Function at 0x40312d
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
lea eax, [ebp - 0x38]
push edi
mov ebx, ecx
push eax
mov dword [ebp - 0x24], ebx
call fcn.0044a432
lea ecx, [ebp - 0x20]
mov dword [esp], 0x488de0
call fcn.00401356
mov eax, dword [0x47e520]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.00401356
call fcn.0044a5b3
pop ecx
pop ecx
push 0x138d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor esi, esi
push esi
push esi
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x488df0], eax
mov eax, dword [0x47e520]
mov edi, 0x491c10
lea ecx, [ebp - 0x30]
push edi
mov dword [ebp - 0x34], eax
call fcn.00401356
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00401522
push esi
push 0x47ea24
call fcn.00461045
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00401522
mov dword [ebp - 0x2c], esi
mov dword [ebp - 8], esi
push esi
lea ecx, [ebp - 0x1c]
call fcn.004016d4
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov edi, dword [ecx - 8]
mov ecx, dword [0x47e520]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
call fcn.00460bfc
add esp, 0x10
test eax, eax
je 0x4032bf
lea eax, [ebp - 0x18]
lea ecx, [ebp - 4]
push eax
call fcn.00401356
lea ecx, [ebp - 4]
call fcn.00408a6f
lea ecx, [ebp - 4]
call fcn.00408a1f
push esi
push 0x47ea20
lea ecx, [ebp - 4]
call fcn.0040179a
test eax, eax
jne 0x40328a
push 1
push esi
lea ecx, [ebp - 4]
call fcn.00408ab9
cmp dword [ebp - 8], esi
je 0x4032a6
push esi
push 0x2a
lea ecx, [ebp - 4]
call fcn.004088a4
test eax, eax
jne 0x40327f
push 1
push esi
lea ecx, [ebp - 4]
call fcn.00408ab9
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
mov dword [ebx + 0x1c], esi
call fcn.00401356
mov ecx, ebx
call fcn.00406a36
jmp 0x4032a6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4032a6
cmp dword [ebp - 8], esi
jne 0x4032a6
push 0xa0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 4]
call fcn.0040139c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp - 0xc]
jmp 0x4031ff
cmp dword [ebp - 8], esi
jne 0x4032db
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], 1
mov dword [ebp - 0x2c], esi
call fcn.0040139c
jmp 0x4031da
cmp dword [ebp - 0x14], esi
mov ecx, reloc.SHELL32.dll_SHChangeNotifyRegister
jne 0x4032e6
dec ecx
mov eax, dword [0x488de8]
lea edx, [ebp - 8]
push edx
push 0xf003f
push esi
push eax
push ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403315
lea ecx, [ebp - 0x10]
call fcn.0040372e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0x47ea10
lea ecx, [ebp - 8]
call fcn.004013c8
lea eax, [ebp - 8]
mov ebx, 0x491d58
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.004015b6
push dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
push 0x47e9fc
lea ecx, [ebp - 8]
call fcn.004013c8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.004015b6
push dword [eax]
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
push dword [0x491d58]
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x10], esi
je 0x4033a0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
cmp dword [0x488df0], esi
je 0x40340e
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
call fcn.0044add2
mov eax, dword [eax]
pop ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
push 0xf003f
push esi
push eax
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4033e2
lea ecx, [ebp - 8]
call fcn.0040372e
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea eax, [ebp - 0xc]
push eax
call fcn.0044ade5
pop ecx
push dword [eax]
lea ecx, [ebp - 8]
call fcn.00403745
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040372e
cmp dword [ebp - 0x14], esi
je 0x403598
push 1
mov ebx, str.Folder
pop edi
push esi
push edi
push ecx
mov dword [0x488dec], edi
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x40344f
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.Directory
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x40347e
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID20D04FE0_3AEA_1069_A2D8_08002B30309D
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x4034ad
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID450D8FBA_AD25_11D0_98A8_0800361B1103
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x4034dc
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID645FF040_5081_101B_9F08_00AA002F954E
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x40350b
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID208D2C60_3AEA_1069_A2D7_08002B30309D
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x40353a
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID46e06680_4bf0_11d1_83ee_00a0c90dc849
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x403569
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
push esi
push edi
push ecx
mov edi, str.CLSIDBDEADF00_C265_11D0_BCED_00A0C90AB50F
mov ecx, esp
push edi
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
cmp eax, esi
je 0x403598
push esi
push esi
push ecx
mov ecx, esp
push edi
call fcn.004013c8
call fcn.0042e802
add esp, 0xc
mov edi, dword [ebp - 0x24]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push str.__seiteFreeware_
lea ecx, [ebp - 0x14]
call fcn.004013c8
push str._Uninstall
lea ecx, [ebp - 4]
call fcn.004013c8
push eax
lea eax, [ebp - 0x14]
push 0x491c14
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413434
pop ecx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004015b6
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004015b6
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004015b6
lea ecx, [ebp - 0x24]
call fcn.0040139c
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp - 0x14]
call fcn.0040139c
call fcn.0042e757
test eax, eax
je 0x4036b6
lea eax, [ebp - 0x238]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x238]
lea ecx, [ebp - 4]
push eax
call fcn.0040811c
lea eax, [ebp - 4]
push eax
call fcn.00450494
lea ecx, [ebp - 0x14]
mov dword [esp], str.softwareok_tmp_link.url
call fcn.004013c8
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00401658
lea ecx, [ebp - 0x14]
call fcn.0040139c
push ecx
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00401356
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.00401356
call fcn.00401e8e
pop ecx
pop ecx
push 3
push esi
push dword [ebp - 4]
push str.explorer.exe
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.0040139c
jmp 0x4036c9
push 3
push esi
push esi
push dword [ebp - 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00403867
movzx ebx, word [ebp + 0xc]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x28]
call fcn.0040139c
cmp dword [ebp - 0x10], esi
je 0x4036f5
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x18]
call fcn.0040139c
lea ecx, [ebp - 0x30]
call fcn.0040139c
lea ecx, [ebp - 0x34]
call fcn.0040139c
lea ecx, [ebp - 0x1c]
call fcn.0040139c
lea ecx, [ebp - 0x20]
call fcn.0040139c
lea ecx, [ebp - 0x38]
call fcn.0040139c
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10