Function at 0x441e3c
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x270
mov eax, 0x51d089
call fcn.004f21c7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x4424fd
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264], eax
and dword [ebp - 4], 0
mov edi, 0x400
lea eax, [ebp - 0x264]
mov dword [ebp - 0x258], 2
call fcn.004239ae
lea edi, [ebp - 0x25c]
mov ebx, eax
mov byte [ebp - 0x251], 1
call fcn.0040457c
mov eax, dword [eax]
push str.config.ini
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.0040557a
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebx
call esi
test eax, eax
jne 0x441f20
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x400
push ebx
push eax
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x53c274
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
call esi
test eax, eax
jne 0x441f20
push 0x400
push ebx
push eax
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...config.ini
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
call esi
test eax, eax
jne 0x441f20
mov byte [ebp - 0x251], al
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x25c], eax
mov edi, 0x80
lea eax, [ebp - 0x25c]
mov byte [ebp - 4], 1
call fcn.004239ae
cmp byte [ebp - 0x251], 1
mov ebx, 0x53c87c
jne 0x441f77
push dword [ebp - 0x264]
push edi
push eax
push 0x52f388
push str.language
push 0x53c2a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x441f84
push ebx
lea eax, [ebp - 0x25c]
push eax
call fcn.00405721
lea eax, [ebp - 0x25c]
call fcn.00421b17
mov esi, dword [ebp - 0x25c]
push str.zh_tw
push esi
call fcn.004ead89
pop ecx
pop ecx
push 7
pop edi
test eax, eax
je 0x442203
push 0x53f0e8
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x442203
push str.zh_cn
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421fa
push 0x53f0f0
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421fa
push 0x53f0f8
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421ee
push ebx
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421ee
push 0x53e61c
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421e6
push 0x53f100
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421e6
push str.pt_br
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421da
push 0x540138
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421da
push str.es_419
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421ce
push 0x540140
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421ce
push 0x540148
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421c2
push 0x53f124
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x4421c2
push 0x53e614
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x4420da
mov dword [ebp - 0x258], 0xb
jmp 0x44220d
push 0x540120
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x4420fa
mov dword [ebp - 0x258], 0xc
jmp 0x44220d
push 0x53e60c
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x44211a
mov dword [ebp - 0x258], 0xd
jmp 0x44220d
push 0x53f12c
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x44213a
mov dword [ebp - 0x258], 0xe
jmp 0x44220d
mov ebx, 0x540150
push ebx
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x442179
push 0x540118
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x44216c
mov dword [ebp - 0x258], 0x10
jmp 0x44220d
push ebx
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x442188
mov dword [ebp - 0x258], 0xf
jmp 0x44220d
push 0x540130
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x4421a5
mov dword [ebp - 0x258], 3
jmp 0x44220d
push 0x540128
push esi
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x44220d
mov dword [ebp - 0x258], 0x11
jmp 0x44220d
mov dword [ebp - 0x258], 8
jmp 0x44220d
mov dword [ebp - 0x258], 9
jmp 0x44220d
mov dword [ebp - 0x258], 0xa
jmp 0x44220d
mov dword [ebp - 0x258], edi
jmp 0x44220d
mov dword [ebp - 0x258], 2
jmp 0x44220d
and dword [ebp - 0x258], 0
jmp 0x44220d
mov dword [ebp - 0x258], 1
or eax, 0xffffffff
lea esi, [ebp - 0x264]
call fcn.00423989
or eax, 0xffffffff
lea esi, [ebp - 0x25c]
call fcn.00423989
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], edi
mov word [ebp - 0x230], ax
and dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], edi
mov word [ebp - 0x24c], ax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x258]
cmp eax, 0x12
ja case.0x442261.2
jmp dword [eax*4 + 0x442508]
mov esi, 0x53f138
push esi
call fcn.004e73fa
pop ecx
push esi
lea esi, [ebp - 0x234]
call fcn.00404dce
mov esi, 0x53f198
jmp 0x4422f8
mov esi, 0x53f1a8
jmp 0x4422e0
mov esi, 0x53f358
jmp 0x4422e0
mov esi, str.Os_arquivos_do_360_Total_Security_foram_danificados.__nReinstale_o_360_Total_Security_e_fa
jmp 0x4422e0
mov esi, str.360_Total_Security_dosyalar
jmp 0x4422e0
mov esi, str.Los_archivos_de_360_Total_Security_han_sido_da
jmp 0x4422e0
mov esi, 0x53f858
jmp 0x4422e0
mov esi, str.360_Total_Security_____.__n360_Total_Security___________.__n_:
jmp 0x4422e0
mov esi, 0x53fa68
jmp 0x4422e0
mov esi, 0x53fb18
jmp 0x4422e0
mov esi, str.Les_fichiers_de_360_Total_Security_ont
jmp 0x4422e0
mov esi, str.I_file_di_360_Total_Security_sono_stati_danneggiati._nReinstalla_360_Total_Security_e_avvia_una_scansione_dei_virus._nDocumenti_danneggiati:
jmp 0x4422e0
mov esi, str.Pliki_aplikacji_360_Total_Security_zosta
jmp 0x4422e0
mov esi, str.360_Total_Security_files_have_been_damaged.__nPlease_reinstall_360_Total_Security_and_scan_for_viruses.__nDamaged_documents:
push esi
call fcn.004e73fa
pop ecx
push esi
lea esi, [ebp - 0x234]
call fcn.00404dce
mov esi, 0x53f234
push esi
call fcn.004e73fa
pop ecx
push esi
lea esi, [ebp - 0x250]
call fcn.00404dce
push dword [ebp - 0x260]
lea eax, [ebp - 0x234]
push eax
call fcn.0040160e
cmp dword [ebp - 0x21c], 8
mov ebx, dword [ebp - 0x230]
jae 0x442332
lea ebx, [ebp - 0x230]
cmp dword [ebp - 0x238], 8
mov edi, dword [ebp - 0x24c]
jae 0x442347
lea edi, [ebp - 0x24c]
push 0x14
push edi
push ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
call esi
mov byte [ebp - 0x251], 0
cmp eax, 6
je 0x442376
test eax, eax
jne 0x442382
push 0x14
push edi
push ebx
push eax
call esi
cmp eax, 6
jne 0x442382
call fcn.00442554
mov byte [ebp - 0x251], 1
push ecx
mov eax, esp
mov dword [ebp - 0x268], esp
xor edi, edi
push str.UserExperience
inc edi
push eax
mov dword [ebp - 0x258], edi
lea esi, [ebp - 0x258]
xor ebx, ebx
call fcn.00405747
push ecx
mov eax, esp
mov dword [ebp - 0x26c], esp
push str.SOFTWARE360TotalSecurityExperience
push eax
mov byte [ebp - 4], 4
call fcn.00405747
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x27c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.004049f3
push eax
call fcn.00404801
pop ecx
lea esi, [ebp - 0x27c]
call fcn.00401105
cmp dword [ebp - 0x258], ebx
je 0x4424c7
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004e7380
push 0xffffffffffffffff
push dword [ebp - 0x260]
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004ecfab
add esp, 0x1c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
xor eax, eax
cmp ax, word [ebp - 0x218]
je 0x4424c7
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 5
mov eax, 0x53ffe4
cmp byte [ebp - 0x251], bl
jne 0x442473
mov eax, 0x53ffe8
push dword [0x5864c8]
push dword [0x5864c4]
push dword [0x5864c0]
push dword [0x5864bc]
push dword [0x5864b4]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [0x586530]
lea eax, [ebp - 0x260]
push str._snosign.htm_f_sre_smid_sver_slan_sos_sch_s
push eax
call fcn.00404568
mov esi, dword [ebp - 0x260]
push esi
call fcn.004b059d
add esp, 0x2c
lea eax, [esi - 0x10]
call fcn.0040557a
push ebx
push edi
lea esi, [ebp - 0x250]
call fcn.00404e82
push ebx
push edi
lea esi, [ebp - 0x234]
call fcn.00404e82
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.0040557a
call fcn.004f224a
ret 4