Function at 0x41fd80
Capabilities:
Accept command line arguments
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3ac
mov eax, dword [0x47d00c]
xor eax, esp
mov dword [esp + 0x3a8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push 0
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
push 0x46eb1c
mov dword [esp + 0x20], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, eax
test esi, esi
je 0x41fdef
push 9
push esi
call ebx
test eax, eax
je 0x41fdef
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a8]
xor ecx, esp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x258
lea eax, [esp + 0x15c]
push 0
push eax
call fcn.0043eb00
add esp, 0xc
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x158]
push eax
call fcn.00413200
lea ecx, [esp + 0x38]
call fcn.004099b0
lea ecx, [esp + 0x44]
call fcn.004099b0
lea ecx, [esp + 0x50]
call fcn.004099b0
lea ecx, [esp + 0x5c]
call fcn.004099b0
lea ecx, [esp + 0x68]
call fcn.004099b0
lea ecx, [esp + 0x74]
call fcn.004099b0
lea ecx, [esp + 0x80]
call fcn.004099b0
lea ecx, [esp + 0x8c]
call fcn.004099b0
lea eax, [esp + 0x11c]
mov dword [esp + 0x28], 0x7f
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x8c]
lea eax, [esp + 0x158]
mov dword [esp + 0x2c], 0
push 0x46eb38
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.00409a70
push 0x46eb4c
lea ecx, [esp + 0x60]
call fcn.00409a70
push 0
push str.UVK_Ultra_GUI
call edi
mov esi, eax
test esi, esi
jne 0x41fee6
push str.__UVK
push str.AutoIt_v3_GUI
call edi
mov esi, eax
test esi, esi
je 0x41ff36
lea eax, [esp + 0x10c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [esp + 0x114], 0x2bc
jl 0x41ff36
cmp dword [esp + 0x118], 0x1f4
jl 0x41ff36
push 9
push esi
call ebx
test eax, eax
je 0x41ff36
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x41ff36
push ecx
xor edx, edx
lea ecx, [esp + 0x24]
call fcn.00420b70
mov esi, eax
jmp 0x420af3
xor edx, edx
mov ecx, str.HKCUSoftwareUVK
call fcn.0040d9f0
test al, al
je 0x41ff55
mov edx, str.HKLM64SOFTWAREUVK___Ultra_virus_killer
mov ecx, str.HKCUSoftwareUVK
call fcn.0040d5b0
xor edx, edx
mov ecx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK
call fcn.0040d9f0
test al, al
je 0x41ff74
mov edx, str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
mov ecx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK
call fcn.0040d5b0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00410f60
push ecx
push 0x20019
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [esp + 0xcc]
mov byte [esp + 0x20], al
mov dword [esp + 0xcc], 0
call fcn.0040c670
push ecx
push 0x20019
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [esp + 0xac]
mov dword [esp + 0xac], 0
call fcn.0040c670
xorps xmm0, xmm0
mov dword [esp + 0x108], 0
lea ecx, [esp + 0x100]
movq qword [esp + 0x100], xmm0
call fcn.004099b0
lea eax, [esp + 0x38]
push eax
push str.InstallLocation
lea ecx, [esp + 0xc8]
call fcn.0040c800
lea ecx, [esp + 0x38]
call fcn.00409b70
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x420043
lea ecx, [esp + 0x38]
call fcn.00409c40
push eax
call ebx
test eax, eax
je 0x420043
push 0
push 1
push 1
push 0
push str.UVK
lea ecx, [esp + 0x4c]
call fcn.0040a7e0
test eax, eax
jne 0x4200d0
lea ecx, [esp + 0x38]
call fcn.00409b00
xorps xmm0, xmm0
mov dword [esp + 0xd8], 0
lea ecx, [esp + 0xd0]
movq qword [esp + 0xd0], xmm0
call fcn.004099b0
push dword [esp + 0x14]
lea edx, [esp + 0xd4]
lea ecx, [esp + 0x104]
call fcn.00411370
lea ecx, [esp + 0x100]
call fcn.00409dc0
test al, al
jne 0x4200c4
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [esp + 0x12c]
call fcn.00409c40
push eax
lea ecx, [esp + 0x68]
call fcn.00409be0
lea ecx, [esp + 0xd0]
call fcn.00409af0
push 0x400
push 0
push 0x400
lea ecx, [esp + 0x8c]
call fcn.00409f00
mov esi, dword [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x78]
call fcn.00409a80
push 0
lea ecx, [esp + 0x78]
call fcn.00409d80
xorps xmm0, xmm0
mov dword [esp + 0x114], 0
lea ecx, [esp + 0x10c]
movq qword [esp + 0x10c], xmm0
call fcn.004099b0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.key.uvkey
lea ecx, [esp + 0xa0]
call fcn.00409c40
push eax
lea ecx, [esp + 0x74]
call fcn.00409be0
lea ecx, [esp + 0x44]
call fcn.00409c40
push eax
call ebx
test eax, eax
jne 0x420193
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.key.uvkey
lea ecx, [esp + 0x64]
call fcn.00409c40
push eax
lea ecx, [esp + 0x74]
call fcn.00409be0
call fcn.0040e370
lea ecx, [esp + 0x44]
call fcn.00409c40
push eax
call ebx
test eax, eax
je 0x4201b1
lea ecx, [esp + 0x20]
call fcn.00420bb0
xorps xmm0, xmm0
mov dword [esp + 0xfc], 0
lea ecx, [esp + 0xf4]
movq qword [esp + 0xf4], xmm0
call fcn.004099b0
xorps xmm0, xmm0
mov dword [esp + 0xd8], 0
lea ecx, [esp + 0xd0]
movq qword [esp + 0xd0], xmm0
call fcn.004099b0
push 0
push 0x200
lea ecx, [esp + 0x70]
call fcn.00409f00
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSetup
lea ecx, [esp + 0x98]
call fcn.0040aa90
push 0
push 0
push 0x46d668
push 0x46db18
lea ecx, [esp + 0x78]
call fcn.0040aef0
lea ecx, [esp + 0x68]
call fcn.00409c40
mov ecx, eax
call fcn.00411050
cmp dword [esp + 0x2c], 2
mov dword [esp + 0x9c], 0
jne 0x42027d
cmp dword [esp + 0x30], 0
jne 0x4204b6
lea eax, [esp + 0x9c]
push eax
push str.EulaAccepted
lea ecx, [esp + 0xa8]
call fcn.0040c940
test al, al
je 0x4202a8
cmp dword [esp + 0x9c], 0
jne 0x4204b6
push ecx
call fcn.004160c0
sub esp, 0x20
lea ecx, [esp + 0x7c]
call fcn.00409c40
push eax
push ecx
lea ecx, [esp + 0x180]
call fcn.00413240
sub esp, 0x10
lea ecx, [esp + 0x168]
push esi
call fcn.00414160
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.License.htm
lea ecx, [esp + 0x94]
call fcn.00409c40
push eax
lea ecx, [esp + 0x124]
call fcn.00409be0
push esi
lea ecx, [esp + 0xf8]
call fcn.00409c40
push eax
push 0xa
push 0xc8
call fcn.00418100
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x400
push eax
push 0
push 0x400
lea ecx, [esp + 0xe0]
call fcn.00409f00
push eax
lea ecx, [esp + 0x100]
call fcn.00409c40
push eax
call dword [sym.imp.SHLWAPI.dll_UrlCreateFromPathW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.png
lea ecx, [esp + 0x94]
call fcn.00409c40
push eax
lea ecx, [esp + 0x124]
call fcn.00409be0
push esi
lea ecx, [esp + 0xf8]
call fcn.00409c40
push eax
push 0x46e194
push 0x64
call fcn.00418100
sub esp, 0x18
lea ecx, [esp + 0xe8]
call fcn.00409c40
push eax
lea ecx, [esp + 0x174]
call fcn.00415df0
push ecx
mov dword [esp], 0x41500000
push str.Continue_installation
sub esp, 0xc
lea ecx, [esp + 0x16c]
mov edx, str.I_Accept
push 0x78
push 0x67
call fcn.00412920
push ecx
mov dword [esp], 0x41500000
lea ecx, [esp + 0x15c]
push str.Cancel_installation
sub esp, 0xc
mov edx, str.I_Decline
mov esi, eax
push 0x168
push 0x68
call fcn.00412920
sub esp, 8
lea ecx, [esp + 0x160]
mov edi, eax
call fcn.00414300
push 0x80
push esi
lea ecx, [esp + 0x160]
call fcn.00416d40
xor dl, dl
lea ecx, [esp + 0x11c]
call fcn.00412620
test eax, eax
je 0x42047e
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [esp + 0x11c]
cmp eax, 0xfffffffb
je 0x420728
cmp eax, edi
je 0x420728
cmp eax, esi
je 0x42047e
xor dl, dl
lea ecx, [esp + 0x11c]
call fcn.00412620
test eax, eax
jne 0x420450
lea ecx, [esp + 0x158]
call fcn.00413480
push ecx
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 1
push eax
push 4
push str.EulaAccepted
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [esp + 0xb4]
call fcn.0040cc20
sub esp, 0x1c
mov dword [esp + 0x10c], 0
xorps xmm0, xmm0
lea ecx, [esp + 0x90]
movq qword [esp + 0x104], xmm0
push 0
push 0
push 0
push str.UVKSettings.ini
call fcn.00409c40
push eax
lea ecx, [esp + 0x118]
call fcn.00409a30
cmp dword [esp + 0x30], 0
je 0x4205d0
lea ecx, [esp + 0xe8]
call fcn.00409c40
push eax
call ebx
test eax, eax
je 0x4205d0
lea ecx, [esp + 0xe8]
call fcn.00409c40
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 1
push str.DesktopShortcut
push str.Preferences
call esi
test eax, eax
jne 0x420540
and dword [esp + 0x28], 0xffffffef
lea ecx, [esp + 0xe8]
call fcn.00409c40
push eax
push 1
push str.ContextMenu
push str.Preferences
call esi
test eax, eax
jne 0x420564
and dword [esp + 0x28], 0xfffffffb
lea ecx, [esp + 0xe8]
call fcn.00409c40
push eax
push 1
push str.AssociateUVKScripts
push str.Preferences
call esi
test eax, eax
jne 0x420588
and dword [esp + 0x28], 0xfffffff7
lea ecx, [esp + 0xe8]
call fcn.00409c40
push eax
push 1
push str.AutoUpdate
push str.Preferences
call esi
test eax, eax
jne 0x4205ac
and dword [esp + 0x28], 0xffffffdf
lea ecx, [esp + 0xe8]
call fcn.00409c40
push eax
push 1
push str.ShowTooltips
push str.Preferences
call esi
test eax, eax
jne 0x4205d0
and dword [esp + 0x28], 0xffffffbf
xorps xmm0, xmm0
mov dword [esp + 0xe4], 0
lea ecx, [esp + 0xdc]
movq qword [esp + 0xdc], xmm0
call fcn.004099b0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xa4], 0
mov byte [esp + 0x13], 0
call fcn.0040b940
cmp eax, 1
jle 0x420969
lea eax, [esp + 0xa4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0xa4], 0
mov edi, eax
je 0x420969
test edi, edi
je 0x420969
xorps xmm0, xmm0
mov dword [esp + 0xbc], 0
lea ecx, [esp + 0xb4]
movq qword [esp + 0xb4], xmm0
call fcn.004099b0
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
lea ecx, [esp + 0xa8]
movq qword [esp + 0xa8], xmm0
call fcn.004099b0
xorps xmm0, xmm0
mov dword [esp + 0xcc], 0
lea ecx, [esp + 0xc4]
movq qword [esp + 0xc4], xmm0
call fcn.004099b0
xor esi, esi
cmp dword [esp + 0xa4], esi
jle 0x420912
nop dword [eax]
nop dword [eax + eax]
push dword [edi + esi*4]
lea ecx, [esp + 0xac]
call fcn.00409a70
push 0
push 0
push 0x46c60c
push 0x46de90
lea ecx, [esp + 0xb8]
call fcn.0040aef0
lea ecx, [esp + 0xa8]
call fcn.00409b70
cmp eax, 2
jl 0x420904
lea ecx, [esp + 0xa8]
call fcn.00409c40
push eax
call ebx
test eax, eax
jne 0x42073b
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + esi*4]
push 0x46dea0
jmp 0x4208f8
push ecx
xor edx, edx
lea ecx, [esp + 0x24]
call fcn.00420b70
mov esi, eax
jmp 0x420aab
lea ecx, [esp + 0xa8]
call fcn.00409c40
push eax
push 0x400
lea ecx, [esp + 0xb0]
call fcn.00409f00
push 0x400
lea ecx, [esp + 0xac]
call fcn.00409c40
push eax
lea ecx, [esp + 0xb0]
call fcn.00409c40
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0xb8]
call fcn.00409a80
push ecx
lea ecx, [esp + 0xb8]
call fcn.00409ce0
cmp dword [esp + 0xa4], 1
jne 0x4208d0
push str..uvksr
lea ecx, [esp + 0xb8]
call fcn.00409ab0
test al, al
je 0x420887
push ecx
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 1
push eax
push 4
push str.AutoLoadLastSR
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [esp + 0xb4]
call fcn.0040cc20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemRepair
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [esp + 0xf4]
call fcn.00409be0
push ecx
lea ecx, [esp + 0xac]
call fcn.00409c40
push eax
push 1
push str.LastSRFile
lea ecx, [esp + 0xd4]
call fcn.00409c40
push eax
lea ecx, [esp + 0xb4]
call fcn.0040cc20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x46de90
lea ecx, [esp + 0xd0]
call fcn.00409c40
push eax
push str.__ImportSr__
lea ecx, [esp + 0x10c]
call fcn.0040aa90
mov byte [esp + 0x13], 1
jmp 0x420904
cmp dword [esp + 0xa4], 1
jne 0x4208d0
push str..uvk
lea ecx, [esp + 0xb8]
call fcn.00409ab0
test al, al
je 0x4208d0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x46de90
lea ecx, [esp + 0xd0]
call fcn.00409c40
push eax
push str.__ReadFile__
jmp 0x4208f8
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x46de90
lea ecx, [esp + 0xd0]
call fcn.00409c40
push eax
push 0x46f03c
lea ecx, [esp + 0x10c]
call fcn.0040aa90
inc esi
cmp esi, dword [esp + 0xa4]
jl 0x4206c0
lea ecx, [esp + 0xdc]
call fcn.00409b70
cmp eax, 2
jle 0x420933
lea ecx, [esp + 0xdc]
call fcn.00409c40
mov dword [esp + 0x34], eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0xc4]
call fcn.00409af0
lea ecx, [esp + 0xa8]
call fcn.00409af0
lea ecx, [esp + 0xb4]
call fcn.00409af0
cmp byte [esp + 0x13], 0
jne 0x420a7c
xorps xmm0, xmm0
mov dword [esp + 0xbc], 0
lea ecx, [esp + 0xb4]
movq qword [esp + 0xb4], xmm0
call fcn.004099b0
sub esp, 0x1c
mov dword [esp + 0xe8], 0
xorps xmm0, xmm0
lea ecx, [esp + 0x90]
movq qword [esp + 0xe0], xmm0
push 0
push 0
push 0
push str.UVK_SR_settings.uvksr
call fcn.00409c40
push eax
lea ecx, [esp + 0xf4]
call fcn.00409a30
lea ecx, [esp + 0xc4]
call fcn.00409c40
push eax
call ebx
test eax, eax
je 0x420a64
push ecx
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 1
push eax
push 4
push str.AutoLoadLastSR
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [esp + 0xb4]
call fcn.0040cc20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemRepair
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [esp + 0xe4]
call fcn.00409be0
push ecx
lea ecx, [esp + 0xc8]
call fcn.00409c40
push eax
push 1
push str.LastSRFile
lea ecx, [esp + 0xc4]
call fcn.00409c40
push eax
lea ecx, [esp + 0xb4]
call fcn.0040cc20
lea ecx, [esp + 0xc4]
call fcn.00409af0
lea ecx, [esp + 0xb4]
call fcn.00409af0
lea ecx, [esp + 0x20]
call fcn.00421100
push ecx
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.00420b70
lea ecx, [esp + 0xdc]
mov esi, eax
call fcn.00409af0
lea ecx, [esp + 0xe8]
call fcn.00409af0
lea ecx, [esp + 0xd0]
call fcn.00409af0
lea ecx, [esp + 0xf4]
call fcn.00409af0
lea ecx, [esp + 0x10c]
call fcn.00409af0
lea ecx, [esp + 0x100]
call fcn.00409af0
lea ecx, [esp + 0xa0]
call fcn.0040c6c0
lea ecx, [esp + 0xc0]
call fcn.0040c6c0
lea ecx, [esp + 0x8c]
call fcn.00409af0
lea ecx, [esp + 0x80]
call fcn.00409af0
lea ecx, [esp + 0x74]
call fcn.00409af0
lea ecx, [esp + 0x68]
call fcn.00409af0
lea ecx, [esp + 0x5c]
call fcn.00409af0
lea ecx, [esp + 0x50]
call fcn.00409af0
lea ecx, [esp + 0x44]
call fcn.00409af0
lea ecx, [esp + 0x38]
call fcn.00409af0
lea ecx, [esp + 0x158]
call fcn.00415d90
mov ecx, dword [esp + 0x3b4]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042520b
mov esp, ebp
pop ebp
ret 0x10