Function at 0x4b3cf0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5968bc
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x5f4964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x4b3d26
jmp 0x4b44c2
lea ecx, [ebp - 0x38]
call fcn.004161f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x60], 2
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
call fcn.00415350
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x59], 1
push 0x5af6b4
lea ecx, [ebp - 0x28c]
push ecx
call fcn.0041a080
add esp, 4
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebp - 0x2a8]
call fcn.00422f30
push eax
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x28c]
call fcn.00423040
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b3e11
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x5af6cc
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b3e11
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...config.ini
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b3e11
mov byte [ebp - 0x59], 0
lea ecx, [ebp - 0x58]
call fcn.004161f0
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], 0x80
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x58]
call fcn.00415350
mov dword [ebp - 0x34], eax
movzx eax, byte [ebp - 0x59]
cmp eax, 1
jne 0x4b3e64
lea ecx, [ebp - 0x38]
call fcn.00422f30
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 0x5af4e4
push 0x5af64c
push 0x5af6e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4b3e71
push 0x5af6ec
lea ecx, [ebp - 0x58]
call fcn.004150e0
lea ecx, [ebp - 0x58]
call fcn.0041bcd0
push str.zh_tw
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
je 0x4b3e9b
push 0x5af700
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3ea7
mov dword [ebp - 0x60], 1
jmp 0x4b4092
push str.zh_cn
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
je 0x4b3ec9
push 0x5af714
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3ed5
mov dword [ebp - 0x60], 0
jmp 0x4b4092
push 0x5af71c
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
je 0x4b3ef7
push 0x5af724
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3f03
mov dword [ebp - 0x60], 2
jmp 0x4b4092
push 0x5af72c
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
je 0x4b3f25
push 0x5af734
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3f31
mov dword [ebp - 0x60], 7
jmp 0x4b4092
push str.pt_br
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
je 0x4b3f53
push 0x5af748
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3f5f
mov dword [ebp - 0x60], 0xa
jmp 0x4b4092
push str.es_419
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
je 0x4b3f81
push 0x5af760
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3f8d
mov dword [ebp - 0x60], 9
jmp 0x4b4092
push 0x5af768
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
je 0x4b3faf
push 0x5af770
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3fbb
mov dword [ebp - 0x60], 8
jmp 0x4b4092
push 0x5af778
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3fd8
mov dword [ebp - 0x60], 0xb
jmp 0x4b4092
push 0x5af780
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b3ff5
mov dword [ebp - 0x60], 0xc
jmp 0x4b4092
push 0x5af788
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b4012
mov dword [ebp - 0x60], 0xd
jmp 0x4b4092
push 0x5af790
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b402c
mov dword [ebp - 0x60], 0xe
jmp 0x4b4092
push 0x5af798
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b4046
mov dword [ebp - 0x60], 0xf
jmp 0x4b4092
push 0x5af7a0
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b4060
mov dword [ebp - 0x60], 0x10
jmp 0x4b4092
push 0x5af7a8
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b407a
mov dword [ebp - 0x60], 0xf
jmp 0x4b4092
push 0x5af7b0
lea ecx, [ebp - 0x58]
call fcn.0041bca0
test eax, eax
jne 0x4b4092
mov dword [ebp - 0x60], 3
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
call fcn.00415dd0
push 0xffffffffffffffff
lea ecx, [ebp - 0x58]
call fcn.00415dd0
lea ecx, [ebp - 0x2c]
call fcn.0041a680
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.0041a680
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x10
ja case.0x4b40da.4
mov ecx, dword [ebp - 0x2ac]
jmp dword [ecx*4 + 0x4b44e0]
push 0x5af7b8
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5af818
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push 0x5af828
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5af8b4
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push 0x5af8e0
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5af9d8
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push 0x5afa00
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5afb60
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push str.Os_arquivos_do_360_Total_Security_foram_danificados.__nReinstale_o_360_Total_Security_e_fa
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5afca4
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push str.360_Total_Security_dosyalar
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5afe18
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push str.Los_archivos_de_360_Total_Security_han_sido_da
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5aff74
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push 0x5affa0
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5b0088
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push str.360_Total_Security_____.__n360_Total_Security___________.__n_:
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5b01d4
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push 0x5b0200
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5b02b0
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push str.360_Total_Security_Dateien_wurden_besch
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5b03f4
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push str.Les_fichiers_de_360_Total_Security_ont
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push 0x5b0558
lea ecx, [ebp - 0x54]
call fcn.004199b0
jmp 0x4b4263
push str.360_Total_Security_files_have_been_damaged.__nPlease_reinstall_360_Total_Security_and_scan_for_viruses.__nDamaged_documents:
lea ecx, [ebp - 0x2c]
call fcn.004199b0
push str.360_Total_Security
lea ecx, [ebp - 0x54]
call fcn.004199b0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0041a6f0
lea ecx, [ebp - 0x2c]
call fcn.004178e0
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0x54]
call fcn.004178e0
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
push 0x14
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x71], 0
cmp dword [ebp - 0x6c], 6
jne 0x4b42ba
call fcn.004b47e0
mov byte [ebp - 0x71], 1
jmp 0x4b42e4
cmp dword [ebp - 0x6c], 0
jne 0x4b42e4
push 0x14
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 6
jne 0x4b42e4
call fcn.004b47e0
mov byte [ebp - 0x71], 1
mov dword [ebp - 0x70], 1
lea edx, [ebp - 0x70]
push edx
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x2a0], esp
push str.UserExperience
call fcn.00415010
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x2a4], esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.00415010
mov dword [ebp - 0x2b8], eax
push 0x80000002
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x29c]
call fcn.0041ca20
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c0], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2c0]
push edx
call fcn.0041cc30
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x29c]
call fcn.0041d0f0
cmp dword [ebp - 0x70], 0
je 0x4b448f
xor eax, eax
mov word [ebp - 0x284], ax
push 0x206
push 0
lea ecx, [ebp - 0x282]
push ecx
call fcn.0056b960
add esp, 0xc
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x284]
push eax
call fcn.004b8670
add esp, 0xc
lea ecx, [ebp - 0x284]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea edx, [ebp - 0x284]
test edx, edx
je 0x4b448f
movzx eax, word [ebp - 0x284]
test eax, eax
je 0x4b448f
lea ecx, [ebp - 0x288]
call fcn.004161f0
mov byte [ebp - 4], 6
movzx ecx, byte [ebp - 0x71]
test ecx, ecx
je 0x4b4406
mov dword [ebp - 0x2c4], 0x5b070c
jmp 0x4b4410
mov dword [ebp - 0x2c4], 0x5b0710
mov edx, dword [0x5f8294]
push edx
mov eax, dword [0x5f8290]
push eax
mov ecx, dword [0x5f828c]
push ecx
mov edx, dword [0x5f8288]
push edx
mov eax, dword [0x5f8280]
push eax
mov ecx, dword [ebp - 0x2c4]
push ecx
lea edx, [ebp - 0x284]
push edx
mov ecx, 0x5f7c68
call fcn.004b8e40
mov ecx, eax
call fcn.004b8e00
mov eax, dword [eax]
push eax
push str._snosign.htm_f_sre_smid_sver_slan_sos_sch_s
lea ecx, [ebp - 0x288]
push ecx
call fcn.00416010
add esp, 0x28
push 0xfa0
lea ecx, [ebp - 0x288]
call fcn.00422f30
push eax
call fcn.0041ecd0
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x288]
call fcn.00423040
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.00417280
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00417280
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00423040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00423040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056ab51
mov esp, ebp
pop ebp
ret 4