Function at 0x4a2fd0
Capabilities:
Create thread
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6be3f6
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004a3aa0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x320], 0xf
mov byte [ebp - 0x334], 0
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00651620
lea eax, [ebp - 0x334]
push eax
call fcn.004c8820
push 0x71880c
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004cfa40
push str.AdobeGCData
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004cfa40
lea ecx, [ebp - 0x114]
add esp, 0x28
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a3088
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x334]
call fcn.0049f250
cmp dword [ebp - 0x320], 0x10
lea edi, [ebp - 0x334]
cmovae edi, dword [ebp - 0x334]
xor esi, esi
push edi
call fcn.004cf390
add esp, 4
test eax, eax
je 0x4a3139
push edi
call fcn.004cfe10
add esp, 4
test eax, eax
jne 0x4a3101
push str.A_file_already_exists_with_the_name_AdobeGCData__removing_the_file
push eax
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
push edi
call fcn.00665876
add esp, 0x18
test eax, eax
jne 0x4a3132
push edi
call fcn.004c11d0
jmp 0x4a312b
push str.AdobeGCData_folder_already_exists
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
add esp, 0x14
mov ecx, ebx
push edi
call fcn.004a1ef0
push edi
call fcn.004c4710
add esp, 4
test al, al
jne 0x4a3165
mov esi, 0x501
jmp 0x4a3165
push str.AdobeGCData_folder_does_not_exist__creating_folder
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
push edi
call fcn.004c11d0
add esp, 0x18
mov ecx, 0x501
test al, al
cmove esi, ecx
push 3
lea eax, [ebp - 0x434]
push edi
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x438], eax
call fcn.004a2500
push dword [ebp - 0x438]
lea eax, [ebp - 0x31c]
push 0x104
push eax
call fcn.00665315
mov eax, dword [ebp - 0x438]
lea ecx, [ebp - 0x434]
add esp, 0xc
cmp eax, ecx
je 0x4a31b2
push eax
call fcn.00665390
add esp, 4
push 2
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
jne 0x4a31e2
push str.Successfully_created_fetched_AdobeGCData_Folder
push esi
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
add esp, 0x14
jmp 0x4a31ff
push esi
push str.Failed_to_create_fetch_AdobeGCData_Folder_and_status___d
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
add esp, 0x18
push str.AdobeGenuineData
push str.UninstallAGM
call fcn.004bb3c0
add esp, 8
test al, al
je 0x4a325a
push str.Uninstall_AGM_flag_found
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
push ecx
mov ecx, esp
xor eax, eax
push 0xa
push 0x719b10
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0049f4a0
call fcn.004c3f00
add esp, 0x18
jmp 0x4a325f
call fcn.004a1ca0
push str.Thread...
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
add esp, 0x14
lea eax, [ebp - 0x43c]
push 0
push 0
push eax
push 0x4a3390
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4a32bd
push str.Thread_Finished_...
push eax
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
add esp, 0x14
cmp dword [ebp - 0x43c], 2
jne 0x4a32e2
push str.Thread_Need_to_Launch_agshelper...
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x43c]
cmp eax, 2
jne 0x4a3301
mov ecx, ebx
call fcn.004a2d10
jmp 0x4a332a
test eax, eax
jne 0x4a332a
lea ecx, [ebp - 0x450]
call fcn.004af530
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 1
call fcn.004b2d30
lea ecx, [ebp - 0x450]
call fcn.004b00d0
mov edx, dword [ebp - 0x320]
cmp edx, 0x10
jb 0x4a3360
mov ecx, dword [ebp - 0x334]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a3356
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a337c
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
call fcn.0065a824
int3