Function at 0x4489a9
Capabilities:
Manipulate safe mode programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d88af
mov eax, dword fs:[0]
push eax
sub esp, 0x2ec
mov eax, dword [0x50f52c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb4], ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc4], edi
push str._vsinit.dll
add edi, 0x24c
lea eax, [ebp - 0x138]
push edi
push eax
mov dword [ebp - 0x70], 1
call fcn.00401b00
add esp, 0xc
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, 8
cmp dword [eax + 0x18], ebx
jb 0x448533
mov eax, dword [eax + 4]
jmp 0x448536
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x120], ebx
jb 0x448561
mov ecx, dword [ebp - 0x134]
push ecx
call fcn.004b29fa
add esp, 4
push str._vsutil.dll
lea eax, [ebp - 0x18c]
xor edx, edx
push edi
mov ebx, 7
push eax
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x124], esi
mov word [ebp - 0x134], dx
call fcn.00401b00
add esp, 0xc
mov dword [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x4485a2
mov eax, dword [eax + 4]
jmp 0x4485a5
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xac], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x174], 8
jb 0x4485d1
mov ecx, dword [ebp - 0x188]
push ecx
call fcn.004b29fa
add esp, 4
push str._vsdata.dll
lea eax, [ebp - 0x1a8]
xor edx, edx
push edi
push eax
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x178], esi
mov word [ebp - 0x188], dx
call fcn.00401b00
add esp, 0xc
mov dword [ebp - 4], 2
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x448611
mov eax, dword [eax + 4]
jmp 0x448614
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x190], edi
jb 0x44863f
mov ecx, dword [ebp - 0x1a4]
push ecx
call fcn.004b29fa
add esp, 4
mov eax, dword [ebp - 0xb8]
xor edx, edx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x194], esi
mov word [ebp - 0x1a4], dx
cmp eax, esi
je 0x4486d2
mov edi, dword [ebp - 0xac]
cmp edi, esi
je 0x4486d2
mov ecx, dword [ebp - 0xb4]
push eax
call fcn.00445e00
push str.ToolInit
push edi
call fcn.00424a20
cmp eax, esi
jne 0x44868a
call fcn.00424e10
jmp 0x44869f
call eax
test eax, eax
jne 0x44869f
push str.ToolInit_failed.
push 0x4e25d8
call fcn.00424a00
push str.VSSetProtection
push edi
call fcn.00424a20
cmp eax, esi
jne 0x4486b5
call fcn.00424e10
jmp 0x4486ba
push esi
push 0xffffffffffffffff
call eax
push str.VSUninstallProductEx
push edi
call fcn.00424a20
cmp eax, esi
jne 0x44882d
call fcn.00424e10
mov edi, dword [ebp - 0x70]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc4]
push ecx
mov ecx, dword [ebp - 0xb4]
push edx
call fcn.00445140
mov eax, dword [ebp - 0xc0]
push eax
call fcn.00424a30
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.00424a30
mov edx, dword [ebp - 0xb8]
push edx
call fcn.00424a30
push 0xe
xor eax, eax
push str.FIREWALLACTION
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], esi
mov word [ebp - 0xa4], ax
call fcn.00401860
mov dword [ebp - 4], 0x1c
xor ecx, ecx
push 0x24
mov word [ebp - 0x88], cx
push str.Remove_client_to_start_in_Safe_mode.
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], esi
call fcn.00401860
mov byte [ebp - 4], 0x1d
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x8c]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x74], 8
jb 0x44878e
mov ecx, dword [ebp - 0x88]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], esi
mov word [ebp - 0x88], dx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x90], 8
jb 0x4487bc
mov eax, dword [ebp - 0xa4]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov word [ebp - 0xa4], cx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], esi
call fcn.00433f10
mov dword [ebp - 4], 0x1e
push 0x37
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_vsmon
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x6c], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401860
lea ecx, [ebp - 0x6c]
call fcn.00434170
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00402470
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3057
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x11c]
push ecx
mov dword [ebp - 0x114], esi
push esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x11c], 0x20
mov dword [ebp - 0x114], str.secret
call eax
mov edi, eax
cmp edi, 0xb
ja case.0x448880.3
jmp dword [edi*4 + 0x448e94]
push str.FIREWALLACTION
lea ecx, [ebp - 0xa8]
call fcn.004019e0
mov dword [ebp - 4], 3
push str.Uninstall_product_successful.
lea ecx, [ebp - 0x8c]
call fcn.004019e0
mov byte [ebp - 4], 4
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x8c]
push eax
call fcn.00419d40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
jmp 0x448bf4
push str.FIREWALLACTION
lea ecx, [ebp - 0xfc]
call fcn.004019e0
mov dword [ebp - 4], 5
push str.Uninstall_product_failure:_invalid_password_parameter.
lea ecx, [ebp - 0xe0]
call fcn.004019e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xfc]
push ecx
lea edx, [ebp - 0xe0]
push edx
call fcn.00419d40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe0]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.00490320
jmp 0x4486eb
push str.FIREWALLACTION
lea ecx, [ebp - 0x250]
call fcn.004019e0
mov dword [ebp - 4], ebx
push str.Uninstall_product_failure:_old_dominica_version_returned_FALSE.
lea ecx, [ebp - 0x1c4]
call fcn.004019e0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x1c4]
push ecx
call fcn.00419d40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c4]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00490320
jmp 0x4486eb
push str.FIREWALLACTION
lea ecx, [ebp - 0x2c0]
call fcn.004019e0
mov dword [ebp - 4], 9
push str.Uninstall_product_failure:_user_cancelled_true_vector_uninstall_prompt.
lea ecx, [ebp - 0x288]
call fcn.004019e0
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x288]
push eax
call fcn.00419d40
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x288]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c0]
call fcn.00490320
jmp 0x4486eb
push str.FIREWALLACTION
lea ecx, [ebp - 0x1fc]
call fcn.004019e0
mov dword [ebp - 4], 0xb
push str.Uninstall_product_failure:_install_password_incorrect.
lea ecx, [ebp - 0x2f8]
call fcn.004019e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1fc]
push ecx
lea edx, [ebp - 0x2f8]
push edx
call fcn.00419d40
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2f8]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1fc]
call fcn.00490320
jmp 0x4486eb
push str.FIREWALLACTION
lea ecx, [ebp - 0x234]
call fcn.004019e0
mov dword [ebp - 4], 0xd
push str.Uninstall_product_failure:_user_entered_incorrect_password.
lea ecx, [ebp - 0x2dc]
call fcn.004019e0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2dc]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2dc]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00490320
jmp 0x4486eb
push str.FIREWALLACTION
lea ecx, [ebp - 0x26c]
call fcn.004019e0
mov dword [ebp - 4], 0xf
push str.Uninstall_product_failure:_call_to_ServiceUninstall_failed._Check_tvdebug.
lea ecx, [ebp - 0x2a4]
call fcn.004019e0
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x26c]
push edx
lea eax, [ebp - 0x2a4]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2a4]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.00490320
jmp 0x448c07
push str.FIREWALLACTION
lea ecx, [ebp - 0x218]
call fcn.004019e0
mov dword [ebp - 4], 0x11
push str.Uninstall_product_failure:_all_vsmon_stop_and_kill_methods_failed.
lea ecx, [ebp - 0x1e0]
call fcn.004019e0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x1e0]
push edx
call fcn.00419d40
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1e0]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.00490320
jmp 0x448c07
push str.FIREWALLACTION
lea ecx, [ebp - 0x170]
call fcn.004019e0
mov dword [ebp - 4], 0x13
push str.Uninstall_product_failure:_unknown_result_code.
lea ecx, [ebp - 0x154]
call fcn.004019e0
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x154]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x154]
call fcn.00490320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.00490320
cmp edi, 0xb
je 0x448c07
cmp edi, 0xa
jne 0x448e84
mov dword [ebp - 0xb0], 0x12c
lea edx, [ebp - 0xbc]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x70], esp
mov dword [ebp - 0xbc], esi
push 9
xor eax, eax
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], esi
push str.vsmon.exe
mov word [ecx + 4], ax
call fcn.00401860
mov dword [ebp - 4], 0x15
or edi, 0xffffffff
mov dword [ebp - 4], edi
call fcn.00427d60
cmp eax, esi
je 0x448e1d
xor ecx, ecx
push 0xe
mov word [ebp - 0xdc], cx
push str.FIREWALLACTION
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], esi
call fcn.00401860
mov dword [ebp - 4], 0x16
push 0x18
xor edx, edx
push str.Client_is_still_running.
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe8], esi
mov word [ebp - 0xf8], dx
call fcn.00401860
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xfc]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 0x16
mov edi, 8
cmp dword [ebp - 0xe4], edi
jb 0x448ce4
mov edx, dword [ebp - 0xf8]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe8], esi
mov word [ebp - 0xf8], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xc8], edi
jb 0x448d17
mov ecx, dword [ebp - 0xdc]
push ecx
call fcn.004b29fa
add esp, 4
push 0xe
xor edx, edx
xor eax, eax
push str.FIREWALLACTION
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], esi
mov word [ebp - 0xdc], dx
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], esi
mov word [ebp - 0x88], ax
call fcn.00401860
mov dword [ebp - 4], 0x1a
xor ecx, ecx
push 0x1f
mov word [ebp - 0xa4], cx
push str.Checking_again_in_10_seconds...
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], esi
call fcn.00401860
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0xa8]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x90], edi
jb 0x448db4
mov ecx, dword [ebp - 0xa4]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], esi
mov word [ebp - 0xa4], dx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x74], edi
jb 0x448de4
mov eax, dword [ebp - 0x88]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
push 0x2710
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], esi
mov word [ebp - 0x88], cx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xb0]
sub eax, 0xa
cmp eax, esi
mov dword [ebp - 0xb0], eax
jg 0x448c11
mov edi, dword [ebp - 0x70]
jmp 0x4486eb
push str.FIREWALLACTION
lea ecx, [ebp - 0x154]
call fcn.004019e0
mov dword [ebp - 4], 0x18
push str.Failed_to_stop_client_but_client_should_be_down.
lea ecx, [ebp - 0x170]
call fcn.004019e0
mov byte [ebp - 4], 0x19
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x170]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x170]
call fcn.00490320
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x154]
call fcn.00490320
mov dword [ebp - 0x70], 1
jmp 0x4486d2
cmp edi, 1
jne 0x4486eb
jmp 0x4486d5