Function at 0x40e070
Capabilities:
Contain obfuscated stackstrings
Delete directory
Delete file
Get common file path
Parse pe header
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43f69b
push eax
mov dword fs:[0], esp
sub esp, 0x15c
lea eax, [esp + 0x3c]
push ebx
push ebp
push esi
push edi
push eax
xor ebp, ebp
push str.IsV2CleanupNeeded
push ebp
call fcn.00413d19
cmp dword [esp + 0x4c], ebp
je 0x40f767
push ebp
push str.IsV2CleanupNeeded
push ebp
call fcn.00413e16
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTBUPDD
lea ecx, [esp + 0x54]
call fcn.00416cb2
push ebp
push 0x4540b0
push str.MainDir
lea ecx, [esp + 0x5c]
mov dword [esp + 0x180], ebp
call fcn.00416d31
push eax
lea ecx, [esp + 0x30]
push 0x80000002
push ecx
call fcn.0041781a
add esp, 0x18
lea edx, [esp + 0x68]
push 0x104
push edx
mov byte [esp + 0x17c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x68]
lea ecx, [esp + 0x58]
push eax
call fcn.00416cb2
lea ecx, [esp + 0x68]
push 0x104
push ecx
mov byte [esp + 0x17c], 2
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x68]
lea ecx, [esp + 0x60]
push edx
call fcn.00416cb2
mov bl, 3
push str._tbinstal.exe
lea ecx, [esp + 0x14]
mov byte [esp + 0x178], bl
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 4
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 5
call fcn.00416d31
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 4
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._teambrd.gid
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 6
call fcn.00416f5d
mov byte [esp + 0x174], 7
mov ecx, eax
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 6
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._teambrd.fts
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 8
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 9
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 8
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddgen.gid
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0xa
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0xb
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0xa
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddgen.fts
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0xc
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0xd
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0xc
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddfirm.gid
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0xe
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0xf
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0xe
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddfirm.fts
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x10
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x11
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x10
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbkey.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x12
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x13
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x12
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._acutil.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x14
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x15
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x14
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.psapi.dll
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x16
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x17
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x16
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.def_tbr.dat
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x18
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x19
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x18
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddgen.hlp
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x1a
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x1b
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x1a
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddgen.fr
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x1c
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x1d
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x1c
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddgen.jp
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x1e
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x1f
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x1e
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddgen.de
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x20
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x21
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x20
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddgen.chm
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x22
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x23
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x22
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._teambrd.hlp
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x24
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x25
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x24
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._teambrd.cnt
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x26
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x27
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x26
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.inetwh32.dll
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x28
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x29
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x28
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbcalib.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
mov byte [esp + 0x174], 0x2a
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x2b
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x2a
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbtest.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x2c
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x2d
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x2c
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbctpnle.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x2e
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x2f
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x2e
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.TBSeting.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x30
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x31
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x30
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push 0x44bf8c
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x32
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x33
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x32
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbsystry.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x34
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x35
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x34
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbsysalt.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x36
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x37
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x36
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbalt.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
mov byte [esp + 0x174], 0x38
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x39
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x38
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._script.dll
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x3a
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x3b
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x3a
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._acontrol.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x3c
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x3d
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x3c
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.learner.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x3e
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x3f
call fcn.00416d31
push eax
call esi
mov byte [esp + 0x174], 0x3e
lea ecx, [esp + 0x18]
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._names.dat
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x40
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x41
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x40
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.licence.txt
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x42
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x43
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x42
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._acclose.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x44
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x45
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x44
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.default.tbr
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
mov byte [esp + 0x174], 0x46
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x47
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x46
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbkycore.dll
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x48
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x49
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x48
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.draw.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x4a
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x4b
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x4a
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._roboex32.dll
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x4c
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x4d
call fcn.00416d31
push eax
call esi
mov byte [esp + 0x174], 0x4c
lea ecx, [esp + 0x18]
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.hook.dll
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x4e
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x4f
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x4e
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.zlib.dll
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x50
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x51
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x50
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbpanel.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x52
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x53
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x52
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._recorder.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
mov byte [esp + 0x174], 0x54
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x55
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x54
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.eganlicn.txt
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x56
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x57
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x56
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbhist.txt
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x58
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x59
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x58
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddfirm.hlp
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x5a
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x5b
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x5a
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddfirm.fr
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x5c
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x5d
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x5c
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddfirm.de
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x5e
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x5f
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x5e
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddfirm.jp
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x60
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x61
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x60
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str.upddfirm.chm
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
mov byte [esp + 0x178], 0x62
push edx
lea ecx, [esp + 0x28]
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x63
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x62
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbinstal.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x64
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x65
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x64
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._setup.exe
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x66
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x67
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x66
call fcn.00416d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00416d10
push str._tbkey.ini
lea ecx, [esp + 0x14]
call fcn.00416cb2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0x17c], 0x68
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x69
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x68
call fcn.00416d10
mov byte [esp + 0x174], bl
lea ecx, [esp + 0x10]
call fcn.00416d10
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2c]
push eax
call fcn.00416cf8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x174], 0x6a
call fcn.00416d31
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push eax
call edi
jmp 0x40f3ce
xor ebp, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
sub esp, 8
mov byte [esp + 0x17c], 0x6b
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x44a3cc
call fcn.00416cb2
sub esp, 8
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x188], 0x6c
call fcn.00416cf8
lea eax, [esp + 0x44]
mov byte [esp + 0x184], 0x6b
push eax
call fcn.004185a6
add esp, 0x14
lea ecx, [esp + 0x2c]
push 0x4540b0
call fcn.00416d5d
mov ecx, dword [esp + 0x38]
dec ecx
test ecx, ecx
jle 0x40f494
test ebp, ebp
je 0x40f479
push 0x44a3cc
lea ecx, [esp + 0x1c]
call fcn.00416cb2
lea edx, [esp + 0x18]
lea ecx, [esp + 0x2c]
push edx
mov byte [esp + 0x178], 0x6d
call fcn.00416e70
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x6b
call fcn.00416d10
mov eax, dword [esp + 0x34]
lea ecx, [eax + ebp*8]
push ecx
lea ecx, [esp + 0x30]
call fcn.00416e70
mov edx, dword [esp + 0x38]
inc ebp
dec edx
cmp ebp, edx
jl 0x40f440
lea ecx, [esp + 0x2c]
call fcn.00416d31
push eax
call edi
mov eax, dword [esp + 0x38]
mov byte [esp + 0x174], 0x6a
cmp eax, 1
jle 0x40f4ec
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x40f3cc
test eax, eax
je 0x40f4de
mov dword [esp + 0x28], eax
mov ecx, ebp
call fcn.00416d10
mov eax, dword [esp + 0x28]
add ebp, 8
dec eax
mov dword [esp + 0x28], eax
jne 0x40f4c5
mov ebp, dword [esp + 0x34]
push ebp
call fcn.00433020
add esp, 4
jmp 0x40f3cc
mov edi, dword [esp + 0x34]
test edi, edi
je 0x40f514
test eax, eax
je 0x40f50b
lea ebp, [eax]
mov ecx, edi
call fcn.00416d10
add edi, 8
dec ebp
jne 0x40f4fa
mov edi, dword [esp + 0x34]
push edi
call fcn.00433020
add esp, 4
push str.SYSTEMCurrentControlSetServicesTBKeyPad_System_Daemon
push 0x80000002
call fcn.004188ad
push str.SOFTWAREEgan
push 0x80000001
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesTBUPDD
push 0x80000002
call fcn.004188ad
push str..tbd
push 0x80000000
call fcn.004188ad
push str.Teamboard.Draw.Document
push 0x80000000
call fcn.004188ad
push str.TBRecordX.TBRecord
push 0x80000000
call fcn.004188ad
push str.TBRecordX.TBRecord.1
push 0x80000000
call fcn.004188ad
push str.TBRecrdX.TBRecord
push 0x80000000
call fcn.004188ad
add esp, 0x40
push str.TBRecrdX.TBRecord.1
push 0x80000000
call fcn.004188ad
push str.SOFTWAREClasses.tbd
push 0x80000002
call fcn.004188ad
push str.SOFTWAREClassesTeamboard.Draw.Document
push 0x80000002
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesEventLogSystemTBUPDDNT
push 0x80000002
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesEventLogSystemTBUPDDWD
push 0x80000002
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesEventLogSystemTBUPDD
push 0x80000002
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesEventLogApplicationTBKeyPad_System_Daemon
push 0x80000002
call fcn.004188ad
add esp, 0x38
lea ecx, [esp + 0x44]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00416cb2
push str.upddtidy
lea ecx, [esp + 0x48]
mov byte [esp + 0x178], 0x6e
call fcn.00416d31
push eax
push 0x80000002
call fcn.004187ec
push str.upddtidy
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call fcn.004187ec
push str.SYSTEMCurrentControlSetServicesTBUPDDNT
push 0x80000002
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesTBUPDD95
push 0x80000002
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesTBUPDDUM
push 0x80000002
call fcn.004188ad
push str.SYSTEMCurrentControlSetServicesTBUPDDWD
push 0x80000002
call fcn.004188ad
add esp, 0x38
lea ecx, [esp + 0x44]
push str.softwareMicrosoftWindowsCurrentVersionUninstallTBUPDD
call fcn.00416d5d
lea ecx, [esp + 0x44]
call fcn.00416d31
push eax
push 0x80000002
call fcn.004188ad
add esp, 8
lea ecx, [esp + 0x18]
push str.TBCtlPnl.cpl
call fcn.00416cb2
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x68]
mov byte [esp + 0x17c], 0x6f
call fcn.00416f5d
mov ecx, eax
mov byte [esp + 0x174], 0x70
call fcn.00416d31
push eax
call esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], 0x6f
call fcn.00416d10
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x6e
call fcn.00416d10
lea ecx, [esp + 0x44]
mov byte [esp + 0x174], 0x6a
call fcn.00416d10
lea ecx, [esp + 0x2c]
mov byte [esp + 0x174], bl
call fcn.00416d10
lea ecx, [esp + 0x60]
mov byte [esp + 0x174], 2
call fcn.00416d10
lea ecx, [esp + 0x58]
mov byte [esp + 0x174], 1
call fcn.00416d10
lea ecx, [esp + 0x20]
mov byte [esp + 0x174], 0
call fcn.00416d10
lea ecx, [esp + 0x50]
mov dword [esp + 0x174], 0xffffffff
call fcn.00416d10
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x168
ret