Function at 0x401371
Capabilities:
Check if file exists
Create directory
Delete file
Encode data using xor
Move file
Read .ini file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x116c
call fcn.00405dd0
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x55f]
mov byte [ebp - 0x560], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x560]
mov dword [ebp - 8], ebx
push eax
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x560]
push 0x40f250
push eax
call fcn.00405dbc
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x401a7d
push 2
push ebx
push edi
call fcn.00405d10
push edi
call fcn.00405bb8
push edi
mov esi, eax
call fcn.00405b64
push ebx
push dword [0x40f040]
push edi
call fcn.00405d10
push edi
push 1
lea eax, [ebp - 0xc]
push 4
push eax
mov dword [ebp - 0xc], ebx
call fcn.00405a7c
add esp, 0x30
cmp dword [ebp - 0xc], 0x50555241
jne 0x40146f
push edi
push 1
lea eax, [ebp - 4]
push 4
push eax
mov dword [ebp - 4], ebx
call fcn.00405a7c
sub esi, dword [0x40f040]
add esp, 0x10
cmp esi, dword [ebp - 4]
jb 0x40146f
mov esi, dword [ebp - 4]
push esi
call fcn.00405a6e
cmp eax, ebx
pop ecx
mov dword [ebp - 0x14], eax
je 0x401472
push esi
push ebx
push eax
call fcn.00405790
push edi
push 1
push esi
push dword [ebp - 0x14]
call fcn.00405a7c
add esp, 0x1c
xor eax, eax
cmp esi, ebx
jbe 0x401472
mov ecx, dword [ebp - 0x14]
add ecx, eax
xor byte [ecx], 0x80
inc eax
cmp eax, esi
jb 0x401460
jmp 0x401472
mov esi, dword [ebp - 0x10]
push edi
call fcn.00405a18
cmp dword [ebp - 0x14], ebx
pop ecx
je 0x401a7d
cmp esi, ebx
je 0x401a7d
push ebx
push esi
push dword [ebp - 0x14]
call fcn.00405661
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x401a6f
push 0x4a
xor eax, eax
pop ecx
lea edi, [ebp - 0x354]
mov dword [ebp - 0x358], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
call fcn.00405678
add esp, 0xc
test eax, eax
jne 0x401a66
mov eax, dword [ebp - 0x358]
mov dword [ebp - 8], 1
cmp eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], ebx
jle 0x401a66
cmp dword [ebp - 8], ebx
je 0x401a66
push 0x12c
lea eax, [ebp - 0x358]
push ebx
push eax
call fcn.00405790
lea eax, [ebp - 0x358]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.00405678
add esp, 0x18
test eax, eax
jne 0x401a57
push 0x40
lea edi, [ebp - 0x127]
pop ecx
mov byte [ebp - 0x128], bl
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x128]
push eax
call fcn.004057f0
lea eax, [ebp - 0x128]
push eax
call fcn.004058e0
add esp, 0xc
cmp byte [ebp + eax - 0x129], 0x5c
je 0x401573
lea eax, [ebp - 0x128]
push 0x40f17c
push eax
call fcn.00405800
pop ecx
pop ecx
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00405800
cmp byte [ebp - 0x128], bl
pop ecx
pop ecx
lea eax, [ebp - 0x128]
je 0x4015a3
cmp byte [eax], 0x2f
jne 0x40159e
mov byte [eax], 0x5c
inc eax
cmp byte [eax], bl
jne 0x401596
test byte [ebp - 0x250], 0x10
je 0x4015bf
lea eax, [ebp - 0x128]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x401a57
lea eax, [ebp - 0x354]
push str.config.ini
push eax
call fcn.0040b1d0
pop ecx
test eax, eax
pop ecx
jne 0x40181c
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x128]
push eax
call esi
test eax, eax
je 0x401822
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x22b]
mov byte [ebp - 0x22c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.004057f0
lea eax, [ebp - 0x22c]
push str..new
push eax
call fcn.00405800
add esp, 0x10
mov edi, 0x80
lea eax, [ebp - 0x22c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x358]
push dword [ebp - 4]
call fcn.004056f1
add esp, 0xc
test eax, eax
je 0x4016e9
mov esi, dword [ebp - 0x230]
mov dword [ebp - 0x1c], esi
add esi, 0x400
push esi
call fcn.00405966
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
je 0x4016e6
push esi
push ebx
push eax
call fcn.00405790
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x358]
push dword [ebp - 4]
call fcn.0040570a
add esp, 0x1c
test eax, eax
jne 0x4016e6
push ebx
push edi
push 2
push ebx
push 1
lea eax, [ebp - 0x22c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4016e6
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4016e9
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
je 0x401a57
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x963]
mov byte [ebp - 0x964], bl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [ebp - 0x964]
push 0x400
push eax
push 0x411db0
mov edi, str.update
push str.x86url
push edi
call esi
lea eax, [ebp - 0x964]
push eax
call fcn.004058e0
test eax, eax
pop ecx
jbe 0x40175d
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x964]
push eax
push str.x86url
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x964]
push 0x400
push eax
push 0x411db0
push str.x64url
push edi
call esi
lea eax, [ebp - 0x964]
push eax
call fcn.004058e0
test eax, eax
pop ecx
jbe 0x4017a8
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x964]
push eax
push str.x64url
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x22c]
mov edi, str.SystemClean
push eax
lea eax, [ebp - 0x964]
push 0x400
push eax
push 0x411db0
push str.FileExts
push edi
call esi
lea eax, [ebp - 0x964]
push eax
call fcn.004058e0
test eax, eax
pop ecx
jbe 0x4017f8
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x964]
push eax
push str.FileExts
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x22c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401a57
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x128]
push eax
call esi
test eax, eax
je 0x401849
lea eax, [ebp - 0x128]
push str.banner.png
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x401a57
lea eax, [ebp - 0x128]
push eax
call esi
test eax, eax
je 0x401870
lea eax, [ebp - 0x128]
push str.webbkgnd.png
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x401a57
mov edx, 0x100
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0xd67]
mov byte [ebp - 0xd68], bl
mov byte [ebp - 0x116c], bl
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x116b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x10], ebx
push eax
call esi
test eax, eax
je 0x4018fb
lea eax, [ebp - 0x128]
push str.atpgreen.ini
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4018fb
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea eax, [ebp - 0x128]
push eax
mov edi, 0x400
lea eax, [ebp - 0xd68]
push edi
push eax
push str.AtpBanner
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x116c]
push edi
push eax
push str.AtpWebBkgnd
call esi
mov dword [ebp - 0x10], 1
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x45b]
mov byte [ebp - 0x45c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.004057f0
lea eax, [ebp - 0x45c]
push str..del
push eax
call fcn.00405800
add esp, 0x10
lea eax, [ebp - 0x45c]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, 0x80
lea eax, [ebp - 0x45c]
push edi
push eax
call esi
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x128]
push edi
push eax
call esi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x358]
push dword [ebp - 4]
call fcn.004056f1
add esp, 0xc
test eax, eax
je 0x401a22
mov esi, dword [ebp - 0x230]
mov dword [ebp - 0x24], esi
add esi, 0x400
push esi
call fcn.00405966
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
je 0x401a1f
push esi
push ebx
push eax
call fcn.00405790
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x358]
push dword [ebp - 4]
call fcn.0040570a
add esp, 0x1c
test eax, eax
jne 0x401a1f
push ebx
push edi
push 2
push ebx
push 1
lea eax, [ebp - 0x128]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401a1f
lea eax, [ebp - 0x1c]
push ebx
push eax
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401a22
mov dword [ebp - 8], ebx
cmp dword [ebp - 0x10], ebx
je 0x401a57
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0xd68]
push eax
push str.AtpBanner
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x116c]
push eax
push str.AtpWebBkgnd
call esi
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jl 0x4014ec
push dword [ebp - 4]
call fcn.00405725
pop ecx
push dword [ebp - 0x14]
call fcn.0040595b
mov eax, dword [ebp - 8]
pop ecx
jmp 0x401a7f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret