Function at 0x45619e
Capabilities:
Get common file path
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
sub esp, 0x68
mov eax, 0x6d08c2
call fcn.006899cc
sub esp, 0x974
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp + 0x48], 0xf
push str.classic_uninstall
mov byte [ebp + 0x68], bl
lea ecx, [ebp + 0x34]
push dword [ebp + 0x68]
mov dword [ebp + 0x34], ebx
push 0x11
mov dword [ebp + 0x44], ebx
mov byte [ebp + 0x34], bl
call fcn.00416cb0
sub esp, 0x18
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp + 0x68], esp
mov dword [ebp + 0x18], ecx
lea eax, [ebp + 0x34]
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040fd80
xor eax, eax
lea ecx, [ebp + 0x67]
inc eax
mov byte [ebp - 4], al
call fcn.005d4eef
push eax
lea ecx, [ebp + 0x67]
mov byte [ebp - 4], bl
call fcn.005d4ff9
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x48]
cmp eax, 0x10
jb 0x45624e
mov ecx, dword [ebp + 0x34]
inc eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x456245
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
call fcn.005cf378
mov edi, 0x104
lea eax, [ebp - 0x570]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call fcn.00472c0c
test al, al
jne 0x4562e5
cmp byte [0x7e46a8], 6
jb 0x4562e5
push str._UNINSTALL
lea ecx, [ebp - 0x30]
call fcn.00449a5e
cmp byte [ebp + 0x74], 0
mov dword [ebp - 4], 2
je 0x4562a0
push 0x6f67d8
lea ecx, [ebp - 0x30]
call fcn.0044a8ee
cmp byte [ebp + 0x78], 0
je 0x4562b3
push str.__REMSETTINGS
lea ecx, [ebp - 0x30]
call fcn.0044a8ee
lea ecx, [ebp]
call fcn.00449bec
xor eax, eax
mov byte [ebp - 4], 3
push ebx
inc eax
lea ecx, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp]
push eax
call fcn.00457977
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.00453b92
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov bl, byte [ebp + 0x74]
test bl, bl
jne 0x456344
lea ecx, [ebp - 0xb8]
call fcn.005bc4b4
mov dword [ebp - 0xb8], 0x6f65cc
xor eax, eax
mov dword [ebp - 4], 4
inc eax
push eax
lea eax, [ebp + 0x78]
push eax
push 0xfe
call fcn.005bb8f8
push eax
lea ecx, [ebp - 0xb8]
call fcn.005bd16d
lea ecx, [ebp - 0xb8]
cmp byte [ebp - 0x7c], bl
jne 0x45633b
call fcn.005bc551
jmp 0x456b9b
or dword [ebp - 4], 0xffffffff
call fcn.005bc551
call fcn.00455fdd
test al, al
jne 0x456377
test bl, bl
jne 0x456377
push 0x10
push 0x816
call fcn.005ba91d
push eax
push 0x817
call fcn.005ba91d
push eax
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x456b9b
push dword [ebp + 0x78]
call fcn.00499ab2
xor ebx, ebx
mov dword [0x81be18], ebx
mov dword [0x81be10], ebx
mov dword [0x81be14], ebx
call fcn.00486993
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 8
pop esi
push esi
call fcn.00452e3a
lea ecx, [ebp - 0x160]
call fcn.005c96a2
push esi
push 0x7e61b0
lea ecx, [ebp - 0x160]
mov dword [ebp - 4], 5
call fcn.005ca558
xor eax, eax
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x60], 7
mov word [ebp + 0x4c], ax
push edi
lea eax, [ebp - 0x980]
mov byte [ebp - 4], 6
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push reloc.WS2_32.dll_accept
call fcn.0049a452
test al, al
je 0x456866
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x980]
push eax
call fcn.00499f48
test eax, eax
je 0x45645a
mov eax, dword [ebp + 0x60]
cmp eax, esi
jb 0x456453
mov ecx, dword [ebp + 0x4c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x45644a
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor edi, edi
jmp 0x456b80
xor edi, edi
lea eax, [ebp - 0x570]
inc edi
push edi
push eax
call fcn.0046f5a7
xor ebx, ebx
mov dword [ebp + 0x30], 7
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x2c], ebx
test eax, eax
je 0x45648e
xor ecx, ecx
mov word [ebp + 0x1c], cx
lea ecx, [ebp + 0x1c]
push eax
call fcn.004482e2
jmp 0x456494
xor eax, eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1c]
mov byte [ebp - 4], 7
push eax
sub esp, 0x18
lea eax, [ebp + 0x4c]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00448193
lea eax, [ebp]
push eax
call fcn.0046f4a0
mov eax, dword [ebp + 0x30]
mov byte [ebp - 4], 9
cmp eax, esi
jb 0x4564f9
mov ecx, dword [ebp + 0x1c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x4564f0
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x2c], ebx
mov word [ebp + 0x1c], ax
lea eax, [ebp - 0x570]
push edi
push eax
mov dword [ebp + 0x30], 7
call fcn.0046f5a7
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], 7
test eax, eax
je 0x456538
xor ecx, ecx
mov word [ebp + 0x34], cx
lea ecx, [ebp + 0x34]
push eax
call fcn.004482e2
jmp 0x45653e
xor eax, eax
mov word [ebp + 0x34], ax
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0xa
push eax
sub esp, 0x18
lea eax, [ebp - 0x980]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 7
call fcn.004482e2
lea eax, [ebp - 0x60]
push eax
call fcn.0046f4a0
mov eax, dword [ebp + 0x48]
mov byte [ebp - 4], 0xc
cmp eax, esi
jb 0x4565aa
mov ecx, dword [ebp + 0x34]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x4565a1
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x44], ebx
mov word [ebp + 0x34], ax
lea eax, [ebp]
mov dword [ebp + 0x48], 7
cmp dword [ebp + 0x14], esi
jb 0x4565c5
mov eax, dword [ebp]
push eax
call fcn.0048ce39
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], esi
jb 0x4565d6
mov eax, dword [ebp - 0x60]
push eax
call fcn.0048ce39
lea eax, [ebp]
cmp dword [ebp + 0x14], esi
jb 0x4565e7
mov eax, dword [ebp]
push eax
call fcn.00456baf
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], esi
jb 0x4565f8
mov eax, dword [ebp - 0x60]
push eax
call fcn.00456baf
push edi
push 0x28
lea eax, [ebp - 0x368]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4567b1
lea ecx, [ebp - 0x368]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x456620
sub ecx, edx
lea eax, [ebp + 0x4c]
sar ecx, 1
cmp dword [ebp + 0x60], esi
jb 0x45663a
mov eax, dword [ebp + 0x4c]
push ecx
lea ecx, [ebp - 0x368]
push ecx
push eax
call fcn.00698ebe
add esp, 0xc
test eax, eax
jne 0x4567b1
lea eax, [ebp - 0x778]
push eax
call fcn.0044e6d8
xor eax, eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x48], ax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x778]
mov dword [ebp - 0x38], ebx
push eax
mov dword [ebp - 0x34], 7
call fcn.004482e2
push edi
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0xd
push eax
sub esp, 0x18
lea eax, [ebp - 0x368]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 7
call fcn.004482e2
lea eax, [ebp - 0x30]
push eax
call fcn.0046f4a0
mov eax, dword [ebp - 0x34]
cmp eax, esi
jb 0x4566ea
mov ecx, dword [ebp - 0x48]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x4566e1
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x30], ebx
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x1c], esi
jb 0x456702
mov eax, dword [ebp - 0x30]
push ebx
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.004705e7
mov edi, dword [ebp + 0x2c]
mov eax, edi
mov esi, dword [ebp + 0x28]
sub eax, esi
push 0x18
pop ecx
cdq
idiv ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x456749
push 0x6f62dc
mov ecx, esi
call fcn.00457121
test al, al
je 0x456749
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp + 0x4c]
call fcn.004482e2
mov edi, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x28]
test esi, esi
je 0x4567a6
cmp esi, edi
je 0x456766
push 0x18
pop ebx
mov ecx, esi
call fcn.0044823e
add esi, ebx
cmp esi, edi
jne 0x456754
mov esi, dword [ebp + 0x28]
xor ebx, ebx
mov eax, dword [ebp + 0x30]
sub eax, esi
mov dword [ebp + 0x68], esi
push 0x18
cdq
pop ecx
idiv ecx
imul eax, eax, 0x18
mov dword [ebp + 0x74], eax
cmp eax, 0x1000
jb 0x456794
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov esi, dword [ebp + 0x68]
push eax
push esi
call fcn.0068976d
pop ecx
pop ecx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x30], ebx
lea ecx, [ebp - 0x30]
call fcn.0044823e
push 8
pop esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp + 0x4c]
mov byte [ebp - 4], 0x11
cmp dword [ebp + 0x60], esi
jb 0x4567c9
mov eax, dword [ebp + 0x4c]
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004705e7
mov edi, dword [ebp - 0x14]
mov eax, edi
mov esi, dword [ebp - 0x18]
sub eax, esi
push 0x18
cdq
pop ecx
idiv ecx
xor edx, edx
inc edx
cmp edx, eax
sbb bl, bl
inc bl
test esi, esi
je 0x45684b
cmp esi, edi
je 0x45680a
mov ecx, esi
call fcn.0044823e
push 0x18
pop eax
add esi, eax
cmp esi, edi
jne 0x4567f5
mov esi, dword [ebp - 0x18]
push eax
pop ecx
mov eax, dword [ebp - 0x10]
sub eax, esi
mov dword [ebp + 0x68], esi
cdq
idiv ecx
imul eax, eax, 0x18
mov dword [ebp + 0x74], eax
cmp eax, 0x1000
jb 0x456835
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov esi, dword [ebp + 0x68]
push eax
push esi
call fcn.0068976d
xor edi, edi
pop ecx
pop ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
jmp 0x45684d
xor edi, edi
lea ecx, [ebp - 0x60]
call fcn.0044823e
lea ecx, [ebp]
mov byte [ebp - 4], 6
call fcn.0044823e
push 8
pop esi
jmp 0x456868
xor edi, edi
push 0x6f6210
lea eax, [ebp - 0x78]
push eax
call fcn.004848ce
cmp byte [ebp + 0x78], 0
mov byte [ebp - 4], 0x12
je 0x4568ff
cmp dword [ebp - 0x68], 0
je 0x4568ff
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], esi
jb 0x456891
mov eax, dword [ebp - 0x78]
push eax
call fcn.004702e2
lea eax, [ebp + 0x4c]
cmp dword [ebp + 0x60], esi
jb 0x4568a2
mov eax, dword [ebp + 0x4c]
push 0x6f689c
push 0x6f68b8
push eax
lea eax, [ebp]
push 0x6f68bc
push eax
call fcn.00475719
add esp, 0x14
lea eax, [ebp]
mov byte [ebp - 4], 0x13
cmp dword [ebp + 0x14], esi
jb 0x4568cd
mov eax, dword [ebp]
push eax
call fcn.004843bf
test eax, eax
je 0x4568ee
lea eax, [ebp]
cmp dword [ebp + 0x14], esi
jb 0x4568e2
mov eax, dword [ebp]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
xor eax, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp]
lea ebx, [eax + 1]
call fcn.0044823e
call fcn.0058f8a2
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x30], ax
mov dword [ebp], edi
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x14], ecx
mov word [ebp], ax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp]
push eax
call fcn.00451e3a
mov byte [ebp - 4], 0x12
test al, al
je 0x456950
push 0x6fa7d0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call fcn.0049a202
push 0x6f68cc
push 0x6f6900
call fcn.00452b1c
push str.application_x_bittorrentsearchdescriptionxml
push 0x6f6974
call fcn.00452b1c
push str.application_x_bittorrent_skin
push 0x6f69c4
call fcn.00452b1c
push str.application_x_bittorrent_key
push 0x6f6a10
call fcn.00452b1c
push str.application_x_bittorrent_app
push 0x6f6a5c
call fcn.00452b1c
push str.application_x_bittorrent_appinst
push 0x6f6ab4
call fcn.00452b1c
push str.Magnet
call fcn.00452db1
push str.bittorrent
call fcn.00452db1
push 0x6f6a5e
call fcn.00452db1
push 0x6f6ab6
call fcn.00452db1
push 0x6f69c6
call fcn.00452db1
push 0x6f6a12
call fcn.00452db1
movzx eax, byte [0x7e46a8]
cmp eax, 5
push str.SoftwareClassesuTorrent
sbb esi, esi
neg esi
add esi, reloc.WS2_32.dll_accept
push esi
call fcn.00499d92
push str.SoftwareClassesApplicationsuTorrent.exe
push esi
call fcn.00499d92
push str.SoftwareBitTorrent
mov esi, reloc.WS2_32.dll_accept
push esi
call fcn.00499d92
push str.SoftwareBitTorrentuTorrent
push esi
call fcn.00499d92
push str.SoftwareBitTorrentengine
push esi
call fcn.00499d92
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push esi
call fcn.00499d48
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalluTorrent
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00499d48
test bl, bl
je 0x456b38
xor eax, eax
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x44], edi
mov dword [ebp + 0x48], 7
mov word [ebp + 0x34], ax
cmp dword [0x7e46a8], 0x80000000
mov eax, str.rmdir__S__Q
mov byte [ebp - 4], 0x16
jb 0x456a85
mov eax, str.deltree__Y
push eax
lea ecx, [ebp + 0x34]
call fcn.004482e2
cmp dword [ebp + 0x60], 8
lea eax, [ebp + 0x4c]
jb 0x456a9a
mov eax, dword [ebp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
push edi
push edi
push eax
call esi
cmp dword [ebp + 0x60], 8
lea ecx, [ebp + 0x4c]
jb 0x456ab1
mov ecx, dword [ebp + 0x4c]
push eax
lea eax, [ebp - 0x778]
push eax
push ecx
call esi
test eax, eax
jne 0x456ada
cmp dword [ebp + 0x60], 8
lea eax, [ebp + 0x4c]
jb 0x456acc
mov eax, dword [ebp + 0x4c]
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x34]
push eax
call fcn.00448284
jmp 0x456ae9
lea eax, [ebp - 0x778]
push eax
lea ecx, [ebp + 0x34]
call fcn.004578e2
cmp dword [ebp + 0x48], 8
lea eax, [ebp + 0x34]
jb 0x456af5
mov eax, dword [ebp + 0x34]
push eax
call fcn.005cd71a
mov eax, dword [ebp + 0x48]
cmp eax, 8
jb 0x456b3d
mov ecx, dword [ebp + 0x34]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x456b2d
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
jmp 0x456b3d
call fcn.005cda09
lea ecx, [ebp - 0x78]
call fcn.0044823e
mov eax, dword [ebp + 0x60]
cmp eax, 8
jb 0x456b80
mov ecx, dword [ebp + 0x4c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x456b77
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x5c], edi
lea ecx, [ebp - 0x160]
mov dword [ebp + 0x60], 7
mov word [ebp + 0x4c], ax
call fcn.0044a533
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add ebp, 0x6c
leave
ret 8