Function at 0x404310
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x432fa2
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x446050]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, 0x10
cmp dword [ebx + 0x3c], esi
jb 0x404358
mov eax, dword [ebx + 0x28]
jmp 0x40435b
lea eax, [ebx + 0x28]
push eax
push str.Attempting_to_remove__s
call fcn.0040d8e0
add esp, 8
xor edi, edi
push str.advapi32.dll
mov dword [esp + 0x18], vtable.CServiceControl.0
mov dword [esp + 0x1c], 0x2710
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x40439e
push str.ControlServiceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x10], 1
cmp dword [ebx + 0x3c], esi
jb 0x4043b4
mov eax, dword [ebx + 0x28]
jmp 0x4043b7
lea eax, [ebx + 0x28]
push eax
push str.Domain_Time_Server
call fcn.0041f9ca
add esp, 8
test eax, eax
je 0x4043e8
cmp dword [ebx + 0x3c], esi
jb 0x4043d3
mov eax, dword [ebx + 0x28]
jmp 0x4043d6
lea eax, [ebx + 0x28]
push eax
push str.Domain_Time_Client
call fcn.0041f9ca
add esp, 8
test eax, eax
jne 0x404414
push 1
mov esi, str.domtime_cpl_all_shutdown_event
xor edi, edi
call fcn.004125c0
mov esi, eax
test esi, esi
je 0x40440f
cmp esi, 0xffffffff
je 0x40440f
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x10
cmp dword [ebx + 0x3c], esi
jb 0x40441e
mov eax, dword [ebx + 0x28]
jmp 0x404421
lea eax, [ebx + 0x28]
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.00414a50
test eax, eax
jne 0x404464
cmp dword [esp + 0x10], 4
jne 0x404464
cmp dword [ebx + 0x3c], esi
jb 0x404441
mov eax, dword [ebx + 0x28]
jmp 0x404444
lea eax, [ebx + 0x28]
push str.DTSetup_removing_service
push 0x40040014
push eax
lea edx, [esp + 0x20]
push edx
call fcn.004147f0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x3c]
lea ecx, [ebx + 0x94]
push eax
call fcn.0040dc90
add esp, 4
mov byte [esp + 0x68], 1
cmp dword [esp + 0x50], 0
je 0x40465e
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], esi
jae 0x404495
lea eax, [esp + 0x40]
push eax
push str.Cannot_get_exclusive_access_to__s
mov edi, 0x20
call fcn.0040d7c0
mov ecx, dword [0x44a6ec]
add esp, 8
push 0x4364e7
push 0x41e
push ecx
mov byte [0x44a704], 0
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edx, dword [0x44a6ec]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x4b
push 0
push 0x40a
push 0x3eb
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x44a6ec]
push 0
push 0x3eb
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [0x44a6ec]
push 0
push 0x41e
push ecx
call esi
push eax
call edi
mov edx, dword [0x44a6ec]
push 1
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x26
push str.Setup_cannot_gain_exclusive_access_to
lea eax, [esp + 0x44]
call fcn.004097c0
push 0x1a2
push str.._The_file_is_locked_open__either_because_you_are_currently_using_it_or_because_a_system_program_such_as_Event_Viewer_has_a_portion_of_the_file_mapped._r_n_r_nYou_may_proceed_with_removing_the_software__but_you_will_probably_have_to_reboot_your_machine_afterward._To_avoid_a_reboot__you_may_try_logging_out_and_back_in__then_trying_again._This_sometimes_clears_the_locked_file._r_n_r_nDo_you_want_to_continue_with_the_removal_
lea eax, [esp + 0x44]
call fcn.004095d0
mov ecx, 0x10
cmp dword [ebx + 0x3c], ecx
jb 0x404556
mov eax, dword [ebx + 0x28]
jmp 0x404559
lea eax, [ebx + 0x28]
cmp dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x40]
jae 0x404567
lea ecx, [esp + 0x40]
push 0
push eax
mov eax, dword [0x448730]
push 0x24
push eax
mov edi, 0x436b2c
call fcn.0041a340
add esp, 0x10
cmp eax, 7
jne 0x4045e4
cmp dword [esp + 0x10], 4
jne 0x4045a4
cmp dword [ebx + 0x3c], 0x10
jb 0x404596
mov ebx, dword [ebx + 0x28]
jmp 0x404599
add ebx, 0x28
push ebx
lea ecx, [esp + 0x18]
push ecx
call fcn.00414680
mov byte [esp + 0x68], 0
cmp dword [esp + 0x54], 0x10
jb 0x4045bd
mov edx, dword [esp + 0x40]
push edx
call fcn.0042019e
add esp, 4
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
mov dword [esp + 0x68], 0xffffffff
mov eax, 0x20
jmp 0x404850
mov eax, dword [0x44a6ec]
push 0x4364e7
push 0x41e
push eax
mov byte [0x44a704], 1
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [0x44a6ec]
push 0x4b
push 0
push 0x40a
push 0x3eb
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x44a6ec]
push 0
push 0x3eb
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov eax, dword [0x44a6ec]
push 0
push 0x41e
push eax
call esi
push eax
call edi
mov ecx, dword [0x44a6ec]
push 0
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, 0x10
cmp dword [ebx + 0x58], esi
jb 0x404668
mov eax, dword [ebx + 0x44]
jmp 0x40466b
lea eax, [ebx + 0x44]
push eax
push 0x448840
push str._s_s__remove__vq
lea ecx, [esp + 0x2c]
call fcn.004172c0
add esp, 0xc
mov byte [esp + 0x68], 2
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x48]
call fcn.004096e0
mov byte [esp + 0x68], 1
cmp dword [esp + 0x38], esi
jb 0x4046ad
mov edx, dword [esp + 0x24]
push edx
call fcn.0042019e
add esp, 4
mov eax, dword [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
cmp dword [esp + 0x54], esi
jae 0x4046d0
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040e520
mov edi, eax
add esp, 8
test edi, edi
je 0x4046ff
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], esi
jae 0x4046ef
lea eax, [esp + 0x40]
push eax
push str.Problem_while_executing__s
call fcn.0040d7c0
jmp 0x404816
cmp dword [ebx + 0x3c], esi
jb 0x404709
mov eax, dword [ebx + 0x28]
jmp 0x40470c
lea eax, [ebx + 0x28]
push eax
push str.Domain_Time_Server
call fcn.0041f9ca
add esp, 8
test eax, eax
je 0x404741
cmp dword [ebx + 0x3c], esi
jb 0x404728
mov ebx, dword [ebx + 0x28]
jmp 0x40472b
add ebx, 0x28
push ebx
push str.Domain_Time_Client
call fcn.0041f9ca
add esp, 8
test eax, eax
jne 0x4047fd
cmp byte [0x44a8b8], 0
jne 0x4047f3
lea eax, [esp + 0x20]
push eax
call fcn.00417a60
mov byte [esp + 0x68], 3
mov ecx, dword [esp + 0x10]
push ecx
push 0x4477f0
push 0x4477e0
lea eax, [esp + 0x2c]
call fcn.0040ab00
push 0x448c60
lea ebx, [esp + 0x24]
call fcn.0040c950
mov edx, dword [esp + 0x14]
add esp, 4
push edx
push 0x4477f8
push 0x4477f0
mov eax, ebx
call fcn.0040ab00
push 0x448c60
call fcn.0040c950
add esp, 4
call fcn.0040cb00
push 0x448c60
mov esi, str..url
call fcn.0040b400
add esp, 4
push 0x448b58
call fcn.0040b400
add esp, 4
push 0x448b58
mov esi, str..lnk
call fcn.0040b400
add esp, 4
mov byte [esp + 0x68], 1
mov eax, ebx
push eax
call fcn.00409370
mov esi, 0x10
jmp 0x4047fd
push 1
call fcn.0040bc40
add esp, 4
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], esi
jae 0x40480b
lea eax, [esp + 0x40]
push eax
push str._s_executed_successfully
call fcn.0040d8e0
add esp, 8
mov byte [esp + 0x68], 0
cmp dword [esp + 0x54], esi
jb 0x404831
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0042019e
add esp, 4
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
mov dword [esp + 0x68], 0xffffffff
mov eax, edi
mov dword [esp + 0x14], vtable.CServiceControl.0
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041f826
mov esp, ebp
pop ebp
ret