Function at 0x411270
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c036
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x463024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push ecx
mov esi, esp
mov byte [0x4695d8], 0
mov dword [ebp - 0x438], esi
mov ecx, dword [0x46b730]
lea ecx, [ecx - 0x10]
call fcn.004160a0
add eax, 0x10
mov dword [esi], eax
call fcn.00404d60
add esp, 4
call fcn.00411010
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x46a280
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push str._s_s
push 0x469810
call edi
push str.InstallLocation
mov edx, 0x469810
call fcn.00405a80
add esp, 0x14
push eax
push 0x46b338
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 8
push 0x46b338
call ebx
cmp eax, 0xffffffff
je 0x41132f
test al, 0x10
jne 0x41133f
push 0x46b338
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x46b338
call ebx
cmp eax, 0xffffffff
je 0x4117bf
test al, 0x10
je 0x4117bf
push 0x46b338
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov edx, 0x469810
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00405ed0
call fcn.004089d0
cmp dword [0x46b334], 0
jle 0x41143d
push ecx
mov esi, esp
mov dword [ebp - 0x438], esp
mov dword [ebp - 0x43c], esi
mov ecx, dword [0x46b730]
add ecx, 0xfffffff0
call fcn.004160a0
add eax, 0x10
mov dword [esi], eax
push ecx
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x43c], esi
call fcn.00402520
mov ecx, eax
test ecx, ecx
je 0x41181c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push str._DeleteTasks_
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00414f80
test al, al
jne 0x4113f0
push 0xd
push str._DeleteTasks_
mov ecx, esi
call fcn.00416110
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00403530
mov eax, dword [0x46b770]
add esp, 8
mov ecx, dword [0x46b76c]
xor esi, esi
sub eax, ecx
sar eax, 3
test eax, eax
je 0x41143d
nop dword [eax]
mov ecx, dword [ecx + esi*8]
call fcn.00406050
mov eax, dword [0x46b770]
inc esi
mov ecx, dword [0x46b76c]
sub eax, ecx
sar eax, 3
cmp esi, eax
jb 0x411420
push 0x46b338
call ebx
cmp eax, 0xffffffff
je 0x41152b
test al, 0x10
je 0x41152b
call fcn.00402520
mov ecx, eax
test ecx, ecx
je 0x411826
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x434], eax
push 0x46b338
push 0x28
mov dword [ebp - 4], 2
call fcn.0040a000
add esp, 4
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.00416490
mov esi, dword [ebp - 0x434]
add esp, 0xc
push 0
push 0x1024
push 0x46a280
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
cmp eax, 7
jne 0x4114e0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x411800
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x411800
mov ecx, 0x46b338
call fcn.00410f30
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x46b338
call ebx
cmp eax, 0xffffffff
je 0x41150c
test al, 0x10
je 0x41150c
mov ecx, 0x46b338
call fcn.00410ce0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41152b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call esi
push 0x46a280
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x469810
call edi
add esp, 0x10
push 0x469810
call ebx
cmp eax, 0xffffffff
je 0x411597
test al, 0x10
je 0x411597
mov ecx, 0x469810
call fcn.00410f30
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x469810
call ebx
cmp eax, 0xffffffff
je 0x411597
test al, 0x10
je 0x411597
mov ecx, 0x469810
call fcn.00410ce0
push 0
push 2
lea eax, [ebp - 0x218]
push eax
push 0
call esi
push 0x46a280
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x46aee8
call edi
add esp, 0x10
push 0x46aee8
call ebx
cmp eax, 0xffffffff
je 0x4115db
test al, 0x10
je 0x4115db
mov ecx, 0x46aee8
call fcn.00410ce0
push 0
push 0x17
lea eax, [ebp - 0x218]
push eax
push 0
call esi
push 0x46a280
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x46aee8
call edi
add esp, 0x10
push 0x46aee8
call ebx
cmp eax, 0xffffffff
je 0x41161f
test al, 0x10
je 0x41161f
mov ecx, 0x46aee8
call fcn.00410ce0
mov esi, dword [0x46b754]
lea eax, [ebp - 0x218]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [esi + 4]
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x46a4a8
call edi
add esp, 0x10
push 0x46a4a8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411763
push 0x46a4a8
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x411763
push 5
push eax
push 0x46a4a8
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov byte [0x4695d8], 1
push 0x46a280
push 0x15
call fcn.0040a000
add esp, 4
push eax
push 0x469810
call edi
add esp, 0xc
push 0x46a280
push 0x12
call fcn.0040a000
add esp, 4
push eax
push 0x46a4a8
call edi
add esp, 0xc
push 0
push 0x1024
push 0x46a4a8
push 0x469810
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
cmp eax, 6
jne 0x411800
lea eax, [ebp - 0x434]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x411800
lea eax, [ebp - 0x42c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 1
push eax
push 0
push dword [ebp - 0x434]
mov dword [ebp - 0x424], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x411800
push 0x80020003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x411800
cmp byte [0x4695d8], 0
jne 0x41168c
push 0x46a280
push 0x14
call fcn.0040a000
add esp, 4
push eax
push 0x469810
call edi
add esp, 0xc
push 0x46a280
push 0x12
call fcn.0040a000
add esp, 4
push eax
push 0x46a4a8
call edi
add esp, 0xc
push 0
push 0x1040
push 0x46a4a8
push 0x469810
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
jmp 0x411800
push 0
push 0x1040
push 0x448948
push 0xf
call fcn.0040a000
add esp, 8
push eax
push 0x448948
push 0x16
call fcn.0040a000
add esp, 8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push 0
push 0
push 0x10
push dword [0x46acd4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ac2f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402280
push 0x80004005
call fcn.00402280
int3