Function at 0x4c7ea0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x258], eax
test eax, eax
je 0x4c8692
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
add eax, 0x10
push 0x400
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x254], eax
mov ebx, 2
call fcn.0044b200
mov esi, eax
lea eax, [ebp - 0x250]
push eax
mov byte [ebp - 0x249], 1
call fcn.00473c90
mov ecx, dword [eax]
add esp, 4
push str.config.ini
push ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 0x250]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4c7f3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
call edi
test eax, eax
jne 0x4c7f9e
push 0x400
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x561c54
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call edi
test eax, eax
jne 0x4c7f9e
push 0x400
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...config.ini
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call edi
test eax, eax
jne 0x4c7f9e
mov byte [ebp - 0x249], al
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
add eax, 0x10
push 0x80
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x248], eax
call fcn.0044b200
cmp byte [ebp - 0x249], 1
mov esi, dword [ebp - 0x254]
jne 0x4c7ff4
push esi
push 0x80
push eax
push 0x576bd0
push str.language
push 0x561c38
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4c8004
push 0x561bf0
lea ecx, [ebp - 0x248]
call fcn.00459660
lea ecx, [ebp - 0x248]
call fcn.00451410
mov ecx, eax
call fcn.0044b970
mov ecx, dword [ebp - 0x248]
push 0x5658d0
push ecx
call fcn.0051dcaf
add esp, 8
mov edi, 7
test eax, eax
je 0x4c8284
mov edx, dword [ebp - 0x248]
push 0x568524
push edx
call fcn.0051dcaf
add esp, 8
test eax, eax
je 0x4c8284
mov eax, dword [ebp - 0x248]
push str.zh_cn
push eax
call fcn.0051dcaf
add esp, 8
test eax, eax
je 0x4c8280
push 0x56851c
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c8280
push 0x568514
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c8289
push 0x561bf0
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c8289
push 0x56850c
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c827c
push 0x568504
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c827c
push str.pt_br
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c8275
push 0x5684f0
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c8275
push str.es_419
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c826e
push 0x5684d8
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c826e
push 0x5684d0
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c8267
push 0x5684c8
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
je 0x4c8267
push 0x5684c0
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c8193
lea ebx, [edi + 4]
jmp 0x4c8289
push 0x5684b8
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c81af
lea ebx, [eax + 0xc]
jmp 0x4c8289
push 0x5684b0
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c81cb
lea ebx, [eax + 0xd]
jmp 0x4c8289
push 0x5684a8
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c81e7
lea ebx, [eax + 0xe]
jmp 0x4c8289
push 0x5684a0
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c8203
lea ebx, [eax + 0xf]
jmp 0x4c8289
push 0x568498
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c821c
lea ebx, [eax + 0x10]
jmp 0x4c8289
push 0x5684a0
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c8235
lea ebx, [eax + 0xf]
jmp 0x4c8289
push 0x568490
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c824e
lea ebx, [eax + 3]
jmp 0x4c8289
push 0x568488
lea ecx, [ebp - 0x248]
call fcn.0042fbf0
test eax, eax
jne 0x4c8289
lea ebx, [eax + 0x11]
jmp 0x4c8289
mov ebx, 8
jmp 0x4c8289
mov ebx, 9
jmp 0x4c8289
mov ebx, 0xa
jmp 0x4c8289
mov ebx, edi
jmp 0x4c8289
xor ebx, ebx
jmp 0x4c8289
mov ebx, 1
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0051f6df
add esp, 8
test eax, eax
jl 0x4c86a5
cmp eax, dword [esi - 8]
jg 0x4c86a5
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0051f6df
add esp, 8
test eax, eax
jl 0x4c86a5
mov ecx, dword [ebp - 0x248]
cmp eax, dword [ecx - 8]
jg 0x4c86a5
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x248]
xor edx, edx
mov word [ecx + eax*2], dx
xor eax, eax
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], eax
mov word [ebp - 0x224], dx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x230], eax
mov word [ebp - 0x240], ax
cmp ebx, 0x12
ja case.0x4c831a.4
jmp dword [ebx*4 + 0x4c86b0]
push 0x568428
lea ecx, [ebp - 0x228]
call fcn.00455840
push 0x568414
lea ecx, [ebp - 0x244]
call fcn.00455840
jmp 0x4c83e0
push 0x568388
lea ecx, [ebp - 0x228]
call fcn.00455840
push 0x568360
lea ecx, [ebp - 0x244]
call fcn.00455840
jmp 0x4c83e0
push str.360_Total_Security_files_have_been_damaged.__nPlease_reinstall_360_Total_Security_and_scan_for_viruses.__nDamaged_documents:
jmp 0x4c834b
push 0x568108
jmp 0x4c834b
push str.Os_arquivos_do_360_Total_Security_foram_danificados.__nReinstale_o_360_Total_Security_e_fa
jmp 0x4c834b
push str.360_Total_Security_dosyalar
jmp 0x4c834b
push str.Los_archivos_de_360_Total_Security_han_sido_da
jmp 0x4c834b
push 0x567c80
jmp 0x4c834b
push 0x567b58
jmp 0x4c834b
push 0x567aa8
jmp 0x4c834b
push str.360_Total_Security_Dateien_wurden_besch
jmp 0x4c834b
push str.Les_fichiers_de_360_Total_Security_ont
jmp 0x4c834b
push str.I_file_di_360_Total_Security_sono_stati_danneggiati._nReinstalla_360_Total_Security_e_avvia_una_scansione_dei_virus._nDocumenti_danneggiati:
jmp 0x4c834b
push str.Pliki_aplikacji_360_Total_Security_zosta
jmp 0x4c834b
push 0x7b
push str.360_Total_Security_files_have_been_damaged.__nPlease_reinstall_360_Total_Security_and_scan_for_viruses.__nDamaged_documents:
lea ecx, [ebp - 0x228]
call fcn.0044fc50
push 0x12
push 0x568360
lea ecx, [ebp - 0x244]
call fcn.0044fc50
mov esi, dword [ebp - 0x258]
mov eax, esi
lea edx, [eax + 2]
jmp 0x4c83f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c83f0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x228]
call fcn.00451500
mov ebx, dword [ebp - 0x224]
mov eax, 8
cmp dword [ebp - 0x210], eax
jae 0x4c8425
lea ebx, [ebp - 0x224]
mov esi, dword [ebp - 0x240]
cmp dword [ebp - 0x22c], eax
jae 0x4c8439
lea esi, [ebp - 0x240]
push 0x14
push esi
push ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
call edi
mov byte [ebp - 0x249], 0
cmp eax, 6
je 0x4c8468
test eax, eax
jne 0x4c8474
push 0x14
push esi
push ebx
push eax
call edi
cmp eax, 6
jne 0x4c8474
call fcn.004c70d0
mov byte [ebp - 0x249], 1
lea ecx, [ebp - 0x250]
push ecx
xor ebx, ebx
push ebx
push ecx
mov ecx, esp
push str.UserExperience
mov dword [ebp - 0x250], 1
call fcn.00464b60
push ecx
mov ecx, esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.00464b60
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x268]
call fcn.00448da0
push eax
call int.00438100
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4c84dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c84ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x250], ebx
je 0x4c85ec
push 0x206
lea edx, [ebp - 0x20a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x20c], cx
call fcn.0051d250
mov eax, dword [ebp - 0x258]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.0051f901
add esp, 0x1c
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
xor eax, eax
cmp ax, word [ebp - 0x20c]
je 0x4c85ec
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
add eax, 0x10
cmp byte [ebp - 0x249], 0
mov dword [ebp - 0x250], eax
mov eax, 0x5675d0
jne 0x4c858b
mov eax, 0x5675cc
mov ecx, dword [0x598c60]
mov edx, dword [0x598c5c]
push ecx
mov ecx, dword [0x598c58]
push edx
mov edx, dword [0x598c54]
push ecx
mov ecx, dword [0x598c4c]
push edx
push ecx
push eax
mov eax, dword [0x598cc8]
lea edx, [ebp - 0x20c]
push edx
push eax
lea ecx, [ebp - 0x250]
push str._snosign.htm_f_sre_smid_sver_slan_sos_sch_s
push ecx
call fcn.0044ff30
mov edx, dword [ebp - 0x250]
push 0xfa0
push edx
call fcn.004fb5a0
add esp, 0x30
lea ecx, [ebp - 0x250]
call fcn.00442750
mov edi, 8
cmp dword [ebp - 0x22c], edi
jb 0x4c8608
mov eax, dword [ebp - 0x240]
push eax
call fcn.0051d230
add esp, 4
xor ecx, ecx
mov esi, 7
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], ebx
mov word [ebp - 0x240], cx
cmp dword [ebp - 0x210], edi
jb 0x4c8639
mov edx, dword [ebp - 0x224]
push edx
call fcn.0051d230
add esp, 4
xor eax, eax
mov word [ebp - 0x224], ax
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c8670
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c8692
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00414840
nop
inc esi
or dword [eax + eax + 33], 0xffffff83
dec esp
add byte [eax - 0x7d], ch
dec esp
add byte [edi - 0x43ffb37d], ah
or dword [eax + eax - 0x44], 0xffffff83
dec esp
add byte [ebx + eax*4 - 0x7c90ffb4], bh
dec esp
add byte [ebp - 0x7d], bh
dec esp
add byte [ebx + eax*4 - 0x7c89ffb4], al
dec esp
add byte [ebx - 0x6dffb37d], cl
or dword [eax + eax - 0x44], 0xffffff83
dec esp
add byte [ebx + eax*4 - 0x7c5fffb4], bh
dec esp
add byte [ecx - 0x51ffb37d], bl
or dword [eax + eax - 0x4b], 0xffffff83
dec esp
add ah, cl
int3