Function at 0x4031a0
Capabilities:
Encode data using xor
Get common file path
Terminate process

Disassembly:
sub esp, 0x6c4
mov eax, dword [0x4223a0]
xor eax, esp
mov dword [esp + 0x6c0], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6dc]
push str.CommandClass::CommandClass_n
mov ebp, ecx
mov dword [esp + 0x18], edi
call fcn.00403a50
add esp, 4
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x403243
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x403243
cmp dword [esp + 0x10], ebx
je 0x403243
push str.I386
lea ecx, [esp + 0x2d4]
push str.You_are_running_a_32_bit_version_of_Nvidia_uninstaller_on_a_64_bit_system__Binary_type__s_._nWrong_version_of_uninstaller._Uninstaller_exits_now.
push ecx
call fcn.0040a7d1
add esp, 0xc
push 0x10
push str.Fatal_Error
lea edx, [esp + 0x2d8]
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.0040afc6
xor ecx, ecx
mov dword [ebp + 0x548], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ecx
mov esi, dword [esp + ecx*4 + 0x1c]
movsx eax, byte [esi*4 + section..data]
lea edx, [esi*4 + section..data]
lea ebx, [eax + 4]
shr ebx, 2
add ebx, esi
mov dword [esp + ecx*4 + 0x20], ebx
xor ebx, ebx
cmp eax, ebx
jle 0x4032a4
lea ecx, [eax + edx - 1]
mov esi, eax
mov edi, edi
mov bl, byte [ecx + 1]
xor byte [ecx], bl
sub ecx, 1
sub esi, 1
jne 0x403280
xor ebx, ebx
cmp eax, ebx
jle 0x40329c
lea esi, [edx + 1]
mov ecx, eax
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ecx, 1
cmp ecx, 5
mov byte [eax + edx], bl
mov dword [esp + 0x10], ecx
jl 0x403253
mov eax, dword [esp + 0x6d8]
mov ecx, dword [esp + 0x6e0]
push 0x14
mov dword [ebp + 0x554], 0x419865
mov dword [ebp + 0x558], edi
mov dword [ebp + 0x550], eax
mov dword [ebp + 0x55c], ecx
call fcn.0040a39f
add esp, 4
cmp eax, ebx
mov dword [ebp], eax
je 0x403318
mov dword [eax], 0x422008
mov edx, dword [ebp]
mov dword [edx + 4], 0x402c30
mov eax, dword [ebp]
mov dword [eax + 8], 0x422014
mov ecx, dword [ebp]
mov dword [ecx + 0xc], 0x422030
mov edx, dword [ebp]
mov dword [edx + 0x10], ebx
push str.If__Command_Name__is_provided_displayes_syntax_and_description_of_that_command_otherwise_displays_all_the_avilable_commands
push str.Command_Name
push fcn.00401f00
push str.Help
mov ecx, ebp
call fcn.004010c0
push str.Executes_the_given_system_command__returns_immidiately_
push str.Command
push 0x401960
push str.System
mov ecx, ebp
call fcn.004010c0
push str.call_and_wait_untill_app_is_done.
push str.Exact_path_to_App__arguments
push 0x401990
push str.SysCallAndWait
mov ecx, ebp
call fcn.004010c0
push str.Defines_the_variable_if_not_defined_and_Sets_the_its_value_to_the_given_value._nIf__Value__is_not_given_it_undefines_the_given_variable
push str.Name_Value_
push 0x401e90
push 0x41a45c
mov ecx, ebp
call fcn.004010c0
push str.Outputs_data_after_evaluation
push str.Data
push 0x4017f0
push str.Echo
mov ecx, ebp
call fcn.004010c0
push str.runs_all_the_commands_in_that_section_and_returnd_and_continues_executing_commands_after_that_line
push str.Section_Name
push 0x403130
push str.Call
mov ecx, ebp
call fcn.004010c0
push str.Executes_all_the_commands_in_that_file_and_returns
push str.Path_to_an_NVU_File
push fcn.004028e0
push 0x41a364
mov ecx, ebp
call fcn.004010c0
push str.Run_all_the_commands_in_this_file_and_delete_the_file
push str.Path_to_an_NVU_File
push fcn.004029f0
push str.RunOnce
mov ecx, ebp
call fcn.004010c0
push str.A_dir_will_be_applied_to_the_given_path_and_for_each_file_found_it_sets_variable_current_file_to_that_file_and_calls_the_given_command.
push str.DirPath_Command
push 0x402ac0
push str.DirAndApply
mov ecx, ebp
call fcn.004010c0
push str.Executes_command_if_Exp1_is_the_same_as_Exp2_for__or_Exp1_has_Exp2_for___if___is_added_to_the_beging_of_Exp1_it_will_negate_the_result
push str.___Exp1___Exp2_then_Command
push 0x403030
push 0x41a1c8
mov ecx, ebp
call fcn.004010c0
push str.reEvaluates_the_given_command_and_executes_it
push str.Command
push fcn.00402590
push str.Eval
mov ecx, ebp
call fcn.004010c0
push str.Opens_the_given_log_files_ad_Logs_all_the_commands_in_the_given_file
push str.Filename
push 0x402470
push str.StartLogging
mov ecx, ebp
call fcn.004010c0
push str.Stops_logging_close_the_file
push 0x419865
push fcn.00401920
push str.StopLogging
mov ecx, ebp
call fcn.004010c0
push str.Waits_for_a_number_of_miliseconds_passed_before_executing_the_next_command
push str.milisconds
push 0x401ba0
push 0x41a098
mov ecx, ebp
call fcn.004010c0
push str.Shows_the_given_bitmap_for_the_given_time_number_on_the_screen
push str.milisconds__BitmapPath
push 0x402b20
push str.Splash
mov ecx, ebp
call fcn.004010c0
push str.Allows_waiting_for_a_specific_registry_key_or_value_to_be_deleted
push str.Key_Value_LoopDelay_MaxLoopCount_TimeoutCommand
push 0x402c60
push str.WaitOnRegDel
mov ecx, ebp
call fcn.004010c0
mov dword [ebp + 0x54c], str.Generic_command_class_basic_functionality.
mov dword [ebp + 0x404], ebx
mov eax, 0x80
lea ecx, [ecx]
mov ecx, dword [ebp + 0x404]
mov dword [ebp + ecx*8 + 4], ebx
mov edx, dword [ebp + 0x404]
mov dword [ebp + edx*8 + 8], ebx
add dword [ebp + 0x404], 1
cmp dword [ebp + 0x404], eax
jl 0x4034e0
push 0x104
lea eax, [esp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xc8]
push ecx
push str.windir
mov ecx, ebp
call fcn.00401c90
push 0x104
lea edx, [esp + 0xcc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0xc8]
push eax
push str.sysdir
mov ecx, ebp
call fcn.00401c90
lea ecx, [esp + 0xc8]
push 0x104
push ecx
call fcn.00401b50
add esp, 8
lea edx, [esp + 0xc8]
push edx
push str.syswow64dir
mov ecx, ebp
call fcn.00401c90
lea eax, [esp + 0xc8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xc8]
push ecx
push str.Currentdir
mov ecx, ebp
call fcn.00401c90
push 0x103
lea edx, [esp + 0x1d1]
push ebx
push edx
mov byte [esp + 0x1d8], bl
call fcn.0040a410
add esp, 0xc
lea eax, [esp + 0x1cc]
push eax
push ebx
push ebx
push 0x8023
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x4035eb
push 0x419f5c
lea ecx, [esp + 0x1d0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x1cc]
push edx
push str.wrkdir
mov ecx, ebp
call fcn.00401c90
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebx
push 0x17
lea eax, [esp + 0xd0]
push eax
push edi
call esi
lea ecx, [esp + 0xc8]
push ecx
push str.commonprograms
mov ecx, ebp
call fcn.00401c90
push ebx
push 0x19
lea edx, [esp + 0xd0]
push edx
push edi
call esi
lea eax, [esp + 0xc8]
push eax
push str.commondesktop
mov ecx, ebp
call fcn.00401c90
push str.ALLUSERSPROFILE
call fcn.0040acb3
add esp, 4
push eax
push str.ALLUSERSPROFILEDir
mov ecx, ebp
call fcn.00401c90
push str.USERPROFILE
call fcn.0040acb3
add esp, 4
push eax
push str.USERPROFILEDir
mov ecx, ebp
call fcn.00401c90
push ebx
push 0x26
lea ecx, [esp + 0xd0]
push ecx
push edi
call esi
lea edx, [esp + 0xc8]
push edx
push str.ProgramFilesDir
mov ecx, ebp
call fcn.00401c90
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
movzx esi, ax
push esi
lea eax, [esp + 0xcc]
push str.Language_Resource__d
push eax
call fcn.0040a7d1
add esp, 0xc
lea ecx, [esp + 0xc8]
push ecx
push str.Language_Resource
mov ecx, ebp
call fcn.00401c90
and esi, 0x3ff
push esi
lea edx, [esp + 0xcc]
push str.Language_Resource__d
push edx
call fcn.0040a7d1
add esp, 0xc
lea eax, [esp + 0xc8]
push eax
push str.Primary_Language_Resource
mov ecx, ebp
call fcn.00401c90
push 0x4197b0
push 0x419ec8
mov ecx, ebp
call fcn.00401c90
mov edx, dword [ebp + 0x550]
push 0x104
lea ecx, [esp + 0xcc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x422014
push section..data
mov ecx, ebp
call fcn.00401c90
lea eax, [esp + 0xc8]
push eax
push str.Current_Parser_Path
mov ecx, ebp
call fcn.00401c90
lea ecx, [esp + 0xc8]
push ecx
mov ecx, ebp
call fcn.00401300
push eax
push str.Current_Parser_Name
mov ecx, ebp
call fcn.00401c90
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xcc]
push eax
mov dword [esp + 0x20], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 0xc8]
push ecx
push str.Computer_Name
mov ecx, ebp
call fcn.00401c90
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xcc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [esp + 0xc8]
push ecx
push str.User_Name
mov ecx, ebp
call fcn.00401c90
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0xcc]
push 0x419e80
push ecx
call fcn.0040a7d1
add esp, 0xc
lea edx, [esp + 0xc8]
push edx
push str.OS_Major_Version
mov ecx, ebp
call fcn.00401c90
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0xcc]
push 0x419e80
push ecx
call fcn.0040a7d1
add esp, 0xc
lea edx, [esp + 0xc8]
push edx
push str.OS_Minor_Version
mov ecx, ebp
call fcn.00401c90
mov eax, dword [esp + 0x44]
sub eax, 1
mov dword [ebp + 0x560], ebx
je 0x4038c2
sub eax, 1
jne 0x40390d
push str.ControlClass
push str.DriverBaseRegPath
mov ecx, ebp
call fcn.00401c90
mov eax, dword [esp + 0x38]
cmp eax, 7
jne 0x403872
push str.Win7
jmp 0x403901
cmp eax, 6
jne 0x403881
push str.WinVista
jmp 0x403901
cmp eax, 5
jne 0x4038b6
mov eax, dword [esp + 0x3c]
sub eax, ebx
je 0x4038af
sub eax, 1
je 0x4038a8
sub eax, 1
mov ecx, ebp
je 0x4038a1
push str.Unknown_WIN32_NT5
jmp 0x403903
push str.WinServer2003Family
jmp 0x403903
push str.WinXP
jmp 0x403901
push str.Win2K
jmp 0x403901
cmp eax, 4
jne 0x40390d
push str.WinNT4
jmp 0x403901
push str.ServicesClass
push str.DriverBaseRegPath
mov ecx, ebp
call fcn.00401c90
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x4038fc
cmp eax, 0xa
je 0x4038f5
cmp eax, 0x5a
mov ecx, ebp
je 0x4038ee
push str.Unknown_WIN32_Windows
jmp 0x403903
push str.WinME
jmp 0x403903
push str.Win98
jmp 0x403901
push str.Win95
mov ecx, ebp
push 0x419d9c
call fcn.00401c90
push str.I386
push str.Platform
mov ecx, ebp
call fcn.00401c90
mov ecx, dword [esp + 0x6d0]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a7c2
add esp, 0x6c4
ret 0xc