Function at 0x1000d760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061973
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x10073290]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
inc dword [0x100758d8]
mov ecx, 7
xor eax, eax
xor edx, edx
mov dword [ebp - method.HString.virtual_0], vtable.HString.0
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x24c], dx
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], dx
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x260], eax
mov word [ebp - 0x270], dx
mov dword [ebp - 0x258], 0x2001f
mov byte [ebp - 4], 2
push 0x5e
mov dword [ebp - 0x27c], ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall4DADA025_5F63_40f4_B80C_91B7FCAFC30C_is1
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x280], eax
mov word [ebp - 0x290], ax
call fcn.100017a0
mov ebx, 0x20019
lea edi, [ebp - 0x294]
lea esi, [ebp - 0x278]
mov byte [ebp - 4], 3
call fcn.100039a0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x27c], 8
jb 0x1000d852
mov ecx, dword [ebp - 0x290]
push ecx
call fcn.10044440
add esp, 4
push 0xf
xor edx, edx
push str.InstallLocation
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], 0
mov word [ebp - 0x290], dx
call fcn.100017a0
lea eax, [ebp - 0x234]
push eax
lea esi, [ebp - 0x294]
lea ebx, [ebp - 0x278]
mov byte [ebp - 4], 4
call fcn.10004080
test al, al
sete bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x27c], 8
jb 0x1000d8be
mov ecx, dword [ebp - 0x290]
push ecx
call fcn.10044440
add esp, 4
xor edi, edi
xor edx, edx
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], edi
mov word [ebp - 0x290], dx
test bl, bl
je 0x1000d952
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x218], ax
call fcn.10049f90
mov eax, dword [0x100758e0]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000d930
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.100017a0
push str.IsWow64Process
push 0x1006f76c
mov dword [ebp - 0x29c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x1000d985
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x29c], edi
mov edx, str.JXFileEncryTask64.dll
setne al
test al, al
jne 0x1000d99c
mov edx, str.JXFileEncryTask.dll
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000d9a1
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [ebp - 0x234]
call fcn.10006180
mov eax, dword [ebp - 0x230]
mov ebx, 8
cmp dword [ebp - 0x21c], ebx
jae 0x1000d9d6
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000da4a
lea esi, [ebp - 0x278]
call fcn.10003a50
cmp dword [ebp - 0x21c], ebx
jb 0x1000da03
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.10044440
add esp, 4
dec dword [0x100758d8]
xor edx, edx
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
mov dword [ebp - method.HString.virtual_0], vtable.HString.0
cmp dword [ebp - 0x238], ebx
jb 0x1000da43
mov eax, dword [ebp - 0x24c]
push eax
call fcn.10044440
add esp, 4
xor al, al
jmp 0x1000dc78
lea ecx, [ebp - 0x308]
push ecx
mov ecx, 0x1006ff04
call fcn.10005ec0
lea edx, [ebp - 0x2c8]
push edx
mov ecx, 0x1006fefc
mov byte [ebp - 4], 5
call fcn.10005ec0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2e8]
push ecx
mov byte [ebp - 4], 6
call fcn.10005e50
lea edx, [ebp - 0x298]
push edx
mov ecx, str.rundll32__
mov byte [ebp - 4], 7
call fcn.10005ec0
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 8
call fcn.10006430
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x2e4]
push ecx
lea ecx, [ebp - 0x250]
call fcn.10006430
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x2c4]
push edx
lea ecx, [ebp - 0x250]
call fcn.10006430
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x250]
call fcn.10006430
dec dword [0x100758d8]
mov ebx, 8
mov edi, vtable.HString.0
mov dword [ebp - 0x298], edi
cmp dword [ebp - 0x27c], ebx
jb 0x1000db21
mov ecx, dword [ebp - 0x290]
push ecx
call fcn.10044440
add esp, 4
dec dword [0x100758d8]
xor esi, esi
xor edx, edx
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], esi
mov word [ebp - 0x290], dx
mov dword [ebp - 0x2e8], edi
cmp dword [ebp - 0x2cc], ebx
jb 0x1000db5f
mov eax, dword [ebp - 0x2e0]
push eax
call fcn.10044440
add esp, 4
dec dword [0x100758d8]
xor ecx, ecx
mov dword [ebp - 0x2cc], 7
mov dword [ebp - 0x2d0], esi
mov word [ebp - 0x2e0], cx
mov dword [ebp - 0x2c8], edi
cmp dword [ebp - 0x2ac], ebx
jb 0x1000db9b
mov edx, dword [ebp - 0x2c0]
push edx
call fcn.10044440
add esp, 4
mov byte [ebp - 4], 2
dec dword [0x100758d8]
xor eax, eax
mov dword [ebp - 0x2ac], 7
mov dword [ebp - 0x2b0], esi
mov word [ebp - 0x2c0], ax
mov dword [ebp - 0x308], edi
cmp dword [ebp - 0x2ec], ebx
jb 0x1000dbdb
mov ecx, dword [ebp - 0x300]
push ecx
call fcn.10044440
add esp, 4
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x238], ebx
jae 0x1000dbef
lea eax, [ebp - 0x24c]
lea ebx, [ebp - 0x2a8]
mov dword [ebp - 0x2a0], esi
mov byte [ebp - 0x2a8], 1
mov dword [ebp - 0x2a4], esi
call fcn.100036f0
lea esi, [ebp - 0x278]
mov bl, al
call fcn.10003a50
mov esi, 8
cmp dword [ebp - 0x21c], esi
jb 0x1000dc36
mov edx, dword [ebp - 0x230]
push edx
call fcn.10044440
add esp, 4
dec dword [0x100758d8]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 0x254], edi
cmp dword [ebp - 0x238], esi
jb 0x1000dc76
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.10044440
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10044431
mov esp, ebp
pop ebp
ret