Function at 0x448ada
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x270
mov eax, 0x527bc7
call fcn.004fc737
mov eax, dword [ebp + 8]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x44919b
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264], eax
and dword [ebp - 4], 0
mov edi, 0x400
lea eax, [ebp - 0x264]
mov dword [ebp - 0x258], 2
call fcn.00428e31
lea edi, [ebp - 0x25c]
mov ebx, eax
mov byte [ebp - 0x251], 1
call fcn.00404523
mov eax, dword [eax]
push str.config.ini
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.00405521
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebx
call esi
test eax, eax
jne 0x448bbe
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x400
push ebx
push eax
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x547b94
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
call esi
test eax, eax
jne 0x448bbe
push 0x400
push ebx
push eax
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...config.ini
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
call esi
test eax, eax
jne 0x448bbe
mov byte [ebp - 0x251], al
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x25c], eax
mov edi, 0x80
lea eax, [ebp - 0x25c]
mov byte [ebp - 4], 1
call fcn.00428e31
cmp byte [ebp - 0x251], 1
mov ebx, 0x5481bc
jne 0x448c15
push dword [ebp - 0x264]
push edi
push eax
push 0x53a3d8
push str.language
push 0x547bc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x448c22
push ebx
lea eax, [ebp - 0x25c]
push eax
call fcn.004056c8
lea eax, [ebp - 0x25c]
call fcn.00426eb2
mov esi, dword [ebp - 0x25c]
push str.zh_tw
push esi
call fcn.004f52b9
pop ecx
pop ecx
push 7
pop edi
test eax, eax
je 0x448ea1
push 0x54ab18
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448ea1
push str.zh_cn
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e98
push 0x54ab20
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e98
push 0x54ab28
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e8c
push ebx
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e8c
push 0x549f4c
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e84
push 0x54ab30
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e84
push str.pt_br
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e78
push 0x54bb68
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e78
push str.es_419
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e6c
push 0x54bb70
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e6c
push 0x54bb78
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e60
push 0x54ab54
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e60
push 0x549f44
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448d78
mov dword [ebp - 0x258], 0xb
jmp 0x448eab
push 0x54bb50
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448d98
mov dword [ebp - 0x258], 0xc
jmp 0x448eab
push 0x549f3c
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448db8
mov dword [ebp - 0x258], 0xd
jmp 0x448eab
push 0x54ab5c
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448dd8
mov dword [ebp - 0x258], 0xe
jmp 0x448eab
mov ebx, 0x54bb80
push ebx
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x448e17
push 0x54bb48
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448e0a
mov dword [ebp - 0x258], 0x10
jmp 0x448eab
push ebx
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448e26
mov dword [ebp - 0x258], 0xf
jmp 0x448eab
push 0x54bb60
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448e43
mov dword [ebp - 0x258], 3
jmp 0x448eab
push 0x54bb58
push esi
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x448eab
mov dword [ebp - 0x258], 0x11
jmp 0x448eab
mov dword [ebp - 0x258], 8
jmp 0x448eab
mov dword [ebp - 0x258], 9
jmp 0x448eab
mov dword [ebp - 0x258], 0xa
jmp 0x448eab
mov dword [ebp - 0x258], edi
jmp 0x448eab
mov dword [ebp - 0x258], 2
jmp 0x448eab
and dword [ebp - 0x258], 0
jmp 0x448eab
mov dword [ebp - 0x258], 1
or eax, 0xffffffff
lea esi, [ebp - 0x264]
call fcn.00428e0c
or eax, 0xffffffff
lea esi, [ebp - 0x25c]
call fcn.00428e0c
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], edi
mov word [ebp - 0x230], ax
and dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], edi
mov word [ebp - 0x24c], ax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x258]
cmp eax, 0x12
ja case.0x448eff.2
jmp dword [eax*4 + 0x4491a6]
mov esi, 0x54ab68
push esi
call fcn.004f192a
pop ecx
push esi
lea esi, [ebp - 0x234]
call fcn.00404d75
mov esi, 0x54abc8
jmp 0x448f96
mov esi, 0x54abd8
jmp 0x448f7e
mov esi, 0x54ad88
jmp 0x448f7e
mov esi, str.Os_arquivos_do_360_Total_Security_foram_danificados.__nReinstale_o_360_Total_Security_e_fa
jmp 0x448f7e
mov esi, str.360_Total_Security_dosyalar
jmp 0x448f7e
mov esi, str.Los_archivos_de_360_Total_Security_han_sido_da
jmp 0x448f7e
mov esi, 0x54b288
jmp 0x448f7e
mov esi, str.360_Total_Security_____.__n360_Total_Security___________.__n_:
jmp 0x448f7e
mov esi, 0x54b498
jmp 0x448f7e
mov esi, 0x54b548
jmp 0x448f7e
mov esi, str.Les_fichiers_de_360_Total_Security_ont
jmp 0x448f7e
mov esi, str.I_file_di_360_Total_Security_sono_stati_danneggiati._nReinstalla_360_Total_Security_e_avvia_una_scansione_dei_virus._nDocumenti_danneggiati:
jmp 0x448f7e
mov esi, str.Pliki_aplikacji_360_Total_Security_zosta
jmp 0x448f7e
mov esi, str.360_Total_Security_files_have_been_damaged.__nPlease_reinstall_360_Total_Security_and_scan_for_viruses.__nDamaged_documents:
push esi
call fcn.004f192a
pop ecx
push esi
lea esi, [ebp - 0x234]
call fcn.00404d75
mov esi, 0x54ac64
push esi
call fcn.004f192a
pop ecx
push esi
lea esi, [ebp - 0x250]
call fcn.00404d75
push dword [ebp - 0x260]
lea eax, [ebp - 0x234]
push eax
call fcn.0040160e
cmp dword [ebp - 0x21c], 8
mov ebx, dword [ebp - 0x230]
jae 0x448fd0
lea ebx, [ebp - 0x230]
cmp dword [ebp - 0x238], 8
mov edi, dword [ebp - 0x24c]
jae 0x448fe5
lea edi, [ebp - 0x24c]
push 0x14
push edi
push ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
call esi
mov byte [ebp - 0x251], 0
cmp eax, 6
je 0x449014
test eax, eax
jne 0x449020
push 0x14
push edi
push ebx
push eax
call esi
cmp eax, 6
jne 0x449020
call fcn.004491f2
mov byte [ebp - 0x251], 1
push ecx
mov eax, esp
mov dword [ebp - 0x268], esp
xor edi, edi
push str.UserExperience
inc edi
push eax
mov dword [ebp - 0x258], edi
lea esi, [ebp - 0x258]
xor ebx, ebx
call fcn.004056ee
push ecx
mov eax, esp
mov dword [ebp - 0x26c], esp
push str.SOFTWARE360TotalSecurityExperience
push eax
mov byte [ebp - 4], 4
call fcn.004056ee
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x27c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0040499a
push eax
call fcn.004047a8
pop ecx
lea esi, [ebp - 0x27c]
call fcn.00401105
cmp dword [ebp - 0x258], ebx
je 0x449165
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004f18b0
push 0xffffffffffffffff
push dword [ebp - 0x260]
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004f74db
add esp, 0x1c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
xor eax, eax
cmp ax, word [ebp - 0x218]
je 0x449165
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 5
mov eax, 0x54ba14
cmp byte [ebp - 0x251], bl
jne 0x449111
mov eax, 0x54ba18
push dword [0x594590]
push dword [0x59458c]
push dword [0x594588]
push dword [0x594584]
push dword [0x59457c]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [0x5945f8]
lea eax, [ebp - 0x260]
push str._snosign.htm_f_sre_smid_sver_slan_sos_sch_s
push eax
call fcn.0040450f
mov esi, dword [ebp - 0x260]
push esi
call fcn.004ba045
add esp, 0x2c
lea eax, [esi - 0x10]
call fcn.00405521
push ebx
push edi
lea esi, [ebp - 0x250]
call fcn.00404e29
push ebx
push edi
lea esi, [ebp - 0x234]
call fcn.00404e29
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.00405521
call fcn.004fc7ba
ret 4