Function at 0x47ea90
Capabilities:
Delete file
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576cdb
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x838], 0
call fcn.0040cf00
mov ecx, eax
test ecx, ecx
je 0x47f69e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x844], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], vtable.mf_bind_t_class_CInstaller__class_CInstaller___void_.0
mov dword [ebp - 0x20], 0x47ded0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0046dfe0
add esp, 4
mov byte [ebp - 4], 0
call fcn.00472ff0
mov esi, eax
call fcn.00473000
mov ecx, eax
call fcn.004731a0
mov ecx, dword [esi]
push dword [eax]
push esi
call dword [ecx + 0x30]
push eax
push str.install_type:_d__install_version:_s
call fcn.004790f0
mov dword [ebp - 0x30], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__enum_InstallStage__int_.0
mov dword [ebp - 0x28], 0x47dee0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x47
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.0046dfe0
add esp, 0x10
mov byte [ebp - 4], 0
lea edi, [ebx + 8]
push 0
push edi
call fcn.00473000
mov ecx, eax
call fcn.004731b0
push eax
call fcn.0048b410
mov esi, dword [edi]
lea ecx, [ebp - 0x20]
add esp, 0xc
call fcn.00429ea0
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0042a480
lea ecx, [ebp - 0x20]
call fcn.0042a7e0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.00429fb0
push str.remove_all_pending_files
call fcn.004790f0
lea eax, [ebp - 0x28]
push 0xd
push eax
call fcn.00438100
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x47ebe1
mov eax, dword [eax]
push str.ldsuninst
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47ec2c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47ec22
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47f6a8
push edx
push ecx
call fcn.004b0a8e
add esp, 8
push 0x208
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x47ec8f
push str.removelds.bat
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x47ec8f
lea eax, [ebp - 0x238]
push eax
push str.Delete_temp_file:__s
call fcn.004790f0
add esp, 8
push str..tmp
push dword [edi]
call fcn.0040fed0
push dword [edi]
push str.remove_all_.tmp_files_in__s
call fcn.004790f0
add esp, 0x10
mov eax, dword [edi]
mov byte [ebp - 4], 4
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x47ecc2
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x47ecd8
call fcn.0040cf00
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x47f6ad
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x838], 1
lea esi, [eax + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x840], eax
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x83c], edi
lea edx, [edi + 7]
test edx, edx
js 0x47f6b7
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x47ed2f
push edx
lea ecx, [ebp - 0x834]
call fcn.0040b390
mov esi, dword [ebp - 0x834]
add edi, edi
push edi
push dword [ebp - 0x840]
push edi
push esi
call fcn.00480540
lea ecx, [edi + esi]
add esp, 0x10
test ecx, ecx
jne 0x47ed5b
call fcn.00533819
mov dword [eax], 0x16
call fcn.005336f3
jmp 0x47ed79
movq xmm0, qword [str.update]
movq qword [ecx], xmm0
mov eax, dword [0x59b194]
mov dword [ecx + 8], eax
mov ax, word [0x59b198]
mov word [ecx + 0xc], ax
mov eax, dword [ebp - 0x83c]
add eax, 7
cmp eax, dword [esi - 8]
jg 0x47f6b7
xor ecx, ecx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], cx
call fcn.0040f850
add esp, 4
mov dword [ebp - 0x838], 0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47edc3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 8]
mov byte [ebp - 4], 5
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x47eddc
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x47edf2
call fcn.0040cf00
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x47f6c1
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x838], 2
lea esi, [eax + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x83c], eax
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x840], edi
lea edx, [edi + 7]
test edx, edx
js 0x47f6cb
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x47ee4a
push edx
lea ecx, [ebp - 0x834]
call fcn.0040b390
mov esi, dword [ebp - 0x834]
add edi, edi
push edi
push dword [ebp - 0x83c]
push edi
push esi
call fcn.00480540
lea ecx, [edi + esi]
add esp, 0x10
test ecx, ecx
jne 0x47ee76
call fcn.00533819
mov dword [eax], 0x16
call fcn.005336f3
jmp 0x47ee94
movq xmm0, qword [str.update]
movq qword [ecx], xmm0
mov eax, dword [0x59b194]
mov dword [ecx + 8], eax
mov ax, word [0x59b198]
mov word [ecx + 0xc], ax
mov eax, dword [ebp - 0x840]
add eax, 7
cmp eax, dword [esi - 8]
jg 0x47f6b7
xor ecx, ecx
mov dword [esi - 0xc], eax
push esi
push str.Delete_directory_recursively:__s
mov word [esi + eax*2], cx
call fcn.004790f0
add esp, 8
mov dword [ebp - 0x838], 0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47eee3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 8]
mov byte [ebp - 4], 6
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x47eefc
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x47ef12
call fcn.0040cf00
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x47f6d5
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x838], 4
lea esi, [eax + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x83c], eax
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x840], edi
lea ecx, [edi + 0x15]
test ecx, ecx
js 0x47f6df
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x47ef6a
push ecx
lea ecx, [ebp - 0x834]
call fcn.0040b390
mov esi, dword [ebp - 0x834]
add edi, edi
push edi
push dword [ebp - 0x83c]
push edi
push esi
call fcn.00480540
lea eax, [edi + esi]
add esp, 0x10
test eax, eax
jne 0x47ef96
call fcn.00533819
mov dword [eax], 0x16
call fcn.005336f3
jmp 0x47efa6
push 0x2a
push str.ComputerZService.exe
push eax
call fcn.00516a90
add esp, 0xc
mov eax, dword [ebp - 0x840]
add eax, 0x15
cmp eax, dword [esi - 8]
jg 0x47f6b7
xor ecx, ecx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], cx
call fcn.004297e0
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47efe5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, ebx
call fcn.0047c5b0
mov esi, eax
and esi, 1
mov dword [ebp - 0x834], esi
jne 0x47f00b
push 0xf
push str.copy_file_fail
lea ecx, [ebp - 0x844]
call fcn.0042dd20
cmp dword [ebx + 0xb0], 0
je 0x47f026
push str.break_off_copy_files
call fcn.004790f0
add esp, 4
jmp 0x47f5f1
lea ecx, [ebx + 0x9c]
call fcn.0047a9c0
test eax, eax
jne 0x47f042
push str.down_patcher_fail
call fcn.004790f0
add esp, 4
push str.start_call_program
call fcn.004790f0
add esp, 4
cmp dword [ebx + 0x84], 0
jne 0x47f072
mov eax, dword [ebx + 8]
push dword [eax - 0xc]
push eax
call fcn.00473000
mov ecx, eax
call fcn.004731b0
mov ecx, eax
call fcn.004813d0
push dword [ebx + 8]
call fcn.0048b810
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 4
cmp dword [ebx + 0x80], 0
jne 0x47f11d
cmp dword [ebx + 0x90], 0
jne 0x47f11d
call fcn.00439090
test eax, eax
je 0x47f11d
mov ecx, ebx
call fcn.0047f900
test eax, eax
jne 0x47f0cb
push 0x11
push str.set_autorun_fail
lea ecx, [ebp - 0x844]
mov dword [ebp - 0x834], eax
call fcn.0042dd20
jmp 0x47f11d
call fcn.00472ff0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
je 0x47f11d
push 0x208
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x238]
push str.ComputerZ.set
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x238]
push eax
push 0x58e25c
push str.AutoStart2
push str.General
call edi
mov dword [ebp - 0x30], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__enum_InstallStage__int_.0
mov dword [ebp - 0x28], 0x47dee0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x61
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 7
push eax
call fcn.0046dfe0
add esp, 4
mov byte [ebp - 4], 0
call fcn.00472ff0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
neg eax
sbb esi, esi
inc esi
call fcn.00473000
mov ecx, eax
call fcn.00474830
test eax, eax
je 0x47f1de
test esi, esi
je 0x47f242
push 0x208
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00516300
add esp, 0xc
call fcn.00472ff0
push 0x104
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
push str.ComputerZ.set
lea eax, [ebp - 0x238]
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendW]
call eax
lea eax, [ebp - 0x238]
push eax
push 0x58f660
push 0x59b2cc
push str.three_end
call edi
push str.set_act.
jmp 0x47f23a
test esi, esi
jne 0x47f242
push 0x208
lea eax, [ebp - 0x238]
push esi
push eax
call fcn.00516300
add esp, 0xc
call fcn.00472ff0
push 0x104
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
push str.ComputerZ.set
lea eax, [ebp - 0x238]
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendW]
call eax
lea eax, [ebp - 0x238]
push eax
push esi
push 0x59b2cc
push str.three_end
call edi
push str.clear_act.
call fcn.004790f0
add esp, 4
mov ecx, ebx
call fcn.0047fbf0
test eax, eax
jne 0x47f263
push 0x14
push str.write_path_reg_fail
lea ecx, [ebp - 0x844]
xor esi, esi
call fcn.0042dd20
jmp 0x47f269
mov esi, dword [ebp - 0x834]
mov ecx, dword [0x5e342c]
test ecx, ecx
jne 0x47f2cd
push 0x5db188
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x5e342c], 0
jne 0x47f2bc
push 0x50
call fcn.004b1019
add esp, 4
mov dword [ebp - 0x83c], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x47f2aa
mov ecx, eax
call fcn.0042d6a0
mov ecx, eax
jmp 0x47f2ac
xor ecx, ecx
mov byte [ebp - 4], 0
xchg dword [ebp - 0x83c], eax
mov dword [0x5e342c], ecx
push 0x5db188
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x5e342c]
call fcn.0042e660
mov ecx, str.360safeadvtool
mov eax, dword [eax]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47f306
test dx, dx
je 0x47f302
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47f306
add eax, 4
add ecx, 4
test dx, dx
jne 0x47f2e0
xor eax, eax
jmp 0x47f30b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47f456
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x28]
push 0xf
push eax
call fcn.00438100
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x47f32f
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x838]
push ecx
push 4
push str.navigation
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47f385
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47f37b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47f6e9
push edx
push ecx
call fcn.004b0a8e
add esp, 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x838], 3
push 0x10
push eax
call fcn.00438100
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x47f3a5
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x838]
push ecx
push 4
push str.showtype
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47f3fb
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47f3f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47f6ee
push edx
push ecx
call fcn.004b0a8e
add esp, 8
push 0x208
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x238]
push str.ComputerZ.set
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x238]
push eax
push 0x58f660
push str.MasterHeadline
push str.General
call edi
lea eax, [ebp - 0x238]
push eax
push 0x58f660
push str.ShowMonitor
push str.General
call edi
cmp dword [ebx + 0x80], 0
je 0x47f468
cmp dword [ebx + 0x8c], 0
je 0x47f46f
mov ecx, ebx
call fcn.0047ff50
mov dword [ebp - 0x30], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__enum_InstallStage__int_.0
mov dword [ebp - 0x28], 0x47dee0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x62
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 9
push eax
call fcn.0046dfe0
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebx + 0x80], 0
jne 0x47f54f
call fcn.00473000
cmp dword [eax + 0x2bc], 0
jne 0x47f4db
call fcn.00473000
mov ecx, eax
call fcn.00474830
test eax, eax
jne 0x47f4db
mov ecx, ebx
call fcn.0047c950
push 0x800
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x830]
push 1
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x58cd40
lea eax, [ebp - 0x830]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47f548
lea eax, [ebp - 0x830]
push eax
call fcn.00410250
lea eax, [ebp - 0x830]
push eax
push str.Delete_old_start_menu_directory_:__s
call fcn.004790f0
add esp, 0xc
mov ecx, ebx
call fcn.0047bf90
push 0x208
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x238]
push str.Utils_arctrl.dll
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x238]
push eax
call fcn.004aa800
add esp, 4
test eax, eax
je 0x47f5b4
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x47f5b4
push str.SetArParm
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47f5b4
push 0
push 1
call eax
mov dword [ebp - 0x30], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__enum_InstallStage__int_.0
mov dword [ebp - 0x28], 0x47dee0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x63
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xa
push eax
call fcn.0046dfe0
add esp, 4
mov byte [ebp - 4], 0
or edi, 0xffffffff
push str.install_end.
call fcn.004790f0
add esp, 4
cmp dword [ebx + 0xb0], 0
je 0x47f612
push dword [ebx + 8]
call fcn.0040f830
add esp, 4
mov dword [ebp - 0x1c], esi
mov esi, dword [ebp - 0x844]
mov dword [ebp - 0x30], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x28], 0x47deb0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xb
push eax
call fcn.0046dfe0
add esp, 4
mov dword [ebp - 0x30], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x28], 0
add esi, 0xfffffff0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x47f67e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.0040af40
call fcn.00533703
push 0x80004005
call fcn.0040af40
push 0x80070057
call fcn.0040af40
push 0x80004005
call fcn.0040af40
push 0x80070057
call fcn.0040af40
push 0x80004005
call fcn.0040af40
push 0x80070057
call fcn.0040af40
call fcn.00533703
call fcn.00533703
int3