Function at 0x403640
Capabilities:
Create process on windows
Delete directory
Delete file
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ff3c
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x5a1ec0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x5516b0
call fcn.004011e0
push str.Start_DoUninstall_by_AP
call fcn.004011e0
push 0x5516b0
call fcn.004011e0
push str.DeleteRtkSaveProperty
call fcn.004011e0
add esp, 0x10
mov ecx, esi
call fcn.004023f0
push str.DeleteInfFiles
call fcn.004011e0
add esp, 4
lea eax, [esi + 0x94]
push eax
mov ecx, esi
call fcn.00401d80
push str.UpdateDriver
call fcn.004011e0
add esp, 4
mov ecx, esi
call fcn.004028b0
xor ebx, ebx
cmp eax, 1
jne 0x40376c
mov eax, dword [0x5a3544]
test eax, eax
jle 0x40371b
lea ecx, [esi + 0x198]
mov edi, 0x5a3548
push ecx
push edi
mov ecx, esi
call fcn.004043f0
test eax, eax
jne 0x403705
push edi
mov ecx, esi
call fcn.00403ec0
mov eax, dword [0x5a3544]
inc ebx
add edi, 0x100
lea ecx, [esi + 0x198]
cmp ebx, eax
jl 0x4036f0
xor ebx, ebx
test eax, eax
jle 0x4037aa
mov edi, 0x5a3548
lea ebx, [ebx]
push str.MI_00
push pe_nt_image_headers32
push edi
call fcn.004042f0
lea eax, [esi + 0x29c]
push eax
push edi
mov ecx, esi
call fcn.004043f0
test eax, eax
jne 0x40375b
push edi
mov ecx, esi
call fcn.00403ec0
inc ebx
add edi, 0x100
cmp ebx, dword [0x5a3544]
jl 0x403730
jmp 0x4037aa
cmp dword [0x5a3544], ebx
jle 0x4037aa
lea eax, [esi + 0x29c]
mov edi, 0x5a3548
nop
push eax
push edi
mov ecx, esi
call fcn.004043f0
test eax, eax
jne 0x403795
push edi
mov ecx, esi
call fcn.00403ec0
inc ebx
add edi, 0x100
lea eax, [esi + 0x29c]
cmp ebx, dword [0x5a3544]
jl 0x403780
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00525070
add esp, 0xc
call fcn.0040a604
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4037dc
push 0x80004005
call fcn.00401b60
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push str.WINDIR
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403813
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x11c]
call fcn.00404250
push str.UnRegisterDriverDll
call fcn.004011e0
add esp, 4
mov ecx, esi
call fcn.00402860
test eax, eax
lea eax, [ebp - 0x11c]
push eax
push str._u__s
jne 0x4038bd
lea eax, [ebp - 0x118]
push eax
call fcn.004018a0
push str._system32RtCamX.dll
push eax
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 4], 1
call fcn.004017d0
add esp, 0x18
push 0
push 0
push dword [eax]
push str.regsvr32.exe
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0x120]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4038b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x118]
jmp 0x4039ab
lea eax, [ebp - 0x120]
push eax
call fcn.004018a0
push str._system32RtCamX64.dll
push eax
lea eax, [ebp - 0x118]
push eax
mov byte [ebp - 4], 2
call fcn.004017d0
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x18
push 0
push 0
push dword [eax]
push str.regsvr32.exe
push str.Open
push 0
call ebx
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40391e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x120]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403941
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
push str._u__s
push eax
call fcn.004018a0
push str._syswow64RtCamX.dll
push eax
lea eax, [ebp - 0x118]
push eax
mov byte [ebp - 4], 3
call fcn.004017d0
add esp, 0x18
push 0
push 0
push dword [eax]
push str.regsvr32.exe
push str.Open
push 0
call ebx
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4039a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x120]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
mov byte [ebp - 4], 0
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4039c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.DeleteDriverSYSDllFile
call fcn.004011e0
add esp, 4
mov ecx, esi
call fcn.00402860
test eax, eax
push str._system32drivers_rtsuvc.sys
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
jne 0x403a2b
call fcn.004017d0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
push dword [eax]
call ebx
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403a24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._system32RtCamX.dll
jmp 0x403a9f
call fcn.004017d0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
push dword [eax]
call ebx
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403a5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._system32RtCamX64.dll
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004017d0
add esp, 0xc
push dword [eax]
call ebx
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403a9a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._syswow64RtCamX.dll
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004017d0
add esp, 0xc
push dword [eax]
call ebx
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403ad8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._twain_32RtsUvcRtTWN.ds
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004017d0
add esp, 0xc
push dword [eax]
call ebx
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403b16
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._twain_32RtsUvc
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004017d0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403b58
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.DeleteDriverDllKey
call fcn.004011e0
mov ecx, esp
push str.CLSID6BE3A97E_04CA_479b_9A6C_638EAB41059E
call fcn.00401500
push SysReAllocString
mov ecx, esi
call fcn.00403d60
push ecx
mov ecx, esp
push str.SYSTEMCurrentControlSetControlMediaSetsC6E13360_30AC_11d0_A18C_00A0C9118956PropertyPages6BE3A97E_04CA_479b_9A6C_638EAB41059E
call fcn.00401500
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00403d60
mov ecx, esi
call fcn.00402860
cmp eax, 1
jne 0x403bb8
push ecx
mov ecx, esp
push str.SoftwareWow6432NodeClassesCLSID6BE3A97E_04CA_479b_9A6C_638EAB41059E
call fcn.00401500
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00403d60
push str.DeleteUninstallKey
call fcn.004011e0
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallRtsUvcUninst
call fcn.00401500
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00403d60
mov ecx, esi
call fcn.00402860
push ecx
mov ecx, esp
test eax, eax
jne 0x403bef
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallE0A7ED39_8CD6_4351_93C3_69CCA00D12B4
jmp 0x403bf4
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallE0A7ED39_8CD6_4351_93C3_69CCA00D12B4
call fcn.00401500
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00403d60
push str.Finish_DoUninstall_by_AP
call fcn.004011e0
push 0x5516b0
call fcn.004011e0
mov eax, dword [esi]
add esp, 8
mov ecx, esi
call dword [eax + 0x17c]
mov edx, dword [ebp - 0x11c]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x403c4a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052505f
mov esp, ebp
pop ebp
ret 8