Function at 0x408b70
Capabilities:
Copy file
Delete directory
Get common file path
Get hostname
Shutdown system

Disassembly:
push ebp
lea ebp, [esp - 0x40c]
sub esp, 0x40c
push 0xffffffffffffffff
push 0x432f10
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x446050]
xor eax, ebp
mov dword [ebp + 0x408], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x41c]
mov dword [ebp - 0x2c], eax
push 0x4111d0
call fcn.0041fdf6
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
call fcn.00401e90
mov byte [ebp - 4], 2
cmp byte [ebp - 0x28], bl
jne 0x408be9
cmp dword [ebp - 0x20], ebx
je 0x408c15
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x408bfe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xffffffff
push edi
call fcn.0041fdf6
mov eax, 0xb7
jmp 0x409256
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x34], 0x4ff
lea ecx, [ebp - 0x38]
push ecx
call fcn.004015d0
push str.SeTcbPrivilege
call fcn.00411fa0
push str.SeSecurityPrivilege
call fcn.00411fa0
push str.SeAuditPrivilege
call fcn.00411fa0
push str.SeLockMemoryPrivilege
call fcn.00411fa0
push str.SeSystemtimePrivilege
call fcn.00411fa0
push str.SeTimeZonePrivilege
call fcn.00411fa0
push str.SeIncreaseBasePriorityPrivilege
call fcn.00411fa0
push str.SeIncreaseQuotaPrivilege
call fcn.00411fa0
push str.SeCreateTokenPrivilege
call fcn.00411fa0
push str.SeAssignPrimaryTokenPrivilege
call fcn.00411fa0
push str.SeTakeOwnershipPrivilege
call fcn.00411fa0
push str.SeBackupPrivilege
call fcn.00411fa0
push str.SeShutdownPrivilege
call fcn.00411fa0
push str.SeChangeNotifyPrivilege
call fcn.00411fa0
push str.SeRemoteShutdownPrivilege
call fcn.00411fa0
push str.SeCreateGlobalPrivilege
call fcn.00411fa0
add esp, 0x40
push str.SeSyncAgentPrivilege
call fcn.00411fa0
add esp, 4
call fcn.00412110
test eax, eax
jne 0x408d3c
lea esi, [ebp]
call fcn.004123e0
mov esi, eax
lea edx, [ebp + 0x200]
push edx
push esi
call fcn.00413e10
push ebx
lea eax, [ebp + 0x200]
push eax
push 0x30
push ebx
mov edi, str.Domain_Time_II_Setup
lea ecx, [ebp]
call fcn.0041a340
add esp, 0x18
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x408d2c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
push ecx
jmp 0x40924f
mov esi, 0xff
mov dword [ebp - 0x14], esi
lea edx, [ebp - 0x14]
push edx
push 0x4494a0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.00412e70
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea edi, [ebp + 0x280]
call fcn.004135e0
mov dword [ebp - 0x14], ebx
xor eax, eax
call fcn.0040e5d0
call fcn.0040b550
call fcn.0041f500
add eax, 0x2ac18000
adc edx, 0xfe624e21
push ebx
push 0x989680
push edx
push eax
call fcn.004283c0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
cmp edx, ebx
je 0x408da3
or eax, 0xffffffff
push eax
lea edi, [ebp - 0x60]
call fcn.0041f450
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 0x10
jb 0x408dbb
mov eax, dword [eax + 4]
jmp 0x408dbe
add eax, 4
push eax
push str._r_n_Start_time:__s_
call fcn.0040d8e0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00409320
push 0x4494a0
push str.Domain_Time_II_Setup_5.2.b.20241123R_starting_on__s
call fcn.0040d8e0
lea eax, [ebp + 0x280]
push eax
push str.__Operating_system:__s
call fcn.0040d8e0
push 0x448840
push str.__Launch_path:_______s
call fcn.0040d8e0
push 0x448e70
push str.__x86_sources:_______s
call fcn.0040d8e0
push 0x448738
push str.__x64_sources:_______s
call fcn.0040d8e0
push 0x448948
push str.__DTLinux_sources:___s
call fcn.0040d8e0
push 0x448c60
push str.__Manager_root:______s
call fcn.0040d8e0
push 0x448f78
push str.__Manager_x86:_______s
call fcn.0040d8e0
add esp, 0x40
push 0x449188
push str.__Manager_x64:_______s
call fcn.0040d8e0
add esp, 8
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call fcn.004192c0
add esp, 4
cmp dword [0x449ee4], 0x1000
jae 0x408ebb
push str.Cannot_run_setup
mov edi, 0x47e
call fcn.0040d7c0
push 1
push str.Setup_cannot_continue
push 0x40090
push 0
mov edi, 0x436b2c
mov ecx, str.This_program_requires_Windows_XP_or_later._Previous_versions_of_Domain_Time_continue_to_support_earlier_operating_systems.
call fcn.0041a340
add esp, 0x14
mov dword [ebp - 0x14], esi
jmp 0x408fca
call fcn.00411630
test eax, eax
je 0x408efb
push str.Cannot_run_in_x86_mode
mov edi, 0x29e
call fcn.0040d7c0
push 1
push str.Setup_cannot_continue
push 0x40090
push 0
mov edi, 0x436b2c
mov ecx, str.You_are_running_the_32_bit_version_of_Setup_on_a_64_bit_operating_system._Use_the_64_bit_version_instead.
call fcn.0041a340
add esp, 0x14
mov dword [ebp - 0x14], esi
jmp 0x408fca
call fcn.0040dee0
test eax, eax
je 0x408f3b
push str.Cannot_upgrade_prior_install
mov edi, 0x66a
call fcn.0040d7c0
push 1
push str.Cannot_continue
push 0x40090
push 0
mov edi, 0x436b2c
mov ecx, str.Direct_upgrade_from_32_bit_to_64_bit_is_not_supported_in_this_release._r_n_r_nSetup_has_detected_one_or_more_32_bit_components_already_installed_on_this_machine._Use_the_original_32_bit_setup_program_to_remove_them_before_running_the_64_bit_setup_program._r_n_r_nIf_you_no_longer_have_access_to_the_original_32_bit_setup_program__or_if_you_experience_problems_removing_previous_32_bit_installations__please_use_the_DTCLEAN_utility_to_remove_all_Domain_Time_II_components._You_may_download_the_DTCLEAN_utility_from_www.greyware.com__or_write_to_techsupport_greyware.com_for_assistance.
call fcn.0041a340
add esp, 0x14
mov dword [ebp - 0x14], esi
jmp 0x408fca
push 0
push 0x32
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
push eax
push 0x31
call esi
push eax
push 1
push 1
push 0x400000
mov edi, dword [sym.imp.USER32.dll_LoadImageA]
call edi
mov dword [0x4495a0], eax
push 0
push 0xc
call esi
push eax
push 0xb
call esi
push eax
push 1
push 1
push 0x400000
call edi
mov dword [0x448734], eax
mov dword [ebp - 0x14], 0
mov edi, 0x438864
mov esi, dword [ebp - 0x2c]
mov eax, esi
call fcn.00408ae0
test al, al
je 0x40908a
mov byte [0x449dbd], 1
mov eax, 0x448c60
call fcn.0040e5d0
cmp dword [ebp - 0x14], 0
jne 0x408fca
call ebx
push 0xd0
mov esi, 0x44a6e8
call fcn.00401cf0
call fcn.00402da0
cmp byte [0x449dbc], 0
je 0x40901d
push 0
push str.Restart_required
push 0x11024
push 0
mov edi, 0x436b2c
mov ecx, str.A_system_restart_is_required_to_complete_the_setup_tasks._Do_you_want_to_reboot_your_computer_now_
call fcn.0041a340
add esp, 0x10
cmp eax, 6
jne 0x40901d
push str.System_restart_initiated
call fcn.0040d8e0
add esp, 4
push 0x80040002
push 1
push 0
push 0
push str.Domain_Time_II_Software_installation
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExA]
push 0x448b58
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call esi
push 0x448f78
call esi
push 0x449188
call esi
push 0x448c60
call esi
call fcn.0041f500
add eax, 0x2ac18000
adc edx, 0xfe624e21
xor esi, esi
push esi
push 0x989680
push edx
push eax
call fcn.004283c0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp edx, esi
je 0x40906b
or eax, 0xffffffff
push eax
lea edi, [ebp - 0x60]
call fcn.0041f450
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 0x10
jb 0x409201
mov eax, dword [eax + 4]
jmp 0x409204
mov edi, str.force
mov eax, esi
call fcn.00408ae0
mov byte [0x449dbe], al
push 0x448c60
push 0x448840
call fcn.0041f9ca
add esp, 8
test eax, eax
sete al
test al, al
jne 0x4090ca
mov edi, str.remove
mov eax, esi
call fcn.00408ae0
test al, al
je 0x408fae
push 0x105
lea ecx, [ebp + 0xf8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp + 0x300]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp + 0x300]
call fcn.004191c0
lea eax, [ebp + 0x300]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409104
sub eax, edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str._08X_
lea eax, [ebp + esi + 0x300]
push eax
call fcn.0041fa79
lea ecx, [ebp + 0x300]
push ecx
call fcn.004174f0
add esp, 0x10
lea eax, [ebp + 0x300]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409140
mov edx, dword [0x436154]
mov dword [eax], edx
mov ecx, dword [0x436158]
mov dword [eax + 4], ecx
mov dx, word [0x43615c]
mov word [eax + 8], dx
push 0
lea eax, [ebp + 0x300]
push eax
lea ecx, [ebp + 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4091d8
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x409193
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], 0
lea eax, [ebp + 0x300]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4091a0
mov edx, dword [str.__tmp]
mov dword [eax], edx
mov cx, word [0x43887c]
mov word [eax + 4], cx
push 0
lea edx, [ebp + 0x300]
push edx
call fcn.0040e520
add esp, 8
mov dword [ebp - 0x14], 0xff
jmp 0x408fca
push 0
push str.Temporary_file_location_error
push 0x30
push 0
mov edi, 0x436b2c
mov ecx, str.Cannot_run_Setup._Please_re_extract_from_your_distribution_files.
call fcn.0041a340
add esp, 0x10
mov dword [ebp - 0x14], 0xff
jmp 0x408fca
add eax, 4
push eax
push str._Finish_time:__s__r_n
call fcn.0040d8e0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00409320
call fcn.004194e0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x40923e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041fdf6
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x408]
xor ecx, ebp
call fcn.0041f826
add ebp, 0x40c
mov esp, ebp
pop ebp
ret 0x10