDSName
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471819
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push str.HomepageDSName
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
add esi, eax
push 0
push str.ConfigureImmunization
push 0x64ea58
lea ecx, [ebp - 0x68]
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.ConfigureImmunization
call fcn.005d5f20
push 1
push str.VT_AutoScans
movzx eax, al
lea ecx, [ebp - 0x68]
push 0x64ea58
add esi, eax
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.VT_AutoScans
call fcn.005d5f20
push 1
push str.VT_AutoUpload
movzx eax, al
lea ecx, [ebp - 0x68]
push 0x64ea58
add esi, eax
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.VT_AutoUpload
call fcn.005d5f20
push 1
push str.VT_AnalysisUI
movzx eax, al
lea ecx, [ebp - 0x68]
push 0x64ea58
add esi, eax
call fcn.005dd290
push 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 4
push str.VT_AnalysisUI
call fcn.005d5f20
push 5
push str.VT_SafeThreshold
movzx eax, al
lea ecx, [ebp - 0x68]
push 0x64ea58
add esi, eax
lea edi, [ebx + 0x1f78]
call fcn.005dd290
push 0
push edi
push 4
push str.VT_SafeThreshold
lea ecx, [ebp - 0x18]
mov dword [edi], eax
call fcn.005d5f20
push 0
movzx eax, al
lea ecx, [ebp - 0x24]
push str.ThirdParty
add esi, eax
lea eax, [ebp - 0x68]
push 0x64ea58
push eax
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x4719cb
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push str.ThirdParty
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
lea ecx, [ebp - 0x24]
push 0
add esi, eax
call fcn.005dbc20
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ecx, eax
call fcn.005ddc10
test al, al
jne 0x4719a5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c630c
lea ecx, [ebx + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebx + 0x168]
call fcn.005dc200
jmp 0x4719b4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebx + 0x168]
call fcn.005dc4e0
lea ecx, [ebx + 0x168]
call fcn.005dc190
push eax
push str.ThirdParty
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x28
push 0
push str.MoreCustomApps
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dae00
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471a13
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push 1
push str.MoreCustomApps
lea ecx, [ebp - 0x18]
call fcn.005d5f20
jmp 0x471a20
push str.MoreCustomApps
lea ecx, [ebp - 0x18]
call fcn.005d5df0
push 0
push str.AutoCloudSync
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
lea edi, [ebx + 0x1f74]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471a5a
lea ecx, [ebp - 0x24]
call fcn.005dafe0
and eax, 0x87
mov dword [edi], eax
jmp 0x471a68
push edi
push str.AutoCloudSync
lea ecx, [ebp - 0x28]
call fcn.005d66b0
push 0
push edi
push 4
push str.AutoCloudSync
lea ecx, [ebp - 0x18]
call fcn.005d5f20
push 0
movzx eax, al
lea ecx, [ebp - 0x24]
push str.CloudSyncAsked
add esi, eax
lea eax, [ebp - 0x68]
push 0x64ea58
push eax
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471aaf
lea ecx, [ebp - 0x24]
call fcn.005dafe0
mov dword [ebp - 0x14], eax
jmp 0x471ac3
lea eax, [ebp - 0x14]
push eax
push str.CloudSyncAsked
lea ecx, [ebp - 0x28]
call fcn.005d66b0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x471ae1
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push str.CloudSyncAsked
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
add esi, eax
push 0
push str.NoOEMCloudUpload
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471b11
lea ecx, [ebp - 0x24]
call fcn.005dafe0
mov dword [ebp - 0x14], eax
jmp 0x471b22
lea eax, [ebp - 0x14]
push eax
push str.NoOEMCloudUpload
lea ecx, [ebp - 0x28]
call fcn.005d66b0
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push str.NoOEMCloudUpload
lea ecx, [ebp - 0x18]
call fcn.005d5f20
movzx eax, al
add esi, eax
cmp dword [ebp - 0x14], 0
je 0x471b58
or dword [ebx + 0x1f68], 0x2000000
test byte [ebx + 0x13dc], 8
je 0x471b58
and dword [edi], 0xfffffffd
push 0
push str.ExecutePreventAllowed
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471b9b
push ecx
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push str.ExecutePreventAllowed
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
call fcn.00438530
movzx eax, al
add esi, eax
push 0
push str.ExecutePreventDisallowed
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471bde
push ecx
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
push str.ExecutePreventDisallowed
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
call fcn.00438530
movzx eax, al
add esi, eax
push 0
push str.PasswordEnabled
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x24]
call fcn.005db160
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x471c56
lea ecx, [ebp - 0x24]
call fcn.005dafe0
test eax, eax
je 0x471c56
push 0
push str.Password
push 0x64ea58
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc400
mov ecx, eax
call fcn.005db160
lea ecx, [ebp - 0x74]
call fcn.005dc3a0
cmp eax, 0x1f
jle 0x471c56
push ecx
push 1
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
push str.MBinder
push str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
call fcn.00438530
jmp 0x471c65
mov edx, str.MBinder
mov ecx, str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
call fcn.005d5060
push 0
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerDelete___Replace_files
lea eax, [ebp - 0x68]
mov ecx, ebx
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerLogAnalyzer
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerProcessExplorer
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerServices___Drivers
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystemBooster
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSmart_Uninstaller
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystem_repair
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerStreamsManager
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerModulesManager
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerReporting
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerStartupEntries
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
lea eax, [ebp - 0x68]
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerSystem_info
push eax
mov ecx, ebx
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerDesktop_Watermark
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerAutoLoad
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerExtraButton1
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerExtraButton2
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerDeviceRescue
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
add esi, eax
cmp dword [ebp - 0x2c], 2
jae 0x471f17
push 1
push str.HKLMSoftwareUVK___Ultra_virus_killerDelete___Replace_files
lea eax, [ebp - 0x68]
mov ecx, ebx
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerLogAnalyzer
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerProcessExplorer
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerServices___Drivers
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerSystemBooster
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerSmart_Uninstaller
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerSystem_repair
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerStreamsManager
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 0
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerModulesManager
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerReporting
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerStartupEntries
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
lea eax, [ebp - 0x68]
push str.HKLMSoftwareUVK___Ultra_virus_killerSystem_info
push eax
mov ecx, ebx
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerDesktop_Watermark
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerAutoLoad
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerExtraButton1
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerExtraButton2
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
push 1
add esi, eax
mov ecx, ebx
push str.HKLMSoftwareUVK___Ultra_virus_killerDeviceRescue
lea eax, [ebp - 0x68]
push eax
call fcn.00470e20
add esi, eax
mov edi, 3
nop dword [eax]
sub esp, 0xc
lea ecx, [ebp - 0x24]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerExtraButtonsButton
push edi
call fcn.005db320
mov ecx, eax
call fcn.005da510
push 0
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea eax, [ebp - 0x68]
mov ecx, ebx
push eax
call fcn.00470e20
add esi, eax
cmp dword [ebp - 0x2c], 2
jae 0x471fa6
sub esp, 0xc
lea ecx, [ebp - 0x24]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLMSoftwareUVK___Ultra_virus_killerExtraButtonsButton
push edi
call fcn.005db320
mov ecx, eax
call fcn.005da510
push 1
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea eax, [ebp - 0x68]
mov ecx, ebx
push eax
call fcn.00470e20
add esi, eax
inc edi
cmp edi, 0x20
jle 0x471f20
push 0
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsSystemRepair
lea eax, [ebp - 0x68]
mov ecx, ebx
push eax
call fcn.00470e20
mov ecx, dword [ebp - 0x94]
add esi, eax
call fcn.005d8c40
test eax, eax
jne 0x471fe2
push eax
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
call fcn.005771e0
test byte [ebp + 0xc], 2
je 0x471fed
call fcn.00437df0
lea ecx, [ebp - 0x68]
call fcn.005dd5d0
lea ecx, [ebp - 0x28]
call fcn.005d69e0
lea ecx, [ebp - 0x18]
call fcn.005d69e0
lea ecx, [ebp - 0x74]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x80]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8