Function at 0x403890
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4774fb
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x48300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x41c], edi
mov dword [ebp - 0x414], edi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 0x414], edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
push 0
push str.onlyUsb
push 0x47bdf0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push str.Audit_Only_USB_:__d
push str.readIniFile
push dword [0x484188]
mov dword [0x484140], eax
call fcn.00403170
xorps xmm0, xmm0
movlpd qword [ebp - 0x418], xmm0
push 0xc
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
call fcn.00475be2
add esp, 0x14
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x418], eax
push esi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push eax
push 0x47bdf9
push str.audit
push 0x47bdf0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4039da
push 0xc
mov dword [edi], eax
mov dword [edi + 4], eax
call fcn.00475be2
mov edx, eax
add esp, 4
mov dword [edx], edx
mov dword [edx + 4], edx
mov eax, dword [ebp - 0x418]
mov dword [edi], eax
mov eax, dword [ebp - 0x414]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x418], edx
mov dword [edi + 4], eax
mov dword [ebp - 0x414], ecx
mov eax, dword [edx + 4]
mov dword [eax], 0
mov eax, dword [edx]
test eax, eax
je 0x403b43
mov esi, dword [eax]
push 0xc
push eax
call fcn.00475c12
add esp, 8
mov eax, esi
test esi, esi
jne 0x4039c2
jmp 0x403b43
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4039e3
sub ecx, edx
lea eax, [ebp - 0x410]
add ecx, eax
cmp byte [ecx - 1], 0x2c
lea eax, [ecx - 1]
je 0x403a02
mov eax, ecx
mov byte [eax], 0x2c
mov byte [eax + 1], 0
lea esi, [ebp - 0x410]
mov al, byte [ebp - 0x410]
mov ebx, esi
test al, al
je 0x403ae1
nop dword [eax]
cmp al, 0xa
je 0x403adb
test esi, esi
je 0x403adb
cmp al, 0x2c
jne 0x403acf
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, esi
mov edi, eax
sub ecx, ebx
xorps xmm0, xmm0
push ecx
push ebx
push edi
movq qword [edi], xmm0
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 0x418]
add esp, 0x10
cmp dword [ebp - 0x414], 0x15555555
je 0x403b71
lea eax, [ebp - 0x418]
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 1
push 0xc
mov dword [ebp - 0x420], 0
call fcn.00475be2
mov byte [ebp - 4], 0
push edi
push str.Audit_File_Type_:__s
mov dword [eax + 8], edi
inc dword [ebp - 0x414]
mov ecx, dword [ebx + 4]
mov dword [eax], ebx
mov dword [eax + 4], ecx
push str.readIniFile
push dword [0x484188]
mov dword [ebx + 4], eax
mov dword [ebp - 0x420], 0
mov dword [ecx], eax
call fcn.00403170
add esp, 0x14
lea ebx, [esi + 1]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403a20
mov edi, dword [ebp - 0x41c]
push 0xc
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00475be2
mov esi, eax
add esp, 4
mov dword [esi], esi
mov dword [esi + 4], esi
mov ecx, dword [ebp - 0x418]
mov dword [edi], ecx
mov edx, dword [edi + 4]
mov ecx, dword [ebp - 0x414]
mov dword [ebp - 0x418], esi
mov dword [edi + 4], ecx
mov dword [ebp - 0x414], edx
mov eax, dword [esi + 4]
mov dword [eax], 0
mov eax, dword [esi]
test eax, eax
je 0x403b43
nop
mov esi, dword [eax]
push 0xc
push eax
call fcn.00475c12
add esp, 8
mov eax, esi
test esi, esi
jne 0x403b30
push 0xc
push dword [ebp - 0x418]
call fcn.00475c12
mov eax, edi
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475bd4
mov esp, ebp
pop ebp
ret
push str.list_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3