Function at 0x4a1860
Capabilities:
Create thread
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bbaa6
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x7ef784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004a2340
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x320], 0xf
mov byte [ebp - 0x334], 0
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0064ed10
lea eax, [ebp - 0x334]
push eax
call fcn.004c6fb0
push 0x715714
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004ce1d0
push str.AdobeGCData
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004ce1d0
lea ecx, [ebp - 0x114]
add esp, 0x28
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a1918
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x334]
call fcn.0049dbb0
cmp dword [ebp - 0x320], 0x10
lea edi, [ebp - 0x334]
cmovae edi, dword [ebp - 0x334]
xor esi, esi
push edi
call fcn.004cdb20
add esp, 4
test eax, eax
je 0x4a19c9
push edi
call fcn.004ce5a0
add esp, 4
test eax, eax
jne 0x4a1991
push str.A_file_already_exists_with_the_name_AdobeGCData__removing_the_file
push eax
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
push edi
call fcn.00662f66
add esp, 0x18
test eax, eax
jne 0x4a19c2
push edi
call fcn.004bfa70
jmp 0x4a19bb
push str.AdobeGCData_folder_already_exists
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
add esp, 0x14
mov ecx, ebx
push edi
call fcn.004a0860
push edi
call fcn.004c2fb0
add esp, 4
test al, al
jne 0x4a19f5
mov esi, 0x501
jmp 0x4a19f5
push str.AdobeGCData_folder_does_not_exist__creating_folder
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
push edi
call fcn.004bfa70
add esp, 0x18
mov ecx, 0x501
test al, al
cmove esi, ecx
push 3
lea eax, [ebp - 0x434]
push edi
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x438], eax
call fcn.004a0d90
push dword [ebp - 0x438]
lea eax, [ebp - 0x31c]
push 0x104
push eax
call fcn.00662a05
mov eax, dword [ebp - 0x438]
lea ecx, [ebp - 0x434]
add esp, 0xc
cmp eax, ecx
je 0x4a1a42
push eax
call fcn.00662a80
add esp, 4
push 2
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
jne 0x4a1a72
push str.Successfully_created_fetched_AdobeGCData_Folder
push esi
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
add esp, 0x14
jmp 0x4a1a8f
push esi
push str.Failed_to_create_fetch_AdobeGCData_Folder_and_status___d
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
add esp, 0x18
push str.AdobeGenuineData
push str.UninstallAGM
call fcn.004b9c60
add esp, 8
test al, al
je 0x4a1aea
push str.Uninstall_AGM_flag_found
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
push ecx
mov ecx, esp
xor eax, eax
push 0xa
push 0x716a18
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0049de00
call fcn.004c27a0
add esp, 0x18
jmp 0x4a1aef
call fcn.004a0610
push str.Thread...
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
add esp, 0x14
lea eax, [ebp - 0x43c]
push 0
push 0
push eax
push 0x4a1c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4a1b4d
push str.Thread_Finished_...
push eax
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
add esp, 0x14
cmp dword [ebp - 0x43c], 2
jne 0x4a1b72
push str.Thread_Need_to_Launch_agshelper...
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x43c]
cmp eax, 2
jne 0x4a1b91
mov ecx, ebx
call fcn.004a15a0
jmp 0x4a1bba
test eax, eax
jne 0x4a1bba
lea ecx, [ebp - 0x450]
call 0x4addd0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 1
call fcn.004b15d0
lea ecx, [ebp - 0x450]
call 0x4ae970
mov edx, dword [ebp - 0x320]
cmp edx, 0x10
jb 0x4a1bf0
mov ecx, dword [ebp - 0x334]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a1be6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a1c0c
push edx
push ecx
call fcn.006391f8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006391b7
mov esp, ebp
pop ebp
ret
call fcn.00657f14
int3