Function at 0x40553e
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
lea eax, [ebp - 0x38]
push edi
mov ebx, ecx
push eax
mov dword [ebp - 0x24], ebx
call fcn.0045f431
lea ecx, [ebp - 0x20]
mov dword [esp], 0x4bc798
call fcn.004038b5
mov eax, dword [0x4af550]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.0045f621
pop ecx
pop ecx
push 0x138d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor esi, esi
push esi
push esi
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x4bc7a8], eax
mov eax, dword [0x4af550]
mov edi, 0x4c55b8
lea ecx, [ebp - 0x30]
push edi
mov dword [ebp - 0x34], eax
call fcn.004038b5
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00403a8c
push esi
push 0x4afcb4
call fcn.0048ef58
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00403a8c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 8], esi
push esi
lea ecx, [ebp - 0x1c]
call fcn.00403c58
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov edi, dword [ecx - 8]
mov ecx, dword [0x4af550]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
call fcn.0048e719
add esp, 0x10
test eax, eax
je 0x4056d0
lea eax, [ebp - 0x18]
lea ecx, [ebp - 4]
push eax
call fcn.004038b5
lea ecx, [ebp - 4]
call fcn.0040ae64
lea ecx, [ebp - 4]
call fcn.0040ae14
push esi
push 0x4afcb0
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
jne 0x40569b
push 1
push esi
lea ecx, [ebp - 4]
call fcn.0040aeae
cmp dword [ebp - 8], esi
je 0x4056b7
push esi
push 0x2a
lea ecx, [ebp - 4]
call fcn.0040ac91
test eax, eax
jne 0x405690
push 1
push esi
lea ecx, [ebp - 4]
call fcn.0040aeae
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
mov dword [ebx + 0x1c], esi
call fcn.004038b5
mov ecx, ebx
call fcn.00408e42
jmp 0x4056b7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4056b7
cmp dword [ebp - 8], esi
jne 0x4056b7
push 0xa0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 4]
call fcn.004038fb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp - 0xc]
jmp 0x405610
cmp dword [ebp - 8], esi
jne 0x4056ec
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], 1
mov dword [ebp - 0x2c], esi
call fcn.004038fb
jmp 0x4055eb
cmp dword [ebp - 0x14], esi
mov ecx, reloc.SHELL32.dll_SHChangeNotifyRegister
jne 0x4056f7
dec ecx
mov eax, dword [0x4bc7a0]
lea edx, [ebp - 8]
push edx
push 0xf003f
push esi
push eax
push ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405726
lea ecx, [ebp - 0x10]
call fcn.00405b3f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0x4afca0
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
mov ebx, 0x4c5710
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00403b20
push dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push 0x4afc8c
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00403b20
push dword [eax]
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push dword [0x4c5710]
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x10], esi
je 0x4057b1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
cmp dword [0x4bc7a8], esi
je 0x40581f
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
call fcn.0045fe40
mov eax, dword [eax]
pop ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
push 0xf003f
push esi
push eax
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4057f3
lea ecx, [ebp - 8]
call fcn.00405b3f
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea eax, [ebp - 0xc]
push eax
call fcn.0045fe53
pop ecx
push dword [eax]
lea ecx, [ebp - 8]
call fcn.00405b56
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.00405b3f
cmp dword [ebp - 0x14], esi
je 0x4059a9
push 1
mov ebx, str.Folder
pop edi
push esi
push edi
push ecx
mov dword [0x4bc7a4], edi
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x405860
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.Directory
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x40588f
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID20D04FE0_3AEA_1069_A2D8_08002B30309D
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x4058be
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID450D8FBA_AD25_11D0_98A8_0800361B1103
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x4058ed
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID645FF040_5081_101B_9F08_00AA002F954E
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x40591c
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID208D2C60_3AEA_1069_A2D7_08002B30309D
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x40594b
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
push esi
push edi
push ecx
mov ebx, str.CLSID46e06680_4bf0_11d1_83ee_00a0c90dc849
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x40597a
push esi
push esi
push ecx
mov ecx, esp
push ebx
call fcn.00403927
call fcn.0043a340
add esp, 0xc
push esi
push edi
push ecx
mov edi, str.CLSIDBDEADF00_C265_11D0_BCED_00A0C90AB50F
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a340
add esp, 0xc
cmp eax, esi
je 0x4059a9
push esi
push esi
push ecx
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a340
add esp, 0xc
mov edi, dword [ebp - 0x24]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push str.__seiteFreeware_
lea ecx, [ebp - 0x14]
call fcn.00403927
push str._Uninstall
lea ecx, [ebp - 4]
call fcn.00403927
push eax
lea eax, [ebp - 0x14]
push 0x4c55bc
push eax
lea eax, [ebp - 8]
push eax
call fcn.00415df1
pop ecx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00403b20
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
call fcn.0043a295
test eax, eax
je 0x405ac7
lea eax, [ebp - 0x238]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x238]
lea ecx, [ebp - 4]
push eax
call fcn.0040a529
lea eax, [ebp - 4]
push eax
call fcn.00478f67
lea ecx, [ebp - 0x14]
mov dword [esp], str.softwareok_tmp_link.url
call fcn.00403927
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x14]
call fcn.004038fb
push ecx
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004038b5
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.004043c8
pop ecx
pop ecx
push 3
push esi
push dword [ebp - 4]
push str.explorer.exe
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004038fb
jmp 0x405ada
push 3
push esi
push esi
push dword [ebp - 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00405c78
movzx ebx, word [ebp + 0xc]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x28]
call fcn.004038fb
cmp dword [ebp - 0x10], esi
je 0x405b06
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp - 0x30]
call fcn.004038fb
lea ecx, [ebp - 0x34]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x38]
call fcn.004038fb
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10