Function at 0x402df0
Capabilities:
Create process on windows
Delete file
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x6ac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x6a8], eax
push esi
xor eax, eax
mov byte [esp + 0x2c], 0
push 0xff
push eax
mov word [esp + 0x35], ax
mov byte [esp + 0x4b0], al
lea eax, [esp + 0x4b1]
push eax
call fcn.00409cc0
add esp, 0xc
mov byte [esp + 0x5a8], 0
lea eax, [esp + 0x5a9]
push 0xff
push 0
push eax
call fcn.00409cc0
add esp, 0xc
mov byte [esp + 0x3a8], 0
lea eax, [esp + 0x3a9]
push 0xff
push 0
push eax
call fcn.00409cc0
add esp, 0xc
push 0x104
push 0x421668
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
call fcn.00404943
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.004045c1
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x84]
push 0x14
push eax
call fcn.004045a4
push 0x421668
lea eax, [esp + 0x90]
push eax
push str.__s_LOG:_UninstallOldAC:_SysPath_s_n
push dword [0x421558]
call fcn.004042e7
push dword [0x421558]
call fcn.004040a1
add esp, 0x24
push 0x104
push 0x421770
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
call fcn.00404943
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.004045c1
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x84]
push 0x14
push eax
call fcn.004045a4
push 0x421770
lea eax, [esp + 0x90]
push eax
push str.__s_LOG:_UninstallOldAC:_WinPath_s_n
push dword [0x421558]
call fcn.004042e7
push dword [0x421558]
call fcn.004040a1
add esp, 0x24
lea eax, [esp + 0x3a8]
push eax
lea eax, [esp + 0x5ac]
push eax
lea eax, [esp + 0x4b0]
push eax
lea eax, [esp + 0x38]
push eax
push 0x421668
call fcn.004051a6
add esp, 0x14
lea eax, [esp + 0x2c]
push eax
push str._sProgram_FilesInfosafeSnlsp
push 0x421560
call fcn.00403f6a
add esp, 0xc
push 0
call fcn.00404943
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.004045c1
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x84]
push 0x14
push eax
call fcn.004045a4
push 0x421560
lea eax, [esp + 0x90]
push eax
push str.__s_LOG:_UninstallOldAC:_AppPath_s_n
push dword [0x421558]
call fcn.004042e7
push dword [0x421558]
call fcn.004040a1
add esp, 0x24
mov byte [esp + 0x198], 0
lea eax, [esp + 0x199]
push 0x103
push 0
push eax
call fcn.00409cc0
add esp, 0xc
lea eax, [esp + 0x198]
push str.C:InfosafeSnlsp
push eax
call fcn.00403f6a
push 0
call fcn.00404943
add esp, 0xc
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.004045c1
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x84]
push 0x14
push eax
call fcn.004045a4
lea eax, [esp + 0x1a8]
push eax
lea eax, [esp + 0x90]
push eax
push str.__s_LOG:_UninstallOldAC:_AppPath4Win7_s_n
push dword [0x421558]
call fcn.004042e7
push dword [0x421558]
call fcn.004040a1
add esp, 0x24
mov byte [esp + 0x2a0], 0
lea eax, [esp + 0x2a1]
push 0x103
push 0
push eax
call fcn.00409cc0
add esp, 0xc
lea eax, [esp + 0x2a0]
push str.StopService.txt
push 0x421560
push str._s_s
push eax
call fcn.00403f6a
lea ecx, [esp + 0x2b0]
call fcn.00401fb0
push 0x104
lea eax, [esp + 0x2b4]
push 0
push eax
call fcn.00409cc0
add esp, 0x1c
lea eax, [esp + 0x198]
push str.StopService.txt
push eax
lea eax, [esp + 0x2a8]
push str._s_s
push eax
call fcn.00403f6a
lea ecx, [esp + 0x2b0]
call fcn.00401fb0
call fcn.004020d0
mov ecx, 0x421560
call fcn.00402540
lea ecx, [esp + 0x1a8]
call fcn.00402540
push 0x103
lea eax, [esp + 0xa5]
mov byte [esp + 0xa4], 0
push 0
push eax
call fcn.00409cc0
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareInfoSafe_SoftwareASC
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40317b
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40345f
call fcn.004028e0
test al, al
jne 0x40345f
push str.Snetcfg_Uninstall.exe
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
push 0x44
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00409cc0
add esp, 0x1c
mov dword [esp + 0x30], 0x44
lea eax, [esp + 0x10]
xorps xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
push eax
lea eax, [esp + 0x34]
push eax
push 0x421668
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0xb0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403202
push 0x1388
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call fcn.00404943
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.004045c1
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x84]
push 0x14
push eax
call fcn.004045a4
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x90]
push eax
push str.__s_LOG:_UninstallOldAC:__s_n
push dword [0x421558]
call fcn.004042e7
push dword [0x421558]
call fcn.004040a1
add esp, 0x24
lea eax, [esp + 0x90]
push str.Snetcfg.exe
push 0x421668
push str._s_s__u
push eax
call fcn.00403f6a
push 0x44
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00409cc0
add esp, 0x1c
mov dword [esp + 0x30], 0x44
lea eax, [esp + 0x10]
xorps xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
push eax
lea eax, [esp + 0x34]
push eax
push 0x421668
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0xb0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4032de
push 0x1388
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call fcn.00404943
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.004045c1
add esp, 4
push eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x84]
push 0x14
push eax
call fcn.004045a4
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x90]
push eax
push str.__s_LOG:_UninstallOldAC:__s_n
push dword [0x421558]
call fcn.004042e7
push dword [0x421558]
call fcn.004040a1
add esp, 0x24
lea eax, [esp + 0x90]
push str.Snetcfg_Install.exe
push 0x421668
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.Snetcfg_Uninstall.exe
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.Snetcfg.exe
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.infoism.inf
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.infoism.sys
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.infoist.inf
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.driversinfoism.sys
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
mov ecx, str.truecrypt
call fcn.00402980
mov ecx, str.IsFilter
call fcn.00402980
push str.drivers_truecrypt.sys
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.isfilter.sys
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.isfilter.ini
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.IsFilterInstall.cmd
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.IsFilterUninstall.cmd
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
push str.driversisfilter.sys
push 0x421668
lea eax, [esp + 0x98]
push str._s_s
push eax
call fcn.00403f6a
add esp, 0x10
lea eax, [esp + 0x90]
push eax
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.SoftwareInfoSafe_SoftwareE
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallInstallShield_D70C5EBF_A36D_488E_A50E_B21E213AAA3F
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_ManagementARPCacheInstallShield_D70C5EBF_A36D_488E_A50E_B21E213AAA3F
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallD70C5EBF_A36D_488E_A50E_B21E213AAA3F
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallInstallShield_Uninstall_InformationD70C5EBF_A36D_488E_A50E_B21E213AAA3F
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallInstallShield_D70C5EBF_A36D_488E_A50E_B21E213AAA3F
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallC38FE80A_E5C7_4229_B374_87E985182F5E
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallInstallShield_Uninstall_InformationC38FE80A_E5C7_4229_B374_87E985182F5E
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallInstallShield_C38FE80A_E5C7_4229_B374_87E985182F5E
push 0x80000002
call esi
push 0x80000000
xor edx, edx
mov ecx, str.InstallerProductsFBE5C07DD63AE8845AE02BE112A3AAF3
call fcn.00402cd0
add esp, 4
xor edx, edx
mov ecx, str.SOFTWAREClassesInstallerProductsFBE5C07DD63AE8845AE02BE112A3AAF3
push 0x80000002
call fcn.00402cd0
add esp, 4
xor edx, edx
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_ManagementARPCacheD70C5EBF_A36D_488E_A50E_B21E213AAA3F
push 0x80000002
call fcn.00402cd0
add esp, 4
xor edx, edx
mov ecx, str.InstallerProductsA08EF83C7C5E92243B47789E5881F2E5
push 0x80000000
call fcn.00402cd0
add esp, 4
mov ecx, 0x421560
call fcn.00402a60
lea ecx, [esp + 0x198]
call fcn.00402a60
mov ecx, dword [esp + 0x6ac]
pop esi
xor ecx, esp
call fcn.00403f5b
mov esp, ebp
pop ebp
ret