Function at 0x4111f0
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c1f6
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x464024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ecx
mov esi, esp
mov byte [0x46a5d7], 0
mov dword [ebp - 0x438], esi
mov ecx, dword [0x46c73c]
lea ecx, [ecx - 0x10]
call fcn.004164d0
add eax, 0x10
mov dword [esi], eax
call fcn.00404d20
add esp, 4
call fcn.00410f90
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x46b2b0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push str._s_s
push 0x46a838
call edi
push str.InstallLocation
mov edx, 0x46a838
call fcn.004051e0
add esp, 0x14
push eax
push 0x46c368
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 8
push 0x46c368
call ebx
cmp eax, 0xffffffff
je 0x4112af
test al, 0x10
jne 0x4112bf
push 0x46c368
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x46c368
call ebx
cmp eax, 0xffffffff
je 0x41173f
test al, 0x10
je 0x41173f
push 0x46c368
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, 0x46a838
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00405630
call fcn.00408120
cmp dword [0x46c570], 0
jle 0x4113bd
push ecx
mov esi, esp
mov dword [ebp - 0x438], esp
mov dword [ebp - 0x43c], esi
mov ecx, dword [0x46c73c]
add ecx, 0xfffffff0
call fcn.004164d0
add eax, 0x10
mov dword [esi], eax
push ecx
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x43c], esi
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x41179c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push str._DeleteTasks_
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004153b0
test al, al
jne 0x411370
push 0xd
push str._DeleteTasks_
mov ecx, esi
call fcn.00416540
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004034f0
mov eax, dword [0x46c77c]
add esp, 8
mov ecx, dword [0x46c778]
xor esi, esi
sub eax, ecx
sar eax, 3
test eax, eax
je 0x4113bd
nop dword [eax]
mov ecx, dword [ecx + esi*8]
call fcn.004057b0
mov eax, dword [0x46c77c]
inc esi
mov ecx, dword [0x46c778]
sub eax, ecx
sar eax, 3
cmp esi, eax
jb 0x4113a0
push 0x46c368
call ebx
cmp eax, 0xffffffff
je 0x4114ab
test al, 0x10
je 0x4114ab
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x4117a6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x434], eax
push 0x46c368
push 0x28
mov dword [ebp - 4], 2
call fcn.00409750
add esp, 4
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.004168c0
mov esi, dword [ebp - 0x434]
add esp, 0xc
push 0
push 0x1024
push 0x46b2b0
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
cmp eax, 7
jne 0x411460
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x411780
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x411780
mov ecx, 0x46c368
call fcn.00410eb0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x46c368
call ebx
cmp eax, 0xffffffff
je 0x41148c
test al, 0x10
je 0x41148c
mov ecx, 0x46c368
call fcn.00410c60
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4114ab
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call esi
push 0x46b2b0
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x46a838
call edi
add esp, 0x10
push 0x46a838
call ebx
cmp eax, 0xffffffff
je 0x411517
test al, 0x10
je 0x411517
mov ecx, 0x46a838
call fcn.00410eb0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x46a838
call ebx
cmp eax, 0xffffffff
je 0x411517
test al, 0x10
je 0x411517
mov ecx, 0x46a838
call fcn.00410c60
push 0
push 2
lea eax, [ebp - 0x218]
push eax
push 0
call esi
push 0x46b2b0
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x46bf30
call edi
add esp, 0x10
push 0x46bf30
call ebx
cmp eax, 0xffffffff
je 0x41155b
test al, 0x10
je 0x41155b
mov ecx, 0x46bf30
call fcn.00410c60
push 0
push 0x17
lea eax, [ebp - 0x218]
push eax
push 0
call esi
push 0x46b2b0
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x46bf30
call edi
add esp, 0x10
push 0x46bf30
call ebx
cmp eax, 0xffffffff
je 0x41159f
test al, 0x10
je 0x41159f
mov ecx, 0x46bf30
call fcn.00410c60
mov esi, dword [0x46c760]
lea eax, [ebp - 0x218]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [esi + 4]
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x46b4f0
call edi
add esp, 0x10
push 0x46b4f0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4116e3
push 0x46b4f0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4116e3
push 5
push eax
push 0x46b4f0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x46a5d7], 1
push 0x46b2b0
push 0x15
call fcn.00409750
add esp, 4
push eax
push 0x46a838
call edi
add esp, 0xc
push 0x46b2b0
push 0x12
call fcn.00409750
add esp, 4
push eax
push 0x46b4f0
call edi
add esp, 0xc
push 0
push 0x1024
push 0x46b4f0
push 0x46a838
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
cmp eax, 6
jne 0x411780
lea eax, [ebp - 0x434]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x411780
lea eax, [ebp - 0x42c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 1
push eax
push 0
push dword [ebp - 0x434]
mov dword [ebp - 0x424], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x411780
push 0x80020003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x411780
cmp byte [0x46a5d7], 0
jne 0x41160c
push 0x46b2b0
push 0x14
call fcn.00409750
add esp, 4
push eax
push 0x46a838
call edi
add esp, 0xc
push 0x46b2b0
push 0x12
call fcn.00409750
add esp, 4
push eax
push 0x46b4f0
call edi
add esp, 0xc
push 0
push 0x1040
push 0x46b4f0
push 0x46a838
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
jmp 0x411780
push 0
push 0x1040
push 0x449958
push 0xf
call fcn.00409750
add esp, 8
push eax
push 0x449958
push 0x16
call fcn.00409750
add esp, 8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push 0
push 0
push 0x10
push dword [0x46bd1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ae8f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402240
push 0x80004005
call fcn.00402240
int3