Function at 0x420a60
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file
Persist via lnk shortcut
Read .ini file
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ce86
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x200f0
call fcn.0044afc0
mov eax, dword [0x46400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20034], esi
test esi, esi
jne 0x420ab9
or eax, 0xffffffff
jmp 0x4231d8
lea ecx, [ebp - 0x2007c]
mov dword [ebp - 0x2007c], 0x423a
call fcn.0040e620
test eax, eax
je 0x420adb
push eax
call fcn.0042cfa2
add esp, 4
add esi, 0x18
mov ecx, esi
mov dword [ebp - 0x200fc], esi
call fcn.0040ad30
or edx, 0xffffffff
mov ecx, eax
call fcn.00410ce0
test al, al
jne 0x420b03
mov eax, 2
jmp 0x4231d8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
xor esi, esi
push 0
push str.UVK_Ultra_GUI
call edi
push 0
push str.Log_analyzerW
mov dword [ebp - 0x20054], eax
call edi
mov edi, eax
mov eax, dword [ebp - 0x20054]
test eax, eax
jne 0x420b3d
test edi, edi
je 0x420b7b
jmp 0x420b54
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
je 0x420b67
push 0
push 0xf060
push 0x112
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
inc esi
cmp esi, 0xa
jl 0x420b13
mov ecx, 0x45a500
call fcn.00413730
mov ecx, 0x45a518
call fcn.00413730
mov ecx, 0x45a53c
call fcn.00413730
xorps xmm0, xmm0
lea ecx, [ebp - 0x20070]
movq qword [ebp - 0x20070], xmm0
call fcn.0040aae0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20020]
movq qword [ebp - 0x20020], xmm0
call fcn.0040aae0
xorps xmm0, xmm0
lea ecx, [ebp - 0x2002c]
movq qword [ebp - 0x2002c], xmm0
call fcn.0040aae0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20078]
movq qword [ebp - 0x20078], xmm0
call fcn.0040aae0
sub esp, 0x1c
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x200fc]
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x20040], xmm0
push 0
push 0
push 0
push str.UVK.zip
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ab50
lea ecx, [ebp - 0x20040]
mov byte [ebp - 4], 4
call fcn.0040ad30
push eax
push 0xa
push 0xcd
push 0
call fcn.00418e80
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
mov ecx, eax
call fcn.0041e320
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
xorps xmm0, xmm0
mov dword [ebp - 0x20088], 0
lea ecx, [ebp - 0x200a0]
movq qword [ebp - 0x20090], xmm0
movups xmmword [ebp - 0x200a0], xmm0
call fcn.0040ffa0
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2002c]
mov byte [ebp - 0x200f5], 1
push 0x23
call fcn.0040af20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKUltra_Adware_Killer
lea ecx, [ebp - 0x2002c]
call fcn.0040b970
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20070]
call fcn.0040acd0
lea ecx, [ebp - 0x20070]
call fcn.0040ad30
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x420d91
push 0
lea ecx, [ebp - 0x20070]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200a0]
call fcn.00410150
test eax, eax
je 0x420d78
push ecx
lea eax, [ebp - 0x20070]
push eax
lea ecx, [ebp - 0x200a0]
call fcn.00410490
test eax, eax
je 0x420d78
lea ecx, [ebp - 0x20070]
call fcn.0040b490
call fcn.0044b531
cmp eax, 0x404
setb byte [ebp - 0x200f5]
push ecx
lea ecx, [ebp - 0x200a0]
call fcn.00410820
cmp byte [ebp - 0x200f5], 0
je 0x420f49
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.zip
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
or edx, 0xffffffff
mov ecx, eax
call fcn.00410ce0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.dat
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20078]
call fcn.0040acd0
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
push eax
push 0xa
push 0xce
push 0
call fcn.00418e80
test al, al
je 0x420e39
lea ecx, [ebp - 0x20078]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
mov ecx, eax
call fcn.0041e320
lea ecx, [ebp - 0x20078]
call fcn.0040ad30
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
or eax, 2
lea ecx, [ebp - 0x20078]
push eax
call fcn.0040ad30
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x2002c]
call fcn.0040b970
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push 2
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200a0]
call fcn.00410150
movsd xmm1, qword [0x45bd58]
lea ecx, [ebp - 0x20020]
call fcn.0040b0d0
lea eax, [ebp - 0x20020]
push eax
lea ecx, [ebp - 0x200a0]
call fcn.004105e0
push ecx
lea ecx, [ebp - 0x200a0]
call fcn.00410820
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
call edi
or eax, 2
lea ecx, [ebp - 0x2002c]
push eax
call fcn.0040ad30
push eax
call esi
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [ebp - 0x200fc]
sub esp, 0x1c
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x20060], xmm0
push 0
push 0
push 0
push str.UVK_en.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20060]
call fcn.0040ab50
lea ecx, [ebp - 0x20060]
mov byte [ebp - 4], 6
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
call fcn.00410ca0
push ecx
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x42110e
push str.UVK_x64_.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
push 1
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x200fc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
mov ecx, dword [ebp - 0x200fc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
push ecx
mov ecx, dword [ebp - 0x200fc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push 1
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call esi
push ecx
mov esi, dword [ebp - 0x200fc]
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
jmp 0x421252
push str.UVK.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
push 1
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x200fc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x64_.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
mov ecx, dword [ebp - 0x200fc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
mov ecx, dword [ebp - 0x200fc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x200fc]
push 0
push str.UVK.dll
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
push 1
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call esi
mov esi, dword [ebp - 0x200fc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
sub esp, 8
lea ecx, [ebp - 0x2002c]
push 0x23
call fcn.0040af20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKImmunizationRebootExec.exe
lea ecx, [ebp - 0x2002c]
call fcn.0040b970
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x4212e4
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._bluescreenview.zip
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040acd0
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
push eax
push 0xa
push 0xc9
push 0
call fcn.00418e80
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
mov ecx, eax
call fcn.0041e320
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_tool.zip
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040acd0
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
push eax
push 0xa
push 0xca
push 0
call fcn.00418e80
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
mov ecx, eax
call fcn.0041e320
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Pictures.zip
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040acd0
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
push eax
push 0xa
push 0xcb
push 0
call fcn.00418e80
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
mov ecx, eax
call fcn.0041e320
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesAbstract.jpg
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
push 0x459780
push 0x65
push 0
call fcn.00418e80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesUVK.png
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
push 0x459780
push 0x64
push 0
call fcn.00418e80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Icons.zip
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040acd0
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
push eax
push 0xa
push 0xcc
push 0
call fcn.00418e80
mov ecx, esi
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
mov ecx, eax
call fcn.0041e320
lea ecx, [ebp - 0x20040]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
mov esi, dword [ebp - 0x20034]
mov byte [ebp - 0x200f5], 0
cmp dword [esi + 0xc], 0
je 0x421ad5
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.key.uvkey
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [esi + 0x20]
call fcn.0040ad30
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esi + 0xc], 2
jne 0x4216b7
lea eax, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 0x20054], eax
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x4216b7
push dword [ebp - 0x20054]
lea ecx, [ebp - 0x2002c]
call fcn.0040aba0
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040ae00
mov ecx, dword [ebp - 0x200fc]
sub esp, 0x28
push 0x45876c
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040bc80
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov ecx, dword [ebp - 0x20054]
push eax
call fcn.0040ad30
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x2002c]
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040aba0
push ecx
mov ecx, dword [ebp - 0x200fc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.BrandIco.ico
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
movaps xmm0, xmmword [0x45bdb0]
lea eax, [ebp - 0x200ec]
push ecx
push eax
lea ecx, [ebp - 0x2002c]
mov dword [ebp - 0x200dc], 0x100
movups xmmword [ebp - 0x200ec], xmm0
call fcn.0040ad30
lea ecx, [ebp - 0x20020]
mov esi, eax
call fcn.0040ad30
mov edx, esi
mov ecx, eax
call fcn.0041f670
mov esi, dword [ebp - 0x20034]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSettings.ini
lea ecx, [esi + 0x40]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
cmp dword [esi + 0x10], 0
je 0x421750
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x421750
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSettings.ini
lea ecx, [esi + 0x18]
mov byte [ebp - 0x200f5], 1
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x421757
mov byte [ebp - 0x200f5], 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAK_White_list.ini
lea ecx, [esi + 0x40]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
cmp dword [esi + 0x10], 0
je 0x42183c
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x42183c
sub esp, 8
lea ecx, [ebp - 0x2002c]
push 0x23
call fcn.0040af20
test al, al
je 0x42183c
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKUltra_Adware_KillerSettings
lea ecx, [ebp - 0x2002c]
call fcn.0040b970
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.00410ce0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteList.ini
lea ecx, [ebp - 0x2002c]
call fcn.0040b970
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_SU_whitelist.ini
lea ecx, [esi + 0x40]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
cmp dword [esi + 0x10], 0
je 0x421ad5
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x421ad5
sub esp, 8
lea ecx, [ebp - 0x2002c]
push 0x23
call fcn.0040af20
test al, al
je 0x421ad5
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSmart_uninstaller
lea ecx, [ebp - 0x2002c]
call fcn.0040b970
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.00410ce0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Whitelist.ini
lea ecx, [ebp - 0x2002c]
call fcn.0040b970
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
call edi
test eax, eax
jne 0x42194f
xorps xmm0, xmm0
mov dword [ebp - 0x200dc], eax
push 0x22
lea ecx, [ebp - 0x2002c]
movq qword [ebp - 0x200e4], xmm0
movups xmmword [ebp - 0x200f4], xmm0
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200f4]
call fcn.0040ffc0
lea ecx, [ebp - 0x200f4]
call fcn.00420a40
lea eax, [ebp - 0x20018]
xorps xmm0, xmm0
lea ecx, [ebp - 0x20048]
mov dword [ebp - 0x200fc], eax
movq qword [ebp - 0x20048], xmm0
call fcn.0040aae0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20050]
movq qword [ebp - 0x20050], xmm0
call fcn.0040aae0
lea ecx, [ebp - 0x20020]
mov byte [ebp - 4], 8
call fcn.0040ad30
push eax
push 0x10000
lea eax, [ebp - 0x20018]
push eax
push str.Whitelisted
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x421a1b
lea eax, [ebp - 0x20050]
push eax
lea edx, [ebp - 0x20048]
lea ecx, [ebp - 0x20018]
call fcn.0041f7a0
test al, al
je 0x421a1b
nop
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
push str.Whitelisted
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20050]
push eax
lea edx, [ebp - 0x20048]
lea ecx, [ebp - 0x200fc]
call fcn.0041f770
test al, al
jne 0x4219d0
lea eax, [ebp - 0x20018]
lea ecx, [ebp - 0x20020]
mov dword [ebp - 0x200fc], eax
call fcn.0040ad30
push eax
push 0x10000
lea eax, [ebp - 0x20018]
push eax
push str.Blacklisted
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x421abb
lea eax, [ebp - 0x20050]
push eax
lea edx, [ebp - 0x20048]
lea ecx, [ebp - 0x20018]
call fcn.0041f7a0
test al, al
je 0x421abb
nop word [eax + eax]
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
push str.Blacklisted
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20050]
push eax
lea edx, [ebp - 0x20048]
lea ecx, [ebp - 0x200fc]
call fcn.0041f770
test al, al
jne 0x421a70
lea ecx, [ebp - 0x20050]
call fcn.0040ac10
lea ecx, [ebp - 0x20048]
mov byte [ebp - 4], 6
call fcn.0040ac10
push 0x20019
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20024]
mov dword [ebp - 0x20024], 0
call fcn.0040d4c0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20048]
movq qword [ebp - 0x20048], xmm0
call fcn.0040aae0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20068]
movq qword [ebp - 0x20068], xmm0
call fcn.0040aae0
lea eax, [esi + 0x30]
mov byte [ebp - 4], 0xb
xorps xmm0, xmm0
lea ecx, [ebp - 0x20058]
push eax
movq qword [ebp - 0x20058], xmm0
call fcn.0040aaf0
lea ecx, [ebp - 0x20058]
mov byte [ebp - 4], 0xc
call fcn.00411dd0
sub esp, 8
lea ecx, [ebp - 0x20048]
push 0x10
call fcn.0040af20
sub esp, 8
lea ecx, [ebp - 0x20068]
push 0x19
call fcn.0040af20
cmp byte [ebp - 0x200f5], 0
jne 0x421e04
lea eax, [ebp - 0x20020]
push eax
push str.DisplayName
lea ecx, [ebp - 0x20024]
call fcn.0040d660
test al, al
je 0x421e04
lea ecx, [ebp - 0x20020]
call fcn.0040ac70
test eax, eax
je 0x421e04
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
jne 0x421d37
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
jne 0x421d37
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
jne 0x421d37
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
jne 0x421d37
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
jne 0x421d37
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
jne 0x421d37
and dword [esi + 8], 0xffffffef
mov edx, 0x455d58
mov ecx, str.HKCR64_shellForce_Deletecommand
call fcn.0040e7b0
test al, al
jne 0x421d61
mov edx, 0x455d58
mov ecx, str.HKCR_shellDelete_with_UVKcommand
call fcn.0040e7b0
test al, al
jne 0x421d61
and dword [esi + 8], 0xfffffffb
mov edx, 0x455d58
mov ecx, str.HKCR.uvk
call fcn.0040e7b0
test al, al
jne 0x421d8b
mov edx, 0x455d58
mov ecx, str.HKCRUVKCommandsScript
call fcn.0040e7b0
test al, al
jne 0x421d8b
and dword [esi + 8], 0xfffffff7
push 0x20019
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20024]
mov dword [ebp - 0x20030], 0
call fcn.0040d4f0
lea eax, [ebp - 0x20030]
push eax
push str.AutoUpdate
lea ecx, [ebp - 0x20024]
call fcn.0040d7a0
test al, al
je 0x421dce
cmp dword [ebp - 0x20030], 0
jne 0x421dd2
and dword [esi + 8], 0xffffffdf
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 0
push eax
push str.ShowTooltips
lea ecx, [ebp - 0x20024]
call fcn.0040d7a0
test al, al
je 0x421e00
cmp dword [ebp - 0x20030], 0
jne 0x421e04
and dword [esi + 8], 0xffffffbf
sub esp, 0x1c
lea ecx, [ebp - 0x20060]
xorps xmm0, xmm0
movq qword [ebp - 0x20084], xmm0
push 0
push 0
push 0
push str.__Uninst
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20084]
call fcn.0040ab50
sub esp, 0x1c
mov byte [ebp - 4], 0xd
cmp dword [esi + 0xc], 2
mov ecx, 0x45a500
mov eax, str.Brandico.ico
xorps xmm0, xmm0
cmovne eax, ecx
movq qword [ebp - 0x20050], xmm0
push 0
push 0
push eax
push 0x45876c
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20050]
call fcn.0040ab50
push ecx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0xe
call fcn.0040ad30
push eax
push 1
push str.DisplayName
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20024]
call fcn.0040da30
push 0
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
push 1
push str.InstallLocation
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea ecx, [ebp - 0x20084]
call fcn.0040ad30
push eax
push 1
push str.UninstallString
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
push 1
push str.DisplayIcon
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea ecx, [esi + 0x50]
call fcn.0040ad30
push eax
push 1
push str.Publisher
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
push 0x45aadc
push 1
push str.DisplayVersion
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
lea ecx, [esi + 0x18]
call fcn.0040ad30
mov ecx, eax
call fcn.0040f730
shrd eax, edx, 0xa
push 0
mov dword [ebp - 0x20030], eax
lea ecx, [ebp - 0x20024]
lea eax, [ebp - 0x20030]
shr edx, 0xa
push eax
push 4
push str.EstimatedSize
call fcn.0040d9a0
push 0
push str.http:__www.carifred.com_uvk_help
push 1
push str.HelpLink
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
push str.http:__www.carifred.com_uvk
push 1
push str.URLInfoAbout
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 1
push eax
push 4
push str.NoModify
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea eax, [ebp - 0x20030]
push eax
push 4
push str.NoRepair
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 7
push eax
push 4
push str.VersionMajor
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 4
push eax
push 4
push str.VersionMinor
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push ecx
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
push 1
push 0x455d58
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsUVK_en.exe
lea ecx, [ebp - 0x20024]
call fcn.0040da30
push 0
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
push 1
push str.Path
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push str.HKCRShellDelete_with_UVK
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKCRShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKCRDirectoryShellDelete_with_UVK
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKCRDirectoryShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKCRShellFile_Information
lea ecx, [ebp - 0x20024]
call fcn.0040db90
test byte [esi + 8], 4
je 0x42220b
push ecx
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040da30
push ecx
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040da30
push ecx
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellFile_Information
lea ecx, [ebp - 0x20024]
call fcn.0040da30
sub esp, 0x1c
lea ecx, [ebp - 0x20060]
xorps xmm0, xmm0
movq qword [ebp - 0x20038], xmm0
push 0
push 0
push str.____1_
call fcn.0040ad30
push eax
push 0x458f44
lea ecx, [ebp - 0x20038]
call fcn.0040ab50
push ecx
lea ecx, [ebp - 0x20038]
mov byte [ebp - 4], 0xf
call fcn.0040ad30
push eax
push 1
push 0x455d58
push str.HKLM64SOFTWAREClassesShellForce_Deletecommand
lea ecx, [ebp - 0x20024]
call fcn.0040da30
push ecx
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
push 1
push 0x455d58
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Deletecommand
lea ecx, [ebp - 0x20024]
call fcn.0040da30
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___FileInfo___1_
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
push 0x458f44
lea ecx, [ebp - 0x20038]
call fcn.0040acd0
push ecx
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
push 1
push 0x455d58
push str.HKLM64SOFTWAREClassesShellFile_Informationcommand
lea ecx, [ebp - 0x20024]
call fcn.0040da30
lea ecx, [ebp - 0x20038]
mov byte [ebp - 4], 0xe
call fcn.0040ac10
push str.HKCRUVKCommandsFile
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKLM64SOFTWAREClassesUVKCommandsScriptDefaultIcon
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKLM64SOFTWAREClassesSrSettingsFileDefaultIcon
lea ecx, [ebp - 0x20024]
call fcn.0040db90
cmp dword [esi + 0xc], 2
jne 0x422254
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
mov dword [ebp - 0x200fc], eax
jmp 0x42225e
mov dword [ebp - 0x200fc], 0
test byte [esi + 8], 8
je 0x422397
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___readfile___1_
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
push 0x458f44
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
push dword [ebp - 0x200fc]
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
push str.UVK_commands_script
mov edx, str.UVKCommandsScript
mov ecx, str..uvk
call fcn.00411920
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___ImportSr___1_
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
push 0x458f44
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
push dword [ebp - 0x200fc]
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
push str.System_repair_settings_file
mov edx, str.SrSettingsFile
mov ecx, str..uvksr
call fcn.00411920
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe_
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
push 0x458f44
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___1_
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
call fcn.00411c40
jmp 0x4223d7
push str.HKCR.uvk
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKCRUVKCommandsScript
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKCR.uvksr
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push str.HKCRSrSettingsFile
lea ecx, [ebp - 0x20024]
call fcn.0040db90
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____1_
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
push 0x458f44
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
push dword [ebp - 0x200fc]
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
push str.UVK_license_key
mov edx, str.UVKLicenseKey
mov ecx, str..uvkey
call fcn.00411920
mov eax, dword [esi + 8]
shr eax, 5
and eax, 1
push ecx
mov dword [ebp - 0x20030], eax
lea ecx, [ebp - 0x20024]
lea eax, [ebp - 0x20030]
push eax
push 4
push str.AutoUpdate
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
call fcn.0040da30
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x20024]
shr eax, 6
and eax, 1
push 0
mov dword [ebp - 0x20030], eax
lea eax, [ebp - 0x20030]
push eax
push 4
push str.ShowTooltips
call fcn.0040d9a0
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x20024]
shr eax, 4
and eax, 1
push 0
mov dword [ebp - 0x20030], eax
lea eax, [ebp - 0x20030]
push eax
push 4
push str.DesktopShortcut
call fcn.0040d9a0
push 0
lea ecx, [esi + 0x48]
call fcn.0040ad30
push eax
push 1
push str.InstallSource
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
push 1
push str.InstallDir
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push str.GuiBkColor
lea ecx, [ebp - 0x20024]
call fcn.0040db20
push str.GroupBorderColor
lea ecx, [ebp - 0x20024]
call fcn.0040db20
push str.GroupBkColor
lea ecx, [ebp - 0x20024]
call fcn.0040db20
push str.ButtonColor0
lea ecx, [ebp - 0x20024]
call fcn.0040db20
push str.ButtonColor1
lea ecx, [ebp - 0x20024]
call fcn.0040db20
push str.ButtonColor2
lea ecx, [ebp - 0x20024]
call fcn.0040db20
push str.ButtonColor3
lea ecx, [ebp - 0x20024]
call fcn.0040db20
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 1
push eax
push 4
push str.PortableVersion
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push 0
lea eax, [ebp - 0x20030]
push eax
push 4
push str.EulaAccepted
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
push str.TBinder
push str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
lea ecx, [ebp - 0x20024]
call fcn.0040db50
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemBooster
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
push 0xf003f
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20024]
call fcn.0040d4f0
test al, al
je 0x42264d
lea eax, [ebp - 0x2002c]
push eax
push str.JunkFileExtensions
lea ecx, [ebp - 0x20024]
call fcn.0040d660
test al, al
je 0x42264d
push 0
push 0
push 0x458c28
push str.bak
lea ecx, [ebp - 0x2002c]
call fcn.0040bdc0
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
push 1
push str.JunkFileExtensions
lea ecx, [ebp - 0x20024]
call fcn.0040d9a0
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
mov ecx, eax
call fcn.00411120
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov ecx, eax
call fcn.00411120
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov ecx, eax
call fcn.00411120
sub esp, 0xc
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
mov edx, str.Ultra_virus_killer
mov ecx, eax
call fcn.004130e0
call fcn.00411220
xorps xmm0, xmm0
lea ecx, [ebp - 0x20038]
movq qword [ebp - 0x20038], xmm0
call fcn.0040aae0
sub esp, 8
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x20038]
push 2
call fcn.0040af20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x42277c
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x4227d4
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b5e8
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x42282c
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b630
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422884
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x4228e6
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
sub esp, 8
lea ecx, [ebp - 0x20038]
push 0x17
call fcn.0040af20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x42294e
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x4229a6
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b5e8
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x4229fe
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b630
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422a56
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 2
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422ab8
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
mov edx, 6
mov ecx, eax
call fcn.0040f990
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
or edx, 0xffffffff
mov ecx, eax
call fcn.00410ce0
push 0x38
lea eax, [ebp - 0x200d8]
push 0
push eax
call fcn.00431b40
add esp, 0xc
lea ecx, [ebp - 0x200d8]
call fcn.0040ec00
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x20058]
mov byte [ebp - 4], 0x11
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20020]
call fcn.0040b970
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eda0
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eea0
push ecx
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eef0
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040ef40
sub esp, 8
lea ecx, [ebp - 0x200d8]
call fcn.0040ef20
lea ecx, [ebp - 0x200d8]
call fcn.0040ef70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.lnk
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eda0
lea ecx, [ebp - 0x2002c]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eea0
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040ef40
lea ecx, [ebp - 0x200d8]
call fcn.0040ef70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Uninstall.lnk
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20038]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eda0
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eea0
push ecx
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eef0
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040ef40
push ecx
lea ecx, [ebp - 0x200d8]
call fcn.0040eed0
lea ecx, [ebp - 0x200d8]
call fcn.0040ef70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422d4b
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422da0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b6b8
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422df5
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b6f0
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422e4a
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20048]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422eac
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422f01
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
test byte [esi + 8], 0x10
je 0x422f1b
push 0x459c40
lea ecx, [ebp - 0x20058]
call fcn.0040abe0
test al, al
je 0x422f70
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422f70
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b6b8
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x422fc5
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x45b6f0
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x42301a
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x20058]
call fcn.0040ad30
push eax
push 0x45876c
lea ecx, [ebp - 0x20068]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040acd0
test byte [esi + 8], 0x10
lea ecx, [ebp - 0x20020]
je 0x4230c3
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eda0
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eea0
push ecx
lea ecx, [ebp - 0x20050]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040eef0
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x200d8]
call fcn.0040ef40
lea ecx, [ebp - 0x200d8]
call fcn.0040ef70
jmp 0x4230e3
call fcn.0040ad30
push eax
call edi
test eax, eax
je 0x4230e3
lea ecx, [ebp - 0x20020]
call fcn.0040ad30
xor edx, edx
mov ecx, eax
call fcn.0040f990
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
sub esp, 8
lea ecx, [esi + 0x18]
call fcn.0040ad30
push eax
lea ecx, [ebp - 0x20060]
call fcn.0040ad30
mov edx, dword [esi + 0x14]
mov ecx, eax
call fcn.00410a00
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x200d8]
call fcn.0040efa0
lea ecx, [ebp - 0x20038]
call fcn.0040ac10
lea ecx, [ebp - 0x20050]
call fcn.0040ac10
lea ecx, [ebp - 0x20084]
call fcn.0040ac10
lea ecx, [ebp - 0x20058]
call fcn.0040ac10
lea ecx, [ebp - 0x20068]
call fcn.0040ac10
lea ecx, [ebp - 0x20048]
call fcn.0040ac10
lea ecx, [ebp - 0x20024]
call fcn.0040d530
lea ecx, [ebp - 0x20060]
call fcn.0040ac10
lea ecx, [ebp - 0x20098]
call fcn.0040c5b0
mov eax, dword [ebp - 0x200a0]
cmp eax, 0xffffffff
je 0x42319f
test eax, eax
je 0x42319f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20040]
call fcn.0040ac10
lea ecx, [ebp - 0x20078]
call fcn.0040ac10
lea ecx, [ebp - 0x2002c]
call fcn.0040ac10
lea ecx, [ebp - 0x20020]
call fcn.0040ac10
lea ecx, [ebp - 0x20070]
call fcn.0040ac10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042cf3b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret