Function at 0x438460
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51d030
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push 0x68
call fcn.004fa746
xor edi, edi
add esp, 4
cmp eax, edi
mov esi, 0xf
je 0x4384af
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], edi
mov byte [eax + 8], 0
mov dword [eax + 0x3c], esi
mov dword [eax + 0x38], edi
mov byte [eax + 0x28], 0
mov dword [eax + 0x60], esi
mov dword [eax + 0x5c], edi
mov byte [eax + 0x4c], 0
jmp 0x4384b1
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push 0x68
mov dword [ebp + 0x6658], eax
call fcn.004fa746
add esp, 4
cmp eax, edi
je 0x4384eb
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], edi
mov byte [eax + 8], 0
mov dword [eax + 0x3c], esi
mov dword [eax + 0x38], edi
mov byte [eax + 0x28], 0
mov dword [eax + 0x60], esi
mov dword [eax + 0x5c], edi
mov byte [eax + 0x4c], 0
jmp 0x4384ed
xor eax, eax
mov ecx, dword [ebp + 0x240]
mov dword [ebp + 0x665c], eax
mov eax, dword [ebp + 0x23c]
cmp eax, ecx
je 0x4385fc
lea ebx, [eax + 0x2c]
lea ebx, [ebx]
mov esi, dword [ebx - 4]
cmp esi, dword [ebx]
je 0x4385e8
add esi, 0x20
mov edi, edi
cmp dword [esi], 1
jne 0x4385d6
mov eax, dword [esi - 0x20]
cmp eax, 6
jne 0x438582
mov edi, dword [ebp + 0x6658]
push 0xffffffffffffffff
mov dword [edi], eax
push 0
lea eax, [esi - 0x1c]
push eax
lea ecx, [edi + 4]
call fcn.004018b0
mov ecx, dword [esi]
push 0xffffffffffffffff
push 0
lea edx, [esi + 4]
mov dword [edi + 0x20], ecx
push edx
lea ecx, [edi + 0x24]
call fcn.004018b0
mov al, byte [esi + 0x20]
push 0xffffffffffffffff
mov byte [edi + 0x40], al
mov ecx, dword [esi + 0x24]
push 0
lea edx, [esi + 0x28]
mov dword [edi + 0x44], ecx
push edx
lea ecx, [edi + 0x48]
call fcn.004018b0
mov eax, dword [esi + 0x44]
mov dword [edi + 0x64], eax
jmp 0x4385d6
cmp eax, 1
jne 0x4385d6
mov edi, dword [ebp + 0x665c]
push 0xffffffffffffffff
push 0
lea ecx, [esi - 0x1c]
push ecx
lea ecx, [edi + 4]
mov dword [edi], eax
call fcn.004018b0
mov edx, dword [esi]
push 0xffffffffffffffff
push 0
lea eax, [esi + 4]
push eax
lea ecx, [edi + 0x24]
mov dword [edi + 0x20], edx
call fcn.004018b0
mov cl, byte [esi + 0x20]
push 0xffffffffffffffff
mov byte [edi + 0x40], cl
mov edx, dword [esi + 0x24]
push 0
lea eax, [esi + 0x28]
push eax
lea ecx, [edi + 0x48]
mov dword [edi + 0x44], edx
call fcn.004018b0
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x64], ecx
mov eax, dword [ebx]
add esi, 0x68
lea edx, [esi - 0x20]
cmp edx, eax
jne 0x438520
xor edi, edi
mov eax, dword [ebp + 0x240]
add ebx, 0x44
lea ecx, [ebx - 0x2c]
cmp ecx, eax
jne 0x438510
mov eax, dword [ebp + 0x358]
mov esi, dword [ebp + 0x1ad0]
push 0xffff0002
push 0xffff0000
push edi
push edi
push edi
push edi
push edi
push eax
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
mov edi, eax
push edi
push 0
push 0
push 0
push 5
push 5
push 0x542cd4
push 0x23
mov ecx, esi
call fcn.004f4b09
mov edx, dword [0x56ba60]
push str.about:blank
push edx
call fcn.004b34a2
add esp, 8
test eax, eax
je 0x438677
push 0xffff0002
push edi
push 0
push 0
push 0
push 0xc
push 0xc
push 0x541c50
push 0x23
mov ecx, esi
call fcn.004f4b09
mov eax, dword [ebp + 0x23c]
mov ecx, dword [ebp + 0x240]
cmp eax, ecx
je 0x438753
lea ecx, [eax + 0x2c]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx - 4]
mov edx, dword [ecx]
cmp eax, edx
mov dword [esp + 0x10], eax
je 0x438737
cmp dword [eax], 0xea60
je 0x4386b8
add eax, 0x68
cmp eax, edx
jne 0x4386a3
mov dword [esp + 0x10], eax
jmp 0x438737
mov dword [esp + 0x10], eax
call fcn.004fa853
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], 0
mov eax, dword [0x56ba74]
push eax
lea ecx, [esp + 0x20]
push 0x541c3c
push ecx
call fcn.00405820
mov ebx, dword [esp + 0x28]
add esp, 0xc
push 0xffff0002
push edi
push 0
push 0
push 0
push 0xb
push 0xb
push ebx
push 0x23
mov ecx, esi
call fcn.004f4b09
lea eax, [ebx - 0x10]
mov dword [esp + 0x34], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43872f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp eax, dword [ecx]
jne 0x438753
mov eax, dword [ebp + 0x240]
add ecx, 0x44
lea edx, [ecx - 0x2c]
cmp edx, eax
mov dword [esp + 0x18], ecx
jne 0x438692
push 0xffff0002
push edi
push 0
push 0
push 0
push 1
push 1
push 0x541c30
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
mov ebx, eax
push ebx
push 0
push 0
push 0
push 8
push 8
push 0x541c24
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push ebx
push 0
push 0
push 0
push 8
push 8
push 0x541c18
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push ebx
push 0
push 0
push 0
push 8
push 8
push 0x541c08
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push ebx
push 0
push 0
push 0
push 8
push 8
push 0x541bf8
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push edi
push 0
push 0
push 0
push 2
push 2
push 0x541bec
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
mov ebp, eax
push ebp
push 0
push 0
push 0
push 7
push 7
push 0x541bdc
push 0x23
mov ecx, esi
mov dword [esp + 0x48], ebp
call fcn.004f4b09
push 0xffff0002
push ebp
push 0
push 0
push 0
push 9
push 9
push 0x541bd0
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push ebp
push 0
push 0
push 0
push 9
push 9
push 0x541bc4
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push edi
push 0
push 0
push 0
push 3
push 3
push 0x542230
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
mov ebp, eax
push ebp
push 0
push 0
push 0
push 0xa
push 0xa
push 0x5421b0
push 0x23
mov ecx, esi
mov dword [esp + 0x4c], ebp
call fcn.004f4b09
push 0x56b5e8
lea ecx, [esp + 0x20]
call fcn.00402030
push 0xb
push str.Service.ini
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 1
call fcn.00401a20
mov eax, dword [esp + 0x1c]
push eax
push 0
push str.ShowmVirementPage
push 0x541ba0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x438907
push 0xffff0002
push ebp
push eax
push eax
push eax
push 0xa
push 0xa
push 0x541b94
push 0x23
mov ecx, esi
call fcn.004f4b09
call fcn.004fa853
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x34], 2
call fcn.004fa853
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
push 8
push 0x541b88
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 3
call fcn.00401f00
mov eax, dword [esp + 0x18]
push 0xffff0002
push ebp
push 0
push 0
push 0
push 0xa
push 0xa
push eax
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push ebp
push 0
push 0
push 0
push 7
push 7
push 0x541b78
push 0x23
mov ecx, esi
call fcn.004f4b09
mov byte [esp + 0x34], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4389a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0x34], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4389c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4389ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0xffff0002
push edi
push 0
push 0
push 0
push 4
push 4
push 0x541b6c
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
mov ebp, eax
push ebp
push 0
push 0
push 0
push 0xb
push 0xb
push 0x541b60
push 0x23
mov ecx, esi
mov dword [esp + 0x3c], ebp
call fcn.004f4b09
push 0xffff0002
push ebp
push 0
push 0
push 0
push 0xb
push 0xb
push 0x541b54
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push ebp
push 0
push 0
push 0
push 0xb
push 0xb
push 0x541b48
push 0x23
mov ecx, esi
call fcn.004f4b09
push str.stockReg.exe
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
je 0x438b3e
push 0xffff0002
push edi
push 0
push 0
push 0
push 4
push 4
push 0x541b3c
push 0x23
mov ecx, esi
call fcn.004f4b09
push 0xffff0002
push eax
push 0
push 0
push 0
push 0xb
push 0xb
push 0x542004
push 0x23
mov ecx, esi
mov dword [esp + 0x34], eax
call fcn.004f4b09
mov eax, dword [esp + 0x10]
push 0xffff0002
push eax
push 0
push 0
push 0
push 0xb
push 0xb
push 0x541ff4
push 0x23
mov ecx, esi
call fcn.004f4b09
mov ecx, dword [esp + 0x10]
push 0xffff0002
push ecx
push 0
push 0
push 0
push 0xb
push 0xb
push 0x541fe4
push 0x23
mov ecx, esi
call fcn.004f4b09
mov edx, dword [esp + 0x10]
push 0xffff0002
push edx
push 0
push 0
push 0
push 0xb
push 0xb
push 0x542014
push 0x23
mov ecx, esi
call fcn.004f4b09
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
push eax
push 2
push 0x1102
push ecx
call ebp
push 0x541b30
lea ecx, [esp + 0x24]
call fcn.00402030
push 0xffff0002
push edi
push 0
push 0
push 0
push 6
mov dword [esp + 0x4c], 4
mov edx, dword [esp + 0x38]
push 6
push edx
push 0x23
mov ecx, esi
call fcn.004f4b09
mov eax, dword [esi + 0x1c]
push edi
push 2
push 0x1102
push eax
call ebp
mov ecx, dword [esi + 0x1c]
push ebx
push 2
push 0x1102
push ecx
call ebp
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 0x1c]
push edx
push 2
push 0x1102
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
push ecx
push 2
push 0x1102
push edx
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x1c]
push eax
push 2
push 0x1102
push ecx
call ebp
push 0x56b5e8
lea ecx, [esp + 0x18]
call fcn.00402030
push 0x11
push str.ManageClient.exe
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 5
call fcn.00401a20
mov edx, dword [esp + 0x14]
push 0
push edx
call fcn.004b56c8
add esp, 8
cmp eax, 0xffffffff
pop ebp
pop ebx
je 0x438c48
mov eax, dword [esp + 0xc]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconA]
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 0x1ad0]
mov edx, dword [ecx + 0x88]
push eax
add ecx, 0x84
push 0xffffffffffffffff
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push 0xffff0002
push edi
push 0
push 0
push 0
push eax
push eax
push 0x541b10
push 0x23
mov ecx, esi
call fcn.004f4b09
push 1
push 0
push 1
mov ecx, esi
call fcn.004f7894
mov byte [esp + 0x2c], 4
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x438c7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438ca0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4