Function at 0x402ac0
Capabilities:
Delete file
Delete registry value
Get common file path
Get file attributes
Persist via run registry key
Read .ini file
Set current directory
Set file attributes

Disassembly:
sub esp, 0x41c
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREDTXS
push 0x80000002
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edi, dword [esp + 0x438]
push 0xff
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.00404eb0
lea eax, [esp + 0x34]
push eax
call fcn.0040ac46
lea ecx, [esp + 0x38]
push str._NOLOGO
push ecx
call fcn.00404fe0
add esp, 0x18
test eax, eax
je 0x402b3a
mov byte [0x40e040], 0
lea edx, [esp + 0x28]
push str._DISK1
push edx
call fcn.00404fe0
add esp, 8
test eax, eax
mov ebx, 1
je 0x402b5b
mov byte [0x40eb41], bl
lea eax, [esp + 0x28]
push str._OSVER
push eax
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x402b94
mov al, byte [0x40e040]
test al, al
je 0x402b7f
call fcn.00401a50
call fcn.00401930
pop edi
pop esi
pop ebp
movzx eax, ax
pop ebx
add esp, 0x41c
ret 0x10
lea ecx, [esp + 0x28]
push str._UNINSTALL
push ecx
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x402c3b
call fcn.00401ef0
cmp eax, 0xf0
jge 0x402bdf
test al, 0x48
je 0x402bdf
push ebp
push str.Windows_Driver
push str.CANNOT_be_uninstalled_n::_Protected__Open
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 0x10
push str.KacerLiu
push edi
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x402c2c
push ebp
call fcn.00401fb0
add esp, 4
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
push str.ezWTools
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 0x10
lea edx, [esp + 0x28]
push str._INSTALL
push edx
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x402e3d
lea eax, [esp + 0x28]
push str._BUS
push eax
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x402c71
mov byte [0x40eb40], bl
call fcn.00402630
call fcn.00401ef0
cmp eax, 0xf0
jge 0x402e2e
test al, 0x48
je 0x402e2e
mov edi, ebx
mov esi, 0x4351484c
push ebp
push ebx
lea ecx, [esp + 0x130]
push edi
push ecx
call fcn.00402a50
mov eax, dword [esp + 0x138]
add esp, 0x10
cmp eax, esi
je 0x402cc8
inc edi
cmp edi, 0x3f
jb 0x402c95
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 0x10
mov dl, byte [esp + 0x12f]
mov eax, 8
mov cl, byte [esp + eax + 0x128]
mov bl, cl
sub bl, dl
mov dl, byte [esp + eax + 0x129]
mov byte [esp + eax + 0x128], bl
mov bl, dl
sub bl, cl
mov cl, byte [esp + eax + 0x12a]
mov byte [esp + eax + 0x129], bl
mov bl, cl
sub bl, dl
mov dl, byte [esp + eax + 0x12b]
mov byte [esp + eax + 0x12a], bl
mov bl, dl
sub bl, cl
mov cl, byte [esp + eax + 0x12c]
mov byte [esp + eax + 0x12b], bl
mov bl, cl
sub bl, dl
mov dl, byte [esp + eax + 0x12d]
mov byte [esp + eax + 0x12c], bl
mov bl, dl
sub bl, cl
mov byte [esp + eax + 0x12d], bl
add eax, 6
cmp eax, 0xc8
jb 0x402cd4
mov al, byte [esp + 0x135]
test al, 0x10
je 0x402e2e
mov cl, byte [esp + 0x12f]
and al, 0xef
mov byte [esp + 0x135], al
mov eax, 8
mov edi, edi
mov dl, byte [esp + eax + 0x128]
mov bl, byte [esp + eax + 0x129]
add dl, cl
mov cl, dl
add bl, cl
mov byte [esp + eax + 0x128], dl
mov dl, byte [esp + eax + 0x12a]
mov cl, bl
add dl, cl
mov byte [esp + eax + 0x129], bl
mov bl, byte [esp + eax + 0x12b]
mov cl, dl
add bl, cl
mov byte [esp + eax + 0x12a], dl
mov dl, byte [esp + eax + 0x12c]
mov cl, bl
add dl, cl
mov byte [esp + eax + 0x12b], bl
mov bl, byte [esp + eax + 0x12d]
mov cl, dl
add bl, cl
mov byte [esp + eax + 0x12c], dl
mov byte [esp + eax + 0x12d], bl
add eax, 6
cmp eax, 0xc8
mov cl, bl
jb 0x402d70
xor cl, cl
lea eax, [esp + 0x12a]
mov esi, 0x80
mov bl, byte [eax - 1]
mov dl, byte [eax - 2]
add dl, bl
add dl, byte [eax + 1]
add dl, byte [eax]
add cl, dl
add eax, 4
dec esi
jne 0x402df4
mov al, byte [esp + 0x12e]
push 1
sub al, cl
push 1
mov byte [esp + 0x136], al
lea eax, [esp + 0x130]
push edi
push eax
call fcn.00402a50
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 0x10
lea ecx, [esp + 0x28]
push str._COPYLANG
push ecx
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x40307c
lea edx, [esp + 0x28]
push str._COPYLANG
push edx
call fcn.00404fe0
add eax, 0xa
push 0x40
push eax
call fcn.004050b0
mov ebx, eax
add esp, 0x10
cmp ebx, ebp
je 0x4033fc
mov al, byte [ebx + 1]
inc ebx
cmp al, 0x20
jne 0x402e8e
mov al, byte [ebx + 1]
inc ebx
cmp al, 0x20
je 0x402e86
cmp byte [ebx], 0
je 0x4033fc
push 0x40
push ebx
call fcn.004050b0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4033fc
mov byte [ebp], 0
mov al, byte [ebp + 1]
inc ebp
cmp al, 0x20
jne 0x402ec0
mov al, byte [ebp + 1]
inc ebp
cmp al, 0x20
je 0x402eb8
cmp byte [ebp], 0
je 0x4033fc
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ed0
sub eax, edx
mov cl, byte [eax + ebx - 1]
cmp cl, 0x20
lea eax, [eax + ebx - 1]
jne 0x402eef
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x20
je 0x402ee6
cmp byte [eax], 0x5c
jne 0x402ef5
dec eax
push 0x5c
push ebx
mov byte [eax + 1], 0
call fcn.00405070
add esp, 8
test eax, eax
je 0x402f0b
mov byte [eax], 0
cmp byte [ebx], 0
je 0x4033fc
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402f20
sub eax, edx
mov cl, byte [eax + ebp - 1]
cmp cl, 0x20
lea eax, [eax + ebp - 1]
jne 0x402f3f
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x20
je 0x402f36
cmp byte [eax], 0x5c
jne 0x402f45
dec eax
mov byte [eax + 1], 0
cmp byte [ebp], 0
je 0x4033fc
lea edx, [esp + 0x328]
mov eax, ebx
sub edx, ebx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402f60
lea edi, [esp + 0x328]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402f72
mov ecx, 5
mov esi, str.LanguageLanguage.ini
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x328]
push eax
push 0x104
lea ecx, [esp + 0x130]
push ecx
push str.English
movsw word es:[edi], word [esi]
push str.Main
push str.Language
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [esp + 0x328]
mov eax, ebp
sub esi, ebp
mov edi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x402fc0
lea edi, [esp + 0x328]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402fd2
mov edx, dword [str.SysAdmin.ini]
mov eax, dword [0x40babc]
mov ecx, dword [0x40bac0]
mov dword [edi], edx
mov dx, word [0x40bac4]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x12c]
push ecx
push str.Main
push str.Language
mov word [edi + 0xc], dx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, ebp
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x403020
lea edi, [esp + 0x328]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403032
mov edx, dword [str._sysLanguage]
mov eax, dword [0x40baac]
mov ecx, dword [0x40bab0]
mov dword [edi], edx
mov dl, byte [0x40bab4]
mov dword [edi + 4], eax
lea eax, [esp + 0x328]
push eax
mov dword [edi + 8], ecx
push ebx
mov byte [edi + 0xc], dl
call fcn.00401000
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 0x10
lea ecx, [esp + 0x28]
push str._CLEAR
push ecx
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x40318e
call fcn.00401f90
test eax, eax
jne 0x40317f
mov eax, dword [0x40ba98]
mov cx, word [0x40ba9c]
mov edx, dword [str.rwsec.vxd]
mov word [esp + 0x24], cx
mov dword [esp + 0x20], eax
mov word [esp + 0x328], bp
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x32a]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], edx
stosw word es:[edi], ax
call fcn.00403970
lea ecx, [esp + 0x14]
call fcn.004036c0
cmp eax, 4
jne 0x403131
push 0x104
lea edx, [esp + 0x32c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [esp + 0x430]
push 0x40ba90
push 0x65
lea ecx, [esp + 0x24]
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.004038a0
movsx eax, byte [0x40eb41]
push eax
push 0x32
call fcn.00403ea0
add esp, 8
lea ecx, [esp + 0x14]
call fcn.004036c0
cmp eax, 4
jne 0x403176
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffff8
push eax
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
call fcn.00403540
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 0x10
lea ecx, [esp + 0x28]
push str._KILL
push ecx
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x403215
lea edx, [esp + 0x28]
push str._KILL
push edx
call fcn.00404fe0
mov esi, eax
mov al, byte [esi + 6]
add esi, 6
add esp, 8
cmp al, 0x20
jne 0x4031ca
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
je 0x4031c2
cmp byte [esi], 0
je 0x4033fc
lea ecx, [esp + 0x14]
call fcn.00403970
push 0x101
push esi
lea ecx, [esp + 0x1c]
call fcn.004036d0
cmp eax, 0x105
je 0x403176
cmp eax, 0x106
je 0x403176
lea ecx, [esp + 0x14]
call fcn.00403540
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x41c
ret 0x10
lea eax, [esp + 0x28]
push str._PLUGPROTECTOPEN
push eax
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x4033a8
call fcn.00401ef0
mov ebp, eax
mov al, byte [0x40e040]
test al, al
je 0x403399
lea eax, [ebp - 0x80]
cmp eax, 0x7f
ja case.0x403256.129
movzx ecx, byte [eax + 0x4034b4]
jmp dword [ecx*4 + 0x40349c]
mov eax, dword [0x40ba60]
mov ecx, dword [0x40ba64]
mov edx, dword [str.Driver_not_installed_]
mov dword [esp + 0x2c], eax
mov eax, dword [0x40ba6c]
mov dword [esp + 0x30], ecx
mov cx, word [0x40ba70]
mov dword [esp + 0x28], edx
mov edx, dword [0x40ba68]
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], cx
jmp 0x403381
mov eax, dword [0x40ba48]
mov ecx, dword [0x40ba4c]
mov edx, dword [str.Driver_version_error_]
mov dword [esp + 0x2c], eax
mov eax, dword [0x40ba54]
mov dword [esp + 0x30], ecx
mov cx, word [0x40ba58]
mov dword [esp + 0x28], edx
mov edx, dword [0x40ba50]
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], cx
jmp 0x403381
mov ecx, 7
mov esi, str.Card_found_but_not_installed_
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x403385
mov eax, dword [0x40ba10]
mov ecx, dword [0x40ba14]
mov edx, dword [str.Card_found_and_PROTECT_]
mov dword [esp + 0x2c], eax
mov eax, dword [0x40ba1c]
mov dword [esp + 0x30], ecx
mov ecx, dword [0x40ba20]
mov dword [esp + 0x28], edx
mov edx, dword [0x40ba18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
jmp 0x403381
mov eax, dword [0x40b9f8]
mov ecx, dword [0x40b9fc]
mov edx, dword [str.Card_found_and_OPEN_]
mov dword [esp + 0x2c], eax
mov eax, dword [0x40ba04]
mov dword [esp + 0x30], ecx
mov cl, byte [0x40ba08]
mov dword [esp + 0x28], edx
mov edx, dword [0x40ba00]
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], cl
jmp 0x403381
mov edx, dword [str.Card_not_found_]
mov eax, dword [0x40b9e8]
mov ecx, dword [0x40b9ec]
mov dword [esp + 0x28], edx
mov edx, dword [0x40b9f0]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
push 0
push str.Recovery_HW_SW_Status
lea eax, [esp + 0x30]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x41c
ret 0x10
lea ecx, [esp + 0x28]
push str._MASS
push ecx
call fcn.00404fe0
add esp, 8
test eax, eax
jne 0x40340b
lea edx, [esp + 0x28]
push str._EZLOCK
push edx
call fcn.00404fe0
add esp, 8
test eax, eax
jne 0x40340b
lea eax, [esp + 0x28]
push str._UNMASS
push eax
call fcn.00404fe0
add esp, 8
test eax, eax
jne 0x40340b
push ebp
push str.ezWTools
push str.http:__forum.admtop.com_n_nVersion_1.00__12_Sep_2005_nVersion_1.01__14_Sep_2005_nVersion_1.02__16_Sep_2005_n______AutoCheck_n______CopyLang__src__dst_for_ezControl_TM__nVersion_1.03__28_Sep_2005_n______Clear____Kill_Prog_nVersion_1.04__18_Oct_2005_n_______OSNUM____PlugProtectOpen__Nologo_nVersion_1.05__08_Jun_2006_n______Disk1__Bus_____POLICY____canceled_nVersion_1.06__26_Mar_2007_n_____Vista_nVersion_1.07__28_May_2007_n______Mass__ezLock__unMass_nVersion_1.08__23_Apr_2010_n_____2008__Win7_nVersion_1.08__20_Oct_2010_n_____2TB_n
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 0x10
call fcn.00401ef0
lea ecx, [esp + 0x28]
push str._UNMASS
push ecx
mov esi, eax
mov byte [esp + 0x1c], 0
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x403451
cmp esi, 0xc0
je 0x40348b
cmp esi, 0x88
je 0x40348b
call fcn.004043e0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret 0x10
lea edx, [esp + 0x28]
push str._EZLOCK
push edx
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x40346b
mov byte [esp + 0x14], bl
cmp esi, 0xc0
je 0x40348b
cmp esi, 0x88
je 0x40348b
mov eax, dword [esp + 0x14]
push 2
push ebx
push eax
call fcn.004041b0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret 0x10