Function at 0x40d0d0
Capabilities:
Contain obfuscated stackstrings
Delete directory
Delete file
Get common file path
Parse pe header
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42426b
push eax
mov dword fs:[0], esp
sub esp, 0x15c
lea eax, [esp + 0x3c]
push ebx
push ebp
push esi
push edi
push eax
xor ebp, ebp
push str.IsV2CleanupNeeded
push ebp
call fcn.0041103b
cmp dword [esp + 0x4c], ebp
je 0x40e7c7
push ebp
push str.IsV2CleanupNeeded
push ebp
call fcn.004110f4
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTBUPDD
lea ecx, [esp + 0x54]
call fcn.00413e2e
push ebp
push 0x432408
push str.MainDir
lea ecx, [esp + 0x5c]
mov dword [esp + 0x180], ebp
call fcn.00413ead
push eax
lea ecx, [esp + 0x30]
push 0x80000002
push ecx
call fcn.00414996
add esp, 0x18
lea edx, [esp + 0x68]
push 0x104
push edx
mov byte [esp + 0x17c], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x68]
lea ecx, [esp + 0x58]
push eax
call fcn.00413e2e
lea ecx, [esp + 0x68]
push 0x104
push ecx
mov byte [esp + 0x17c], 2
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x68]
lea ecx, [esp + 0x60]
push edx
call fcn.00413e2e
mov bl, 3
push str._tbinstal.exe
lea ecx, [esp + 0x14]
mov byte [esp + 0x178], bl
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 4
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 5
call fcn.00413ead
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 4
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._teambrd.gid
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 6
call fcn.004140d9
mov byte [esp + 0x174], 7
mov ecx, eax
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 6
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._teambrd.fts
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 8
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 9
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 8
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddgen.gid
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0xa
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0xb
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0xa
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddgen.fts
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0xc
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0xd
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0xc
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddfirm.gid
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0xe
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0xf
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0xe
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddfirm.fts
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x10
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x11
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x10
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbkey.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x12
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x13
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x12
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._acutil.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x14
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x15
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x14
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.psapi.dll
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x16
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x17
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x16
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.def_tbr.dat
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x18
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x19
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x18
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddgen.hlp
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x1a
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x1b
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x1a
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddgen.fr
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x1c
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x1d
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x1c
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddgen.jp
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x1e
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x1f
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x1e
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddgen.de
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x20
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x21
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x20
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddgen.chm
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x22
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x23
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x22
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._teambrd.hlp
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x24
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x25
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x24
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._teambrd.cnt
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x26
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x27
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x26
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.inetwh32.dll
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x28
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x29
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x28
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbcalib.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
mov byte [esp + 0x174], 0x2a
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x2b
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x2a
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbtest.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x2c
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x2d
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x2c
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbctpnle.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x2e
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x2f
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x2e
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.TBSeting.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x30
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x31
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x30
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push 0x42bef8
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x32
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x33
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x32
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbsystry.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x34
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x35
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x34
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbsysalt.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x36
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x37
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x36
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbalt.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
mov byte [esp + 0x174], 0x38
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x39
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x38
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._script.dll
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x3a
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x3b
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x3a
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._acontrol.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x3c
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x3d
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x3c
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.learner.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x3e
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x3f
call fcn.00413ead
push eax
call esi
mov byte [esp + 0x174], 0x3e
lea ecx, [esp + 0x18]
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._names.dat
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x40
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x41
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x40
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.licence.txt
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x42
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x43
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x42
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._acclose.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x44
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x45
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x44
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.default.tbr
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
mov byte [esp + 0x174], 0x46
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x47
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x46
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbkycore.dll
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x48
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x49
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x48
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.draw.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x4a
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x4b
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x4a
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._roboex32.dll
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x4c
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x4d
call fcn.00413ead
push eax
call esi
mov byte [esp + 0x174], 0x4c
lea ecx, [esp + 0x18]
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.hook.dll
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x4e
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x4f
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x4e
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.zlib.dll
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x50
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x51
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x50
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbpanel.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x52
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x53
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x52
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._recorder.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
mov byte [esp + 0x174], 0x54
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x55
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x54
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.eganlicn.txt
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x56
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x57
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x56
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbhist.txt
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x58
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x59
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x58
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddfirm.hlp
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x5a
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x5b
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x5a
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddfirm.fr
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x5c
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x5d
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x5c
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddfirm.de
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x5e
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x5f
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x5e
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddfirm.jp
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x60
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x61
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x60
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str.upddfirm.chm
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
mov byte [esp + 0x178], 0x62
push edx
lea ecx, [esp + 0x28]
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x63
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x62
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbinstal.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x64
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x65
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x64
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._setup.exe
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x17c], 0x66
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x67
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x66
call fcn.00413e8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], bl
call fcn.00413e8c
push str._tbkey.ini
lea ecx, [esp + 0x14]
call fcn.00413e2e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0x17c], 0x68
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x69
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x68
call fcn.00413e8c
mov byte [esp + 0x174], bl
lea ecx, [esp + 0x10]
call fcn.00413e8c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2c]
push eax
call fcn.00413e74
lea ecx, [esp + 0x2c]
mov byte [esp + 0x174], 0x6a
call fcn.00413ead
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push eax
call edi
jmp 0x40e42e
xor ebp, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
sub esp, 8
mov byte [esp + 0x17c], 0x6b
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x42a310
call fcn.00413e2e
sub esp, 8
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x188], 0x6c
call fcn.00413e74
lea eax, [esp + 0x44]
mov byte [esp + 0x184], 0x6b
push eax
call fcn.00415816
add esp, 0x14
lea ecx, [esp + 0x2c]
push 0x432408
call fcn.00413ed9
mov ecx, dword [esp + 0x38]
dec ecx
test ecx, ecx
jle 0x40e4f4
test ebp, ebp
je 0x40e4d9
push 0x42a310
lea ecx, [esp + 0x1c]
call fcn.00413e2e
lea edx, [esp + 0x18]
lea ecx, [esp + 0x2c]
push edx
mov byte [esp + 0x178], 0x6d
call fcn.00413fec
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x6b
call fcn.00413e8c
mov eax, dword [esp + 0x34]
lea ecx, [eax + ebp*8]
push ecx
lea ecx, [esp + 0x30]
call fcn.00413fec
mov edx, dword [esp + 0x38]
inc ebp
dec edx
cmp ebp, edx
jl 0x40e4a0
lea ecx, [esp + 0x2c]
call fcn.00413ead
push eax
call edi
mov eax, dword [esp + 0x38]
mov byte [esp + 0x174], 0x6a
cmp eax, 1
jle 0x40e54c
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x40e42c
test eax, eax
je 0x40e53e
mov dword [esp + 0x28], eax
mov ecx, ebp
call fcn.00413e8c
mov eax, dword [esp + 0x28]
add ebp, 8
dec eax
mov dword [esp + 0x28], eax
jne 0x40e525
mov ebp, dword [esp + 0x34]
push ebp
call fcn.00419f48
add esp, 4
jmp 0x40e42c
mov edi, dword [esp + 0x34]
test edi, edi
je 0x40e574
test eax, eax
je 0x40e56b
lea ebp, [eax]
mov ecx, edi
call fcn.00413e8c
add edi, 8
dec ebp
jne 0x40e55a
mov edi, dword [esp + 0x34]
push edi
call fcn.00419f48
add esp, 4
push str.SYSTEMCurrentControlSetServicesTBKeyPad_System_Daemon
push 0x80000002
call fcn.00415b1d
push str.SOFTWAREEgan
push 0x80000001
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesTBUPDD
push 0x80000002
call fcn.00415b1d
push str..tbd
push 0x80000000
call fcn.00415b1d
push str.Teamboard.Draw.Document
push 0x80000000
call fcn.00415b1d
push str.TBRecordX.TBRecord
push 0x80000000
call fcn.00415b1d
push str.TBRecordX.TBRecord.1
push 0x80000000
call fcn.00415b1d
push str.TBRecrdX.TBRecord
push 0x80000000
call fcn.00415b1d
add esp, 0x40
push str.TBRecrdX.TBRecord.1
push 0x80000000
call fcn.00415b1d
push str.SOFTWAREClasses.tbd
push 0x80000002
call fcn.00415b1d
push str.SOFTWAREClassesTeamboard.Draw.Document
push 0x80000002
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesEventLogSystemTBUPDDNT
push 0x80000002
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesEventLogSystemTBUPDDWD
push 0x80000002
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesEventLogSystemTBUPDD
push 0x80000002
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesEventLogApplicationTBKeyPad_System_Daemon
push 0x80000002
call fcn.00415b1d
add esp, 0x38
lea ecx, [esp + 0x44]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00413e2e
push str.upddtidy
lea ecx, [esp + 0x48]
mov byte [esp + 0x178], 0x6e
call fcn.00413ead
push eax
push 0x80000002
call fcn.00415a5c
push str.upddtidy
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call fcn.00415a5c
push str.SYSTEMCurrentControlSetServicesTBUPDDNT
push 0x80000002
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesTBUPDD95
push 0x80000002
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesTBUPDDUM
push 0x80000002
call fcn.00415b1d
push str.SYSTEMCurrentControlSetServicesTBUPDDWD
push 0x80000002
call fcn.00415b1d
add esp, 0x38
lea ecx, [esp + 0x44]
push str.softwareMicrosoftWindowsCurrentVersionUninstallTBUPDD
call fcn.00413ed9
lea ecx, [esp + 0x44]
call fcn.00413ead
push eax
push 0x80000002
call fcn.00415b1d
add esp, 8
lea ecx, [esp + 0x18]
push 0x42ba14
call fcn.00413e2e
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x68]
mov byte [esp + 0x17c], 0x6f
call fcn.004140d9
mov ecx, eax
mov byte [esp + 0x174], 0x70
call fcn.00413ead
push eax
call esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], 0x6f
call fcn.00413e8c
lea ecx, [esp + 0x18]
mov byte [esp + 0x174], 0x6e
call fcn.00413e8c
lea ecx, [esp + 0x44]
mov byte [esp + 0x174], 0x6a
call fcn.00413e8c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x174], bl
call fcn.00413e8c
lea ecx, [esp + 0x60]
mov byte [esp + 0x174], 2
call fcn.00413e8c
lea ecx, [esp + 0x58]
mov byte [esp + 0x174], 1
call fcn.00413e8c
lea ecx, [esp + 0x20]
mov byte [esp + 0x174], 0
call fcn.00413e8c
lea ecx, [esp + 0x50]
mov dword [esp + 0x174], 0xffffffff
call fcn.00413e8c
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x168
ret