Function at 0x413c20
Capabilities:
Copy file
Delete file
Delete registry key
Get common file path
Persist via lnk shortcut
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8d26
mov eax, dword fs:[0]
push eax
sub esp, 0x708
mov eax, dword [0x50c4d8]
xor eax, esp
mov dword [esp + 0x700], eax
push ebx
push esi
push edi
mov eax, dword [0x50c4d8]
xor eax, esp
push eax
lea eax, [esp + 0x718]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 0
lea ecx, [esp + 0x54]
push 0x11
xor eax, eax
mov dword [esp + 0x6c], 7
push str._F__IM_adb.exe__T
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
mov byte [esp + 0x720], 1
lea ecx, [esp + 0x6c]
push 8
xor eax, eax
mov dword [esp + 0x84], 7
push str.taskkill
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 2
lea eax, [esp + 0x4c]
lea edx, [esp + 0x64]
lea ecx, [esp + 0x7c]
push eax
call fcn.0040fe50
add esp, 0x14
cmp dword [esp + 0x80], 8
jb 0x413d25
push dword [esp + 0x6c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x80], 7
cmp dword [esp + 0x68], 8
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x413d52
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x413d87
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 3
lea ecx, [esp + 0x6c]
push 0xf
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_aapt.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 4
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 5
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe50
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x413e47
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x413e74
push dword [esp + 0x6c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x413eac
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 6
lea ecx, [esp + 0x6c]
push 0x13
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_ldrecord.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 7
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 8
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe50
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x413f6c
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x413f99
push dword [esp + 0x6c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x413fd1
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 9
lea ecx, [esp + 0x6c]
push 0x11
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_dndscd.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 0xa
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 0xb
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe50
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x414091
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x4140be
push dword [esp + 0x6c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x4140f6
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 0xc
lea ecx, [esp + 0x6c]
push 0x11
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_fynews.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 0xd
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 0xe
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe50
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x4141b6
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x4141e3
push dword [esp + 0x6c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x41421b
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 0xf
lea ecx, [esp + 0x6c]
push 0x11
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_ldnews.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 0x10
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 0x11
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe50
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x4142db
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x414308
push dword [esp + 0x6c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x414340
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
call fcn.00415930
lea edi, [esi + 0x78]
push str.dnuninst.exe
mov edx, edi
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
mov ebx, eax
mov dword [esp + 0x720], 0x12
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x41438d
mov edx, dword [0x515154]
mov eax, dword [ecx]
add edx, 0x14
push 0xc8
push edx
push ebx
mov dword [0x515154], edx
call dword [eax + 0xc]
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x4143ab
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x14], 8
jb 0x4143c0
mov eax, dword [edi]
jmp 0x4143c2
mov eax, edi
push eax
push str.uninst_begin_delete_files__directory_is__s
push 0x30
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0x10
cmp dword [esi + 0x88], 0
jne 0x4143f9
push str.clean_bug_install_path_is_empty___
push 0x33
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0xc
jmp 0x415329
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00416ce0
mov ecx, 0x516050
call fcn.0043bbd0
push 0x4e9f58
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp dword [0x516048], 0
mov dword [esi + 0xd0], eax
jne 0x41443b
push 1
call fcn.00491db2
add esp, 4
mov dword [0x516048], eax
call fcn.00412670
lea eax, [esp + 0x3c]
mov ecx, 0x5160e0
push eax
call fcn.00416940
lea ecx, [esi + 0x58]
mov dword [esp + 0x720], 0x13
cmp ecx, eax
je 0x41446b
push 0xffffffffffffffff
push 0
push eax
call fcn.00407870
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x414489
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
lea eax, [esp + 0x3c]
mov ecx, 0x5160e0
push eax
call fcn.00416940
mov dword [esp + 0x720], 0x14
cmp dword [eax + 0x14], 8
jb 0x4144ab
mov eax, dword [eax]
push eax
push str.openIdopenIdopenIdopenIdopenId__s
push 0x3c
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0x10
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x4144de
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
lea eax, [esp + 0x2c]
push eax
push str.SoftwareXuanZhiLDPlayer9
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4145cf
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 8
push eax
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x30]
movlpd qword [esp + 0x24], xmm0
push eax
push 0
push str.installTime
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [esp + 0x24]
push dword [esp + 0x24]
push str.install_time___d_ret___d
push 0x48
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0x18
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x34]
push eax
call fcn.00498433
mov ecx, dword [esp + 0x38]
add esp, 4
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
sbb eax, dword [esp + 0x20]
test eax, eax
jg 0x4145cf
jl 0x41457e
cmp ecx, 0x5265c00
jae 0x4145cf
push str.uninstall_not_one_day
push 0x50
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
sub esp, 0xc
mov ecx, 0x5160e0
mov eax, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00416940
sub esp, 0x18
mov dword [esp + 0x750], 0x15
mov ecx, esp
push str.uinstallplayer
call fcn.00407230
mov ecx, esi
mov dword [esp + 0x750], 0xffffffff
call fcn.0040ae00
xor eax, eax
push 0x208
push eax
mov word [esp + 0x104], ax
lea eax, [esp + 0x106]
push eax
call fcn.0049a790
add esp, 0xc
lea eax, [esp + 0xfc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0xd0]
call fcn.00407230
push 3
push 0x4ee400
lea ecx, [esp + 0xd4]
mov dword [esp + 0x728], 0x16
call fcn.00410c40
lea eax, [esp + 0xcc]
push eax
call fcn.00424b00
add esp, 4
test al, al
jne 0x414658
lea eax, [esp + 0xcc]
push eax
call fcn.00424b20
add esp, 4
push 0x4ee408
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
mov byte [esp + 0x720], 0x17
cmp dword [eax + 0x14], 8
jb 0x414680
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x58]
call fcn.00407230
cmp dword [esp + 0x68], 8
lea eax, [esp + 0x54]
cmovae eax, dword [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x68], 8
jb 0x4146b2
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x50], 8
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x4146e4
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
push 0x4ee408
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411240
add esp, 4
mov ebx, eax
push str.lduninst_del.exe
mov edx, edi
mov byte [esp + 0x724], 0x18
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x414721
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x414729
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x414746
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x414778
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
push 0x4ee450
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411240
add esp, 4
mov ebx, eax
push str.msvcr120.dll
mov edx, edi
mov byte [esp + 0x724], 0x19
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x4147b5
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x4147bd
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x4147da
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x41480c
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
push 0x4ee488
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411240
add esp, 4
mov ebx, eax
push str.msvcp120.dll
mov edx, edi
mov byte [esp + 0x724], 0x1a
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x414849
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x414851
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x41486e
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x4148a0
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
push 0x4ee4c0
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411240
add esp, 4
mov ebx, eax
push str.msvcp120d.dll
mov edx, edi
mov byte [esp + 0x724], 0x1b
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x4148dd
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x4148e5
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x414902
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x414934
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
push 0x4ee4fc
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411240
add esp, 4
mov ebx, eax
push str.msvcr120d.dll
mov edx, edi
mov byte [esp + 0x724], 0x1c
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x414971
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x414979
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x414996
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x4149c8
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
lea eax, [esp + 0xe4]
push eax
call fcn.00424e20
add esp, 4
push str.datadata.ini
lea ecx, [esp + 0xe8]
mov byte [esp + 0x724], 0x1d
call fcn.00410610
push 0x3ff
lea eax, [esp + 0x311]
mov byte [esp + 0x310], 0
push 0
push eax
call fcn.0049a790
add esp, 0xc
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004226a0
add esp, 8
cmp dword [eax + 0x14], 0x10
jb 0x414a2d
mov eax, dword [eax]
push eax
push 0x400
lea eax, [esp + 0x314]
push eax
push 0x4ed9f6
push str.shortcut
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [esp + 0x50], 0x10
jb 0x414a63
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
lea eax, [esp + 0x30c]
push eax
lea ecx, [esp + 0x40]
call fcn.0040d780
push eax
lea eax, [esp + 0x88]
mov byte [esp + 0x724], 0x1e
push eax
call fcn.00422660
add esp, 8
mov byte [esp + 0x720], 0x20
cmp dword [esp + 0x50], 0x10
jb 0x414aa8
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
cmp dword [esp + 0x98], 8
lea eax, [esp + 0x84]
mov dword [esp + 0x50], 0xf
cmovae eax, dword [esp + 0x84]
push eax
push str.shortcut_name_is__s
push 0x6c
push str.SimulatorFileCleaner::_runCleaning
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.004204c0
cmp dword [esp + 0x108], 8
lea eax, [esp + 0xf4]
cmovae eax, dword [esp + 0xf4]
push eax
push str.path_:__s
push 0x6d
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0x20
cmp dword [esp + 0x94], 0
jbe 0x414bc8
push str..lnk
lea ecx, [esp + 0x88]
call fcn.00410610
cmp dword [esp + 0x98], 8
lea eax, [esp + 0x84]
cmovae eax, dword [esp + 0x84]
push eax
push str.delete_shortcut__s
push 0x70
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
sub esp, 8
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4e9c80
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x750], 0x21
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x4e9c80
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x768], 0x22
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0xd4]
push eax
call fcn.00407870
mov byte [esp + 0x768], 0x20
call fcn.00440c90
add esp, 0x48
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414bf1
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esi + 0xa8]
push eax
call dword [edx + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x190
call ebx
mov ecx, esi
call fcn.00415590
mov ecx, esi
call fcn.00415720
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414c2f
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
push edi
mov dword [0x515154], eax
call dword [edx + 0xc]
push 0x190
call ebx
mov ecx, esi
call fcn.00415350
lea ecx, [esp + 0xb4]
call fcn.0040ef90
mov byte [esp + 0x720], 0x23
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414c7b
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0xbc]
push eax
call dword [edx + 0xc]
push 0x7d0
call ebx
cmp dword [esp + 0xc8], 8
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x3c]
cmovae eax, dword [esp + 0xb4]
push eax
call fcn.00407230
lea ecx, [esp + 0x3c]
mov byte [esp + 0x720], 0x24
call fcn.0040f290
mov byte [esp + 0x720], 0x23
cmp dword [esp + 0x50], 8
jb 0x414ccf
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414cf9
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0xbc]
push eax
call dword [edx + 0xc]
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x414d14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xd0], 0
cmp dword [0x516048], 0
jne 0x414d2c
push 1
call fcn.00491db2
add esp, 4
mov dword [0x516048], eax
call fcn.00412790
xor eax, eax
mov dword [esp + 0xb0], 7
mov dword [esp + 0xac], 0
mov word [esp + 0x9c], ax
mov byte [esp + 0x720], 0x25
mov dword [esp + 0x14], eax
cmp dword [0x516048], eax
jne 0x414d74
push 1
call fcn.00491db2
add esp, 4
mov dword [0x516048], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xa0]
push eax
call fcn.004128b0
cmp dword [esp + 0xb0], 8
lea eax, [esp + 0x9c]
cmovae eax, dword [esp + 0x9c]
push eax
push str.mutiplayer_path___s
push 0x91
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
push str.dnmultiplayerex.exe
lea edx, [esp + 0xb0]
lea ecx, [esp + 0x50]
call fcn.00411240
add esp, 0x14
push eax
mov byte [esp + 0x724], 0x26
call fcn.00424b00
add esp, 4
mov byte [esp + 0x720], 0x25
cmp dword [esp + 0x50], 8
mov bl, al
jb 0x414df8
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
test bl, bl
je 0x414f71
cmp dword [0x516048], 0
jne 0x414e18
push 1
call fcn.00491db2
add esp, 4
mov dword [0x516048], eax
push ecx
call fcn.00413660
test al, al
jne 0x414f71
cmp dword [0x516048], 0
jne 0x414e3e
push 1
call fcn.00491db2
add esp, 4
mov dword [0x516048], eax
push ecx
call fcn.00413560
test al, al
jne 0x414f71
call fcn.00412650
push ecx
call fcn.00413860
test al, al
jne 0x414f71
call fcn.00412650
push ecx
call fcn.00413760
test al, al
jne 0x414f71
push str.remove_mul_files
push 0x97
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0xc
lea ecx, [esp + 0x54]
push str._F__IM_dnmultiplayerex.exe
call fcn.00407230
push str.taskkill
lea ecx, [esp + 0x40]
mov byte [esp + 0x724], 0x27
call fcn.00407230
push 0xbb8
push 0
lea eax, [esp + 0x5c]
mov byte [esp + 0x728], 0x28
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00428c80
add esp, 0x10
lea ecx, [esp + 0x3c]
call fcn.00407ab0
lea ecx, [esp + 0x54]
mov byte [esp + 0x720], 0x25
call fcn.00407ab0
lea eax, [esp + 0x9c]
push eax
call fcn.00424b70
add esp, 4
push str.SoftwareXuanZhildmultiplay
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.remove_short_curt
push 0x9d
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push str.LDMultiPlayer.lnk
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x750], 0x29
mov ecx, esp
mov dword [esp + 0x60], esp
push str.LDMultiPlayer.lnk
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x768], 0x2a
mov ecx, esp
push str.LDMultiPlayer.lnk
call fcn.00407230
mov byte [esp + 0x768], 0x25
call fcn.00440c90
add esp, 0x48
cmp byte [esi + 0xcc], 0
je 0x4151f3
push str.remove_remote
push 0xa6
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0xc
lea ecx, [esp + 0x3c]
push str.remote
call fcn.00407230
mov byte [esp + 0x720], 0x2b
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414fd2
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0x44]
push eax
call dword [edx + 0xc]
cmp dword [esp + 0x50], 8
jb 0x414fe5
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], 0
mov byte [esp + 0x54], 0
lea ecx, [esp + 0x14]
mov byte [esp + 0x720], 0x2c
call fcn.00421e30
push str.SoftwareXuanZhiOSLink
lea ecx, [esp + 0x40]
mov byte [esp + 0x724], 0x2d
call fcn.0040d780
push 0x20119
lea eax, [esp + 0x40]
mov byte [esp + 0x724], 0x2e
push eax
push SysReAllocString
lea ecx, [esp + 0x20]
call fcn.00424540
mov byte [esp + 0x720], 0x2d
mov edi, eax
cmp dword [esp + 0x50], 0x10
jb 0x41505e
push dword [esp + 0x3c]
call fcn.00473460
add esp, 4
test edi, edi
jne 0x415094
push str.InstallDir
lea ecx, [esp + 0x40]
call fcn.0040d780
lea eax, [esp + 0x54]
mov byte [esp + 0x720], 0x2f
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
call fcn.00424640
lea ecx, [esp + 0x3c]
call fcn.0040d7e0
xor eax, eax
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
mov byte [esp + 0x720], 0x30
cmp dword [esp + 0x64], eax
je 0x4151ab
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00422620
add esp, 8
lea ecx, [esp + 0x6c]
push eax
call fcn.0040b310
lea ecx, [esp + 0x3c]
call fcn.00407ab0
push str._binldremoteuninst.exe
lea edx, [esp + 0x70]
lea ecx, [esp + 0x40]
call fcn.00411240
add esp, 4
push eax
mov byte [esp + 0x724], 0x31
call fcn.00424b00
add esp, 4
mov byte [esp + 0x720], 0x30
lea ecx, [esp + 0x3c]
mov bl, al
call fcn.00407ab0
lea ecx, [esp + 0x6c]
test bl, bl
je 0x41512d
push str._binldremoteuninst.exe
jmp 0x415132
push str.ldremoteuninst.exe
call fcn.00410610
cmp dword [esp + 0x80], 8
lea eax, [esp + 0x6c]
cmovae eax, dword [esp + 0x6c]
push eax
push str.remote_path__s
push 0xbc
push str.SimulatorFileCleaner::_runCleaning
call fcn.004204c0
add esp, 0x10
lea ecx, [esp + 0x3c]
push str.__playeruninstall
call fcn.00407230
push 0
push 1
lea eax, [esp + 0x44]
mov byte [esp + 0x728], 0x32
push eax
lea eax, [esp + 0x78]
push eax
call fcn.00428b90
add esp, 0x10
lea ecx, [esp + 0x3c]
call fcn.00407ab0
cmp dword [esp + 0x80], 8
jb 0x4151ab
push dword [esp + 0x6c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x80], 7
lea ecx, [esp + 0x14]
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
mov byte [esp + 0x720], 0x2c
call fcn.00424520
mov byte [esp + 0x720], 0x25
cmp dword [esp + 0x68], 0x10
jb 0x41521d
push dword [esp + 0x54]
call fcn.00473460
add esp, 4
jmp 0x41521d
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x41521d
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0xbc]
push eax
call dword [edx + 0xc]
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x41522c
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esp + 0xb0], 8
jb 0x415245
push dword [esp + 0x9c]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0xb0], 7
cmp dword [esp + 0xc8], 8
mov dword [esp + 0xac], 0
mov word [esp + 0x9c], ax
jb 0x41527e
push dword [esp + 0xb4]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0xc8], 7
cmp dword [esp + 0x98], 8
mov dword [esp + 0xc4], 0
mov word [esp + 0xb4], ax
jb 0x4152b7
push dword [esp + 0x84]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0x98], 7
cmp dword [esp + 0xf8], 8
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
jb 0x4152f0
push dword [esp + 0xe4]
call fcn.00473460
add esp, 4
xor eax, eax
mov dword [esp + 0xf8], 7
cmp dword [esp + 0xe0], 8
mov dword [esp + 0xf4], 0
mov word [esp + 0xe4], ax
jb 0x415329
push dword [esp + 0xcc]
call fcn.00473460
add esp, 4
mov ecx, dword [esp + 0x718]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x700]
xor ecx, esp
call fcn.00491c63
mov esp, ebp
pop ebp
ret