Function at 0x403b3b
Capabilities:
Check if file exists
Delete directory
Delete file
Delete registry key
Delete service
Delete user account
Enumerate files on windows
Get common file path
Get file attributes
Impersonate user
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cebbf
mov eax, dword fs:[0]
push eax
mov eax, 0x253c
call fcn.0045f530
mov eax, dword [0x4fa654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x2224], 7
mov dword [ebp - 0x2228], esi
mov word [ebp - 0x2238], ax
lea eax, [ebp - 0x221c]
push eax
push 0x1000
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x403bdf
lea eax, [ebp - 0x221c]
push eax
lea eax, [ebp - 0x2290]
push eax
call fcn.00404c84
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x2290]
lea ecx, [ebp - 0x2238]
mov byte [ebp - 4], 1
call fcn.00405528
push 1
xor edi, edi
lea esi, [ebp - 0x2290]
mov byte [ebp - 4], 0
call fcn.00401198
mov esi, str.UpdatusUninstall.log
push esi
call fcn.00447827
pop ecx
mov edi, eax
push esi
lea eax, [ebp - 0x2238]
call fcn.0040594f
push 8
pop ebx
push ebx
call fcn.00447c3b
pop ecx
mov dword [ebp - 0x2538], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x403c2f
mov ecx, dword [ebp - 0x2238]
cmp dword [ebp - 0x2224], ebx
jae 0x403c25
lea ecx, [ebp - 0x2238]
push ecx
mov esi, eax
call fcn.00401000
jmp 0x403c31
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x253c], eax
mov byte [ebp - 4], 3
mov ecx, dword [0x4ff46c]
mov dword [0x4ff46c], eax
mov dword [ebp - 0x253c], ecx
lea eax, [ebp - 0x253c]
mov byte [ebp - 4], 0
call fcn.00405403
lea eax, [ebp - 0x2258]
push eax
call fcn.004018c2
pop ecx
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], ebx
jb 0x403c77
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Daemon_type:__s
call fcn.0040102f
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
mov byte [ebp - 4], 0
call fcn.00401198
or dword [ebp - 4], 0xffffffff
push 1
lea esi, [ebp - 0x2238]
call fcn.00401198
push 1
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x2540], eax
test eax, eax
jne 0x403d12
lea eax, [ebp - 0x2258]
push eax
call fcn.00420059
pop ecx
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], ebx
jb 0x403cdd
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.OpenSCManager_failed:__s
call fcn.0040102f
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
call fcn.00401198
mov dword [ebp - 0x253c], 6
jmp 0x403e37
mov ecx, dword [0x4ff46c]
push str.Servicemanager_opened
call fcn.0040102f
mov dword [esp], 0x10024
push str.nvUpdatusService
push dword [ebp - 0x2540]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x403d8f
lea eax, [ebp - 0x2258]
push eax
call fcn.00420059
pop ecx
mov dword [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x403d5c
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.OpenService_failed:__s
call fcn.0040102f
or dword [ebp - 4], 0xffffffff
pop ecx
xor ebx, ebx
pop ecx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x2258]
call fcn.00401198
mov dword [ebp - 0x253c], ebx
jmp 0x403e28
mov ecx, dword [0x4ff46c]
push str.Service_opened
call fcn.0040102f
push ebx
call fcn.00402681
pop ecx
pop ecx
mov dword [ebp - 0x253c], eax
test eax, eax
jne 0x403e21
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x403e0a
lea eax, [ebp - 0x2258]
push eax
call fcn.00420059
pop ecx
mov dword [ebp - 4], 7
cmp dword [eax + 0x14], 8
jb 0x403dd8
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.DeleteService_failed:__s
call fcn.0040102f
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
call fcn.00401198
mov dword [ebp - 0x253c], 5
jmp 0x403e21
mov ecx, dword [0x4ff46c]
push str.Service_removed
call fcn.0040102f
and dword [ebp - 0x253c], edi
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x2540]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 8
pop ebx
call fcn.0040a65a
test al, al
jne 0x403e6e
mov ecx, dword [0x4ff46c]
push str.unregisterDaemon_failed_
call fcn.0040102f
pop ecx
push 0xb
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004466c5
leave
ret
and dword [ebp - 0x2228], 0
xor eax, eax
mov dword [ebp - 0x2224], 7
mov word [ebp - 0x2238], ax
lea eax, [ebp - 0x2238]
push eax
mov dword [ebp - 4], ebx
call fcn.0041e757
pop ecx
test al, al
jne 0x403ec4
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0x2238]
call fcn.00401198
mov ecx, dword [0x4ff46c]
push str.uninstallCOM_failed_
call fcn.0040102f
pop ecx
push 0xf
jmp 0x403e53
push str._UnregServer
lea eax, [ebp - 0x2290]
push eax
call fcn.00404c84
push str.ComUpdatus.exe
lea ebx, [ebp - 0x2258]
lea ecx, [ebp - 0x2238]
mov byte [ebp - 4], 9
call fcn.00404d08
lea ecx, [ebp - 0x2290]
push ecx
lea edx, [ebp - 0x2238]
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0040248e
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
mov ebx, eax
mov byte [ebp - 4], 9
call fcn.00401198
push 1
lea esi, [ebp - 0x2290]
mov byte [ebp - 4], 8
call fcn.00401198
test ebx, ebx
je 0x403f54
mov esi, dword [0x4ff46c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Failed_to_call_ComUpdatus.exe__UnregServer:_code_d__lastError_u
mov ecx, esi
call fcn.0040102f
add esp, 0xc
jmp 0x403e9c
mov ecx, dword [0x4ff46c]
push str.ComUpdatus.exe_unregistred
call fcn.0040102f
or dword [ebp - 4], 0xffffffff
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2238]
call fcn.00401198
push 7
pop esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x22d0], esi
mov dword [ebp - 0x22d4], ebx
mov word [ebp - 0x22e4], ax
lea ecx, [ebp - 0x22e4]
mov dword [ebp - 4], 0xb
call fcn.0040901e
test al, al
je 0x404359
lea eax, [ebp - 0x22e4]
call fcn.0041e4e3
test al, al
je 0x404348
cmp dword [ebp - 0x22d0], 8
mov eax, dword [ebp - 0x22e4]
jae 0x403fd4
lea eax, [ebp - 0x22e4]
xor ecx, ecx
mov dword [ebp - 0x2538], eax
mov dword [ebp - 0x2260], esi
mov dword [ebp - 0x2264], ebx
mov word [ebp - 0x2274], cx
push eax
lea eax, [ebp - 0x2258]
push eax
mov byte [ebp - 4], 0xc
call fcn.00404c84
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2258]
lea ecx, [ebp - 0x2274]
mov byte [ebp - 4], 0xd
call fcn.00405528
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
mov byte [ebp - 4], 0xc
call fcn.00401198
mov ecx, dword [ebp - 0x2264]
cmp ecx, ebx
je 0x404316
cmp dword [ebp - 0x2260], 8
mov eax, dword [ebp - 0x2274]
jae 0x40404e
lea eax, [ebp - 0x2274]
lea eax, [eax + ecx*2]
cmp word [eax - 2], 0x5c
je 0x404072
mov esi, 0x4e0ca0
push esi
call fcn.00447827
pop ecx
mov edi, eax
push esi
lea eax, [ebp - 0x2274]
call fcn.0040594f
xor ecx, ecx
cmp dword [ebp - 0x2264], ebx
jbe 0x4040bd
cmp dword [ebp - 0x2260], 8
mov eax, dword [ebp - 0x2274]
jae 0x404091
lea eax, [ebp - 0x2274]
cmp word [eax + ecx*2], 0x2f
jne 0x4040b4
cmp dword [ebp - 0x2260], 8
mov eax, dword [ebp - 0x2274]
jae 0x4040ad
lea eax, [ebp - 0x2274]
push 0x5c
pop edx
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [ebp - 0x2264]
jb 0x40407c
lea eax, [ebp - 0x2274]
push eax
lea esi, [ebp - 0x2238]
call fcn.00401874
mov esi, 0x4e5458
push esi
mov byte [ebp - 4], 0xe
call fcn.00447827
pop ecx
mov edi, eax
push esi
lea eax, [ebp - 0x2238]
call fcn.0040594f
push 0x250
lea eax, [ebp - 0x2534]
push ebx
push eax
call fcn.00447b70
mov eax, dword [ebp - 0x2238]
add esp, 0xc
cmp dword [ebp - 0x2224], 8
jae 0x404117
lea eax, [ebp - 0x2238]
lea ecx, [ebp - 0x2534]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2540], eax
cmp eax, 0xffffffff
jne 0x404182
push 1
xor edi, edi
lea esi, [ebp - 0x2238]
mov byte [ebp - 4], 0xc
call fcn.00401198
push 1
lea esi, [ebp - 0x2274]
mov byte [ebp - 4], 0xb
call fcn.00401198
mov ecx, dword [0x4ff46c]
push str.Workpath_exists_but_not_deleted_
call fcn.0040102f
pop ecx
push 0xc
pop ebx
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0x22e4]
call fcn.00401198
mov eax, ebx
jmp 0x403e54
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x2274]
push eax
lea esi, [ebp - 0x2290]
call fcn.00401874
lea eax, [ebp - 0x2508]
push eax
mov byte [ebp - 4], 0xf
call fcn.00447827
pop ecx
lea ecx, [ebp - 0x2508]
mov edi, eax
push ecx
mov eax, esi
call fcn.0040594f
test byte [ebp - 0x2534], 0x10
je 0x404206
lea eax, [ebp - 0x2508]
push 0x4def40
push eax
call fcn.00448a0a
pop ecx
pop ecx
test eax, eax
je 0x404295
lea eax, [ebp - 0x2508]
push 0x4e0ca8
push eax
call fcn.00448a0a
pop ecx
pop ecx
test eax, eax
je 0x404295
mov eax, esi
call fcn.0041f34a
jmp 0x404295
cmp dword [ebp - 0x227c], 8
mov eax, dword [ebp - 0x2290]
jae 0x40421b
lea eax, [ebp - 0x2290]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404295
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404295
cmp dword [ebp - 0x227c], 8
mov eax, dword [ebp - 0x2290]
jae 0x404246
lea eax, [ebp - 0x2290]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x227c], 8
mov ecx, dword [ebp - 0x2290]
jae 0x404262
lea ecx, [ebp - 0x2290]
and eax, 0xfffffffe
push eax
push ecx
call ebx
test eax, eax
je 0x404330
cmp dword [ebp - 0x227c], 8
mov eax, dword [ebp - 0x2290]
jae 0x404286
lea eax, [ebp - 0x2290]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x404330
push 1
xor edi, edi
lea esi, [ebp - 0x2290]
mov byte [ebp - 4], 0xe
call fcn.00401198
lea eax, [ebp - 0x2534]
push eax
push dword [ebp - 0x2540]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404188
push dword [ebp - 0x2540]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x2538]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
call esi
test eax, eax
jne 0x404303
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push edi
call ebx
test eax, eax
je 0x404130
push edi
call esi
test eax, eax
je 0x404130
push 1
xor edi, edi
lea esi, [ebp - 0x2238]
mov byte [ebp - 4], 0xc
call fcn.00401198
push 1
xor edi, edi
lea esi, [ebp - 0x2274]
mov byte [ebp - 4], 0xb
call fcn.00401198
push str.Workpath_deleted
jmp 0x40434d
push 1
xor edi, edi
lea esi, [ebp - 0x2290]
mov byte [ebp - 4], 0xe
call fcn.00401198
jmp 0x404130
push str.Workpath_does_not_exist
mov ecx, dword [0x4ff46c]
call fcn.0040102f
pop ecx
and dword [ebp - 0x2538], 0
and dword [ebp - 0x22b8], 0
xor eax, eax
mov dword [ebp - 0x22b4], 7
mov word [ebp - 0x22c8], ax
push str.HKLMSOFTWARENVIDIA_CorporationGlobalNVUpdatus
lea eax, [ebp - 0x2258]
push eax
mov byte [ebp - 4], 0x10
call fcn.00404c84
lea eax, [ebp - 0x22c8]
push eax
lea eax, [ebp - 0x2538]
push eax
lea ecx, [ebp - 0x2258]
mov byte [ebp - 4], 0x11
call fcn.00421342
pop ecx
mov bl, al
pop ecx
neg bl
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
mov byte [ebp - 4], 0x10
call fcn.00401198
inc bl
je 0x4043f6
mov ecx, dword [0x4ff46c]
push str.TransformRegistryPaths_failed_
call fcn.0040102f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x22c8]
mov byte [ebp - 4], 0xb
call fcn.00401198
push 0xa
jmp 0x404167
cmp dword [ebp - 0x22b4], 8
mov eax, dword [ebp - 0x22c8]
jae 0x40440b
lea eax, [ebp - 0x22c8]
push eax
push dword [ebp - 0x2538]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [0x4ff46c]
xor esi, esi
cmp eax, esi
je 0x404432
push eax
push str.SHDeleteKey_failed__Error_code:__d
call fcn.0040102f
pop ecx
jmp 0x4043db
push str.Registry_cleaned
call fcn.0040102f
xor eax, eax
pop ecx
mov dword [ebp - 0x2298], 7
mov dword [ebp - 0x229c], esi
mov word [ebp - 0x22ac], ax
lea ecx, [ebp - 0x22ac]
mov byte [ebp - 4], 0x12
call fcn.0040a2ad
lea eax, [ebp - 0x2544]
push eax
push 1
mov ebx, 0x4def44
push ebx
push esi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
jne 0x40451c
cmp dword [ebp - 0x2298], 8
mov eax, dword [ebp - 0x22ac]
jae 0x404498
lea eax, [ebp - 0x22ac]
mov ecx, dword [ebp - 0x2544]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x2538]
push eax
push dword [ebp - 0x2544]
push 1
push ebx
push esi
call dword [sym.imp.NETAPI32.dll_NetUserSetInfo]
cmp eax, esi
je 0x4044ff
mov ecx, eax
lea esi, [ebp - 0x2258]
call fcn.00401cc3
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 8
jb 0x4044d5
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Password_reset_with_NetUserSetInfo_failed_with_code__d___s_
call fcn.0040102f
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
mov byte [ebp - 4], 0x12
call fcn.00401198
xor esi, esi
jmp 0x404510
mov ecx, dword [0x4ff46c]
push str.Password_successfully_reset
call fcn.0040102f
pop ecx
push dword [ebp - 0x2544]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp dword [ebp - 0x2298], 8
mov eax, dword [ebp - 0x22ac]
mov dword [ebp - 0x2538], esi
jae 0x404537
lea eax, [ebp - 0x22ac]
lea ecx, [ebp - 0x2548]
push ecx
push esi
push 5
push eax
push 0x4def40
push ebx
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x40459b
mov ecx, dword [0x4ff46c]
push str.LogonUser_succeeded
call fcn.0040102f
pop ecx
lea eax, [ebp - 0x2540]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x2548]
mov dword [ebp - 0x2540], 0x105
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
push dword [ebp - 0x2548]
mov dword [ebp - 0x2538], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4045dc
lea eax, [ebp - 0x2258]
push eax
call fcn.00420059
pop ecx
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
jb 0x4045b4
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.LogonUser_failed:__s
call fcn.0040102f
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
mov byte [ebp - 4], 0x12
call fcn.00401198
xor esi, esi
push ebx
push esi
call dword [sym.imp.NETAPI32.dll_NetUserDel]
mov edi, eax
cmp edi, esi
je 0x404654
mov ecx, edi
lea esi, [ebp - 0x2258]
call fcn.00401cc3
mov byte [ebp - 4], 0x15
cmp dword [eax + 0x14], 8
jb 0x404603
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push edi
push str.NetUserDel_failed:__d___s_
call fcn.0040102f
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp - 0x2258]
mov byte [ebp - 4], 0x12
call fcn.00401198
push 1
lea esi, [ebp - 0x22ac]
mov byte [ebp - 4], 0x10
call fcn.00401198
push 1
lea esi, [ebp - 0x22c8]
mov byte [ebp - 4], 0xb
call fcn.00401198
push 9
jmp 0x404167
mov ecx, dword [0x4ff46c]
push str.User_deleted
call fcn.0040102f
pop ecx
cmp dword [ebp - 0x2538], esi
je 0x404752
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404752
xor eax, eax
push 0x20a
mov word [ebp - 0x24f0], ax
lea eax, [ebp - 0x24ee]
push esi
push eax
call fcn.00447b70
push 0x105
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x24f0]
push eax
call fcn.004477db
push 0x1e
lea eax, [ebp - 0x2258]
push esi
push eax
call fcn.00447b70
lea eax, [ebp - 0x24f0]
mov dword [ebp - 0x2250], eax
mov eax, 0x8414
mov word [ebp - 0x2248], ax
add esp, 0x24
lea eax, [ebp - 0x2258]
push eax
mov dword [ebp - 0x2258], esi
mov dword [ebp - 0x2254], 3
mov dword [ebp - 0x224c], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [0x4ff46c]
test eax, eax
je 0x404747
push str.Profile_directory_NOT_deleted_
call fcn.0040102f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x22ac]
mov byte [ebp - 4], 0x10
call fcn.00401198
push 1
lea esi, [ebp - 0x22c8]
mov byte [ebp - 4], 0xb
call fcn.00401198
push 8
jmp 0x404167
push str.Profile_directory_deleted
call fcn.0040102f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x22ac]
mov byte [ebp - 4], 0x10
call fcn.00401198
push 1
lea esi, [ebp - 0x22c8]
mov byte [ebp - 4], 0xb
call fcn.00401198
mov ebx, dword [ebp - 0x253c]
jmp 0x404168