Function at 0x4bd7e0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4bd7fe
jmp 0x4bdf71
lea ecx, [ebp - 0x2c]
call fcn.00426ee0
mov dword [ebp - 0x24], 0x400
mov dword [ebp - 0x54], 2
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004a10e0
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x4d], 1
push 0x5ac9b4
lea ecx, [ebp - 0x280]
push ecx
call fcn.00434c10
add esp, 4
mov ecx, eax
call fcn.004273c0
push eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x280]
call fcn.00426fe0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd8d8
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x5ac9cc
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd8d8
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...config.ini
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd8d8
mov byte [ebp - 0x4d], 0
lea ecx, [ebp - 0x4c]
call fcn.00426ee0
mov dword [ebp - 0x24], 0x80
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x4c]
call fcn.004a10e0
mov dword [ebp - 0x28], eax
movzx eax, byte [ebp - 0x4d]
cmp eax, 1
jne 0x4bd927
lea ecx, [ebp - 0x2c]
call fcn.004273c0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x5ac654
push 0x5ac7bc
push 0x5ac9e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4bd934
push 0x5ac9ec
lea ecx, [ebp - 0x4c]
call fcn.00427020
lea ecx, [ebp - 0x4c]
call fcn.004468a0
push 0x5ac884
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
je 0x4bd95e
push 0x5ac9f4
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bd96a
mov dword [ebp - 0x54], 1
jmp 0x4bdb72
push 0x5ac8e4
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
je 0x4bd98c
push 0x5ac9fc
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bd998
mov dword [ebp - 0x54], 0
jmp 0x4bdb72
push 0x5aca04
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
je 0x4bd9ba
push 0x5aca0c
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bd9c6
mov dword [ebp - 0x54], 2
jmp 0x4bdb72
push 0x5aca14
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
je 0x4bd9e8
push 0x5aca1c
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bd9f4
mov dword [ebp - 0x54], 7
jmp 0x4bdb72
push str.pt_br
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
je 0x4bda16
push 0x5aca30
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bda22
mov dword [ebp - 0x54], 0xa
jmp 0x4bdb72
push str.es_419
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
je 0x4bda44
push 0x5aca48
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bda50
mov dword [ebp - 0x54], 9
jmp 0x4bdb72
push 0x5aca50
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
je 0x4bda72
push 0x5aca58
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bda7e
mov dword [ebp - 0x54], 8
jmp 0x4bdb72
push 0x5aca60
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bda9b
mov dword [ebp - 0x54], 0xb
jmp 0x4bdb72
push 0x5aca68
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdab8
mov dword [ebp - 0x54], 0xc
jmp 0x4bdb72
push 0x5aca70
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdad5
mov dword [ebp - 0x54], 0xd
jmp 0x4bdb72
push 0x5aca78
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdaf2
mov dword [ebp - 0x54], 0xe
jmp 0x4bdb72
push 0x5aca80
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdb0c
mov dword [ebp - 0x54], 0xf
jmp 0x4bdb72
push 0x5aca88
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdb26
mov dword [ebp - 0x54], 0x10
jmp 0x4bdb72
push 0x5aca90
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdb40
mov dword [ebp - 0x54], 0xf
jmp 0x4bdb72
push 0x5aca98
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdb5a
mov dword [ebp - 0x54], 3
jmp 0x4bdb72
push 0x5acaa0
lea ecx, [ebp - 0x4c]
call fcn.004467b0
test eax, eax
jne 0x4bdb72
mov dword [ebp - 0x54], 0x11
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
call fcn.0042bd10
push 0xffffffffffffffff
lea ecx, [ebp - 0x4c]
call fcn.0042bd10
lea ecx, [ebp - 0x20]
call fcn.0042df30
lea ecx, [ebp - 0x48]
call fcn.0042df30
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x12
ja case.0x4bdbb2.4
mov ecx, dword [ebp - 0x29c]
jmp dword [ecx*4 + 0x4bdf84]
push 0x5acaa8
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5acb08
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push 0x5acb18
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5acba4
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push 0x5acbd0
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5accc8
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push 0x5accf0
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ace50
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.Os_arquivos_do_360_Total_Security_foram_danificados.__nReinstale_o_360_Total_Security_e_fa
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5acf94
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.360_Total_Security_dosyalar
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad108
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.Los_archivos_de_360_Total_Security_han_sido_da
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad264
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push 0x5ad290
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad378
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.360_Total_Security_____.__n360_Total_Security___________.__n_:
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad4c4
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push 0x5ad4f0
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad5a0
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.360_Total_Security_Dateien_wurden_besch
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad6e4
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.Les_fichiers_de_360_Total_Security_ont
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad848
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.I_file_di_360_Total_Security_sono_stati_danneggiati._nReinstalla_360_Total_Security_e_avvia_una_scansione_dei_virus._nDocumenti_danneggiati:
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5ad988
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.Pliki_aplikacji_360_Total_Security_zosta
lea ecx, [ebp - 0x20]
call fcn.00425030
push 0x5adb0c
lea ecx, [ebp - 0x48]
call fcn.00425030
jmp 0x4bdd79
push str.360_Total_Security_files_have_been_damaged.__nPlease_reinstall_360_Total_Security_and_scan_for_viruses.__nDamaged_documents:
lea ecx, [ebp - 0x20]
call fcn.00425030
push str.360_Total_Security
lea ecx, [ebp - 0x48]
call fcn.00425030
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
call fcn.004307c0
lea ecx, [ebp - 0x20]
call fcn.0042bd60
mov dword [ebp - 0x6c], eax
lea ecx, [ebp - 0x48]
call fcn.0042bd60
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
push 0x14
mov ecx, dword [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x65], 0
cmp dword [ebp - 0x60], 6
jne 0x4bddd0
call fcn.004be1f0
mov byte [ebp - 0x65], 1
jmp 0x4bddfa
cmp dword [ebp - 0x60], 0
jne 0x4bddfa
push 0x14
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 6
jne 0x4bddfa
call fcn.004be1f0
mov byte [ebp - 0x65], 1
mov dword [ebp - 0x64], 1
lea edx, [ebp - 0x64]
push edx
push 0
push ecx
mov ecx, esp
push str.UserExperience
call fcn.00426f30
push ecx
mov ecx, esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.00426f30
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x290]
call fcn.00426160
push eax
call fcn.004262b0
add esp, 8
lea ecx, [ebp - 0x290]
call fcn.00426e20
cmp dword [ebp - 0x64], 0
je 0x4bdf51
xor eax, eax
mov word [ebp - 0x278], ax
push 0x206
push 0
lea ecx, [ebp - 0x276]
push ecx
call fcn.0055e2a0
add esp, 0xc
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x278]
push eax
call fcn.004c3690
add esp, 0xc
lea ecx, [ebp - 0x278]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea edx, [ebp - 0x278]
test edx, edx
je 0x4bdf51
movzx eax, word [ebp - 0x278]
test eax, eax
je 0x4bdf51
lea ecx, [ebp - 0x27c]
call fcn.00426ee0
movzx ecx, byte [ebp - 0x65]
test ecx, ecx
je 0x4bdecc
mov dword [ebp - 0x2a0], 0x5adcc4
jmp 0x4bded6
mov dword [ebp - 0x2a0], 0x5adcc8
mov edx, dword [0x5ebb24]
push edx
mov eax, dword [0x5ebb20]
push eax
mov ecx, dword [0x5ebb1c]
push ecx
mov edx, dword [0x5ebb18]
push edx
mov eax, dword [0x5ebb10]
push eax
mov ecx, dword [ebp - 0x2a0]
push ecx
lea edx, [ebp - 0x278]
push edx
mov ecx, 0x5eb4f8
call fcn.004c4380
mov ecx, eax
call fcn.0044e150
mov eax, dword [eax]
push eax
push str._snosign.htm_f_sre_smid_sver_slan_sos_sch_s
lea ecx, [ebp - 0x27c]
push ecx
call fcn.0042fa10
add esp, 0x28
push 0xfa0
lea ecx, [ebp - 0x27c]
call fcn.004273c0
push eax
call fcn.0044e430
add esp, 8
lea ecx, [ebp - 0x27c]
call fcn.00426fe0
lea ecx, [ebp - 0x48]
call fcn.00424f60
lea ecx, [ebp - 0x20]
call fcn.00424f60
lea ecx, [ebp - 0x4c]
call fcn.00426fe0
lea ecx, [ebp - 0x2c]
call fcn.00426fe0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret 4