Function at 0x43eab0
Capabilities:
Check if file exists
Create thread
Query environment variable
Set environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed0e3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xf0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x2c], eax
call fcn.005d8790
movsd qword [edi + 8], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.005e17c0
push 0x800
push 0
test al, al
mov byte [edi + 0x10], al
push 0
setne al
lea esi, [edi + 0x1478]
push 0x800
mov ecx, esi
mov byte [edi + 0x11], al
call fcn.005db9a0
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea eax, [edi + 0x150]
mov ecx, esi
push 1
mov dword [ebp - 0x28], eax
call fcn.005dc190
push eax
lea ecx, [edi + 0x150]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
cmp byte [edi + 0x10], 0
je 0x43eca4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.64.exe
push 4
mov ecx, esi
call fcn.005dadc0
mov ecx, eax
call fcn.005da780
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43ebb8
or eax, 0xffffffff
jmp 0x44056d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x2c]
mov ecx, esi
push 0x62438c
call fcn.005da780
mov ecx, dword [ebp - 0x28]
push 2
push dword [ebx + 0x10]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2ad0
mov esi, eax
test esi, esi
je 0x43ec9a
cmp esi, 0xffffffff
je 0x43ec9a
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x43ec59
xor edi, edi
mov ecx, eax
call fcn.005ce120
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x43ec43
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, 0x64
jb 0x43ec22
jmp 0x43ec53
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
je 0x43ec77
push 0x14
call edi
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x43ec66
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xffffffff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x44056d
or edi, 0xffffffff
mov eax, edi
jmp 0x44056d
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push SHDefExtractIconW
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.005cac50
sub esp, 8
mov dword [ebp - 0x40], 0
xorps xmm0, xmm0
lea ecx, [edi + 0x150]
movq qword [ebp - 0x48], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6cc408
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc520
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xb0]
xorps xmm0, xmm0
mov dword [ebp - 0xa8], 0
movq qword [ebp - 0xb0], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x94]
push 1
push dword [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
movq qword [ebp - 0x94], xmm0
call fcn.005dc570
push 3
push 0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea esi, [edi + 0x14a8]
mov dword [edi + 4], eax
push esi
lea ecx, [edi + 0x17e0]
call fcn.005b7660
push esi
lea ecx, [edi + 0x1cf8]
call fcn.005c4320
lea ecx, [edi + 0x70]
call fcn.005d3930
push 0xc
push 1
push 1
push 1
push str._RemoveApp
lea ecx, [ebp - 0x94]
mov dword [edi + 0x74], eax
mov dword [edi + 0x1f68], 4
call fcn.005daa70
test eax, eax
je 0x43edd3
lea eax, [ebp - 0x94]
mov ecx, edi
push eax
call fcn.00485eb0
mov esi, eax
jmp 0x44054d
xor edx, edx
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_Virus_Killer_backupsVirusTotal_reports
call fcn.005d3780
test al, al
je 0x43edf4
push 1
mov edx, str.HKLM64SOFTWARECarifredVirusTotal_reports
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_Virus_Killer_backupsVirusTotal_reports
call fcn.005d3c40
xor edx, edx
mov ecx, str.HKCUSoftwareUVK___Ultra_virus_killer
call fcn.005d3780
test al, al
je 0x43ee15
push 1
mov edx, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
mov ecx, str.HKCUSoftwareUVK___Ultra_virus_killer
call fcn.005d3c40
xor edx, edx
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_Virus_Killer
call fcn.005d3780
test al, al
je 0x43ee36
push 1
mov edx, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_Virus_Killer
call fcn.005d3c40
xor edx, edx
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_Virus_Killer_backups
call fcn.005d3780
test al, al
je 0x43ee57
push 1
mov edx, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backups
mov ecx, str.HKLM64SOFTWAREUVK___Ultra_Virus_Killer_backups
call fcn.005d3c40
push 0
mov ecx, edi
call fcn.00468150
mov eax, dword [edi + 0x13dc]
cmp eax, 0xfffffffe
je 0x43ee75
cmp eax, 0xfffffffb
je 0x43ee75
cmp eax, 0xffffffff
jne 0x43ee94
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push 0
push 0
push str.Sorry__your_license_could_not_be_validated_this_time._r_n_r_nPlease_report_this_error_to_us._Sorry_for_the_inconvenience.
call fcn.0043e2e0
lea ecx, [ebp - 0x94]
call fcn.005dc3a0
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x43eec6
push eax
push eax
push edi
push 0x469930
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x43eec6
cmp eax, 0xffffffff
je 0x43eec6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 8
mov dword [ebp - 0x9c], 0
xorps xmm0, xmm0
lea ecx, [edi + 0x150]
movq qword [ebp - 0xa4], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c9e54
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa4]
call fcn.005dc520
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 3
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43ef2e
or dword [edi + 0x1f68], 0x20000
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6aa0
sub esp, 8
mov byte [ebp - 4], 4
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
movq qword [ebp - 0x88], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x63bc40
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x88]
call fcn.005dc520
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 5
push eax
push str.AutoEndTasks
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d65d0
test al, al
je 0x43efb4
lea ecx, [ebp - 0x48]
call fcn.005dafe0
test eax, eax
jne 0x43efc6
push str.AutoEndTasks
lea ecx, [ebp - 0x18]
call fcn.005d6120
cmp eax, 4
jne 0x43f019
push ecx
push 0
push 0x62796c
push str.AutoEndTasks
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
call fcn.00438530
push ecx
push 0
push str.10000
push str.WaitToKillAppTimeout
lea ecx, [ebp - 0x88]
call fcn.005dc190
push eax
call fcn.00438530
push ecx
push 0
push str.10000
push str.WaitToKillServiceTimeout
push str.HKLMSYSTEMCurrentControlSetControl
call fcn.00438530
push ecx
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x18]
call fcn.005d6a30
lea eax, [ebp - 0x48]
push eax
push str.FirewallPath
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x43f051
lea eax, [edi + 0x1478]
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc450
test al, al
je 0x43f058
mov ecx, edi
call fcn.004b52e0
mov eax, dword [edi + 0x13dc]
test al, 4
jne 0x43f0ce
cmp eax, 1
jl 0x43f0ce
lea esi, [edi + 0x1f74]
lea ecx, [ebp - 0x18]
mov dword [esi], 0
push esi
push str.AutoCloudSync
call fcn.005d66b0
lea eax, [ebp - 0x1c]
push eax
push str.NoOEMCloudUpload
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f0d8
cmp dword [ebp - 0x1c], 0
je 0x43f0d8
test byte [edi + 0x13dc], 8
je 0x43f0c2
mov eax, dword [esi]
test al, 2
je 0x43f0c2
push 0
push esi
push 4
and eax, 0xfffffffd
lea ecx, [ebp - 0x18]
push str.AutoCloudSync
mov dword [esi], eax
call fcn.005d5f20
or dword [edi + 0x1f68], 0x2000000
jmp 0x43f0d8
mov dword [edi + 0x1f74], 0
lea esi, [edi + 0x1f78]
push esi
push str.VT_SafeThreshold
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
jne 0x43f0f6
mov dword [esi], 5
lea eax, [ebp - 0x98]
mov dword [edi + 0x38], 0
push eax
push str.AutoUpdate
lea ecx, [ebp - 0x18]
mov dword [edi + 0x3c], 0
call fcn.005d66b0
mov ecx, dword [ebp - 0x98]
test al, al
je 0x43f126
test ecx, ecx
je 0x43f12d
or dword [edi + 0x1f68], 0x10
mov eax, dword [edi + 0x1f68]
test cl, 2
je 0x43f143
or eax, 0x1000000
mov dword [edi + 0x1f68], eax
test al, 0x10
je 0x43f159
push 6
mov ecx, edi
call fcn.00460040
push eax
lea ecx, [edi + 0x14]
call fcn.005b0bb0
lea eax, [ebp - 0x1c]
push eax
push str.AlwaysOnTop
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f17b
cmp dword [ebp - 0x1c], 0
je 0x43f17b
or dword [edi + 0x1f68], 0x40
lea eax, [ebp - 0x1c]
push eax
push str.AutoLoadLastSR
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f1a0
cmp dword [ebp - 0x1c], 0
je 0x43f1a0
or dword [edi + 0x1f68], 0x80
lea eax, [ebp - 0x1c]
push eax
push str.DesktopShortcut
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f1bb
cmp dword [ebp - 0x1c], 0
je 0x43f1c5
or dword [edi + 0x1f68], 0x200
lea eax, [ebp - 0x1c]
push eax
push str.EulaAccepted
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f1ea
cmp dword [ebp - 0x1c], 0
je 0x43f1ea
or dword [edi + 0x1f68], 0x400
lea eax, [ebp - 0x1c]
push eax
push str.PortableVersion
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f20f
cmp dword [ebp - 0x1c], 0
je 0x43f20f
or dword [edi + 0x1f68], 0x800
lea eax, [ebp - 0x1c]
push eax
push str.ShowTooltips
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f22a
cmp dword [ebp - 0x1c], 0
je 0x43f231
or dword [edi + 0x1f68], 0x20
lea eax, [ebp - 0x1c]
push eax
push str.InstallHidden
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f256
cmp dword [ebp - 0x1c], 0
je 0x43f256
or dword [edi + 0x1f68], 0x800000
lea eax, [ebp - 0x1c]
push eax
push str.DontUse2Browse
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f271
cmp dword [ebp - 0x1c], 0
je 0x43f27b
or dword [edi + 0x1f68], 0x1000
test dword [edi + 0x1f68], 0x800000
mov ecx, str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
mov eax, str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsInstallInfo
cmove eax, ecx
lea ecx, [edi + 0x1490]
push eax
call fcn.005dc510
mov eax, dword [edi + 0x1f68]
lea ecx, [ebp - 0x18]
and eax, 0xfffffff0
push 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 4
push str.Flag
call fcn.005d5f20
lea esi, [edi + 0x1f6c]
push esi
push str.HelpButtonsFlag
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x43f2dc
cmp dword [esi], 0
jne 0x43f2f2
test byte [edi + 0x13dc], 2
mov eax, 1
mov ecx, 4
cmovne eax, ecx
mov dword [esi], eax
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
mov ecx, dword [ebp - 0x20]
push 0xa
push edi
mov dword [ecx + 0x64], eax
call esi
mov ecx, dword [ebp - 0x20]
push edi
push 0
mov dword [ecx + 0x68], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x48]
push eax
push str.CurrentSkin
lea ecx, [ebp - 0x18]
call fcn.005d6740
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
call fcn.00467670
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x663e2c
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 0
push 0
push str.https:__www.google.com
push ecx
push 2
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov edx, eax
mov ecx, str.https:__www.carifred.com_uvk_urls
call fcn.005b40e0
push eax
lea ecx, [edi + 0x18]
call fcn.005b0bb0
test dword [edi + 0x1f68], 0x20000
lea esi, [edi + 0x174]
je 0x43f3e6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c630c
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc200
push str.InstallSource
lea ecx, [ebp - 0x18]
call fcn.005d5df0
jmp 0x43f4ca
push esi
push str.InstallSource
lea ecx, [ebp - 0x18]
call fcn.005d6740
push 1
push 1
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc260
mov ecx, eax
call fcn.005dbf40
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x43f427
push str.UVKSetup.exe
lea ecx, [ebp - 0x48]
call fcn.005dc510
mov ecx, esi
call fcn.005dc3a0
test eax, eax
je 0x43f43b
push 0
mov ecx, esi
call fcn.005dbed0
mov ecx, esi
call fcn.005dbeb0
test al, al
jne 0x43f456
call fcn.005dc190
mov ecx, eax
call fcn.005ddc10
test al, al
jne 0x43f4ca
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c630c
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [edi + 0x174]
call fcn.005dc200
sub esp, 0xc
lea ecx, [edi + 0x174]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005da510
push 0
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push 1
push str.InstallSource
lea ecx, [ebp - 0x18]
call fcn.005d5f20
push 0
mov ecx, edi
call fcn.0043e8f0
lea eax, [edi + 0x14a8]
push eax
lea eax, [edi + 0x17e0]
push eax
push dword [edi + 0x14e4]
lea eax, [edi + 0x14f0]
push eax
lea eax, [edi + 0x11c4]
push eax
lea ecx, [edi + 0x1290]
call fcn.0057c740
lea eax, [edi + 0x70]
push eax
lea eax, [edi + 0x74]
push eax
push dword [edi + 0x1f68]
push ecx
push 0
lea ecx, [edi + 0x1290]
call fcn.0057c6b0
lea esi, [edi + 0x15c]
push esi
lea eax, [edi + 0x1184]
push eax
lea eax, [edi + 0x149c]
push eax
lea eax, [edi + 0x168]
push eax
lea eax, [edi + 0x150]
push eax
lea ecx, [edi + 0x1290]
call fcn.0057c6f0
lea eax, [edi + 0xd0]
push eax
push 0x42ff80
push 0x42ffb0
lea ecx, [edi + 0x1290]
call fcn.0057c690
push ecx
lea eax, [edi + 0x1448]
push eax
lea eax, [edi + 0x180]
push eax
lea ecx, [edi + 0x1290]
call fcn.0057c660
push dword [edi + 4]
lea ecx, [edi + 0x1290]
call fcn.0057c630
sub esp, 8
mov dword [ebp - 0x74], 0
xorps xmm0, xmm0
movq qword [ebp - 0x7c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c260
push eax
lea ecx, [ebp - 0x7c]
call fcn.005dc520
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 6
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43f76a
push ecx
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x7c]
call fcn.005dc190
push eax
lea ecx, [edi + 0x1290]
call fcn.00576230
sub esp, 8
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
lea ecx, [edi + 0x1290]
movq qword [ebp - 0x6c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Update_Windows.lnk
push 0
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc520
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 7
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43f75e
sub esp, 8
mov dword [ebp - 0x58], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x7c]
movq qword [ebp - 0x60], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WAU_Manager.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x60]
call fcn.005dc520
sub esp, 8
mov byte [ebp - 4], 8
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
mov ecx, esi
movq qword [ebp - 0x3c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WAU_Manager.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc520
push 0x4c
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 9
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x6c]
push 2
call fcn.005dc190
push eax
lea ecx, [ebp - 0x100]
call fcn.005e9480
push ecx
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0xa
call fcn.005e9390
push eax
lea ecx, [ebp - 0x60]
call fcn.005dc4c0
test al, al
je 0x43f743
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x100]
call fcn.005e92b0
push 0
lea ecx, [ebp - 0x6c]
call fcn.005dc190
push eax
push 5
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [ebp - 0x100]
call fcn.005e9080
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x60]
call fcn.005dc430
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.005dc430
push ecx
call fcn.0046e060
push ecx
call fcn.0046e060
movsd xmm2, qword [edi + 8]
call fcn.0058fa60
cmp eax, 4
jne 0x43f799
movsd xmm3, qword [edi + 8]
lea edx, [eax - 1]
push 0xffffffffffffffff
mov ecx, str.wuauserv
call fcn.0058f7a0
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c300
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push eax
push str.UserName
call esi
push 0
lea ecx, [edi + 0x1290]
call fcn.0057b970
push eax
push str.MyDocs
call esi
lea ecx, [edi + 0x18c]
call fcn.005dc190
push eax
push str.CommonDocs
call esi
push 0
lea ecx, [edi + 0x1290]
call fcn.0057bb00
push eax
push 0x62e520
call esi
push dword [edi + 0x24]
push str.SystemDir
call esi
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c000
push eax
push str.SysWOWDir
call esi
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
push str.UVKDir
call esi
lea ecx, [edi + 0x1478]
call fcn.005dc190
push eax
push str.UVKExe
call esi
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c260
push eax
push str.LocalAppData
call esi
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c080
push eax
push str.ProgramFiles_x86_
call esi
movsd xmm0, qword [0x6edab8]
comisd xmm0, xmmword [edi + 8]
jbe 0x43f8c9
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x48]
call fcn.005db9a0
push eax
push str.AllUsersProfile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x48]
call fcn.005dbeb0
test al, al
je 0x43f8b9
push 0
push 1
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push str.Public
call esi
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
push str.PublicDesktop
call esi
lea ecx, [edi + 0x174]
call fcn.005dc190
push eax
push str.InstallSourceDir
call esi
lea ecx, [edi + 0x174]
call fcn.005dc190
push eax
push str.ToolsDir
call esi
lea eax, [edi + 0x168]
push eax
push str.ThirdParty
lea ecx, [ebp - 0x18]
call fcn.005d6740
push 0
lea ecx, [edi + 0x168]
call fcn.005dbc20
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x43f95f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c630c
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [edi + 0x168]
call fcn.005dc200
lea ecx, [edi + 0x168]
call fcn.005dc190
push eax
push str.ThirdParty
call esi
movaps xmm0, xmmword [0x6edde0]
sub esp, 8
mov edx, 1
movups xmmword [edi + 0xd4], xmm0
push 0xff005f00
lea ecx, [edx + 0xd]
call fcn.005d28c0
push eax
lea ecx, [edi + 0xe4]
call fcn.005c64e0
sub esp, 8
xor edx, edx
push 0xff005f00
lea ecx, [edx + 0xe]
call fcn.005d28c0
push eax
lea ecx, [edi + 0xe8]
call fcn.005c64e0
sub esp, 0xc
mov edx, 1
call fcn.005d26c0
push eax
lea ecx, [edi + 0xec]
call fcn.005c64e0
sub esp, 0xc
xor edx, edx
call fcn.005d26c0
push eax
lea ecx, [edi + 0xf0]
call fcn.005c64e0
push 0
push 0
push edi
push 0x469b40
push 0
push 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x1f68]
and eax, 3
mov dword [edi + 0x6c], 0
cmp al, 3
je 0x43fa49
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 8
push eax
mov dword [ebp - 0x58], 0xc37f
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x678278
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [edi + 0x180]
call fcn.005dc200
lea ecx, [edi + 0x180]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
lea ecx, [ebp - 0x48]
call fcn.0053fcc0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x66b644
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push str.Log_
lea ecx, [edi + 0x180]
call fcn.005da780
mov ecx, edi
call fcn.0045a870
mov eax, dword [edi + 0x11ac]
test eax, eax
je 0x43fb04
push 0x4037e0
lea esi, [eax - 4]
mov byte [ebp - 4], 0xb
push dword [esi]
push 4
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
mov byte [ebp - 4], 6
push 0x37c
mov dword [ebp - 0x20], 0xde
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x28], eax
push 0x4037e0
push fcn.004013f0
push 0xde
lea esi, [eax + 4]
mov byte [ebp - 4], 0xc
push 4
push esi
mov dword [eax], 0xde
call fcn.0041e804
mov byte [ebp - 4], 6
mov dword [edi + 0x11ac], esi
mov dword [edi + 0x11b0], 0xde
mov eax, dword [edi + 0x11b4]
test eax, eax
je 0x43fb8a
push fcn.005c6580
lea esi, [eax - 4]
mov byte [ebp - 4], 0xd
push dword [esi]
push 4
push eax
call fcn.0041e45b
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.0041e1c8
add esp, 8
mov byte [ebp - 4], 6
push 0x30
mov dword [ebp - 0x20], 0xb
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x28], eax
push fcn.005c6580
push fcn.005c65a0
push 0xb
lea esi, [eax + 4]
mov byte [ebp - 4], 0xe
push 4
push esi
mov dword [eax], 0xb
call fcn.0041e804
mov byte [ebp - 4], 6
mov ecx, edi
push dword [ebp - 0x30]
mov dword [edi + 0x11b4], esi
push dword [ebp - 0x2c]
mov dword [edi + 0x11b8], 0xb
mov dword [edi + 0x1f70], 0
call fcn.00465ea0
mov byte [edi + 0x13d9], al
test al, al
jne 0x43fbfc
mov esi, dword [edi + 0x6c]
jmp 0x440527
mov dword [ebp - 0x70], 0
cmp al, 1
jne 0x44049e
cmp byte [edi + 0x13d8], 0
je 0x44049e
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x6c]
movq qword [ebp - 0x6c], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 0x10
call fcn.005d0460
push 0
push 0x20019
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerAutoLoad
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x24], 0
call fcn.005d6a80
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x28]
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsAutoLoad
mov dword [ebp - 0x28], 0
call fcn.005d6a80
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x12
push eax
push str.LoadBeforePasswordProtection
lea ecx, [ebp - 0x24]
call fcn.005d66b0
cmp dword [ebp - 0x70], 0
jne 0x43fcb8
push ecx
mov ecx, edi
call fcn.0046ef80
cmp eax, 1
jne 0x4400a4
lea eax, [ebp - 0x3c]
push eax
push str.AutoLoadScript
lea ecx, [ebp - 0x24]
call fcn.005d6740
test al, al
je 0x43fe3e
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dbc20
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x43fe3e
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43fe3e
lea eax, [ebp - 0x60]
push eax
push str.AutoLoadScriptTS
lea ecx, [ebp - 0x28]
call fcn.005d6620
lea eax, [ebp - 0x2c]
push eax
push str.AutoLoadScriptDelay
lea ecx, [ebp - 0x24]
call fcn.005d66b0
test al, al
je 0x43fd55
mov eax, 0xc9
mul dword [ebp - 0x2c]
mov esi, eax
mov eax, 0x2a69c000
mul dword [ebp - 0x2c]
add esi, edx
add eax, dword [ebp - 0x60]
adc esi, dword [ebp - 0x5c]
cmp esi, dword [ebp - 0x4c]
ja 0x43fe3e
jb 0x43fd55
cmp eax, dword [ebp - 0x50]
ja 0x43fe3e
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push str.___ReadFile__
lea ecx, [edi + 0x1478]
call fcn.005dc190
push eax
push 0x624388
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
push str.AutoLoadScriptFlag
lea ecx, [ebp - 0x24]
call fcn.005d66b0
mov eax, dword [ebp - 0x20]
test al, 1
je 0x43fde0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c07b4
jmp 0x43fdff
test al, 2
je 0x43fe07
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__Auto
lea ecx, [ebp - 0x3c]
call fcn.005da780
push 0
push 5
lea ecx, [ebp - 0x6c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2a10
test eax, eax
je 0x43fe3e
push 0
lea eax, [ebp - 0x50]
push eax
push 0xb
push str.AutoLoadScriptTS
lea ecx, [ebp - 0x28]
call fcn.005d5f20
lea eax, [ebp - 0x3c]
push eax
push str.AutoLoadSRfile
lea ecx, [ebp - 0x24]
call fcn.005d6740
test al, al
je 0x43ffc4
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dbc20
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x43ffc4
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43ffc4
lea eax, [ebp - 0x60]
push eax
push str.AutoLoadSRfileTS
lea ecx, [ebp - 0x28]
call fcn.005d6620
lea eax, [ebp - 0x2c]
push eax
push str.AutoLoadSRfileDelay
lea ecx, [ebp - 0x24]
call fcn.005d66b0
test al, al
je 0x43fedb
mov eax, 0xc9
mul dword [ebp - 0x2c]
mov esi, eax
mov eax, 0x2a69c000
mul dword [ebp - 0x2c]
add esi, edx
add eax, dword [ebp - 0x60]
adc esi, dword [ebp - 0x5c]
cmp esi, dword [ebp - 0x4c]
ja 0x43ffc4
jb 0x43fedb
cmp eax, dword [ebp - 0x50]
ja 0x43ffc4
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624388
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push str.___ImportSr__
lea ecx, [edi + 0x1478]
call fcn.005dc190
push eax
push 0x624388
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
push str.AutoLoadSRfileFlag
lea ecx, [ebp - 0x24]
call fcn.005d66b0
mov eax, dword [ebp - 0x20]
test al, 1
je 0x43ff66
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c07b4
jmp 0x43ff85
test al, 2
je 0x43ff8d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__Auto
lea ecx, [ebp - 0x3c]
call fcn.005da780
push 0
push 5
lea ecx, [ebp - 0x6c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2a10
test eax, eax
je 0x43ffc4
push 0
lea eax, [ebp - 0x50]
push eax
push 0xb
push str.AutoLoadSRfileTS
lea ecx, [ebp - 0x28]
call fcn.005d5f20
lea eax, [ebp - 0x3c]
push eax
push str.AutoLoadCMD
lea ecx, [ebp - 0x24]
call fcn.005d6740
test al, al
je 0x440091
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dbc20
mov ecx, eax
call fcn.005dc3a0
test eax, eax
je 0x440091
lea eax, [ebp - 0x60]
push eax
push str.AutoLoadCMDTS
lea ecx, [ebp - 0x28]
call fcn.005d6620
lea ecx, [ebp - 0x2c]
push ecx
push str.AutoLoadCMDDelay
lea ecx, [ebp - 0x24]
call fcn.005d66b0
test al, al
je 0x440043
mov ecx, dword [ebp - 0x2c]
mov eax, 0xc9
mul ecx
mov esi, eax
mov eax, 0x2a69c000
mul ecx
add esi, edx
add eax, dword [ebp - 0x60]
adc esi, dword [ebp - 0x5c]
cmp esi, dword [ebp - 0x4c]
ja 0x440091
jb 0x440043
cmp eax, dword [ebp - 0x50]
ja 0x440091
lea eax, [ebp - 0x20]
push eax
push str.AutoLoadCMDFlag
lea ecx, [ebp - 0x24]
call fcn.005d66b0
test byte [ebp - 0x20], 1
mov ecx, 0
mov eax, 5
cmovne eax, ecx
lea ecx, [ebp - 0x3c]
movzx eax, ax
push eax
call fcn.005dc190
mov ecx, eax
call fcn.005e2670
test eax, eax
je 0x440091
push 0
lea eax, [ebp - 0x50]
push eax
push 0xb
push str.AutoLoadCMDTS
lea ecx, [ebp - 0x28]
call fcn.005d5f20
cmp dword [ebp - 0x70], 0
je 0x4400ce
push ecx
mov ecx, edi
call fcn.0046ef80
cmp eax, 1
je 0x4400ce
lea ecx, [ebp - 0x28]
call fcn.005d69e0
lea ecx, [ebp - 0x24]
call fcn.005d69e0
lea ecx, [ebp - 0x6c]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005dc430
mov esi, 0xfffffffc
jmp 0x440527
lea ecx, [ebp - 0x28]
call fcn.005d69e0
lea ecx, [ebp - 0x24]
call fcn.005d69e0
lea ecx, [ebp - 0x6c]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 6
call fcn.005dc430
lea eax, [edi + 0x1190]
push eax
call fcn.0046bda0
cmp byte [edi + 0x13d9], 1
jne 0x4401a2
push 0
push 0x20019
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerDesktop_Watermark
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
call fcn.005d6a80
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x13
push eax
push str.OptionsFlag
lea ecx, [ebp - 0x20]
call fcn.005d66b0
test al, al
je 0x440196
test byte [ebp - 0x1c], 0x40
je 0x440196
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___DesktopWatermark
lea ecx, [edi + 0x1184]
call fcn.005dc190
push eax
push 0x624388
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 0
push 5
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2a10
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.005d69e0
sub esp, 8
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
lea ecx, [edi + 0x150]
movq qword [ebp - 0x6c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.lock
call fcn.005dc190
push eax
lea ecx, [ebp - 0x6c]
call fcn.005dc520
mov byte [ebp - 4], 0x14
mov eax, dword [edi + 0x1f68]
test al, 3
jne 0x440243
test eax, 0x800
je 0x440243
xor edx, edx
mov ecx, str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
call fcn.005d3780
test al, al
je 0x440243
push 0
push 2
push 4
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x6c]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [edi + 0x34]
mov esi, eax
cmp ecx, 0xffffffff
je 0x440235
test ecx, ecx
je 0x440235
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x34], esi
test esi, esi
jne 0x440243
mov dword [edi + 0x34], 0xffffffff
mov al, byte [edi + 0x13d9]
test al, al
je 0x44026e
mov byte [ebp - 0x20], al
push dword [ebp - 0x20]
mov ecx, edi
mov byte [edi + 0x1f80], 0
call fcn.0045f9d0
mov byte [edi + 0x13d9], al
mov byte [ebp - 0x20], al
test al, al
jne 0x440250
lea ecx, [edi + 0x1448]
call fcn.005dc3a0
test eax, eax
je 0x440292
push 0
lea ecx, [edi + 0x1448]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0046f640
test byte [edi + 0x1f74], 2
je 0x4402a6
push 2
push 0
mov ecx, edi
call fcn.0046f640
lea ecx, [edi + 0x14e4]
mov byte [edi + 0x1f80], 0
call fcn.00403550
lea ecx, [edi + 0x14e8]
call fcn.00403550
test byte [edi + 0x1f68], 3
jne 0x44051c
lea eax, [ebp - 0x1c]
push eax
push str.RebootActions
lea ecx, [ebp - 0x18]
call fcn.005d66b0
cmp byte [edi + 0x13d8], 0
jne 0x440372
cmp dword [ebp - 0x30], 7
jge 0x440372
test dword [edi + 0x1f68], 0x400000
jne 0x440372
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
call fcn.005d0460
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x5c], edx
push eax
push str.LastFVAdvice
call fcn.005d6620
test al, al
je 0x44035d
mov esi, dword [ebp - 0x50]
mov eax, esi
mov edx, dword [ebp - 0x4c]
or eax, edx
je 0x44035d
mov ecx, dword [ebp - 0x5c]
cmp edx, ecx
ja 0x44035d
mov eax, dword [ebp - 0x60]
jb 0x440348
cmp esi, eax
ja 0x44035d
sub eax, esi
sbb ecx, edx
cmp ecx, 0xc9
jb 0x440372
ja 0x44035d
cmp eax, 0x2a69c000
jbe 0x440372
push 0
lea eax, [ebp - 0x60]
push eax
push 0xb
push str.LastFVAdvice
lea ecx, [ebp - 0x18]
call fcn.005d5f20
lea ecx, [edi + 0x34]
call fcn.004010c0
movsd xmm0, qword [edi + 8]
comisd xmm0, xmmword [0x6edab8]
jbe 0x4403c5
push 0
push str.UVK_Ultra_GUI
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x4403c5
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x30]
push eax
push str.HybridShutdownAdviced
call fcn.005d66b0
test al, al
je 0x4403c5
cmp dword [ebp - 0x30], 1
jne 0x4403c5
push str.HybridShutdownAdviced
lea ecx, [ebp - 0x18]
call fcn.005d5df0
test dword [edi + 0x1f68], 0x800
je 0x4404b6
xor edx, edx
mov ecx, str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
call fcn.005d3780
test al, al
je 0x4404b6
push 2
lea ecx, [ebp - 0x6c]
call fcn.005dc190
push eax
call fcn.005771e0
test eax, eax
je 0x4404b6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._portable_
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
push str.Do_you_want_to_uninstall
lea ecx, [ebp - 0x48]
call fcn.005dc200
push str._In_any_case__delete_all_applicaton_reports
push 0xaa
push 0x1c2
push ecx
push 2
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043ddd0
mov dword [ebp - 0x30], eax
test al, 4
je 0x44046a
push str.PortableVersion
lea ecx, [ebp - 0x18]
call fcn.005d5df0
mov eax, dword [ebp - 0x30]
test al, 8
je 0x440478
mov ecx, edi
call fcn.0043e560
mov eax, dword [ebp - 0x30]
test al, 1
je 0x44051c
or dword [edi + 0x1f68], 3
lea ecx, [ebp - 0x18]
call fcn.005d5440
mov ecx, edi
call fcn.00487320
movzx esi, al
jmp 0x44051f
push ecx
mov ecx, edi
call fcn.0046ef80
cmp eax, 1
je 0x4400f2
mov esi, 0xfffffffc
jmp 0x440527
cmp dword [ebp - 0x1c], 0
je 0x44051c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._has_actions_scheduled_to_be_performed_on_the_next_reboot__r_n_r_nPlease_do_not_remove_the_application_until_you_reboot_at_least_once.
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
push str.Important:
lea ecx, [ebp - 0x48]
call fcn.005dc200
sub esp, 8
lea ecx, [ebp - 0x48]
push 0xaa
push 0x1c2
push 0x3c
push 0
push 0
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
push str.RebootActions
lea ecx, [ebp - 0x18]
call fcn.005d5df0
mov esi, dword [edi + 0x6c]
lea ecx, [ebp - 0x6c]
call fcn.005dc430
lea ecx, [ebp - 0x7c]
call fcn.005dc430
lea ecx, [ebp - 0x88]
call fcn.005dc430
lea ecx, [ebp - 0x18]
call fcn.005d69e0
lea ecx, [ebp - 0xa4]
call fcn.005dc430
lea ecx, [ebp - 0x94]
call fcn.005dc430
lea ecx, [ebp - 0xb0]
call fcn.005dc430
lea ecx, [ebp - 0x48]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc