Function at 0x42b870
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43ca0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
mov eax, dword [0x444020]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x10], eax
xor ebx, ebx
lea ecx, [esp + 0x58]
mov dword [esp + 0x430], ebx
call fcn.00425320
lea ecx, [esp + 0x14]
mov byte [esp + 0x430], 1
push ecx
mov ecx, ebp
call fcn.0042bb90
mov edi, eax
mov esi, dword [edi]
mov eax, dword [esp + 0x10]
cmp eax, esi
mov byte [esp + 0x430], 2
je 0x42b938
cmp dword [eax - 0xc], ebx
jge 0x42b8e6
mov ecx, dword [0x444024]
add eax, 0xfffffff4
cmp eax, ecx
jne 0x42b8eb
cmp dword [esi - 0xc], ebx
jge 0x42b91f
mov edi, dword [esi - 8]
lea ecx, [esp + 0x10]
push edi
call fcn.00422f80
test eax, eax
je 0x42b938
mov eax, dword [esp + 0x10]
push edi
lea edx, [edi + 1]
push esi
push edx
push eax
call fcn.004023d0
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov dword [ecx - 8], edi
mov edx, dword [esp + 0x10]
mov byte [edi + edx], bl
jmp 0x42b938
lea ecx, [esp + 0x10]
call fcn.00405770
mov edi, dword [edi]
mov dword [esp + 0x10], edi
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x14]
mov edx, dword [0x444024]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x430], 1
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42b971
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x42b971
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.0043a372
add esp, 4
push 0x2710
lea ecx, [esp + 0x5c]
call fcn.00425410
mov al, byte [ebp + 0x18d8]
cmp al, bl
mov eax, str.http:__update.360safe.com_antiarp_360arpup.ini_tabmain
jne 0x42b993
mov eax, str.http:__update.360safe.com_antiarp_360arpup.ini_tabtray
mov ecx, dword [esp + 0x10]
push ecx
push eax
lea ecx, [esp + 0x60]
call fcn.00425590
test eax, eax
je 0x42bb27
mov edx, dword [0x44591c]
push str.antiarp.exe.tmp
lea eax, [esp + 0x328]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [esp + 0x324]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42ba0e
lea ecx, [esp + 0x58]
mov byte [esp + 0x430], bl
call fcn.00425370
mov eax, dword [esp + 0x10]
mov ecx, dword [0x444024]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x42bb68
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x42bb68
jmp 0x42bb58
mov cl, byte [0x445264]
xor eax, eax
mov byte [esp + 0x18], cl
mov ecx, 0xf
lea edi, [esp + 0x19]
mov edx, dword [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x1c]
push 0x40
push eax
push ebx
push str.version
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x18], bl
je 0x42bb27
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.0042be70
test eax, eax
je 0x42bb27
mov dl, byte [ebp + 0x18d8]
lea ecx, [esp + 0x178]
push edx
call fcn.00424140
lea eax, [esp + 0x178]
mov byte [esp + 0x430], 3
mov dword [esp + 0x180], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x4452a4
mov dword [esp + 0x188], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4452d8]
lea edx, [esp + 0x180]
push 0x4452a4
mov dword [esp + 0x18c], ecx
mov dword [0x4452d8], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x445278]
push ebx
push 0x408340
push ebx
push 0x100
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x42bafb
lea eax, [esp + 0x18]
mov ecx, ebp
push eax
call fcn.0042c070
mov ecx, ebp
call fcn.0042c1e0
jmp 0x42bb13
cmp eax, 0x427
je 0x42bb07
cmp eax, 2
jne 0x42bb13
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.0042c070
lea ecx, [esp + 0x178]
mov byte [esp + 0x430], 1
call fcn.004245c0
lea ecx, [esp + 0x58]
mov byte [ebp + 0x18d8], bl
mov byte [esp + 0x430], bl
call fcn.00425370
mov eax, dword [esp + 0x10]
mov ecx, dword [0x444024]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x42bb68
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x42bb68
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0043a372
add esp, 4
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x424
ret