Function at 0x41f860
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a8df
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x54112c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x80], 0
je 0x41f9c2
lea eax, [ebp - 0x10]
push eax
call fcn.0041c6c0
add esp, 4
mov eax, dword [ebp - 0x10]
lea edi, [esi + 4]
mov ecx, dword [edi]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
jne 0x41f8f6
push 0
push str.Error
push 0x512ad8
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41fb17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41fb17
push 4
push str.Please_Confirm
push str.Reason_Antivirus_is_going_to_be_uninstalled_from_your_computer._nAre_you_sure_you_want_to_proceed_
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x41f8cb
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 5
mov ecx, esi
call fcn.00420bb0
push edi
push 0x421bb0
lea ecx, [ebp - 0x24]
call fcn.004120e0
cmp dword [esi + 0x1a8], 0
jne 0x41fb2d
mov ecx, dword [eax]
mov dword [esi + 0x1a4], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0x1a8], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
cmp dword [ebp - 0x20], 0
jne 0x41fb2d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xf
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.uninstall_start
mov byte [ecx], 0
call fcn.0040e880
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push 9
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.uninstall
mov byte [ecx], 0
call fcn.0040e880
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 0
call fcn.0040ac70
jmp 0x41f8cb
push 0x24
call fcn.0048bf4f
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x41fa6e
movzx ecx, byte [esi + 0x81]
push ecx
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_f90389a8b06a89bb67c846633ec13d9e___void___.0
mov dword [eax + 4], esi
mov dword [eax + 0x24], eax
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_7031076ef8b9984a707197e069965d24___void__enum_APIClient::state__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov dword [eax + 4], esi
mov dword [eax + 0x24], eax
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x2f
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.__metaData_:___freshInstallation_:__true___
mov byte [ecx], 0
call fcn.0040e880
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
push 0x2b
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.https:__update.reasonsecurity.com_v1_update
mov byte [ecx], 0
call fcn.0040e880
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00401850
mov edi, eax
jmp 0x41fa70
xor edi, edi
lea eax, [esi + 0x184]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
cmp eax, ecx
je 0x41fa98
mov ebx, dword [eax]
mov dword [eax], edi
test ebx, ebx
je 0x41faae
mov ecx, ebx
call fcn.00401ce0
push 0x24
push ebx
jmp 0x41faa6
test edi, edi
je 0x41faae
mov ecx, edi
call fcn.00401ce0
push 0x24
push edi
call fcn.0048bf7f
add esp, 8
push 1
mov ecx, esi
call fcn.00420bb0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x16
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.update_api_query_start
mov byte [ecx], 0
call fcn.0040e880
sub esp, 0x18
mov dword [ebp - 4], 6
mov ecx, esp
push 7
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.install
mov byte [ecx], 0
call fcn.0040e880
lea ecx, [esi + 0x84]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ac70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.004bceee
int3