Function at 0x94e3c0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0xdac
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xda4], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x89d]
push ebx
push eax
mov byte [esp + 0x8a4], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x165]
push ebx
push ecx
mov byte [esp + 0x16c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x585]
push ebx
push edx
mov byte [esp + 0x58c], bl
call fcn.00a7ffb0
add esp, 0xc
mov edi, 0x104
lea ecx, [esp + 0x898]
call fcn.00958630
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x898]
push eax
lea ecx, [esp + 0x164]
push ecx
call ebp
cmp byte [esp + 0x160], bl
je 0x94e49c
lea eax, [esp + 0x160]
lea ebx, [ebx]
inc eax
cmp byte [eax], bl
jne 0x94e470
lea edx, [esp + 0x160]
sub eax, edx
je 0x94e49c
cmp byte [esp + eax + 0x15f], 0x5c
je 0x94e49c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xaa1564
mov eax, edx
push eax
call esi
jmp 0x94e4a2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xae2a08
lea ecx, [esp + 0x164]
push ecx
call esi
xor ecx, ecx
lea edi, [esp + 0x160]
call fcn.0095a6d0
test eax, eax
je 0x94e8ef
lea edx, [esp + 0x580]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esp + 0x580], bl
jne 0x94e4f5
lea eax, [esp + 0x898]
push eax
lea ecx, [esp + 0x584]
push ecx
call ebp
push 0x103
lea edx, [esp + 0x795]
push ebx
push edx
mov byte [esp + 0x79c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0x47d]
push ebx
push eax
mov byte [esp + 0x484], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x5000
call fcn.00a7a155
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
cmp edi, ebx
je 0x94e8ef
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x794]
push edx
mov byte [edi], bl
call ebp
lea ecx, [esp + 0x790]
call fcn.00960910
push str.OEM.INF
lea eax, [esp + 0x794]
push eax
call esi
lea esi, [esp + 0x20]
lea ecx, [esp + 0x790]
mov dword [esp + 0x18], 1
call fcn.0094df40
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x94e8e6
mov edi, edi
cmp dword [esp + 0x18], ebx
je 0x94e8db
test byte [esp + 0x20], 0x10
jne 0x94e8c5
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x47c]
push edx
call ebp
lea ecx, [esp + 0x478]
call fcn.00960910
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x478]
push edx
push 0x5000
push edi
push 0xaa1543
push ebx
push str.Strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [edi], bl
je 0x94e8c5
xor esi, esi
cmp byte [edi], bl
je 0x94e8c5
jmp 0x94e620
push 0x207
lea eax, [esp + 0x9a5]
push ebx
push eax
mov byte [esp + 0x9ac], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [esp + 0xbad]
push ebx
push ecx
mov byte [esp + 0xbb4], bl
call fcn.00a7ffb0
add esp, 0xc
lea edx, [esi + edi]
push edx
lea eax, [esp + 0x9a4]
push eax
call ebp
mov cl, byte [esp + 0x9a0]
lea eax, [esp + 0x9a0]
cmp cl, bl
je 0x94e685
lea ebx, [ebx]
inc eax
cmp byte [eax], bl
jne 0x94e680
lea edx, [esp + 0x9a0]
sub eax, edx
lea esi, [esi + eax + 1]
cmp cl, bl
je 0x94e8c5
lea eax, [esp + 0x478]
push eax
push 0x208
lea ecx, [esp + 0xbb0]
push ecx
push 0xaa1543
push edx
push str.Strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
lea eax, [esp + 0xbac]
push 0xaa1ab8
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x94e730
push ebx
lea ecx, [esp + 0xbac]
push str.econceal
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x94e730
push ebx
lea edx, [esp + 0xbac]
push str.eScan_Firewall
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x94e730
cmp byte [esi + edi], bl
jne 0x94e620
mov ecx, dword [esp + 0x14]
lea esi, [esp + 0x20]
call fcn.0094e160
mov dword [esp + 0x18], eax
jmp 0x94e5a0
push 0x103
lea eax, [esp + 0x26d]
push ebx
push eax
mov byte [esp + 0x274], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x375]
push ebx
push ecx
mov byte [esp + 0x37c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x68d]
push ebx
push edx
mov byte [esp + 0x694], bl
call fcn.00a7ffb0
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x68c]
push ecx
call ebp
lea edx, [esp + 0x688]
push 0x2e
push edx
call fcn.00a7aa50
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
cmp eax, ebx
je 0x94e852
mov byte [eax], bl
push str..PNF
lea eax, [esp + 0x68c]
push eax
call esi
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x26c]
push edx
call ebp
lea ecx, [esp + 0x268]
call fcn.00960910
lea eax, [esp + 0x688]
push eax
lea ecx, [esp + 0x26c]
push ecx
call esi
lea edx, [esp + 0x580]
push edx
lea eax, [esp + 0x374]
push eax
call ebp
lea ecx, [esp + 0x370]
call fcn.00960910
lea ecx, [esp + 0x688]
push ecx
lea edx, [esp + 0x374]
push edx
call esi
push 1
push ebx
xor edx, edx
lea ecx, [esp + 0x270]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x94e852
lea edi, [esp + 0x370]
lea ebx, [esp + 0x268]
call fcn.009626c0
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0x26c]
push ecx
call ebp
lea ecx, [esp + 0x268]
call fcn.00960910
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x26c]
push eax
call esi
lea ecx, [esp + 0x580]
push ecx
lea edx, [esp + 0x374]
push edx
call ebp
lea ecx, [esp + 0x370]
call fcn.00960910
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x374]
push ecx
call esi
lea edi, [esp + 0x370]
lea ebx, [esp + 0x268]
call fcn.009626c0
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov ecx, dword [esp + 0x14]
lea esi, [esp + 0x20]
call fcn.0094e160
mov dword [esp + 0x18], eax
jmp 0x94e5a0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.00a78fec
add esp, 4
mov ecx, dword [esp + 0xdb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0xdac
ret