Function at 0x485eb0
Capabilities:
Accept command line arguments
Copy file
Delete file
Move file
Persist via lnk shortcut
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f0e05
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x9c]
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
movq qword [ebp - 0x9c], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x68]
movq qword [ebp - 0x68], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 3
xor esi, esi
mov ecx, ebx
mov dword [ebp - 0x7c], esi
call fcn.005dc3a0
test eax, eax
je 0x485f82
lea eax, [ebp - 0x7c]
mov ecx, ebx
push eax
call fcn.005dc190
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, dword [ebp - 0x7c]
mov ebx, eax
mov dword [ebp - 0x3b8], eax
jmp 0x485f8a
xor ebx, ebx
mov dword [ebp - 0x3b8], ebx
mov dword [ebp - 0x3a8], ebx
mov byte [ebp - 4], 4
cmp esi, 3
jl 0x4872ac
test ebx, ebx
je 0x4872b7
push str._RemoveApp
push 1
push dword [ebx]
lea ecx, [ebp - 0x9c]
call fcn.005dc260
mov ecx, eax
call fcn.005dc480
test al, al
je 0x485ff8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x9c]
call fcn.005dc430
mov eax, 2
jmp 0x4872df
push 1
push dword [ebx + 4]
lea ecx, [ebp - 0x30]
call fcn.005dc260
mov ecx, eax
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x48604b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x9c]
call fcn.005dc430
mov eax, 3
jmp 0x4872df
push 6
push 1
push 1
push 1
push str._flag
push 1
push dword [ebx + 8]
lea ecx, [ebp - 0x68]
call fcn.005dc260
mov ecx, eax
call fcn.005daa70
test eax, eax
jne 0x4860a4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x9c]
call fcn.005dc430
mov eax, 4
jmp 0x4872df
push 0
push 0x20019
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6a80
lea esi, [edi + 0x143c]
mov byte [ebp - 4], 5
push esi
push str.AppName
lea ecx, [ebp - 0x18]
call fcn.005d6740
test al, al
je 0x4860e6
mov ecx, esi
call fcn.005dbeb0
test al, al
je 0x4860f2
push 0x69a744
mov ecx, esi
call fcn.005dc510
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0
push eax
push str.ValidKey
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x40], 0
call fcn.005d66b0
mov eax, dword [ebp - 0x80]
mov dword [edi + 0x13dc], eax
test al, 2
je 0x48614b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c9ea4
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [edi + 0x146c]
call fcn.005dc200
lea eax, [edi + 0x1f74]
push eax
push str.AutoCloudSync
lea ecx, [ebp - 0x18]
call fcn.005d66b0
lea eax, [ebp - 0x84]
push eax
push str.CloudSyncAsked
lea ecx, [ebp - 0x18]
call fcn.005d66b0
lea eax, [ebp - 0x40]
push eax
push str.ConfigureImmunization
lea ecx, [ebp - 0x18]
call fcn.005d66b0
lea ecx, [edi + 0x70]
call fcn.005d3930
push 6
lea ecx, [ebp - 0x68]
mov dword [edi + 0x74], eax
call fcn.005dad50
mov ecx, eax
call fcn.005dafe0
xorps xmm0, xmm0
mov dword [ebp - 0x3b0], eax
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x50], 0
movq qword [ebp - 0xb4], xmm0
mov dword [ebp - 0xac], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0xa8]
movq qword [ebp - 0xa8], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 7
push eax
push str.HomepageDesktopShortcut
lea ecx, [ebp - 0x18]
call fcn.005d66b0
cmp dword [ebp - 0x50], 0
je 0x486260
test byte [edi + 0x13dc], 2
je 0x486260
lea eax, [ebp - 0xb4]
push eax
push str.HomepageDSURL
lea ecx, [ebp - 0x18]
call fcn.005d6740
lea eax, [ebp - 0xa8]
push eax
push str.HomepageDSName
lea ecx, [ebp - 0x18]
call fcn.005d6740
lea ecx, [ebp - 0xb4]
call fcn.005dc3a0
cmp eax, 6
jl 0x486259
lea ecx, [ebp - 0xa8]
call fcn.005dc3a0
cmp eax, 3
jge 0x486260
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x3b0]
mov dword [edi + 0x1f68], 0
test al, 0x10
je 0x486280
mov dword [edi + 0x1f68], 3
jmp 0x4862eb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x635758
mov ecx, esi
call fcn.005dc190
push eax
push str.Uninstalling
lea ecx, [ebp - 0x24]
call fcn.005dc200
sub esp, 8
lea ecx, [ebp - 0x24]
push 0x46
push 0x1c2
push 0
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043da60
push 0
push 1
mov ecx, edi
call fcn.0043d720
lea ecx, [edi + 0x14f0]
call fcn.005b6bd0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x3b0]
shr eax, 4
mov ecx, edi
not al
and al, 1
movzx eax, al
push eax
call fcn.0043e8f0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x150]
call fcn.005dc4e0
xorps xmm0, xmm0
mov dword [ebp - 0x88], 0
lea ecx, [ebp - 0x90]
movq qword [ebp - 0x90], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x4c]
movq qword [ebp - 0x4c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
push ecx
push 0x20019
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers0Paths
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
mov byte [ebp - 0x3a9], 0
call fcn.005d6a30
test al, al
je 0x486390
lea ecx, [ebp - 0x18]
call fcn.005d6280
mov byte [ebp - 0x3aa], 1
cmp eax, 2
ja 0x486397
mov byte [ebp - 0x3aa], 0
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4863a3
cmp eax, 1
jne 0x486400
lea eax, [ebp - 0x90]
push eax
push str.Immunized
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea ecx, [ebp - 0x18]
call fcn.005d65d0
lea eax, [ebp - 0xb8]
push eax
push str.DefaultAppsProtected
lea ecx, [ebp - 0x18]
call fcn.005d66b0
lea ecx, [ebp - 0x90]
call fcn.005dc3a0
cmp eax, 1
jg 0x4863f9
cmp byte [ebp - 0x3aa], 0
jne 0x4863f9
cmp dword [ebp - 0xb8], 0
mov byte [ebp - 0x3a9], 0
je 0x486400
mov byte [ebp - 0x3a9], 1
sub esp, 0xc
lea ecx, [ebp - 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
call fcn.005dc190
push eax
push 1
lea ecx, [edi + 0x1184]
call fcn.005dbf40
mov ecx, eax
call fcn.005da510
push 0
push 1
mov ecx, edi
call fcn.0043d720
cmp byte [ebp - 0x3a9], 0
je 0x4865f7
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6cc408
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
push 3
push 0
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64cd74
lea ecx, [edi + 0x15c]
mov dword [edi + 4], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6cc420
lea ecx, [ebp - 0x3c]
call fcn.005da780
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [edi + 0x1184]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Immunizationexecprevico.png
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push dword [edi + 4]
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
push ecx
push 0x77
call fcn.005b8900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Immunizationimmunizeico.png
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
push dword [edi + 4]
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
push ecx
push 0x7f
call fcn.005b8900
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Immunizationimmunize.ico
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
movaps xmm0, xmmword [0x6edd70]
lea eax, [ebp - 0x78]
push ecx
push eax
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x78], xmm0
call fcn.005dc190
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058c760
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 1
mov ecx, edi
call fcn.0043d720
push 0
push 0xa
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
cmp dword [ebp - 0x50], 0
je 0x4867bc
lea ecx, [ebp - 0xa8]
call fcn.005d9bd0
mov ecx, eax
call fcn.005dc3a0
cmp eax, 4
jle 0x4867bc
sub esp, 8
mov dword [ebp - 0x54], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0xa8]
movq qword [ebp - 0x5c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push str..url
call fcn.005dc190
push eax
push 0x624284
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc520
push 0x38
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 0xb
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xf4]
call fcn.005dd680
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c9ea4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c9ea4
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push 0
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x48679a
push 0x65fd7c
push str.InternetShortcut
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xb4]
call fcn.005db130
push str.IconFile
push str.InternetShortcut
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x3c]
call fcn.005db130
push 0x62796c
push str.IconIndex
push str.InternetShortcut
lea ecx, [ebp - 0xf4]
call fcn.005dd0c0
push ecx
push 0
push 0
lea ecx, [ebp - 0xf4]
call fcn.005dca80
push 0
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
push 5
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
push 1
mov ecx, edi
call fcn.0043d720
lea ecx, [ebp - 0xf4]
call fcn.005dd5d0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xa
call fcn.005dc430
mov ecx, 0x69a744
call fcn.005cf0f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c9ea4
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
mov ecx, 0x69a744
call fcn.005cf230
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c9ea4
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc200
push 0
push 0x14
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
mov dword [ebp - 0x144], str.bluescreenview
lea ebx, [ebp - 0x144]
mov dword [ebp - 0x140], str.cleanup_tool
xor esi, esi
mov dword [ebp - 0x13c], str.Logs
mov dword [ebp - 0x138], str.Third_party
mov dword [ebp - 0x134], str.2Browse.exe
mov dword [ebp - 0x130], 0x6cc578
mov dword [ebp - 0x12c], str.AutoItRun.exe
mov dword [ebp - 0x128], str.AutoItRun64.exe
mov dword [ebp - str.3___v], str.BrandIco.ico
mov dword [ebp - 0x120], 0x6cc5e0
mov dword [ebp - 0x11c], 0x6cc604
mov dword [ebp - 0x118], str.key.uvkey
mov dword [ebp - 0x114], str.la_logo.png
mov dword [ebp - 0x110], str.License.htm
mov dword [ebp - 0x10c], str.Log_analyzer.exe
mov dword [ebp - 0x108], str.logo.jpg
mov dword [ebp - 0x104], str.logo.bmp
mov dword [ebp - 0x100], 0x6cc6ac
mov dword [ebp - 0xfc], str.logo.gif
mov dword [ebp - 0xf8], str.PortableZip.ini
mov dword [ebp - 0xf4], str.RebootExec.exe
mov dword [ebp - 0xf0], str.RebootExecx64.exe
mov dword [ebp - 0xec], str.SystemInfo.ini
mov dword [ebp - 0xe8], str.urls
mov dword [ebp - 0xe4], 0x6cc764
mov dword [ebp - 0xe0], str.UVK_en.exe
mov dword [ebp - 0xdc], str.UVK_en64.exe
mov dword [ebp - 0xd8], str.uvkres.dll
mov dword [ebp - 0xd4], str.UVK.dll
mov dword [ebp - 0xd0], 0x6cc764
mov dword [ebp - 0xcc], 0x699c38
mov dword [ebp - 0xc8], str.Icons
mov dword [ebp - 0xc4], str.UVKSettings.ini
mov dword [ebp - 0xc0], 0x635b78
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
lea ecx, [ebp - 0x30]
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
lea ecx, [ebp - 0x24]
test eax, eax
je 0x4869ee
call fcn.005dc190
mov ecx, eax
call fcn.005cc160
jmp 0x4869fa
call fcn.005dc190
mov ecx, eax
call fcn.005cc690
push 3
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
call fcn.005771e0
mov eax, 0x8d3dcb09
lea ecx, [edi + 0x14f0]
imul esi
push 0
add edx, esi
sar edx, 4
mov eax, edx
add edx, 0x14
shr eax, 0x1f
add eax, edx
push eax
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
add esi, 0x3c
add ebx, 4
cmp esi, 0x7f8
jb 0x4869a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
push 0x260
lea eax, [ebp - 0x3a4]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x3a4]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x3a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [ebp - 0x3b8]
mov dword [ebp - 0x154], eax
cmp eax, 0xffffffff
je 0x486ae5
lea ecx, [ebp - 0x3a4]
mov dword [ebp - 0x150], 0
call fcn.004011a0
mov eax, dword [ebp - 0x154]
cmp eax, 0xffffffff
mov byte [ebp - 4], 0xd
sete cl
mov byte [ebp - 0x3b1], cl
je 0x486b04
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov cl, byte [ebp - 0x3b1]
test cl, cl
mov dword [ebp - 0x154], 0xffffffff
lea ecx, [ebp - 0x30]
je 0x486b24
push 3
call fcn.005dc190
push eax
call fcn.005771e0
jmp 0x486b85
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
push 1
movq qword [ebp - 0x74], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc570
push 0
push 1
push 1
push 0
push 0x6cc7f0
push 0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xe
call fcn.005dbf40
mov ecx, eax
call fcn.005daa70
test eax, eax
je 0x486b79
push 3
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
call fcn.005771e0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xd
call fcn.005dc430
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.004730d0
push 0
push 0x55
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
lea ecx, [edi + 0x143c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.00472d40
call fcn.0046ed50
push 0
push 0x5a
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
push str.HKCUSoftwareUVK___Ultra_virus_killer
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKLM64SOFTWARECarifredVirusTotal_reports
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCR.uvk
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCRUVKCommandsFile
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCR.uvksr
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCRSrSettingsFile
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCR.uvkey
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCRUVKLicenseKey
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCRUVKCommandsScript
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCR.uvkbk
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKCRBackupInfoFile
lea ecx, [ebp - 0x18]
call fcn.005d5740
push 0
push 0x5f
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 0
push 1
mov ecx, edi
call fcn.0043d720
push str.MBinder
push str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
lea ecx, [ebp - 0x18]
call fcn.005d5da0
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallUVK
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionApp_PathsUVK_en.exe
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp_PathsUVK_en.exe
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.Desktop_Watermark
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x18]
call fcn.005d55d0
push str.HKCR_shellFile_information
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.Uninstall_complete.
push 0x64
lea ecx, [edi + 0x14f0]
call fcn.005b66e0
push 1
push 0x64
lea ecx, [edi + 0x1290]
call fcn.00546ef0
push 0
push 1
mov ecx, edi
call fcn.0043d720
push 2
lea ecx, [edi + 0x14f0]
call fcn.005b6250
push 0
push 1
mov ecx, edi
call fcn.0043d720
test dword [ebp - 0x3b0], 0x18
jne 0x486db0
sub esp, 8
lea ecx, [edi + 0x143c]
push 0xbe
push 0x1c2
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__un_immunize_all_areas_and_remove_all_Execute_prevent_applied_paths._r_n_r_nNormally_you_only_do_this_if_you_plan_to_never_use_this_application_in_this_computer_again.
call fcn.005dc190
push eax
push str.This_will_delete_all_the_backups_created_by
push str.Do_you_want_to_perform_a_clean_uninstall__r_n_r_n
lea ecx, [ebp - 0x24]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
cmp eax, 1
jne 0x486db0
or dword [ebp - 0x3b0], 8
sub esp, 8
mov dword [ebp - 0x6c], 0
xorps xmm0, xmm0
movq qword [ebp - 0x74], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Configure_immunization.lnk
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057baa0
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc520
sub esp, 8
mov byte [ebp - 4], 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
movq qword [ebp - 0x5c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Configure_immunization.lnk
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057bd60
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc520
push 2
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x10
call fcn.005dc190
push eax
call fcn.005771e0
push 2
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
call fcn.005771e0
test byte [ebp - 0x3b0], 8
je 0x486f24
lea ecx, [ebp - 0x90]
call fcn.005dc3a0
cmp eax, 1
jle 0x486e7f
push 1
push 0x62794c
lea ecx, [edi + 0x1290]
call fcn.0055e210
call fcn.004af0e0
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backups
lea ecx, [ebp - 0x18]
call fcn.005d5740
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x18]
call fcn.005d5740
push 2
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
call fcn.005771e0
cmp byte [edi + 0x11], 0
mov ecx, str.UVK_en.exe
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, str.UVK_en64.exe
cmove eax, ecx
lea ecx, [ebp - 0x30]
push eax
push 0x624284
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, eax
call fcn.005cf230
lea ecx, [edi + 0x143c]
call fcn.005dc190
mov ecx, eax
call fcn.005cf0f0
mov ecx, edi
call fcn.0043e560
push str.Ultra_Virus_Killer_Auto_Cleanup
mov ecx, edi
call fcn.0043bcf0
jmp 0x487170
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x18]
call fcn.005d5740
lea ecx, [ebp - 0x90]
call fcn.005dc3a0
cmp eax, 1
jle 0x486f72
push ecx
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_KillerImmunization
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
je 0x486f72
push 0
lea ecx, [ebp - 0x90]
call fcn.005dc190
push eax
push 1
push str.Immunized
lea ecx, [ebp - 0x18]
call fcn.005d5f20
mov eax, dword [ebp - 0x40]
cmp eax, 1
jne 0x486f7f
lea eax, [ebp - 0x5c]
jmp 0x486f86
test eax, eax
jne 0x486f92
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x4c]
call fcn.005dc4e0
mov eax, dword [ebp - 0x40]
cmp byte [ebp - 0x3a9], 0
je 0x4870ce
cmp eax, 2
je 0x4870ce
push 0x4c
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x4c]
push 0x1000
call fcn.005dc190
push eax
lea ecx, [ebp - 0x10c]
call fcn.005e9480
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ImmunizationRebootExec.exe
lea ecx, [edi + 0x15c]
mov byte [ebp - 4], 0x11
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x10c]
call fcn.005e92b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Immunizationimmunize.ico
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
push ecx
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x10c]
call fcn.005e91f0
push str.__ImmunizeConfig
lea ecx, [ebp - 0x10c]
call fcn.005e9250
push str.Enable_or_disable_the_System_Immunization_and_Execute_Prevent
lea ecx, [ebp - 0x10c]
call fcn.005e9220
push 0
lea ecx, [ebp - 0x24]
call fcn.005dbed0
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x10c]
call fcn.005e91a0
lea ecx, [ebp - 0x10c]
call fcn.005e9140
test al, al
je 0x4870bf
push 0
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
push 5
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x10
call fcn.005e9080
cmp byte [ebp - 0x3aa], 0
je 0x487127
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Immunization
lea ecx, [edi + 0x15c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
call fcn.004aef20
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backupsExecute_Prevent
lea ecx, [ebp - 0x18]
call fcn.005d5740
push 7
call fcn.005536d0
push ecx
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backups
lea ecx, [ebp - 0x18]
call fcn.005d6a30
push 0
lea eax, [edi + 0x1f74]
push eax
push 4
push str.AutoCloudSync
lea ecx, [ebp - 0x18]
call fcn.005d5f20
cmp dword [ebp - 0x84], 0
je 0x487170
push 0
lea eax, [ebp - 0x84]
push eax
push 4
push str.CloudSyncAsked
lea ecx, [ebp - 0x18]
call fcn.005d5f20
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 0x3b0]
test al, 0x10
jne 0x4871e0
sub esp, 8
lea ecx, [edi + 0x143c]
push 0xaa
push 0x1c2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._was_successfully_uninstalled.
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
mov eax, dword [ebp - 0x3b0]
mov byte [edi + 0x1f80], 0
test al, 3
je 0x487207
push 4
push 0
lea ecx, [edi + 0x1478]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x3b0]
test al, 1
je 0x487211
push 0
push 1
jmp 0x48721d
test al, 2
je 0x4872fd
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x74]
call fcn.005dc430
mov eax, dword [ebp - 0x154]
cmp eax, 0xffffffff
je 0x487245
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x4c]
call fcn.005dc430
lea ecx, [ebp - 0x90]
call fcn.005dc430
lea ecx, [ebp - 0xa8]
call fcn.005dc430
lea ecx, [ebp - 0xb4]
call fcn.005dc430
lea ecx, [ebp - 0x18]
call fcn.005d69e0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x9c]
call fcn.005dc430
xor eax, eax
jmp 0x4872df
test ebx, ebx
je 0x4872b7
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x24]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x9c]
call fcn.005dc430
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
push ecx
lea ecx, [edi + 0x1478]
call fcn.005dc190
mov ecx, eax
call fcn.005e2d70
int3