Function at 0x405aa0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4537a9
mov eax, dword fs:[0]
push eax
sub esp, 0x59c
mov eax, dword [0x46a850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x590], ecx
mov dword [ebp - 0x360], 0
mov al, byte [0x457b09]
mov byte [ebp - 0xf4], al
push 0x31
push 0
lea ecx, [ebp - 0xf3]
push ecx
call fcn.0043b1e0
add esp, 0xc
mov dl, byte [0x457b09]
mov byte [ebp - 0xa4], dl
push 0x31
push 0
lea eax, [ebp - 0xa3]
push eax
call fcn.0043b1e0
add esp, 0xc
call fcn.0041f307
push eax
lea ecx, [ebp - 0x6c]
call fcn.00407790
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xac], eax
call fcn.0041f307
push eax
lea ecx, [ebp - 0x60]
call fcn.00407790
mov byte [ebp - 4], 1
call fcn.0041f307
push eax
lea ecx, [ebp - 0xc0]
call fcn.00407790
mov byte [ebp - 4], 2
call fcn.0041f307
push eax
lea ecx, [ebp - 0xa8]
call fcn.00407790
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2fc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea ecx, [ebp - 0xc0]
call fcn.00407b50
push eax
push 0
push 0x457ef4
lea edx, [ebp - 0x2fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0xc0]
call fcn.004072e0
push str.3eeff2aee9b7da1b2f0a8e941c71a7db51fc1bc17c17df827aec76873d434bf9
push 0x457ac0
lea eax, [ebp - 0x60]
push eax
call fcn.00408c10
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x60]
call fcn.00407b50
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x36c]
push ecx
lea ecx, [ebp - 0x60]
call fcn.004072a0
push eax
mov ecx, 0x46c2b0
call fcn.00405a30
push 0xffffffffffffffff
lea ecx, [ebp - 0x60]
call fcn.004072e0
mov dword [ebp - 0x304], 0
jmp 0x405c21
mov edx, dword [ebp - 0x304]
add edx, 1
mov dword [ebp - 0x304], edx
cmp dword [ebp - 0x304], 4
jge 0x405d00
mov eax, dword [ebp - 0x304]
and eax, 0x80000001
jns 0x405c40
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x405c59
push str..mmj7.
push str..eol8.
lea ecx, [ebp - 0x60]
call fcn.00406b90
jmp 0x405c6b
push str..eol8.
push str..mmj7.
lea ecx, [ebp - 0x60]
call fcn.00406b90
push 0x800
lea ecx, [ebp - 0xc0]
call fcn.00407b50
mov dword [ebp - 0x3f4], eax
push 1
mov ecx, dword [ebp - 0x3f4]
push ecx
lea ecx, [ebp - 0x60]
call fcn.004072a0
push eax
call dword [0x46c378]
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0x3fc], edx
mov eax, dword [ebp - 0x3fc]
push eax
push 0xa
lea ecx, [ebp - 0x2fc]
push ecx
push 0x457e4c
push 0x457e48
push str.Conf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x405cfb
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0x400], edx
mov eax, dword [ebp - 0x400]
push eax
push 0xffffffffffffffff
push 0x457e48
push str.Conf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x300], eax
jmp 0x405d00
jmp 0x405c12
call fcn.0041f307
push eax
lea ecx, [ebp - 0x68]
call fcn.00407790
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x300]
push ecx
push str.m_RunMode:________d
lea edx, [ebp - 0x68]
push edx
call fcn.00409590
add esp, 0xc
cmp dword [ebp - 0x300], 0xffffffff
jne 0x405dd3
push 0
call fcn.0043db86
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x68]
sub eax, 0x10
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
call fcn.004045c0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa8]
sub ecx, 0x10
mov dword [ebp - 0x408], ecx
mov ecx, dword [ebp - 0x408]
call fcn.004045c0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xc0]
sub edx, 0x10
mov dword [ebp - 0x40c], edx
mov ecx, dword [ebp - 0x40c]
call fcn.004045c0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
sub eax, 0x10
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x410]
call fcn.004045c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x6c]
sub ecx, 0x10
mov dword [ebp - 0x414], ecx
mov ecx, dword [ebp - 0x414]
call fcn.004045c0
jmp 0x4067ca
call fcn.0041f307
push eax
lea ecx, [ebp - 0xb8]
call fcn.00407790
mov byte [ebp - 4], 5
call fcn.0041f307
push eax
lea ecx, [ebp - 0x64]
call fcn.00407790
mov byte [ebp - 4], 6
push 0x104
lea ecx, [ebp - 0x64]
call fcn.00407b50
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x64]
call fcn.004072e0
mov edx, str._agent.db
test edx, edx
jne 0x405e32
mov dword [ebp - 0x420], 0
jmp 0x405e45
push str._agent.db
call fcn.0043dc1e
add esp, 4
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
push eax
push str._agent.db
lea ecx, [ebp - 0x64]
call fcn.00408930
push 0x400
lea ecx, [ebp - 0xb8]
call fcn.00407b50
push eax
push str.3eeff2aee9b7da1b2f0a8e941c71a7db727c5a464efde87f
mov ecx, 0x46c2b0
call fcn.00405a30
push 0xffffffffffffffff
lea ecx, [ebp - 0xb8]
call fcn.004072e0
mov ecx, dword [0x46c35c]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x42c]
push eax
mov ecx, dword [0x46c35c]
push ecx
lea ecx, [ebp - 0xb8]
call fcn.00408930
mov edx, str..inf
test edx, edx
jne 0x405ec3
mov dword [ebp - 0x430], 0
jmp 0x405ed6
push str..inf
call fcn.0043dc1e
add esp, 4
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x430]
push eax
push str..inf
lea ecx, [ebp - 0xb8]
call fcn.00408930
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x308], 0
jmp 0x405f0f
mov ecx, dword [ebp - 0x308]
add ecx, 1
mov dword [ebp - 0x308], ecx
cmp dword [ebp - 0x308], 4
jge 0x405fa9
mov edx, dword [ebp - 0x308]
and edx, 0x80000001
jns 0x405f2f
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x405f48
push str..mmj7.
push str..eol8.
lea ecx, [ebp - 0x60]
call fcn.00406b90
jmp 0x405f5a
push str..eol8.
push str..mmj7.
lea ecx, [ebp - 0x60]
call fcn.00406b90
push 1
lea ecx, [ebp - 0x64]
call fcn.004072a0
push eax
lea ecx, [ebp - 0xb8]
call fcn.004072a0
push eax
call dword [0x46c378]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
push ecx
push 0xffffffffffffffff
push str.count
push str.FlowData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xffffffff
jle 0x405fa4
jmp 0x405fa9
jmp 0x405f00
mov dword [ebp - 0x30c], 0
jmp 0x405fc4
mov edx, dword [ebp - 0x30c]
add edx, 1
mov dword [ebp - 0x30c], edx
mov eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x70]
jge 0x406405
call fcn.0041f307
push eax
lea ecx, [ebp - 0x314]
call fcn.00407790
mov byte [ebp - 4], 7
call fcn.0041f307
push eax
lea ecx, [ebp - 0x310]
call fcn.00407790
mov byte [ebp - 4], 8
call fcn.0041f307
push eax
lea ecx, [ebp - 0x328]
call fcn.00407790
mov byte [ebp - 4], 9
call fcn.0041f307
push eax
lea ecx, [ebp - 0x324]
call fcn.00407790
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x30c]
push ecx
push str.type
push str._s_d
lea edx, [ebp - 0x314]
push edx
call fcn.00408c10
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x314]
call fcn.004072e0
mov eax, dword [ebp - 0x30c]
push eax
push 0x457d60
push str._s_d
lea ecx, [ebp - 0x310]
push ecx
call fcn.00408c10
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x310]
call fcn.004072e0
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x4c8], edx
mov eax, dword [ebp - 0x4c8]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x314]
call fcn.004072a0
push eax
push str.FlowData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x4d0], ecx
push 0x800
lea ecx, [ebp - 0x328]
call fcn.00407b50
mov dword [ebp - 0x4d4], eax
mov edx, dword [ebp - 0x4d0]
push edx
push 0x7ff
mov eax, dword [ebp - 0x4d4]
push eax
push 0x457e4c
lea ecx, [ebp - 0x310]
call fcn.004072a0
push eax
push str.FlowData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x328]
call fcn.004072e0
push 0x800
lea ecx, [ebp - 0x324]
call fcn.00407b50
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
push ecx
lea ecx, [ebp - 0x328]
call fcn.004072a0
push eax
mov ecx, 0x46c2b0
call fcn.00405a30
push 0xffffffffffffffff
lea ecx, [ebp - 0x324]
call fcn.004072e0
lea ecx, [ebp - 0x320]
call fcn.00406890
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x318], 0
jl 0x406208
push 4
lea edx, [ebp - 0x330]
push edx
lea ecx, [ebp - 0x324]
call fcn.00407120
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x4fc], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x360]
or ecx, 1
mov dword [ebp - 0x360], ecx
mov edx, str.http
neg edx
sbb edx, edx
neg edx
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x4f4], edx
jne 0x4061c3
push 0x80004005
call fcn.00403940
xor eax, eax
jne 0x4061a0
xor ecx, ecx
jne 0x4061c7
mov edx, dword [ebp - 0x4fc]
mov eax, dword [edx]
mov dword [ebp - 0x4f8], eax
push str.http
mov ecx, dword [ebp - 0x4f8]
push ecx
call fcn.0043e56e
add esp, 8
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0
jne 0x406208
mov dword [ebp - 0x598], 1
jmp 0x406212
mov dword [ebp - 0x598], 0
mov dl, byte [ebp - 0x598]
mov byte [ebp - 0x329], dl
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x360]
and eax, 1
je 0x406251
and dword [ebp - 0x360], 0xfffffffe
mov ecx, dword [ebp - 0x330]
sub ecx, 0x10
mov dword [ebp - 0x504], ecx
mov ecx, dword [ebp - 0x504]
call fcn.004045c0
movzx edx, byte [ebp - 0x329]
test edx, edx
je 0x40627c
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x324]
push ecx
lea ecx, [ebp - 0x320]
call fcn.00408e70
jmp 0x406296
mov dword [ebp - 0x31c], 0xffffffff
push 0x457e4c
lea ecx, [ebp - 0x320]
call fcn.00408e70
sub esp, 8
mov edx, esp
mov dword [ebp - 0x340], esp
mov dword [ebp - 0x518], edx
lea eax, [ebp - 0x320]
push eax
mov ecx, dword [ebp - 0x518]
call fcn.00408e10
mov ecx, dword [ebp - 0x518]
mov edx, dword [ebp - 0x31c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x59c], eax
mov ecx, dword [ebp - 0x30c]
push ecx
lea edx, [ebp - 0x34c]
push edx
call fcn.00408c40
add esp, 0x10
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x5a4], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x5a4]
push ecx
lea ecx, [ebp - 0x33c]
call fcn.00408ce0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x33c]
push edx
lea eax, [ebp - 0x358]
push eax
mov ecx, 0x46bf5c
call fcn.00407360
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x338]
sub ecx, 0x10
mov dword [ebp - 0x51c], ecx
mov ecx, dword [ebp - 0x51c]
call fcn.004045c0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x348]
sub edx, 0x10
mov dword [ebp - 0x520], edx
mov ecx, dword [ebp - 0x520]
call fcn.004045c0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x320]
sub eax, 0x10
mov dword [ebp - 0x524], eax
mov ecx, dword [ebp - 0x524]
call fcn.004045c0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x324]
sub ecx, 0x10
mov dword [ebp - 0x528], ecx
mov ecx, dword [ebp - 0x528]
call fcn.004045c0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x328]
sub edx, 0x10
mov dword [ebp - 0x52c], edx
mov ecx, dword [ebp - 0x52c]
call fcn.004045c0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x310]
sub eax, 0x10
mov dword [ebp - 0x530], eax
mov ecx, dword [ebp - 0x530]
call fcn.004045c0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x314]
sub ecx, 0x10
mov dword [ebp - 0x534], ecx
mov ecx, dword [ebp - 0x534]
call fcn.004045c0
jmp 0x405fb5
mov edx, dword [0x46bf78]
mov dword [ebp - 0x538], edx
cmp dword [ebp - 0x538], 0
ja 0x4064f3
push 0
call fcn.0043db86
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x64]
sub eax, 0x10
mov dword [ebp - 0x53c], eax
mov ecx, dword [ebp - 0x53c]
call fcn.004045c0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xb8]
sub ecx, 0x10
mov dword [ebp - 0x540], ecx
mov ecx, dword [ebp - 0x540]
call fcn.004045c0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x68]
sub edx, 0x10
mov dword [ebp - 0x544], edx
mov ecx, dword [ebp - 0x544]
call fcn.004045c0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xa8]
sub eax, 0x10
mov dword [ebp - 0x548], eax
mov ecx, dword [ebp - 0x548]
call fcn.004045c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc0]
sub ecx, 0x10
mov dword [ebp - 0x54c], ecx
mov ecx, dword [ebp - 0x54c]
call fcn.004045c0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x60]
sub edx, 0x10
mov dword [ebp - 0x550], edx
mov ecx, dword [ebp - 0x550]
call fcn.004045c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6c]
sub eax, 0x10
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
call fcn.004045c0
jmp 0x4067ca
lea ecx, [ebp - 0x5c]
call fcn.00406890
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xb4]
call fcn.00406890
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xb0]
call fcn.00406890
mov byte [ebp - 4], 0x11
push 0x400
mov ecx, dword [ebp - 0x590]
add ecx, 0xa8
call fcn.00407b50
push eax
push str.b0c543e67cde315cf0b07d56872c6014f2dc65d1ebe842dae9b0a48d09cd7002
mov ecx, 0x46c2b0
call fcn.00405a30
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x590]
add ecx, 0xa8
call fcn.004072e0
lea ecx, [ebp - 0x54]
push ecx
push 0
lea edx, [ebp - 0x58]
push edx
push 0
call fcn.00404600
add esp, 0x10
lea eax, [ebp - 0x58]
mov dword [ebp - 0xbc], eax
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.00406aa0
mov edx, dword [0x46c360]
push edx
mov eax, dword [0x46c35c]
push eax
mov ecx, dword [ebp - 0xbc]
movzx edx, byte [ecx + 3]
push edx
mov eax, dword [ebp - 0xbc]
movzx ecx, byte [eax + 2]
push ecx
mov edx, dword [ebp - 0xbc]
movzx eax, byte [edx + 1]
push eax
mov ecx, dword [ebp - 0xbc]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x5c]
push eax
push str.ua00001m_slip_d._d._d._dk0an_suac_s
lea ecx, [ebp - 0xb4]
push ecx
call fcn.00408c10
add esp, 0x24
lea edx, [ebp - 0xb4]
push edx
mov ecx, dword [ebp - 0x590]
add ecx, 0xa4
call fcn.00406a80
push 0x800
lea ecx, [ebp - 0xb0]
call fcn.00407b50
mov dword [ebp - 0x558], eax
push 0
mov eax, dword [ebp - 0x558]
push eax
lea ecx, [ebp - 0xb4]
call fcn.004072a0
push eax
call dword [0x46c370]
push 0xffffffffffffffff
lea ecx, [ebp - 0xb0]
call fcn.004072e0
lea ecx, [ebp - 0xb0]
push ecx
mov edx, dword [ebp - 0x590]
add edx, 0xa8
push edx
lea eax, [ebp - 0x35c]
push eax
call fcn.004071c0
add esp, 0xc
mov dword [ebp - 0x5a8], eax
mov ecx, dword [ebp - 0x5a8]
mov dword [ebp - 0x55c], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x55c]
mov eax, dword [edx]
mov dword [ebp - 0x560], eax
push 0
mov ecx, dword [ebp - 0x560]
push ecx
mov ecx, 0x46c2b0
call fcn.00405a70
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x35c]
sub edx, 0x10
mov dword [ebp - 0x564], edx
mov ecx, dword [ebp - 0x564]
call fcn.004045c0
push 0
push 0x457c68
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0xb0]
sub eax, 0x10
mov dword [ebp - 0x568], eax
mov ecx, dword [ebp - 0x568]
call fcn.004045c0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0xb4]
sub ecx, 0x10
mov dword [ebp - 0x56c], ecx
mov ecx, dword [ebp - 0x56c]
call fcn.004045c0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x5c]
sub edx, 0x10
mov dword [ebp - 0x570], edx
mov ecx, dword [ebp - 0x570]
call fcn.004045c0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x64]
sub eax, 0x10
mov dword [ebp - 0x574], eax
mov ecx, dword [ebp - 0x574]
call fcn.004045c0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xb8]
sub ecx, 0x10
mov dword [ebp - 0x578], ecx
mov ecx, dword [ebp - 0x578]
call fcn.004045c0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x68]
sub edx, 0x10
mov dword [ebp - 0x57c], edx
mov ecx, dword [ebp - 0x57c]
call fcn.004045c0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xa8]
sub eax, 0x10
mov dword [ebp - 0x580], eax
mov ecx, dword [ebp - 0x580]
call fcn.004045c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc0]
sub ecx, 0x10
mov dword [ebp - 0x584], ecx
mov ecx, dword [ebp - 0x584]
call fcn.004045c0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x60]
sub edx, 0x10
mov dword [ebp - 0x588], edx
mov ecx, dword [ebp - 0x588]
call fcn.004045c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6c]
sub eax, 0x10
mov dword [ebp - 0x58c], eax
mov ecx, dword [ebp - 0x58c]
call fcn.004045c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b25a
mov esp, ebp
pop ebp
ret