Function at 0x401850
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Get common file path
Get startup folder
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0xff
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call sub.MSVCR110.dll_memset
push 0xff
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call sub.MSVCR110.dll_memset
push 0xff
lea eax, [ebp - 0x303]
push 0
push eax
mov byte [ebp - 0x304], 0
call sub.MSVCR110.dll_memset
add esp, 0x24
call fcn.00409930
test eax, eax
je 0x4018cd
push 0x28
call dword [sym.imp.MSVCR110.dll_exit]
push 0
call sub.libav.dll_Ordinal_17
add esp, 4
test eax, eax
je 0x401904
push eax
call sub.libav.dll_Ordinal_27
push eax
push str._Cant_initialize_libclamav:__s_n
call fcn.00409e10
add esp, 0xc
mov eax, 0x28
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 0
push 2
push 1
push edi
push esi
push 0
call sub.libav.dll_Ordinal_44284
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jne 0x401940
push str._Cant_parse_command_line_options_n
call fcn.00409e10
add esp, 4
lea eax, [ebx + 0x28]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push str.help
push ebx
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401975
call fcn.004015a0
push ebx
call sub.libav.dll_Ordinal_44285
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
push eax
push 0
push 0
call fcn.004016d0
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, dword [sym.imp.MSVCR110.dll_strcat_s]
push 0x40d1d4
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
push eax
call edi
call fcn.00401120
push eax
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
push eax
call edi
mov esi, dword [sym.imp.MSVCR110.dll_strcpy_s]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call esi
push str.PCAU.conf
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x304]
push pe_nt_image_headers32
push eax
call esi
push str.RPCAU.log
lea eax, [ebp - 0x304]
push pe_nt_image_headers32
push eax
call edi
add esp, 0x48
lea eax, [ebp - 0x204]
push eax
push pe_nt_image_headers32
push 0x4139a0
call esi
push str.database
push pe_nt_image_headers32
push 0x4139a0
call edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCR110.dll__strdup]
push ebx
push 0
push 2
push 1
push 0
mov esi, eax
lea eax, [ebp - 0x104]
push 0
push eax
call sub.libav.dll_Ordinal_44284
add esp, 0x38
mov edi, eax
push esi
test edi, edi
jne 0x401aa5
push str.ERROR:_Cant_open_parse_the_config_file__s_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
push esi
call dword [sym.imp.MSVCR110.dll_free]
add esp, 0x10
lea eax, [edi + 0x28]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MSVCR110.dll_free]
push str.version
push edi
call sub.libav.dll_Ordinal_44283
add esp, 0xc
cmp dword [eax + 0x18], 0
je 0x401aef
push str.DatabaseDirectory
push edi
call sub.libav.dll_Ordinal_44283
mov eax, dword [eax + 8]
push eax
call fcn.00409c10
push edi
call sub.libav.dll_Ordinal_44285
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push str.stats_host_id
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401c32
push str.stats_host_id
push edi
call sub.libav.dll_Ordinal_44283
mov ecx, dword [eax + 8]
add esp, 8
mov edx, str.default
mov eax, ecx
nop
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x401b40
test bl, bl
je 0x401b3c
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x401b40
add eax, 2
add edx, 2
test bl, bl
jne 0x401b20
xor eax, eax
jmp 0x401b45
sbb eax, eax
or eax, 1
test eax, eax
je 0x401c1e
mov edx, str.anonymous
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x401b74
test bl, bl
je 0x401b70
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x401b74
add eax, 2
add edx, 2
test bl, bl
jne 0x401b54
xor eax, eax
jmp 0x401b79
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401bd3
movq xmm0, qword [str.5b585e8f_3be5_11e3_bf0b_18037319526c]
mov eax, dword [0x40d288]
movq qword [0x413960], xmm0
movq xmm0, qword [0x40d270]
movq qword [0x413968], xmm0
movq xmm0, qword [0x40d278]
movq qword [0x413970], xmm0
movq xmm0, qword [0x40d280]
mov dword [0x413980], eax
mov al, byte [0x40d28c]
movq qword [0x413978], xmm0
mov byte [0x413984], al
jmp 0x401c32
mov edx, ecx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x401bd8
sub edx, esi
cmp edx, 0x24
jbe 0x401c05
push edi
call sub.libav.dll_Ordinal_44285
add esp, 4
mov eax, 0x28
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
mov edx, 0x413960
sub edx, ecx
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x401c10
jmp 0x401c32
mov eax, dword [str.default]
mov dword [0x413960], eax
mov eax, dword [0x40d258]
mov dword [0x413964], eax
push edi
call fcn.00402280
push str.HTTPProxyPassword
push edi
call sub.libav.dll_Ordinal_44283
add esp, 0xc
cmp dword [eax + 0x18], 0
je 0x401c86
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.libav.dll_Ordinal_44339
add esp, 8
cmp eax, 0xffffffff
jne 0x401c86
push edi
call sub.libav.dll_Ordinal_44285
add esp, 4
mov eax, 0x38
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push str.Debug
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
jne 0x401cae
push str.debug
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401cb3
call sub.libav.dll_Ordinal_6
push str.verbose
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
mov esi, 1
je 0x401cd3
mov word [0x413600], si
push str.quiet
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401cee
mov word [0x413604], si
push str.no_warnings
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401d10
mov word [0x413608], si
mov word [0x4135e4], si
push str.stdout
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401d2b
mov word [0x41360c], si
cmp word [0x413600], 0
je 0x401d3e
mov word [0x4135e0], si
jmp 0x401d56
push str.LogVerbose
push edi
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x18]
add esp, 8
mov word [0x4135e0], ax
push str.LogTime
push edi
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x18]
push str.LogFileMaxSize
push edi
mov word [0x4135e8], ax
call sub.libav.dll_Ordinal_44283
mov eax, dword [eax + 0x10]
add esp, 0x10
mov dword [0x4135f4], eax
test eax, eax
je 0x401d9d
push str.LogRotate
push edi
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x18]
add esp, 8
mov word [0x4135f0], ax
push str.UpdateLogFile
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401dfc
lea eax, [ebp - 0x304]
push str._______________________________________n
mov dword [0x4135f8], eax
call fcn.00409df0
add esp, 4
test eax, eax
je 0x401e06
push dword [0x4135f8]
push str._Problem_with_internal_logger__UpdateLogFile___s_._n
call fcn.00409e10
push edi
call sub.libav.dll_Ordinal_44285
add esp, 0xc
mov eax, 0x3e
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
mov dword [0x4135f8], 0
push 0x401840
call sub.libav.dll_Ordinal_33
push 0x4139a0
call dword [sym.imp.MSVCR110.dll__chdir]
add esp, 8
test eax, eax
je 0x401e41
push edi
call sub.libav.dll_Ordinal_44285
add esp, 4
mov eax, 0x32
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push str.list_mirrors
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401ece
push 1
lea eax, [ebp - 0x328]
push eax
push str.mirrors.dat
call fcn.00406e30
add esp, 0xc
cmp eax, 0xffffffff
jne 0x401e9a
push str.Cant_read_mirrors.dat_n
call dword [sym.imp.MSVCR110.dll_printf]
push edi
call sub.libav.dll_Ordinal_44285
add esp, 8
mov eax, 0x37
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x328]
push eax
call fcn.00406d30
lea eax, [ebp - 0x328]
push eax
call fcn.00406d00
push edi
call sub.libav.dll_Ordinal_44285
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push str.PrivateMirror
push edi
call sub.libav.dll_Ordinal_44283
mov ebx, eax
add esp, 8
cmp dword [ebx + 0x18], 0
je 0x401fe6
push str.DatabaseMirror
push edi
call sub.libav.dll_Ordinal_44283
mov esi, eax
add esp, 8
mov dword [esi + 0x18], 1
mov dword [esi + 0x1c], 1
jmp 0x401f10
push str..clamav.net
push dword [ebx + 8]
call sub.libav.dll_Ordinal_44258
add esp, 8
test eax, eax
jne 0x40206a
mov eax, dword [esi + 8]
test eax, eax
je 0x401f39
push eax
call dword [sym.imp.MSVCR110.dll_free]
add esp, 4
push dword [ebx + 8]
call dword [sym.imp.MSVCR110.dll__strdup]
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x40204b
cmp dword [esi + 0x28], 0
lea eax, [esi + 0x28]
mov dword [ebp - 0x35c], eax
jne 0x401f7e
push 0x38
push 1
call dword [sym.imp.MSVCR110.dll_calloc]
mov ecx, dword [ebp - 0x35c]
add esp, 8
mov dword [ecx], eax
test eax, eax
je 0x40204b
mov eax, ecx
mov ebx, dword [ebx + 0x28]
mov ecx, esi
mov esi, dword [eax]
test ebx, ebx
jne 0x401f10
mov dword [ecx + 0x28], ebx
test esi, esi
je 0x401fb1
mov ebx, dword [sym.imp.MSVCR110.dll_free]
push dword [esi]
call ebx
push dword [esi + 4]
call ebx
push dword [esi + 8]
call ebx
push esi
mov esi, dword [esi + 0x28]
call ebx
add esp, 0x10
test esi, esi
jne 0x401f96
push str.no_dns
push edi
call sub.libav.dll_Ordinal_44283
push str.ScriptedUpdates
push edi
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 1
call sub.libav.dll_Ordinal_44283
add esp, 0x10
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
push 0x402240
push 2
mov byte [0x413ba0], 0
call dword [sym.imp.MSVCR110.dll_signal]
push str.daemon
push edi
call sub.libav.dll_Ordinal_44283
add esp, 0x10
cmp dword [eax + 0x18], 0
je 0x40212a
push str.Checks
push edi
call sub.libav.dll_Ordinal_44283
mov ecx, dword [eax + 0x10]
add esp, 8
test ecx, ecx
jle 0x40202c
cmp ecx, 0x32
jle 0x402089
push edi
call sub.libav.dll_Ordinal_44285
add esp, 4
mov eax, 0x29
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push edi
call sub.libav.dll_Ordinal_44285
add esp, 4
mov eax, 0x4b
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push edi
call sub.libav.dll_Ordinal_44285
add esp, 4
mov eax, 0x2d
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
mov eax, 0x15180
cdq
idiv ecx
push str.PidFile
push edi
mov esi, eax
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x4020b8
mov eax, dword [eax + 8]
push eax
mov dword [0x4131c8], eax
call fcn.00402410
add esp, 4
cmp word [0x4131c4], 0
mov dword [0x413da0], 0
jne 0x4021ab
imul esi, esi, 0x3e8
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.00401490
mov ebx, eax
add esp, 8
cmp ebx, 1
jle 0x402117
push str.OnErrorExecute
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x402117
mov eax, dword [eax + 8]
test eax, eax
je 0x402117
push edi
push eax
push str.OnErrorExecute
call fcn.00401070
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp word [0x4131c4], 0
je 0x4020d6
jmp 0x4021a4
push str.GlobalPCAPDBUpdaterMutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40215d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 0x30
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x402147
call fcn.00401170
test eax, eax
je 0x402229
push str.GlobalPCAPDBUpdaterMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.00401490
add esp, 8
mov ebx, eax
call fcn.00401350
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
jle 0x4021d5
jmp 0x4021b0
mov ebx, 0x34
push str.OnErrorExecute
push edi
call sub.libav.dll_Ordinal_44283
add esp, 8
cmp dword [eax + 0x18], 0
je 0x4021d5
push edi
push dword [eax + 8]
push str.OnErrorExecute
call fcn.00401070
add esp, 0xc
mov eax, dword [0x4131c8]
test eax, eax
je 0x4021e8
push eax
call dword [sym.imp.MSVCR110.dll__unlink]
add esp, 4
push edi
call sub.libav.dll_Ordinal_44285
add esp, 4
call sub.libav.dll_Ordinal_49
test ebx, ebx
jne 0x402216
cmp dword [0x4131cc], ebx
je 0x402216
lea eax, [ebx + 2]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov eax, 0x31
pop esi
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret