Function at 0x409770
Capabilities:
Delete directory
Delete file
Get file attributes
Set file attributes
Shutdown system

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x578
mov qword [rsp + 0x570], rbx
mov qword [rsp + 0x568], rdi
mov rbx, rcx
mov qword [rsp + 0x48], 0xfffffffffffffffe
lea rdx, str.set_UninstallFilessysdir.nvu
call fcn.00403690
lea rdx, str.UninstallFiles
mov rcx, rbx
call fcn.00401dc0
mov dword [rsp + 0x30], 0
lea r9, [0x00404fc0]
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbx
call fcn.00401c00
cmp dword [rsp + 0x30], 0
jne 0x4098a7
cmp byte [rbx + 0xb49], 0
je 0x4098a7
mov r8d, 0x80
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0xaa0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x40981f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40987a
mov byte [rsp + 0xd0], 0x88
mov r8d, 0x4000
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x40987a
mov edx, 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40987a
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.00405310
or byte [rbx + 0xb48], al
lea rdx, str.set_Current_File
mov rcx, rbx
call fcn.00403690
lea rdx, str.DirAndApply_sysdir_nvu.exe_del_Current_File
mov rcx, rbx
call fcn.00403690
lea rdx, str.Delreg_NVUninst_RegKey
mov rcx, rbx
call fcn.00403690
lea rdx, str.ForceNoReboot
mov rcx, rbx
call fcn.00401dc0
cmp byte [rbx + 0xb48], 0
je 0x409a55
test rax, rax
je 0x4098e0
lea rdx, [0x0040c6b0]
mov rcx, rax
call qword [sym.imp.msvcrt.dll__mbsicmp]
test eax, eax
je 0x409a55
lea rdx, str.Silent
mov rcx, rbx
call fcn.00401dc0
test rax, rax
je 0x40990c
lea rdx, [0x0040c6b0]
mov rcx, rax
call qword [sym.imp.msvcrt.dll__mbsicmp]
test eax, eax
je 0x4099cb
lea rdx, str.Two_Reboot_Required
mov rcx, rbx
call fcn.00401dc0
test rax, rax
je 0x409961
lea rdx, [0x0040c6b0]
mov rcx, rax
call qword [sym.imp.msvcrt.dll__mbsicmp]
test eax, eax
jne 0x409961
mov edx, 0xa
mov rcx, rbx
call entry0
lea rdx, [rsp + 0x160]
nop
nop
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x409950
jmp 0x409969
mov byte [rsp + 0x160], 0
mov edx, 2
mov rcx, rbx
call entry0
mov r11, rax
lea rdi, [rsp + 0x160]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor edx, edx
nop
movzx ecx, byte [r11 + rdx]
mov byte [rdi + rdx - 1], cl
inc rdx
test cl, cl
jne 0x409990
mov r9d, 0x40024
mov r8, qword [rbx + 0xa98]
lea rdx, [rsp + 0x160]
mov rcx, qword [rbx + 0xab0]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x409a55
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [rsp + 0x44], 2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x409a41
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, InitCommonControls
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
nop
mov rcx, rbx
mov rbx, qword [rsp + 0x570]
mov rdi, qword [rsp + 0x568]
add rsp, 0x578
jmp fcn.004029e0