Function at 0x45d4b0
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry key
Get common file path
Get startup folder
Move file
Query or enumerate registry value
Read .ini file
Self delete
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b357
mov eax, dword fs:[0]
push eax
mov eax, 0x1488
call fcn.00493de0
mov eax, dword [0x594624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x428], 0x45ad80
mov dword [ebp - 0x424], ebx
lea eax, [ebp - 0x42c]
mov dword [ebp - 4], 0
push eax
call fcn.0044bd70
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x430]
mov dword [ebp - 4], 1
push eax
call fcn.0044bd70
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.0045b3b0
call fcn.00412c30
mov ecx, eax
test ecx, ecx
je 0x45e643
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1448], eax
push 0x557230
lea ecx, [ebp - 0x1448]
mov dword [ebp - 4], 2
call fcn.0041db10
test al, al
jne 0x45d5a4
push 0xa
push 0x557230
lea ecx, [ebp - 0x1448]
call fcn.0040e3c0
cmp dword [ebx + 0x7c], 0
mov dword [ebp - 4], 3
je 0x45d722
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004daa30
lea eax, [ebp - 0x438]
mov dword [ebp - 0x1444], 1
push 2
push eax
mov dword [ebp - 0x1440], 0x208
call fcn.0042de70
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x45d5f5
mov eax, dword [eax]
lea ecx, [ebp - 0x1440]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x1444]
push ecx
push str.Setup_Path
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x438]
call fcn.00421a70
cmp word [ebp - 0x218], 0
je 0x45d714
push 0x54fc64
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45d714
push 0x208
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.004daa30
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x640]
push eax
push 0x54ca30
push 0x551964
push str.three_end
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x640]
push 0x5504b8
push eax
call fcn.005055ff
add esp, 8
test eax, eax
jne 0x45d714
push str.LdsLite_is_act:0
call fcn.00453ab0
add esp, 4
lea eax, [ebp - 0x218]
push eax
push 0
push 0x551964
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1458], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.uninst_act_lite
mov byte [ebp - 4], 4
call fcn.004297a0
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00423cc0
mov dword [ebx + 0x80], 1
jmp 0x45d722
lea ecx, [ebx + 0x78]
call fcn.00464f10
mov dword [ebx + 0x80], eax
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 2
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 5
push eax
call fcn.0044bd70
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004daa30
add esp, 0x10
lea eax, [ebp - 0x218]
push str.UtilsMiniNews.exe
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call fcn.00451850
mov edi, dword [ebp - 0x1448]
lea eax, [ebp - 0x218]
push 0x1388
push 0
push 1
push 1
push 1
push edi
push eax
call fcn.00451a50
push edi
lea eax, [ebp - 0x218]
push eax
push str.Call_exe:_s_param:_s
call fcn.00453ab0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 3
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 6
push eax
call fcn.0044bd70
push str.start_call_program
mov byte [ebp - 4], 3
call fcn.00453ab0
mov eax, dword [ebx + 8]
add esp, 0x14
push dword [eax - 0xc]
push eax
call fcn.004536f0
mov ecx, eax
call fcn.004536d0
mov ecx, eax
call fcn.00455960
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 4
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 7
push eax
call fcn.0044bd70
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004daa30
add esp, 0x10
lea eax, [ebp - 0x218]
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.UtilsLDSGameCenter_ludashi.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0xe40]
push 0
push eax
call fcn.004daa30
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0xe40]
add esp, 0xc
push dword [ebx + 8]
push eax
call esi
push str.GameCenterGameUninst.exe
lea eax, [ebp - 0xe40]
push eax
call esi
call fcn.00412c30
mov ecx, eax
test ecx, ecx
je 0x45e64d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1440], eax
push str._S__PIDludashi
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 8
call fcn.0041db10
test al, al
jne 0x45d90f
push 0xf
push str._S__PIDludashi
lea ecx, [ebp - 0x1440]
call fcn.0040e3c0
cmp dword [ebx + 0x88], 0
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 9
je 0x45d92b
push 0xb
push str.__UNINSTALL
jmp 0x45d932
push 0xd
push str.__NOUNINSTALL
call fcn.00421d00
mov esi, dword [ebp - 0x1440]
lea eax, [ebp - 0x218]
push 0xbb8
push 0
push 1
push 1
push 1
push esi
push eax
call fcn.00451a50
push esi
lea eax, [ebp - 0x218]
push eax
push str.Call_exe:_s_param:_s
call fcn.00453ab0
add esp, 0xc
lea eax, [ebp - 0xe40]
push 0xbb8
push 0
push 1
push 1
push 1
push esi
push eax
call fcn.00451a50
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45d9a2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 5
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xa
push eax
call fcn.0044bd70
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 6
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xb
push eax
call fcn.0044bd70
add esp, 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1444]
mov dword [ebp - 0x1444], ebx
lea ecx, [ebx + 0x8c]
mov dword [ebp - 0x1440], 0x45cc50
push eax
lea eax, [ebp - 0x1440]
push eax
call fcn.00459120
push 0x7530
lea ecx, [ebx + 0x8c]
call fcn.0045ac80
test al, al
jne 0x45dc3e
xorps xmm0, xmm0
mov dword [ebp - 0x148c], 0
lea eax, [ebp - 0x1494]
mov dword [ebp - 0x147c], 0
push eax
movlpd qword [ebp - 0x1474], xmm0
movlpd qword [ebp - 0x146c], xmm0
movlpd qword [ebp - 0x1464], xmm0
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x1494], 0x3c
mov dword [ebp - 0x1484], 0x5572b8
mov dword [ebp - 0x1488], 0x54e3e0
mov dword [ebp - 0x1480], str._c_netsh_winsock_reset
mov dword [ebp - 0x1478], 0
mov dword [ebp - 0x1490], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x45dc3e
push 0x2710
push dword [ebp - 0x145c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x45dc3e
push dword [ebp - 0x145c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SOFTWARELudashiLspUrl
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004daa30
add esp, 0xc
mov dword [ebp - 0x1440], 0
lea eax, [ebp - 0x1440]
push eax
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x1440]
test eax, eax
je 0x45dc3e
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x45dc3e
push 0x208
lea eax, [ebp - 0xe40]
push 0
push eax
call fcn.004daa30
add esp, 0xc
lea eax, [ebp - 0xe40]
push eax
push 0
push str.lds
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x45dbe2
push str.netload.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0xe40]
push 1
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0xe40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45dbe2
push 4
push eax
lea eax, [ebp - 0xe40]
push eax
call esi
push 0x208
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.004daa30
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x45dc3e
push str.ldscon
lea eax, [ebp - 0x640]
push 0x104
push eax
call fcn.0050c579
lea eax, [ebx + 4]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.00431600
add esp, 0x18
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 7
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xc
push eax
call fcn.0044bd70
push 1
push dword [ebx + 8]
lea esi, [ebx + 8]
mov byte [ebp - 4], 3
call fcn.0042be40
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 8
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xd
push eax
call fcn.0044bd70
push str.start_close_all_processes
mov byte [ebp - 4], 3
call fcn.00453ab0
add esp, 0x14
push 0
push esi
call fcn.004536f0
mov ecx, eax
call fcn.004536d0
push eax
call fcn.0045fbe0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 9
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xe
push eax
call fcn.0044bd70
push str.start_close_band
mov byte [ebp - 4], 3
call fcn.00453ab0
add esp, 0x14
mov ecx, ebx
call fcn.00459c00
push str.start_uninstall_shellext
call fcn.00453ab0
add esp, 4
mov ecx, ebx
call fcn.0045e820
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xa
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xf
push eax
call fcn.0044bd70
add esp, 4
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.0045ea50
push str.remove_desktop_shortcuts
call fcn.00453ab0
add esp, 4
mov ecx, ebx
call fcn.0045c540
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xb
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x10
push eax
call fcn.0044bd70
push str.remove_start_menu_shortcuts
mov byte [ebp - 4], 3
call fcn.00453ab0
push 0x800
lea eax, [ebp - 0xc38]
push 0
push eax
call fcn.004daa30
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xc38]
add esp, 0x14
push 1
push 0x17
push eax
push 0
call esi
push 0x54e728
lea eax, [ebp - 0xc38]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc38]
push eax
call fcn.00452b10
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xc
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x11
push eax
call fcn.0044bd70
push str.remove_appdata
mov byte [ebp - 4], 3
call fcn.00453ab0
push 0x800
lea eax, [ebp - 0xc38]
push 0
push eax
call fcn.004daa30
add esp, 0x18
lea eax, [ebp - 0xc38]
push 1
push 0x1a
push eax
push 0
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc38]
push str.Ludashi
push eax
push eax
call esi
push 0x800
lea eax, [ebp - 0x1438]
push 0
push eax
call fcn.004daa30
add esp, 0xc
lea eax, [ebp - 0xc38]
push str.no_delete_me.txt
push eax
lea eax, [ebp - 0x1438]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0xc38]
push eax
call esi
test eax, eax
je 0x45def5
lea eax, [ebp - 0x1438]
push eax
call esi
test eax, eax
jne 0x45def5
lea eax, [ebp - 0xc38]
push eax
call fcn.00452b10
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xd
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x12
push eax
call fcn.0044bd70
push str.remove_file_by_registry
mov byte [ebp - 4], 3
call fcn.00453ab0
lea eax, [ebx + 0xc]
push eax
push 1
push dword [ebx + 8]
call fcn.0042c5f0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xe
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x13
push eax
call fcn.0044bd70
push str.remove_registry
mov byte [ebp - 4], 3
call fcn.00453ab0
add esp, 0x1c
mov ecx, ebx
call fcn.0045cd00
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xf
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x14
push eax
call fcn.0044bd70
push str.remove_autorun
mov byte [ebp - 4], 3
call fcn.00453ab0
add esp, 8
lea ecx, [ebp - 0x1439]
call fcn.00467ba0
push 1
push str.ComputerZ_Tray
lea ecx, [ebp - 0x1439]
mov byte [ebp - 4], 0x15
call fcn.00469320
push 0
push str.ComputerZ_Tray
lea ecx, [ebp - 0x1439]
call fcn.00469320
push eax
push str.Delete_AutoRun_Registry__ret___d
call fcn.00453ab0
add esp, 8
lea ecx, [ebp - 0x1439]
push str.ComputerZ_Tray
call fcn.00469500
push eax
push str.Delete_AutoRun_Task_Schedule__ret___d
call fcn.00453ab0
add esp, 8
lea ecx, [ebp - 0x1439]
call fcn.00468000
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x10
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x16
push eax
call fcn.0044bd70
add esp, 4
mov byte [ebp - 4], 3
call fcn.00412c30
mov ecx, eax
test ecx, ecx
je 0x45e657
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1440], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLudashi_is1
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 0x17
call fcn.0041db10
test al, al
jne 0x45e0c2
push 0x3f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLudashi_is1
lea ecx, [ebp - 0x1440]
call fcn.0040e3c0
mov esi, dword [ebp - 0x1440]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x18
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.00453ab0
add esp, 4
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45e101
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x11
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x19
push eax
call fcn.0044bd70
push str.ComputerZLock
mov byte [ebp - 4], 3
call fcn.0046b530
push str.ComputerZLock
call fcn.0046b690
push dword [0x593444]
call fcn.0046b530
push dword [0x593444]
call fcn.0046b690
push dword [0x593440]
call fcn.0046b530
push dword [0x593440]
call fcn.0046b690
push str.HardwareTM
call fcn.0046b530
push str.HardwareTM
call fcn.0046b690
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x12
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1a
push eax
call fcn.0044bd70
push 0x208
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004daa30
add esp, 0x34
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.ComputerZ_PowerSaveDll.dll
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e2af
lea eax, [ebp - 0x420]
xor esi, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x45e280
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e280
lea eax, [ebp - 0x420]
push eax
call fcn.00471250
add esp, 4
test eax, eax
je 0x45e280
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x45e280
push dword [0x593400]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45e280
call eax
mov esi, eax
test esi, esi
je 0x45e2a2
mov eax, dword [esi]
push esi
call dword [eax]
test eax, eax
je 0x45e2af
push str.powerSaveHelper__DeletePowerScheme
call fcn.00453ab0
mov eax, dword [esi]
add esp, 4
push esi
call dword [eax + 0x34]
jmp 0x45e2af
push str.powerSaveHelper_is_nil
call fcn.00453ab0
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x13
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1b
push eax
call fcn.0044bd70
push str.UtilsPCStoreSetup_officialwebsite.dll
lea esi, [ebx + 8]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1444]
push esi
push eax
call fcn.00459b10
push 1
push 0x5574a8
push 0x54e494
push dword [eax]
mov byte [ebp - 4], 0x1c
call fcn.0042c3b0
mov edx, dword [ebp - 0x1444]
add esp, 0x20
mov byte [ebp - 4], 3
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45e338
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x14
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1d
push eax
call fcn.0044bd70
add esp, 4
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.0045d100
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x15
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1e
push eax
call fcn.0044bd70
push dword [esi]
mov byte [ebp - 4], 3
push str.start_delete_all_files_in__s
call fcn.00453ab0
add esp, 0xc
mov ecx, ebx
push dword [esi]
call fcn.0045bdc0
push dword [esi]
push str.end_delete_all_files_in__s
call fcn.00453ab0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x62
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1f
push eax
call fcn.0044bd70
push str.start_create_runonce_bat
mov byte [ebp - 4], 3
call fcn.00453ab0
push dword [esi]
lea eax, [ebx + 0xc]
push eax
call fcn.00430150
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x63
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x20
push eax
call fcn.0044bd70
push str.start_ending_report.
mov byte [ebp - 4], 3
call fcn.00453ab0
add esp, 0x20
mov ecx, ebx
call fcn.0045a280
call fcn.004536e0
push eax
mov dword [ebp - 0x1444], eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x45e4cc
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1458], esp
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x1444]
push 0
push 0
push ecx
mov eax, dword [ecx]
mov byte [ebp - 4], 0x21
call dword [eax + 0x1c]
test eax, eax
mov edx, str.inst_lite_fail
mov ecx, str.inst_lite_suc
cmove ecx, edx
push ecx
call fcn.004297a0
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00423cc0
mov edx, dword [esi]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45e4f0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x438]
call fcn.00432180
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0x22
push 0x4e20
push eax
call fcn.004d8290
mov edx, dword [ebp - 0x424]
add esp, 8
mov byte [ebp - 0x1439], al
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x45e574
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45e564
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45e661
push edx
push ecx
call fcn.004939be
mov al, byte [ebp - 0x1439]
add esp, 8
test al, al
je 0x45e585
push str.remove_dnf.
call fcn.00453ab0
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45ad60
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x64
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x23
push eax
call fcn.0044bd70
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1450], 0x45ad50
mov dword [ebp - 0x144c], ebx
lea eax, [ebp - 0x1454]
mov byte [ebp - 4], 0x24
push eax
call fcn.0044bd70
add esp, 8
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1450], 0
add edi, 0xfffffff0
mov dword [ebp - 0x144c], 0
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45e623
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493dce
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.0040b4c0
push 0x80004005
call fcn.0040b4c0
push 0x80004005
call fcn.0040b4c0
call fcn.004e61b8
int3