Function at 0x4c29a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc3c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0xc38], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc48]
xor ebx, ebx
push edi
mov edi, dword [esp + 0xc50]
cmp dword [0x749024], ebx
je 0x4c2a15
cmp dword [0x748e14], ebx
je 0x4c29ea
push 0x748f20
push str._WGWIN__eScanUpdateServer:___s_
push ebx
call fcn.004f0f30
add esp, 0xc
mov eax, 0x748f20
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4c29f3
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc38]
xor ecx, esp
call fcn.005dfbbe
add esp, 0xc3c
ret
push esi
call fcn.004f0de0
mov byte [0x748f20], bl
mov byte [ebp], bl
mov esi, eax
mov dword [0x749024], 1
cmp dword [0x748e14], ebx
je 0x4c2a47
push esi
push str._WGWIN__SMBCorp:__d
push ebx
call fcn.004f0f30
add esp, 0xc
cmp esi, ebx
je 0x4c2f70
push 0x103
lea eax, [esp + 0x339]
push ebx
push eax
mov byte [esp + 0x340], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x39]
push ebx
push ecx
mov byte [esp + 0x40], bl
call fcn.005dfd60
push ebx
push 0x104
lea edx, [esp + 0x354]
push edx
push 0x60c81c
push str.server
push 0x60c810
call fcn.004efe40
add esp, 0x30
cmp dword [0x748e14], ebx
je 0x4c2ac1
push edi
lea eax, [esp + 0x338]
push eax
push str._WGWIN__Server:__s__EupdateIni:__s
push ebx
call fcn.004f0f30
add esp, 0x10
cmp byte [esp + 0x334], 0x30
jne 0x4c2f70
push 1
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4c2f70
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x104
lea ecx, [esp + 0x30]
push ecx
push 0x60c81c
push str.HTTPHost
push 0x60da74
call esi
cmp dword [0x748e14], ebx
je 0x4c2b23
lea edx, [esp + 0x28]
push edx
push str._WGWIN__HTTPHost:__s
push ebx
call fcn.004f0f30
add esp, 0xc
cmp byte [esp + 0x28], bl
je 0x4c2f70
push ebx
lea eax, [esp + 0x2c]
push 0x6355b4
push eax
mov dword [esp + 0x24], ebx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2b4e
add eax, 3
jmp 0x4c2b50
xor eax, eax
lea eax, [esp + eax + 0x28]
mov edx, 0x748f20
sub edx, eax
jmp 0x4c2b60
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4c2b60
push 0x3a
push 0x748f20
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x4c2b7f
mov byte [eax], bl
mov eax, 0x748f20
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4c2b85
mov ecx, dword [str.:2221]
mov dx, word [0x642114]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 0x18]
push eax
push str.WGWinDownloadFromInternet
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4c2bd6
mov ecx, dword [esp + 0x18]
push ecx
push str.WGWinDownloadFromInternet
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [esp + 0x18], ebx
je 0x4c2bfd
cmp dword [0x748e14], ebx
je 0x4c2bf2
push str._WGWIN__Setting_eScanUpdateServer_to_NULL_as_WGWinDownloadFromInternet1
push ebx
call fcn.004f0f30
add esp, 8
mov byte [0x748f20], bl
jmp 0x4c2f70
push 0x207
lea edx, [esp + 0x131]
push ebx
push edx
mov byte [esp + 0x138], bl
call fcn.005dfd60
add esp, 0xc
push edi
push 0x208
lea eax, [esp + 0x134]
push eax
push 0x60cf3c
push str.NoChangeDwnLink
push 0x60da74
call esi
cmp byte [esp + 0x12c], 0x31
je 0x4c2f70
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x748f20]
mov byte [esp + eax + 0x12c], cl
inc eax
cmp cl, bl
jne 0x4c2c50
push ebx
lea ecx, [esp + 0x130]
push str.:2221
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2f70
push 0x60c81c
lea edx, [esp + 0x130]
push str.http:__
push edx
mov byte [esp + eax + 0x138], bl
call fcn.004e9030
lea eax, [esp + 0x138]
push eax
call fcn.004e1290
lea ecx, [esp + 0x13c]
push ebx
push ecx
call fcn.00508760
mov esi, eax
add esp, 0x18
cmp esi, ebx
jne 0x4c2ceb
cmp dword [0x748e14], ebx
je 0x4c2f70
push ebx
lea edx, [esp + 0x130]
push edx
push str._WGWIN__Tmp:__s__IP:_u_
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x4c2f70
lea eax, [esp + 0x12c]
push 0x748f1c
push eax
call fcn.00508cf0
add esp, 8
mov edi, eax
cmp dword [0x748e14], ebx
je 0x4c2d22
push edi
push esi
lea ecx, [esp + 0x134]
push ecx
push str._WGWIN__Tmp:__s__IP:_u__LocIP:_d_
push ebx
call fcn.004f0f30
add esp, 0x14
cmp edi, 1
je 0x4c2f70
push 0x103
lea edx, [esp + 0x541]
push ebx
push edx
mov byte [esp + 0x548], bl
call fcn.005dfd60
xor eax, eax
push 0x3ff
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov byte [esp + 0x35], al
lea eax, [esp + 0x859]
push ebx
push eax
mov byte [esp + 0x34], bl
mov byte [esp + 0x860], bl
call fcn.005dfd60
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x18
push str.upgr_mmxiv.cdn.bitdefender.net
lea ecx, [esp + 0x540]
push ecx
call esi
push 0x61bed0
lea edx, [esp + 0x20]
push edx
call esi
mov byte [esp + 0x848], bl
cmp dword [0x748e14], ebx
je 0x4c2db2
push str._WGWIN__B__Checking_conn_to_upgr_cloud...
push ebx
call fcn.004f0f30
add esp, 8
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2710
push ebx
push ebx
lea eax, [esp + 0x868]
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x564]
push edx
call fcn.0042c910
add esp, 0x2c
mov esi, eax
cmp dword [0x748e14], ebx
je 0x4c2dfc
lea eax, [esp + 0x848]
push eax
push esi
push str._WGWIN__B__Check_Conn_returns__u___s_
push ebx
call fcn.004f0f30
add esp, 0x10
cmp esi, ebx
je 0x4c2f70
push 0x207
lea ecx, [esp + 0x645]
push ebx
push ecx
mov byte [esp + 0x64c], bl
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x449]
push ebx
push edx
mov byte [esp + 0x450], bl
call fcn.005dfd60
lea eax, [esp + 0x658]
push str.http:__upgr_mmxiv.cdn.bitdefender.net_av32bit_versions.dat
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
call fcn.005dfb23
push ebx
lea ecx, [esp + 0x664]
push str.mmxiii
push ecx
call fcn.004f5880
add esp, 0x2c
cmp eax, 0xffffffff
je 0x4c2e74
mov esi, str.downloader_1.0.30.345_95505_Bitdefender2012__WSLib_1.4__1__0__162__0__
jmp 0x4c2e94
push ebx
lea edx, [esp + 0x644]
push str.mmxiv
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2ea5
mov esi, str.downloader_1.0.30.400_132565_Bitdefender2014__WSLib_1.4__3__0__0__79__
mov ecx, 0x11
lea edi, [esp + 0x438]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp dword [0x748e14], ebx
je 0x4c2ec3
lea eax, [esp + 0x640]
push eax
push str._WGWIN__VURL:_s
push ebx
call fcn.004f0f30
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x43c]
push edx
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x650]
push ebx
push ecx
call fcn.0040fc10
add esp, 0x18
cmp dword [0x748e14], ebx
je 0x4c2f02
mov edx, dword [esp + 0x14]
push edx
push str._WGWIN__ContentSize:_d
push ebx
call fcn.004f0f30
add esp, 0xc
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4c2f44
cmp byte [eax], bl
je 0x4c2f44
push ebx
push str.emalware
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2f40
cmp dword [0x748e14], ebx
je 0x4c2f38
push str._WGWIN__Setting_eScanUpdateServer_to_NULL_as_Connectivity_to_Cloud_detected.
push ebx
call fcn.004f0f30
add esp, 8
mov byte [0x748f20], bl
jmp 0x4c2f5f
mov eax, dword [esp + 0x10]
cmp dword [0x748e14], ebx
je 0x4c2f63
mov eax, dword [esp + 0x14]
push eax
push str._WGWIN__Invalid_Versions.dat_with_ContentSize:_d
push ebx
call fcn.004f0f30
add esp, 0xc
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4c2f70
push eax
call fcn.005e0865
add esp, 4
mov eax, 0x748f20
mov edx, ebp
sub edx, eax
pop esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4c2f80
mov ecx, dword [esp + 0xc44]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0xc3c
ret