Function at 0x479500
Capabilities:
Create process on windows
Delete directory
Delete file
Move file
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67b40f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x233c
call fcn.0060ce10
mov eax, dword [0x780784]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [ebp + 8], 3
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x234c], edi
jne 0x479619
mov ecx, dword [edi + 4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x479550
mov eax, dword [0x74b788]
sub ecx, edx
sar ecx, 1
add eax, 6
cmp ecx, eax
jne 0x479619
push 0xb
push str.S_1_16_4096
lea ecx, [ebp - 0x2288]
mov dword [ebp - 0x2278], 0
mov dword [ebp - 0x2274], 0xf
mov byte [ebp - 0x2288], 0
call fcn.004753c0
push dword [edi + 8]
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
call fcn.0061cf17
add esp, 4
cmp eax, 1
jne 0x4795d7
push 0xb
push str.S_1_16_8192
lea ecx, [ebp - 0x2288]
call fcn.004753c0
jmp 0x4795d7
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2288]
mov ecx, esp
push eax
call fcn.0046cf20
call fcn.00485ec0
add esp, 0x18
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [edi + 8]
lea ecx, [ebp - 0x223d]
push dword [edi + 4]
call fcn.00551bb0
lea ecx, [ebp - 0x2288]
jmp 0x47a807
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00494e50
push 0x6c4834
call fcn.004948c0
push eax
push 0x6c4834
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00494860
push str.adobegc.log
call fcn.004948c0
push eax
push str.adobegc.log
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00494860
lea eax, [ebp - 0x118]
push 0x61a8000
push eax
call fcn.0054e550
mov esi, eax
add esp, 0x38
test esi, esi
je 0x4796ac
push 0
call fcn.0054e5e0
add esp, 4
mov dword [0x785d74], eax
test eax, eax
je 0x4796a3
push esi
push eax
call fcn.0054e560
add esp, 8
push esi
call fcn.0054e650
add esp, 4
push 0x6c4f2c
push str.AGSHelper_Started__s
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
mov esi, dword [ebp + 8]
add esp, 0x18
cmp esi, 2
jne 0x479746
mov eax, dword [edi + 4]
mov edx, str.__UninstallClient
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x479706
test si, si
je 0x479702
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x479706
add ecx, 4
add edx, 4
test si, si
jne 0x4796e0
xor ecx, ecx
jmp 0x47970b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x479783
mov ecx, str.__UninstallUserDriven
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47973a
test dx, dx
je 0x479736
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47973a
add eax, 4
add ecx, 4
test dx, dx
jne 0x479714
xor eax, eax
jmp 0x47973f
sbb eax, eax
or eax, 1
test eax, eax
je 0x479783
mov esi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, str.__UninstallForbidden
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x479776
test dx, dx
je 0x479772
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x479776
add eax, 4
add ecx, 4
test dx, dx
jne 0x479750
xor eax, eax
jmp 0x47977b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x479cb7
push str.AGSHelper_uninstall_workflow_Started
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
mov eax, dword [edi + 4]
add esp, 0x14
mov ecx, str.__UninstallForbidden
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4797ce
test dx, dx
je 0x4797ca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4797ce
add eax, 4
add ecx, 4
test dx, dx
jne 0x4797a8
xor eax, eax
jmp 0x4797d3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4798a4
push str.Sending_uninstallation_forbidden_status_to_the_server
push eax
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x14
mov dword [ebp - 0x2244], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x2254]
movups xmmword [ebp - 0x2254], xmm0
call fcn.005f8820
push 0xa
push str.UserDriven
lea ecx, [ebp - 0x2270]
mov dword [ebp - 4], 3
mov dword [ebp - 0x2260], 0
mov dword [ebp - 0x225c], 0xf
mov byte [ebp - 0x2270], 0
call fcn.004753c0
lea eax, [ebp - 0x2270]
mov byte [ebp - 4], 4
push eax
push 0x11
lea ecx, [ebp - 0x2254]
call fcn.00479050
lea ecx, [ebp - 0x2270]
call fcn.00468830
mov eax, dword [0x785d74]
test eax, eax
je 0x479894
push eax
call fcn.0054e5c0
push dword [0x785d74]
call fcn.0054e650
add esp, 8
mov dword [0x785d74], 0
lea ecx, [ebp - 0x2254]
call fcn.005f8a50
jmp 0x47a80c
xorps xmm0, xmm0
mov dword [ebp - 0x2244], 0
lea ecx, [ebp - 0x2254]
movups xmmword [ebp - 0x2254], xmm0
call fcn.005f8820
mov eax, dword [edi + 4]
mov ecx, str.__UninstallClient
mov dword [ebp - 4], 5
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4798f8
test dx, dx
je 0x4798f4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4798f8
add eax, 4
add ecx, 4
test dx, dx
jne 0x4798d2
xor eax, eax
jmp 0x4798fd
sbb eax, eax
or eax, 1
mov ecx, str.UserDriven
mov dword [ebp - 0x2260], 0
test eax, eax
mov dword [ebp - 0x225c], 0xf
mov edx, str.ServerDriven
mov byte [ebp - 0x2270], 0
cmovne edx, ecx
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x479930
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2270]
call fcn.004753c0
push 0
lea ecx, [ebp - 0x2254]
mov byte [ebp - 4], 6
call fcn.005f9480
push str.Sending_uninstallation_status_info_to_the_server
push 0
push 4
push dword [0x74abe8]
mov esi, eax
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x14
lea eax, [ebp - 0x2270]
lea ecx, [ebp - 0x2254]
push eax
push esi
call fcn.00479050
test esi, esi
jne 0x479b39
push str.Deleting_SLCache_GC_subdomains__AdobeGCData_and_log_file
push esi
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
mov eax, dword [0x785d74]
add esp, 0x14
test eax, eax
je 0x4799d0
push eax
call fcn.0054e5c0
push dword [0x785d74]
call fcn.0054e650
add esp, 8
mov dword [0x785d74], esi
push 0
call fcn.0054e8b0
movzx ecx, byte [0x6d886f]
mov esi, eax
push ecx
push str.GoCartDataUploadV2
push esi
call fcn.0054eb90
movzx ecx, byte [0x6d886f]
push ecx
push str.GoCartResurfacingData
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.GoCartAppExecutablePathsV2
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.GoCartAppAMTLibPathsV2
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.GoCartAdobeCodesV2
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
add esp, 0x40
push eax
push str.GoCartInstallationEventTimestamps
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.GoCartProductPidDomain
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.GoCartOOCData
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.GoCartOOCScheduledData
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.postSelfUpdate
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.postAGSSchedulerInstallation
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
add esp, 0x48
push eax
push str.postAGMInstallation
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.postUserSchedulerInstallation
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.postAdminSchedulerInstallation
push esi
call fcn.0054eb90
movzx eax, byte [0x6d886f]
push eax
push str.launchURIRegistryInstallation
push esi
call fcn.0054eb90
push esi
call fcn.0054e650
mov eax, dword [ebp - 0x2254]
add esp, 0x34
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x6bb4e8]
lea ecx, [ebp - 0x2254]
call esi
mov eax, dword [ebp - 0x2254]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x6bb4e8]
lea ecx, [ebp - 0x2254]
call esi
jmp 0x479b60
mov eax, dword [0x785d74]
test eax, eax
je 0x479b60
push eax
call fcn.0054e5c0
push dword [0x785d74]
call fcn.0054e650
add esp, 8
mov dword [0x785d74], 0
lea ecx, [ebp - 0x2270]
call fcn.00468830
lea ecx, [ebp - 0x2254]
mov dword [ebp - 4], 0xffffffff
call fcn.005f8a50
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00494e50
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x2278], 0
add esp, 8
mov dword [ebp - 0x2274], 0xf
mov byte [ebp - 0x2288], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x479bb5
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x2288]
call fcn.004753c0
push 1
push 0x6c4834
lea ecx, [ebp - 0x2288]
mov dword [ebp - 4], 7
call fcn.00475240
push 0x11
push str.dispatchtable.xml
lea ecx, [ebp - 0x2288]
call fcn.00475240
cmp dword [ebp - 0x2274], 0x10
lea eax, [ebp - 0x2288]
cmovae eax, dword [ebp - 0x2288]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x44
lea eax, [ebp - 0x22fc]
push 0
push eax
call fcn.0060f310
add esp, 0xc
lea eax, [ebp - 0x62c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x2250], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x62c]
push eax
push str.cmd.exe__C_timeout__T_3__Del__f__q___s_
lea eax, [ebp - 0x223c]
push 0x208
push eax
call fcn.004792e0
add esp, 0x10
lea eax, [ebp - 0x2250]
push eax
lea eax, [ebp - 0x22fc]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x223c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x224c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2250]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2288]
jmp 0x47a807
push str.Setting_mitigation_policies
push dword [0x76c548]
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
call fcn.00482cd0
mov dword [ebp - 0x22a8], 0
mov dword [ebp - 0x22a4], 0xf
mov byte [ebp - 0x22b8], 0
mov dword [ebp - 4], 8
mov dword [ebp - 0x2290], 0
mov dword [ebp - 0x228c], 0xf
mov byte [ebp - 0x22a0], 0
push 0x400
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.0060f310
push 0x400
lea eax, [ebp - 0x1a2c]
push 0
push eax
call fcn.0060f310
push 0x400
lea eax, [ebp - 0xe2c]
push 0
push eax
call fcn.0060f310
push 0x400
lea eax, [ebp - 0x1e2c]
push 0
push eax
call fcn.0060f310
add esp, 0x44
lea eax, [ebp - 0x162c]
push 0x400
push 0
push eax
call fcn.0060f310
push 0x400
lea eax, [ebp - 0x122c]
push 0
push eax
call fcn.0060f310
push 0
push str.AGSService
call fcn.00478d00
add esp, 0x20
cmp esi, 1
jle 0x47a615
test al, al
je 0x47a615
push 1
push str.AGMService
call fcn.00478d00
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2244], 0xf
mov byte [ebp - 0x2258], 0
push 0x104
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0xa
push 0
push eax
call fcn.0060f310
lea eax, [ebp - 0x2258]
push eax
call fcn.00489460
push 0x6c4834
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00494750
push str.AdobeGCData
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00494750
lea ecx, [ebp - 0x118]
add esp, 0x30
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x479e30
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x2258]
call fcn.00475240
cmp dword [ebp - 0x2244], 0x10
lea eax, [ebp - 0x2258]
cmovae eax, dword [ebp - 0x2258]
push eax
call fcn.00494bf0
add esp, 4
test eax, eax
lea eax, [ebp - 0x2258]
jne 0x479e89
cmp dword [ebp - 0x2244], 0x10
cmovae eax, dword [ebp - 0x2258]
push eax
call fcn.00483f50
jmp 0x479e9d
cmp dword [ebp - 0x2244], 0x10
cmovae eax, dword [ebp - 0x2258]
push eax
call fcn.00486b50
mov edx, dword [ebp - 0x2244]
add esp, 4
mov byte [ebp - 4], 9
cmp edx, 0x10
jb 0x479ede
mov ecx, dword [ebp - 0x2258]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x479ed4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a82a
push edx
push ecx
call fcn.0060c992
add esp, 8
mov ecx, dword [edi + 4]
lea edx, [ebp - 0xa2c]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x479ef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa2c]
push eax
push str.Passed_in_arg__S_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
lea eax, [ebp - 0x21c]
push 1
push eax
call fcn.0047a840
push 0x6c4834
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00494750
push str.AdobeGCClient
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00494750
lea eax, [ebp - 0x21c]
push eax
call fcn.004948c0
add esp, 0x40
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.00494890
push 0x6c4834
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.00494750
push 0x6c45bc
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.00494750
lea eax, [ebp - 0x21c]
push eax
call fcn.004948c0
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call fcn.00494890
push 0x6c4834
lea eax, [ebp - 0x424]
push 0x104
push eax
call fcn.00494750
add esp, 0x48
lea eax, [ebp - 0x424]
push 0x6c463c
push 0x104
push eax
call fcn.00494750
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x320]
push eax
push str.AGS__s_and_AGM___s___error___d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x20
lea ecx, [ebp - 0x320]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47a048
sub ecx, edx
lea eax, [ebp - 0x320]
push ecx
push eax
lea eax, [ebp - 0xe2c]
push eax
call fcn.0061d1e0
lea ecx, [ebp - 0x424]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47a071
sub ecx, edx
lea eax, [ebp - 0x424]
push ecx
push eax
lea eax, [ebp - 0x162c]
push eax
call fcn.0061d1e0
lea ecx, [ebp - 0x21c]
add esp, 0xc
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47a0a0
sub ecx, edx
lea eax, [ebp - 0x21c]
push ecx
push eax
lea eax, [ebp - 0x1e2c]
push eax
call fcn.0061d1e0
lea eax, [ebp - 0x320]
push eax
call fcn.00494ef0
add esp, 0x10
test eax, eax
je 0x47a0fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x320]
push eax
push str.Deleting___s_Failed_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0xa2c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x1a2e], ax
test ax, ax
jne 0x47a100
lea edi, [ebp - 0x1a2c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x47a121
mov ecx, 8
mov esi, str.AGSService.exe
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ebp + ecx - 0xa2c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x122e], ax
test ax, ax
jne 0x47a140
lea edi, [ebp - 0x122c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x47a161
push 0x200
lea eax, [ebp - 0x624]
mov ecx, 8
mov esi, str.AGMService.exe
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0060f310
push 0x200
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x624]
push eax
call fcn.0061d59e
lea eax, [ebp - 0x624]
push eax
call fcn.00494bf0
add esp, 0x1c
test eax, eax
je 0x47a20f
push str.AGMService_exists_in_temp_folder__replacing_service
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
lea eax, [ebp - 0x424]
push eax
call fcn.00494ef0
add esp, 0x18
test eax, eax
je 0x47a20f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x424]
push eax
push str.Deleting___s_Failed_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
lea eax, [ebp - 0xe2c]
push eax
lea eax, [ebp - 0x1a2c]
push eax
push str.Moving_AGS_from__S_to__S
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
lea eax, [ebp - 0x162c]
push eax
lea eax, [ebp - 0x122c]
push eax
push str.Moving_AGM_from__S_to__S
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x38
lea eax, [ebp - 0xe2c]
push eax
lea eax, [ebp - 0x1a2c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
lea eax, [ebp - 0x162c]
push eax
lea eax, [ebp - 0x122c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x234c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe2c]
push eax
cmp esi, 1
jne 0x47a3a7
push str.Scheduling_AGS__s_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
push 0x48
lea eax, [ebp - 0x2300]
push 0
push eax
call fcn.0060f310
add esp, 0x28
lea ecx, [ebp - 0x2300]
call fcn.0048a720
lea ecx, [ebp - 0x2300]
mov byte [ebp - 4], 0xb
call fcn.0048dca0
lea ecx, [ebp - 0x2300]
call fcn.0048b300
lea ecx, [ebp - 0x22a0]
test eax, eax
je 0x47a331
push 0x13
push str.schedulingAGSFailed
mov esi, str.failed
call fcn.004753c0
mov edi, dword [ebp - 0x22c0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe2c]
push eax
push str.Failed_to_create_AGS_scheduler__s_d
jmp 0x47a357
push 4
push 0x6c444c
mov esi, str.successfull
call fcn.004753c0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe2c]
push eax
push str.Successfully_created_AGS_scheduler__s_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
lea eax, [ebp - 0x22a0]
cmp dword [ebp - 0x228c], 0x10
cmovae eax, dword [ebp - 0x22a0]
push 0
push edi
push eax
push esi
push str.postAGSSchedulerInstallation
push str.AGSHelper
call fcn.0047d980
add esp, 0x18
lea ecx, [ebp - 0x2300]
call fcn.0048cc30
jmp 0x47a3c4
push str.Move_AGS_Failed__s_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
cmp dword [ebp - 0x234c], 1
jne 0x47a5ea
mov dword [ebp - 0x224c], 0
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2244], 0
lea eax, [ebp - 0x224c]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.00488de0
mov esi, dword [ebp - 0x224c]
add esp, 8
test al, al
mov byte [ebp - 4], 9
sete al
mov byte [ebp - 0x223d], al
test esi, esi
je 0x47a4d6
mov edi, dword [ebp - 0x2248]
cmp esi, edi
je 0x47a489
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x47a469
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x47a45f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a82f
mov eax, edx
push ecx
push eax
call fcn.0060c992
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add esi, 0x18
cmp esi, edi
jne 0x47a430
mov esi, dword [ebp - 0x224c]
mov ecx, dword [ebp - 0x2244]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x47a4c6
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a82f
push ecx
push esi
call fcn.0060c992
mov al, byte [ebp - 0x223d]
add esp, 8
test al, al
je 0x47a505
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa2c]
push eax
push str.Deleting__contents_of__s_Failed_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x47a541
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa2c]
push eax
push str.Deleting___s_folder_failed_Failed_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
push str.AdobeGenuineData
push str.UninstallAGM
call fcn.0047ad00
add esp, 8
test al, al
jne 0x47a615
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x162c]
push eax
push str.Starting_AGM__s_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x22a0]
push eax
lea eax, [ebp - 0x22b8]
push eax
call fcn.00478480
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x228c], 0x10
lea edx, [ebp - 0x22a0]
push 0
cmovae edx, dword [ebp - 0x22a0]
lea ecx, [ebp - 0x22b8]
cmp dword [ebp - 0x22a4], 0x10
push eax
cmovae ecx, dword [ebp - 0x22b8]
push edx
push ecx
push str.postAGMInstallation
push str.AGSHelper
call fcn.0047d980
add esp, 0x18
jmp 0x47a615
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x162c]
push eax
push str.Move_AGM_Failed__s_d
push 0
push 4
push dword [0x74abe8]
push dword [0x785d74]
call fcn.0054e4f0
add esp, 0x1c
mov dword [ebp - 0x2260], 0
mov dword [ebp - 0x225c], 0xf
mov byte [ebp - 0x2270], 0
mov byte [ebp - 4], 0xd
call fcn.00477630
test al, al
je 0x47a64e
mov esi, str.successfull
mov eax, 0x6c444c
mov ecx, 4
jmp 0x47a65d
mov esi, str.failed
mov eax, str.errorCreatingRegEntry
mov ecx, 0x15
push ecx
push eax
lea ecx, [ebp - 0x2270]
call fcn.004753c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x225c], 0x10
lea ecx, [ebp - 0x2270]
push 0
cmovae ecx, dword [ebp - 0x2270]
push eax
push ecx
push esi
push str.postAdminSchedulerInstallation
push str.AGSHelper
call fcn.0047d980
add esp, 0x18
call fcn.00489f60
test al, al
je 0x47a717
call fcn.00477aa0
test al, al
je 0x47a6be
mov esi, str.successfull
mov eax, 0x6c444c
mov ecx, 4
jmp 0x47a6cd
mov esi, str.failed
mov eax, str.errorCreatingRegEntryForUWP
mov ecx, 0x1b
push ecx
push eax
lea ecx, [ebp - 0x2270]
call fcn.004753c0
cmp esi, str.successfull
jne 0x47a6e6
xor eax, eax
jmp 0x47a6ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x225c], 0x10
lea ecx, [ebp - 0x2270]
push 0
cmovae ecx, dword [ebp - 0x2270]
push eax
push ecx
push esi
push str.launchURIRegistryInstallation
push str.AGSHelper
call fcn.0047d980
add esp, 0x18
mov edx, dword [ebp - 0x225c]
mov byte [ebp - 4], 9
cmp edx, 0x10
jb 0x47a755
mov ecx, dword [ebp - 0x2270]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x47a74b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a834
push edx
push ecx
call fcn.0060c992
add esp, 8
push 0x48
lea eax, [ebp - 0x2348]
push 0
push eax
call fcn.0060f310
add esp, 0xc
lea ecx, [ebp - 0x2348]
call fcn.0048de50
lea ecx, [ebp - 0x2348]
mov byte [ebp - 4], 0xe
call fcn.0048dca0
push 0
lea ecx, [ebp - 0x2348]
call fcn.0048e180
push 0
test eax, eax
jne 0x47a7a2
push eax
push 0x6c444c
push str.successfull
jmp 0x47a7b2
push dword [ebp - 0x2308]
push 0x6c444c
push str.failed
push str.postUserSchedulerInstallation
push str.AGSHelper
call fcn.0047d980
mov eax, dword [0x785d74]
add esp, 0x18
test eax, eax
je 0x47a7eb
push eax
call fcn.0054e5c0
push dword [0x785d74]
call fcn.0054e650
add esp, 8
mov dword [0x785d74], 0
lea ecx, [ebp - 0x2348]
call fcn.0048cc30
lea ecx, [ebp - 0x22a0]
call fcn.00468830
lea ecx, [ebp - 0x22b8]
call fcn.00468830
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0060cdfa
mov esp, ebp
pop ebp
ret
call fcn.0061883f
call fcn.0061883f
call fcn.0061883f
int3