Function at 0x4060f0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c2b0
mov eax, dword fs:[0]
push eax
sub esp, 0x654
mov eax, dword [0x49d1b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb
xor eax, eax
mov dword [ebp - 0x454], 7
push str.YZWallpaper
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov word [ebp - 0x468], ax
call fcn.00404340
push 2
push 0x480644
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], 0
call fcn.00405610
cmp dword [ebp - 0x454], 8
lea eax, [ebp - 0x468]
lea ecx, [ebp - 0x65c]
cmovae eax, dword [ebp - 0x468]
push eax
call fcn.0041ca6c
lea ecx, [ebp - 0x65c]
mov byte [ebp - 4], 1
call fcn.0041cac8
test eax, eax
je 0x4061a0
xor esi, esi
jmp 0x4068b2
push 0x2e
push str.http:__down.znshuru.com_wall_yz_svc_cld_tt.dat
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x43c], 0xf
mov dword [ebp - 0x440], 0
mov byte [ebp - 0x450], 0
call fcn.00404120
cmp dword [ebp - 0x440], 0
mov byte [ebp - 4], 2
jne 0x4061e1
xor esi, esi
jmp 0x406879
lea ecx, [ebp - 0x5d0]
call fcn.0041ce97
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 3
call fcn.0042174f
cmp dword [0x49e600], 0
mov byte [ebp - 4], 4
jne 0x40620d
call fcn.004076c0
mov ecx, dword [0x49e600]
call fcn.00404ab0
push eax
lea ecx, [ebp - 0x4e0]
call fcn.00407300
lea eax, [ebp - 0x4e0]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x638]
call fcn.00421a58
mov eax, dword [ebp - 0x4cc]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x40625c
inc eax
lea ecx, [ebp - 0x4e0]
push eax
push dword [ebp - 0x4e0]
call fcn.00404500
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x406279
mov eax, dword [ecx]
jmp 0x40627b
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.00403ff0
lea ecx, [ebp - 0x5d0]
call fcn.0041d29b
xor edi, edi
mov byte [ebp - 0x639], 0
mov dword [ebp - 0x640], edi
nop dword [eax + eax]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x644], ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
cmp dword [ecx + 0x14], 0x10
jb 0x4062dc
mov eax, dword [ecx]
jmp 0x4062de
mov eax, ecx
push 0x2e
push str.http:__down.znshuru.com_wall_yz_svc_cld_tt.dat
mov byte [eax], bl
call fcn.00404120
lea ecx, [ebp - 0x5d0]
call fcn.0041d0a9
test al, al
jne 0x406307
cmp byte [ebp - 0x639], bl
je 0x4065ff
lea ecx, [ebp - 0x5d0]
call fcn.0041d293
mov ebx, eax
test edi, edi
jne 0x40644e
lea ecx, [ebp - 0x5d0]
call fcn.0041d297
test al, al
je 0x40644e
push 5
push str.svl01
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x484], 0xf
mov dword [ebp - 0x488], edi
mov byte [ebp - 0x498], 0
call fcn.00404120
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 6
call fcn.0041d72e
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x64c]
call fcn.004213db
mov byte [ebp - 4], 8
cmp dword [0x49e608], edi
jne 0x40638e
call fcn.00407780
mov ecx, dword [0x49e608]
push 0
call fcn.00402b30
cmp dword [ebp - 0x46c], 0x10
lea esi, [ebp - 0x480]
lea edi, [ebp - 0x498]
cmovae esi, dword [ebp - 0x480]
cmp dword [ebp - 0x484], 0x10
cmovae edi, dword [ebp - 0x498]
cmp dword [0x49e608], 0
jne 0x4063d1
call fcn.00407780
mov ecx, dword [0x49e608]
push esi
push 1
push edi
push 1
call fcn.00402ee0
mov eax, dword [ebp - 0x46c]
cmp eax, 0x10
jb 0x406400
inc eax
lea ecx, [ebp - 0x480]
push eax
push dword [ebp - 0x480]
call fcn.004044b0
lea ecx, [ebp - 0x64c]
mov dword [ebp - 0x46c], 0xf
mov dword [ebp - 0x470], 0
mov byte [ebp - 0x480], 0
call fcn.00421e70
mov eax, dword [ebp - 0x484]
mov byte [ebp - 4], 4
cmp eax, 0x10
jb 0x406448
inc eax
lea ecx, [ebp - 0x498]
push eax
push dword [ebp - 0x498]
call fcn.004044b0
mov edi, dword [ebp - 0x640]
cmp dword [0x49e600], 0
jne 0x40645c
call fcn.004076c0
mov ecx, dword [0x49e600]
lea eax, [ebp - 0x4f8]
push eax
call fcn.00404d00
push 1
push 1
push eax
push ebx
push 0
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 9
call fcn.004219ce
movzx esi, al
mov eax, dword [ebp - 0x4e4]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x4064aa
inc eax
lea ecx, [ebp - 0x4f8]
push eax
push dword [ebp - 0x4f8]
call fcn.00404500
test edi, edi
jne 0x4065e4
lea ecx, [ebp - 0x5d0]
call fcn.0041d297
test al, al
je 0x4065e4
push 5
push str.svl02
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], 0xf
mov dword [ebp - 0x4b8], edi
mov byte [ebp - 0x4c8], 0
call fcn.00404120
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 0xa
call fcn.0041d72e
lea eax, [ebp - 0x4b0]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x654]
call fcn.004213db
xor ebx, ebx
mov byte [ebp - 4], 0xc
test esi, esi
setne bl
cmp dword [0x49e608], edi
jne 0x40652b
call fcn.00407780
mov ecx, dword [0x49e608]
push 0
call fcn.00402b30
cmp dword [ebp - 0x49c], 0x10
lea esi, [ebp - 0x4b0]
lea edi, [ebp - 0x4c8]
cmovae esi, dword [ebp - 0x4b0]
cmp dword [ebp - 0x4b4], 0x10
cmovae edi, dword [ebp - 0x4c8]
cmp dword [0x49e608], 0
jne 0x40656e
call fcn.00407780
mov ecx, dword [0x49e608]
push esi
push ebx
push edi
push 1
call fcn.00402ee0
mov eax, dword [ebp - 0x49c]
cmp eax, 0x10
jb 0x40659c
inc eax
lea ecx, [ebp - 0x4b0]
push eax
push dword [ebp - 0x4b0]
call fcn.004044b0
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x49c], 0xf
mov dword [ebp - 0x4a0], 0
mov byte [ebp - 0x4b0], 0
call fcn.00421e70
mov eax, dword [ebp - 0x4b4]
mov byte [ebp - 4], 4
cmp eax, 0x10
jb 0x4065e4
inc eax
lea ecx, [ebp - 0x4c8]
push eax
push dword [ebp - 0x4c8]
call fcn.004044b0
lea ecx, [ebp - 0x5d0]
mov dword [ebp - 0x640], 1
call fcn.0041d721
mov ebx, dword [ebp - 0x644]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0042a980
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0042a980
add esp, 0x18
lea eax, [ebp - 0x420]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.0042aada
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
movzx eax, word [ebp + ecx - 0x420]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21a], ax
test ax, ax
jne 0x406652
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x406673
mov ecx, 0xb
mov esi, str.LocalLowExplorerMenu_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
movsw word es:[edi], word [esi]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x406696
mov eax, dword [str.YZWallpaper]
lea edi, [ebp - 0x218]
mov dword [ecx], eax
add edi, 0xfffffffe
mov eax, dword [0x4803f0]
mov dword [ecx + 4], eax
mov eax, dword [0x4803f4]
mov dword [ecx + 8], eax
mov eax, dword [0x4803f8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4803fc]
mov dword [ecx + 0x10], eax
mov eax, dword [0x480400]
mov dword [ecx + 0x14], eax
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4066e0
mov ecx, 6
lea eax, [ebp - 0x218]
mov esi, str.RunDate.ini
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40685e
call fcn.0041b166
push 0
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.0041b042
add esp, 0xc
cmp dword [ebp - 0x428], 8
mov byte [ebp - 4], 0xd
jne 0x406826
push 4
push 4
lea eax, [ebp - 0x510]
push eax
lea ecx, [ebp - 0x438]
call fcn.00408170
mov esi, eax
lea eax, [ebp - 0x438]
cmp eax, esi
je 0x4067a0
mov eax, dword [ebp - 0x424]
cmp eax, 8
jb 0x406777
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00404500
xor eax, eax
mov dword [ebp - 0x424], 7
push esi
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
call fcn.004053a0
mov eax, dword [ebp - 0x4fc]
cmp eax, 8
jb 0x4067be
inc eax
lea ecx, [ebp - 0x510]
push eax
push dword [ebp - 0x510]
call fcn.00404500
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push ecx
push 0
push str.Interval
push eax
call edi
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
mov esi, eax
lea eax, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x438]
push eax
push 0xffffffffffffffff
push str.Disable
push ecx
call edi
cmp eax, 1
je 0x406826
test esi, esi
je 0x406826
mov byte [ebp - 0x639], 1
imul ebx, esi, 0xea60
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x406848
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00404500
test ebx, ebx
je 0x40685e
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x640]
jmp 0x4062b0
lea ecx, [ebp - 0x638]
mov esi, 1
call fcn.00421765
lea ecx, [ebp - 0x5d0]
call fcn.0041cf9c
mov eax, dword [ebp - 0x43c]
cmp eax, 0x10
jb 0x406897
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.004044b0
mov dword [ebp - 0x43c], 0xf
mov dword [ebp - 0x440], 0
mov byte [ebp - 0x450], 0
lea ecx, [ebp - 0x65c]
call fcn.0041ca81
mov ecx, dword [ebp - 0x454]
cmp ecx, 8
jb 0x4068db
inc ecx
push ecx
push dword [ebp - 0x468]
lea ecx, [ebp - 0x468]
call fcn.00404500
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ea9a
mov esp, ebp
pop ebp
ret