Function at 0x403410
Capabilities:
Encode data using xor
Get common file path
Get program files directory
Get session user name
Terminate process

Disassembly:
sub esp, 0x6cc
mov eax, dword [0x4293c0]
xor eax, esp
mov dword [esp + 0x6c8], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6e4]
push str.CommandClass::CommandClass_n
mov ebp, ecx
mov dword [esp + 0x18], edi
call fcn.00404160
add esp, 4
push str.IsWow64Process
xor ebx, ebx
push str.kernel32
mov byte [ebp], bl
call dword [0x41d0bc]
push eax
call dword [0x41d0b8]
mov esi, eax
cmp esi, ebx
je 0x4034b6
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
call dword [0x41d0f0]
push eax
call esi
test eax, eax
je 0x4034b6
cmp dword [esp + 0x10], ebx
je 0x4034b6
push str.I386
lea ecx, [esp + 0x2dc]
push str.You_are_running_a_32_bit_version_of_Nvidia_uninstaller_on_a_64_bit_system__Binary_type__s_._nWrong_version_of_uninstaller._Uninstaller_exits_now.
push ecx
call fcn.0040dd41
add esp, 0xc
push 0x10
push str.Fatal_Error
lea edx, [esp + 0x2e0]
push edx
push edi
call dword [0x41d308]
push ebx
call fcn.0040e9ac
xor ecx, ecx
mov dword [ebp + 0x54c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ecx
jmp 0x4034d0
mov esi, dword [esp + ecx*4 + 0x1c]
movsx eax, byte [esi*4 + section..data]
lea edx, [esi*4 + section..data]
lea ebx, [eax + 4]
shr ebx, 2
add ebx, esi
mov dword [esp + ecx*4 + 0x20], ebx
xor ebx, ebx
cmp eax, ebx
jle 0x403524
lea ecx, [eax + edx - 1]
mov esi, eax
jmp 0x403500
mov bl, byte [ecx + 1]
xor byte [ecx], bl
sub ecx, 1
sub esi, 1
jne 0x403500
xor ebx, ebx
cmp eax, ebx
jle 0x40351c
lea esi, [edx + 1]
mov ecx, eax
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add ecx, 1
cmp ecx, 5
mov byte [eax + edx], bl
mov dword [esp + 0x10], ecx
jl 0x4034d0
mov eax, dword [esp + 0x6e0]
mov ecx, dword [esp + 0x6e8]
push 0x14
mov dword [ebp + 0x558], 0x41d9bd
mov dword [ebp + 0x55c], edi
mov dword [ebp + 0x554], eax
mov dword [ebp + 0x560], ecx
call fcn.0040d90b
add esp, 4
cmp eax, ebx
mov dword [ebp + 4], eax
je 0x403598
mov dword [eax], 0x429008
mov edx, dword [ebp + 4]
mov dword [edx + 4], 0x402ea0
mov eax, dword [ebp + 4]
mov dword [eax + 8], 0x429014
mov ecx, dword [ebp + 4]
mov dword [ecx + 0xc], 0x429030
mov edx, dword [ebp + 4]
mov dword [edx + 0x10], ebx
push str.If__Command_Name__is_provided_displayes_syntax_and_description_of_that_command_otherwise_displays_all_the_avilable_commands
push str.Command_Name
push fcn.00401ff0
push str.Help
mov ecx, ebp
call fcn.00401090
push str.Executes_the_given_system_command__returns_immidiately_
push str.Command
push 0x4019c0
push str.System
mov ecx, ebp
call fcn.00401090
push str.call_and_wait_untill_app_is_done.
push str.Exact_path_to_App__arguments
push 0x4019f0
push str.SysCallAndWait
mov ecx, ebp
call fcn.00401090
push str.Defines_the_variable_if_not_defined_and_Sets_the_its_value_to_the_given_value._nIf__Value__is_not_given_it_undefines_the_given_variable
push str.Name_Value_
push 0x401f80
push 0x41e6c4
mov ecx, ebp
call fcn.00401090
push str.Outputs_data_after_evaluation
push str.Data
push 0x401850
push str.Echo
mov ecx, ebp
call fcn.00401090
push str.runs_all_the_commands_in_that_section_and_returnd_and_continues_executing_commands_after_that_line
push str.Section_Name
push 0x4033a0
push str.Call
mov ecx, ebp
call fcn.00401090
push str.Executes_all_the_commands_in_that_file_and_returns
push str.Path_to_an_NVU_File
push fcn.00402a60
push 0x41e5cc
mov ecx, ebp
call fcn.00401090
push str.Run_all_the_commands_in_this_file_and_delete_the_file
push str.Path_to_an_NVU_File
push fcn.00402bc0
push str.RunOnce
mov ecx, ebp
call fcn.00401090
push str.A_dir_will_be_applied_to_the_given_path_and_for_each_file_found_it_sets_variable_current_file_to_that_file_and_calls_the_given_command.
push str.DirPath_Command
push 0x402d30
push str.DirAndApply
mov ecx, ebp
call fcn.00401090
push str.Executes_command_if_Exp1_is_the_same_as_Exp2_for__or_Exp1_has_Exp2_for___if___is_added_to_the_beging_of_Exp1_it_will_negate_the_result
push str.___Exp1___Exp2_then_Command
push 0x4032a0
push 0x41e430
mov ecx, ebp
call fcn.00401090
push str.reEvaluates_the_given_command_and_executes_it
push str.Command
push fcn.004026a0
push str.Eval
mov ecx, ebp
call fcn.00401090
push str.Opens_the_given_log_files_ad_Logs_all_the_commands_in_the_given_file
push str.Filename
push 0x402580
push str.StartLogging
mov ecx, ebp
call fcn.00401090
push str.Stops_logging_close_the_file
push 0x41d9bd
push fcn.00401980
push str.StopLogging
mov ecx, ebp
call fcn.00401090
push str.Waits_for_a_number_of_miliseconds_passed_before_executing_the_next_command
push str.milisconds
push 0x401c90
push 0x41e300
mov ecx, ebp
call fcn.00401090
push str.Shows_the_given_bitmap_for_the_given_time_number_on_the_screen
push str.milisconds__BitmapPath
push 0x402d90
push str.Splash
mov ecx, ebp
call fcn.00401090
push str.Allows_waiting_for_a_specific_registry_key_or_value_to_be_deleted
push str.Key_Value_LoopDelay_MaxLoopCount_TimeoutCommand
push 0x402ed0
push str.WaitOnRegDel
mov ecx, ebp
call fcn.00401090
mov dword [ebp + 0x550], str.Generic_command_class_basic_functionality.
mov dword [ebp + 0x408], ebx
mov eax, 0x80
lea ecx, [ecx]
mov ecx, dword [ebp + 0x408]
mov dword [ebp + ecx*8 + 8], ebx
mov edx, dword [ebp + 0x408]
mov dword [ebp + edx*8 + 0xc], ebx
add dword [ebp + 0x408], 1
cmp dword [ebp + 0x408], eax
jl 0x403760
push 0x104
lea eax, [esp + 0xd4]
push eax
call dword [0x41d0ec]
lea ecx, [esp + 0xd0]
push ecx
push str.windir
mov ecx, ebp
call fcn.00401d80
push 0x104
lea edx, [esp + 0xd4]
push edx
call dword [0x41d0b4]
lea eax, [esp + 0xd0]
push eax
push 0x41e1d4
mov ecx, ebp
call fcn.00401d80
lea ecx, [esp + 0xd0]
push 0x104
push ecx
call fcn.00401c40
add esp, 8
lea edx, [esp + 0xd0]
push edx
push str.syswow64dir
mov ecx, ebp
call fcn.00401d80
lea eax, [esp + 0xd0]
push eax
push 0x104
call dword [0x41d0e8]
lea ecx, [esp + 0xd0]
push ecx
push str.Currentdir
mov ecx, ebp
call fcn.00401d80
push 0x103
lea edx, [esp + 0x1d9]
push ebx
push edx
mov byte [esp + 0x1e0], bl
call fcn.0040d980
mov esi, dword [0x41d2d8]
add esp, 0xc
lea eax, [esp + 0x1d4]
push eax
push ebx
push ebx
push 0x8023
push ebx
call esi
test eax, eax
jne 0x40386d
push 0x41e1c0
lea ecx, [esp + 0x1d8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x1d4]
push edx
push str.wrkdir
mov ecx, ebp
call fcn.00401d80
lea eax, [esp + 0x1d4]
push eax
push ebx
push ebx
push 0x8023
push ebx
call esi
test eax, eax
jne 0x4038ab
lea ecx, [esp + 0x1d4]
push ecx
push str.pgmdir
mov ecx, ebp
call fcn.00401d80
mov esi, dword [0x41d2dc]
push ebx
push 0x17
lea edx, [esp + 0xd8]
push edx
push edi
call esi
lea eax, [esp + 0xd0]
push eax
push str.commonprograms
mov ecx, ebp
call fcn.00401d80
push ebx
push 0x19
lea ecx, [esp + 0xd8]
push ecx
push edi
call esi
lea edx, [esp + 0xd0]
push edx
push str.commondesktop
mov ecx, ebp
call fcn.00401d80
push str.ALLUSERSPROFILE
call fcn.0040e699
add esp, 4
push eax
push str.ALLUSERSPROFILEDir
mov ecx, ebp
call fcn.00401d80
push str.USERPROFILE
call fcn.0040e699
add esp, 4
push eax
push str.USERPROFILEDir
mov ecx, ebp
call fcn.00401d80
push ebx
push 0x26
lea eax, [esp + 0xd8]
push eax
push edi
call esi
lea ecx, [esp + 0xd0]
push ecx
push 0x41e140
mov ecx, ebp
call fcn.00401d80
call dword [0x41d0e4]
movzx eax, ax
movzx esi, ax
push esi
lea edx, [esp + 0xd4]
push str.Language_Resource__d
push edx
call fcn.0040dd41
add esp, 0xc
lea eax, [esp + 0xd0]
push eax
push str.Language_Resource
mov ecx, ebp
call fcn.00401d80
and esi, 0x3ff
push esi
lea ecx, [esp + 0xd4]
push str.Language_Resource__d
push ecx
call fcn.0040dd41
add esp, 0xc
lea edx, [esp + 0xd0]
push edx
push str.Primary_Language_Resource
mov ecx, ebp
call fcn.00401d80
push 0x41d8c0
push 0x41e124
mov ecx, ebp
call fcn.00401d80
push 0x104
lea eax, [esp + 0xd4]
push eax
mov ecx, dword [ebp + 0x554]
push ecx
call dword [0x41d0c4]
push 0x429014
push section..data
mov ecx, ebp
call fcn.00401d80
lea edx, [esp + 0xd0]
push edx
push str.Current_Parser_Path
mov ecx, ebp
call fcn.00401d80
lea eax, [esp + 0xd0]
push eax
mov ecx, ebp
call fcn.004012d0
push eax
push str.Current_Parser_Name
mov ecx, ebp
call fcn.00401d80
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xd4]
push edx
mov dword [esp + 0x20], 0x104
call dword [0x41d0e0]
lea eax, [esp + 0xd0]
push eax
push str.Computer_Name
mov ecx, ebp
call fcn.00401d80
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xd4]
push edx
call dword [0x41d074]
lea eax, [esp + 0xd0]
push eax
push str.User_Name
mov ecx, ebp
call fcn.00401d80
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0x9c
call dword [0x41d0dc]
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0xd4]
push 0x41e0dc
push eax
call fcn.0040dd41
add esp, 0xc
lea ecx, [esp + 0xd0]
push ecx
push str.OS_Major_Version
mov ecx, ebp
call fcn.00401d80
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0xd4]
push 0x41e0dc
push eax
call fcn.0040dd41
add esp, 0xc
lea ecx, [esp + 0xd0]
push ecx
push str.OS_Minor_Version
mov ecx, ebp
call fcn.00401d80
mov eax, dword [esp + 0x44]
sub eax, 1
mov dword [ebp + 0x564], ebx
je 0x403b6e
sub eax, 1
jne 0x403bb9
push str.ControlClass
push str.DriverBaseRegPath
mov ecx, ebp
call fcn.00401d80
mov eax, dword [esp + 0x38]
cmp eax, 7
jne 0x403b1e
push str.Win7
jmp 0x403bad
cmp eax, 6
jne 0x403b2d
push str.WinVista
jmp 0x403bad
cmp eax, 5
jne 0x403b62
mov eax, dword [esp + 0x3c]
sub eax, ebx
je 0x403b5b
sub eax, 1
je 0x403b54
sub eax, 1
mov ecx, ebp
je 0x403b4d
push str.Unknown_WIN32_NT5
jmp 0x403baf
push str.WinServer2003Family
jmp 0x403baf
push str.WinXP
jmp 0x403bad
push str.Win2K
jmp 0x403bad
cmp eax, 4
jne 0x403bb9
push str.WinNT4
jmp 0x403bad
push str.ServicesClass
push str.DriverBaseRegPath
mov ecx, ebp
call fcn.00401d80
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x403ba8
cmp eax, 0xa
je 0x403ba1
cmp eax, 0x5a
mov ecx, ebp
je 0x403b9a
push str.Unknown_WIN32_Windows
jmp 0x403baf
push str.WinME
jmp 0x403baf
push str.Win98
jmp 0x403bad
push str.Win95
mov ecx, ebp
push 0x41dff8
call fcn.00401d80
push str.I386
push str.Platform
mov ecx, ebp
call fcn.00401d80
mov ecx, dword [esp + 0x6d8]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0040dd32
add esp, 0x6cc
ret 0xc