Function at 0x4ca5d0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x5a53f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4ca5ee
jmp 0x4cace7
lea ecx, [ebp - 0x2c]
call fcn.00404e70
mov dword [ebp - 0x24], 0x400
mov dword [ebp - 0x54], 2
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403560
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x4d], 1
push 0x579eb4
lea ecx, [ebp - 0x280]
push ecx
call fcn.00408440
add esp, 4
mov ecx, eax
call fcn.00404d60
push eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x280]
call fcn.00404d70
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ca6c8
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x579ecc
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ca6c8
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...config.ini
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ca6c8
mov byte [ebp - 0x4d], 0
lea ecx, [ebp - 0x4c]
call fcn.00404e70
mov dword [ebp - 0x24], 0x80
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x4c]
call fcn.00403560
mov dword [ebp - 0x28], eax
movzx eax, byte [ebp - 0x4d]
cmp eax, 1
jne 0x4ca717
lea ecx, [ebp - 0x2c]
call fcn.00404d60
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x579b54
push 0x579cbc
push 0x579ee4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4ca724
push 0x579eec
lea ecx, [ebp - 0x4c]
call fcn.004032f0
lea ecx, [ebp - 0x4c]
call fcn.004204e0
push str.zh_tw
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
je 0x4ca74e
push 0x579ef4
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca75a
mov dword [ebp - 0x54], 1
jmp 0x4ca945
push str.zh_cn
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
je 0x4ca77c
push 0x579efc
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca788
mov dword [ebp - 0x54], 0
jmp 0x4ca945
push 0x579f04
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
je 0x4ca7aa
push 0x579f0c
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca7b6
mov dword [ebp - 0x54], 2
jmp 0x4ca945
push 0x579f14
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
je 0x4ca7d8
push 0x579f1c
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca7e4
mov dword [ebp - 0x54], 7
jmp 0x4ca945
push str.pt_br
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
je 0x4ca806
push 0x579f30
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca812
mov dword [ebp - 0x54], 0xa
jmp 0x4ca945
push str.es_419
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
je 0x4ca834
push 0x579f48
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca840
mov dword [ebp - 0x54], 9
jmp 0x4ca945
push 0x579f50
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
je 0x4ca862
push 0x579f58
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca86e
mov dword [ebp - 0x54], 8
jmp 0x4ca945
push 0x579f60
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca88b
mov dword [ebp - 0x54], 0xb
jmp 0x4ca945
push 0x579f68
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca8a8
mov dword [ebp - 0x54], 0xc
jmp 0x4ca945
push 0x579f70
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca8c5
mov dword [ebp - 0x54], 0xd
jmp 0x4ca945
push 0x579f78
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca8df
mov dword [ebp - 0x54], 0xe
jmp 0x4ca945
push 0x579f80
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca8f9
mov dword [ebp - 0x54], 0xf
jmp 0x4ca945
push 0x579f88
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca913
mov dword [ebp - 0x54], 0x10
jmp 0x4ca945
push 0x579f90
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca92d
mov dword [ebp - 0x54], 0xf
jmp 0x4ca945
push 0x579f98
lea ecx, [ebp - 0x4c]
call fcn.00420280
test eax, eax
jne 0x4ca945
mov dword [ebp - 0x54], 3
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404800
push 0xffffffffffffffff
lea ecx, [ebp - 0x4c]
call fcn.00404800
lea ecx, [ebp - 0x20]
call fcn.0040a730
lea ecx, [ebp - 0x48]
call fcn.0040a730
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x10
ja case.0x4ca985.3
mov ecx, dword [ebp - 0x29c]
jmp dword [ecx*4 + 0x4cacf8]
push 0x579fa0
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a000
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push 0x57a010
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a09c
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push 0x57a0c8
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a1c0
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push 0x57a1e8
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a348
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push str.Os_arquivos_do_360_Total_Security_foram_danificados.__nReinstale_o_360_Total_Security_e_fa
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a48c
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push str.360_Total_Security_dosyalar
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a600
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push str.Los_archivos_de_360_Total_Security_han_sido_da
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a75c
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push 0x57a788
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a870
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push str.360_Total_Security_____.__n360_Total_Security___________.__n_:
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57a9bc
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push 0x57a9e8
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57aa98
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push str.360_Total_Security_Dateien_wurden_besch
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push 0x57abd8
lea ecx, [ebp - 0x48]
call fcn.0040aa00
jmp 0x4caaef
push str.360_Total_Security_files_have_been_damaged.__nPlease_reinstall_360_Total_Security_and_scan_for_viruses.__nDamaged_documents:
lea ecx, [ebp - 0x20]
call fcn.0040aa00
push str.360_Total_Security
lea ecx, [ebp - 0x48]
call fcn.0040aa00
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
call fcn.0040a8b0
lea ecx, [ebp - 0x20]
call fcn.00406540
mov dword [ebp - 0x6c], eax
lea ecx, [ebp - 0x48]
call fcn.00406540
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
push 0x14
mov ecx, dword [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x65], 0
cmp dword [ebp - 0x60], 6
jne 0x4cab46
call fcn.004caf60
mov byte [ebp - 0x65], 1
jmp 0x4cab70
cmp dword [ebp - 0x60], 0
jne 0x4cab70
push 0x14
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 6
jne 0x4cab70
call fcn.004caf60
mov byte [ebp - 0x65], 1
mov dword [ebp - 0x64], 1
lea edx, [ebp - 0x64]
push edx
push 0
push ecx
mov ecx, esp
push str.UserExperience
call fcn.00403220
push ecx
mov ecx, esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.00403220
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x290]
call fcn.00414410
push eax
call fcn.00414950
add esp, 8
lea ecx, [ebp - 0x290]
call fcn.00415320
cmp dword [ebp - 0x64], 0
je 0x4cacc7
xor eax, eax
mov word [ebp - 0x278], ax
push 0x206
push 0
lea ecx, [ebp - 0x276]
push ecx
call fcn.00534b20
add esp, 0xc
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x278]
push eax
call fcn.004d03b0
add esp, 0xc
lea ecx, [ebp - 0x278]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea edx, [ebp - 0x278]
test edx, edx
je 0x4cacc7
movzx eax, word [ebp - 0x278]
test eax, eax
je 0x4cacc7
lea ecx, [ebp - 0x27c]
call fcn.00404e70
movzx ecx, byte [ebp - 0x65]
test ecx, ecx
je 0x4cac42
mov dword [ebp - 0x2a0], 0x57ad8c
jmp 0x4cac4c
mov dword [ebp - 0x2a0], 0x57ad90
mov edx, dword [0x5a91dc]
push edx
mov eax, dword [0x5a91d8]
push eax
mov ecx, dword [0x5a91d4]
push ecx
mov edx, dword [0x5a91d0]
push edx
mov eax, dword [0x5a91c8]
push eax
mov ecx, dword [ebp - 0x2a0]
push ecx
lea edx, [ebp - 0x278]
push edx
mov ecx, 0x5a8bb0
call fcn.004d14c0
mov ecx, eax
call fcn.004d1480
mov eax, dword [eax]
push eax
push str._snosign.htm_f_sre_smid_sver_slan_sos_sch_s
lea ecx, [ebp - 0x27c]
push ecx
call fcn.00404aa0
add esp, 0x28
push 0xfa0
lea ecx, [ebp - 0x27c]
call fcn.00404d60
push eax
call fcn.00426780
add esp, 8
lea ecx, [ebp - 0x27c]
call fcn.00404d70
lea ecx, [ebp - 0x48]
call fcn.00406510
lea ecx, [ebp - 0x20]
call fcn.00406510
lea ecx, [ebp - 0x4c]
call fcn.00404d70
lea ecx, [ebp - 0x2c]
call fcn.00404d70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005308cb
mov esp, ebp
pop ebp
ret 4