Function at 0x403260
Capabilities:
Check os version
Encode data using xor
Get common file path
Get hostname
Get program files directory
Get session user name
Identify system language via api
Terminate process

Disassembly:
sub esp, 0x6cc
mov eax, dword [0x4253c0]
xor eax, esp
mov dword [esp + 0x6c8], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6e4]
push str.CommandClass::CommandClass_n
mov ebp, ecx
mov dword [esp + 0x18], edi
call fcn.00403da0
add esp, 4
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x403303
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x403303
cmp dword [esp + 0x10], ebx
je 0x403303
push str.I386
lea ecx, [esp + 0x2dc]
push str.You_are_running_a_32_bit_version_of_Nvidia_uninstaller_on_a_64_bit_system__Binary_type__s_._nWrong_version_of_uninstaller._Uninstaller_exits_now.
push ecx
call fcn.0040bc71
add esp, 0xc
push 0x10
push str.Fatal_Error
lea edx, [esp + 0x2e0]
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.0040c486
xor ecx, ecx
mov dword [ebp + 0x548], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ecx
mov esi, dword [esp + ecx*4 + 0x1c]
movsx eax, byte [esi*4 + section..data]
lea edx, [esi*4 + section..data]
lea ebx, [eax + 4]
shr ebx, 2
add ebx, esi
mov dword [esp + ecx*4 + 0x20], ebx
xor ebx, ebx
cmp eax, ebx
jle 0x403364
lea ecx, [eax + edx - 1]
mov esi, eax
mov edi, edi
mov bl, byte [ecx + 1]
xor byte [ecx], bl
sub ecx, 1
sub esi, 1
jne 0x403340
xor ebx, ebx
cmp eax, ebx
jle 0x40335c
lea esi, [edx + 1]
mov ecx, eax
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ecx, 1
cmp ecx, 5
mov byte [eax + edx], bl
mov dword [esp + 0x10], ecx
jl 0x403313
mov eax, dword [esp + 0x6e0]
mov ecx, dword [esp + 0x6e8]
push 0x14
mov dword [ebp + 0x554], 0x41b895
mov dword [ebp + 0x558], edi
mov dword [ebp + 0x550], eax
mov dword [ebp + 0x55c], ecx
call fcn.0040b83d
add esp, 4
cmp eax, ebx
mov dword [ebp], eax
je 0x4033d8
mov dword [eax], 0x425008
mov edx, dword [ebp]
mov dword [edx + 4], 0x402cf0
mov eax, dword [ebp]
mov dword [eax + 8], 0x425014
mov ecx, dword [ebp]
mov dword [ecx + 0xc], 0x425030
mov edx, dword [ebp]
mov dword [edx + 0x10], ebx
push str.If__Command_Name__is_provided_displayes_syntax_and_description_of_that_command_otherwise_displays_all_the_avilable_commands
push str.Command_Name
push fcn.00401f00
push str.Help
mov ecx, ebp
call fcn.004010c0
push str.Executes_the_given_system_command__returns_immidiately_
push str.Command
push 0x401960
push str.System
mov ecx, ebp
call fcn.004010c0
push str.call_and_wait_untill_app_is_done.
push str.Exact_path_to_App__arguments
push 0x401990
push str.SysCallAndWait
mov ecx, ebp
call fcn.004010c0
push str.Defines_the_variable_if_not_defined_and_Sets_the_its_value_to_the_given_value._nIf__Value__is_not_given_it_undefines_the_given_variable
push str.Name_Value_
push 0x401e90
push 0x41c59c
mov ecx, ebp
call fcn.004010c0
push str.Outputs_data_after_evaluation
push str.Data
push 0x4017f0
push str.Echo
mov ecx, ebp
call fcn.004010c0
push str.runs_all_the_commands_in_that_section_and_returnd_and_continues_executing_commands_after_that_line
push str.Section_Name
push 0x4031f0
push str.Call
mov ecx, ebp
call fcn.004010c0
push str.Executes_all_the_commands_in_that_file_and_returns
push str.Path_to_an_NVU_File
push fcn.00402900
push 0x41c4a4
mov ecx, ebp
call fcn.004010c0
push str.Run_all_the_commands_in_this_file_and_delete_the_file
push str.Path_to_an_NVU_File
push fcn.00402a10
push str.RunOnce
mov ecx, ebp
call fcn.004010c0
push str.A_dir_will_be_applied_to_the_given_path_and_for_each_file_found_it_sets_variable_current_file_to_that_file_and_calls_the_given_command.
push str.DirPath_Command
push 0x402b80
push str.DirAndApply
mov ecx, ebp
call fcn.004010c0
push str.Executes_command_if_Exp1_is_the_same_as_Exp2_for__or_Exp1_has_Exp2_for___if___is_added_to_the_beging_of_Exp1_it_will_negate_the_result
push str.___Exp1___Exp2_then_Command
push 0x4030f0
push 0x41c308
mov ecx, ebp
call fcn.004010c0
push str.reEvaluates_the_given_command_and_executes_it
push str.Command
push fcn.004025b0
push str.Eval
mov ecx, ebp
call fcn.004010c0
push str.Opens_the_given_log_files_ad_Logs_all_the_commands_in_the_given_file
push str.Filename
push 0x402490
push str.StartLogging
mov ecx, ebp
call fcn.004010c0
push str.Stops_logging_close_the_file
push 0x41b895
push fcn.00401920
push str.StopLogging
mov ecx, ebp
call fcn.004010c0
push str.Waits_for_a_number_of_miliseconds_passed_before_executing_the_next_command
push str.milisconds
push 0x401ba0
push 0x41c1d8
mov ecx, ebp
call fcn.004010c0
push str.Shows_the_given_bitmap_for_the_given_time_number_on_the_screen
push str.milisconds__BitmapPath
push 0x402be0
push str.Splash
mov ecx, ebp
call fcn.004010c0
push str.Allows_waiting_for_a_specific_registry_key_or_value_to_be_deleted
push str.Key_Value_LoopDelay_MaxLoopCount_TimeoutCommand
push 0x402d20
push str.WaitOnRegDel
mov ecx, ebp
call fcn.004010c0
mov dword [ebp + 0x54c], str.Generic_command_class_basic_functionality.
mov dword [ebp + 0x404], ebx
mov eax, 0x80
lea ecx, [ecx]
mov ecx, dword [ebp + 0x404]
mov dword [ebp + ecx*8 + 4], ebx
mov edx, dword [ebp + 0x404]
mov dword [ebp + edx*8 + 8], ebx
add dword [ebp + 0x404], 1
cmp dword [ebp + 0x404], eax
jl 0x4035a0
push 0x104
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xd0]
push ecx
push str.windir
mov ecx, ebp
call fcn.00401c90
push 0x104
lea edx, [esp + 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0xd0]
push eax
push str.sysdir
mov ecx, ebp
call fcn.00401c90
lea ecx, [esp + 0xd0]
push 0x104
push ecx
call fcn.00401b50
add esp, 8
lea edx, [esp + 0xd0]
push edx
push str.syswow64dir
mov ecx, ebp
call fcn.00401c90
lea eax, [esp + 0xd0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xd0]
push ecx
push str.Currentdir
mov ecx, ebp
call fcn.00401c90
push 0x103
lea edx, [esp + 0x1d9]
push ebx
push edx
mov byte [esp + 0x1e0], bl
call fcn.0040b8b0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
add esp, 0xc
lea eax, [esp + 0x1d4]
push eax
push ebx
push ebx
push 0x8023
push ebx
call esi
test eax, eax
jne 0x4036ad
push 0x41c098
lea ecx, [esp + 0x1d8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x1d4]
push edx
push str.wrkdir
mov ecx, ebp
call fcn.00401c90
lea eax, [esp + 0x1d4]
push eax
push ebx
push ebx
push 0x8023
push ebx
call esi
test eax, eax
jne 0x4036eb
lea ecx, [esp + 0x1d4]
push ecx
push str.pgmdir
mov ecx, ebp
call fcn.00401c90
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebx
push 0x17
lea edx, [esp + 0xd8]
push edx
push edi
call esi
lea eax, [esp + 0xd0]
push eax
push str.commonprograms
mov ecx, ebp
call fcn.00401c90
push ebx
push 0x19
lea ecx, [esp + 0xd8]
push ecx
push edi
call esi
lea edx, [esp + 0xd0]
push edx
push str.commondesktop
mov ecx, ebp
call fcn.00401c90
push str.ALLUSERSPROFILE
call fcn.0040c173
add esp, 4
push eax
push str.ALLUSERSPROFILEDir
mov ecx, ebp
call fcn.00401c90
push str.USERPROFILE
call fcn.0040c173
add esp, 4
push eax
push str.USERPROFILEDir
mov ecx, ebp
call fcn.00401c90
push ebx
push 0x26
lea eax, [esp + 0xd8]
push eax
push edi
call esi
lea ecx, [esp + 0xd0]
push ecx
push str.ProgramFilesDir
mov ecx, ebp
call fcn.00401c90
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
movzx esi, ax
push esi
lea edx, [esp + 0xd4]
push str.Language_Resource__d
push edx
call fcn.0040bc71
add esp, 0xc
lea eax, [esp + 0xd0]
push eax
push str.Language_Resource
mov ecx, ebp
call fcn.00401c90
and esi, 0x3ff
push esi
lea ecx, [esp + 0xd4]
push str.Language_Resource__d
push ecx
call fcn.0040bc71
add esp, 0xc
lea edx, [esp + 0xd0]
push edx
push str.Primary_Language_Resource
mov ecx, ebp
call fcn.00401c90
push 0x41b794
push 0x41bffc
mov ecx, ebp
call fcn.00401c90
push 0x104
lea eax, [esp + 0xd4]
push eax
mov ecx, dword [ebp + 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x425014
push section..data
mov ecx, ebp
call fcn.00401c90
lea edx, [esp + 0xd0]
push edx
push str.Current_Parser_Path
mov ecx, ebp
call fcn.00401c90
lea eax, [esp + 0xd0]
push eax
mov ecx, ebp
call fcn.00401300
push eax
push str.Current_Parser_Name
mov ecx, ebp
call fcn.00401c90
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xd4]
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0xd0]
push eax
push str.Computer_Name
mov ecx, ebp
call fcn.00401c90
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xd4]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0xd0]
push eax
push str.User_Name
mov ecx, ebp
call fcn.00401c90
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0xd4]
push 0x41bfb4
push eax
call fcn.0040bc71
add esp, 0xc
lea ecx, [esp + 0xd0]
push ecx
push str.OS_Major_Version
mov ecx, ebp
call fcn.00401c90
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0xd4]
push 0x41bfb4
push eax
call fcn.0040bc71
add esp, 0xc
lea ecx, [esp + 0xd0]
push ecx
push str.OS_Minor_Version
mov ecx, ebp
call fcn.00401c90
mov eax, dword [esp + 0x44]
sub eax, 1
mov dword [ebp + 0x560], ebx
je 0x4039ae
sub eax, 1
jne 0x4039f9
push str.ControlClass
push str.DriverBaseRegPath
mov ecx, ebp
call fcn.00401c90
mov eax, dword [esp + 0x38]
cmp eax, 7
jne 0x40395e
push str.Win7
jmp 0x4039ed
cmp eax, 6
jne 0x40396d
push str.WinVista
jmp 0x4039ed
cmp eax, 5
jne 0x4039a2
mov eax, dword [esp + 0x3c]
sub eax, ebx
je 0x40399b
sub eax, 1
je 0x403994
sub eax, 1
mov ecx, ebp
je 0x40398d
push str.Unknown_WIN32_NT5
jmp 0x4039ef
push str.WinServer2003Family
jmp 0x4039ef
push str.WinXP
jmp 0x4039ed
push str.Win2K
jmp 0x4039ed
cmp eax, 4
jne 0x4039f9
push str.WinNT4
jmp 0x4039ed
push str.ServicesClass
push str.DriverBaseRegPath
mov ecx, ebp
call fcn.00401c90
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x4039e8
cmp eax, 0xa
je 0x4039e1
cmp eax, 0x5a
mov ecx, ebp
je 0x4039da
push str.Unknown_WIN32_Windows
jmp 0x4039ef
push str.WinME
jmp 0x4039ef
push str.Win98
jmp 0x4039ed
push str.Win95
mov ecx, ebp
push 0x41bed0
call fcn.00401c90
push str.I386
push str.Platform
mov ecx, ebp
call fcn.00401c90
mov ecx, dword [esp + 0x6d8]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bc62
add esp, 0x6cc
ret 0xc