Function at 0x4067d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46cd20
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x1c]
call fcn.00405210
mov dword [ebp - 4], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], vtable.OCArray_class_CKlidRegEntry_.0
xor edi, edi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], vtable.OCArray_class_CKlidRegEntry_.0
push ebx
lea edx, [ebp - 0x54]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00405700
add esp, 4
test al, al
je 0x4068f0
push ebx
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x1c]
call fcn.00405570
add esp, 4
test al, al
je 0x4068ed
cmp dword [ebp - 0x4c], edi
jle 0x4069af
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x18]
call fcn.00405970
mov byte [ebp - 4], 3
push dword [eax]
push str.Layout_cannot_be_uninstalled_because_following_layout_s__are_still_loaded_in_the_Language_Bar:_r_n_r_n_s_r_n_r_nPlease_remove_these_layouts_from_the_Language_Bar_first
push ebx
call fcn.00403a80
mov byte [ebp - 4], 2
add esp, 0xc
mov ecx, dword [ebp - 0x18]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4068ed
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x406bc6
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x406bc6
push edi
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x38]
xor bl, bl
mov byte [ebp - 0xd], bl
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x40691a
test edi, edi
jle 0x40690f
mov ecx, esi
call fcn.004147f0
add esi, 0x1c
sub edi, 1
jne 0x406900
push dword [ebp - 0x3c]
call fcn.00436734
add esp, 4
mov edi, dword [ebp - 0x50]
test edi, edi
je 0x40694b
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
jle 0x40693f
mov esi, edi
nop word [eax + eax]
mov ecx, esi
call fcn.004147f0
add esi, 0x1c
sub ebx, 1
jne 0x406930
push edi
call fcn.00436734
mov bl, byte [ebp - 0xd]
add esp, 4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406bb2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x406c0d
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CWin32Heap.0
jne 0x406c0b
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x38]
xor ebx, ebx
test edi, edi
jle 0x4069d7
mov esi, dword [ebp - 0x3c]
nop dword [eax + eax]
mov ecx, dword [esi]
call fcn.00416860
test al, al
je 0x406a72
inc ebx
add esi, 0x1c
cmp ebx, edi
jl 0x4069c0
mov ecx, dword [ebp - 0x18]
mov bl, 1
push 0
push 0x47a2ec
mov byte [ebp - 0xd], bl
call fcn.004041d0
lea ecx, [ebp - 0x2c]
call fcn.00405210
mov esi, eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.0040ea40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x14]
push dword [esi]
mov edx, dword [eax]
call fcn.0040e2b0
add esp, 4
mov byte [ebp - 4], 8
or esi, 0xffffffff
mov ecx, dword [ebp - 0x20]
mov eax, esi
add ecx, 0xfffffff0
mov dword [ebp - 0x24], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x406ae4
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x28], edx
mov edx, dword [ecx]
cmp eax, 0x471758
jne 0x406be2
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x24]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x406bd8
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x406ae4
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00414a60
mov byte [ebp - 4], 4
push dword [eax]
push str.Couldnt_uninstall_layout__s_r_nThis_is_commonly_caused_by_interference_from_anti_virus_software.
push dword [ebp - 0x18]
call fcn.00403a80
mov byte [ebp - 4], 2
add esp, 0xc
mov ecx, dword [ebp - 0x20]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4068f0
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x406bcf
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x406bcf
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4068f0
mov byte [ebp - 4], 9
mov eax, esi
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x406b39
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x24], edx
mov edx, dword [ecx]
cmp eax, 0x471758
jne 0x406bf7
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x28]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x406bed
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x14]
call fcn.0040de80
test eax, eax
je 0x406b6a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406b6a
push dword [ebp - 0x14]
push str.Couldnt_delete_file__s_r_nMake_sure_you_have_full_write_access_to_the_Windows_System_directory
push dword [ebp - 0x18]
call fcn.00403a80
add esp, 0xc
xor bl, bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 4], 2
mov eax, esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4068f5
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x406c02
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x406c02
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4068f5
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
jmp 0x4068ed
mov ecx, edx
call esi
jmp 0x4068f0
mov ecx, edx
call dword [ebp - 0x28]
jmp 0x406ae4
push ecx
mov ecx, edx
call dword [ebp - 0x28]
jmp 0x406ae4
mov ecx, edx
call dword [ebp - 0x24]
jmp 0x406b39
push ecx
mov ecx, edx
call dword [ebp - 0x24]
jmp 0x406b39
mov ecx, edx
call esi
jmp 0x4068f5
mov ecx, eax
call esi
jmp 0x406bb2