Function at 0x401b80
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407a35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push edi
mov dword [ebp - 0x404], ecx
mov dword [ebp - 0x13c], 0
lea ecx, [ebp - 0x144]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 2
mov byte [ebp - 0x13d], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x144]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x144]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 4
push str.SOFTWAREATI_TechnologiesInstalled_Drivers
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 0x148], 0
jmp 0x401c4f
mov eax, dword [ebp - 0x148]
add eax, 1
mov dword [ebp - 0x148], eax
mov ecx, 0x40c138
call fcn.00406720
cmp dword [ebp - 0x148], eax
jge 0x402093
push 0x4093bc
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x3f8]
push edx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x40c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x148]
push ecx
mov ecx, 0x40c14c
call fcn.00406760
mov ecx, eax
call fcn.00406810
push eax
mov edx, dword [ebp - 0x148]
push edx
mov ecx, 0x40c14c
call fcn.00406760
mov ecx, eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x3fc]
push ecx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x410], eax
mov edx, dword [ebp - 0x410]
mov dword [ebp - 0x414], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x130]
call fcn.00407554
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3fc]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::CString
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x148]
push ecx
mov ecx, 0x40c14c
call fcn.00406760
mov ecx, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
mov edx, dword [ebp - 0x148]
push edx
mov ecx, 0x40c138
call fcn.00406760
mov ecx, eax
call fcn.00406810
push eax
mov eax, dword [ebp - 0x148]
push eax
mov ecx, 0x40c138
call fcn.00406760
mov ecx, eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator_1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x148]
push ecx
mov ecx, 0x40c138
call fcn.00406760
mov ecx, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
lea edx, [ebp - 0x134]
push edx
lea ecx, [ebp - 0x14c]
call fcn.0040754e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14c]
call sub.MFC42.DLL_CString::MakeLower
push str.rundll
lea ecx, [ebp - 0x14c]
call fcn.00406850
push eax
call dword [sym.imp.msvcrt.dll_strstr]
add esp, 8
test eax, eax
je 0x401ed3
mov dword [ebp - 0x3f4], 0x94
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov cl, byte [0x4093c7]
mov byte [ebp - 0x35c], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x35b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x4093c8]
mov byte [ebp - 0x254], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x253]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 0x3e4], 2
jne 0x401e80
push 0x104
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4093cc
lea ecx, [ebp - 0x254]
push ecx
call sub.msvcrt.dll_strcat
add esp, 8
lea ecx, [ebp - 0x134]
call fcn.00406850
push eax
lea edx, [ebp - 0x254]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator_1
jmp 0x401ed3
push 0x104
lea ecx, [ebp - 0x35c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4093d0
lea edx, [ebp - 0x35c]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
lea ecx, [ebp - 0x134]
call fcn.00406850
push eax
lea eax, [ebp - 0x35c]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
lea ecx, [ebp - 0x35c]
push ecx
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator_1
push 0x4093d4
mov edx, dword [ebp - 0x148]
push edx
mov ecx, 0x40c14c
call fcn.00406760
mov ecx, eax
call fcn.00406860
test eax, eax
jne 0x401f7b
push str._force_restart
lea ecx, [ebp - 0x134]
call fcn.00406850
push eax
call dword [sym.imp.msvcrt.dll_strstr]
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x14], 0
je 0x401f47
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0xf
push edx
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x134]
call fcn.00406850
push eax
lea ecx, [ebp - 0x12c]
push ecx
call sub.msvcrt.dll_strcpy
add esp, 8
push str.__silent
lea edx, [ebp - 0x12c]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
jmp 0x40201a
push str.msiexec.exe
lea ecx, [ebp - 0x14c]
call fcn.00406850
push eax
call dword [sym.imp.msvcrt.dll_strstr]
add esp, 8
test eax, eax
je 0x401feb
push 0x409410
push 0x409414
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::Replace
push 0x409418
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator
push str._REBOOTReallySuppress
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x134]
call fcn.00406850
push eax
lea eax, [ebp - 0x12c]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
jmp 0x40201a
lea ecx, [ebp - 0x134]
call fcn.00406850
push eax
lea ecx, [ebp - 0x12c]
push ecx
call sub.msvcrt.dll_strcpy
add esp, 8
push str.__z_uui
lea edx, [ebp - 0x12c]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x12c]
push ecx
call fcn.004071b0
add esp, 0xc
mov dword [ebp - 0x138], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x18]
push edx
push 0xf003f
push 0
lea ecx, [ebp - 0x130]
call fcn.00406850
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40207f
push 0x40943c
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14c]
call sub.MFC42.DLL_CString::CString
jmp 0x401c40
mov dword [ebp - 0x400], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x400]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret