Function at 0x1000d2f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060903
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x10071290]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
inc dword [0x100738d8]
mov ecx, 7
xor eax, eax
xor edx, edx
mov dword [ebp - method.HString.virtual_0], vtable.HString.0
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x24c], dx
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], dx
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x260], eax
mov word [ebp - 0x270], dx
mov dword [ebp - 0x258], 0x2001f
mov byte [ebp - 4], 2
push 0x5e
mov dword [ebp - 0x27c], ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall32B5ECE7_CF30_4d36_883E_640D6FBD0DE2_is1
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x280], eax
mov word [ebp - 0x290], ax
call fcn.10001790
mov ebx, 0x20019
lea edi, [ebp - 0x294]
lea esi, [ebp - 0x278]
mov byte [ebp - 4], 3
call fcn.10003990
mov byte [ebp - 4], 2
cmp dword [ebp - 0x27c], 8
jb 0x1000d3e2
mov ecx, dword [ebp - 0x290]
push ecx
call fcn.10043fe0
add esp, 4
push 0xf
xor edx, edx
push str.InstallLocation
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], 0
mov word [ebp - 0x290], dx
call fcn.10001790
lea eax, [ebp - 0x234]
push eax
lea esi, [ebp - 0x294]
lea ebx, [ebp - 0x278]
mov byte [ebp - 4], 4
call fcn.10004070
test al, al
sete bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x27c], 8
jb 0x1000d44e
mov ecx, dword [ebp - 0x290]
push ecx
call fcn.10043fe0
add esp, 4
xor edi, edi
xor edx, edx
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], edi
mov word [ebp - 0x290], dx
test bl, bl
je 0x1000d4e2
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x218], ax
call fcn.10049a70
mov eax, dword [0x100738dc]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000d4c0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.10001790
push str.IsWow64Process
push 0x1006d76c
mov dword [ebp - 0x29c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x1000d515
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x29c], edi
mov edx, str.FileZhuoYiTask64.dll
setne al
test al, al
jne 0x1000d52c
mov edx, str.FileZhuoYiTask.dll
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000d531
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [ebp - 0x234]
call fcn.10005f80
mov eax, dword [ebp - 0x230]
mov ebx, 8
cmp dword [ebp - 0x21c], ebx
jae 0x1000d566
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000d5da
lea esi, [ebp - 0x278]
call fcn.10003a40
cmp dword [ebp - 0x21c], ebx
jb 0x1000d593
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.10043fe0
add esp, 4
dec dword [0x100738d8]
xor edx, edx
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
mov dword [ebp - method.HString.virtual_0], vtable.HString.0
cmp dword [ebp - 0x238], ebx
jb 0x1000d5d3
mov eax, dword [ebp - 0x24c]
push eax
call fcn.10043fe0
add esp, 4
xor al, al
jmp 0x1000d808
lea ecx, [ebp - 0x308]
push ecx
mov ecx, 0x1006deec
call fcn.10005eb0
lea edx, [ebp - 0x2c8]
push edx
mov ecx, 0x1006dee4
mov byte [ebp - 4], 5
call fcn.10005eb0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2e8]
push ecx
mov byte [ebp - 4], 6
call fcn.10005e40
lea edx, [ebp - 0x298]
push edx
mov ecx, str.rundll32__
mov byte [ebp - 4], 7
call fcn.10005eb0
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 8
call fcn.10006120
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x2e4]
push ecx
lea ecx, [ebp - 0x250]
call fcn.10006120
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x2c4]
push edx
lea ecx, [ebp - 0x250]
call fcn.10006120
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x250]
call fcn.10006120
dec dword [0x100738d8]
mov ebx, 8
mov edi, vtable.HString.0
mov dword [ebp - 0x298], edi
cmp dword [ebp - 0x27c], ebx
jb 0x1000d6b1
mov ecx, dword [ebp - 0x290]
push ecx
call fcn.10043fe0
add esp, 4
dec dword [0x100738d8]
xor esi, esi
xor edx, edx
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], esi
mov word [ebp - 0x290], dx
mov dword [ebp - 0x2e8], edi
cmp dword [ebp - 0x2cc], ebx
jb 0x1000d6ef
mov eax, dword [ebp - 0x2e0]
push eax
call fcn.10043fe0
add esp, 4
dec dword [0x100738d8]
xor ecx, ecx
mov dword [ebp - 0x2cc], 7
mov dword [ebp - 0x2d0], esi
mov word [ebp - 0x2e0], cx
mov dword [ebp - 0x2c8], edi
cmp dword [ebp - 0x2ac], ebx
jb 0x1000d72b
mov edx, dword [ebp - 0x2c0]
push edx
call fcn.10043fe0
add esp, 4
mov byte [ebp - 4], 2
dec dword [0x100738d8]
xor eax, eax
mov dword [ebp - 0x2ac], 7
mov dword [ebp - 0x2b0], esi
mov word [ebp - 0x2c0], ax
mov dword [ebp - 0x308], edi
cmp dword [ebp - 0x2ec], ebx
jb 0x1000d76b
mov ecx, dword [ebp - 0x300]
push ecx
call fcn.10043fe0
add esp, 4
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x238], ebx
jae 0x1000d77f
lea eax, [ebp - 0x24c]
lea ebx, [ebp - 0x2a8]
mov dword [ebp - 0x2a0], esi
mov byte [ebp - 0x2a8], 1
mov dword [ebp - 0x2a4], esi
call fcn.100036e0
lea esi, [ebp - 0x278]
mov bl, al
call fcn.10003a40
mov esi, 8
cmp dword [ebp - 0x21c], esi
jb 0x1000d7c6
mov edx, dword [ebp - 0x230]
push edx
call fcn.10043fe0
add esp, 4
dec dword [0x100738d8]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 0x254], edi
cmp dword [ebp - 0x238], esi
jb 0x1000d806
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.10043fe0
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10043fd1
mov esp, ebp
pop ebp
ret