Function at 0x409880
Capabilities:
Check if file exists
Create process on windows
Get common file path
Read .ini file

Disassembly:
sub esp, 0x4c0
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x4bc], eax
push 0x103
lea eax, [esp + 0x2b9]
push 0
push eax
mov byte [esp + 0x2c0], 0
call fcn.0042eb30
push 0x103
lea ecx, [esp + 0x3c9]
push 0
push ecx
mov byte [esp + 0x3d0], 0
call fcn.0042eb30
lea edx, [esp + 0x2cc]
push edx
call fcn.00407530
add esp, 0x1c
mov ecx, 0x45b5a5
lea eax, [esp + 0x2b4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409908
test dl, dl
je 0x409904
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409908
add eax, 2
add ecx, 2
test dl, dl
jne 0x4098e8
xor eax, eax
jmp 0x40990d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x409966
push eax
push 0x23
lea eax, [esp + 0x2bc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x2b4]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409930
mov ecx, dword [str.Net_Protector]
mov edx, dword [0x45bcac]
mov dword [eax], ecx
mov ecx, dword [0x45bcb0]
mov dword [eax + 4], edx
mov dx, word [0x45bcb4]
mov dword [eax + 8], ecx
mov cl, byte [0x45bcb6]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
lea eax, [esp + 0x2b4]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409970
mov edx, dword [str.UpdSet.ini]
mov ecx, dword [0x45c0d0]
mov dword [eax], edx
mov edx, dword [0x45c0d4]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x2b4]
push eax
push 0x104
lea ecx, [esp + 0x3c0]
push ecx
push 0x45be70
push str.LASTUPDTIME
push str.STATUS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x3b8]
push edx
call fcn.00409190
add esp, 4
cmp eax, 7
jl 0x409c25
push 0x104
lea eax, [esp + 0x1b4]
push 0
push eax
call fcn.0042eb30
lea ecx, [esp + 0x1bc]
push ecx
call fcn.004075a0
lea eax, [esp + 0x1c0]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409a03
sub eax, edx
je 0x409c25
lea edx, [esp + 0x1b0]
push edx
call fcn.004303aa
lea eax, [esp + 0x1b4]
push str.ZVSCAN
push eax
call fcn.0042f090
add esp, 0xc
test eax, eax
je 0x409a3b
mov byte [eax], 0
lea eax, [esp + 0x1b0]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a43
mov ecx, dword [str.NPAVUPD.EXE]
mov edx, dword [0x45c0ac]
mov dword [eax], ecx
mov ecx, dword [0x45c0b0]
mov dword [eax + 4], edx
mov dl, byte [0x45c0b4]
mov dword [eax + 8], ecx
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov byte [eax + 0xc], dl
lea eax, [esp + 0x1b4]
push eax
call ebx
test eax, eax
je 0x409c24
push edi
lea edi, [esp + 0x1b8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409a90
mov ecx, dword [0x45c0a4]
push esi
push 0x44
lea edx, [esp + 0x78]
push 0
push edx
mov dword [edi], ecx
call fcn.0042eb30
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x78]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x1dc]
push edx
push 0
mov dword [esp + 0x9c], 0x44
call esi
test eax, eax
jne 0x409c22
push 0x104
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.0042eb30
lea ecx, [esp + 0xc4]
push ecx
call fcn.004075a0
lea eax, [esp + 0xc8]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409b30
sub eax, edx
je 0x409c22
lea edx, [esp + 0xb8]
push edx
call fcn.004303aa
lea eax, [esp + 0xbc]
push str.ZVSCAN
push eax
call fcn.0042f090
add esp, 0xc
test eax, eax
je 0x409b68
mov byte [eax], 0
lea eax, [esp + 0xb8]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409b70
mov ecx, dword [str.UPDATE_NP2005.EXE]
mov edx, dword [0x45c094]
mov dword [eax], ecx
mov ecx, dword [0x45c098]
mov dword [eax + 4], edx
mov edx, dword [0x45c09c]
mov dword [eax + 8], ecx
mov cx, word [0x45c0a0]
mov dword [eax + 0xc], edx
mov dl, byte [0x45c0a2]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
lea eax, [esp + 0xb8]
push eax
call ebx
test eax, eax
je 0x409c22
lea edi, [esp + 0xb8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409bc5
mov ecx, dword [0x45c0a4]
push 0x44
lea edx, [esp + 0x34]
push 0
push edx
mov dword [edi], ecx
call fcn.0042eb30
add esp, 0xc
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xd8]
push edx
push 0
mov dword [esp + 0x58], 0x44
call esi
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x4bc]
xor ecx, esp
call fcn.0042eb15
add esp, 0x4c0
ret