Function at 0x4025b0
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ef77
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x455d50]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
push str.Advanced_System_Repair_Pro_App
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x402607
mov ecx, eax
call fcn.00412020
cmp byte [0x45a377], 0
jne 0x402623
mov dword [ebp - 4], 5
call fcn.00402c60
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 7
lea eax, [ebp - 0x234]
push eax
call fcn.0040dfe0
add esp, 4
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x234]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4026ba
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x22c]
push eax
mov ebx, str._asrrealtimesrv.exe
call fcn.00403740
mov bl, 9
mov byte [ebp - 4], bl
add esp, 4
mov ecx, esp
mov dword [ebp - 0x230], esp
push ecx
mov ecx, str.tscmon
call fcn.00414080
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], bl
call fcn.004235c0
mov edx, esp
mov dword [ebp - 0x230], esp
push edx
mov ecx, str.asrrealtimesrv
call fcn.00414080
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], bl
call fcn.004235c0
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.0040c460
mov eax, dword [ebp - 0x234]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x402951
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x22c]
push edx
mov ebx, 0x448b5c
call fcn.00403740
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x228]
push eax
mov ebx, str.AdvancedSystemRepairPro.exe
call fcn.00403740
add esp, 0x10
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x22c]
call fcn.0040c460
mov ecx, dword [ebp - 0x228]
push ecx
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push SysReAllocString
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call esi
mov edx, dword [ebp - 0x228]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call esi
call fcn.00408420
test al, al
jne 0x402931
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push eax
lea ecx, [ebp - 0x222]
push ecx
call fcn.0042ace0
add esp, 0xc
push 1
push 2
lea edx, [ebp - 0x224]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x224]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402780
mov eax, dword [0x448b5c]
mov dword [edi], eax
lea edi, [ebp - 0x224]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4027a0
mov ecx, 0xd
mov esi, 0x448bc4
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 3
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00404dd0
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x238]
push edx
call fcn.00407bc0
mov bl, 0x10
mov byte [ebp - 4], bl
push 0x448dec
push 0x448dec
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
lea ecx, [ebp - 0x224]
call fcn.00414080
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.004225e0
add esp, 4
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
lea edi, [ebp - 0x238]
call fcn.0041bf00
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.00404610
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
mov ecx, str.asrtskrb.vbs
call fcn.00414080
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x244]
push ecx
mov byte [ebp - 4], bl
call fcn.00409ab0
mov byte [ebp - 4], 0x14
add esp, 4
mov edx, esp
mov dword [ebp - 0x240], esp
lea eax, [ebp - 0x244]
push eax
push edx
call fcn.0040e180
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x238]
mov edi, dword [ecx - 0xc]
lea esi, [ebp - 0x238]
call fcn.004074e0
push eax
mov byte [ebp - 4], 0x14
call fcn.0041aff0
add esp, 8
lea edx, [ebp - 0x23c]
push edx
call fcn.004178e0
mov byte [ebp - 4], 0x16
lea esi, [ebp - 0x244]
call fcn.004110a0
push eax
push str.wscript.exe___B___T:10___s_
lea edi, [ebp - 0x23c]
call fcn.0040e250
add esp, 4
mov eax, esp
mov dword [ebp - 0x240], esp
mov ecx, edi
push ecx
push eax
call fcn.0040e180
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x16
call fcn.00411760
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x14
mov ecx, edi
call fcn.0040c460
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.0040c460
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x238]
call fcn.00404610
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x22c]
call fcn.00404610
push 1
lea edx, [ebp - 0x234]
push edx
call fcn.00415ae0
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x228]
call fcn.0040c460
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x234]
call fcn.0040c460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x19
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAdvanced_System_Repair_Pro
push SysReAllocString
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call esi
push 0
xor ecx, ecx
call fcn.0040b800
add esp, 4
push 2
lea edi, [ebp - 0x228]
call fcn.00405660
add esp, 4
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x230]
push eax
mov ebx, 0x448b5c
call fcn.00403740
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x22c]
push ecx
mov ebx, 0x448bc4
call fcn.00403740
add esp, 0x10
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x230]
call fcn.0040c460
mov bl, 0x1e
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0040c460
push 1
lea edx, [ebp - 0x22c]
push edx
call fcn.00415ae0
push 1
lea eax, [ebp - 0x230]
push eax
call fcn.0040ea90
add esp, 0x10
mov byte [ebp - 4], 0x1f
mov eax, dword [eax]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0040c460
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.0040ea90
add esp, 8
mov byte [ebp - 4], 0x20
mov eax, dword [eax]
push eax
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
call fcn.0040c460
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x22c]
call fcn.0040c460
mov dword [ebp - 4], 0xffffffff
jmp 0x402a9c
mov dword [ebp - 4], 0x22
cmp byte [ebp + 8], 0
jne 0x402aae
call fcn.0040afc0
push str.SoftwareAdvancedSystemRepairPro
push SysReAllocString
call esi
push str.SoftwareAdvancedSystemRepairPro
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x24
mov dword [ebp - 4], 0xffffffff
jmp 0x402b13
mov ebx, 0x26
mov dword [ebp - 4], ebx
cmp byte [ebp + 8], 0
jne 0x402bd2
push 0x23
lea edi, [ebp - 0x228]
call fcn.00405660
add esp, 4
mov byte [ebp - 4], 0x27
mov edx, 0x448b60
call fcn.00404a50
push 1
mov edx, edi
push edx
call fcn.00415ae0
add esp, 8
push str.SOFTWAREClassesAppID_asrrealtimesrv.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesAppID233F8F82_F91E_4E49_2222_BD21AB39D1BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesAppID2245B082_41FA_478E_8DEA_86177F1394BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesCLSID233F8F82_F91E_4E49_2222_BD21AB39D1BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface23387882_DEAA_4971_2222_5D5046F2B3BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface2532D782_C4FC_4ED8_2222_D654E27AF7F8
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesInterface2F343382_EFC2_49C9_2222_FC0C403B0EBB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClassesTypeLib23311E82_B997_11CF_2222_0080C7B2D6BB
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClasses_asrrealtimesrv.Gate
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREClasses_asrrealtimesrv.Gate.1
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0040c460
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041d851
mov esp, ebp
pop ebp
ret