Function at 0x4fefa0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0xd78
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0xd74], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x871]
push ebx
push eax
mov byte [esp + 0x878], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x161]
push ebx
push ecx
mov byte [esp + 0x168], bl
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x57d]
push ebx
push edx
mov byte [esp + 0x584], bl
call fcn.005dfd60
lea eax, [esp + 0x890]
push 0x104
push eax
call fcn.004ebf90
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x2c
lea ecx, [esp + 0x86c]
push ecx
lea edx, [esp + 0x154]
push edx
call edi
cmp byte [esp + 0x150], bl
je 0x4ff070
lea eax, [esp + 0x150]
inc eax
cmp byte [eax], bl
jne 0x4ff044
lea ecx, [esp + 0x150]
sub eax, ecx
je 0x4ff070
cmp byte [esp + eax + 0x14f], 0x5c
je 0x4ff070
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x66da34
mov edx, ecx
push edx
call esi
jmp 0x4ff076
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x63f824
lea eax, [esp + 0x154]
push eax
call esi
lea ecx, [esp + 0x150]
push ebx
push ecx
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x4ff4bb
lea edx, [esp + 0x560]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esp + 0x560], bl
jne 0x4ff0cc
lea eax, [esp + 0x86c]
push eax
lea ecx, [esp + 0x564]
push ecx
call edi
push ebp
push 0x103
lea edx, [esp + 0x771]
push ebx
push edx
mov byte [esp + 0x778], bl
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x679]
push ebx
push eax
mov byte [esp + 0x680], bl
call fcn.005dfd60
push 0x5000
call fcn.005e20e4
mov ebp, eax
add esp, 0x1c
cmp ebp, ebx
je 0x4ff4ba
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x770]
push edx
mov byte [ebp], bl
call edi
lea eax, [esp + 0x76c]
push eax
call fcn.004e24e0
add esp, 4
push str.OEM.INF
lea ecx, [esp + 0x770]
push ecx
call esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x770]
push eax
mov esi, 1
call fcn.004e0820
add esp, 8
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4ff4b1
cmp esi, ebx
je 0x4ff4a6
test byte [esp + 0x14], 0x10
jne 0x4ff48d
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x66c]
push edx
call edi
lea eax, [esp + 0x668]
push eax
call fcn.004e24e0
add esp, 4
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x66c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x668]
push eax
push 0x5000
push ebp
push 0x60c81c
push ebx
push str.Strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp], bl
je 0x4ff48d
xor esi, esi
cmp byte [ebp], bl
je 0x4ff48d
mov edi, edi
push 0x207
lea ecx, [esp + 0x979]
push ebx
push ecx
mov byte [esp + 0x980], bl
call fcn.005dfd60
push 0x207
lea edx, [esp + 0xb8d]
push ebx
push edx
mov byte [esp + 0xb94], bl
call fcn.005dfd60
add esp, 0x18
lea eax, [esi + ebp]
push eax
lea ecx, [esp + 0x978]
push ecx
call edi
mov cl, byte [esp + 0x974]
lea eax, [esp + 0x974]
cmp cl, bl
je 0x4ff24c
inc eax
cmp byte [eax], bl
jne 0x4ff247
lea edx, [esp + 0x974]
sub eax, edx
lea esi, [esi + eax + 1]
cmp cl, bl
je 0x4ff48d
lea eax, [esp + 0x668]
push eax
push 0x208
lea ecx, [esp + 0xb84]
push ecx
push 0x60c81c
push edx
push str.Strings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
lea eax, [esp + 0xb80]
push 0x60cf40
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ff2e6
push ebx
lea ecx, [esp + 0xb80]
push 0x6147e0
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ff2e6
push ebx
lea edx, [esp + 0xb80]
push str.eScan_Firewall
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ff2e6
cmp byte [esi + ebp], bl
jne 0x4ff1f0
jmp 0x4ff48d
push 0x103
lea eax, [esp + 0x25d]
push ebx
push eax
mov byte [esp + 0x264], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x36d]
push ebx
push ecx
mov byte [esp + 0x374], bl
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x47d]
push ebx
push edx
mov byte [esp + 0x484], bl
call fcn.005dfd60
add esp, 0x24
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x464]
push ecx
call edi
lea edx, [esp + 0x460]
push 0x2e
push edx
call fcn.005e0a00
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
cmp eax, ebx
je 0x4ff412
mov byte [eax], bl
push str..PNF
lea eax, [esp + 0x464]
push eax
call esi
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x25c]
push edx
call edi
lea eax, [esp + 0x258]
push eax
call fcn.004e24e0
add esp, 4
lea ecx, [esp + 0x460]
push ecx
lea edx, [esp + 0x25c]
push edx
call esi
lea eax, [esp + 0x564]
push eax
lea ecx, [esp + 0x360]
push ecx
call edi
lea edx, [esp + 0x35c]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [esp + 0x460]
push eax
lea ecx, [esp + 0x360]
push ecx
call esi
push 1
push ebx
push ebx
push ebx
lea edx, [esp + 0x268]
push ebx
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ff412
push ebx
lea eax, [esp + 0x360]
push eax
lea ecx, [esp + 0x260]
push ecx
call fcn.004eca90
add esp, 0xc
lea edx, [esp + 0x154]
push edx
lea eax, [esp + 0x25c]
push eax
call edi
lea ecx, [esp + 0x258]
push ecx
call fcn.004e24e0
add esp, 4
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x25c]
push eax
call esi
lea ecx, [esp + 0x564]
push ecx
lea edx, [esp + 0x360]
push edx
call edi
lea eax, [esp + 0x35c]
push eax
call fcn.004e24e0
add esp, 4
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x360]
push edx
call esi
push ebx
lea eax, [esp + 0x360]
push eax
lea ecx, [esp + 0x260]
push ecx
call fcn.004eca90
add esp, 0xc
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.004d5ad0
add esp, 8
mov esi, eax
jmp 0x4ff173
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.005e0865
add esp, 4
pop ebp
mov ecx, dword [esp + 0xd80]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0xd78
ret