Function at 0x405550
Capabilities:
Delete file
Enumerate gui resources
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x42af65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbac
push esi
push 1
push 1
push 0
push 0
mov dword [esp + 0x14], 0
call fcn.00401000
add esp, 0x10
test al, al
jne 0x4055be
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push str.Fatal_Error__The_MDaemon_UserDll_could_not_be_loaded__no_SpamAssassin_update_was_performed__n
push 0x406010
call esi
push str.___________n
push 0x406010
call esi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xbac]
mov dword fs:[0], ecx
add esp, 0xbb8
ret
push ebx
push ebp
push edi
lea eax, [esp + 0x8b8]
push 0x100
push eax
mov ebp, 1
call dword [0x43c160]
lea edi, [esp + 0x8b8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5b0]
push ecx
call fcn.00405460
lea edx, [esp + 0x5b4]
push 0x5c
push edx
call fcn.00405460
add esp, 0x10
push 0x2f
push ebp
push str.AutoUpdate
push str.SpamAssassin
call dword [0x43c4c0]
test al, al
je 0x405c67
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
push str.Starting_update_process..._n
push 0x406010
call ebx
lea edi, [esp + 0x5ac]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xa4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xa4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x437740
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x6ac]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x6ac]
push 0x5c
push ecx
call fcn.00405480
add esp, 8
lea edx, [esp + 0x6ac]
lea eax, [esp + 0x1a4]
push edx
push str._supdate_en.ini
push eax
call fcn.0040696b
lea ecx, [esp + 0x1b0]
push ecx
call fcn.00402700
add esp, 0x10
test al, al
je 0x40570f
lea edx, [esp + 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xa4]
push eax
call fcn.00402720
add esp, 4
test al, al
jne 0x405733
lea ecx, [esp + 0xa4]
push ecx
call fcn.00402740
add esp, 4
lea edi, [esp + 0xa4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Update_en.ini
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00405c90
add esp, 4
test al, al
je 0x405c65
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x1a4]
xor edi, edi
push ecx
call fcn.00402700
add esp, 4
test al, al
je 0x405c65
lea edx, [esp + 0x1a4]
lea eax, [esp + 0x4ac]
push edx
push 0x104
push eax
push 0x43c4e4
push str.Version
push str.WiseUpdate
call fcn.004027a0
mov al, byte [esp + 0x4c4]
add esp, 0x18
test al, al
je 0x4057e1
lea ecx, [esp + 0x4ac]
push ecx
call fcn.004076ea
add esp, 4
mov edi, eax
push 0x2f
push 0x64
push str.CurrentUpdateCode
push str.SpamAssassin
call dword [0x43c300]
mov esi, eax
push edi
push esi
lea edx, [esp + 0xac4]
push str.Current_update_code:__d__newest_update_code:__d
push edx
call fcn.0040696b
add esp, 0x10
lea eax, [esp + 0xabc]
push eax
push 0x406010
call ebx
cmp edi, esi
jle 0x405c29
push str.Downloading_update___this_could_take_several_minutes..._n
push 0x406010
call ebx
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x7b4]
push ecx
push str._sSpamAssassinUpdate.zip
push edx
call fcn.0040696b
add esp, 0xc
lea eax, [esp + 0xa4]
lea ecx, [esp + 0x2a4]
push eax
push str._sSpamAssassinUpdate.lck
push ecx
call fcn.0040696b
add esp, 0xc
lea ecx, [esp + 0x70]
mov dword [esp + 0x18], 0x42d4cc
call fcn.00402880
mov esi, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x10], 1
mov dword [esp + 0x70], esi
mov edx, dword [esp + 0x18]
xor ebp, ebp
lea ecx, [esp + 0x1c]
push ebp
mov eax, dword [edx + 4]
push ecx
mov dword [esp + 0xbcc], ebp
mov dword [esp + eax + 0x20], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x20]
call fcn.004053c0
lea ecx, [esp + 0x1c]
mov dword [esp + 0xbc4], 2
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x1c]
call fcn.00404760
lea ecx, [esp + 0x68]
call fcn.004027d0
push ebp
push ebp
lea ecx, [esp + 0x24]
mov byte [esp + 0xbcc], 4
mov dword [esp + 0x24], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.00404810
mov edx, dword [esp + 0x18]
mov ebx, 0x42d4c8
mov byte [esp + 0xbc4], 5
mov eax, dword [edx + 4]
mov dword [esp + eax + 0x18], ebx
mov eax, dword [esp + 0x6c]
cmp eax, ebp
jne 0x40594e
lea ecx, [esp + 0x2a4]
push 0x12
push ecx
call fcn.0041979f
add esp, 8
cmp eax, ebp
je 0x40594e
push 1
push eax
lea ecx, [esp + 0x24]
call fcn.00404810
lea ecx, [esp + 0x1c]
call fcn.004048f0
lea edx, [esp + 0x1c]
test edx, edx
jne 0x405961
mov eax, dword [esp + 0x18]
push ebp
push 2
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x20]
call fcn.00402a60
lea edx, [esp + 0x18]
push 0x43721c
push edx
mov dword [esp + 0xbcc], 6
call fcn.00404c90
mov eax, dword [esp + 0x74]
add esp, 8
cmp eax, ebp
je 0x4059a7
push eax
call fcn.0040753e
add esp, 4
test eax, eax
jne 0x4059a7
push 2
push ebp
lea ecx, [esp + 0x24]
call fcn.00404810
lea eax, [esp + 0x1c]
test eax, eax
jne 0x4059c6
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 4]
mov eax, dword [esp + edx + 0x1c]
lea ecx, [esp + edx + 0x18]
or al, 2
cmp dword [ecx + 0x28], ebp
jne 0x4059bf
or al, 4
push ebp
push eax
call fcn.00415f5e
lea eax, [esp + 0x6ac]
push str.SpamAssassinUpdate.zip
push eax
lea ecx, [esp + 0x3b0]
push str._s_s
push ecx
call fcn.0040696b
lea edx, [esp + 0x3b8]
push edx
call fcn.00402700
add esp, 0x14
test al, al
je 0x405a07
lea eax, [esp + 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.SpamAssassinUpdate.zip
lea ecx, [esp + 0x9bc]
push 0x437630
push ecx
call fcn.0040696b
lea edx, [esp + 0x9c4]
push edx
call fcn.00405c90
add esp, 0x10
test al, al
jne 0x405af6
lea eax, [esp + 0x2a4]
push eax
call fcn.00402700
add esp, 4
test al, al
je 0x405a5a
lea ecx, [esp + 0x2a4]
push ecx
call fcn.004075bb
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x70]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x18], ebx
mov ebx, 7
lea edx, [esp + 0x1c]
mov dword [esp + 0xbc4], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov al, byte [esp + 0x64]
mov byte [esp + 0xbc4], 9
test al, al
je 0x405aa2
lea ecx, [esp + 0x1c]
call fcn.00404530
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x405ab1
push 1
call fcn.004060c0
lea ecx, [esp + 0x68]
call fcn.00402820
lea ecx, [esp + 0x1c]
mov byte [esp + 0xbc4], bl
call fcn.00402a90
mov eax, dword [esp + 0x18]
mov dword [esp + 0xbc4], 0xffffffff
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x18], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], esi
call fcn.004161cc
jmp 0x405c67
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x3a8]
push edx
call fcn.00402700
add esp, 4
test al, al
je 0x405b57
lea eax, [esp + 0x7b4]
lea ecx, [esp + 0x3a8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [esp + 0x7b4]
push edx
call fcn.00402700
add esp, 4
test al, al
je 0x405b57
push 0x2f
push edi
push str.CurrentUpdateCode
push str.SpamAssassin
mov ebp, 1
call dword [0x43c2c8]
lea eax, [esp + 0x2a4]
push eax
call fcn.00402700
add esp, 4
test al, al
je 0x405b7b
lea ecx, [esp + 0x2a4]
push ecx
call fcn.004075bb
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x70]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x18], ebx
mov ebx, 0xa
lea edx, [esp + 0x1c]
mov dword [esp + 0xbc4], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov al, byte [esp + 0x64]
mov byte [esp + 0xbc4], 0xc
test al, al
je 0x405bc3
lea ecx, [esp + 0x1c]
call fcn.00404530
mov ecx, dword [esp + 0x60]
test ecx, ecx
mov esi, ecx
je 0x405bdd
push 1
call fcn.00403d60
push esi
call fcn.0042397c
add esp, 4
lea ecx, [esp + 0x68]
call fcn.00402820
lea ecx, [esp + 0x1c]
mov byte [esp + 0xbc4], bl
call fcn.00402a90
mov eax, dword [esp + 0x18]
mov dword [esp + 0xbc4], 0xffffffff
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x18], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.004161cc
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x405c35
push str.Your_Spam_Filter_does_not_need_an_update._n
push 0x406010
call ebx
lea edx, [esp + 0x1a4]
push edx
call fcn.00402700
add esp, 4
test al, al
je 0x405c57
lea eax, [esp + 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.___________n
push 0x406010
call ebx
jmp 0x405c67
xor ebp, ebp
call fcn.00402590
mov ecx, dword [esp + 0xbbc]
mov eax, ebp
pop edi
pop ebp
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0xbb8
ret