Function at 0x411bd0
Capabilities:
Delete file
Delete registry key
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bdb1
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x284], cl
push str.CUninstallUtil::uninstallApplication
push str._s_enter_
push str.uninstall_util
call fcn.00402320
add esp, 0xc
push str.GlobalExit_7a176276_e800_4daa_b5e8_7febbd3efc4a
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
jne 0x411c5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialized_app_exit_event___d_
push str.uninstall_util
call fcn.0040bc30
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x411c79
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00411980
push str.GlobalKNIT_NFS_EXIT_CD1DF70D_8191_4840_B884_76C2620B8ED3
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
jne 0x411cb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialize_network_exit_event___d_
push str.uninstall_util
call fcn.0040bc30
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
jmp 0x411cc9
push esi
call ebx
push 0x1f4
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0x88
mov dword [ebp - 0x28c], 0
mov dword [ebp - 4], 0
call fcn.00419548
mov esi, eax
add esp, 4
mov dword [ebp - 0x220], esi
push 0x88
push 0
push esi
mov byte [ebp - 4], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, esi
push 0
call fcn.0040bcc0
mov ebx, eax
mov byte [ebp - 4], 0
mov ecx, ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
call fcn.0040c7e0
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push 4
push eax
call fcn.0040c3c0
call fcn.0040fcb0
add esp, 0x18
push str.GlobalExit_7a176276_e800_4daa_b5e8_7febbd3efc4a
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x411d5f
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
jmp 0x411d78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialized_app_exit_event___d_
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push 0xa
push eax
call fcn.0040c3c0
call fcn.0040fcb0
add esp, 0x18
mov ecx, ebx
sub esp, 0x18
mov eax, esp
push 0x11
push eax
call fcn.0040c3c0
call fcn.0040fcb0
add esp, 0x18
mov ecx, ebx
call fcn.0040e740
sub esp, 0x18
cmp byte [ebp - 0x284], 0
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
je 0x411f76
cmp dword [ecx + 0x14], 0x10
jb 0x411dd7
mov eax, dword [ecx]
jmp 0x411dd9
mov eax, ecx
push 0xffffffffffffffff
push 0
push 0x4289e8
mov byte [eax], 0
call fcn.00404520
call fcn.0040fae0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x411e0f
mov eax, dword [ecx]
jmp 0x411e11
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 1
mov ecx, ebx
call fcn.0040d240
mov ecx, ebx
call fcn.0040e0a0
mov ecx, ebx
call fcn.0040d190
xor eax, eax
lea edi, [ebp - 0x21c]
push eax
mov ecx, 0x82
rep stosd dword es:[edi], eax
push 0x19
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], 0
mov word [ebp - 0x244], ax
cmp word [ebp - 0x21c], ax
jne 0x411e82
xor ecx, ecx
jmp 0x411e9f
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411e90
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x244]
call fcn.00403fe0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x234], 0
jbe 0x411f4e
push 0x19
push str.Windows_Provisioning.lnk
lea ecx, [ebp - 0x244]
call fcn.00404200
cmp dword [ebp - 0x230], 8
lea ecx, [ebp - 0x280]
lea eax, [ebp - 0x244]
cmovae eax, dword [ebp - 0x244]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64i32]
add esp, 8
test eax, eax
jne 0x411f4e
lea edx, [ebp - 0x244]
lea ecx, [ebp - 0x268]
call fcn.00405950
cmp dword [eax + 0x14], 0x10
jb 0x411f17
mov eax, dword [eax]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 0x254]
add esp, 4
mov esi, eax
cmp ecx, 0x10
jb 0x411f3b
inc ecx
push ecx
push dword [ebp - 0x268]
call fcn.00402b40
push esi
push str.Delete_icon:__d
push str.uninstall_util
call fcn.00402320
add esp, 0xc
call fcn.00418f70
call fcn.00414550
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x230]
cmp eax, 8
jb 0x411f9a
inc eax
push eax
push dword [ebp - 0x244]
call fcn.00402ae0
jmp 0x411f9a
cmp dword [ecx + 0x14], 0x10
jb 0x411f80
mov eax, dword [ecx]
jmp 0x411f82
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 0
mov ecx, ebx
call fcn.0040d240
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push 4
push eax
call fcn.0040c3c0
call fcn.0040fae0
add esp, 0x18
mov ecx, ebx
sub esp, 0x18
mov eax, esp
push 0xa
push eax
call fcn.0040c3c0
call fcn.0040fae0
add esp, 0x18
mov ecx, ebx
call fcn.0040f940
call fcn.0040f670
xorps xmm0, xmm0
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x22c]
movq qword [ebp - 0x22c], xmm0
call fcn.0040f4a0
mov edi, dword [ebp - 0x228]
mov esi, dword [ebp - 0x22c]
mov dword [ebp - 0x220], edi
cmp edi, esi
je 0x412263
mov byte [ebp - 4], 4
mov esi, dword [edi - 4]
mov ecx, esi
call fcn.0040c7e0
sub esp, 0x18
mov ecx, esi
mov eax, esp
push 4
push eax
call fcn.0040c3c0
call fcn.0040fcb0
add esp, 0x18
push str.GlobalExit_7a176276_e800_4daa_b5e8_7febbd3efc4a
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
test ebx, ebx
je 0x41205a
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412073
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialized_app_exit_event___d_
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
sub esp, 0x18
mov ecx, esi
mov eax, esp
push 0xa
push eax
call fcn.0040c3c0
call fcn.0040fcb0
add esp, 0x18
mov ecx, esi
sub esp, 0x18
mov eax, esp
push 0x11
push eax
call fcn.0040c3c0
call fcn.0040fcb0
add esp, 0x18
mov ecx, esi
call fcn.0040e740
push 0x17
xor eax, eax
mov dword [ebp - 0x230], 7
push str.SOFTWAREClassesCLSID_
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x234], 0
mov word [ebp - 0x244], ax
call fcn.00403fe0
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x10]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x244]
call fcn.00404320
cmp dword [ebp - 0x230], 8
lea eax, [ebp - 0x244]
cmovae eax, dword [ebp - 0x244]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x230]
cmp eax, 8
jb 0x41212a
inc eax
push eax
push dword [ebp - 0x244]
call fcn.00402ae0
sub esp, 0x18
cmp byte [ebp - 0x284], 0
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
je 0x4121ab
cmp dword [ecx + 0x14], 0x10
jb 0x412150
mov eax, dword [ecx]
jmp 0x412152
mov eax, ecx
push 0xffffffffffffffff
push 0
push 0x4289e8
mov byte [eax], 0
call fcn.00404520
call fcn.0040fae0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x412188
mov eax, dword [ecx]
jmp 0x41218a
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 1
mov ecx, esi
call fcn.0040d240
mov ecx, esi
call fcn.0040e0a0
jmp 0x4121cf
cmp dword [ecx + 0x14], 0x10
jb 0x4121b5
mov eax, dword [ecx]
jmp 0x4121b7
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 0
mov ecx, esi
call fcn.0040d240
sub esp, 0x18
mov ecx, esi
mov eax, esp
push 4
push eax
call fcn.0040c3c0
call fcn.0040fae0
add esp, 0x18
mov ecx, esi
sub esp, 0x18
mov eax, esp
push 0xa
push eax
call fcn.0040c3c0
call fcn.0040fae0
add esp, 0x18
mov ecx, esi
call fcn.0040f940
call fcn.0040f670
mov ebx, dword [ebp - 0x290]
sub edi, 4
mov dword [ebp - 4], 3
jmp 0x411ffa
cmp esi, dword [ebp - 0x228]
je 0x41229c
nop dword [eax + eax]
mov edi, dword [esi]
test edi, edi
je 0x41228b
mov ecx, edi
call fcn.0040c100
push 0x88
push edi
call fcn.00419580
add esp, 8
add esi, 4
cmp esi, dword [ebp - 0x228]
jne 0x412270
mov esi, dword [ebp - 0x22c]
test esi, esi
je 0x4122fc
mov eax, dword [ebp - 0x224]
sub eax, esi
sar eax, 2
push eax
push esi
call fcn.004056d0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
jmp 0x4122fc
mov dword [ebp - 4], 0xffffffff
call fcn.004124e0
push str.CUninstallUtil::uninstallApplication
push str._s_exit_
push str.uninstall_util
call fcn.00402320
add esp, 0xc
sub esp, 0x18
cmp byte [ebp - 0x284], 0
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
je 0x41235a
cmp dword [ecx + 0x14], 0x10
jb 0x412345
mov eax, dword [ecx]
jmp 0x412347
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 1
jmp 0x412377
cmp dword [ecx + 0x14], 0x10
jb 0x412364
mov eax, dword [ecx]
jmp 0x412366
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 0
mov ecx, ebx
call fcn.0040de60
test ebx, ebx
je 0x412397
mov ecx, ebx
call fcn.0040c100
push 0x88
push ebx
call fcn.00419580
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x250]
movq qword [ebp - 0x250], xmm0
call fcn.0040f4a0
mov dword [ebp - 4], 8
mov edi, dword [ebp - 0x24c]
mov esi, dword [ebp - 0x250]
mov dword [ebp - 0x220], edi
cmp edi, esi
je 0x412479
sub esp, 0x18
mov byte [ebp - 4], 9
cmp byte [ebp - 0x284], 0
mov ecx, esp
mov esi, dword [edi - 4]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
je 0x41242b
cmp dword [ecx + 0x14], 0x10
jb 0x412405
mov eax, dword [ecx]
jmp 0x412407
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 1
mov ecx, esi
call fcn.0040de60
mov dword [ebp - 4], 8
sub edi, 4
jmp 0x4123c4
cmp dword [ecx + 0x14], 0x10
jb 0x412435
mov eax, dword [ecx]
jmp 0x412437
mov eax, ecx
push 0
push 0x421a0c
mov byte [eax], 0
call fcn.00404420
push 0
mov ecx, esi
call fcn.0040de60
mov dword [ebp - 4], 8
sub edi, 4
jmp 0x4123c4
cmp esi, dword [ebp - 0x24c]
je 0x4124ad
mov edi, dword [esi]
test edi, edi
je 0x41249c
mov ecx, edi
call fcn.0040c100
push 0x88
push edi
call fcn.00419580
add esp, 8
add esi, 4
cmp esi, dword [ebp - 0x24c]
jne 0x412481
mov esi, dword [ebp - 0x250]
test esi, esi
je 0x4124c3
mov eax, dword [ebp - 0x248]
sub eax, esi
sar eax, 2
push eax
push esi
call fcn.004056d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00419532
mov esp, ebp
pop ebp
ret