Function at 0x4a0af0
Capabilities:
Accept command line arguments
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d760
mov eax, dword fs:[0]
push eax
mov eax, 0x2120
call fcn.004b0a90
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2128], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xfb4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x17c0]
call fcn.00401e30
mov dword [ebp - 4], 0
cmp dword [0x58c060], 0
je 0x4a0c41
push 0
push str._restart1
lea ecx, [ebp - 0x17c0]
call fcn.004282c0
cmp eax, 0xffffffff
je 0x4a0c41
push str.EntClientEntAllfix.ini
lea eax, [ebp - 0x17c8]
push eax
call fcn.0041acc0
add esp, 8
mov byte [ebp - 4], 1
push str..dec
lea ecx, [ebp - 0x17c8]
push ecx
lea edx, [ebp - 0x17c4]
push edx
call fcn.00403700
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x17c8]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x17c4]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x2128]
add ecx, 0x78
call fcn.004086e0
test eax, eax
je 0x4a0bfe
mov ecx, dword [ebp - 0x2128]
add ecx, 0x78
call fcn.0043e290
push eax
push 0x540868
push str.EntAllfix.ini
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov dword [0x58c060], 0
cmp dword [0x58fb50], 0
je 0x4a0c23
push 0x54c0a4
push 0x58f750
call fcn.004045b0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x17c4]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x17c8]
call fcn.00401eb0
mov ecx, dword [ebp - 0x2128]
call fcn.004a0a20
test eax, eax
je 0x4a0ca3
push str._nN_kV
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [0x58fc78], 1
mov ecx, dword [ebp - 0x2128]
call fcn.004a0880
mov dword [ebp - 0x210c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c0]
call fcn.00401eb0
mov eax, dword [ebp - 0x210c]
jmp 0x4a1338
mov eax, dword [ebp - 0x2128]
cmp dword [eax + 0xa0], 0
je 0x4a0d29
push str.ck_W
push 0x58f750
call fcn.004045b0
add esp, 8
mov ecx, dword [ebp - 0x2128]
cmp dword [ecx + 0x58], 0
je 0x4a0d02
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x58]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a0d02
push 0
push 0
mov ecx, dword [ebp - 0x2128]
mov edx, dword [ecx + 0x5c]
push edx
mov eax, dword [ebp - 0x2128]
mov ecx, dword [eax + 0x58]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x2110], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c0]
call fcn.00401eb0
mov eax, dword [ebp - 0x2110]
jmp 0x4a1338
mov ecx, dword [ebp - 0x2128]
call fcn.004a0880
lea edx, [ebp - 0xfb8]
push edx
mov ecx, dword [ebp - 0x2128]
call fcn.0049fae0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xfb8]
call fcn.004086e0
test eax, eax
je 0x4a0de3
push 0x54c038
push 0x58f750
call fcn.004045b0
add esp, 8
mov eax, dword [ebp - 0x2128]
cmp dword [eax + 0x58], 0
je 0x4a0dad
mov ecx, dword [ebp - 0x2128]
mov edx, dword [ecx + 0x58]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a0dad
push 0
push 0
mov eax, dword [ebp - 0x2128]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x58]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x2114], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfb8]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c0]
call fcn.00401eb0
mov eax, dword [ebp - 0x2114]
jmp 0x4a1338
mov ecx, dword [ebp - 0x2128]
cmp dword [ecx + 0x60], 3
jl 0x4a0e4c
push 0x54c018
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [0x58fc78], 1
mov ecx, dword [ebp - 0x2128]
call fcn.004a0880
mov dword [ebp - 0x2118], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfb8]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c0]
call fcn.00401eb0
mov eax, dword [ebp - 0x2118]
jmp 0x4a1338
mov edx, dword [ebp - 0x2128]
cmp dword [edx + 0x9c], 0
jne 0x4a0eed
mov ecx, dword [ebp - 0x2128]
call fcn.0049f380
mov eax, dword [ebp - 0x2128]
cmp dword [eax + 0x9c], 0
jne 0x4a0eed
mov ecx, dword [ebp - 0x2128]
cmp dword [ecx + 0x58], 0
je 0x4a0eb7
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x58]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a0eb7
push 0
push 0
mov ecx, dword [ebp - 0x2128]
mov edx, dword [ecx + 0x5c]
push edx
mov eax, dword [ebp - 0x2128]
mov ecx, dword [eax + 0x58]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x211c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfb8]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c0]
call fcn.00401eb0
mov eax, dword [ebp - 0x211c]
jmp 0x4a1338
push 1
push str.EntUpdate
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x9c]
mov ecx, dword [ebp - 0x2128]
mov ecx, dword [ecx + 0x9c]
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
push str.EntUpdate
mov ecx, dword [ebp - 0x2128]
mov edx, dword [ecx + 0x9c]
mov eax, dword [ebp - 0x2128]
mov ecx, dword [eax + 0x9c]
mov edx, dword [edx]
mov eax, dword [edx + 0x18]
call eax
lea ecx, [ebp - 0xfac]
call fcn.00458d60
lea ecx, [ebp - 0xfac]
push ecx
call fcn.0041b620
add esp, 4
xor edx, edx
mov word [ebp - 0x17bc], dx
push 0x7fe
push 0
lea eax, [ebp - 0x17ba]
push eax
call fcn.004b0ac0
add esp, 0xc
push str.updatecfg.ini
lea ecx, [ebp - 0x17cc]
push ecx
call fcn.00401270
add esp, 8
lea ecx, [ebp - 0x17cc]
call fcn.0043e290
push eax
push 0x3ff
lea edx, [ebp - 0x17bc]
push edx
push 0x540868
push 0x5452c0
push str.360lib
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x17cc]
call fcn.00401eb0
xor eax, eax
mov word [ebp - 0x89c], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x89a]
push ecx
call fcn.004b0ac0
add esp, 0xc
mov ecx, dword [ebp - 0x2128]
add ecx, 0x78
call fcn.0043e290
push eax
push 0x3ff
lea edx, [ebp - 0x89c]
push edx
push 0x540868
push str.result
push str.360EntExam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
mov ecx, esp
mov dword [ebp - 0x2120], esp
lea eax, [ebp - 0x89c]
push eax
call fcn.00401e30
mov dword [ebp - 0x212c], eax
mov ecx, dword [ebp - 0x2128]
call fcn.004a2610
lea ecx, [ebp - 0xfac]
mov dword [ebp - 0x98], ecx
xor edx, edx
mov word [ebp - 0x94], dx
push 0x7e
push 0
lea eax, [ebp - 0x92]
push eax
call fcn.004b0ac0
add esp, 0xc
mov ecx, dword [ebp - 0x98]
movzx edx, byte [ecx + 3]
push edx
mov eax, dword [ebp - 0x98]
movzx ecx, byte [eax + 2]
push ecx
mov edx, dword [ebp - 0x98]
movzx eax, byte [edx + 1]
push eax
mov ecx, dword [ebp - 0x98]
movzx edx, byte [ecx]
push edx
push str._u._u._u._u
lea eax, [ebp - 0x94]
push eax
call fcn.00401ba0
add esp, 0x18
mov dword [ebp - 0xfb0], 0
mov ecx, dword [ebp - 0x2128]
add ecx, 0xa4
call fcn.00404d80
mov dword [ebp - 0x2104], 0
push 0x928
push 0
lea ecx, [ebp - 0x2100]
push ecx
call fcn.004b0ac0
add esp, 0xc
mov dword [ebp - 0x2104], 0x92c
push str.EntUpdate
push 0x80
lea edx, [ebp - 0x2100]
push edx
call fcn.004696c0
push str.enterprise
push 0x410
lea eax, [ebp - 0x1bf0]
push eax
call fcn.004696c0
push str.360app
push 0x80
lea ecx, [ebp - 0x1c70]
push ecx
call fcn.004696c0
lea ecx, [ebp - 0x17d4]
call fcn.00403840
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x2128]
cmp dword [edx + 0x94], 0
je 0x4a1161
mov eax, dword [ebp - 0x2128]
add eax, 0xc
push eax
lea ecx, [ebp - 0x17d4]
push ecx
mov edx, dword [ebp - 0x2128]
mov ecx, dword [edx + 0x94]
call fcn.00471710
jmp 0x4a1171
push 0x540868
lea ecx, [ebp - 0x17d4]
call fcn.00401ed0
mov eax, dword [ebp - 0x2128]
mov ecx, dword [eax + 0x84]
push ecx
lea edx, [ebp - 0xaa2]
push edx
mov eax, dword [ebp - 0x2128]
mov ecx, dword [eax + 0x6c]
push ecx
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x64]
push eax
lea ecx, [ebp - 0x17bc]
push ecx
lea edx, [ebp - 0xca2]
push edx
mov eax, dword [ebp - 0x17d4]
push eax
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0xfa2]
push edx
mov eax, dword [ebp - 0x2128]
mov ecx, dword [eax + 0x80]
push ecx
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push edx
push str.http:__EntUpdate.360.cn_EntClient.cab_t_umid_slv_smac_sip_scid_shost_ssl_s_sver_sdm_spk_s
push 0x208
lea edx, [ebp - 0x2080]
push edx
call fcn.00487e20
add esp, 0x3c
push 0x54bf00
push 0x208
lea eax, [ebp - 0x1e78]
push eax
call fcn.004696c0
mov dword [ebp - 0x17e0], 2
mov dword [ebp - 0x17dc], 0
push 1
lea ecx, [ebp - 0x2104]
push ecx
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x9c]
mov ecx, dword [ebp - 0x2128]
mov ecx, dword [ecx + 0x9c]
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x2108], eax
cmp dword [ebp - 0x2108], 0
jne 0x4a1271
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x17d4]
call fcn.00401eb0
jmp 0x4a1305
mov ecx, dword [ebp - 0x2128]
mov dword [ecx + 0xa0], 1
push str.EntUpdate
mov edx, dword [ebp - 0x2128]
mov eax, dword [edx + 0x9c]
mov ecx, dword [ebp - 0x2128]
mov ecx, dword [ecx + 0x9c]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x17d0], eax
cmp dword [ebp - 0x17d0], 0
jne 0x4a12d5
mov ecx, dword [ebp - 0x2128]
mov dword [ecx + 0xa0], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x17d4]
call fcn.00401eb0
jmp 0x4a1305
mov edx, dword [ebp - 0x2128]
mov eax, dword [ebp - 0xfb4]
mov dword [edx + 8], eax
mov dword [ebp - 0xfb0], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x17d4]
call fcn.00401eb0
xor ecx, ecx
jne 0x4a10b3
mov edx, dword [ebp - 0xfb0]
mov dword [ebp - 0x2124], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfb8]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c0]
call fcn.00401eb0
mov eax, dword [ebp - 0x2124]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret