Function at 0x4259f0
Capabilities:
Check if file exists
Get common file path
Get disk information
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536938
mov eax, dword fs:[0]
push eax
mov eax, 0x34c4
call fcn.004b0a90
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34b8], ecx
lea ecx, [ebp - 0x20]
call fcn.00403840
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
call fcn.00401800
add esp, 4
test eax, eax
jne 0x425a83
cmp dword [0x58fb50], 0
je 0x425a5f
push str.b_rN0R_g
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x3488], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x3488]
jmp 0x426417
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401e10
mov byte [ebp - 4], 1
push str.360sd.exe
lea ecx, [ebp - 0x20]
call fcn.00401990
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x425afe
cmp dword [0x58fb50], 0
je 0x425ace
push 0x5430c0
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x348c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x348c]
jmp 0x426417
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
call fcn.00401c70
add esp, 4
test eax, eax
jne 0x425b5e
cmp dword [0x58fb50], 0
je 0x425b2e
push 0x543098
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x3490], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x3490]
jmp 0x426417
push 0x541310
lea ecx, [ebp - 0x3494]
call fcn.0040ca10
mov byte [ebp - 4], 2
push 0x541310
lea ecx, [ebp - 0x3498]
call fcn.0040ca10
mov byte [ebp - 4], 3
lea edx, [ebp - 0x3494]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3498]
push ecx
lea edx, [ebp - 0x349c]
push edx
call fcn.00409f40
add esp, 0xc
mov dword [ebp - 0x34bc], eax
mov eax, dword [ebp - 0x34bc]
mov dword [ebp - 0x34c0], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x34c0]
push ecx
lea edx, [ebp - 0x34a0]
push edx
call fcn.00409f40
add esp, 0xc
mov dword [ebp - 0x34c4], eax
mov eax, dword [ebp - 0x34c4]
mov dword [ebp - 0x34c8], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x34c8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401970
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x34a0]
call fcn.00401eb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x349c]
call fcn.00401eb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3498]
call fcn.00401eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3494]
call fcn.00401eb0
lea ecx, [ebp - 0x10]
call fcn.00403840
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00403840
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
call fcn.0048a0b0
mov byte [ebp - 4], 8
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0048d170
test eax, eax
jne 0x425cd7
cmp dword [0x58fb50], 0
je 0x425c83
push 0x543070
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x34a4], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
call fcn.0048a0e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00401eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x34a4]
jmp 0x426417
cmp dword [ebp + 8], 0
jne 0x425d4d
push str.2.0.0.0
lea ecx, [ebp - 0x24]
call fcn.00401ef0
test eax, eax
jge 0x425d2d
lea ecx, [ebp - 0x28]
call fcn.00403840
mov byte [ebp - 4], 9
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0048dad0
test eax, eax
je 0x425d1f
mov ecx, dword [ebp - 0x28]
push ecx
push str._sysmenu___s_
lea edx, [ebp - 0x10]
push edx
call fcn.00409170
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.00401eb0
jmp 0x425d48
mov eax, dword [ebp - 0x34b8]
mov ecx, dword [eax + 4]
push ecx
push str._hwnd_d
lea edx, [ebp - 0x10]
push edx
call fcn.00409170
add esp, 0xc
jmp 0x426092
push str.3.1.0.0
lea ecx, [ebp - 0x24]
call fcn.00401ef0
test eax, eax
jge 0x426077
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x3250], 0x104
xor eax, eax
mov word [ebp - 0x324c], ax
push 0x1ffe
push 0
lea ecx, [ebp - 0x324a]
push ecx
call fcn.004b0ac0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1244], dx
push 0x206
push 0
lea eax, [ebp - 0x1242]
push eax
call fcn.004b0ac0
add esp, 0xc
lea ecx, [ebp - 0x1244]
push ecx
mov edx, dword [ebp - 0x3250]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x1038], eax
cmp dword [ebp - 0x1038], 0
jbe 0x425de5
mov eax, dword [ebp - 0x1038]
cmp eax, dword [ebp - 0x3250]
jbe 0x425e4b
push 0x542ff8
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x34a8], 0x80004005
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
call fcn.0048a0e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00401eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x34a8]
jmp 0x426417
lea ecx, [ebp - 0x324c]
push ecx
push 0
push 0
lea edx, [ebp - 0x1244]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x1038], eax
cmp dword [ebp - 0x1038], 0
jne 0x425ed8
push 0x542fd0
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x34ac], 0x80004005
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
call fcn.0048a0e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00401eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x34ac]
jmp 0x426417
lea eax, [ebp - 0x324c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401e30
mov byte [ebp - 4], 0xa
xor ecx, ecx
mov word [ebp - 0x1034], cx
push 0xffe
push 0
lea edx, [ebp - 0x1032]
push edx
call fcn.004b0ac0
add esp, 0xc
lea eax, [ebp - 0x1034]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x1248], eax
mov dword [ebp - 0x124c], 0
push 0x540868
lea ecx, [ebp - 0x30]
call fcn.00401e30
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1034]
mov dword [ebp - 0x3254], ecx
jmp 0x425f6a
mov edx, dword [ebp - 0x3254]
push edx
call fcn.004b0eb7
add esp, 4
mov ecx, dword [ebp - 0x3254]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x3254], edx
mov eax, dword [ebp - 0x3254]
movzx ecx, word [eax]
test ecx, ecx
je 0x426048
mov edx, dword [ebp - 0x3254]
push edx
lea ecx, [ebp - 0x325c]
call fcn.00401e30
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x325c]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x3258], eax
cmp dword [ebp - 0x3258], 3
je 0x425fd8
cmp dword [ebp - 0x3258], 6
je 0x425fd8
cmp dword [ebp - 0x3258], 2
je 0x425fd8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x325c]
call fcn.00401eb0
jmp 0x425f4b
mov eax, dword [ebp - 0x124c]
mov dword [ebp - 0x34cc], eax
mov ecx, dword [ebp - 0x34cc]
push ecx
push 0x542fc8
lea edx, [ebp - 0x30]
push edx
call fcn.00409170
add esp, 0xc
mov eax, dword [ebp - 0x124c]
add eax, 1
mov dword [ebp - 0x124c], eax
lea ecx, [ebp - 0x2c]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x325c]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x30]
call fcn.0043e290
push eax
push 0x5409f0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x325c]
call fcn.00401eb0
jmp 0x425f4b
mov ecx, dword [ebp - 0x2c]
push ecx
push str._sysmenu___s_
lea edx, [ebp - 0x10]
push edx
call fcn.00409170
add esp, 0xc
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x30]
call fcn.00401eb0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2c]
call fcn.00401eb0
jmp 0x426092
mov eax, dword [ebp - 0x34b8]
mov ecx, dword [eax + 4]
push ecx
push str._hwnd_d__full
lea edx, [ebp - 0x10]
push edx
call fcn.00409170
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00402010
movzx eax, al
test eax, eax
jne 0x4263ad
mov dword [ebp - 0x3264], 0
mov dword [ebp - 0x3260], 0
mov dword [ebp - 0x3268], 0
push 0
push str.Q360SDClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x3264], eax
cmp dword [ebp - 0x3264], 0
jne 0x426198
push str.360sdrun.exe
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x326c]
push edx
call fcn.00403700
add esp, 0xc
mov byte [ebp - 4], 0xd
push 1
push 1
lea ecx, [ebp - 0x326c]
call fcn.0043e290
push eax
push str.360sdrun.exe
call fcn.00492e20
add esp, 0x10
mov dword [ebp - 0x3270], eax
cmp dword [ebp - 0x3270], 0
je 0x426144
push 0
mov eax, dword [ebp - 0x3270]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x3270], 0
push 0
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
push 0
lea ecx, [ebp - 0x326c]
call fcn.0043e290
push eax
push str.open
push 0
call fcn.00428ad0
add esp, 0x18
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3268]
add ecx, 0x1f4
mov dword [ebp - 0x3268], ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x326c]
call fcn.00401eb0
cmp dword [ebp - 0x3264], 0
jne 0x4261b1
cmp dword [ebp - 0x3268], 0x2710
jb 0x4260c3
push 0
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
push str.open
push 0
call fcn.00428ad0
add esp, 0x18
mov dword [ebp - 0x3260], eax
cmp dword [ebp - 0x3260], 0x20
ja 0x426203
push 0x542f50
push 0x58f750
call fcn.004045b0
add esp, 8
jmp 0x4263ab
xor edx, edx
cmp dword [ebp + 8], 0
setne dl
mov eax, dword [ebp - 0x34b8]
mov dword [eax + 0x2490], edx
push 0x540868
lea ecx, [ebp - 0x3274]
call fcn.00401e30
mov byte [ebp - 4], 0xe
push 0x540868
lea ecx, [ebp - 0x3278]
call fcn.00401e30
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x34b8]
cmp dword [ecx + 0x2490], 1
jne 0x426271
push str.examstarted0examdone0sdstarted0sddone0fullsdstarted1fullsddone0
lea ecx, [ebp - 0x3274]
call fcn.00401ed0
push str.SDALL
lea ecx, [ebp - 0x3278]
call fcn.00401ed0
jmp 0x4262a0
mov edx, dword [ebp - 0x34b8]
cmp dword [edx + 0x2490], 0
jne 0x4262a0
push str.examstarted0examdone0sdstarted1sddone0fullsdstarted0fullsddone0
lea ecx, [ebp - 0x3274]
call fcn.00401ed0
push 0x542d44
lea ecx, [ebp - 0x3278]
call fcn.00401ed0
lea ecx, [ebp - 0x3274]
call fcn.00402010
movzx eax, al
test eax, eax
jne 0x4262db
push ecx
mov ecx, esp
mov dword [ebp - 0x34b0], esp
lea edx, [ebp - 0x3274]
push edx
call fcn.00401e10
mov dword [ebp - 0x34d0], eax
mov ecx, dword [ebp - 0x34b8]
add ecx, 0x2c
call fcn.004a0110
lea ecx, [ebp - 0x3278]
call fcn.00402010
movzx eax, al
test eax, eax
jne 0x42638d
xor ecx, ecx
mov word [ebp - 0x3484], cx
push 0x206
push 0
lea edx, [ebp - 0x3482]
push edx
call fcn.004b0ac0
add esp, 0xc
push str.EntClientExamCmd.dat
lea eax, [ebp - 0x327c]
push eax
call fcn.0041acc0
add esp, 8
lea ecx, [ebp - 0x327c]
call fcn.0043e290
push eax
push 0x103
lea ecx, [ebp - 0x3484]
push ecx
push 0x540868
push str.LastRecieve
lea ecx, [ebp - 0x3278]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x327c]
call fcn.0043e290
push eax
lea edx, [ebp - 0x3484]
push edx
push str.LastDone
lea ecx, [ebp - 0x3278]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x327c]
call fcn.00401eb0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x3278]
call fcn.00401eb0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x3274]
call fcn.00401eb0
jmp 0x4263c8
cmp dword [0x58fb50], 0
je 0x4263c8
push 0x542df8
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x34b4], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
call fcn.0048a0e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00401eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x34b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret 4