Function at 0x405d20
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x2000
push 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405fdd
lea edi, [esi + 0x400]
mov byte [esi], 0
push 0
mov dword [ebp - 4], edi
add edi, 0x400
push 0x435f14
push 0x80000002
lea ebx, [edi + 0x400]
call fcn.00413e50
mov dword [ebp - 8], eax
test eax, eax
je 0x405d97
push 0x104
push esi
push str.DirProductBase
push eax
call fcn.004141c0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.HealthMon.exe
push esi
push 0x436114
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov byte [ebx], 0
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x435f5c
push ebx
call esi
push str.AVHealthMonitor
push ebx
call esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str.HealthMon.exe
push ebx
push 0x436114
push edi
call esi
add esp, 0x10
push 0
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x405fdd
push str.HealthMon.dat
push ebx
push 0x436114
push edi
call esi
push 0
call fcn.0041bfa4
push eax
push 0x436d84
push dword [ebp - 4]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0x20
push edi
push dword [ebp - 4]
push str.Time
push str.HealthMonInfo
call esi
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00401300
mov dword [ebp - 0xc], eax
test eax, eax
je 0x405fdd
push edi
push eax
push 0x436da0
push str.HealthMonInfo
call esi
push dword [ebp - 0xc]
call fcn.004194d4
mov ecx, dword [ebp - 0x10]
add esp, 4
xor edx, edx
call fcn.00401300
mov dword [ebp - 0x10], eax
test eax, eax
je 0x405fdd
push edi
push eax
push str.UpdtUrl
push str.HealthMonInfo
call esi
push dword [ebp - 0x10]
call fcn.004194d4
mov edx, dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp + 8]
call fcn.00401300
mov dword [ebp - 0x10], eax
test eax, eax
je 0x405fdd
push edi
push eax
push str.Data
push str.HealthMonInfo
call esi
push dword [ebp - 0x10]
call fcn.004194d4
mov eax, dword [ebp + 0x10]
add esp, 4
test eax, eax
je 0x405f88
push eax
push 0x436d84
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
push dword [ebp - 4]
push str.UseProxy
push str.HealthMonInfo
call esi
mov ecx, dword [ebp + 0x14]
xor edx, edx
call fcn.00401300
mov dword [ebp - 0x10], eax
test eax, eax
je 0x405fdd
push edi
push eax
push str.ProxySetup
push str.HealthMonInfo
call esi
push dword [ebp - 0x10]
call fcn.004194d4
mov ecx, dword [ebp + 0x18]
add esp, 4
cmp byte [ecx], 0
je 0x405f59
xor edx, edx
call fcn.00401300
mov dword [ebp - 0x10], eax
test eax, eax
je 0x405fdd
push edi
push eax
push str.ProxyUser
push str.HealthMonInfo
call esi
push dword [ebp - 0x10]
call fcn.004194d4
add esp, 4
mov ecx, dword [ebp + 0x1c]
cmp byte [ecx], 0
je 0x405f88
xor edx, edx
call fcn.00401300
mov dword [ebp - 0x10], eax
test eax, eax
je 0x405fdd
push edi
push eax
push str.ProxyPass
push str.UninstallInfo
call esi
push dword [ebp - 0x10]
call fcn.004194d4
add esp, 4
push str.HealthMon.exe
push ebx
push str.__s_s_
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.AVHealthMon
call fcn.00414ad0
test eax, eax
jne 0x405fd1
push str.AV_Health_Monitor
push str.RPCSS
push 0x110
push 2
push edi
push str.AV_Health_Monitor
push str.AVHealthMon
call fcn.00414950
cmp eax, 1
jne 0x405fdd
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret