Function at 0x40ace4
Capabilities:
Accept command line arguments
Create process on windows
Move file
Persist via app paths registry key
Query or enumerate registry value
Set registry value
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x42a7f8
call sub.MSVCRT.dll__EH_prolog
push ecx
mov eax, 0x1064
call fcn.00428dc0
and dword [ebp - 4], 0
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ebx
call sub.MFC42u.DLL_CString::CString_4
mov esi, 0x104
lea ecx, [ebp - 0x3c]
push esi
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::GetBuffer
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x40ad6d
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax - 8]
lea esi, [eax - 1]
test esi, esi
jl 0x40ad6d
mov eax, dword [ebp - 0x3c]
push 1
push esi
lea ecx, [ebp - 0x3c]
mov di, word [eax + esi*2]
call sub.MFC42u.DLL_CString::Delete
cmp di, 0x5c
je 0x40ad6d
dec esi
jmp 0x40ad4e
lea eax, [ebp - 0x3c]
push str.WSConfig.ini
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42u.DLL_operator
mov ecx, dword [ebx + 0xc4]
push dword [eax]
add ecx, 0x684
mov byte [ebp - 4], 2
call fcn.0041f1f4
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x18]
call fcn.004015c5
mov esi, dword [ebx + 0xc4]
lea ecx, [ebp - 0x18]
add esi, 0x68c
call fcn.0040877f
mov ecx, esi
call fcn.0040180d
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
mov dword [esi], eax
call fcn.0040180d
call fcn.004083ea
call fcn.004010f9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0xd0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 0x1c], 0
mov esi, 0x4431d8
lea edi, [ebp - 0x50]
lea ecx, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
mov ebx, 0x44e058
push ecx
push eax
mov ecx, ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x20], 1
call fcn.0040a543
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, eax
test edi, edi
je 0x40bc8e
push edi
lea ecx, [ebp - 0x34]
call fcn.004015c5
cmp dword [ebp - 0x1c], 0
mov byte [ebp - 4], 3
je 0x40af3c
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push str.SiteVacuum.com
call fcn.004015c5
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.HostingSiteURL
call fcn.00408881
mov ecx, dword [0x44df84]
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0041ba11
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.004015c5
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
push eax
call fcn.00408d0f
test eax, eax
je 0x40af0c
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 7
test eax, eax
je 0x40aea9
mov ecx, dword [eax]
jmp 0x40aeab
xor ecx, ecx
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40aeb6
mov eax, dword [eax]
jmp 0x40aeb8
xor eax, eax
push ecx
push eax
lea eax, [ebp - 0x18]
push str.SwitchTo.aspx_UDSideSiteVacuumOldPublisher_sUDSideSiteVacuumNewPublisher_s
push eax
call fcn.004089bb
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ecx], eax
call fcn.0040877f
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.RunPrecondition
call fcn.00408881
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 7
mov ecx, dword [eax + 0xc4]
call fcn.0041bccc
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40af0c
call fcn.0040172d
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], 1
test ecx, ecx
je 0x40af23
call fcn.0040172d
and dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x40b785
call fcn.0040172d
and dword [ebp - 0x30], 0
jmp 0x40b785
push str.SwitchTo
lea ecx, [ebp - 0x18]
call fcn.004015c5
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x34]
push eax
mov byte [ebp - 4], 9
call fcn.00408e7c
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test eax, eax
sete byte [ebp - 0x3d]
test ecx, ecx
je 0x40af73
call fcn.0040172d
and dword [ebp - 0x18], 0
cmp byte [ebp - 0x3d], 0
je 0x40af80
mov dword [ebp - 0x1c], 1
push str.StartWithWindows
push edi
call esi
test eax, eax
jne 0x40afc1
push 1
call fcn.004083ea
push ecx
add eax, 0xb4
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00410997
mov byte [ebp - 4], 0xa
call fcn.0040be1d
push dword [eax + 0x6c]
mov byte [ebp - 4], 3
call fcn.00428495
add esp, 0xc
jmp 0x40bc48
push str.RemoveStartWithWindows
push edi
call esi
test eax, eax
jne 0x40aff1
push 1
call fcn.004083ea
push ecx
add eax, 0xb4
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00410997
call fcn.004285cf
pop ecx
pop ecx
jmp 0x40bc48
push str.RemoveFromStartMenu
push edi
call esi
test eax, eax
jne 0x40b1dc
lea eax, [ebp - 0x30]
push 2
push eax
mov byte [ebp - 4], 0xb
call fcn.0041fd11
pop ecx
pop ecx
push ecx
mov ebx, str.SiteVacuum.com
mov dword [ebp - 0x28], esp
mov ecx, esp
push ebx
mov byte [ebp - 4], 0xc
call fcn.004015c5
push ecx
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x38], esp
push str.HostingSiteURL
call fcn.00408881
mov ecx, dword [0x44df84]
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0xc
call fcn.0041ba11
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xe
call fcn.00408cba
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xc
test ecx, ecx
je 0x40b06b
call fcn.0040172d
push 0x1e
lea eax, [ebp - 0x70]
push 0
push eax
call sub.MSVCRT.dll_memset
and word [ebp - 0x484], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x482]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x30]
add esp, 0xc
test eax, eax
mov dword [ebp - 0x6c], 3
mov word [ebp - 0x60], 0x411
je 0x40b0ac
mov esi, dword [eax]
jmp 0x40b0ae
xor esi, esi
lea ecx, [ebp - 0x30]
call fcn.0040164a
push eax
lea eax, [ebp - 0x484]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea eax, [ebp - 0x484]
add esp, 0xc
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push ebx
call fcn.004015c5
push ecx
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.HostingSiteURL
call fcn.00408881
mov ecx, dword [0x44df84]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0xc
call fcn.0041ba11
push 0x443084
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x10
call fcn.004015c5
push ecx
xor esi, esi
mov eax, esp
mov dword [ebp - 0x14], esp
push esi
push eax
mov byte [ebp - 4], 0x11
call fcn.0041fd11
pop ecx
pop ecx
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x12
call fcn.00409b90
push ecx
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.00410997
mov byte [ebp - 4], 0x14
call fcn.0041ff64
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
cmp ecx, esi
je 0x40b172
call fcn.0040172d
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x10
cmp ecx, esi
je 0x40b182
call fcn.0040172d
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push esi
push eax
call fcn.0041fd11
pop ecx
pop ecx
push ecx
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
mov byte [ebp - 4], 0x15
call fcn.00410997
mov byte [ebp - 4], 0x10
call fcn.0041ff64
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
cmp ecx, esi
je 0x40b1be
call fcn.0040172d
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x30]
cmp ecx, esi
je 0x40b1ca
call fcn.0040172d
mov dword [ebp - 4], 3
jmp 0x40bc48
push str.UpdateLinksToHost
push edi
call esi
test eax, eax
jne 0x40b24d
push ecx
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x14], esp
mov ecx, esp
push str.SiteVacuum.com
call fcn.004015c5
push ecx
mov byte [ebp - 4], 0x18
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.HostingSiteURL
call fcn.00408881
mov ecx, dword [0x44df84]
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x17
call fcn.0041ba11
mov eax, dword [ebp - 0x1c]
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x14], esp
mov dword [ecx], eax
call fcn.0040877f
call fcn.0041f3aa
pop ecx
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jmp 0x40b1c3
push str.InstallFFXPCOM
push edi
call esi
test eax, eax
jne 0x40b616
push str.C:Program_FilesMozilla_Firefox
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1b
call fcn.004015c5
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x1e
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
push 0x80000002
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40b324
lea ecx, [ebp - 0x20]
call fcn.0040f258
mov edx, dword [ebp - 0x1c]
cmp eax, ebx
mov dword [ebp - 0x20], edx
jne 0x40b324
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1072]
mov word [ebp - 0x1074], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x7d0
push eax
lea eax, [ebp - 0x1074]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push str.Path
push edx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1074]
lea ecx, [ebp - 0x1c]
push eax
call fcn.004015c5
lea ecx, [ebp - 0x1c]
call fcn.0040877f
lea ecx, [ebp - 0x2c]
call fcn.0040180d
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
mov dword [ebp - 0x2c], ecx
je 0x40b324
call fcn.0040172d
jmp 0x40b324
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0x1d
je 0x40b33c
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1c
call fcn.0040f258
push str.components
lea ecx, [ebp - 0x20]
call fcn.004015c5
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 0x20
call fcn.00409b90
mov eax, dword [eax]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
call fcn.0040877f
mov ecx, dword [ebp - 0x44]
cmp ecx, ebx
je 0x40b385
call fcn.0040172d
mov dword [ebp - 0x44], ebx
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 0x22
cmp ecx, ebx
je 0x40b398
call fcn.0040172d
mov dword [ebp - 0x20], ebx
mov esi, str.SiteVacuumXPCOM.dll
lea ecx, [ebp - 0x14]
push esi
call fcn.004015c5
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x23
call fcn.004015c5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x24
call fcn.00409b90
mov eax, dword [eax]
mov byte [ebp - 4], 0x25
cmp eax, ebx
je 0x40b3d5
mov esi, dword [eax]
jmp 0x40b3d7
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc4]
add ecx, 0x68c
call fcn.00409b90
mov eax, dword [eax]
cmp eax, ebx
je 0x40b3fd
mov eax, dword [eax]
jmp 0x40b3ff
xor eax, eax
push 0xb
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
mov ecx, dword [ebp - 0x38]
mov edi, eax
cmp ecx, ebx
je 0x40b41c
call fcn.0040172d
mov dword [ebp - 0x38], ebx
mov ecx, dword [ebp - 0x28]
cmp ecx, ebx
je 0x40b42b
call fcn.0040172d
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x40b43a
call fcn.0040172d
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x22
cmp ecx, ebx
je 0x40b44a
call fcn.0040172d
cmp edi, ebx
jne 0x40b454
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, str.ISiteVacuumXPCOM.xpt
lea ecx, [ebp - 0x38]
push edi
call fcn.004015c5
push edi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x26
call fcn.004015c5
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x27
call fcn.00409b90
mov eax, dword [eax]
mov byte [ebp - 4], 0x28
cmp eax, ebx
je 0x40b491
mov edi, dword [eax]
jmp 0x40b493
xor edi, edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc4]
add ecx, 0x68c
call fcn.00409b90
mov eax, dword [eax]
cmp eax, ebx
je 0x40b4b9
mov eax, dword [eax]
jmp 0x40b4bb
xor eax, eax
push 0xb
push edi
push eax
call esi
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp ecx, ebx
je 0x40b4d2
call fcn.0040172d
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x28]
cmp ecx, ebx
je 0x40b4e1
call fcn.0040172d
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x40b4f0
call fcn.0040172d
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x38]
cmp ecx, ebx
je 0x40b4fc
call fcn.0040172d
cmp esi, ebx
jne 0x40b506
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x29
cmp eax, ebx
je 0x40b518
mov eax, dword [eax]
jmp 0x40b51a
xor eax, eax
push eax
lea eax, [ebp - 0x18]
push 0x442eb0
push eax
call fcn.004089bb
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp eax, ebx
je 0x40b537
mov eax, dword [eax]
jmp 0x40b539
xor eax, eax
push 0x442eac
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x40b5e8
push str.FFExt_
lea ecx, [ebp - 0x1c]
call fcn.004015c5
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc4]
add ecx, 0x68c
call fcn.00409b90
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
call fcn.0040877f
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x40b59a
call fcn.0040172d
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x2c
cmp ecx, ebx
je 0x40b5ad
call fcn.0040172d
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x40b5bd
call fcn.0040175a
mov esi, eax
jmp 0x40b5bf
xor esi, esi
push edi
lea ecx, [ebp - 0x20]
call fcn.0040164a
push eax
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp ecx, ebx
je 0x40b5e8
call fcn.0040172d
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x40b5f7
call fcn.0040172d
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x30]
cmp ecx, ebx
je 0x40b606
call fcn.0040172d
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebp - 0x2c]
cmp ecx, ebx
jmp 0x40b1c3
push str.CloseAll
push edi
call esi
test eax, eax
jne 0x40b6b0
xor esi, esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 0x2e
mov eax, dword [eax + 0xc4]
add eax, 0x68c
mov eax, dword [eax]
cmp eax, esi
je 0x40b647
mov eax, dword [eax]
jmp 0x40b649
xor eax, eax
push eax
lea eax, [ebp - 0x18]
push str._sUpdateHelper.exe
push eax
call fcn.004089bb
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp eax, esi
je 0x40b666
mov eax, dword [eax]
jmp 0x40b668
xor eax, eax
lea ecx, [ebp - 0x74]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__wstat]
pop ecx
cmp eax, esi
pop ecx
push esi
jne 0x40b681
push str.UpdateHelper.exe_closeall_1000
jmp 0x40b686
push str.tskill_SiteVacuumClient
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x40b6a6
call fcn.0040172d
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x34]
cmp ecx, esi
jmp 0x40bc4d
push str.UninstallApp
push edi
call esi
test eax, eax
jne 0x40b767
xor esi, esi
mov dword [ebp - 0x18], esi
push ecx
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x28], esp
mov ecx, esp
push 0x44deb4
call fcn.004015c5
mov byte [ebp - 4], 0x30
call fcn.004083ea
push ecx
add eax, 0x68
mov ecx, esp
mov dword [ebp - 0x38], esp
push eax
call fcn.00410997
mov ecx, dword [0x44df84]
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x2f
call fcn.0041ba11
mov eax, dword [eax]
mov byte [ebp - 4], 0x31
cmp eax, esi
je 0x40b712
mov eax, dword [eax]
jmp 0x40b714
xor eax, eax
push eax
lea eax, [ebp - 0x18]
push str.http:__app.SiteVacuum.com_Panel_uninstall.aspx_UDSideSiteVacuumID_s
push eax
call fcn.004089bb
mov ecx, dword [ebp - 0x14]
add esp, 0xc
cmp ecx, esi
je 0x40b732
call fcn.0040172d
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x40b73d
mov eax, dword [eax]
jmp 0x40b73f
xor eax, eax
push esi
push esi
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x40b6a6
call fcn.0040172d
mov dword [ebp - 0x18], esi
jmp 0x40b6a6
push str.LoadWithDelay
push edi
call esi
test eax, eax
jne 0x40b79e
push 0x1b58
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x40bc98
call fcn.0040172d
jmp 0x40bc98
push str.AddSearchProvider
push edi
call esi
test eax, eax
jne 0x40b9c4
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push str.odt6fyyaaog
call fcn.004015c5
push ecx
mov byte [ebp - 4], 0x32
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.SearchChannel
call fcn.00408881
mov ecx, dword [0x44df84]
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0041ba11
push str.cofFORID_3A10saSearchSV_SRCIE7SearchBoxoeutf_8ieutf_8qsearchTerms
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x33
call fcn.004015c5
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x34
push eax
lea eax, [ebp - 0x28]
push str.http:__www.sitevacuum.com_Results.aspx_cxpartner_pub_8885210189291163:
push eax
call fcn.004109b6
add esp, 0xc
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x35
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00409b90
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
call fcn.0040877f
mov ecx, dword [ebp - 0x14]
xor esi, esi
cmp ecx, esi
je 0x40b840
call fcn.0040172d
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x28]
cmp ecx, esi
je 0x40b84f
call fcn.0040172d
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x38]
cmp ecx, esi
je 0x40b85b
call fcn.0040172d
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes2A5D1C44_CD3F_4514_A15B_B0BF238447B2
push 0x80000001
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x40b8e5
mov edi, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, str.Google_Custom_Search
mov dword [ebp - 0x20], edi
push esi
call ebx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.DisplayName
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call edi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40b8c4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
jmp 0x40b8c8
and dword [ebp - 0x1c], 0
push dword [ebp - 0x1c]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x1c]
push 1
push 0
push 0x442ad0
push dword [ebp - 0x18]
call edi
jmp 0x40b8f6
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, str.Google_Custom_Search
lea ecx, [ebp - 0x14]
xor eax, eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes2A5D1C44_CD3F_4514_A15B_B0BF238447B2
push 0x80000002
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b973
cmp dword [ebp - 0x20], eax
je 0x40b92e
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
test eax, eax
mov dword [ebp - 0x20], ecx
jne 0x40b973
push esi
call ebx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.DisplayName
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40b95a
mov esi, dword [eax]
jmp 0x40b95c
xor esi, esi
push esi
call ebx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push 0x442ad0
push dword [ebp - 0x18]
call edi
mov ecx, dword [0x44df84]
push 1
call fcn.004130f2
xor esi, esi
mov dword [ebp - 4], 0x39
cmp dword [ebp - 0x20], esi
je 0x40b997
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2c]
cmp ecx, esi
je 0x40b9a6
call fcn.0040172d
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x30]
cmp ecx, esi
je 0x40b6a6
call fcn.0040172d
mov dword [ebp - 0x30], esi
jmp 0x40b6a6
push str.SetDefaultSearch
push edi
call esi
test eax, eax
jne 0x40bba4
and dword [ebp - 0x24], eax
push 0x2001f
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes
push 0x80000001
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x3d
call fcn.0040f26f
test eax, eax
jne 0x40baaa
mov ax, word [0x44deb4]
mov ecx, 0x1ff
mov word [ebp - 0x874], ax
xor eax, eax
lea edi, [ebp - 0x872]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
mov ebx, str.DefaultScope
push eax
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
mov dword [ebp - 0x28], 0x400
push dword [ebp - 0x24]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x40baaf
lea eax, [ebp - 0x874]
lea ecx, [ebp - 0x14]
push eax
call fcn.004015c5
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x40ba5f
mov esi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push esi
push 1
push 0
push str.PrevScope
push dword [ebp - 0x24]
call edi
mov esi, str.2A5D1C44_CD3F_4514_A15B_B0BF238447B2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ebx
push dword [ebp - 0x24]
call edi
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40bab4
call fcn.0040172d
jmp 0x40bab4
mov ebx, str.DefaultScope
mov esi, str.2A5D1C44_CD3F_4514_A15B_B0BF238447B2
push 0x2001f
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes
push 0x80000002
lea ecx, [ebp - 0x24]
call fcn.0040f26f
test eax, eax
jne 0x40bb7b
mov ax, word [0x44deb4]
mov ecx, 0x1ff
mov word [ebp - 0x874], ax
xor eax, eax
lea edi, [ebp - 0x872]
and dword [ebp - 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x400
push eax
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40bb7b
lea eax, [ebp - 0x874]
lea ecx, [ebp - 0x14]
push eax
call fcn.004015c5
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40bb35
mov edi, dword [eax]
jmp 0x40bb37
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.PrevScope
push dword [ebp - 0x24]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ebx
push dword [ebp - 0x24]
call edi
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40bb7b
call fcn.0040172d
cmp dword [ebp - 0x24], 0
mov dword [ebp - 4], 0x3c
je 0x40bc48
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x24], 0
jmp 0x40bc48
push str.SetDefaultHomepage
push edi
call esi
test eax, eax
jne 0x40bc63
and dword [ebp - 0x24], eax
mov edi, 0x2001f
mov ebx, str.SOFTWAREMicrosoftInternet_ExplorerMain
push edi
push ebx
push 0x80000001
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x40
call fcn.0040f26f
test eax, eax
mov esi, str.http:__www.sitevacuum.com_Results.aspx
jne 0x40bbfc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.Start_Page
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push ebx
push 0x80000002
lea ecx, [ebp - 0x24]
call fcn.0040f26f
test eax, eax
jne 0x40bc2e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.Start_Page
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x24], 0
mov dword [ebp - 4], 0x3f
je 0x40bc48
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x40bdad
call fcn.0040172d
jmp 0x40bdad
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
push edi
call fcn.0040a543
mov ecx, dword [ebp - 0x34]
mov edi, eax
test ecx, ecx
mov byte [ebp - 4], 1
je 0x40ae23
call fcn.0040172d
and dword [ebp - 0x34], 0
jmp 0x40ae23
cmp dword [ebp - 0x20], 0
je 0x40bdad
mov esi, dword [ebp - 0x24]
push 0x80
lea ecx, [esi + 0xc8]
call fcn.00421414
xor edi, edi
cmp eax, edi
jne 0x40bda8
mov dword [ebp - 0x1c], edi
mov eax, dword [esi + 0xc4]
mov byte [ebp - 4], 0x42
add eax, 0x68c
mov eax, dword [eax]
cmp eax, edi
je 0x40bcd1
mov eax, dword [eax]
jmp 0x40bcd3
xor eax, eax
push eax
lea eax, [ebp - 0x1c]
push str._sUpdateHelper.exe
push eax
call fcn.004089bb
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, edi
je 0x40bcf0
mov eax, dword [eax]
jmp 0x40bcf2
xor eax, eax
lea ecx, [ebp - 0x74]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__wstat]
pop ecx
cmp eax, edi
pop ecx
jne 0x40bd14
push edi
push str.UpdateHelper.exe_restart_1000
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x40bd99
push str..SiteVacuum_Application_more_than_once
lea ecx, [ebp - 0x38]
call fcn.004015c5
mov byte [ebp - 4], 0x43
call fcn.004083ea
add eax, 0x178
push eax
lea eax, [ebp - 0x28]
push str.Cannot_start
push eax
call fcn.004109b6
add esp, 0xc
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x44
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00409b90
mov eax, dword [eax]
cmp eax, edi
je 0x40bd5e
mov eax, dword [eax]
jmp 0x40bd60
xor eax, eax
push 0x10
push eax
push str.The_application_is_already_running
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x40bd7e
call fcn.0040172d
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x28]
cmp ecx, edi
je 0x40bd8d
call fcn.0040172d
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x38]
cmp ecx, edi
je 0x40bd99
call fcn.0040172d
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edi
cmp ecx, edi
je 0x40bdad
call fcn.0040172d
cmp dword [ebp - 0x20], edi
jne 0x40bdca
and byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
and byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString
push 1
pop eax
jmp 0x40bdbb