Function at 0x4073f0
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Inspect load icon resource
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40bc2c
mov eax, dword fs:[0]
push eax
sub esp, 0x688
mov eax, dword [0x413028]
xor eax, esp
mov dword [esp + 0x680], eax
push ebx
push esi
push edi
mov eax, dword [0x413028]
xor eax, esp
push eax
lea eax, [esp + 0x698]
mov dword fs:[0], eax
mov ebx, ecx
call sub.mfc90u.dll_CDialog::OnInitDialog
lea edi, [ebx + 0x104]
push 0
mov ecx, edi
call sub.mfc90u.dll_CWnd::ShowWindow
mov eax, dword [ebx + 0x20]
push 0
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call sub.mfc90u.dll_CMenu::FromHandle
mov esi, eax
test esi, esi
je 0x4074c4
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
push 0x65
lea ecx, [esp + 0x18]
mov dword [esp + 0x6a4], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::LoadStringW]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x4074af
mov edx, dword [esi + 4]
push 0
push 0
push 0x800
push edx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push eax
push 0x10
push 0
push ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [esp + 0x14]
mov dword [esp + 0x6a0], 0xffffffff
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
call sub.mfc90u.dll_AfxGetModuleState
push 0x84
push 0xe
push 0x84
call sub.mfc90u.dll_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push edx
mov dword [ebx + 0x3fc], eax
call esi
mov eax, dword [ebx + 0x3fc]
mov ecx, dword [ebx + 0x20]
push eax
push 1
push 0x80
push ecx
call esi
mov edx, dword [ebx + 0x3fc]
mov eax, dword [ebx + 0x20]
push edx
push 0
push 0x80
push eax
call esi
push 2
push 0xf8
push 0x168
push 0
push 0
push 0
mov ecx, ebx
call sub.mfc90u.dll_CWnd::SetWindowPos
push 1
push 0xf8
push 0x168
push 0x89
push 0x15
lea ecx, [ebx + 0x254]
push 0
call sub.mfc90u.dll_CWnd::SetWindowPos
push 0x40
push 0xf
push 0x13c
push 0xc6
push 0x17
lea ecx, [ebx + 0xb0]
push 0
mov dword [esp + 0x38], ecx
call sub.mfc90u.dll_CWnd::SetWindowPos
push 0x40
push 0x10
push 0x13c
push 0xe4
push 0x17
lea ecx, [ebx + 0x350]
push 0
call sub.mfc90u.dll_CWnd::SetWindowPos
push 0x40
push 9
push 0x13d
push 0xd9
push 0x16
push 0
mov ecx, edi
call sub.mfc90u.dll_CWnd::SetWindowPos
push 1
push 0
push 0
push 9
push 0x145
lea ecx, [ebx + 0x158]
push 0
call sub.mfc90u.dll_CWnd::SetWindowPos
push 0x40eee0
lea edi, [ebx + 0x3a4]
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0x258
push 0
push 0
push 0
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontW]
push eax
mov ecx, edi
call sub.mfc90u.dll_CGdiObject::Attach
test edi, edi
je 0x40760a
mov edi, dword [edi + 4]
mov ecx, dword [ebx + 0xd0]
push 1
push edi
push 0x30
push ecx
call esi
push 2
push 0x82
call sub.mfc90u.dll_AfxFindResourceHandle
push 0
push 0
push 0
push 0
push 0x82
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
mov esi, ebx
call fcn.00401160
push 0x81
lea esi, [ebx + 0x254]
call fcn.00401a90
push 0x83
lea esi, [ebx + 0x158]
call fcn.00401a90
push 0
lea ecx, [ebx + 0x350]
call sub.mfc90u.dll_CWnd::ShowWindow
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x286]
push eax
mov word [esp + 0x288], dx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 1
push 0x23
lea ecx, [esp + 0x284]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x7e]
push eax
mov dword [ebx + 0x3f8], 0
mov word [esp + 0x80], dx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x27c]
push ecx
push str._sNet_ProtectorUpdexd.ini
lea edx, [esp + 0x7c]
call fcn.0040aa70
add esp, 8
lea edx, [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea ecx, [esp + 0x78]
call fcn.00409af0
lea eax, [esp + 0x27c]
push eax
push str._sACLTUpdExdACLT.ini
lea edx, [esp + 0x7c]
call fcn.0040aa70
add esp, 8
push ebx
lea ecx, [esp + 0x78]
call fcn.00409af0
lea ecx, [esp + 0x27c]
push ecx
push str._sUpdExd341DB.ini
lea edx, [esp + 0x7c]
call fcn.0040aa70
add esp, 8
push ebx
lea ecx, [esp + 0x78]
call fcn.00409af0
lea edx, [esp + 0x27c]
push edx
push str._sUpdExdASRV.ini
lea edx, [esp + 0x7c]
call fcn.0040aa70
add esp, 8
push ebx
lea ecx, [esp + 0x78]
call fcn.00409af0
push 0x40f620
push str.c:zvUpgradeNp.log
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x407799
mov edi, dword [sym.imp.MSVCR90.dll_fputs]
push esi
push str.START
call edi
push esi
push 0x40ec00
call edi
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
lea eax, [esp + 0x18]
push eax
push str.SoftwareVB_and_VBA_Program_SettingsSPYWAREPROTECTIONconfig
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4079fe
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edi, [ebx + 0x400]
push edi
push eax
push eax
push str.ZVPath
push edx
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call fcn.0040a290
lea esi, [ebx + 0x810]
push edi
push str._sZVSCANZVUPDATE
mov edx, esi
call fcn.0040aa70
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40781e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push str._sZVSCANZVUPDATE341DB
mov edx, esi
call fcn.0040aa70
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407841
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push str._sZVSCANZVUPDATEACLT
mov edx, esi
call fcn.0040aa70
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407864
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push str._sZVSCANZVUPDATEASRV
mov edx, esi
call fcn.0040aa70
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407887
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push str._sNPEPSEPSLAN
mov edx, esi
call fcn.0040aa70
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4078aa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push str._sNPEPSEPSLANSUPPORTINGFILES
mov edx, esi
call fcn.0040aa70
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4078cd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x23
lea esi, [ebx + 0x608]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Net_Protector
push 0x104
push esi
call dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0xc
mov ecx, ebx
call fcn.004085f0
mov esi, ebx
call fcn.004087d0
xor ecx, ecx
push 0x4e
push ecx
lea edx, [esp + 0x2e]
push edx
mov word [esp + 0x30], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x24]
push eax
call fcn.00409870
test eax, eax
je 0x4079da
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407932
sub eax, edx
sar eax, 1
je 0x4079da
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x48e]
push edx
mov word [esp + 0x490], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push 0x40f1f0
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.MSVCR90.dll_wcstok_s]
add esp, 0xc
lea edx, [esp + 0x24]
push edx
push 0x40f1f4
lea edx, [esp + 0x48c]
call fcn.0040aa70
mov ecx, dword [esp + 0x28]
add esp, 8
lea eax, [esp + 0x484]
push eax
call sub.mfc90u.dll_CWnd::SetWindowTextW
mov eax, 1
mov ecx, dword [esp + 0x698]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x680]
xor ecx, esp
call fcn.0040b240
mov esp, ebp
pop ebp
ret
push 0x10
push str.UpgradeNP
push str.No_DB_Found_
mov ecx, ebx
call sub.mfc90u.dll_CWnd::MessageBoxW
push 2
mov ecx, ebx
call sub.mfc90u.dll_CDialog::EndDialog
push 0
call dword [sym.imp.MSVCR90.dll_exit]
push 0
push str.MakeVersionZip
push str.Product_Not_Found
jmp 0x4079e6