Function at 0x401a10
Capabilities:
Get common file path
Stop service

Disassembly:
mov eax, dword [0x40b540]
sub esp, 0x22c
push esi
push edi
push str.Checking_driver_for_PP_...
push 0x3eb
push eax
mov edi, edx
mov esi, ecx
call fcn.00401000
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
mov edx, 0x40a480
mov ecx, esi
call fcn.00401090
cmp eax, 1
jne 0x401a56
push str.Switching_to_maintenance_mode__CheckSvc:driver_
jmp 0x401abd
mov eax, dword [esp + 0x238]
test eax, eax
jne 0x401ad0
mov eax, dword [esp + 8]
test eax, eax
je 0x401b5d
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401a8b
mov ecx, dword [0x40b540]
push str.Tally_Lock_driver_is_already_installed_and_running
push 0x3eb
push ecx
jmp 0x401c8f
mov edx, dword [0x40b540]
push str.Tally_Lock_driver_is_already_installed_but_NOT_running
push 0x3eb
push edx
call fcn.00401000
add esp, 0xc
mov edx, 0x40a528
mov ecx, esi
call fcn.004011d0
test eax, eax
je 0x401b47
push str.Switching_to_maintenance_mode__StartSvc:driver_
mov eax, dword [0x40b540]
push 0x3eb
push eax
call fcn.00401000
add esp, 0xc
mov edx, dword [0x40b540]
push str.Stopping_and_removing_driver_service_...
push 0x3eb
push edx
call fcn.00401000
add esp, 0xc
push 0xf01ff
push 0x40a6d4
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x401b15
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, 0x40a6e0
mov ecx, esi
call fcn.00401170
mov ecx, dword [0x40b540]
push 0x40b546
push 0x3eb
push ecx
call fcn.00401000
add esp, 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x22c
ret 4
mov ecx, dword [0x40b540]
push 0x40a564
push 0x3eb
push ecx
jmp 0x401c8f
mov edx, dword [0x40b540]
push str.Installing_Tally_Lock_driver_...
push 0x3eb
push edx
call fcn.00401000
add esp, 0xc
mov edx, 0x40a5ac
mov ecx, edi
call fcn.00401530
cmp eax, 1
jne 0x401bb4
mov eax, dword [0x40b540]
push 0x40a5bc
push str.File_not_found___s___skipped_...
push 0x3eb
push eax
call fcn.00401000
add esp, 0x10
pop edi
mov eax, 1
pop esi
add esp, 0x22c
ret 4
push 0x104
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x401bf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x40b540]
push eax
push 0x40a5f0
push 0x3eb
push edx
call fcn.00401000
add esp, 0x10
pop edi
mov eax, 1
pop esi
add esp, 0x22c
ret 4
push 0x40a614
lea eax, [esp + 0x30]
push eax
mov edx, 0x40a624
mov ecx, edi
call fcn.004016e0
test eax, eax
jne 0x401cea
push str.Sentinel.sys
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x138]
push 0x40a644
push edx
call fcn.00402a77
add esp, 0x10
push 2
push 1
lea eax, [esp + 0x138]
push eax
mov edx, 0x40a64c
mov ecx, esi
call fcn.00401260
test eax, eax
jne 0x401cea
mov ecx, dword [0x40b540]
push str.Tally_Lock_driver_installed.
push 0x3eb
push ecx
call fcn.00401000
add esp, 0xc
mov edx, 0x40a678
mov ecx, esi
call fcn.004011d0
test eax, eax
jne 0x401cea
mov edx, dword [0x40b540]
push str.Tally_Lock_driver_service_started.
push 0x3eb
push edx
call fcn.00401000
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
mov edx, 0x40a6ec
mov ecx, esi
call fcn.00401090
cmp eax, 1
je 0x401cea
cmp dword [esp + 8], 1
jne 0x401b21
mov edx, 0x40a6f8
mov ecx, esi
call fcn.00401120
test eax, eax
jne 0x401cea
call fcn.004018e0
test eax, eax
jne 0x401cea
mov edx, str.Sentinel
mov ecx, esi
call fcn.004011d0
test eax, eax
je 0x401b21
pop edi
mov eax, 1
pop esi
add esp, 0x22c
ret 4