Function at 0x100c9fb4
Capabilities:
Check if file exists

Disassembly:
push 0x450
mov eax, 0x1016d9e7
call fcn.1012b71c
mov edi, ecx
mov dword [ebp - 0x45c], edi
lea eax, [edi + 0x14]
push eax
lea ecx, [ebp - 0x430]
call fcn.10007b01
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [edi + 4], ebx
je 0x100c9ff3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x430], ebx
jmp 0x100ca9ec
mov dword [edi + 4], 1
mov esi, 0x208
push esi
push ebx
lea eax, [ebp - 0x21c]
push eax
call fcn.1012db70
push esi
push ebx
lea eax, [ebp - 0x424]
push eax
call fcn.1012db70
add esp, 0x18
push str.dscon.dat
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
push dword [0x1024b9f8]
call fcn.100856ec
mov ecx, eax
call fcn.100867a6
mov dword [edi + 0x23c], ebx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100ca089
push esi
lea eax, [ebp - 0x21c]
push eax
push dword [0x1024b9f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...dscon.dat
lea eax, [ebp - 0x21c]
push eax
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
call esi
mov dword [edi + 0x23c], ebx
jmp 0x100ca099
mov dword [edi + 0x23c], 1
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.dsconz.dat
push 0x104
lea eax, [ebp - 0x424]
push eax
push dword [0x1024b9f8]
call fcn.100856ec
mov ecx, eax
call fcn.100867a6
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100ca0f5
push 0x104
lea eax, [ebp - 0x424]
push eax
push dword [0x1024b9f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...dsconz.dat
lea eax, [ebp - 0x424]
push eax
call esi
jmp 0x100ca0ff
mov dword [edi + 0x23c], 1
lea ecx, [ebp - 0x438]
call fcn.100413a9
mov byte [ebp - 4], 1
mov byte [ebp - 0x429], 0x4c
push 1
lea eax, [ebp - 0x429]
push eax
push 1
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x438]
call fcn.10113d34
test eax, eax
jne 0x100ca186
push 1
lea eax, [ebp - 0x429]
push eax
push 1
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x438]
call fcn.10113d34
test eax, eax
jne 0x100ca186
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xe011000d
call fcn.10112154
mov ecx, eax
call fcn.10115256
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x438]
call fcn.1011194f
or dword [ebp - 4], 0xffffffff
jmp 0x100ca9e5
lea ecx, [ebp - 0x438]
call fcn.101130bc
mov esi, eax
test esi, esi
je 0x100ca16f
mov byte [ebp - 4], 2
mov dword [ebp - 0x428], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
call fcn.1000fecf
lea ecx, [ebp - 0x428]
push ecx
push 0x10184150
mov ecx, eax
call fcn.1008a5b7
test eax, eax
js 0x100ca96c
mov ecx, dword [ebp - 0x428]
test ecx, ecx
je 0x100ca96c
mov dword [ebp - 0x444], ebx
mov eax, dword [ecx]
lea edx, [ebp - 0x444]
push edx
push esi
push ecx
call dword [eax + 0xa4]
test eax, eax
js 0x100ca96c
or ecx, 0xffffffff
cmp word [ebp - 0x444], cx
jne 0x100ca96c
lea eax, [edi + 8]
push eax
push str.__dsconfig_bwtypes_type
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c65a8
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c6877
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c696a
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c754d
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c6006
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c80f3
lea eax, [edi + 0x150]
push eax
push str.__dsconfig_nofiledeletes_type
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c65a8
lea eax, [edi + 0xc8]
push eax
push str.__dsconfig_pnope_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [edi + 0xd4]
push eax
push str.__dsconfig_pzerofile_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [edi + 0xe0]
push eax
push str.__dsconfig_adnofile2_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c541b
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c7001
lea eax, [edi + 0x17c]
push eax
push str.__dsconfig_zptypes_type
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c65a8
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c80a8
lea esi, [edi + 0x1a0]
push esi
push str.__dsconfig_taurotuns_tp
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
lea esi, [edi + 0x1ac]
push esi
push str.__dsconfig_tpdlltype_tp
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c706b
lea eax, [edi + 0xec]
push eax
push str.__dsconfig_passnckillitem_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [edi + 0xf8]
push eax
push str.__dsconfig_pdpath_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [edi + 0x104]
push eax
push str.__dsconfig_pnofile_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
push str....._safemonDsTpi.tpi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100ca435
mov dword [ebp - 0x43c], ebx
lea eax, [ebp - 0x43c]
push eax
push str.__dsconfig_timedelay
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c5b49
mov eax, dword [ebp - 0x43c]
test eax, eax
jns 0x100ca408
mov eax, ebx
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x448], eax
push ebx
push 4
lea eax, [ebp - 0x448]
push eax
push 4
push str.timedelay
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010e24e
mov ecx, eax
call fcn.1010d93f
lea eax, [edi + 0x90]
push eax
push str.__dsconfig_qupips_ip
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
mov ecx, edi
call fcn.100cafd8
lea eax, [edi + 0x1f0]
push eax
push str.__dsconfig_hosts_h
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c9424
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c8a58
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c7756
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c6a5d
lea eax, [edi + 0xbc]
push eax
push str.__dsconfig_blackcert_Hash
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea esi, [edi + 0x1d0]
push esi
push str.__dsconfig_exprt_type
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
lea eax, [edi + 0x1dc]
push eax
push str.__dsconfig_ccs_item
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea eax, [edi + 0x110]
push eax
push str.__dsconfig_camouope_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea esi, [edi + 0x230]
push esi
push str.__dsconfig_autorunsext_tp
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c96e6
push dword [ebp - 0x428]
mov ecx, edi
call fcn.100c9ed7
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c7fb2
lea eax, [edi + 0x58]
push eax
push str.__dsconfig_enablembr
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c5b49
lea eax, [edi + 0x240]
push eax
push str.__dsconfig_urlflt_p
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea ecx, [ebp - 0x434]
call fcn.10008950
mov byte [ebp - 4], 5
lea eax, [ebp - 0x434]
push eax
push str.__dsconfig_urlpos
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c894e
lea esi, [edi + 0x24c]
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.10010737
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
mov byte [ebp - 4], 6
lea eax, [edi + 0x314]
push eax
push str.__dsconfig_uipesuffix_e
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea eax, [ebp - 0x454]
push eax
push str.__dsconfig_writeprotectvsvirus_e
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
mov edx, ebx
mov dword [ebp - 0x440], edx
mov eax, dword [ebp - 0x450]
sub eax, dword [ebp - 0x454]
sar eax, 2
cmp edx, eax
jae 0x100ca6af
mov esi, ebx
mov dword [ebp - 0x458], esi
lea ecx, [edi + 0x314]
mov eax, dword [ecx]
mov dword [ebp - 0x43c], eax
mov eax, dword [ecx + 4]
sub eax, dword [ebp - 0x43c]
sar eax, 2
cmp esi, eax
jae 0x100ca694
mov eax, dword [ebp - 0x43c]
lea ecx, [eax + esi*4]
mov eax, dword [ebp - 0x454]
push dword [eax + edx*4]
call fcn.10008856
test eax, eax
je 0x100ca6a3
inc esi
mov dword [ebp - 0x458], esi
mov edx, dword [ebp - 0x440]
jmp 0x100ca64c
mov eax, dword [ebp - 0x454]
lea eax, [eax + edx*4]
push eax
call fcn.10010737
mov edx, dword [ebp - 0x440]
inc edx
jmp 0x100ca62b
lea ecx, [ebp - 0x434]
call fcn.100089d6
lea eax, [ebp - 0x434]
push eax
push str.__dsconfig_browser
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c894e
lea esi, [edi + 0x258]
lea eax, [ebp - 0x434]
push eax
mov ecx, esi
call fcn.10010737
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
lea eax, [edi + 0x264]
push eax
push str.__dsconfig_urldomain_p
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea eax, [edi + 0x270]
push eax
push str.__dsconfig_browserflt_p
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea esi, [edi + 0x288]
push esi
push str.__dsconfig_bwtype64_tp
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
lea eax, [edi + 0x294]
push eax
push str.__dsconfig_graybwtype64_tp
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea eax, [edi + 0x340]
push eax
push str.__dsconfig_bypassuac_scan
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c5b49
push dword [ebp - 0x428]
mov ecx, edi
call fcn.100c98fc
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c9b3f
lea eax, [edi + 0x2d4]
push eax
push str.__dsconfig_sdmfind
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c5b49
lea eax, [edi + 0x2d8]
push eax
push str.__dsconfig_sdmfiles
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c5b49
lea eax, [edi + 0x2dc]
push eax
push str.__dsconfig_sdmfolders
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c5b49
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c6d47
lea eax, [edi + 0x11c]
push eax
push str.__dsconfig_ploadgray_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [edi + 0x128]
push eax
push str.__dsconfig_passbigpenonet_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [edi + 0x134]
push eax
push str.__dsconfig_dfm_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea eax, [edi + 0x140]
push eax
push str.__dsconfig_lr2028_cdi
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c602d
lea esi, [edi + 0x1b8]
push esi
push str.__dsconfig_dfempty_tp
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
push 0x2c
push esi
mov ecx, edi
call fcn.1006f574
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c9e38
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c96cd
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100caa00
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c9b07
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c95e7
lea eax, [edi + 0x2f8]
push eax
push str.__dsconfig_passscriptleturl_url
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea eax, [edi + 0x304]
push eax
push str.__dsconfig_passsspecialsdb_fn
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c87db
lea eax, [edi + 0x350]
push eax
push str.__dsconfig_scanspecialdllfor360loader_e
push ecx
mov ecx, esp
mov dword [ebp - 0x448], esp
lea eax, [ebp - 0x428]
push eax
call fcn.1001dd67
mov byte [ebp - 4], 7
mov byte [ebp - 4], 6
mov ecx, edi
call fcn.100c8476
lea eax, [edi + 0x35c]
push eax
push str.__dsconfig_maxenumdesktop
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.100c5b49
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x454]
call fcn.10008abd
mov byte [ebp - 4], 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x434]
lea ecx, [ecx - 0x10]
call fcn.100078bc
jmp 0x100ca97e
push eax
push 0xe011000d
call fcn.10112154
mov ecx, eax
call fcn.10115256
or esi, 0xffffffff
mov byte [ebp - 4], 9
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x100ca999
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 1
jmp 0x100ca9cd
mov ecx, edi
call fcn.100cb269
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x438]
call fcn.1011194f
mov dword [ebp - 4], esi
cmp dword [ebp - 0x430], 0
je 0x100ca9fa
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1012b669
ret