Function at 0x41dea0
Capabilities:
Delete file
Get common file path
Set registry value
Shutdown system

Disassembly:
sub esp, 0x804
mov eax, dword [0x43c730]
xor eax, esp
mov dword [esp + 0x800], eax
push ebp
push esi
xor ebp, ebp
xor esi, esi
cmp dword [0x4464d8], 2
jne 0x41ded6
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x41e270
call fcn.00419850
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x41e270
push ebx
push edi
push 0x206
lea ecx, [esp + 0x3b6]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x3bc], ax
call fcn.00422290
push 0x24c
lea edx, [esp + 0x174]
push ebp
push edx
mov dword [esp + 0x178], ebp
call fcn.00422290
push 0x94
lea eax, [esp + 0xe8]
push ebp
push eax
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [esp + 0xec], ebp
call fcn.00422290
push 0x94
lea ecx, [esp + 0x5c]
push ebp
push ecx
mov dword [esp + 0x60], ebp
call fcn.00422290
add esp, 0x30
push 0x104
lea edx, [esp + 0x3b4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4343ec
push 0x208
lea eax, [esp + 0x3b8]
push eax
call fcn.00419ab0
push str.mvenable.txt
push 0x208
lea ecx, [esp + 0x3b8]
push ecx
call fcn.00419ab0
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x3b4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x41dfbd
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edi, [esi + 1]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 8
push ebp
push ebp
xor eax, eax
push 0x6e80
push edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call fcn.00404420
test eax, eax
jle 0x41dff6
cmp dword [esp + 0x1c], 0x6e80
jne 0x41dff6
mov ebx, 1
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push 0x98
lea ecx, [esp + 0xd0]
push ecx
push 0x98
push 0x6ea0
push edx
mov dword [esp + 0xe0], 1
call fcn.00404420
test eax, eax
jle 0x41e03a
test dword [esp + 0x30], 0x80000000
je 0x41e03a
mov esi, 1
cmp edi, esi
je 0x41e15b
cmp ebx, ebp
je 0x41e15b
lea eax, [esp + 0x3b0]
push eax
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xc8]
push edx
push 0x98
and ecx, 0x7fffffdf
lea eax, [esp + 0x38]
push eax
or ecx, 0x20
push 0x98
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x28]
push 0x6ea0
push ecx
call fcn.00404420
cmp esi, ebp
je 0x41e24a
mov eax, dword [0x43dae4]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x12c
lea edx, [esp + 0x5bc]
push edx
push 0x4805
push eax
call edi
test eax, eax
jne 0x41e0db
mov edx, dword [0x4464d0]
push 0x12c
lea ecx, [esp + 0x5bc]
push ecx
push 0x4805
push edx
call edi
push 0x40011
push 0xa05
call fcn.004159c0
add esp, 4
push eax
lea eax, [esp + 0x5c0]
push eax
push ebp
call fcn.004157a0
add esp, 0x10
cmp eax, 1
jne 0x41e15d
lea ecx, [esp + 0x10]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0x20]
push edx
push str.SeShutdownPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0x10]
push ebp
push ebp
push ebp
lea eax, [esp + 0x28]
push eax
push ebp
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebp
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebp
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x41e15d
mov ebx, ebp
cmp esi, ebp
je 0x41e24a
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x14]
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SoftwareNVIDIA_CorporationGlobalNVTweak
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41e24a
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push ebp
push str.NoPages
push edx
mov dword [esp + 0x2c], 0xfdffffef
call esi
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push ebp
push str.NoMenus
push ecx
mov dword [esp + 0x2c], 0xcff
call esi
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push ebp
push str.NvCplDisablePerfQualPage
mov edi, 1
push eax
mov dword [esp + 0x2c], edi
call esi
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push ebp
push str.NvCplDisableRefreshRatePage
push edx
mov dword [esp + 0x2c], edi
call esi
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push ebp
push str.NvCplSingleDacDualviewMode
push ecx
mov dword [esp + 0x2c], edi
call esi
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push ebp
push str.NvCplCustomResConfig
push eax
mov dword [esp + 0x2c], edi
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00422272
add esp, 0x804
ret
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.00422272
add esp, 0x804
ret