Function at 0x4055f4
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
lea eax, [ebp - 0x38]
push edi
mov ebx, ecx
push eax
mov dword [ebp - 0x24], ebx
call fcn.0045f823
lea ecx, [ebp - 0x20]
mov dword [esp], 0x4bd860
call fcn.004038b5
mov eax, dword [0x4b0550]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.0045fa13
pop ecx
pop ecx
push 0x138d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor esi, esi
push esi
push esi
push pe_nt_image_headers32
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x4bd870], eax
mov eax, dword [0x4b0550]
mov edi, 0x4c6680
lea ecx, [ebp - 0x30]
push edi
mov dword [ebp - 0x34], eax
call fcn.004038b5
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00403a8c
push esi
push 0x4b0cb4
call fcn.0048f43d
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00403a8c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 8], esi
push esi
lea ecx, [ebp - 0x1c]
call fcn.00403c58
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov edi, dword [ecx - 8]
mov ecx, dword [0x4b0550]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
call fcn.0048ebfe
add esp, 0x10
test eax, eax
je 0x405786
lea eax, [ebp - 0x18]
lea ecx, [ebp - 4]
push eax
call fcn.004038b5
lea ecx, [ebp - 4]
call fcn.0040ae23
lea ecx, [ebp - 4]
call fcn.0040add3
push esi
push 0x4b0cb0
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
jne 0x405751
push 1
push esi
lea ecx, [ebp - 4]
call fcn.0040ae6d
cmp dword [ebp - 8], esi
je 0x40576d
push esi
push 0x2a
lea ecx, [ebp - 4]
call fcn.0040ac50
test eax, eax
jne 0x405746
push 1
push esi
lea ecx, [ebp - 4]
call fcn.0040ae6d
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
mov dword [ebx + 0x1c], esi
call fcn.004038b5
mov ecx, ebx
call fcn.00408e01
jmp 0x40576d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40576d
cmp dword [ebp - 8], esi
jne 0x40576d
push 0xa0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 4]
call fcn.004038fb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp - 0xc]
jmp 0x4056c6
cmp dword [ebp - 8], esi
jne 0x4057a2
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], 1
mov dword [ebp - 0x2c], esi
call fcn.004038fb
jmp 0x4056a1
cmp dword [ebp - 0x14], esi
mov ecx, reloc.SHELL32.dll_SHChangeNotifyRegister
jne 0x4057ad
dec ecx
mov eax, dword [0x4bd868]
lea edx, [ebp - 8]
push edx
push 0xf003f
push esi
push eax
push ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4057dc
lea ecx, [ebp - 0x10]
call fcn.00405bf5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0x4b0ca0
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
mov ebx, 0x4c67d8
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00403b20
push dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push 0x4b0c8c
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00403b20
push dword [eax]
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push dword [0x4c67d8]
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x10], esi
je 0x405867
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
cmp dword [0x4bd870], esi
je 0x4058d5
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
call fcn.00460232
mov eax, dword [eax]
pop ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
push 0xf003f
push esi
push eax
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4058a9
lea ecx, [ebp - 8]
call fcn.00405bf5
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea eax, [ebp - 0xc]
push eax
call fcn.00460245
pop ecx
push dword [eax]
lea ecx, [ebp - 8]
call fcn.00405c0c
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.00405bf5
cmp dword [ebp - 0x14], esi
je 0x405a5f
push 1
mov ebx, str.Folder
pop edi
push esi
push edi
push ecx
mov dword [0x4bd86c], edi
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x405916
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.Directory
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x405945
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID20D04FE0_3AEA_1069_A2D8_08002B30309D
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x405974
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID450D8FBA_AD25_11D0_98A8_0800361B1103
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x4059a3
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID645FF040_5081_101B_9F08_00AA002F954E
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x4059d2
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID208D2C60_3AEA_1069_A2D7_08002B30309D
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x405a01
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID46e06680_4bf0_11d1_83ee_00a0c90dc849
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x405a30
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
push esi
push edi
push ecx
mov edi, str.CLSIDBDEADF00_C265_11D0_BCED_00A0C90AB50F
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
cmp eax, esi
je 0x405a5f
push esi
push esi
push ecx
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
mov edi, dword [ebp - 0x24]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push str.__seiteFreeware_
lea ecx, [ebp - 0x14]
call fcn.00403927
push str._Uninstall
lea ecx, [ebp - 4]
call fcn.00403927
push eax
lea eax, [ebp - 0x14]
push 0x4c6684
push eax
lea eax, [ebp - 8]
push eax
call fcn.00415e78
pop ecx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00403b20
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
call fcn.0043a317
test eax, eax
je 0x405b7d
lea eax, [ebp - 0x238]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x238]
lea ecx, [ebp - 4]
push eax
call fcn.0040a4e8
lea eax, [ebp - 4]
push eax
call fcn.00479491
lea ecx, [ebp - 0x14]
mov dword [esp], str.softwareok_tmp_link.url
call fcn.00403927
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x14]
call fcn.004038fb
push ecx
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004038b5
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.0040447e
pop ecx
pop ecx
push 3
push esi
push dword [ebp - 4]
push str.explorer.exe
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004038fb
jmp 0x405b90
push 3
push esi
push esi
push dword [ebp - 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00405d2e
movzx ebx, word [ebp + 0xc]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x28]
call fcn.004038fb
cmp dword [ebp - 0x10], esi
je 0x405bbc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp - 0x30]
call fcn.004038fb
lea ecx, [ebp - 0x34]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x38]
call fcn.004038fb
pop edi
invalid