Function at 0x408970
Capabilities:
Access the windows event log
Delete file
Delete registry key
Get common file path
Get installed programs
Get system information on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x444e76
mov eax, dword fs:[0]
push eax
sub esp, 0xc98
mov eax, dword [0x461008]
xor eax, esp
mov dword [esp + 0xc90], eax
push ebx
push esi
push edi
mov eax, dword [0x461008]
xor eax, esp
push eax
lea eax, [esp + 0xca8]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
mov dword [esp + 0xcb0], eax
call fcn.004047e0
test al, al
jne 0x4089dc
call fcn.004048c0
cmp dword [0x463664], 0
jne 0x4089f7
push 0x44bdb8
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [0x463664], eax
mov eax, dword [0x4622b4]
cmp eax, 0xffffffff
jne 0x408a2c
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [esp + 0x48]
cmp cx, 9
jne 0x408a1e
mov eax, 1
jmp 0x408a27
xor eax, eax
cmp cx, 6
sete al
mov dword [0x4622b4], eax
test eax, eax
mov dword [esp + 0x20], 0
setne al
mov byte [esp + 0x13], al
test al, al
je 0x408a71
cmp dword [0x463bf0], 0
jne 0x408a71
push 0x4565a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x463bf0], eax
test eax, eax
je 0x408a71
lea ecx, [esp + 0x20]
push ecx
call eax
call fcn.004084b0
lea eax, [esp + 0x1c]
push eax
push 0x20106
push 0
push 0x454fe8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408aaf
push 0x44bdb8
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040f270
push str.Driver::Uninstall_r_n
call fcn.00416f00
add esp, 4
mov cl, 1
call fcn.004044b0
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov byte [esp + 0xcb0], 1
call fcn.00415a20
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x44bdb8
push eax
lea eax, [esp + 0x484]
push eax
call ebx
push 0x454f50
lea eax, [esp + 0x480]
push eax
lea eax, [esp + 0x894]
push eax
call ebx
lea eax, [esp + 0x88c]
push eax
call fcn.004319e0
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.00402070
mov esi, dword [esp + 0x28]
test esi, esi
je 0x408b3e
mov dword [esi], edi
lea eax, [esp + 0x47c]
add esi, 4
push eax
mov dword [esp + 0x2c], esi
call fcn.004319e0
mov edi, eax
add esp, 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
cmp eax, esi
jae 0x408b97
mov ecx, eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
ja 0x408b97
mov edi, ecx
sub edi, eax
sar edi, 2
cmp esi, dword [esp + 0x2c]
jne 0x408b8c
push ecx
lea ecx, [esp + 0x28]
call fcn.00402070
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
test esi, esi
je 0x408bb1
mov eax, dword [eax + edi*4]
mov dword [esi], eax
jmp 0x408bb1
cmp esi, dword [esp + 0x2c]
jne 0x408bab
push ecx
lea ecx, [esp + 0x28]
call fcn.00402070
mov esi, dword [esp + 0x28]
test esi, esi
je 0x408bb1
mov dword [esi], edi
add esi, 4
cmp byte [esp + 0x13], 0
mov dword [esp + 0x28], esi
je 0x408c8b
cmp word [0x464008], 0
jne 0x408be0
push 0x464008
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [0x464210], 0
jne 0x408bfa
push 0x104
push 0x464210
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers
push 0x464210
lea eax, [esp + 0x68c]
push eax
call ebx
push 0x454f7c
lea eax, [esp + 0x688]
push eax
lea eax, [esp + 0x74]
push eax
call ebx
lea eax, [esp + 0x6c]
push eax
call fcn.004319e0
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
call fcn.0040a7e0
push 0x454f98
push 0x464008
lea eax, [esp + 0x74]
push eax
call ebx
lea eax, [esp + 0x6c]
push eax
call fcn.004319e0
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
call fcn.0040a7e0
push 0x454f98
push 0x464210
lea eax, [esp + 0x74]
push eax
call ebx
lea eax, [esp + 0x6c]
jmp 0x408d0d
cmp word [0x464210], 0
jne 0x408ca5
push 0x104
push 0x464210
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers
push 0x464210
lea eax, [esp + 0xa9c]
push eax
call ebx
push 0x454f7c
lea eax, [esp + 0xa98]
push eax
lea eax, [esp + 0x27c]
push eax
call ebx
lea eax, [esp + 0x274]
push eax
call fcn.004319e0
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
call fcn.0040a7e0
push 0x454f98
push 0x464210
lea eax, [esp + 0x27c]
push eax
call ebx
lea eax, [esp + 0x274]
push eax
call fcn.004319e0
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
call fcn.0040a7e0
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov ecx, dword [esp + 0x24]
xor edi, edi
sub eax, ecx
sar eax, 2
mov dword [esp + 0x18], eax
test eax, eax
je 0x408de6
mov esi, dword [ecx + edi*4]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x408d67
push esi
push str._Uninstaller__Deleted___ws__r_n
call fcn.00416f00
add esp, 8
jmp 0x408dd7
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x408d8b
push esi
push str._Uninstaller__Delete_until_reboot___ws__r_n
call fcn.00416f00
add esp, 8
mov ebx, 1
jmp 0x408dd7
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.MoveFileEx___ls___failed_with_error__d_r_n
call fcn.00414e90
mov esi, eax
add esp, 0xc
cmp word [esi], 0
jne 0x408daf
xor ecx, ecx
jmp 0x408dc3
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408db4
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x38]
call fcn.00403ce0
push esi
call fcn.004323fa
add esp, 4
mov ecx, dword [esp + 0x24]
inc edi
cmp edi, dword [esp + 0x18]
jb 0x408d45
cmp byte [esp + 0x13], 0
je 0x408e1d
cmp dword [0x463bec], 0
mov esi, dword [esp + 0x20]
jne 0x408e1d
push 0x4565a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x463bec], eax
test eax, eax
je 0x408e1d
push esi
call eax
test ebx, ebx
jne 0x408e30
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xdc
push ebx
push 4
jmp 0x408e73
cmp ebx, 1
jne 0x408e4a
push 0
push 0
push 0
push 0
push 0
push 0xdd
push 0
push 4
jmp 0x408e73
cmp dword [esp + 0x44], 8
mov eax, dword [esp + 0x30]
jae 0x408e59
lea eax, [esp + 0x30]
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 1
push 0
push 0xe5
push 1
push 1
push dword [0x463664]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x408e9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReportEvent
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov eax, dword [esp + 0x24]
test eax, eax
je 0x408ead
push eax
call fcn.0043198a
add esp, 4
cmp dword [esp + 0x44], 8
jb 0x408ec0
push dword [esp + 0x30]
call fcn.0043198a
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0xca8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc90]
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret