Function at 0x406b60
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e0d08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x82c
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, ecx
call edi
mov dword [esp + 0x10], eax
mov dword [esi + 0x60], eax
lea eax, [esp + 0x34]
push eax
push str.SavedInstSettings
push 0x4e94ac
push closesocket
mov dword [esp + 0x44], 0x111111
call fcn.0040d500
add esp, 0x10
xor ebp, ebp
mov ebx, 1
test eax, eax
je 0x406bdc
test byte [esp + 0x34], bl
jne 0x406bce
mov dword [esi + 0x60], ebp
cmp dword [esi + 0x60], ebp
je 0x406bdc
cmp dword [esp + 0x10], ebp
jne 0x406bdc
mov dword [esi + 0x60], ebp
mov ecx, dword [esi + 0x60]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x40]
push eax
call fcn.0040e350
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esi + 4]
mov dword [esi + 0x60], eax
call fcn.00402d30
lea ecx, [esp + 0x14]
call fcn.004173e0
mov dword [esp + 0x844], ebp
lea ecx, [esp + 0x1c]
call fcn.004173e0
mov byte [esp + 0x844], bl
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x406cea
lea edx, [esp + 0x24]
push ebx
push edx
call fcn.0040e590
add esp, 8
mov byte [esp + 0x844], 2
push eax
lea ecx, [esp + 0x18]
call fcn.004027a0
mov byte [esp + 0x844], bl
lea ecx, [esp + 0x24]
call fcn.00417490
lea ecx, [esp + 0x14]
call fcn.004173d0
test eax, eax
je 0x406cea
push 0x4e90cc
lea ecx, [esp + 0x30]
call fcn.00418470
mov byte [esp + 0x844], 3
push 0x4e90b4
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x844], 4
push eax
lea ecx, [esp + 0x18]
call fcn.00418270
mov byte [esp + 0x844], 3
lea ecx, [esp + 0x24]
call fcn.00417490
mov byte [esp + 0x844], bl
lea ecx, [esp + 0x2c]
call fcn.00417490
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040ca20
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov dword [esi + 0x4c], eax
call edi
cmp eax, 0xffffffff
jne 0x406cea
mov dword [esi + 0x4c], ebp
lea eax, [esp + 0x2c]
push ebp
push eax
call fcn.0040e590
add esp, 8
mov byte [esp + 0x844], 5
push eax
lea ecx, [esp + 0x20]
call fcn.004027a0
mov byte [esp + 0x844], bl
lea ecx, [esp + 0x2c]
call fcn.00417490
lea ecx, [esp + 0x1c]
call fcn.004173d0
test eax, eax
je 0x406da2
push 0x4e90cc
lea ecx, [esp + 0x28]
call fcn.00418470
mov byte [esp + 0x844], 6
push 0x4e90b4
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x844], 7
push eax
lea ecx, [esp + 0x20]
call fcn.00418270
mov byte [esp + 0x844], 6
lea ecx, [esp + 0x2c]
call fcn.00417490
mov byte [esp + 0x844], bl
lea ecx, [esp + 0x24]
call fcn.00417490
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ca20
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x20]
add esp, 4
push eax
call edi
cmp eax, 0xffffffff
jne 0x406da2
mov dword [esi + 0x50], ebp
mov ecx, esi
call fcn.00406a30
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x24]
sub eax, 0x10
mov ecx, ebx
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x400
or eax, ecx
jge 0x406dcf
push 0x400
mov ecx, edi
call fcn.004019a0
mov eax, dword [edi]
push ebx
push 0x26
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [edi]
mov ecx, dword [eax - 8]
cmp eax, ebp
jne 0x406de9
xor eax, eax
jmp 0x406df7
push ecx
push eax
call fcn.0047a8aa
add esp, 8
cmp eax, ebp
jl 0x406e5e
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x406e5e
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + eax*2], dx
push str.Mail.RuGuard
mov ecx, edi
call fcn.00418290
cmp dword [esi + 0x60], ebp
je 0x406e20
cmp dword [esp + 0x10], ebp
jne 0x406e23
mov dword [esi + 0x6c], ebp
mov byte [esp + 0x844], 0
lea ecx, [esp + 0x1c]
call fcn.00417490
mov dword [esp + 0x844], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00417490
mov ecx, dword [esp + 0x83c]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004010d0
int3