Function at 0x4341b0
Capabilities:
Manipulate safe mode programs

Disassembly:
push 0xffffffffffffffff
push 0x50e6f5
mov eax, dword fs:[0]
push eax
sub esp, 0x4a8
mov eax, dword [0x5aa4e4]
xor eax, esp
mov dword [esp + 0x4a4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5aa4e4]
xor eax, esp
push eax
lea eax, [esp + 0x4bc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x5525d0
mov esi, ecx
mov dword [esp + 0x20], ebx
call fcn.00447920
add esp, 4
mov ecx, esi
call fcn.00432960
test al, al
jne 0x43421f
push 0x552580
call fcn.00447920
add esp, 4
xor al, al
jmp 0x43462f
lea eax, [esp + 0x328]
push eax
push 0x101
call dword [0x540c28]
test eax, eax
je 0x434280
lea ecx, [esp + 0x14]
push 0x804
push ecx
call fcn.0046c120
mov dword [esp + 0x4cc], ebx
mov eax, dword [eax]
push ebx
push eax
call fcn.00467cb0
add esp, 0x10
mov dword [esp + 0x4c4], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00402ad0
push str.4D36E972_E325_11CE_BFC1_08002BE10318
call fcn.00447920
add esp, 4
xor al, al
jmp 0x43462f
lea ecx, [esi + 0x1d0]
call fcn.00429030
test eax, eax
jne 0x43429c
push 0x552510
call fcn.00447920
add esp, 4
mov ecx, esi
call fcn.0042a3c0
mov edi, eax
cmp edi, ebx
jne 0x4342bd
push str.CDriverInstaller::RemoveDriver_:_failed_to_open_service__s_
call fcn.00447920
add esp, 4
xor al, al
jmp 0x43462f
mov ecx, esi
call fcn.0042c510
mov ecx, esi
call fcn.00431900
call fcn.004530c0
mov ecx, edi
call fcn.0040d650
push ebx
mov ecx, esi
call fcn.004311f0
test eax, eax
jne 0x4343ec
call fcn.0040dc60
cmp eax, 8
jne 0x4342fb
push 1
call fcn.004433d0
add esp, 4
lea ecx, [esp + 0x48]
call fcn.004283b0
mov dword [esp + 0x4c4], 1
lea edx, [esp + 0x14]
push 0x7e0
push edx
call fcn.0046c120
add esp, 8
mov byte [esp + 0x4c4], 2
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x4c]
call fcn.004289f0
mov byte [esp + 0x4c4], 1
lea ecx, [esp + 0x14]
call fcn.00402ad0
mov ecx, esi
call fcn.0042a630
mov ecx, esi
call fcn.00433ea0
push 0x3e8
call dword [0x540678]
lea ecx, [esp + 0x48]
call fcn.00427e70
push 1
call fcn.004433d0
add esp, 4
call dword [0x540510]
push eax
push 0x552440
call fcn.00447920
mov esi, dword [0x540ad4]
add esp, 8
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x3c]
push eax
call esi
test eax, eax
je 0x4343c4
mov edi, dword [0x540adc]
mov ebp, 0x12
cmp dword [esp + 0x30], ebp
je 0x4343c4
lea ecx, [esp + 0x2c]
push ecx
call edi
push 1
push ebx
push ebx
push ebx
lea edx, [esp + 0x3c]
push edx
call esi
test eax, eax
jne 0x4343a7
push 0x552410
call fcn.00447920
add esp, 4
mov dword [esp + 0x4c4], 0xffffffff
lea ecx, [esp + 0x48]
call fcn.00428490
xor al, al
jmp 0x43462f
mov ecx, esi
call fcn.004293b0
mov edi, dword [edi + 0x20]
push edi
lea ecx, [esi + 0x1e8]
call fcn.00435120
mov ecx, esi
call fcn.0042e630
call fcn.0047e220
test al, al
jne 0x43461d
lea ecx, [esp + 0x24]
call fcn.00402a60
mov ebx, 3
mov dword [esp + 0x4c4], ebx
lea ecx, [esp + 0x20]
call fcn.00402a60
mov byte [esp + 0x4c4], 4
call fcn.00436570
mov edx, dword [eax]
mov edx, dword [edx + 0x30]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call edx
lea eax, [esp + 0x18]
push eax
call fcn.00465c10
add esp, 4
mov byte [esp + 0x4c4], 5
mov ecx, dword [esp + 0x20]
mov eax, dword [eax]
push ecx
lea edi, [esi + 0x12c]
push eax
mov ecx, edi
call fcn.00455e30
mov byte [esp + 0x4c4], 4
lea ecx, [esp + 0x18]
call fcn.00402ad0
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00405180
mov byte [esp + 0x4c8], 6
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00405180
mov byte [esp + 0x4cc], 7
mov byte [esp + 0x4cc], 4
mov ecx, edi
call fcn.00455ff0
mov byte [esp + 0x4c4], bl
lea ecx, [esp + 0x20]
call fcn.00402ad0
mov dword [esp + 0x4c4], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.00402ad0
call fcn.0046adf0
mov ebp, eax
sub eax, 1
je 0x43450e
sub eax, 2
je 0x43450e
sub eax, 2
je 0x43450e
push 0
jmp 0x434510
push 1
mov ecx, edi
call fcn.00454e60
cmp ebp, 4
jne 0x434525
push 0
mov ecx, esi
call fcn.00431c10
lea ecx, [esp + 0x14]
push ecx
call fcn.00465ba0
add esp, 4
mov ebp, 8
mov dword [esp + 0x4c4], ebp
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
je 0x434578
lea eax, [esp + 0x18]
push eax
call fcn.00465c10
mov byte [esp + 0x4c8], 9
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x28], 1
call fcn.004068b0
add esp, 0xc
test al, al
je 0x434578
mov bl, 1
jmp 0x43457a
xor bl, bl
mov dword [esp + 0x4c4], ebp
test byte [esp + 0x1c], 1
je 0x434596
and dword [esp + 0x1c], 0xfffffffe
lea ecx, [esp + 0x18]
call fcn.00402ad0
xor eax, eax
test bl, bl
setne al
mov ecx, edi
push eax
call fcn.00454ba0
mov ecx, esi
call fcn.0042d720
mov ecx, esi
call fcn.0042b0d0
call fcn.004688e0
test al, al
je 0x4345c3
mov ecx, esi
call fcn.0042f7d0
cmp dword [esi + 0xe4], 0
jne 0x434607
lea edx, [esp + 0x18]
push edx
push 4
push esi
push 0x430c80
push 0
push 0
call dword [0x54061c]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
push 0x552398
call fcn.00447920
add esp, 8
push 0xffffffffffffffff
push esi
call dword [0x540620]
push esi
call dword [0x540624]
mov dword [esp + 0x4c4], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00402ad0
jmp 0x43462d
push 1
mov ecx, esi
call fcn.0042db00
mov ecx, esi
call fcn.00433420
mov al, 1
mov ecx, dword [esp + 0x4bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4a4]
xor ecx, esp
call fcn.004c8a79
add esp, 0x4b4
ret