Function at 0x404351
Capabilities:
Check if file exists
Get common file path
Read .ini file
Set current directory
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xd8
push esi
push dword [0x407034]
xor esi, esi
push dword [0x407030]
mov dword [ebp + 0x64], esi
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40437f
xor eax, eax
jmp 0x4046b9
push ebx
push edi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, dword [ebp + 0x70]
mov edi, 0x7f00
push edi
push esi
mov dword [ebp + 0x3c], 3
mov dword [ebp + 0x40], 0x40409a
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
push esi
mov dword [ebp + 0x50], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp + 0x54], eax
mov eax, dword [str.ATMSHELL]
mov dword [ebp + 0x60], eax
lea eax, [ebp + 0x3c]
push eax
mov dword [ebp + 0x58], 6
mov dword [ebp + 0x5c], esi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x40441e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
push ebx
push esi
push esi
push 0x1e0
push 0x280
push esi
push esi
push 0x80000000
push dword [0x407034]
push dword [0x407030]
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, eax
cmp edi, esi
jne 0x404426
xor eax, eax
inc eax
jmp 0x4046b7
push 0xa
push edi
mov dword [0x4075a8], edi
call dword [sym.imp.DWNDHAND.DLL__nDllWndHandSetWndHand_8]
call fcn.00401981
push 0x408060
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
call fcn.00401c2b
mov dword [esp], str.C:DataSpservice.dat
push 0x80
lea eax, [ebp - 0x70]
push eax
push 0x4055ab
push str.ErrCode
push str.ErrInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40449a
lea eax, [ebp - 0x70]
mov dword [0x407040], eax
call fcn.00403fb1
mov dword [0x4072e4], 1
jmp 0x404668
push edi
call fcn.0040293c
cmp eax, 1
pop ecx
jne 0x4044b0
call fcn.00403fb1
jmp 0x404668
push 0x100
push 0x4080a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4057a0
mov edi, str.C:BK1
push edi
call fcn.00401d4a
test al, al
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
pop ecx
pop ecx
je 0x404506
call fcn.0040216e
push str.C:BK1WindowsAtmreg.inf
call ebx
push edi
mov dword [ebp + 0x70], eax
call fcn.00401f1c
cmp dword [ebp + 0x70], esi
pop ecx
je 0x404506
call fcn.004021ab
call fcn.00403fb1
jmp 0x4045fb
push edi
call ebx
test eax, eax
je 0x404526
mov dword [0x407040], 0x405b70
call fcn.00403fb1
mov dword [0x4072e4], 1
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.atm.ini
push esi
mov ebx, str.TraceMonStatus
push ebx
mov edi, str.TRACEMONSET
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
je 0x404553
call fcn.00402b6d
push str.ATM.INI
push 0x405b48
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call edi
call fcn.004020ae
mov dword [0x408058], esi
call fcn.00402fa6
cmp dword [0x407580], esi
jne 0x40463c
call fcn.00402d76
test eax, eax
je 0x40463c
call fcn.00402754
cmp dword [0x407afc], esi
jne 0x4045ce
call fcn.00402821
xor ecx, ecx
inc ecx
cmp ax, cx
jne 0x404637
call fcn.00402620
cmp ax, 3
je 0x404603
push 0x407570
push 0x407e48
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test ax, ax
jne 0x404619
cmp dword [0x4072e4], esi
jne 0x404668
mov dword [ebp + 0x64], 1
call fcn.00403fb1
cmp dword [0x4072e4], esi
jne 0x404668
call fcn.0040405e
test eax, eax
je 0x404684
push esi
push 1
call fcn.00403ac5
push str.ATM.INI
push 0x4057ac
push str.SetupStatus
push str.ATM_Setup
call edi
call fcn.00403fb1
call fcn.00403ab1
call fcn.00402513
cmp dword [0x4072e4], esi
jne 0x404668
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp + 0x64], ecx
jmp 0x4045e1
cmp dword [0x407580], 1
jne 0x404619
call fcn.00403fb1
call fcn.00402499
cmp dword [0x4072e4], esi
jne 0x404668
cmp word [ebp + 0x64], 1
jne 0x404668
mov dword [0x40825c], 1
xor eax, eax
cmp dword [0x4072e4], 1
setne al
dec eax
push eax
call fcn.00402871
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
pop ecx
jmp 0x4046a7
cmp dword [0x4072e4], esi
jne 0x404668
call fcn.004021f2
jmp 0x40464f
lea eax, [ebp + 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
lea eax, [ebp + 0x20]
push esi
push eax
call edi
test eax, eax
jne 0x404693
mov eax, dword [ebp + 0x28]
pop edi
pop ebx
pop esi
add ebp, 0x68
leave
ret 0x10