Function at 0x418850
Capabilities:
Check if file exists
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627884
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x6b278c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x43c], ecx
push 2
lea eax, [ebp - 0x48]
push eax
call fcn.00412530
mov ecx, eax
call fcn.0040c9e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.0040e9f0
mov byte [ebp - 4], 1
mov dword [ebp - 0x364], 3
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x60]
call fcn.0052b740
mov dword [ebp - 0x368], 0xd
lea edx, [ebp - 0x368]
push edx
lea ecx, [ebp - 0x60]
call fcn.0052b740
mov dword [ebp - 0x36c], 7
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x60]
call fcn.0052b740
mov dword [ebp - 0x370], 6
lea ecx, [ebp - 0x370]
push ecx
lea ecx, [ebp - 0x60]
call fcn.0052b740
push str.RunAuto
lea ecx, [ebp - 0x2c]
call fcn.0040e4b0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x68]
push edx
lea ecx, [ebp - 0x60]
call fcn.00414550
jmp 0x41893b
push 0
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0x68]
call fcn.004413d0
lea ecx, [ebp - 0x380]
push ecx
lea ecx, [ebp - 0x60]
call fcn.0040e8c0
push eax
lea ecx, [ebp - 0x68]
call fcn.00449590
movzx edx, al
test edx, edx
je 0x419283
lea ecx, [ebp - 0x68]
call fcn.00533840
mov esi, eax
call fcn.00412530
mov ecx, eax
call fcn.0040c9c0
cmp dword [esi], eax
jne 0x41897a
jmp 0x41892a
push 0x6402e4
lea ecx, [ebp - 0x2a8]
call fcn.0040e4b0
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 1
push 0x6402e8
lea ecx, [ebp - 0x304]
call fcn.0040e4b0
mov byte [ebp - 4], 4
push 0x6402ec
lea ecx, [ebp - 0x2e8]
call fcn.0040e4b0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.00533840
mov eax, dword [eax]
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x440]
sub ecx, 3
mov dword [ebp - 0x440], ecx
cmp dword [ebp - 0x440], 0xa
ja case.0x4189f9.1
mov edx, dword [ebp - 0x440]
movzx eax, byte [edx + 0x4192e8]
jmp dword [eax*4 + 0x4192d4]
push 0x640300
lea ecx, [ebp - 0x2a8]
call fcn.0040e570
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x384], esp
push 0x640310
call fcn.0040e4b0
mov dword [ebp - 0x444], eax
lea ecx, [ebp - 0x3a0]
push ecx
call fcn.0042e260
add esp, 0x20
mov dword [ebp - 0x448], eax
mov edx, dword [ebp - 0x448]
mov dword [ebp - 0x44c], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x304]
call fcn.0040e550
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3a0]
call fcn.0040e530
push str.SCUpd.exe
lea ecx, [ebp - 0x304]
call fcn.0040e5b0
push str.SmartCloud
lea ecx, [ebp - 0x2e8]
call fcn.0040e5b0
push 0x64034c
lea ecx, [ebp - 0x2c]
call fcn.0040e570
jmp case.0x4189f9.1
push 0x640360
lea ecx, [ebp - 0x2a8]
call fcn.0040e570
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3a4], esp
push 0x640374
call fcn.0040e4b0
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x3c0]
push ecx
call fcn.0042e260
add esp, 0x20
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x458], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x458]
push eax
lea ecx, [ebp - 0x304]
call fcn.0040e550
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c0]
call fcn.0040e530
push str.SCWBUpd.exe
lea ecx, [ebp - 0x304]
call fcn.0040e5b0
push str.SmartCloudWB
lea ecx, [ebp - 0x2e8]
call fcn.0040e5b0
push str.RunCloud
lea ecx, [ebp - 0x2c]
call fcn.0040e570
jmp case.0x4189f9.1
push 0x6403d0
lea ecx, [ebp - 0x2a8]
call fcn.0040e570
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x6403dc
call fcn.0040e4b0
mov dword [ebp - 0x45c], eax
lea ecx, [ebp - 0x3e0]
push ecx
call fcn.0042e260
add esp, 0x20
mov dword [ebp - 0x460], eax
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x464], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x464]
push eax
lea ecx, [ebp - 0x304]
call fcn.0040e550
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3e0]
call fcn.0040e530
push str.PDZipUtility.exe
lea ecx, [ebp - 0x304]
call fcn.0040e5b0
push str.PuddingZip
lea ecx, [ebp - 0x2e8]
call fcn.0040e5b0
push 0x640424
lea ecx, [ebp - 0x304]
call fcn.0040e5d0
push eax
lea ecx, [ebp - 0x320]
push ecx
call fcn.0043e890
add esp, 0xc
mov byte [ebp - 4], 9
push str.1_3_0
lea ecx, [ebp - 0x320]
call fcn.0040e5d0
push eax
call fcn.005b501e
add esp, 8
test eax, eax
jl 0x418c25
push str.SoftExtraOperate___RunType_100
lea ecx, [ebp - 0x2c]
call fcn.0040e570
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x320]
call fcn.0040e530
jmp case.0x4189f9.1
push 0x640490
lea ecx, [ebp - 0x2a8]
call fcn.0040e570
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3e4], esp
push 0x64049c
call fcn.0040e4b0
mov dword [ebp - 0x468], eax
lea edx, [ebp - 0x400]
push edx
call fcn.0042e260
add esp, 0x20
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x470], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x304]
call fcn.0040e550
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x400]
call fcn.0040e530
push str.PDUpd.exe
lea ecx, [ebp - 0x304]
call fcn.0040e5b0
push str.PuddingDesktop
lea ecx, [ebp - 0x2e8]
call fcn.0040e5b0
push 0x6404dc
lea ecx, [ebp - 0x304]
call fcn.0040e5d0
push eax
lea edx, [ebp - 0x33c]
push edx
call fcn.0043e890
add esp, 0xc
mov byte [ebp - 4], 0xb
push str.1_4_3
lea ecx, [ebp - 0x33c]
call fcn.0040e5d0
push eax
call fcn.005b501e
add esp, 8
test eax, eax
jl 0x418d18
push str.Pull_http:__update.znyshurufa.com_zhuomian_pudding_updatevpl.dat
lea ecx, [ebp - 0x2c]
call fcn.0040e570
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x33c]
call fcn.0040e530
lea ecx, [ebp - 0x304]
call fcn.0040e5d0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x418d8e
lea ecx, [ebp - 0x304]
call fcn.0040e5d0
push eax
push 0x64058c
call fcn.00412530
push eax
call fcn.0040d040
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2e8]
call fcn.0040e530
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x304]
call fcn.0040e530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2a8]
call fcn.0040e530
jmp 0x41892a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0x6405a4
call fcn.0040e4b0
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x478], eax
mov byte [ebp - 4], 0xc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x408], esp
push str.ServiceName
call fcn.0040e4b0
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0x480], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2e8]
call fcn.0040e5d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x40c], esp
push eax
call fcn.0040e4b0
mov dword [ebp - 0x484], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0x2c8]
push edx
mov byte [ebp - 4], 5
call fcn.00430390
add esp, 0x5c
mov dword [ebp - 0x488], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c8]
call fcn.0040ee50
test eax, eax
jbe 0x418eed
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
je 0x418ed0
push 0x34
lea ecx, [ebp - 0x2c8]
call fcn.0040e5d0
push eax
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
je 0x418ec1
lea ecx, [ebp - 0x360]
push ecx
mov edx, dword [ebp - 0x344]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x418ec1
cmp dword [ebp - 0x35c], 4
jne 0x418ec1
mov dword [ebp - 0x2ac], 0
push 0x6405c0
call fcn.00412530
push eax
call fcn.0040d040
add esp, 8
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x418eed
mov dword [ebp - 0x2ac], 0
push 0x6405d4
call fcn.00412530
push eax
call fcn.0040d040
add esp, 8
cmp dword [ebp - 0x2ac], 0
jne 0x418f62
lea ecx, [ebp - 0x2c8]
call fcn.0040e5d0
push eax
lea ecx, [ebp - 0x304]
call fcn.0040e5d0
push eax
push 0x6405ec
call fcn.00412530
push eax
call fcn.0040d040
add esp, 0x10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.0040e530
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2e8]
call fcn.0040e530
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x304]
call fcn.0040e530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2a8]
call fcn.0040e530
jmp 0x41892a
xor ecx, ecx
mov word [ebp - 0x28c], cx
push 0x206
push 0
lea edx, [ebp - 0x28a]
push edx
call fcn.005b4de0
add esp, 0xc
lea ecx, [ebp - 0x2c8]
call fcn.0040e5d0
push eax
push str.SYSTEMCurrentControlSetServices_s
lea eax, [ebp - 0x28c]
push eax
call fcn.005b50ec
add esp, 0xc
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x410], esp
push str.Start
call fcn.0040e4b0
mov dword [ebp - 0x48c], eax
mov ecx, dword [ebp - 0x48c]
mov dword [ebp - 0x490], ecx
mov byte [ebp - 4], 0xf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x414], esp
lea edx, [ebp - 0x28c]
push edx
call fcn.0040e4b0
mov dword [ebp - 0x494], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0xe
call fcn.004305a0
add esp, 0x40
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jne 0x419072
mov ecx, dword [ebp - 0x2cc]
push ecx
push 0x640660
call fcn.00412530
push eax
call fcn.0040d040
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.0040e530
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2e8]
call fcn.0040e530
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x304]
call fcn.0040e530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2a8]
call fcn.0040e530
jmp 0x41892a
mov edx, dword [ebp - 0x2cc]
push edx
lea ecx, [ebp - 0x2c8]
call fcn.0040e5d0
push eax
lea ecx, [ebp - 0x304]
call fcn.0040e5d0
push eax
push 0x640684
call fcn.00412530
push eax
call fcn.0040d040
add esp, 0x14
push 0x6406a8
lea ecx, [ebp - 0x84]
call fcn.0040e4b0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040e590
push 0x6406ac
lea ecx, [ebp - 0x84]
call fcn.0040e5b0
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x84]
call fcn.0040e590
lea ecx, [ebp - 0x84]
call fcn.0040e5d0
push eax
call fcn.00436fd0
add esp, 4
test eax, eax
je 0x419214
push 0x6406b4
mov ecx, dword [ebp - 0x43c]
add ecx, 0xd4
call fcn.0040e440
lea edx, [ebp - 0x2a8]
push edx
lea eax, [ebp - 0x430]
push eax
call fcn.0043a030
add esp, 8
mov dword [ebp - 0x49c], eax
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x4a0]
push edx
mov ecx, dword [ebp - 0x43c]
add ecx, 0xd4
call fcn.0040e420
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x430]
call fcn.0040e3e0
lea ecx, [ebp - 0x84]
call fcn.0040e5d0
push eax
push 0x6406b8
call fcn.00412530
push eax
call fcn.0040d040
add esp, 0xc
mov dword [ebp - 0x434], 1
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x84]
call fcn.0040e530
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.0040e530
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2e8]
call fcn.0040e530
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x304]
call fcn.0040e530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2a8]
call fcn.0040e530
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0040e530
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.0052b6e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0040e530
mov eax, dword [ebp - 0x434]
jmp 0x4192ba
lea ecx, [ebp - 0x84]
call fcn.0040e5d0
push eax
push 0x6406cc
call fcn.00412530
push eax
call fcn.0040d040
add esp, 0xc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x84]
call fcn.0040e530
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c8]
call fcn.0040e530
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2e8]
call fcn.0040e530
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x304]
call fcn.0040e530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2a8]
call fcn.0040e530
jmp 0x41892a
mov dword [ebp - 0x438], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0040e530
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.0052b6e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0040e530
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b4b30
mov esp, ebp
pop ebp
ret