Function at 0x4613a0
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry key
Get common file path
Get startup folder
Move file
Query or enumerate registry value
Read .ini file
Self delete
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dfc1
mov eax, dword fs:[0]
push eax
mov eax, 0x1488
call fcn.00498310
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x428], 0x45eb50
mov dword [ebp - 0x424], ebx
lea eax, [ebp - 0x42c]
mov dword [ebp - 4], 0
push eax
call fcn.0044f2b0
push 0
call fcn.0050e462
mov dword [ebx + 0xc8], eax
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x430]
mov dword [ebp - 4], 1
push eax
call fcn.0044f2b0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.0045f180
call fcn.00412520
mov ecx, eax
test ecx, ecx
je 0x462445
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1448], eax
push 0x55a700
lea ecx, [ebp - 0x1448]
mov dword [ebp - 4], 2
call fcn.0041d7d0
test al, al
jne 0x4614a1
push 0xa
push 0x55a700
lea ecx, [ebp - 0x1448]
call fcn.0040dcb0
cmp dword [ebx + 0x7c], 0
mov dword [ebp - 4], 3
je 0x46161f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004dda00
lea eax, [ebp - 0x438]
mov dword [ebp - 0x1444], 1
push 2
push eax
mov dword [ebp - 0x1440], 0x208
call fcn.00432bf0
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x4614f2
mov eax, dword [eax]
lea ecx, [ebp - 0x1440]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x1444]
push ecx
push str.Setup_Path
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x438]
call fcn.00421740
cmp word [ebp - 0x218], 0
je 0x461611
push str.ComputerZ.set
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x461611
push 0x208
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.004dda00
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x640]
push eax
push 0x54fa2c
push 0x554f78
push str.three_end
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x640]
push 0x553cc8
push eax
call fcn.005085bf
add esp, 8
test eax, eax
jne 0x461611
push str.LdsLite_is_act:0
call fcn.00456ec0
add esp, 4
lea eax, [ebp - 0x218]
push eax
push 0
push 0x554f78
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1458], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.uninst_act_lite
mov byte [ebp - 4], 4
call fcn.0042e040
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004239a0
mov dword [ebx + 0x80], 1
jmp 0x46161f
lea ecx, [ebx + 0x78]
call fcn.00468e00
mov dword [ebx + 0x80], eax
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 2
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 5
push eax
call fcn.0044f2b0
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004dda00
add esp, 0x10
lea eax, [ebp - 0x218]
push str.UtilsMiniNews.exe
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call fcn.00454d00
mov edi, dword [ebp - 0x1448]
lea eax, [ebp - 0x218]
push 0x1388
push 0
push 1
push 1
push 1
push edi
push eax
call fcn.00454f00
push edi
lea eax, [ebp - 0x218]
push eax
push str.Call_exe:_s_param:_s
call fcn.00456ec0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 3
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 6
push eax
call fcn.0044f2b0
push str.start_call_program
mov byte [ebp - 4], 3
call fcn.00456ec0
mov eax, dword [ebx + 8]
add esp, 0x14
push dword [eax - 0xc]
push eax
call fcn.00456b60
mov ecx, eax
call fcn.00456b40
mov ecx, eax
call fcn.00458d70
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 4
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 7
push eax
call fcn.0044f2b0
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004dda00
add esp, 0x10
lea eax, [ebp - 0x218]
push dword [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.UtilsLDSGameCenter_ludashi.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0xe40]
push 0
push eax
call fcn.004dda00
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0xe40]
add esp, 0xc
push dword [ebx + 8]
push eax
call esi
push str.GameCenterGameUninst.exe
lea eax, [ebp - 0xe40]
push eax
call esi
call fcn.00412520
mov ecx, eax
test ecx, ecx
je 0x46244f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1440], eax
push str._S__PIDludashi
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 8
call fcn.0041d7d0
test al, al
jne 0x46180c
push 0xf
push str._S__PIDludashi
lea ecx, [ebp - 0x1440]
call fcn.0040dcb0
cmp dword [ebx + 0x88], 0
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 9
je 0x461828
push 0xb
push str.__UNINSTALL
jmp 0x46182f
push 0xd
push str.__NOUNINSTALL
call fcn.004219d0
mov esi, dword [ebp - 0x1440]
lea eax, [ebp - 0x218]
push 0xbb8
push 0
push 1
push 1
push 1
push esi
push eax
call fcn.00454f00
push esi
lea eax, [ebp - 0x218]
push eax
push str.Call_exe:_s_param:_s
call fcn.00456ec0
add esp, 0xc
lea eax, [ebp - 0xe40]
push 0xbb8
push 0
push 1
push 1
push 1
push esi
push eax
call fcn.00454f00
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46189f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 5
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xa
push eax
call fcn.0044f2b0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 6
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xb
push eax
call fcn.0044f2b0
add esp, 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1444]
mov dword [ebp - 0x1444], ebx
lea ecx, [ebx + 0x8c]
mov dword [ebp - 0x1440], 0x460b40
push eax
lea eax, [ebp - 0x1440]
push eax
call fcn.0045ce20
push 0x7530
lea ecx, [ebx + 0x8c]
call fcn.0045ea30
test al, al
jne 0x461b3b
xorps xmm0, xmm0
mov dword [ebp - 0x148c], 0
lea eax, [ebp - 0x1494]
mov dword [ebp - 0x147c], 0
push eax
movlpd qword [ebp - 0x1474], xmm0
movlpd qword [ebp - 0x146c], xmm0
movlpd qword [ebp - 0x1464], xmm0
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x1494], 0x3c
mov dword [ebp - 0x1484], 0x55a788
mov dword [ebp - 0x1488], 0x551950
mov dword [ebp - 0x1480], str._c_netsh_winsock_reset
mov dword [ebp - 0x1478], 0
mov dword [ebp - 0x1490], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x461b3b
push 0x2710
push dword [ebp - 0x145c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461b3b
push dword [ebp - 0x145c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SOFTWARELudashiLspUrl
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004dda00
add esp, 0xc
mov dword [ebp - 0x1440], 0
lea eax, [ebp - 0x1440]
push eax
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x1440]
test eax, eax
je 0x461b3b
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x461b3b
push 0x208
lea eax, [ebp - 0xe40]
push 0
push eax
call fcn.004dda00
add esp, 0xc
lea eax, [ebp - 0xe40]
push eax
push 0
push str.lds
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x461adf
push str.netload.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0xe40]
push 1
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0xe40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x461adf
push 4
push eax
lea eax, [ebp - 0xe40]
push eax
call esi
push 0x208
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.004dda00
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x461b3b
push str.ldscon
lea eax, [ebp - 0x640]
push 0x104
push eax
call fcn.0050f539
lea eax, [ebx + 4]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.004365b0
add esp, 0x18
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 7
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xc
push eax
call fcn.0044f2b0
push 1
push dword [ebx + 8]
lea esi, [ebx + 8]
mov byte [ebp - 4], 3
call fcn.00430740
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 8
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xd
push eax
call fcn.0044f2b0
push str.start_close_all_processes
mov byte [ebp - 4], 3
call fcn.00456ec0
add esp, 0x14
push 0
push esi
call fcn.00456b60
mov ecx, eax
call fcn.00456b40
push eax
call fcn.004639e0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 9
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xe
push eax
call fcn.0044f2b0
push str.start_close_band
mov byte [ebp - 4], 3
call fcn.00456ec0
add esp, 0x14
mov ecx, ebx
call fcn.0045d970
push str.start_uninstall_shellext
call fcn.00456ec0
add esp, 4
mov ecx, ebx
call fcn.00462620
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xa
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0xf
push eax
call fcn.0044f2b0
add esp, 4
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.00462850
push str.remove_desktop_shortcuts
call fcn.00456ec0
add esp, 4
mov ecx, ebx
call fcn.00460310
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xb
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x10
push eax
call fcn.0044f2b0
push str.remove_start_menu_shortcuts
mov byte [ebp - 4], 3
call fcn.00456ec0
push 0x800
lea eax, [ebp - 0xc38]
push 0
push eax
call fcn.004dda00
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xc38]
add esp, 0x14
push 1
push 0x17
push eax
push 0
call esi
push 0x551c98
lea eax, [ebp - 0xc38]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc38]
push eax
call fcn.00455f30
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xc
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x11
push eax
call fcn.0044f2b0
push str.remove_appdata
mov byte [ebp - 4], 3
call fcn.00456ec0
push 0x800
lea eax, [ebp - 0xc38]
push 0
push eax
call fcn.004dda00
add esp, 0x18
lea eax, [ebp - 0xc38]
push 1
push 0x1a
push eax
push 0
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc38]
push str.Ludashi
push eax
push eax
call esi
push 0x800
lea eax, [ebp - 0x1438]
push 0
push eax
call fcn.004dda00
add esp, 0xc
lea eax, [ebp - 0xc38]
push str.no_delete_me.txt
push eax
lea eax, [ebp - 0x1438]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0xc38]
push eax
call esi
test eax, eax
je 0x461df2
lea eax, [ebp - 0x1438]
push eax
call esi
test eax, eax
jne 0x461df2
lea eax, [ebp - 0xc38]
push eax
call fcn.00455f30
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xd
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x12
push eax
call fcn.0044f2b0
push str.remove_file_by_registry
mov byte [ebp - 4], 3
call fcn.00456ec0
lea eax, [ebx + 0xc]
push eax
push 1
push dword [ebx + 8]
call fcn.00430ef0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xf
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x13
push eax
call fcn.0044f2b0
push str.remove_autorun
mov byte [ebp - 4], 3
call fcn.00456ec0
add esp, 0x1c
lea ecx, [ebp - 0x1439]
call fcn.0046ba90
push 1
push str.ComputerZ_Tray
lea ecx, [ebp - 0x1439]
mov byte [ebp - 4], 0x14
call fcn.0046d210
push 0
push str.ComputerZ_Tray
lea ecx, [ebp - 0x1439]
call fcn.0046d210
push eax
push str.Delete_AutoRun_Registry__ret___d
call fcn.00456ec0
add esp, 8
lea ecx, [ebp - 0x1439]
push str.ComputerZ_Tray
call fcn.0046d3f0
push eax
push str.Delete_AutoRun_Task_Schedule__ret___d
call fcn.00456ec0
add esp, 8
lea ecx, [ebp - 0x1439]
call fcn.0046bef0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x10
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x15
push eax
call fcn.0044f2b0
add esp, 4
mov byte [ebp - 4], 3
call fcn.00412520
mov ecx, eax
test ecx, ecx
je 0x462459
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1440], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLudashi_is1
lea ecx, [ebp - 0x1440]
mov byte [ebp - 4], 0x16
call fcn.0041d7d0
test al, al
jne 0x461f73
push 0x3f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLudashi_is1
lea ecx, [ebp - 0x1440]
call fcn.0040dcb0
mov esi, dword [ebp - 0x1440]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x17
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.00456ec0
add esp, 4
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x461fb2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x11
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x18
push eax
call fcn.0044f2b0
push str.ComputerZLock
mov byte [ebp - 4], 3
call fcn.0046f420
push str.ComputerZLock
call fcn.0046f580
push dword [0x596464]
call fcn.0046f420
push dword [0x596464]
call fcn.0046f580
push dword [0x596460]
call fcn.0046f420
push dword [0x596460]
call fcn.0046f580
push str.HardwareTM
call fcn.0046f420
push str.HardwareTM
call fcn.0046f580
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x12
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x19
push eax
call fcn.0044f2b0
push 0x208
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.004dda00
add esp, 0x34
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.ComputerZ_PowerSaveDll.dll
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462160
lea eax, [ebp - 0x420]
xor esi, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x462131
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462131
lea eax, [ebp - 0x420]
push eax
call fcn.00475cd0
add esp, 4
test eax, eax
je 0x462131
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x462131
push dword [0x596420]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x462131
call eax
mov esi, eax
test esi, esi
je 0x462153
mov eax, dword [esi]
push esi
call dword [eax]
test eax, eax
je 0x462160
push str.powerSaveHelper__DeletePowerScheme
call fcn.00456ec0
mov eax, dword [esi]
add esp, 4
push esi
call dword [eax + 0x34]
jmp 0x462160
push str.powerSaveHelper_is_nil
call fcn.00456ec0
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x13
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1a
push eax
call fcn.0044f2b0
push str.UtilsPCStoreSetup_officialwebsite.dll
lea esi, [ebx + 8]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1444]
push esi
push eax
call fcn.0045d880
push 1
push 0x55a958
push 0x551a04
push dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.00430cb0
mov edx, dword [ebp - 0x1444]
add esp, 0x20
mov byte [ebp - 4], 3
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4621e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x14
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1c
push eax
call fcn.0044f2b0
add esp, 4
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.00460ff0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x15
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1d
push eax
call fcn.0044f2b0
push dword [esi]
mov byte [ebp - 4], 3
push str.start_delete_all_files_in__s
call fcn.00456ec0
add esp, 0xc
mov ecx, ebx
push dword [esi]
call fcn.0045fb90
push dword [esi]
push str.end_delete_all_files_in__s
call fcn.00456ec0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x62
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1e
push eax
call fcn.0044f2b0
push str.start_create_runonce_bat
mov byte [ebp - 4], 3
call fcn.00456ec0
push dword [esi]
lea eax, [ebx + 0xc]
push eax
call fcn.00435100
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x63
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x1f
push eax
call fcn.0044f2b0
push str.start_ending_report.
mov byte [ebp - 4], 3
call fcn.00456ec0
add esp, 0x20
mov ecx, ebx
call fcn.0045dff0
call fcn.00456b50
mov esi, eax
push esi
mov ecx, dword [esi]
call dword [ecx + 0x18]
test eax, eax
je 0x462373
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1458], esp
mov dword [eax + 0x24], 0
mov eax, dword [esi]
push 0
push 0
push esi
mov byte [ebp - 4], 0x20
call dword [eax + 0x1c]
test eax, eax
mov edx, str.inst_lite_fail
mov ecx, str.inst_lite_suc
cmove ecx, edx
push ecx
call fcn.0042e040
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004239a0
push str.remove_registry
call fcn.00456ec0
add esp, 4
mov ecx, ebx
call fcn.00460bf0
mov dword [ebp - method.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x42c], 0x45eb30
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x64
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 0x21
push eax
call fcn.0044f2b0
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1450], 0x45eb20
mov dword [ebp - 0x144c], ebx
lea eax, [ebp - 0x1454]
mov byte [ebp - 4], 0x22
push eax
call fcn.0044f2b0
add esp, 8
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1450], 0
add edi, 0xfffffff0
mov dword [ebp - 0x144c], 0
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x462425
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004982ff
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.0040ada0
push 0x80004005
call fcn.0040ada0
push 0x80004005
call fcn.0040ada0
int3