Function at 0x933f00
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc58
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xc54], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc64]
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x20], ebp
mov edi, ecx
cmp dword [0xbfa8b4], ebx
je 0x933f62
cmp dword [0xbd73e8], ebx
je 0x933f4a
push str.10.160.61.4:2221
push str._WGWIN__eScanUpdateServer:___s_
push ebx
call fcn.0096a780
add esp, 0xc
mov eax, str.10.160.61.4:2221
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x933f53
jmp 0x9344fa
call fcn.0098b510
mov byte [str.10.160.61.4:2221], bl
mov byte [ebp], bl
mov esi, eax
mov dword [0xbfa8b4], 1
cmp dword [0xbd73e8], ebx
je 0x933f93
push esi
push str._WGWIN__SMBCorp:__d
push ebx
call fcn.0096a780
add esp, 0xc
cmp esi, ebx
je 0x9344e5
push 0x103
lea eax, [esp + 0x44d]
push ebx
push eax
mov byte [esp + 0x454], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x35]
push ebx
push ecx
mov byte [esp + 0x3c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea edx, [esp + 0x44c]
push edx
push 0xaa1543
mov edx, str.server
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp dword [0xbd73e8], ebx
je 0x934012
push edi
lea eax, [esp + 0x44c]
push eax
push str._WGWIN__Server:__s__EupdateIni:__s
push ebx
call fcn.0096a780
add esp, 0x10
cmp byte [esp + 0x448], 0x30
jne 0x9344e5
push 1
push ebx
xor edx, edx
mov ecx, edi
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x9344e5
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x104
lea ecx, [esp + 0x38]
push ecx
push 0xaa1543
push str.HTTPHost
push str.Config
call ebp
cmp dword [0xbd73e8], ebx
je 0x934074
lea edx, [esp + 0x30]
push edx
push str._WGWIN__HTTPHost:__s
push ebx
call fcn.0096a780
add esp, 0xc
cmp byte [esp + 0x30], bl
je 0x9344e5
push ebx
lea eax, [esp + 0x34]
push 0xaaa5d4
push eax
mov dword [esp + 0x20], ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x93409f
add eax, 3
jmp 0x9340a1
xor eax, eax
lea eax, [esp + eax + 0x30]
mov edx, str.10.160.61.4:2221
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x9340b0
push 0x3a
push str.10.160.61.4:2221
call fcn.00a7a2c0
add esp, 8
cmp eax, ebx
je 0x9340cf
mov byte [eax], bl
mov eax, str.10.160.61.4:2221
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x9340d5
mov ecx, dword [str.:2221]
mov dx, word [0xae4b6c]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 0x14]
push eax
push str.WGWinDownloadFromInternet
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x934127
mov eax, dword [esp + 0x14]
mov esi, str.WGWinDownloadFromInternet
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [esp + 0x14], ebx
je 0x93414e
cmp dword [0xbd73e8], ebx
je 0x934143
push str._WGWIN__Setting_eScanUpdateServer_to_NULL_as_WGWinDownloadFromInternet1
push ebx
call fcn.0096a780
add esp, 8
mov byte [str.10.160.61.4:2221], bl
jmp 0x9344e5
push 0x207
lea ecx, [esp + 0x13d]
push ebx
push ecx
mov byte [esp + 0x144], bl
call fcn.00a7ffb0
add esp, 0xc
push edi
push 0x208
lea edx, [esp + 0x140]
push edx
push 0xaa1ac4
push str.NoChangeDwnLink
push str.Config
call ebp
cmp byte [esp + 0x138], 0x31
je 0x9344e5
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + str.10.160.61.4:2221]
mov byte [esp + eax + 0x138], cl
inc eax
cmp cl, bl
jne 0x9341a0
push ebx
lea eax, [esp + 0x13c]
push str.:2221
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9344e5
push 0xaa1543
lea ecx, [esp + 0x13c]
push str.http:__
push ecx
mov byte [esp + eax + 0x144], bl
call fcn.0095e130
lea edx, [esp + 0x144]
add esp, 0xc
push edx
call fcn.0095ad70
add esp, 4
lea eax, [esp + 0x138]
push ebx
push eax
call fcn.00965e80
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x934241
cmp dword [0xbd73e8], ebx
je 0x9344e5
push ebx
lea ecx, [esp + 0x13c]
push ecx
push str._WGWIN__Tmp:__s__IP:_u_
push ebx
call fcn.0096a780
add esp, 0x10
jmp 0x9344e5
lea edx, [esp + 0x138]
push edx
mov ecx, 0xbfa9bc
call fcn.0096b690
add esp, 4
mov edi, eax
cmp dword [0xbd73e8], ebx
je 0x934278
push edi
push esi
lea eax, [esp + 0x140]
push eax
push str._WGWIN__Tmp:__s__IP:_u__LocIP:_d_
push ebx
call fcn.0096a780
add esp, 0x14
cmp edi, 1
je 0x9344e5
push 0x103
lea ecx, [esp + 0x555]
push ebx
push ecx
mov byte [esp + 0x55c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
xor eax, eax
lea edx, [esp + 0x865]
push ebx
push edx
mov byte [esp + 0x30], bl
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov byte [esp + 0x39], al
mov byte [esp + 0x86c], bl
call fcn.00a7ffb0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
push str.upgr_mmxvi.cdn.bitdefender.net
lea eax, [esp + 0x554]
push eax
call esi
push 0xab6ee4
lea ecx, [esp + 0x28]
push ecx
call esi
mov byte [esp + 0x860], bl
cmp dword [0xbd73e8], ebx
je 0x93430b
push str._WGWIN__B__Checking_conn_to_upgr_cloud...
push ebx
call fcn.0096a780
add esp, 8
push ebx
push ebx
push ebx
push ebx
push 0x2710
push ebx
lea edx, [esp + 0x878]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x570]
push ecx
xor edx, edx
xor ecx, ecx
call fcn.0087cce0
add esp, 0x24
mov esi, eax
cmp dword [0xbd73e8], ebx
je 0x934357
lea edx, [esp + 0x860]
push edx
push esi
push str._WGWIN__B__Check_Conn_returns__u___s_
push ebx
call fcn.0096a780
add esp, 0x10
cmp esi, ebx
je 0x9344e5
push 0x207
lea eax, [esp + 0x65d]
push ebx
push eax
mov byte [esp + 0x664], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x345]
push ebx
push ecx
mov byte [esp + 0x34c], bl
call fcn.00a7ffb0
add esp, 0xc
lea edx, [esp + 0x658]
push str.http:__upgr_mmxvi.cdn.bitdefender.net_av32bit_versions.dat
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.00a78f30
push ebx
lea eax, [esp + 0x664]
push str.mmxiii
push eax
call fcn.0095c8c0
add esp, 0x14
cmp eax, 0xffffffff
je 0x9343d5
mov esi, str.downloader_1.0.30.345_95505_Bitdefender2012__WSLib_1.4__1__0__162__0__
jmp 0x934417
push ebx
lea ecx, [esp + 0x65c]
push str.mmxiv
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9343f7
mov esi, str.downloader_1.0.30.400_132565_Bitdefender2014__WSLib_1.4__3__0__0__79__
jmp 0x934417
push ebx
lea edx, [esp + 0x65c]
push str.mmxvi
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x934428
mov esi, str.downloader_1.0.30.400_132565_Bitdefender2015__WSLib_1.4__3__0__0__79__
mov ecx, 0x11
lea edi, [esp + 0x340]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp dword [0xbd73e8], ebx
je 0x934446
lea eax, [esp + 0x658]
push eax
push str._WGWIN__VURL:_s
push ebx
call fcn.0096a780
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x660]
push ebx
push edx
lea edx, [esp + 0x350]
lea ecx, [esp + 0x28]
call fcn.0085b300
mov edi, dword [esp + 0x2c]
add esp, 0x10
cmp dword [0xbd73e8], ebx
je 0x934483
push edi
push str._WGWIN__ContentSize:_d
push ebx
call fcn.0096a780
add esp, 0xc
mov esi, dword [esp + 0x18]
cmp esi, ebx
je 0x9344c1
cmp byte [esi], bl
je 0x9344c1
push ebx
push str.emalware
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9344c1
cmp dword [0xbd73e8], ebx
je 0x9344b9
push str._WGWIN__Setting_eScanUpdateServer_to_NULL_as_Connectivity_to_Cloud_detected.
push ebx
call fcn.0096a780
add esp, 8
mov byte [str.10.160.61.4:2221], bl
jmp 0x9344d8
cmp dword [0xbd73e8], ebx
je 0x9344d8
push edi
push str._WGWIN__Invalid_Versions.dat_with_ContentSize:_d
push ebx
call fcn.0096a780
add esp, 0xc
cmp esi, ebx
je 0x9344e5
push esi
call fcn.00a78fec
add esp, 4
mov edx, dword [esp + 0x20]
mov eax, str.10.160.61.4:2221
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x9344f0
mov ecx, dword [esp + 0xc64]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0xc58
ret