Function at 0x43793d
Capabilities:
Get common file path
Get startup folder
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
sub esp, 0x58
mov eax, 0x69ed35
call fcn.006426c4
sub esp, 0x970
push ebx
push esi
push edi
push str.classic_uninstall
lea ecx, [ebp - 0x24]
call fcn.0040f32f
sub esp, 0x18
lea eax, [ebp - 0x24]
mov ecx, esp
mov dword [ebp - 0x40], esp
xor ebx, ebx
mov dword [ebp], ecx
mov dword [ebp - 4], ebx
push eax
call fcn.0040f8db
xor eax, eax
lea ecx, [ebp + 0x5b]
inc eax
mov byte [ebp - 4], al
call fcn.005a4006
push eax
lea ecx, [ebp + 0x5b]
mov byte [ebp - 4], bl
call fcn.005a40f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
xor esi, esi
push ebx
inc esi
push esi
call fcn.0040f95f
call fcn.0059f765
push 0x104
lea eax, [ebp - 0x774]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call fcn.0046353a
test al, al
jne 0x437a60
cmp byte [0x7af1d8], 6
jb 0x437a60
push str._UNINSTALL
lea ecx, [ebp + 0x28]
call fcn.00429d77
mov dword [ebp - 4], 2
cmp byte [ebp + 0x64], bl
je 0x437a06
mov esi, 0x6c48b0
push esi
call fcn.00428864
pop ecx
push eax
push esi
lea ecx, [ebp + 0x28]
call fcn.004286d2
cmp byte [ebp + 0x68], 0
je 0x437a22
mov esi, str.__REMSETTINGS
push esi
call fcn.00428864
pop ecx
push eax
push esi
lea ecx, [ebp + 0x28]
call fcn.004286d2
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x24], ax
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
mov byte [ebp - 4], 3
jae 0x437a42
lea eax, [ebp + 0x28]
push ebx
xor esi, esi
lea ecx, [ebp - 0x24]
inc esi
push esi
push ebx
push ecx
push eax
lea eax, [ebp - 0x774]
push eax
call fcn.00434411
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov bl, byte [ebp + 0x64]
test bl, bl
jne 0x437abb
lea ecx, [ebp - 0xac]
call fcn.0058fc2f
mov dword [ebp - 0xac], 0x6c46a4
lea eax, [ebp + 0x68]
mov dword [ebp - 4], 4
push eax
push 0xfe
call fcn.0058f06f
push eax
lea ecx, [ebp - 0xac]
call fcn.00590934
lea ecx, [ebp - 0xac]
cmp byte [ebp - 0x74], bl
jne 0x437ab2
call fcn.0058fcc9
jmp 0x438085
or dword [ebp - 4], 0xffffffff
call fcn.0058fcc9
call fcn.0043776c
test al, al
jne 0x437aed
test bl, bl
jne 0x437aed
push 0x10
push 0x7ff
call fcn.0058dfbe
push eax
push 0x800
call fcn.0058dfbe
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x438085
push dword [ebp + 0x68]
call fcn.0048614d
xor ebx, ebx
mov dword [0x7e54c8], ebx
mov dword [0x7e54c0], ebx
mov dword [0x7e54c4], ebx
call fcn.00475e15
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 8
pop edi
push edi
call fcn.0043372c
lea ecx, [ebp - 0x15c]
call fcn.0059af59
push edi
push 0x7b1000
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], 5
call fcn.0059ba2b
xor eax, eax
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x50], ebx
mov word [ebp + 0x40], ax
push 0x104
lea eax, [ebp - 0x97c]
mov byte [ebp - 4], 6
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push reloc.WS2_32.dll_accept
call fcn.004869ee
test al, al
je 0x437dd4
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x97c]
push eax
call fcn.004864eb
test eax, eax
je 0x437b96
push ebx
jmp 0x438071
push esi
lea eax, [ebp - 0x774]
push eax
call fcn.00460cab
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00429756
push eax
sub esp, 0x18
mov byte [ebp - 4], 7
lea eax, [ebp + 0x40]
mov ecx, esp
push eax
call fcn.00427fbe
lea eax, [ebp + 0x28]
push eax
call fcn.00460bac
xor ebx, ebx
mov byte [ebp - 4], 9
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.004285f6
push esi
lea eax, [ebp - 0x774]
push eax
call fcn.00460cab
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.00429756
push eax
sub esp, 0x18
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x97c]
mov ecx, esp
push eax
call fcn.00429d77
lea eax, [ebp - 0x3c]
push eax
call fcn.00460bac
push ebx
push esi
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0xc
call fcn.004285f6
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x437c2e
lea eax, [ebp + 0x28]
push eax
call fcn.0047bd8a
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], edi
jae 0x437c3f
lea eax, [ebp - 0x3c]
push eax
call fcn.0047bd8a
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x437c50
lea eax, [ebp + 0x28]
push eax
call fcn.00438099
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], edi
jae 0x437c61
lea eax, [ebp - 0x3c]
push eax
call fcn.00438099
push esi
push 0x28
lea eax, [ebp - 0x364]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp + 0x64], 0x18
test eax, eax
je 0x437d7b
lea ecx, [ebp - 0x364]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x437c90
mov eax, dword [ebp + 0x40]
sub ecx, edx
sar ecx, 1
cmp dword [ebp + 0x54], edi
jae 0x437caa
lea eax, [ebp + 0x40]
push ecx
lea ecx, [ebp - 0x364]
push ecx
push eax
call fcn.006680d4
add esp, 0xc
test eax, eax
jne 0x437d7b
lea eax, [ebp - 0x56c]
push eax
call fcn.0042f2a7
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00429d77
push esi
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xd
push eax
sub esp, 0x18
lea eax, [ebp - 0x364]
mov ecx, esp
push eax
call fcn.00429d77
lea eax, [ebp - 0x24]
push eax
call fcn.00460bac
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.004285f6
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x10], edi
jae 0x437d23
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp + 4]
push eax
call fcn.00461988
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
sub eax, ecx
cdq
idiv dword [ebp + 0x64]
cmp eax, esi
jne 0x437d69
push 0x6c4264
call fcn.004392ec
test eax, eax
jne 0x437d69
lea eax, [ebp - 0x364]
push eax
call fcn.00428864
pop ecx
push eax
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp + 0x40]
call fcn.00439135
lea ecx, [ebp + 4]
call fcn.00438fb4
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.004285f6
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
mov eax, dword [ebp + 0x40]
mov byte [ebp - 4], 0x11
cmp dword [ebp + 0x54], edi
jae 0x437d93
lea eax, [ebp + 0x40]
push ebx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00461988
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp + 0x1c]
push 0x18
pop ecx
cdq
idiv ecx
lea ecx, [ebp + 0x1c]
cmp esi, eax
sbb bl, bl
inc bl
call fcn.00438fb4
xor edi, edi
lea ecx, [ebp - 0x3c]
push edi
push esi
call fcn.004285f6
push edi
push esi
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 6
call fcn.004285f6
jmp 0x437dd6
xor edi, edi
push 0x6c4198
lea eax, [ebp - 0x58]
push eax
call fcn.00473f1c
cmp byte [ebp + 0x68], 0
mov byte [ebp - 4], 0x12
je 0x437e7d
cmp dword [ebp - 0x48], 0
je 0x437e7d
cmp dword [ebp - 0x44], 8
mov eax, dword [ebp - 0x58]
jae 0x437e08
lea eax, [ebp - 0x58]
push eax
call fcn.00461675
push 0x6c4974
push 0x6c4990
sub esp, 0x18
lea eax, [ebp + 0x28]
lea esi, [ebp + 0x40]
push 6
pop ecx
mov edi, esp
push 0x6c4994
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00465d7f
add esp, 0x28
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
mov byte [ebp - 4], 0x13
jae 0x437e46
lea eax, [ebp + 0x28]
push eax
call fcn.00473ace
test eax, eax
je 0x437e68
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
jae 0x437e5c
lea eax, [ebp + 0x28]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
xor eax, eax
mov byte [ebp - 4], 0x12
xor edi, edi
lea ecx, [ebp + 0x28]
inc eax
push edi
push eax
mov bl, al
call fcn.004285f6
call fcn.00432825
test al, al
je 0x437e9a
push 0x6c4264
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call fcn.00486780
push 0x6c49a4
push 0x6c49d8
call fcn.004334a8
push str.application_x_bittorrentsearchdescriptionxml
push 0x6c4a4c
call fcn.004334a8
push str.application_x_bittorrent_skin
push 0x6c4a9c
call fcn.004334a8
push str.application_x_bittorrent_key
push 0x6c4ae8
call fcn.004334a8
push str.application_x_bittorrent_app
push 0x6c4b34
call fcn.004334a8
push str.application_x_bittorrent_appinst
push 0x6c4b8c
call fcn.004334a8
push str.Magnet
call fcn.0043369e
push str.bittorrent
call fcn.0043369e
push 0x6c4b36
call fcn.0043369e
push 0x6c4b8e
call fcn.0043369e
push 0x6c4a9e
call fcn.0043369e
push 0x6c4aea
call fcn.0043369e
movzx eax, byte [0x7af1d8]
cmp eax, 5
push str.SoftwareClassesuTorrent
sbb esi, esi
neg esi
add esi, reloc.WS2_32.dll_accept
push esi
call fcn.00486342
push str.SoftwareClassesApplicationsuTorrent.exe
push esi
call fcn.00486342
push 0x6c4220
mov esi, reloc.WS2_32.dll_accept
push esi
call fcn.00486342
push str.SoftwareBitTorrentuTorrent
push esi
call fcn.00486342
push str.SoftwareBitTorrentengine
push esi
call fcn.00486342
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push esi
call fcn.004862f8
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004862f8
test bl, bl
je 0x43805e
xor eax, eax
mov dword [ebp + 0x24], 7
mov dword [ebp + 0x20], edi
mov word [ebp + 0x10], ax
cmp dword [0x7af1d8], 0x80000000
mov esi, str.rmdir__S__Q
mov byte [ebp - 4], 0x14
jb 0x437fcc
mov esi, str.deltree__Y
push esi
call fcn.00428864
pop ecx
push eax
push esi
lea ecx, [ebp + 0x10]
call fcn.00439135
cmp dword [ebp + 0x54], 8
mov eax, dword [ebp + 0x40]
jae 0x437fe9
lea eax, [ebp + 0x40]
mov esi, dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
push edi
push edi
push eax
call esi
cmp dword [ebp + 0x54], 8
mov ecx, dword [ebp + 0x40]
jae 0x438000
lea ecx, [ebp + 0x40]
push eax
lea eax, [ebp - 0x56c]
push eax
push ecx
call esi
test eax, eax
jne 0x438020
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x10]
call fcn.00428642
jmp 0x43803d
lea eax, [ebp - 0x56c]
push eax
call fcn.00428864
pop ecx
push eax
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp + 0x10]
call fcn.004286d2
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x438049
lea eax, [ebp + 0x10]
push eax
call fcn.0059e5bd
xor esi, esi
lea ecx, [ebp + 0x10]
push edi
inc esi
push esi
call fcn.004285f6
jmp 0x438066
call fcn.0059e7bf
xor esi, esi
inc esi
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.004285f6
push edi
push esi
lea ecx, [ebp + 0x40]
call fcn.004285f6
lea ecx, [ebp - 0x15c]
call fcn.0042a6ac
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
lea esp, [ebp + 0x5c]
pop ebp
ret 8