Function at 0x413c30
Capabilities:
Copy file
Delete file
Delete registry key
Get common file path
Persist via lnk shortcut
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c9266
mov eax, dword fs:[0]
push eax
sub esp, 0x708
mov eax, dword [0x50c4d8]
xor eax, esp
mov dword [esp + 0x700], eax
push ebx
push esi
push edi
mov eax, dword [0x50c4d8]
xor eax, esp
push eax
lea eax, [esp + 0x718]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 0
lea ecx, [esp + 0x54]
push 0x11
xor eax, eax
mov dword [esp + 0x6c], 7
push str._F__IM_adb.exe__T
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
mov byte [esp + 0x720], 1
lea ecx, [esp + 0x6c]
push 8
xor eax, eax
mov dword [esp + 0x84], 7
push str.taskkill
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 2
lea eax, [esp + 0x4c]
lea edx, [esp + 0x64]
lea ecx, [esp + 0x7c]
push eax
call fcn.0040fe60
add esp, 0x14
cmp dword [esp + 0x80], 8
jb 0x413d35
push dword [esp + 0x6c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x80], 7
cmp dword [esp + 0x68], 8
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x413d62
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x413d97
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 3
lea ecx, [esp + 0x6c]
push 0xf
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_aapt.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 4
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 5
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe60
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x413e57
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x413e84
push dword [esp + 0x6c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x413ebc
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 6
lea ecx, [esp + 0x6c]
push 0x13
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_ldrecord.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 7
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 8
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe60
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x413f7c
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x413fa9
push dword [esp + 0x6c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x413fe1
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 9
lea ecx, [esp + 0x6c]
push 0x11
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_dndscd.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 0xa
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 0xb
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe60
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x4140a1
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x4140ce
push dword [esp + 0x6c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x414106
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 0xc
lea ecx, [esp + 0x6c]
push 0x11
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_fynews.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 0xd
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 0xe
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe60
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x4141c6
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x4141f3
push dword [esp + 0x6c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x41422b
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push eax
push 0x4e9c80
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
call fcn.00407100
mov dword [esp + 0x720], 0xf
lea ecx, [esp + 0x6c]
push 0x11
xor eax, eax
mov dword [esp + 0x84], 7
push str._F__IM_ldnews.exe
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.00407100
mov byte [esp + 0x720], 0x10
lea ecx, [esp + 0x54]
push 8
xor eax, eax
mov dword [esp + 0x6c], 7
push str.taskkill
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
call fcn.00407100
sub esp, 0x10
mov byte [esp + 0x730], 0x11
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x64]
push eax
call fcn.0040fe60
add esp, 0x14
cmp dword [esp + 0x68], 8
jb 0x4142eb
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
cmp dword [esp + 0x80], 8
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x414318
push dword [esp + 0x6c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
jb 0x414350
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
call fcn.00415940
lea edi, [esi + 0x78]
push str.dnuninst.exe
mov edx, edi
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
mov ebx, eax
mov dword [esp + 0x720], 0x12
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x41439d
mov edx, dword [0x515154]
mov eax, dword [ecx]
add edx, 0x14
push 0xc8
push edx
push ebx
mov dword [0x515154], edx
call dword [eax + 0xc]
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x4143bb
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x14], 8
jb 0x4143d0
mov eax, dword [edi]
jmp 0x4143d2
mov eax, edi
push eax
push str.uninst_begin_delete_files__directory_is__s
push 0x30
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0x10
cmp dword [esi + 0x88], 0
jne 0x414409
push str.clean_bug_install_path_is_empty___
push 0x33
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0xc
jmp 0x415339
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00416cb0
mov ecx, 0x516050
call fcn.0043c090
push 0x4e9f58
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp dword [0x51604c], 0
mov dword [esi + 0xd0], eax
jne 0x41444b
push 1
call fcn.00492312
add esp, 4
mov dword [0x51604c], eax
call fcn.00412680
lea eax, [esp + 0x3c]
mov ecx, 0x5160e0
push eax
call fcn.00416950
lea ecx, [esi + 0x58]
mov dword [esp + 0x720], 0x13
cmp ecx, eax
je 0x41447b
push 0xffffffffffffffff
push 0
push eax
call fcn.00407870
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x414499
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
lea eax, [esp + 0x3c]
mov ecx, 0x5160e0
push eax
call fcn.00416950
mov dword [esp + 0x720], 0x14
cmp dword [eax + 0x14], 8
jb 0x4144bb
mov eax, dword [eax]
push eax
push str.openIdopenIdopenIdopenIdopenId__s
push 0x3c
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0x10
mov dword [esp + 0x720], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x4144ee
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
lea eax, [esp + 0x2c]
push eax
push str.SoftwareXuanZhiLDPlayer9
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4145df
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 8
push eax
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x30]
movlpd qword [esp + 0x24], xmm0
push eax
push 0
push str.installTime
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [esp + 0x24]
push dword [esp + 0x24]
push str.install_time___d_ret___d
push 0x48
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0x18
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x34]
push eax
call fcn.004988eb
mov ecx, dword [esp + 0x38]
add esp, 4
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
sbb eax, dword [esp + 0x20]
test eax, eax
jg 0x4145df
jl 0x41458e
cmp ecx, 0x5265c00
jae 0x4145df
push str.uninstall_not_one_day
push 0x50
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
sub esp, 0xc
mov ecx, 0x5160e0
mov eax, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00416950
sub esp, 0x18
mov dword [esp + 0x750], 0x15
mov ecx, esp
push str.uinstallplayer
call fcn.00407230
mov ecx, esi
mov dword [esp + 0x750], 0xffffffff
call fcn.0040ae10
xor eax, eax
push 0x208
push eax
mov word [esp + 0x104], ax
lea eax, [esp + 0x106]
push eax
call fcn.0049ac40
add esp, 0xc
lea eax, [esp + 0xfc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0xd0]
call fcn.00407230
push 3
push 0x4eeb50
lea ecx, [esp + 0xd4]
mov dword [esp + 0x728], 0x16
call fcn.00410c50
lea eax, [esp + 0xcc]
push eax
call fcn.00424b70
add esp, 4
test al, al
jne 0x414668
lea eax, [esp + 0xcc]
push eax
call fcn.00424b90
add esp, 4
push 0x4eeb58
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
mov byte [esp + 0x720], 0x17
cmp dword [eax + 0x14], 8
jb 0x414690
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x58]
call fcn.00407230
cmp dword [esp + 0x68], 8
lea eax, [esp + 0x54]
cmovae eax, dword [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x68], 8
jb 0x4146c2
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x50], 8
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
jb 0x4146f4
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
push 0x4eeb58
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411250
add esp, 4
mov ebx, eax
push str.lduninst_del.exe
mov edx, edi
mov byte [esp + 0x724], 0x18
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x414731
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x414739
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x414756
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x414788
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
push 0x4eeba0
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411250
add esp, 4
mov ebx, eax
push str.msvcr120.dll
mov edx, edi
mov byte [esp + 0x724], 0x19
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x4147c5
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x4147cd
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x4147ea
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x41481c
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
push 0x4eebd8
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411250
add esp, 4
mov ebx, eax
push str.msvcp120.dll
mov edx, edi
mov byte [esp + 0x724], 0x1a
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x414859
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x414861
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x41487e
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x4148b0
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
push 0x4eec10
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411250
add esp, 4
mov ebx, eax
push str.msvcp120d.dll
mov edx, edi
mov byte [esp + 0x724], 0x1b
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x4148ed
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x4148f5
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x414912
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x414944
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
push 0x4eec4c
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x58]
call fcn.00411250
add esp, 4
mov ebx, eax
push str.msvcr120d.dll
mov edx, edi
mov byte [esp + 0x724], 0x1c
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
cmp dword [ebx + 0x14], 8
jb 0x414981
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x414989
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x50], 8
jb 0x4149a6
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
xor eax, eax
mov byte [esp + 0x720], 0x16
cmp dword [esp + 0x68], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x4149d8
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
lea eax, [esp + 0xe4]
push eax
call fcn.00424e90
add esp, 4
push str.datadata.ini
lea ecx, [esp + 0xe8]
mov byte [esp + 0x724], 0x1d
call fcn.00410620
push 0x3ff
lea eax, [esp + 0x311]
mov byte [esp + 0x310], 0
push 0
push eax
call fcn.0049ac40
add esp, 0xc
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00422710
add esp, 8
cmp dword [eax + 0x14], 0x10
jb 0x414a3d
mov eax, dword [eax]
push eax
push 0x400
lea eax, [esp + 0x314]
push eax
push 0x4ee146
push str.shortcut
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [esp + 0x50], 0x10
jb 0x414a73
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
lea eax, [esp + 0x30c]
push eax
lea ecx, [esp + 0x40]
call fcn.0040d790
push eax
lea eax, [esp + 0x88]
mov byte [esp + 0x724], 0x1e
push eax
call fcn.004226d0
add esp, 8
mov byte [esp + 0x720], 0x20
cmp dword [esp + 0x50], 0x10
jb 0x414ab8
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
cmp dword [esp + 0x98], 8
lea eax, [esp + 0x84]
mov dword [esp + 0x50], 0xf
cmovae eax, dword [esp + 0x84]
push eax
push str.shortcut_name_is__s
push 0x6c
push str.SimulatorFileCleaner::_runCleaning
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.00420530
cmp dword [esp + 0x108], 8
lea eax, [esp + 0xf4]
cmovae eax, dword [esp + 0xf4]
push eax
push str.path_:__s
push 0x6d
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0x20
cmp dword [esp + 0x94], 0
jbe 0x414bd8
push str..lnk
lea ecx, [esp + 0x88]
call fcn.00410620
cmp dword [esp + 0x98], 8
lea eax, [esp + 0x84]
cmovae eax, dword [esp + 0x84]
push eax
push str.delete_shortcut__s
push 0x70
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
sub esp, 8
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4e9c80
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x750], 0x21
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x4e9c80
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x768], 0x22
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0xd4]
push eax
call fcn.00407870
mov byte [esp + 0x768], 0x20
call fcn.004410f0
add esp, 0x48
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414c01
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esi + 0xa8]
push eax
call dword [edx + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x190
call ebx
mov ecx, esi
call fcn.004155a0
mov ecx, esi
call fcn.00415730
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414c3f
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
push edi
mov dword [0x515154], eax
call dword [edx + 0xc]
push 0x190
call ebx
mov ecx, esi
call fcn.00415360
lea ecx, [esp + 0xb4]
call fcn.0040efa0
mov byte [esp + 0x720], 0x23
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414c8b
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0xbc]
push eax
call dword [edx + 0xc]
push 0x7d0
call ebx
cmp dword [esp + 0xc8], 8
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x3c]
cmovae eax, dword [esp + 0xb4]
push eax
call fcn.00407230
lea ecx, [esp + 0x3c]
mov byte [esp + 0x720], 0x24
call fcn.0040f2a0
mov byte [esp + 0x720], 0x23
cmp dword [esp + 0x50], 8
jb 0x414cdf
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414d09
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0xbc]
push eax
call dword [edx + 0xc]
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x414d24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xd0], 0
cmp dword [0x51604c], 0
jne 0x414d3c
push 1
call fcn.00492312
add esp, 4
mov dword [0x51604c], eax
call fcn.004127a0
xor eax, eax
mov dword [esp + 0xb0], 7
mov dword [esp + 0xac], 0
mov word [esp + 0x9c], ax
mov byte [esp + 0x720], 0x25
mov dword [esp + 0x14], eax
cmp dword [0x51604c], eax
jne 0x414d84
push 1
call fcn.00492312
add esp, 4
mov dword [0x51604c], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xa0]
push eax
call fcn.004128c0
cmp dword [esp + 0xb0], 8
lea eax, [esp + 0x9c]
cmovae eax, dword [esp + 0x9c]
push eax
push str.mutiplayer_path___s
push 0x91
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
push str.dnmultiplayerex.exe
lea edx, [esp + 0xb0]
lea ecx, [esp + 0x50]
call fcn.00411250
add esp, 0x14
push eax
mov byte [esp + 0x724], 0x26
call fcn.00424b70
add esp, 4
mov byte [esp + 0x720], 0x25
cmp dword [esp + 0x50], 8
mov bl, al
jb 0x414e08
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
test bl, bl
je 0x414f81
cmp dword [0x51604c], 0
jne 0x414e28
push 1
call fcn.00492312
add esp, 4
mov dword [0x51604c], eax
push ecx
call fcn.00413670
test al, al
jne 0x414f81
cmp dword [0x51604c], 0
jne 0x414e4e
push 1
call fcn.00492312
add esp, 4
mov dword [0x51604c], eax
push ecx
call fcn.00413570
test al, al
jne 0x414f81
call fcn.00412660
push ecx
call fcn.00413870
test al, al
jne 0x414f81
call fcn.00412660
push ecx
call fcn.00413770
test al, al
jne 0x414f81
push str.remove_mul_files
push 0x97
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0xc
lea ecx, [esp + 0x54]
push str._F__IM_dnmultiplayerex.exe
call fcn.00407230
push str.taskkill
lea ecx, [esp + 0x40]
mov byte [esp + 0x724], 0x27
call fcn.00407230
push 0xbb8
push 0
lea eax, [esp + 0x5c]
mov byte [esp + 0x728], 0x28
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00428ce0
add esp, 0x10
lea ecx, [esp + 0x3c]
call fcn.00407ab0
lea ecx, [esp + 0x54]
mov byte [esp + 0x720], 0x25
call fcn.00407ab0
lea eax, [esp + 0x9c]
push eax
call fcn.00424be0
add esp, 4
push str.SoftwareXuanZhildmultiplay
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.remove_short_curt
push 0x9d
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push str.LDMultiPlayer.lnk
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x750], 0x29
mov ecx, esp
mov dword [esp + 0x60], esp
push str.LDMultiPlayer.lnk
call fcn.00407230
sub esp, 0x18
mov byte [esp + 0x768], 0x2a
mov ecx, esp
push str.LDMultiPlayer.lnk
call fcn.00407230
mov byte [esp + 0x768], 0x25
call fcn.004410f0
add esp, 0x48
cmp byte [esi + 0xcc], 0
je 0x415203
push str.remove_remote
push 0xa6
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0xc
lea ecx, [esp + 0x3c]
push str.remote
call fcn.00407230
mov byte [esp + 0x720], 0x2b
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x414fe2
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0x44]
push eax
call dword [edx + 0xc]
cmp dword [esp + 0x50], 8
jb 0x414ff5
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], 0
mov byte [esp + 0x54], 0
lea ecx, [esp + 0x14]
mov byte [esp + 0x720], 0x2c
call fcn.00421ea0
push str.SoftwareXuanZhiOSLink
lea ecx, [esp + 0x40]
mov byte [esp + 0x724], 0x2d
call fcn.0040d790
push 0x20119
lea eax, [esp + 0x40]
mov byte [esp + 0x724], 0x2e
push eax
push SysReAllocString
lea ecx, [esp + 0x20]
call fcn.004245b0
mov byte [esp + 0x720], 0x2d
mov edi, eax
cmp dword [esp + 0x50], 0x10
jb 0x41506e
push dword [esp + 0x3c]
call fcn.00473980
add esp, 4
test edi, edi
jne 0x4150a4
push str.InstallDir
lea ecx, [esp + 0x40]
call fcn.0040d790
lea eax, [esp + 0x54]
mov byte [esp + 0x720], 0x2f
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
call fcn.004246b0
lea ecx, [esp + 0x3c]
call fcn.0040d7f0
xor eax, eax
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
mov byte [esp + 0x720], 0x30
cmp dword [esp + 0x64], eax
je 0x4151bb
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00422690
add esp, 8
lea ecx, [esp + 0x6c]
push eax
call fcn.0040b320
lea ecx, [esp + 0x3c]
call fcn.00407ab0
push str._binldremoteuninst.exe
lea edx, [esp + 0x70]
lea ecx, [esp + 0x40]
call fcn.00411250
add esp, 4
push eax
mov byte [esp + 0x724], 0x31
call fcn.00424b70
add esp, 4
mov byte [esp + 0x720], 0x30
lea ecx, [esp + 0x3c]
mov bl, al
call fcn.00407ab0
lea ecx, [esp + 0x6c]
test bl, bl
je 0x41513d
push str._binldremoteuninst.exe
jmp 0x415142
push str.ldremoteuninst.exe
call fcn.00410620
cmp dword [esp + 0x80], 8
lea eax, [esp + 0x6c]
cmovae eax, dword [esp + 0x6c]
push eax
push str.remote_path__s
push 0xbc
push str.SimulatorFileCleaner::_runCleaning
call fcn.00420530
add esp, 0x10
lea ecx, [esp + 0x3c]
push str.__playeruninstall
call fcn.00407230
push 0
push 1
lea eax, [esp + 0x44]
mov byte [esp + 0x728], 0x32
push eax
lea eax, [esp + 0x78]
push eax
call fcn.00428bf0
add esp, 0x10
lea ecx, [esp + 0x3c]
call fcn.00407ab0
cmp dword [esp + 0x80], 8
jb 0x4151bb
push dword [esp + 0x6c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x80], 7
lea ecx, [esp + 0x14]
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
mov byte [esp + 0x720], 0x2c
call fcn.00424590
mov byte [esp + 0x720], 0x25
cmp dword [esp + 0x68], 0x10
jb 0x41522d
push dword [esp + 0x54]
call fcn.00473980
add esp, 4
jmp 0x41522d
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x41522d
mov eax, dword [0x515154]
mov edx, dword [ecx]
add eax, 0x14
push 0xc8
push eax
mov dword [0x515154], eax
lea eax, [esp + 0xbc]
push eax
call dword [edx + 0xc]
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x41523c
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esp + 0xb0], 8
jb 0x415255
push dword [esp + 0x9c]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0xb0], 7
cmp dword [esp + 0xc8], 8
mov dword [esp + 0xac], 0
mov word [esp + 0x9c], ax
jb 0x41528e
push dword [esp + 0xb4]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0xc8], 7
cmp dword [esp + 0x98], 8
mov dword [esp + 0xc4], 0
mov word [esp + 0xb4], ax
jb 0x4152c7
push dword [esp + 0x84]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0x98], 7
cmp dword [esp + 0xf8], 8
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
jb 0x415300
push dword [esp + 0xe4]
call fcn.00473980
add esp, 4
xor eax, eax
mov dword [esp + 0xf8], 7
cmp dword [esp + 0xe0], 8
mov dword [esp + 0xf4], 0
mov word [esp + 0xe4], ax
jb 0x415339
push dword [esp + 0xcc]
call fcn.00473980
add esp, 4
mov ecx, dword [esp + 0x718]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x700]
xor ecx, esp
call fcn.004921c3
mov esp, ebp
pop ebp
ret