Function at 0x419da0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4560a1
mov eax, dword fs:[0]
push eax
sub esp, 0x904
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8f4], ecx
mov eax, dword [0x482724]
test al, 1
jne 0x419df2
or eax, 1
push 0x45aec0
mov dword [0x482724], eax
call fcn.004521b7
add esp, 4
sub esp, 8
call fcn.00442f40
mov eax, dword [0x4831cc]
test al, 1
jne 0x419e23
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
mov ecx, 0x483160
call fcn.0041bf20
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.0040b7f0
mov eax, dword [0x4831cc]
test al, 1
jne 0x419e7f
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
cmp word [ebp - 0x218], 0
jne 0x419e8d
xor ecx, ecx
jmp 0x419ea5
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419e96
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x483160
call fcn.00406c00
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x462aac
push eax
push str._s_s
lea eax, [ebp - 0x830]
push 0x208
push eax
call fcn.00401c10
mov eax, dword [0x4831cc]
add esp, 0x14
test al, 1
jne 0x419f23
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
lea eax, [ebp - 0x830]
push eax
mov ecx, 0x483160
call fcn.0041abe0
test al, al
je 0x41a302
mov eax, dword [0x482720]
test al, 1
jne 0x419f5a
or eax, 1
push 0x45aeb0
mov dword [0x482720], eax
call fcn.004521b7
add esp, 4
push 1
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x41a302
push 4
push str.iSafeService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x419f8f
push eax
mov bl, 1
call edi
push esi
call edi
test bl, bl
je 0x41a302
call fcn.00412430
add eax, 0x78
cmp dword [eax + 0x14], 8
jb 0x419faa
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8f4]
push eax
call fcn.004198a0
mov eax, dword [0x4831cc]
test al, 1
jne 0x419fdf
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
mov ecx, 0x483160
call fcn.0041b020
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push str.iSafeKrnlCall.dll
push eax
lea eax, [ebp - 0x628]
push str._s_s
push eax
call fcn.00405ac0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
call edi
test eax, eax
je 0x41a06a
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41a06a
push str.Uninstall
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x460874
lea ecx, [ebp - 0x90c]
call fcn.00406d00
lea edx, [ebp - 0x90c]
lea ecx, [ebp - 0x848]
mov dword [ebp - 4], 0
call fcn.004102c0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x8f8], 8
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x41a0b0
push dword [ebp - 0x90c]
call esi
add esp, 4
push 4
xor eax, eax
push str..lnk
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x8f8], 7
mov dword [ebp - 0x8fc], 0
mov word [ebp - 0x90c], ax
call fcn.00405270
lea ecx, [ebp - 0x848]
call fcn.00407fe0
call fcn.004103a0
call fcn.00410770
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x834], 8
jb 0x41a10f
push dword [ebp - 0x848]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], 0
mov word [ebp - 0x848], ax
call fcn.00408230
mov eax, dword [0x4831cc]
test al, 1
jne 0x41a15a
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
mov ecx, 0x483160
call fcn.0041b860
mov eax, dword [0x4831cc]
test al, 1
jne 0x41a18d
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
mov ecx, 0x483160
call fcn.0041bbf0
mov eax, dword [0x4831cc]
test al, 1
jne 0x41a1c0
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
mov ecx, 0x483160
call fcn.0041b070
mov eax, dword [0x4831cc]
test al, 1
jne 0x41a1f3
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
mov ecx, 0x483160
call fcn.0041b380
mov eax, dword [0x4831cc]
test al, 1
jne 0x41a226
or eax, 1
push ecx
mov dword [0x4831cc], eax
call fcn.0041a320
call fcn.0041a530
push 0x45afc0
call fcn.004521b7
add esp, 4
mov ecx, 0x483160
call fcn.0041b660
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x41a25b
call fcn.00412430
cmp byte [eax + 0xe0], 0
jne 0x41a25b
call fcn.004050a0
lea ecx, [ebp - 0x218]
call fcn.004441f0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x4826e0]
add esp, 0xc
test al, 1
jne 0x41a297
or eax, 1
push 0x45ae80
mov dword [0x4826e0], eax
call fcn.004521b7
add esp, 4
push ecx
lea eax, [ebp - 0x420]
push eax
call fcn.00444420
lea eax, [ebp - 0x420]
push eax
call edi
test eax, eax
je 0x41a2da
mov eax, dword [0x4826e0]
test al, 1
jne 0x41a2cf
or eax, 1
push 0x45ae80
mov dword [0x4826e0], eax
call fcn.004521b7
add esp, 4
lea ecx, [ebp - 0x420]
call fcn.004441f0
lea ecx, [ebp - 0x8f0]
call fcn.004124b0
lea ecx, [ebp - 0x8f0]
mov dword [ebp - 4], 3
call fcn.004098c0
lea ecx, [ebp - 0x8f0]
call fcn.00413ae0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret