Function at 0x4015eb
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa4
mov eax, dword [0x41a0d0]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push eax
push str.Check_signature:__s
mov dword [ebp + 0x50], eax
call fcn.00404898
pop ecx
pop ecx
push str.c:_as.ini
push 1
push str.Signature
push str.COMM
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x401634
inc eax
jmp 0x401941
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
xor ebx, ebx
push str.wintrust.dll
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x40], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x30], eax
cmp eax, ebx
je 0x401674
push str.WinVerifyTrust
push eax
call edi
push eax
push str.Get_function__WinVerifyTrust___x
mov dword [ebp + 0x34], eax
call fcn.00404898
pop ecx
pop ecx
push str.crypt32.dll
call esi
mov dword [ebp + 0x2c], eax
cmp eax, ebx
je 0x40169d
mov esi, str.CertGetNameStringW
push esi
push eax
call edi
push eax
push esi
push str.Get_function___s___x
mov dword [ebp + 0x40], eax
call fcn.004048b0
add esp, 0xc
cmp dword [ebp + 0x34], ebx
je 0x40190b
cmp dword [ebp + 0x40], ebx
je 0x40190b
or dword [ebp + 0x4c], 0xffffffff
mov eax, 0xcd44
mov word [ebp + 0x64], ax
push ebx
push dword [ebp + 0x50]
mov eax, 0x11d0
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x60], 0xaac56b
mov word [ebp + 0x66], ax
mov byte [ebp + 0x68], 0x8c
mov byte [ebp + 0x69], 0xc2
mov byte [ebp + 0x6a], bl
mov byte [ebp + 0x6b], 0xc0
mov byte [ebp + 0x6c], 0x4f
mov byte [ebp + 0x6d], 0xc2
mov byte [ebp + 0x6e], 0x95
mov byte [ebp + 0x6f], 0xee
mov dword [ebp + 0x38], ebx
xor edi, edi
call fcn.00405c03
pop ecx
pop ecx
push dword [ebp + 0x50]
test eax, eax
je 0x401715
push str.__s__verified_the_digital_signature_dont_exist
jmp 0x4018b1
call fcn.004059e1
push 0x10
pop esi
push esi
lea eax, [ebp + 0x14]
push ebx
push eax
call fcn.00405b00
mov eax, dword [ebp + 0x50]
push 0x30
mov dword [ebp + 0x14], esi
pop esi
push esi
mov dword [ebp + 0x18], eax
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00405b00
lea eax, [ebp + 0x14]
add esp, 0x1c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], esi
lea eax, [ebp + 0x60]
xor esi, esi
push eax
inc esi
push 0xffffffffffffffff
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
call dword [ebp + 0x34]
test eax, eax
je 0x401779
push dword [ebp + 0x50]
push str.__s_Verify_the_digital_signature_fail
jmp 0x4018b1
push ebx
push 0x10000080
push 3
push ebx
push esi
push 0x80000000
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0x4c], eax
cmp eax, 0xffffffff
je 0x4018c1
push ebx
push ebx
lea eax, [ebp + 0x28]
push eax
push 0xff
push dword [ebp + 0x4c]
call dword [sym.imp.imagehlp.dll_ImageEnumerateCertificates]
test eax, eax
je 0x4018c1
cmp dword [ebp + 0x28], esi
jne 0x4018c1
mov esi, 0x100
mov eax, esi
mov word [ebp + 0x58], ax
lea eax, [ebp + 0x54]
push eax
push ebx
push dword [ebp + 0x4c]
mov dword [ebp + 0x54], ebx
call dword [sym.imp.imagehlp.dll_ImageGetCertificateHeader]
test eax, eax
je 0x4018c1
mov eax, dword [ebp + 0x54]
mov dword [ebp + 0x38], eax
add eax, 0xc
push eax
call fcn.00404a61
mov edi, eax
mov eax, dword [ebp + 0x38]
pop ecx
mov dword [edi], eax
lea eax, [ebp + 0x38]
push eax
push edi
push ebx
push dword [ebp + 0x4c]
mov word [edi + 4], si
call dword [sym.imp.imagehlp.dll_ImageGetCertificateData]
test eax, eax
je 0x4018c1
push 0x14
pop esi
push esi
lea eax, [ebp]
push ebx
push eax
call fcn.00405b00
add esp, 0xc
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x24]
push eax
push ebx
mov dword [ebp], esi
mov dword [ebp + 4], 0x10001
push dword [edi]
lea eax, [edi + 8]
push eax
push ebx
lea eax, [ebp]
push eax
call dword [sym.imp.CRYPT32.dll_CryptVerifyMessageSignature]
test eax, eax
je 0x4018c1
push ebx
push ebx
push ebx
push ebx
push 4
push dword [ebp + 0x48]
call dword [ebp + 0x40]
xor ecx, ecx
push 2
pop edx
mov esi, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404a61
pop ecx
push esi
push eax
push ebx
push ebx
push 4
push dword [ebp + 0x48]
mov dword [ebp + 0x3c], eax
call dword [ebp + 0x40]
mov eax, dword [0x4143ac]
cmp eax, ebx
je 0x4018a9
mov esi, 0x4143ac
push eax
push dword [ebp + 0x3c]
call section..text
pop ecx
pop ecx
test eax, eax
jne 0x4018ba
add esi, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x401891
push dword [ebp + 0x50]
push str.__s__The_digital_signature_is_not_trustred_
call fcn.00404898
pop ecx
pop ecx
jmp 0x4018c1
mov dword [ebp + 0x44], 1
push dword [ebp + 0x44]
push dword [ebp + 0x50]
push 0x414850
call fcn.00404898
add esp, 0xc
cmp dword [ebp + 0x48], ebx
je 0x4018e2
push dword [ebp + 0x48]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
cmp dword [ebp + 0x4c], 0xffffffff
je 0x4018f1
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x3c]
call fcn.00405aec
push edi
call fcn.00405aec
pop ecx
pop ecx
mov eax, 0x41484c
cmp dword [ebp + 0x44], ebx
jne 0x401910
mov eax, 0x414844
push eax
push dword [ebp + 0x50]
push str.__s__The_digital_signature_is__salid
call fcn.00404898
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esp, 0xc
cmp dword [ebp + 0x30], ebx
je 0x401931
push dword [ebp + 0x30]
call esi
cmp dword [ebp + 0x2c], ebx
je 0x40193b
push dword [ebp + 0x2c]
call esi
mov eax, dword [ebp + 0x44]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.004058f9
add ebp, 0x74
leave
ret