Function at 0x41fc70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x870
push 0
push edi
call sub.MSVCR100.dll_memset
push esi
push edi
push str.CreationDate
push str.REPORT
call fcn.00420ec0
add esp, 0x1c
cmp dword [edi], 0
jne 0x41fcca
cmp dword [edi + 4], 0
jne 0x41fcca
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x104
lea eax, [edi + 8]
push eax
push 0x45f664
push str.LogFile
push str.REPORT
call ebx
push esi
push 0x104
lea eax, [edi + 0x210]
push eax
push 0x45f664
push str.Result
push str.REPORT
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0xffffffffffffffff
push str.ReportType
push str.REPORT
call ebx
mov dword [edi + 0x418], eax
cmp eax, 0xffffffff
je 0x420164
test eax, eax
jne 0x41fee1
push esi
push eax
push str.VirusCount
push str.SCAN
call ebx
push esi
push 0
push str.DeletedFiles
push str.SCAN
mov dword [edi + 0x42c], eax
call ebx
push esi
push 0
push str.RepairedFiles
push str.SCAN
mov dword [edi + 0x430], eax
call ebx
push esi
push 0
push str.PathCount
push str.SCAN
mov dword [edi + 0x434], eax
call ebx
push esi
push 0
push str.FileCount
push str.SCAN
mov dword [edi + 0x420], eax
call ebx
push esi
push 0
push str.WarningCount
push str.SCAN
mov dword [edi + 0x424], eax
call ebx
push esi
push 0
push str.NoteCount
push str.SCAN
mov dword [edi + 0x438], eax
call ebx
push esi
push 0
push str.ArchiveCount
push str.SCAN
mov dword [edi + 0x43c], eax
call ebx
push esi
push 0
push str.QuarantaineCount
push str.SCAN
mov dword [edi + 0x428], eax
call ebx
push esi
push 0
push str.RenamedFilesCount
push str.SCAN
mov dword [edi + 0x440], eax
call ebx
push esi
push 0
push str.WipedFilesCount
push str.SCAN
mov dword [edi + 0x444], eax
call ebx
push esi
push 0
push str.HiddenFilesCount
push str.SCAN
mov dword [edi + 0x448], eax
call ebx
push esi
push 0
push str.SuspiciousFilesCount
push str.SCAN
mov dword [edi + 0x44c], eax
call ebx
push esi
push 0
mov dword [edi + 0x450], eax
push str.AbortedByUser
push str.SCAN
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push pe_nt_image_headers32
lea ecx, [edi + 0x458]
push ecx
push 0x45f664
push str.LastVirus
push str.SCAN
mov dword [edi + 0x454], eax
call ebx
push esi
lea edx, [edi + 0x658]
push edx
push str.StartTime
push str.SCAN
call fcn.00420ec0
push esi
lea eax, [edi + 0x660]
push eax
push str.UsedTime
push str.SCAN
call fcn.00420ec0
add esp, 0x20
push esi
push 0x104
add edi, 0x668
push edi
push 0x45f664
push str.ProfileFileName
push str.SCAN
call ebx
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x420191
push esi
push 0
push str.AbortedByUser
push str.UPDATE
call ebx
push esi
push 0
push str.CountOfUpdatedFiles
push str.UPDATE
mov dword [edi + 0x420], eax
call ebx
push esi
push 0x40
lea ecx, [edi + 0x428]
push ecx
push 0x45f664
push str.AVEFileInfo
push str.UPDATE
mov dword [edi + 0x424], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x40
lea edx, [edi + 0x4a8]
push edx
push 0x45f664
push str.VDFFileInfo
push str.UPDATE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [edi + 0x528]
push eax
push str.ElapsedTime
push str.UPDATE
call fcn.00420ec0
push esi
lea ecx, [edi + 0x530]
push ecx
push str.StartTime
push str.UPDATE
call fcn.00420ec0
push esi
lea edx, [edi + 0x538]
push edx
push str.EndTime
push str.UPDATE
call fcn.00420ec0
add esp, 0x30
push esi
push 0
push str.MadeDialupConnection
push str.UPDATE
call ebx
push esi
push 0
push str.DownloadedBytes
push str.UPDATE
mov dword [edi + 0x540], eax
call ebx
push esi
push 0xffffffffffffffff
push str.UpdatedSuccessfully
push str.UPDATE
mov dword [edi + 0x544], eax
call ebx
cmp eax, 0xffffffff
je 0x41ffe3
mov dword [edi + 0x54c], eax
jmp 0x4200be
mov ecx, str.Update_war_erfolgreich.
lea eax, [edi + 0x210]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x420016
test dx, dx
je 0x420012
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x420016
add eax, 4
add ecx, 4
test dx, dx
jne 0x41fff0
xor eax, eax
jmp 0x42001b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42002e
mov dword [edi + 0x54c], 1
jmp 0x4200be
mov ecx, str.Update_was_successful.
lea eax, [edi + 0x210]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x420066
test dx, dx
je 0x420062
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x420066
add eax, 4
add ecx, 4
test dx, dx
jne 0x420040
xor eax, eax
jmp 0x42006b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42007b
mov dword [edi + 0x54c], 1
jmp 0x4200be
mov ecx, 0x459d58
lea eax, [edi + 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4200ac
test dx, dx
je 0x4200a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4200ac
add eax, 4
add ecx, 4
test dx, dx
jne 0x420086
xor eax, eax
jmp 0x4200b1
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov dword [edi + 0x54c], ecx
cmp dword [ebp + 0x10], 0
je 0x420264
push esi
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x45f664
push str.UpdatedFiles
push str.UPDATE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4200f3
sub eax, edx
sar eax, 1
je 0x420264
push 0x50
mov ebx, 0x28
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [ebp - 0x210], eax
test eax, eax
je 0x420178
push esi
push ebx
push eax
push 0x45f664
push str.UpdatedFiles
push str.UPDATE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebx - 1]
cmp eax, ecx
mov eax, dword [ebp - 0x210]
jne 0x420178
add ebx, 0x28
lea edx, [ebx + ebx]
push edx
push eax
call dword [sym.imp.MSVCR100.dll_realloc]
add esp, 8
test eax, eax
je 0x420164
mov dword [ebp - 0x210], eax
jmp 0x420122
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret
pop ebx
mov dword [edi + 0x548], eax
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x420264
push esi
push 0
push str.FileCount
push str.BACKUP
call ebx
push esi
push 0
push str.WarningCount
push str.BACKUP
mov dword [edi + 0x420], eax
call ebx
push esi
push 0
push 0
push str.BackupSize
push str.BACKUP
mov dword [edi + 0x424], eax
call fcn.00420e40
add esp, 0x14
push esi
push 0
push str.AbortedByUser
push str.BACKUP
mov dword [edi + 0x428], eax
mov dword [edi + 0x42c], edx
call ebx
push esi
lea ecx, [edi + 0x434]
push ecx
push str.StartTime
push str.BACKUP
mov dword [edi + 0x430], eax
call fcn.00420ec0
push esi
lea edx, [edi + 0x43c]
push edx
push str.UsedTime
push str.BACKUP
call fcn.00420ec0
add esp, 0x20
push esi
push 0
push str.Success
push str.BACKUP
call ebx
push esi
push 0x104
mov dword [edi + 0x444], eax
add edi, 0x448
push edi
push 0x45f664
push str.ProfileFileName
push str.BACKUP
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004534b8
mov esp, ebp
pop ebp
ret