Function at 0x426220
Capabilities:
Check if file exists
Create thread
Delete file
Get common file path
Get file attributes
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ea50
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1958
call fcn.004ff310
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x120]
mov esi, dword [ebx + 0x10]
push 0x616398
push 0x61633c
push str.._s_._s
push 0x104
push eax
call fcn.00407c70
add esp, 0x14
lea eax, [ebp - 0x120]
mov ecx, 0x90fe00
push 0x614196
push eax
call fcn.00443700
push str._OrderID_
call fcn.00439c30
add esp, 4
push str._AddInfo_
call fcn.00439c30
add esp, 4
mov ecx, 0x90fe00
push 1
push dword [ebx + 0x14]
push esi
push 0x190
push 0
push 0x90e028
push 0
push edi
call fcn.004405d0
test eax, eax
jne 0x42670f
cmp byte [0x91076c], al
je 0x4262f4
mov byte [0x91076d], 1
cmp dword [0x91593c], 0
jne 0x426307
push 0
call fcn.00503e53
add esp, 4
push 0x4cb2f0
mov dword [0x915938], 0x9965e
call fcn.00503e6e
add esp, 4
mov dword [0x91593c], eax
test eax, eax
je 0x426398
mov edi, dword [0x915938]
xor esi, esi
movsd xmm1, qword [0x617008]
test edi, edi
jle 0x426384
movd xmm2, edi
cvtdq2pd xmm2, xmm2
movsd qword [ebp - 0x1968], xmm2
nop dword [eax + eax]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
divsd xmm0, xmm2
call fcn.00513950
mov eax, dword [0x91593c]
movsd xmm1, qword [0x617008]
movsd xmm2, qword [ebp - 0x1968]
movsd qword [eax + esi*8], xmm0
inc esi
cmp esi, edi
jl 0x426350
movd xmm0, edi
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x915940], xmm1
movaps xmm3, xmmword [0x6172a0]
mov ecx, 4
movaps xmm2, xmmword [0x617320]
mov edx, 0x915db0
lea eax, [ecx - 4]
movq xmm1, xmm3
movd xmm0, eax
lea edx, [edx + 0x40]
pshufd xmm0, xmm0, 0
lea eax, [ecx - 2]
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x50], xmm0
movd xmm0, eax
lea eax, [ecx + 2]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x40], xmm0
movd xmm0, ecx
add ecx, 8
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x30], xmm0
movd xmm0, eax
lea eax, [ecx - 4]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x20], xmm0
cmp eax, 0x1000
jl 0x4263b0
mov edi, 0x1000
nop word [eax + eax]
call fcn.00508ae6
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x617178]
mulsd xmm0, qword [0x617170]
cvttsd2si esi, xmm0
call fcn.00508ae6
movsd xmm1, qword [esi*8 + 0x915da0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x617178]
mulsd xmm0, qword [0x617170]
cvttsd2si eax, xmm0
movsd xmm0, qword [eax*8 + 0x915da0]
movsd qword [esi*8 + 0x915da0], xmm0
movsd qword [eax*8 + 0x915da0], xmm1
sub edi, 1
jne 0x426440
push edi
call fcn.0050d930
add eax, dword [0x915d94]
add esp, 4
mov dword [ebp - 0x1964], edx
and eax, 0x80000fff
jns 0x4264ce
dec eax
or eax, 0xfffff000
inc eax
push 0x103
mov dword [0x915d94], eax
lea eax, [ebp - 0x227]
push 0
push eax
mov byte [ebp - 0x228], 0
call fcn.00500bb0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x228]
add esp, 0xc
push str.WIN.INI
push 0x104
push eax
push 0x614196
push str.Wallpaper
push str.Desktop
call esi
lea ecx, [ebp - 0x228]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426521
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x228]
push eax
push 0xffffffffffffffff
push str.BackupWPPath
call fcn.0042e840
add esp, 0x14
mov byte [ebp - 0x228], 0
lea eax, [ebp - 0x227]
push 0x103
push 0
push eax
call fcn.00500bb0
add esp, 0xc
lea eax, [ebp - 0x228]
push str.SYSTEM.INI
push 0x104
push eax
push 0x614196
push str.SCRNSAVE.EXE
push str.boot
call esi
push 0
lea eax, [ebp - 0x195c]
push eax
push 0
push 0xe
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [ebp - 0x228]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4265a1
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x228]
push eax
push 0xffffffffffffffff
push str.BackupSSPath
call fcn.0042e840
add esp, 0x14
lea eax, [ebp - 0x195c]
push 0
push 4
push eax
push 0xffffffffffffffff
push str.BackupSSTimeout
call fcn.0042e840
add esp, 0x14
call fcn.0041ead0
push 0x910df9
lea eax, [ebp - 0x780]
xor edi, edi
push str._s.zip
push eax
call fcn.00448050
add esp, 0xc
lea ecx, [ebp - 0x780]
call fcn.00448230
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
test al, al
je 0x42666d
lea eax, [ebp - 0x195c]
mov byte [0x915b5e], 0
push eax
push edi
push edi
push 0x428070
push edi
push edi
call esi
test eax, eax
je 0x4266ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x41d8a0
push 0x6b
push dword [0x915d9c]
mov ecx, 0x90fe00
call fcn.0043f010
mov edi, eax
test edi, edi
je 0x42666d
lea ecx, [ebp - 0x780]
mov esi, edi
call fcn.00448110
jmp 0x427066
push 0x616674
push 0x910df9
lea eax, [ebp - 0x1958]
push str._s._s
push eax
call fcn.00448050
add esp, 0x10
lea ecx, [ebp - 0x1958]
call fcn.00448230
test al, al
je 0x426753
lea eax, [ebp - 0x195c]
mov byte [0x915b5e], 0
push eax
push 0
push 0
push 0x427f30
push 0
push 0
call esi
test eax, eax
jne 0x426731
lea ecx, [ebp - 0x1958]
call fcn.00448110
lea ecx, [ebp - 0x780]
call fcn.00448110
mov esi, 3
push esi
push 0
push 0x111
push 0
push 0x66
mov ecx, 0x911330
call fcn.0042f4d0
push eax
push 0
push 0
mov ecx, 0x911330
call fcn.0042f4d0
push eax
push 0
push 0x90fe00
call fcn.00443e50
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x41d8a0
push 0x6b
push dword [0x915d9c]
mov ecx, 0x90fe00
call fcn.0043f010
mov edi, eax
xor edx, edx
mov ecx, 0x616698
mov esi, edi
call fcn.00417380
lea ecx, [ebp - 0x1958]
call fcn.00448110
lea ecx, [ebp - 0x780]
mov dword [ebp - 0x195c], edi
call fcn.00448110
test esi, esi
jne 0x427060
push str._CONVERTDATAFILES
mov ecx, 0x90fe00
call fcn.0043fd00
cmp eax, 0xffffffff
je 0x4267b0
push edi
push 0x614196
push 1
mov ecx, 0x90fe00
call fcn.004434b0
jmp 0x42670f
push str.MS_Shell_Dlg
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x10
call dword [sym.imp.GDI32.dll_CreateFontA]
cmp byte [0x91076c], 0
mov dword [0x91e10c], eax
je 0x426805
cmp byte [0x634508], 0
je 0x426805
mov eax, dword [0x63450c]
test eax, eax
je 0x426805
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004080c0
call fcn.00409640
push str.EarthView.bmp
push 0x910534
push str._s_s
push 0x104
push 0x91e110
call fcn.00407c70
add esp, 0x14
push str.EVScrsvr.bmp
push 0x910534
push str._s_s
push 0x104
push 0x91ded8
call fcn.00407c70
add esp, 0x14
lea eax, [ebp - 0x120]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x120]
push eax
call fcn.0042e540
add esp, 4
lea eax, [ebp - 0x120]
push str.EarthView.scr
push eax
push str._s_s
push 0x104
push 0x91dff0
call fcn.00407c70
add esp, 0x14
push 0x104
push 0x91dff0
push 0x91dff0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call fcn.00410980
test eax, eax
je 0x4268c4
push eax
push 0
push 0x111
push 0
push 0x6a
jmp 0x4266e6
push 0x6156d4
push 0x6156d8
push 0x910534
push str._s_s._s
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.00407c70
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x228]
add esp, 0x18
push eax
call esi
push 0x6156f8
push 0x6156d8
push 0x910534
push str._s_s._s
mov edi, eax
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.00407c70
add esp, 0x18
lea eax, [ebp - 0x228]
push eax
call esi
cmp eax, 0xffffffff
je 0x42693a
xor esi, esi
cmp edi, 0xffffffff
jne 0x4269a1
lea eax, [ebp - 0x195c]
mov byte [0x915b5e], 0
push eax
push 0
push 0
push 0x428250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x426973
mov esi, 3
push esi
push eax
push 0x111
push eax
push 0x6a
jmp 0x4266e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x41d8a0
push 0x6b
push dword [0x915d9c]
mov ecx, 0x90fe00
call fcn.0043f010
xor edx, edx
mov ecx, 0x616698
mov esi, eax
call fcn.00417380
test esi, esi
je 0x4269b6
push esi
push 0
push 0x111
push 0
push 0x6a
jmp 0x4266e6
lea ecx, [ebp - 0xc98]
call fcn.00407270
push 0
push 3
push 0x614348
push 0x12c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
lea ecx, [ebp - 0xc98]
call fcn.00487090
lea ecx, [ebp - 0xc98]
call fcn.00485b80
test al, al
je 0x426ff0
lea ecx, [ebp - 0xc98]
xor edi, edi
call fcn.00485b30
lea ecx, [ebp - 0xc98]
mov dword [0x91dfec], eax
call fcn.004859f0
mov dword [0x91dfe8], eax
imul eax, dword [0x91dfec]
push eax
call fcn.00503e6e
add esp, 4
mov dword [0x91ded0], eax
test eax, eax
je 0x426ff0
mov eax, dword [0x91dfe8]
xor edx, edx
mov dword [ebp - 0x195c], edx
test eax, eax
jle 0x426a91
mov ecx, dword [0x91dfec]
nop dword [eax]
xor esi, esi
test ecx, ecx
jle 0x426a86
sub eax, edx
lea ecx, [ebp - 0xc98]
dec eax
push eax
push esi
call fcn.004852d0
mov ecx, dword [0x91ded0]
inc esi
mov edx, dword [ebp - 0x195c]
mov byte [ecx + edi], al
inc edi
mov ecx, dword [0x91dfec]
mov eax, dword [0x91dfe8]
cmp esi, ecx
jl 0x426a56
inc edx
mov dword [ebp - 0x195c], edx
cmp edx, eax
jl 0x426a50
lea ecx, [ebp - 0xc98]
call fcn.00488800
cmp byte [0x634514], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
je 0x426ab7
push 0x91e110
call esi
cmp eax, 0xffffffff
jne 0x426acb
mov ecx, 0x91e110
call fcn.00406100
mov edi, eax
test edi, edi
jne 0x426f03
cmp byte [0x634514], 0
je 0x426ae0
push 0x91ded8
call esi
cmp eax, 0xffffffff
jne 0x426af4
mov ecx, 0x91ded8
call fcn.00406100
mov edi, eax
test edi, edi
jne 0x426f03
call fcn.0042c570
test al, al
je 0x426b09
mov eax, dword [0x91f96c]
mov byte [eax + 0x88], 1
mov eax, dword [0x91f96c]
cmp byte [eax + 0x88], 0
je 0x426b38
lea eax, [ebp - 0x195c]
push eax
push 0
push 1
push 0x42c640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042c730
test al, al
je 0x426b4d
mov eax, dword [0x91f958]
mov byte [eax + 0x88], 1
mov eax, dword [0x91f958]
cmp byte [eax + 0x88], 0
je 0x426b65
mov ecx, 1
call fcn.0042c7f0
push 0
push 0
push 0
push 0
push 0x10000400
push 0
push 0
push 0
mov ecx, 0x911330
call fcn.0042f4d0
push eax
push 0x425640
push 0
mov ecx, 0x90fe00
call fcn.0043d8b0
mov edi, eax
test edi, edi
jns 0x426ba4
mov edi, 0x32
jmp 0x426f03
mov eax, dword [0x911520]
sub esp, 8
mov ecx, 0x90fe00
mov eax, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
mov eax, dword [eax]
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa6
mov dword [0x91dfe4], eax
call fcn.0043cf90
cmp eax, 0xffffffff
jne 0x426bf3
lea edi, [eax + 0x33]
jmp 0x426f03
sub esp, 8
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa4
call fcn.0043cf90
cmp eax, 0xffffffff
jne 0x426c34
lea edi, [eax + 0x33]
jmp 0x426f03
sub esp, 8
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa2
call fcn.0043cf90
cmp eax, 0xffffffff
jne 0x426c75
lea edi, [eax + 0x33]
jmp 0x426f03
sub esp, 8
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa1
call fcn.0043cf90
cmp eax, 0xffffffff
jne 0x426cb6
lea edi, [eax + 0x33]
jmp 0x426f03
sub esp, 8
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0xc0
push 1
push 0xfa0
call fcn.0043cf90
cmp eax, 0xffffffff
jne 0x426cf7
lea edi, [eax + 0x33]
jmp 0x426f03
sub esp, 8
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa5
call fcn.0043cf90
cmp eax, 0xffffffff
jne 0x426d38
lea edi, [eax + 0x33]
jmp 0x426f03
sub esp, 8
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x40080
push 3
push 0x44c
call fcn.0043cf90
cmp eax, 0xffffffff
je 0x426efe
mov esi, 1
nop word [eax + eax]
sub esp, 8
lea eax, [esi + 0x44c]
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x40080
push 1
push eax
call fcn.0043cf90
cmp eax, 0xffffffff
je 0x426efe
inc esi
cmp esi, 0x10
jle 0x426d80
sub esp, 8
mov ecx, 0x90fe00
mov dword [esp + 4], 0
mov dword [esp], 0
push 0x90d340
push 0xffff
push 0
push 0x80
push 3
push 0x3e8
call fcn.0043cf90
cmp eax, 0xffffffff
jne 0x426e06
lea edi, [eax + 0x33]
jmp 0x426f03
cmp byte [0x634510], 0
jne 0x426e18
mov byte [0x91076d], 1
jmp 0x426e5b
cmp byte [0x91076d], 0
jne 0x426e5b
cmp byte [0x91076c], 0
jne 0x426e5b
push 0
push 0x422230
push 0
push 0x6c
push dword [0x90fe00]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x915d9c], eax
test eax, eax
jne 0x426e52
lea edi, [eax + 0x32]
jmp 0x426f03
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x634513], 0
je 0x426e6c
or ecx, 0xffffffff
call fcn.004212f0
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x4d2
push 0x83ff
push dword [0x91dfe4]
call esi
push 0
push 0x4d2
push 0x7e
push dword [0x91dfe4]
call esi
mov eax, dword [0x91f96c]
cmp byte [eax + 0x88], 0
je 0x426ef2
push 0
call fcn.0050d930
mov ecx, dword [0x91f96c]
add esp, 4
mov esi, edx
sub eax, dword [ecx + 0x80]
mov dword [ebp - 0x195c], eax
sbb esi, dword [ecx + 0x84]
mov ecx, dword [ecx + 0x94]
mov eax, ecx
shl eax, 4
sub eax, ecx
shl eax, 2
cdq
cmp esi, edx
jl 0x426ef2
jg 0x426ee8
cmp dword [ebp - 0x195c], eax
jbe 0x426ef2
mov dword [0x91e21c], 1
mov ecx, 0x90fe00
call fcn.00443520
jmp 0x426f03
mov edi, 0xf00b
call fcn.004221b0
lea eax, [ebp - 0x1964]
push eax
push 0
push 0
push 0x42c640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.0042c7f0
push 0x910534
lea eax, [ebp - 0x12f8]
push str._s.tmp
push eax
call fcn.00448050
add esp, 0xc
lea ecx, [ebp - 0x12f8]
call fcn.00448230
test al, al
je 0x426f7d
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea ecx, [ebp - 0x12f8]
call fcn.00448140
push eax
call esi
lea ecx, [ebp - 0x12f8]
call fcn.00448230
test al, al
jne 0x426f60
mov eax, dword [0x91e10c]
test eax, eax
je 0x426f8d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0xfffffffe
call fcn.004212f0
mov eax, dword [0x91ded0]
test eax, eax
je 0x426fa9
push eax
call fcn.00503e53
add esp, 4
test edi, edi
je 0x426fe5
push edi
push 0
push 0x111
push 0
push 0xf003
mov ecx, 0x911330
call fcn.0042f4d0
push eax
push 0
push 0
mov ecx, 0x911330
call fcn.0042f4d0
push eax
push 0
push 0x90fe00
call fcn.00443e50
add esp, 0x1c
lea ecx, [ebp - 0x12f8]
call fcn.00448110
mov eax, dword [ebp - 0x790]
mov dword [ebp - method.CImage.virtual_0], vtable.CImage.0
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x788], 0
test eax, eax
je 0x42702a
cmp byte [ebp - 0x784], 0
jne 0x42702a
push eax
call fcn.00503e53
add esp, 4
mov dword [ebp - 0x790], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xc98]
mov dword [ebp - method.CxImage.virtual_0], vtable.CxImage.0
call fcn.004888c0
lea ecx, [ebp - 0xc98]
call fcn.00488800
jmp 0x42670f
mov esi, dword [ebp - 0x195c]
cmp edi, 0x1a
jne 0x4266da
mov ecx, 0x90fe00
call fcn.004429b0
test eax, eax
jne 0x4266da
push eax
push str._CONVERTDATAFILES
push 2
mov ecx, 0x90fe00
call fcn.004434b0
jmp 0x42670f