Function at 0x43c740
Capabilities:
Accept command line arguments
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1558
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1ca8
call fcn.0047bc80
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x21d]
call fcn.00424480
push 2
mov dword [ebp - 4], 0
call fcn.00405030
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.0043faf0
push eax
call fcn.0047cb40
add esp, 0xc
test eax, eax
je 0x43cbc0
push 5
call fcn.00405050
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.0043faf0
push eax
call fcn.0047cb40
add esp, 0xc
test eax, eax
je 0x43cbc0
push 7
call fcn.00404ff0
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.0043faf0
push eax
call fcn.0047cb40
add esp, 0xc
test eax, eax
je 0x43cbc0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [ebp - 0x1cb4], edi
call fcn.00409100
push eax
push edi
call fcn.0047f08b
add esp, 8
test eax, eax
je 0x43c8fd
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.0043b220
mov byte [ebp - 4], 1
call fcn.0040c8b0
push eax
push edi
call fcn.0047f08b
xor cl, cl
mov edx, 1
test eax, eax
movzx ecx, cl
lea eax, [ebp - 0x238]
cmovne ecx, edx
push edi
push eax
mov byte [ebp - 0x1cb4], cl
call fcn.0043b330
add esp, 0x18
push dword [ebp - 0x1cb4]
xor eax, eax
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1cb4], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x268]
push eax
call fcn.004114e0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x238]
push eax
call fcn.004114e0
mov byte [ebp - 4], 2
call fcn.0043b480
add esp, 0x34
lea ecx, [ebp - 0x238]
mov esi, eax
call fcn.00424c50
lea ecx, [ebp - 0x268]
call fcn.00424c50
lea ecx, [ebp - 0x21d]
mov dword [ebp - 4], 0xffffffff
call fcn.00424c90
mov eax, esi
jmp 0x43cbf0
call fcn.0040c000
push eax
push edi
call fcn.0047f08b
push str._uninstall
push edi
mov esi, eax
call fcn.0047f08b
add esp, 0x10
test esi, esi
jne 0x43cabd
test eax, eax
jne 0x43cabd
call fcn.00413ac0
mov ecx, eax
call fcn.00413bb0
lea ecx, [ebp - 0x1cb0]
call fcn.00435730
lea ecx, [ebp - 0x1cb0]
mov byte [ebp - 4], 6
call fcn.00436340
lea ecx, [ebp - 0x1cb0]
call fcn.004377f0
test al, al
je 0x43c9a7
call fcn.00425280
mov ecx, eax
call fcn.00425180
push esi
call fcn.0040c900
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
lea ecx, [ebp - 0x21d]
mov dword [ebp - method.Object.virtual_0], vtable.Object.0
mov dword [ebp - 4], 0xffffffff
call fcn.00424c90
or eax, 0xffffffff
jmp 0x43cbf0
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x1cb0]
call fcn.00437280
lea ecx, [ebp - 0x268]
call fcn.00424c50
lea ecx, [ebp - 0x1cb0]
mov byte [ebp - 4], 7
call fcn.004369d0
jmp 0x43c9e1
mov dword [ebp - 4], 6
call fcn.0040dd60
push eax
push edi
call fcn.0047f08b
add esp, 8
test eax, eax
je 0x43caa7
xor eax, eax
mov byte [0x5047e6], 1
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x240], 0
mov word [ebp - 0x250], ax
push 0x4da40c
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 9
call fcn.004116a0
call fcn.0040edc0
push eax
lea ecx, [ebp - 0x250]
call fcn.004113b0
cmp dword [ebp - 0x23c], 8
lea ecx, [ebp - 0x21c]
push 0x104
lea eax, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43ca98
push eax
push str.Failed_to_delete_shortcut_lnk
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 6
call fcn.00424c50
call fcn.0043ba60
mov esi, eax
mov dword [ebp - method.Object.virtual_0], vtable.Object.0
jmp 0x43c8e4
call fcn.00413ac0
mov ecx, eax
call fcn.00413bb0
push str.Are_you_sure_you_want_to_uninstall
lea ecx, [ebp - 0x238]
call fcn.0040f510
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 4
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 5
call fcn.004112e0
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 4
call fcn.00424c50
push 0x4da408
lea ecx, [ebp - 0x238]
call fcn.004113b0
lea eax, [ebp - 0x268]
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.00413b70
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x43cb40
mov ecx, dword [ecx]
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
push 4
cmovae eax, dword [ebp - 0x238]
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x268]
mov esi, eax
call fcn.00424c50
cmp esi, 6
jne 0x43cb9f
call fcn.0043af60
call fcn.0043c4b0
lea ecx, [ebp - 0x238]
mov esi, eax
call fcn.00424c50
lea ecx, [ebp - 0x21d]
mov dword [ebp - 4], 0xffffffff
call fcn.00424c90
mov eax, esi
jmp 0x43cbf0
lea ecx, [ebp - 0x238]
call fcn.00424c50
lea ecx, [ebp - 0x21d]
mov dword [ebp - 4], 0xffffffff
call fcn.00424c90
xor eax, eax
jmp 0x43cbf0
push 0
push str.Unsupported_OS
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
lea ecx, [ebp - 0x21d]
mov dword [ebp - 4], 0xffffffff
call fcn.00424c90
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 0x10