Function at 0x4245d0
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file
Persist via lnk shortcut
Read .ini file
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ebb1
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x200e8
call fcn.0044c880
mov eax, dword [0x47b00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
mov dword [ebp - 0x20034], edi
test edi, edi
jne 0x42462a
or eax, 0xffffffff
jmp 0x426f94
lea ecx, [ebp - 0x2007c]
mov dword [ebp - 0x2007c], 0x423a
call fcn.0040e720
test eax, eax
je 0x42464c
push eax
call fcn.00430eef
add esp, 4
test byte [edi + 8], 1
je 0x42475e
push dword [edi + 0x24]
mov ecx, dword [edi + 0x1c]
call fcn.00414890
mov esi, eax
push 0xfffffffffffffff0
push esi
mov dword [ebp - 0x20044], esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x20028], eax
or eax, 8
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x40a
push esi
call edi
mov esi, dword [ebp - 0x20034]
xor edx, edx
push 0
push str.Creating_a_system_restore_point...
mov ecx, esi
call fcn.00426fc0
sub esp, 0x1c
lea ecx, [esi + 0x48]
xorps xmm0, xmm0
movq qword [ebp - 0x20070], xmm0
push 0
push 0
push 0
push str._install
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20070]
call fcn.0040ac30
sub esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20070]
call fcn.0040ae10
mov ecx, eax
call fcn.00422170
push 0
push 0
push 0x40a
push dword [ebp - 0x20044]
mov esi, eax
mov dword [ebp - 0x2001c], edx
call edi
mov eax, dword [ebp - 0x20028]
and eax, 0xfffffff7
push eax
push 0xfffffffffffffff0
push dword [ebp - 0x20044]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test esi, esi
jne 0x424746
cmp dword [ebp - 0x2001c], esi
jne 0x424746
lea ecx, [ebp - 0x20070]
call fcn.0040acf0
lea eax, [esi + 1]
jmp 0x426f94
lea ecx, [ebp - 0x20070]
mov dword [ebp - 4], 0xffffffff
call fcn.0040acf0
mov edi, dword [ebp - 0x20034]
lea esi, [edi + 0x30]
mov ecx, esi
mov dword [ebp - 0x20044], esi
call fcn.0040ae10
or edx, 0xffffffff
mov ecx, eax
call fcn.00412990
test al, al
jne 0x424786
mov eax, 2
jmp 0x426f94
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push str.Installing_application_files...
mov edx, 0xa
mov ecx, edi
call fcn.00426fc0
xor edi, edi
push 0
push str.UVK_Ultra_GUI
call dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.Log_analyzerW
mov dword [ebp - 0x2001c], eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [ebp - 0x2001c]
mov dword [ebp - 0x20028], eax
test ecx, ecx
jne 0x4247d9
test eax, eax
je 0x424817
jmp 0x4247f6
push 0
push 0xf060
push 0x112
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x20028]
test eax, eax
je 0x424809
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x4247a3
mov ecx, 0x470a94
call fcn.00413420
mov ecx, 0x470aac
call fcn.00413420
mov ecx, 0x470ad0
call fcn.00413420
xorps xmm0, xmm0
lea ecx, [ebp - 0x20078]
movq qword [ebp - 0x20078], xmm0
call fcn.0040abc0
xorps xmm0, xmm0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20020]
movq qword [ebp - 0x20020], xmm0
call fcn.0040abc0
xorps xmm0, xmm0
lea ecx, [ebp - 0x2002c]
movq qword [ebp - 0x2002c], xmm0
call fcn.0040abc0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20070]
movq qword [ebp - 0x20070], xmm0
call fcn.0040abc0
sub esp, 0x1c
mov byte [ebp - 4], 4
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x20040], xmm0
push 0
push 0
push 0
push str.UVK.zip
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ac30
lea ecx, [ebp - 0x20040]
mov byte [ebp - 4], 5
call fcn.0040ae10
push eax
push 0xa
push 0xcd
push 0
call fcn.0041a8d0
mov ecx, esi
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
mov ecx, eax
call fcn.00420ce0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
xorps xmm0, xmm0
mov dword [ebp - 0x20088], 0
lea ecx, [ebp - 0x200a0]
movq qword [ebp - 0x20090], xmm0
movups xmmword [ebp - 0x200a0], xmm0
call fcn.00411b80
sub esp, 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2002c]
mov byte [ebp - 0x200f5], 1
push 0x23
call fcn.0040b000
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKUltra_Adware_Killer
lea ecx, [ebp - 0x2002c]
call fcn.0040ba50
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20078]
call fcn.0040adb0
lea ecx, [ebp - 0x20078]
call fcn.0040ae10
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [ebp - 0x20034]
test eax, eax
je 0x424a2b
push 0
lea ecx, [ebp - 0x20078]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200a0]
call fcn.00411d20
test eax, eax
je 0x424a12
push ecx
lea eax, [ebp - 0x20078]
push eax
lea ecx, [ebp - 0x200a0]
call fcn.00412070
test eax, eax
je 0x424a12
lea ecx, [ebp - 0x20078]
call fcn.0040b570
call fcn.0044d161
cmp eax, 0x405
setb byte [ebp - 0x200f5]
push ecx
lea ecx, [ebp - 0x200a0]
call fcn.00412460
cmp byte [ebp - 0x200f5], 0
je 0x424be3
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.zip
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
or edx, 0xffffffff
mov ecx, eax
call fcn.00412990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb2.dat
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20070]
call fcn.0040adb0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
push eax
push 0xa
push 0xce
push 0
call fcn.0041a8d0
test al, al
je 0x424ad3
lea ecx, [ebp - 0x20070]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
mov ecx, eax
call fcn.00420ce0
lea ecx, [ebp - 0x20070]
call fcn.0040ae10
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
or eax, 2
lea ecx, [ebp - 0x20070]
push eax
call fcn.0040ae10
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAKdb.txt
lea ecx, [ebp - 0x2002c]
call fcn.0040ba50
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push 2
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200a0]
call fcn.00411d20
movsd xmm1, qword [0x472eb0]
lea ecx, [ebp - 0x20020]
call fcn.0040b1b0
lea eax, [ebp - 0x20020]
push eax
lea ecx, [ebp - 0x200a0]
call fcn.004121c0
push ecx
lea ecx, [ebp - 0x200a0]
call fcn.00412460
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
call edi
or eax, 2
lea ecx, [ebp - 0x2002c]
push eax
call fcn.0040ae10
push eax
call esi
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
mov edi, dword [ebp - 0x20034]
mov esi, dword [ebp - 0x20044]
sub esp, 0x1c
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0x20048], xmm0
push 0
push 0
push 0
push str.UVK_en.exe
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20048]
call fcn.0040ac30
lea ecx, [ebp - 0x20048]
mov byte [ebp - 4], 7
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
call fcn.00412950
push ecx
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
test al, al
je 0x424d9a
push str.UVK_x64_.exe
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
push 1
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push 1
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
jmp 0x424ecc
push str.UVK.exe
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
push 1
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x64_.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec_x64_.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_x86_.dll
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.dll
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
push 1
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
sub esp, 8
lea ecx, [ebp - 0x2002c]
push 0x23
call fcn.0040b000
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKImmunizationRebootExec.exe
lea ecx, [ebp - 0x2002c]
call fcn.0040ba50
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
je 0x424f65
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
mov edx, 0x14
mov ecx, edi
call fcn.00426fc0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._bluescreenview.zip
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040adb0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
push eax
push 0xa
push 0xc9
push 0
call fcn.0041a8d0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
mov ecx, eax
call fcn.00420ce0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push 0
push 0
mov edx, 0x1e
mov ecx, edi
call fcn.00426fc0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanup_tool.zip
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040adb0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
push eax
push 0xa
push 0xca
push 0
call fcn.0041a8d0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
mov ecx, eax
call fcn.00420ce0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push 0
push 0
mov edx, 0x28
mov ecx, edi
call fcn.00426fc0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Pictures.zip
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040adb0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
push eax
push 0xa
push 0xcb
push 0
call fcn.0041a8d0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
mov ecx, eax
call fcn.00420ce0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesAbstract.jpg
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
push 0x46e808
push 0x65
push 0
call fcn.0041a8d0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.PicturesUVK.png
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
push 0x46e808
push 0x66
push 0
call fcn.0041a8d0
push 0
push 0
mov edx, 0x3c
mov ecx, edi
call fcn.00426fc0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Icons.zip
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040adb0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
push eax
push 0xa
push 0xcc
push 0
call fcn.0041a8d0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
mov ecx, eax
call fcn.00420ce0
lea ecx, [ebp - 0x20040]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
cmp dword [edi + 0xc], 0
je 0x425785
push 0
push str.Installing_license_information...
mov edx, 0x46
mov ecx, edi
call fcn.00426fc0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.key.uvkey
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [edi + 0x38]
call fcn.0040ae10
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [edi + 0xc], 2
jne 0x425375
lea ecx, [edi + 0x40]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x425375
lea eax, [edi + 0x40]
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040ac80
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040aee0
sub esp, 0x28
lea ecx, [edi + 0x30]
push 0x46dcd0
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040bd60
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [edi + 0x40]
call fcn.0040ae10
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x2002c]
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ac80
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.BrandIco.ico
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
movaps xmm0, xmmword [0x472f10]
lea ecx, [ebp - 0x2002c]
movups xmmword [ebp - 0x200ec], xmm0
mov dword [ebp - 0x200dc], 0x100
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
lea eax, [ebp - 0x200ec]
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
lea ecx, [ebp - 0x20020]
mov esi, eax
call fcn.0040ae10
mov edx, esi
mov ecx, eax
call fcn.00422070
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSettings.ini
lea ecx, [edi + 0x58]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
cmp dword [edi + 0x10], 0
je 0x425405
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x425405
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSettings.ini
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAK_White_list.ini
lea ecx, [edi + 0x58]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
cmp dword [edi + 0x10], 0
je 0x4254ea
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x4254ea
sub esp, 8
lea ecx, [ebp - 0x2002c]
push 0x23
call fcn.0040b000
test al, al
je 0x4254ea
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKUltra_Adware_KillerSettings
lea ecx, [ebp - 0x2002c]
call fcn.0040ba50
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00412990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WhiteList.ini
lea ecx, [ebp - 0x2002c]
call fcn.0040ba50
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_SU_whitelist.ini
lea ecx, [edi + 0x58]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
cmp dword [edi + 0x10], 0
je 0x425785
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x425785
sub esp, 8
lea ecx, [ebp - 0x2002c]
push 0x23
call fcn.0040b000
test al, al
je 0x425785
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVKSmart_uninstaller
lea ecx, [ebp - 0x2002c]
call fcn.0040ba50
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00412990
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Whitelist.ini
lea ecx, [ebp - 0x2002c]
call fcn.0040ba50
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
call esi
test eax, eax
jne 0x4255fd
xorps xmm0, xmm0
mov dword [ebp - 0x200dc], eax
push 0x22
lea ecx, [ebp - 0x2002c]
movq qword [ebp - 0x200e4], xmm0
movups xmmword [ebp - 0x200f4], xmm0
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200f4]
call fcn.00411ba0
lea ecx, [ebp - 0x200f4]
call fcn.0041c0a0
lea eax, [ebp - 0x20018]
xorps xmm0, xmm0
lea ecx, [ebp - 0x20050]
mov dword [ebp - 0x20034], eax
movq qword [ebp - 0x20050], xmm0
call fcn.0040abc0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20058]
movq qword [ebp - 0x20058], xmm0
call fcn.0040abc0
lea ecx, [ebp - 0x20020]
mov byte [ebp - 4], 9
call fcn.0040ae10
push eax
push 0x10000
lea eax, [ebp - 0x20018]
push eax
push str.Whitelisted
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x4256cb
lea eax, [ebp - 0x20058]
push eax
lea edx, [ebp - 0x20050]
lea ecx, [ebp - 0x20018]
call fcn.004223b0
test al, al
je 0x4256cb
nop dword [eax]
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
push str.Whitelisted
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20058]
push eax
lea edx, [ebp - 0x20050]
lea ecx, [ebp - 0x20034]
call fcn.00422380
test al, al
jne 0x425680
lea eax, [ebp - 0x20018]
lea ecx, [ebp - 0x20020]
mov dword [ebp - 0x20034], eax
call fcn.0040ae10
push eax
push 0x10000
lea eax, [ebp - 0x20018]
push eax
push str.Blacklisted
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x42576b
lea eax, [ebp - 0x20058]
push eax
lea edx, [ebp - 0x20050]
lea ecx, [ebp - 0x20018]
call fcn.004223b0
test al, al
je 0x42576b
nop word [eax + eax]
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
push str.Blacklisted
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20058]
push eax
lea edx, [ebp - 0x20050]
lea ecx, [ebp - 0x20034]
call fcn.00422380
test al, al
jne 0x425720
lea ecx, [ebp - 0x20058]
call fcn.0040acf0
lea ecx, [ebp - 0x20050]
mov byte [ebp - 4], 7
call fcn.0040acf0
push 0
push str.Writing_registry_information...
mov edx, 0x50
mov ecx, edi
call fcn.00426fc0
push 0x20019
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20024]
mov dword [ebp - 0x20024], 0
call fcn.0040d5b0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20050]
movq qword [ebp - 0x20050], xmm0
call fcn.0040abc0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20068]
movq qword [ebp - 0x20068], xmm0
call fcn.0040abc0
lea eax, [edi + 0x48]
mov byte [ebp - 4], 0xc
xorps xmm0, xmm0
lea ecx, [ebp - 0x20060]
push eax
movq qword [ebp - 0x20060], xmm0
call fcn.0040abd0
lea ecx, [ebp - 0x20060]
mov byte [ebp - 4], 0xd
call fcn.0041b7d0
sub esp, 8
lea ecx, [ebp - 0x20050]
push 0x10
call fcn.0040b000
sub esp, 8
lea ecx, [ebp - 0x20068]
push 0x19
call fcn.0040b000
cmp dword [edi + 0x14], 0
jne 0x425840
cmp dword [edi + 0x18], 0
je 0x425aca
lea eax, [ebp - 0x20020]
push eax
push str.DisplayName
lea ecx, [ebp - 0x20024]
call fcn.0040d760
test al, al
je 0x425aca
lea ecx, [ebp - 0x20020]
call fcn.0040ad50
test eax, eax
je 0x425aca
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
jne 0x4259fd
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
jne 0x4259fd
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
jne 0x4259fd
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
jne 0x4259fd
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
jne 0x4259fd
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str..lnk
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
jne 0x4259fd
and dword [edi + 8], 0xffffffef
mov edx, 0x46cc74
mov ecx, str.HKCR64_shellForce_Deletecommand
call fcn.0040e8b0
test al, al
jne 0x425a27
mov edx, 0x46cc74
mov ecx, str.HKCR_shellDelete_with_UVKcommand
call fcn.0040e8b0
test al, al
jne 0x425a27
and dword [edi + 8], 0xfffffffb
mov edx, 0x46cc74
mov ecx, str.HKCR.uvk
call fcn.0040e8b0
test al, al
jne 0x425a51
mov edx, 0x46cc74
mov ecx, str.HKCRUVKCommandsScript
call fcn.0040e8b0
test al, al
jne 0x425a51
and dword [edi + 8], 0xfffffff7
push 0x20019
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20024]
mov dword [ebp - 0x20030], 0
call fcn.0040d5f0
lea eax, [ebp - 0x20030]
push eax
push str.AutoUpdate
lea ecx, [ebp - 0x20024]
call fcn.0040d8a0
test al, al
je 0x425a94
cmp dword [ebp - 0x20030], 0
jne 0x425a98
and dword [edi + 8], 0xffffffdf
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 0
push eax
push str.ShowTooltips
lea ecx, [ebp - 0x20024]
call fcn.0040d8a0
test al, al
je 0x425ac6
cmp dword [ebp - 0x20030], 0
jne 0x425aca
and dword [edi + 8], 0xffffffbf
sub esp, 0x1c
lea ecx, [ebp - 0x20048]
xorps xmm0, xmm0
movq qword [ebp - 0x20084], xmm0
push 0
push 0
push 0
push str.__Uninst
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20084]
call fcn.0040ac30
sub esp, 0x1c
mov byte [ebp - 4], 0xe
cmp dword [edi + 0xc], 2
mov ecx, 0x470a94
mov eax, str.Brandico.ico
xorps xmm0, xmm0
cmovne eax, ecx
movq qword [ebp - 0x20058], xmm0
push 0
push 0
push eax
push 0x46dcd0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20058]
call fcn.0040ac30
push ecx
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 0xf
call fcn.0040ae10
push eax
push 1
push str.DisplayName
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionUninstallUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push 0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
push 1
push str.InstallLocation
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea ecx, [ebp - 0x20084]
call fcn.0040ae10
push eax
push 1
push str.UninstallString
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
push 1
push str.DisplayIcon
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea ecx, [edi + 0x68]
call fcn.0040ae10
push eax
push 1
push str.Publisher
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
push 0x4710dc
push 1
push str.DisplayVersion
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
lea ecx, [edi + 0x30]
call fcn.0040ae10
mov ecx, eax
call fcn.00411310
shrd eax, edx, 0xa
push 0
mov dword [ebp - 0x20030], eax
lea ecx, [ebp - 0x20024]
lea eax, [ebp - 0x20030]
shr edx, 0xa
push eax
push 4
push str.EstimatedSize
call fcn.0040daa0
push 0
push str.http:__www.carifred.com_uvk_help
push 1
push str.HelpLink
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
push str.http:__www.carifred.com_uvk
push 1
push str.URLInfoAbout
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 1
push eax
push 4
push str.NoModify
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea eax, [ebp - 0x20030]
push eax
push 4
push str.NoRepair
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 7
push eax
push 4
push str.VersionMajor
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 4
push eax
push 4
push str.VersionMinor
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push ecx
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
push 1
push 0x46cc74
push str.HKLM64SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsUVK_en.exe
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push 0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
push 1
push str.Path
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push str.HKCRShellDelete_with_UVK
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKCRShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKCRDirectoryShellDelete_with_UVK
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKCRDirectoryShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKCRShellFile_Information
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push 0
push 0
mov edx, 0x55
mov ecx, edi
call fcn.00426fc0
test byte [edi + 8], 4
je 0x425ee1
push ecx
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push ecx
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Delete
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push ecx
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
push 1
push str.Icon
push str.HKLM64SOFTWAREClassesShellFile_Information
lea ecx, [ebp - 0x20024]
call fcn.0040db30
sub esp, 0x1c
lea ecx, [ebp - 0x20048]
xorps xmm0, xmm0
movq qword [ebp - 0x20038], xmm0
push 0
push 0
push str.____1_
call fcn.0040ae10
push eax
push 0x46e4e4
lea ecx, [ebp - 0x20038]
call fcn.0040ac30
push ecx
lea ecx, [ebp - 0x20038]
mov byte [ebp - 4], 0x10
call fcn.0040ae10
push eax
push 1
push 0x46cc74
push str.HKLM64SOFTWAREClassesShellForce_Deletecommand
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push ecx
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
push 1
push 0x46cc74
push str.HKLM64SOFTWAREClassesDirectoryShellForce_Deletecommand
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___FileInfo___1_
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
push 0x46e4e4
lea ecx, [ebp - 0x20038]
call fcn.0040adb0
push ecx
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
push 1
push 0x46cc74
push str.HKLM64SOFTWAREClassesShellFile_Informationcommand
lea ecx, [ebp - 0x20024]
call fcn.0040db30
lea ecx, [ebp - 0x20038]
mov byte [ebp - 4], 0xf
call fcn.0040acf0
push str.HKCRUVKCommandsFile
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKLM64SOFTWAREClassesUVKCommandsScriptDefaultIcon
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKLM64SOFTWAREClassesSrSettingsFileDefaultIcon
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
cmp dword [edi + 0xc], 2
jne 0x425f2a
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
mov dword [ebp - 0x20034], eax
jmp 0x425f34
mov dword [ebp - 0x20034], 0
test byte [edi + 8], 8
je 0x42606d
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___readfile___1_
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
push 0x46e4e4
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
push dword [ebp - 0x20034]
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
push str.UVK_commands_script
mov edx, str.UVKCommandsScript
mov ecx, str..uvk
call fcn.0041b320
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___ImportSr___1_
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
push 0x46e4e4
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
push dword [ebp - 0x20034]
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
push str.System_repair_settings_file
mov edx, str.SrSettingsFile
mov ecx, str..uvksr
call fcn.0041b320
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe_
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
push 0x46e4e4
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.___1_
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
call fcn.0041b640
jmp 0x4260ad
push str.HKCR.uvk
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKCRUVKCommandsScript
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKCR.uvksr
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push str.HKCRSrSettingsFile
lea ecx, [ebp - 0x20024]
call fcn.0040dc90
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.____1_
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
push 0x46e4e4
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
push dword [ebp - 0x20034]
push ecx
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
push str.UVK_license_key
mov edx, str.UVKLicenseKey
mov ecx, str..uvkey
call fcn.0041b320
mov eax, dword [edi + 8]
shr eax, 5
and eax, 1
push ecx
mov dword [ebp - 0x20030], eax
lea ecx, [ebp - 0x20024]
lea eax, [ebp - 0x20030]
push eax
push 4
push str.AutoUpdate
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
call fcn.0040db30
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x20024]
shr eax, 6
and eax, 1
push 0
mov dword [ebp - 0x20030], eax
lea eax, [ebp - 0x20030]
push eax
push 4
push str.ShowTooltips
call fcn.0040daa0
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x20024]
shr eax, 4
and eax, 1
push 0
mov dword [ebp - 0x20030], eax
lea eax, [ebp - 0x20030]
push eax
push 4
push str.DesktopShortcut
call fcn.0040daa0
push 0
lea ecx, [edi + 0x60]
call fcn.0040ae10
push eax
push 1
push str.InstallSource
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push 0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
push 1
push str.InstallDir
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push str.GuiBkColor
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push str.GroupBorderColor
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push str.GroupBkColor
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push str.ButtonColor0
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push str.ButtonColor1
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push str.ButtonColor2
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push str.ButtonColor3
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push str.PortableVersion
lea ecx, [ebp - 0x20024]
call fcn.0040dc20
push 0
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 1
push eax
push 4
push str.EulaAccepted
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
push str.TBinder
push str.HKLM64SOFTWAREMicrosoftDataAccessRootBinder
lea ecx, [ebp - 0x20024]
call fcn.0040dc50
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemBooster
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
push 0xf003f
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20024]
call fcn.0040d5f0
test al, al
je 0x426318
lea eax, [ebp - 0x2002c]
push eax
push str.JunkFileExtensions
lea ecx, [ebp - 0x20024]
call fcn.0040d760
test al, al
je 0x426318
push 0
push 0
push 0x46e198
push str.bak
lea ecx, [ebp - 0x2002c]
call fcn.0040bea0
push 0
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
push 1
push str.JunkFileExtensions
lea ecx, [ebp - 0x20024]
call fcn.0040daa0
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
mov ecx, eax
call fcn.0041ab20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov ecx, eax
call fcn.0041ab20
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RebootExec.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov ecx, eax
call fcn.0041ab20
sub esp, 0xc
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
mov edx, str.Ultra_virus_killer
mov ecx, eax
call fcn.00412dd0
call fcn.0041ac20
push 0
push str.Creating_shortcuts...
mov edx, 0x5a
mov ecx, edi
call fcn.00426fc0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20038]
movq qword [ebp - 0x20038], xmm0
call fcn.0040abc0
sub esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x20038]
push 2
call fcn.0040b000
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x42645a
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x4264b2
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471c28
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x42650a
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471c70
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426562
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x4265c4
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
sub esp, 8
lea ecx, [ebp - 0x20038]
push 0x17
call fcn.0040b000
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x42662c
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426684
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471c28
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x4266dc
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471c70
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426734
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 2
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426796
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
mov edx, 6
mov ecx, eax
call fcn.00411570
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
or edx, 0xffffffff
mov ecx, eax
call fcn.00412990
push 0
push 0
mov edx, 0x5f
mov ecx, edi
call fcn.00426fc0
push 0x38
lea eax, [ebp - 0x200d8]
push 0
push eax
call fcn.00435ae0
add esp, 0xc
lea ecx, [ebp - 0x200d8]
call fcn.004107e0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x20060]
mov byte [ebp - 4], 0x12
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20020]
call fcn.0040ba50
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410980
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410a80
push ecx
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410ad0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410b20
sub esp, 8
lea ecx, [ebp - 0x200d8]
call fcn.00410b00
lea ecx, [ebp - 0x200d8]
call fcn.00410b50
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.lnk
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Log_analyzer.exe
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410980
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410a80
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410b20
lea ecx, [ebp - 0x200d8]
call fcn.00410b50
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Uninstall.lnk
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20038]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410980
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410a80
push ecx
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410ad0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410b20
push ecx
lea ecx, [ebp - 0x200d8]
call fcn.00410ab0
lea ecx, [ebp - 0x200d8]
call fcn.00410b50
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426a39
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426a8e
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471cf8
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426ae3
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471d30
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426b38
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20050]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426b9a
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426bef
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
test byte [edi + 8], 0x10
je 0x426c09
push 0x46f32c
lea ecx, [ebp - 0x20060]
call fcn.0040acc0
test al, al
je 0x426c5e
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK___Ultra_Virus_Killer.lnk
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426c5e
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471cf8
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426cb3
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x471d30
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426d08
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..lnk
lea ecx, [ebp - 0x20060]
call fcn.0040ae10
push eax
push 0x46dcd0
lea ecx, [ebp - 0x20068]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
test byte [edi + 8], 0x10
lea ecx, [ebp - 0x20020]
je 0x426db1
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410980
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410a80
push ecx
lea ecx, [ebp - 0x20058]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410ad0
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x200d8]
call fcn.00410b20
lea ecx, [ebp - 0x200d8]
call fcn.00410b50
jmp 0x426dd1
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426dd1
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
xor edx, edx
mov ecx, eax
call fcn.00411570
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UVK_SR_settings.uvksr
lea ecx, [edi + 0x58]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20020]
call fcn.0040adb0
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
call esi
test eax, eax
je 0x426e8f
push ecx
lea eax, [ebp - 0x20030]
mov dword [ebp - 0x20030], 1
push eax
push 4
push str.AutoLoadLastSR
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SystemRepair
push str.HKLM64SOFTWAREUVK___Ultra_virus_killer
lea ecx, [ebp - 0x2002c]
call fcn.0040adb0
push ecx
lea ecx, [ebp - 0x20020]
call fcn.0040ae10
push eax
push 1
push str.LastSRFile
lea ecx, [ebp - 0x2002c]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20024]
call fcn.0040db30
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 1
push 0
xor edx, edx
mov ecx, edi
call fcn.00426fc0
test byte [edi + 8], 2
je 0x426ed1
sub esp, 8
lea ecx, [edi + 0x30]
call fcn.0040ae10
push eax
lea ecx, [ebp - 0x20048]
call fcn.0040ae10
mov ecx, eax
call fcn.00412610
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x200d8]
call fcn.00410b80
lea ecx, [ebp - 0x20038]
call fcn.0040acf0
lea ecx, [ebp - 0x20058]
call fcn.0040acf0
lea ecx, [ebp - 0x20084]
call fcn.0040acf0
lea ecx, [ebp - 0x20060]
call fcn.0040acf0
lea ecx, [ebp - 0x20068]
call fcn.0040acf0
lea ecx, [ebp - 0x20050]
call fcn.0040acf0
lea ecx, [ebp - 0x20024]
call fcn.0040d630
lea ecx, [ebp - 0x20048]
call fcn.0040acf0
lea ecx, [ebp - 0x20098]
call fcn.0040c690
mov eax, dword [ebp - 0x200a0]
cmp eax, 0xffffffff
je 0x426f5b
test eax, eax
je 0x426f5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20040]
call fcn.0040acf0
lea ecx, [ebp - 0x20070]
call fcn.0040acf0
lea ecx, [ebp - 0x2002c]
call fcn.0040acf0
lea ecx, [ebp - 0x20020]
call fcn.0040acf0
lea ecx, [ebp - 0x20078]
call fcn.0040acf0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00430eab
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4