Function at 0x460900
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry key
Get common file path
Get startup folder
Move file
Query or enumerate registry value
Read .ini file
Self delete
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d551
mov eax, dword fs:[0]
push eax
mov eax, 0x1488
call fcn.00496d60
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x428], 0x45e2d0
mov dword [ebp - 0x424], ebx
lea eax, [ebp - 0x42c]
mov dword [ebp - 4], 0
push eax
call fcn.0044f390
push 0
call fcn.0050da02
mov dword [ebx + 0xc4], eax
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x430]
mov dword [ebp - 4], 1
push eax
call fcn.0044f390
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.0045e900
call fcn.004126e0
mov ecx, eax
test ecx, ecx
je 0x4619a5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1448], eax
push 0x559630
lea ecx, [ebp - 0x1448]
mov dword [ebp - 4], 2
call fcn.0041d980
test al, al
jne 0x460a01
push 0xa
push 0x559630
lea ecx, [ebp - 0x1448]
call fcn.0040de70
cmp dword [ebx + 0x7c], 0
mov dword [ebp - 4], 3
je 0x460b7f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004dcfa0
lea eax, [ebp - 0x438]
mov dword [ebp - 0x1444], 1
push 2
push eax
mov dword [ebp - 0x1440], 0x208
call fcn.00432d80
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x460a52
mov eax, dword [eax]
lea ecx, [ebp - 0x1440]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x1444]
push ecx
push str.Setup_Path
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x438]
call fcn.004218e0
cmp word [ebp - 0x218], 0
je 0x460b71
push str.ComputerZ.set
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x460b71
push 0x208
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x640]
push eax
push 0x54ea3c
push 0x553f58
push str.three_end
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x640]
push 0x552cb0
push eax
call fcn.00507b5f
add esp, 8
test eax, eax
jne 0x460b71
push str.LdsLite_is_act:0
call fcn.00456fb0
add esp, 4
lea eax, [ebp - 0x218]
push eax
push 0
push 0x553f58
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1458], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.uninst_act_lite
mov byte [ebp - 4], 4
call fcn.0042e1d0
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00423b30
mov dword [ebx + 0x80], 1
jmp 0x460b7f
lea ecx, [ebx + 0x78]
call fcn.00468280
mov dword [ebx + 0x80], eax
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 2
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 5
push eax
call fcn.0044f390
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004dcfa0
add esp, 0x10
lea eax, [ebp - 0x218]
push str.UtilsMiniNews.exe
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call fcn.00454da0
mov edi, dword [ebp - 0x1448]
lea eax, [ebp - 0x218]
push 0x1388
push 0
push 1
push 1
push 1
push edi
push eax
call fcn.00454fa0
push edi
lea eax, [ebp - 0x218]
push eax
push str.Call_exe:_s_param:_s
call fcn.00456fb0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 3
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 6
push eax
call fcn.0044f390
push str.start_call_program
mov byte [ebp - 4], 3
call fcn.00456fb0
mov eax, dword [ebx + 8]
add esp, 0x14
push dword [eax - 0xc]
push eax
call fcn.00456bf0
mov ecx, eax
call fcn.00456bd0
mov ecx, eax
call fcn.00458e60
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 4
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 7
push eax
call fcn.0044f390
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004dcfa0
add esp, 0x10
lea eax, [ebp - 0x218]
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.UtilsLDSGameCenter_ludashi.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0xe40]
push 0
push eax
call fcn.004dcfa0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0xe40]
add esp, 0xc
push dword [ebx + 8]
push eax
call esi
push str.GameCenterGameUninst.exe
lea eax, [ebp - 0xe40]
push eax
call esi
call fcn.004126e0
mov ecx, eax
test ecx, ecx
je 0x4619af
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1440], eax
push str._S__PIDludashi
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 8
call fcn.0041d980
test al, al
jne 0x460d6c
push 0xf
push str._S__PIDludashi
lea ecx, [ebp - 0x1440]
call fcn.0040de70
cmp dword [ebx + 0x88], 0
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 9
je 0x460d88
push 0xb
push str.__UNINSTALL
jmp 0x460d8f
push 0xd
push str.__NOUNINSTALL
call fcn.00421b70
mov esi, dword [ebp - 0x1440]
lea eax, [ebp - 0x218]
push 0xbb8
push 0
push 1
push 1
push 1
push esi
push eax
call fcn.00454fa0
push esi
lea eax, [ebp - 0x218]
push eax
push str.Call_exe:_s_param:_s
call fcn.00456fb0
add esp, 0xc
lea eax, [ebp - 0xe40]
push 0xbb8
push 0
push 1
push 1
push 1
push esi
push eax
call fcn.00454fa0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x460dff
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 5
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xa
push eax
call fcn.0044f390
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 6
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xb
push eax
call fcn.0044f390
add esp, 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1444]
mov dword [ebp - 0x1444], ebx
lea ecx, [ebx + 0x8c]
mov dword [ebp - 0x1440], 0x4600a0
push eax
lea eax, [ebp - 0x1440]
push eax
call fcn.0045c620
push 0x7530
lea ecx, [ebx + 0x8c]
call fcn.0045e1d0
test al, al
jne 0x46109b
xorps xmm0, xmm0
mov dword [ebp - 0x148c], 0
lea eax, [ebp - 0x1494]
mov dword [ebp - 0x147c], 0
push eax
movlpd qword [ebp - 0x1474], xmm0
movlpd qword [ebp - 0x146c], xmm0
movlpd qword [ebp - 0x1464], xmm0
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x1494], 0x3c
mov dword [ebp - 0x1484], 0x5596b8
mov dword [ebp - 0x1488], 0x550938
mov dword [ebp - 0x1480], str._c_netsh_winsock_reset
mov dword [ebp - 0x1478], 0
mov dword [ebp - 0x1490], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x46109b
push 0x2710
push dword [ebp - 0x145c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46109b
push dword [ebp - 0x145c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SOFTWARELudashiLspUrl
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
mov dword [ebp - 0x1440], 0
lea eax, [ebp - 0x1440]
push eax
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x1440]
test eax, eax
je 0x46109b
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x46109b
push 0x208
lea eax, [ebp - 0xe40]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
lea eax, [ebp - 0xe40]
push eax
push 0
push str.lds
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x46103f
push str.netload.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0xe40]
push 1
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0xe40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x46103f
push 4
push eax
lea eax, [ebp - 0xe40]
push eax
call esi
push 0x208
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x46109b
push str.ldscon
lea eax, [ebp - 0x640]
push 0x104
push eax
call fcn.0050ead9
lea eax, [ebx + 4]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.00436730
add esp, 0x18
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 7
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xc
push eax
call fcn.0044f390
push 1
push dword [ebx + 8]
lea esi, [ebx + 8]
mov byte [ebp - 4], 3
call fcn.004308c0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 8
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xd
push eax
call fcn.0044f390
push str.start_close_all_processes
mov byte [ebp - 4], 3
call fcn.00456fb0
add esp, 0x14
push 0
push esi
call fcn.00456bf0
mov ecx, eax
call fcn.00456bd0
push eax
call fcn.00462f40
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 9
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xe
push eax
call fcn.0044f390
push str.start_close_band
mov byte [ebp - 4], 3
call fcn.00456fb0
add esp, 0x14
mov ecx, ebx
call fcn.0045d110
push str.start_uninstall_shellext
call fcn.00456fb0
add esp, 4
mov ecx, ebx
call fcn.00461b80
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xa
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xf
push eax
call fcn.0044f390
add esp, 4
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.00461db0
push str.remove_desktop_shortcuts
call fcn.00456fb0
add esp, 4
mov ecx, ebx
call fcn.0045fa90
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xb
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x10
push eax
call fcn.0044f390
push str.remove_start_menu_shortcuts
mov byte [ebp - 4], 3
call fcn.00456fb0
push 0x800
lea eax, [ebp - 0xc38]
push 0
push eax
call fcn.004dcfa0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xc38]
add esp, 0x14
push 1
push 0x17
push eax
push 0
call esi
push 0x550c80
lea eax, [ebp - 0xc38]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc38]
push eax
call fcn.00455fc0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xc
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x11
push eax
call fcn.0044f390
push str.remove_appdata
mov byte [ebp - 4], 3
call fcn.00456fb0
push 0x800
lea eax, [ebp - 0xc38]
push 0
push eax
call fcn.004dcfa0
add esp, 0x18
lea eax, [ebp - 0xc38]
push 1
push 0x1a
push eax
push 0
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc38]
push str.Ludashi
push eax
push eax
call esi
push 0x800
lea eax, [ebp - 0x1438]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
lea eax, [ebp - 0xc38]
push str.no_delete_me.txt
push eax
lea eax, [ebp - 0x1438]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0xc38]
push eax
call esi
test eax, eax
je 0x461352
lea eax, [ebp - 0x1438]
push eax
call esi
test eax, eax
jne 0x461352
lea eax, [ebp - 0xc38]
push eax
call fcn.00455fc0
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xd
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x12
push eax
call fcn.0044f390
push str.remove_file_by_registry
mov byte [ebp - 4], 3
call fcn.00456fb0
lea eax, [ebx + 0xc]
push eax
push 1
push dword [ebx + 8]
call fcn.00431070
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xf
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x13
push eax
call fcn.0044f390
push str.remove_autorun
mov byte [ebp - 4], 3
call fcn.00456fb0
add esp, 0x1c
lea ecx, [ebp - 0x1439]
call fcn.0046af10
push 1
push str.ComputerZ_Tray
lea ecx, [ebp - 0x1439]
mov byte [ebp - 4], 0x14
call fcn.0046c690
push 0
push str.ComputerZ_Tray
lea ecx, [ebp - 0x1439]
call fcn.0046c690
push eax
push str.Delete_AutoRun_Registry__ret___d
call fcn.00456fb0
add esp, 8
lea ecx, [ebp - 0x1439]
push str.ComputerZ_Tray
call fcn.0046c870
push eax
push str.Delete_AutoRun_Task_Schedule__ret___d
call fcn.00456fb0
add esp, 8
lea ecx, [ebp - 0x1439]
call fcn.0046b370
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x10
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x15
push eax
call fcn.0044f390
add esp, 4
mov byte [ebp - 4], 3
call fcn.004126e0
mov ecx, eax
test ecx, ecx
je 0x4619b9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1440], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLudashi_is1
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 0x16
call fcn.0041d980
test al, al
jne 0x4614d3
push 0x3f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLudashi_is1
lea ecx, [ebp - 0x1440]
call fcn.0040de70
mov esi, dword [ebp - 0x1440]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x17
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.00456fb0
add esp, 4
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x461512
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x11
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x18
push eax
call fcn.0044f390
push str.ComputerZLock
mov byte [ebp - 4], 3
call fcn.0046e8a0
push str.ComputerZLock
call fcn.0046ea00
push dword [0x59545c]
call fcn.0046e8a0
push dword [0x59545c]
call fcn.0046ea00
push dword [0x595458]
call fcn.0046e8a0
push dword [0x595458]
call fcn.0046ea00
push str.HardwareTM
call fcn.0046e8a0
push str.HardwareTM
call fcn.0046ea00
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x12
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x19
push eax
call fcn.0044f390
push 0x208
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004dcfa0
add esp, 0x34
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.ComputerZ_PowerSaveDll.dll
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4616c0
lea eax, [ebp - 0x420]
xor esi, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x461691
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x461691
lea eax, [ebp - 0x420]
push eax
call fcn.00474780
add esp, 4
test eax, eax
je 0x461691
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x461691
push dword [0x595418]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x461691
call eax
mov esi, eax
test esi, esi
je 0x4616b3
mov eax, dword [esi]
push esi
call dword [eax]
test eax, eax
je 0x4616c0
push str.powerSaveHelper__DeletePowerScheme
call fcn.00456fb0
mov eax, dword [esi]
add esp, 4
push esi
call dword [eax + 0x34]
jmp 0x4616c0
push str.powerSaveHelper_is_nil
call fcn.00456fb0
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x13
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1a
push eax
call fcn.0044f390
push str.UtilsPCStoreSetup_officialwebsite.dll
lea esi, [ebx + 8]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1444]
push esi
push eax
call fcn.0045d020
push 1
push 0x559888
push 0x5509ec
push dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.00430e30
mov edx, dword [ebp - 0x1444]
add esp, 0x20
mov byte [ebp - 4], 3
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x461749
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x14
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1c
push eax
call fcn.0044f390
add esp, 4
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.00460550
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x15
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1d
push eax
call fcn.0044f390
push dword [esi]
mov byte [ebp - 4], 3
push str.start_delete_all_files_in__s
call fcn.00456fb0
add esp, 0xc
mov ecx, ebx
push dword [esi]
call fcn.0045f310
push dword [esi]
push str.end_delete_all_files_in__s
call fcn.00456fb0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x62
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1e
push eax
call fcn.0044f390
push str.start_create_runonce_bat
mov byte [ebp - 4], 3
call fcn.00456fb0
push dword [esi]
lea eax, [ebx + 0xc]
push eax
call fcn.00435280
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x63
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1f
push eax
call fcn.0044f390
push str.start_ending_report.
mov byte [ebp - 4], 3
call fcn.00456fb0
add esp, 0x20
mov ecx, ebx
call fcn.0045d790
call fcn.00456be0
mov esi, eax
push esi
mov ecx, dword [esi]
call dword [ecx + 0x18]
test eax, eax
je 0x4618d3
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1458], esp
mov dword [eax + 0x24], 0
mov eax, dword [esi]
push 0
push 0
push esi
mov byte [ebp - 4], 0x20
call dword [eax + 0x1c]
test eax, eax
mov edx, str.inst_lite_fail
mov ecx, str.inst_lite_suc
cmove ecx, edx
push ecx
call fcn.0042e1d0
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00423b30
push str.remove_registry
call fcn.00456fb0
add esp, 4
mov ecx, ebx
call fcn.00460150
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45e2b0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x64
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x21
push eax
call fcn.0044f390
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1450], 0x45e2a0
mov dword [ebp - 0x144c], ebx
lea eax, [ebp - 0x1454]
mov byte [ebp - 4], 0x22
push eax
call fcn.0044f390
add esp, 8
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1450], 0
add edi, 0xfffffff0
mov dword [ebp - 0x144c], 0
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x461985
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.0040af60
push 0x80004005
call fcn.0040af60
push 0x80004005
call fcn.0040af60
int3