Function at 0x426510
Capabilities:
Check if file exists
Create thread
Delete file
Get common file path
Get file attributes
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f500
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1958
call fcn.004ffc70
mov eax, dword [0x62bcc0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x120]
mov esi, dword [ebx + 0x10]
push 0x617468
push 0x61740c
push str.._s_._s
push 0x104
push eax
call fcn.00407c20
add esp, 0x14
lea eax, [ebp - 0x120]
mov ecx, 0x911000
push 0x615266
push eax
call fcn.00443b40
push str._OrderID_
call fcn.00439e90
add esp, 4
push str._AddInfo_
call fcn.00439e90
add esp, 4
mov ecx, 0x911000
push 1
push dword [ebx + 0x14]
push esi
push 0x190
push 0
push 0x90f028
push 0
push edi
call fcn.00440a10
test eax, eax
jne 0x426a2e
cmp byte [0x91196c], al
je 0x4265e4
mov byte [0x91196d], 1
cmp dword [0x916c3c], 0
jne 0x4265f7
push 0
call fcn.00504903
add esp, 4
push 0x4cb2f0
mov dword [0x916c38], 0x9965e
call fcn.0050491e
add esp, 4
mov dword [0x916c3c], eax
test eax, eax
je 0x426688
mov edi, dword [0x916c38]
xor esi, esi
movsd xmm1, qword [0x6180d8]
test edi, edi
jle 0x426674
movd xmm2, edi
cvtdq2pd xmm2, xmm2
movsd qword [ebp - 0x1968], xmm2
nop dword [eax + eax]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
divsd xmm0, xmm2
call fcn.00514400
mov eax, dword [0x916c3c]
movsd xmm1, qword [0x6180d8]
movsd xmm2, qword [ebp - 0x1968]
movsd qword [eax + esi*8], xmm0
inc esi
cmp esi, edi
jl 0x426640
movd xmm0, edi
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x916c40], xmm1
movaps xmm3, xmmword [0x618370]
mov ecx, 4
movaps xmm2, xmmword [0x6183e0]
mov edx, 0x9170b0
lea eax, [ecx - 4]
movq xmm1, xmm3
movd xmm0, eax
lea edx, [edx + 0x40]
pshufd xmm0, xmm0, 0
lea eax, [ecx - 2]
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x50], xmm0
movd xmm0, eax
lea eax, [ecx + 2]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x40], xmm0
movd xmm0, ecx
add ecx, 8
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x30], xmm0
movd xmm0, eax
lea eax, [ecx - 4]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
cvtdq2pd xmm0, xmm0
divpd xmm0, xmm2
movups xmmword [edx - 0x20], xmm0
cmp eax, 0x1000
jl 0x4266a0
mov edi, 0x1000
nop word [eax + eax]
call fcn.00509596
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x618248]
mulsd xmm0, qword [0x618240]
cvttsd2si esi, xmm0
call fcn.00509596
movsd xmm1, qword [esi*8 + 0x9170a0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x618248]
mulsd xmm0, qword [0x618240]
cvttsd2si eax, xmm0
movsd xmm0, qword [eax*8 + 0x9170a0]
movsd qword [esi*8 + 0x9170a0], xmm0
movsd qword [eax*8 + 0x9170a0], xmm1
sub edi, 1
jne 0x426730
push edi
call fcn.0050e3e0
add eax, dword [0x917094]
add esp, 4
mov dword [ebp - 0x1964], edx
and eax, 0x80000fff
jns 0x4267be
dec eax
or eax, 0xfffff000
inc eax
push 0x103
mov dword [0x917094], eax
lea eax, [ebp - 0x227]
push 0
push eax
mov byte [ebp - 0x228], 0
call fcn.00501660
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x228]
add esp, 0xc
push str.WIN.INI
push 0x104
push eax
push 0x615266
push str.Wallpaper
push str.Desktop
call esi
lea ecx, [ebp - 0x228]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426811
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x228]
push eax
push 0xffffffffffffffff
push str.BackupWPPath
call fcn.0042ea80
add esp, 0x14
mov byte [ebp - 0x228], 0
lea eax, [ebp - 0x227]
push 0x103
push 0
push eax
call fcn.00501660
add esp, 0xc
lea eax, [ebp - 0x228]
push str.SYSTEM.INI
push 0x104
push eax
push 0x615266
push str.SCRNSAVE.EXE
push str.boot
call esi
push 0
lea eax, [ebp - 0x195c]
push eax
push 0
push 0xe
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [ebp - 0x228]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426891
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x228]
push eax
push 0xffffffffffffffff
push str.BackupSSPath
call fcn.0042ea80
add esp, 0x14
lea eax, [ebp - 0x195c]
push 0
push 4
push eax
push 0xffffffffffffffff
push str.BackupSSTimeout
call fcn.0042ea80
add esp, 0x14
call fcn.0041edc0
push 0x911ff9
lea eax, [ebp - 0x780]
xor esi, esi
push str._s.zip
push eax
call fcn.004484a0
add esp, 0xc
lea ecx, [ebp - 0x780]
call fcn.00448680
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test al, al
je 0x42698c
lea eax, [ebp - 0x195c]
mov byte [0x916e5e], 0
push eax
push esi
push esi
push 0x428360
push esi
push esi
call edi
test eax, eax
je 0x4269e9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x41db90
push 0x6b
push dword [0x91709c]
mov ecx, 0x911000
call fcn.0043f4a0
mov esi, eax
test esi, esi
je 0x42698c
lea ecx, [ebp - 0x780]
call fcn.00448560
cmp esi, 0x1a
jne 0x4269f9
mov ecx, 0x911000
call fcn.00442df0
test eax, eax
jne 0x4269f9
push eax
push str._CONVERTDATAFILES
push 2
mov ecx, 0x911000
call fcn.004438f0
jmp 0x426a2e
push 0x617744
push 0x911ff9
lea eax, [ebp - 0x1958]
push str._s._s
push eax
call fcn.004484a0
add esp, 0x10
lea ecx, [ebp - 0x1958]
call fcn.00448680
test al, al
je 0x426a72
lea eax, [ebp - 0x195c]
mov byte [0x916e5e], 0
push eax
push 0
push 0
push 0x428220
push 0
push 0
call edi
test eax, eax
jne 0x426a50
lea ecx, [ebp - 0x1958]
call fcn.00448560
lea ecx, [ebp - 0x780]
call fcn.00448560
mov esi, 3
push esi
push 0
push 0x111
push 0
push 0x66
mov ecx, 0x912530
call fcn.0042f710
push eax
push 0
push 0
mov ecx, 0x912530
call fcn.0042f710
push eax
push 0
push 0x911000
call fcn.004442a0
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ff23c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x41db90
push 0x6b
push dword [0x91709c]
mov ecx, 0x911000
call fcn.0043f4a0
mov esi, eax
xor edx, edx
mov ecx, 0x617768
call fcn.00417650
lea ecx, [ebp - 0x1958]
call fcn.00448560
lea ecx, [ebp - 0x780]
call fcn.00448560
test esi, esi
jne 0x42695a
push str._CONVERTDATAFILES
mov ecx, 0x911000
call fcn.00440190
cmp eax, 0xffffffff
je 0x426ac7
push esi
push 0x615266
push 1
mov ecx, 0x911000
call fcn.004438f0
jmp 0x426a2e
push 0x615538
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x10
call dword [sym.imp.GDI32.dll_CreateFontA]
cmp byte [0x91196c], 0
mov dword [0x91f40c], eax
je 0x426b1c
cmp byte [0x635508], 0
je 0x426b1c
mov eax, dword [0x63550c]
test eax, eax
je 0x426b1c
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408210
call fcn.004097b0
push str.EarthView.bmp
push 0x911734
push str._s_s
push 0x104
push 0x91f410
call fcn.00407c20
add esp, 0x14
push str.EVScrsvr.bmp
push 0x911734
push str._s_s
push 0x104
push 0x91f1d8
call fcn.00407c20
add esp, 0x14
lea eax, [ebp - 0x120]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x120]
push eax
call fcn.0042e770
add esp, 4
lea eax, [ebp - 0x120]
push str.EarthView.scr
push eax
push str._s_s
push 0x104
push 0x91f2f0
call fcn.00407c20
add esp, 0x14
push 0x104
push 0x91f2f0
push 0x91f2f0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call fcn.00410c30
test eax, eax
je 0x426bdb
push eax
push 0
push 0x111
push 0
push 0x6a
jmp 0x426a05
push 0x6167a4
push 0x6167a8
push 0x911734
push str._s_s._s
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.00407c20
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x228]
add esp, 0x18
push eax
call esi
push 0x6167c8
push 0x6167a8
push 0x911734
push str._s_s._s
mov edi, eax
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.00407c20
add esp, 0x18
lea eax, [ebp - 0x228]
push eax
call esi
cmp eax, 0xffffffff
je 0x426c51
xor esi, esi
cmp edi, 0xffffffff
jne 0x426cb8
lea eax, [ebp - 0x195c]
mov byte [0x916e5e], 0
push eax
push 0
push 0
push 0x428540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x426c8a
mov esi, 3
push esi
push eax
push 0x111
push eax
push 0x6a
jmp 0x426a05
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x41db90
push 0x6b
push dword [0x91709c]
mov ecx, 0x911000
call fcn.0043f4a0
xor edx, edx
mov ecx, 0x617768
mov esi, eax
call fcn.00417650
test esi, esi
je 0x426ccd
push esi
push 0
push 0x111
push 0
push 0x6a
jmp 0x426a05
lea ecx, [ebp - 0xc98]
call fcn.00407220
push 0
push 3
push 0x615418
push 0x12c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
lea ecx, [ebp - 0xc98]
call fcn.004879f0
lea ecx, [ebp - 0xc98]
call fcn.004864e0
test al, al
je 0x427310
lea ecx, [ebp - 0xc98]
xor edi, edi
call fcn.00486490
lea ecx, [ebp - 0xc98]
mov dword [0x91f2ec], eax
call fcn.00486350
mov dword [0x91f2e8], eax
imul eax, dword [0x91f2ec]
push eax
call fcn.0050491e
add esp, 4
mov dword [0x91f1d0], eax
test eax, eax
je 0x427310
mov eax, dword [0x91f2e8]
xor edx, edx
mov dword [ebp - 0x195c], edx
test eax, eax
jle 0x426dab
mov ecx, dword [0x91f2ec]
xor esi, esi
test ecx, ecx
jle 0x426da0
nop dword [eax]
sub eax, edx
lea ecx, [ebp - 0xc98]
dec eax
push eax
push esi
call fcn.00485c30
mov ecx, dword [0x91f1d0]
inc esi
mov edx, dword [ebp - 0x195c]
mov byte [ecx + edi], al
inc edi
mov ecx, dword [0x91f2ec]
mov eax, dword [0x91f2e8]
cmp esi, ecx
jl 0x426d70
inc edx
mov dword [ebp - 0x195c], edx
cmp edx, eax
jl 0x426d63
lea ecx, [ebp - 0xc98]
call fcn.00489160
cmp byte [0x635514], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
je 0x426dd1
push 0x91f410
call esi
cmp eax, 0xffffffff
jne 0x426de5
mov ecx, 0x91f410
call fcn.004060b0
mov edi, eax
test edi, edi
jne 0x427223
cmp byte [0x635514], 0
je 0x426dfa
push 0x91f1d8
call esi
cmp eax, 0xffffffff
jne 0x426e0e
mov ecx, 0x91f1d8
call fcn.004060b0
mov edi, eax
test edi, edi
jne 0x427223
call fcn.0042c880
test al, al
je 0x426e23
mov eax, dword [0x920c6c]
mov byte [eax + 0x88], 1
mov eax, dword [0x920c6c]
cmp byte [eax + 0x88], 0
je 0x426e52
lea eax, [ebp - 0x195c]
push eax
push 0
push 1
push 0x42c950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042ca40
test al, al
je 0x426e67
mov eax, dword [0x920c58]
mov byte [eax + 0x88], 1
mov eax, dword [0x920c58]
cmp byte [eax + 0x88], 0
je 0x426e7f
mov ecx, 1
call fcn.0042cb00
push 0
push 0
push 0
push 0
push 0x10000400
push 0
push 0
push 0
mov ecx, 0x912530
call fcn.0042f710
push eax
push 0x425930
push 0
mov ecx, 0x911000
call fcn.0043dd40
mov edi, eax
test edi, edi
jns 0x426ebe
mov edi, 0x32
jmp 0x427223
mov eax, dword [0x912720]
sub esp, 8
mov ecx, 0x911000
mov eax, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
mov eax, dword [eax]
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa6
mov dword [0x91f2e4], eax
call fcn.0043d420
cmp eax, 0xffffffff
jne 0x426f0d
lea edi, [eax + 0x33]
jmp 0x427223
sub esp, 8
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa4
call fcn.0043d420
cmp eax, 0xffffffff
jne 0x426f4e
lea edi, [eax + 0x33]
jmp 0x427223
sub esp, 8
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa2
call fcn.0043d420
cmp eax, 0xffffffff
jne 0x426f8f
lea edi, [eax + 0x33]
jmp 0x427223
sub esp, 8
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa1
call fcn.0043d420
cmp eax, 0xffffffff
jne 0x426fd0
lea edi, [eax + 0x33]
jmp 0x427223
sub esp, 8
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0xc0
push 1
push 0xfa0
call fcn.0043d420
cmp eax, 0xffffffff
jne 0x427011
lea edi, [eax + 0x33]
jmp 0x427223
sub esp, 8
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x80
push 1
push 0xfa5
call fcn.0043d420
cmp eax, 0xffffffff
jne 0x427052
lea edi, [eax + 0x33]
jmp 0x427223
sub esp, 8
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x40080
push 3
push 0x44c
call fcn.0043d420
cmp eax, 0xffffffff
je 0x42721e
mov esi, 1
nop dword [eax]
nop dword [eax + eax]
sub esp, 8
lea eax, [esi + 0x44c]
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0xffff
push 0xffff
push 0x40080
push 1
push eax
call fcn.0043d420
cmp eax, 0xffffffff
je 0x42721e
inc esi
cmp esi, 0x10
jle 0x4270a0
sub esp, 8
mov ecx, 0x911000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0x90e340
push 0xffff
push 0
push 0x80
push 3
push 0x3e8
call fcn.0043d420
cmp eax, 0xffffffff
jne 0x427126
lea edi, [eax + 0x33]
jmp 0x427223
cmp byte [0x635510], 0
jne 0x427138
mov byte [0x91196d], 1
jmp 0x42717b
cmp byte [0x91196d], 0
jne 0x42717b
cmp byte [0x91196c], 0
jne 0x42717b
push 0
push 0x422520
push 0
push 0x6c
push dword [0x911000]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x91709c], eax
test eax, eax
jne 0x427172
lea edi, [eax + 0x32]
jmp 0x427223
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x635513], 0
je 0x42718c
or ecx, 0xffffffff
call fcn.004215e0
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x4d2
push 0x83ff
push dword [0x91f2e4]
call esi
push 0
push 0x4d2
push 0x7e
push dword [0x91f2e4]
call esi
mov eax, dword [0x920c6c]
cmp byte [eax + 0x88], 0
je 0x427212
push 0
call fcn.0050e3e0
mov ecx, dword [0x920c6c]
add esp, 4
mov esi, edx
sub eax, dword [ecx + 0x80]
mov dword [ebp - 0x195c], eax
sbb esi, dword [ecx + 0x84]
mov ecx, dword [ecx + 0x94]
mov eax, ecx
shl eax, 4
sub eax, ecx
shl eax, 2
cdq
cmp esi, edx
jl 0x427212
jg 0x427208
cmp dword [ebp - 0x195c], eax
jbe 0x427212
mov dword [0x91f51c], 1
mov ecx, 0x911000
call fcn.00443960
jmp 0x427223
mov edi, 0xf00b
call fcn.004224a0
lea eax, [ebp - 0x1964]
push eax
push 0
push 0
push 0x42c950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.0042cb00
push 0x911734
lea eax, [ebp - 0x12f8]
push str._s.tmp
push eax
call fcn.004484a0
add esp, 0xc
lea ecx, [ebp - 0x12f8]
call fcn.00448680
test al, al
je 0x42729d
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea ecx, [ebp - 0x12f8]
call fcn.00448590
push eax
call esi
lea ecx, [ebp - 0x12f8]
call fcn.00448680
test al, al
jne 0x427280
mov eax, dword [0x91f40c]
test eax, eax
je 0x4272ad
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0xfffffffe
call fcn.004215e0
mov eax, dword [0x91f1d0]
test eax, eax
je 0x4272c9
push eax
call fcn.00504903
add esp, 4
test edi, edi
je 0x427305
push edi
push 0
push 0x111
push 0
push 0xf003
mov ecx, 0x912530
call fcn.0042f710
push eax
push 0
push 0
mov ecx, 0x912530
call fcn.0042f710
push eax
push 0
push 0x911000
call fcn.004442a0
add esp, 0x1c
lea ecx, [ebp - 0x12f8]
call fcn.00448560
mov eax, dword [ebp - 0x790]
mov dword [ebp - method.CImage.virtual_0], vtable.CImage.0
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x788], 0
test eax, eax
je 0x42734a
cmp byte [ebp - 0x784], 0
jne 0x42734a
push eax
call fcn.00504903
add esp, 4
mov dword [ebp - 0x790], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xc98]
mov dword [ebp - method.CxImage.virtual_0], vtable.CxImage.0
call fcn.00489220
lea ecx, [ebp - 0xc98]
call fcn.00489160
jmp 0x426a2e