Function at 0x7023ab80
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70313c79
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x7036ee20]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edi, ecx
mov dword [ebp - 0x238], edi
test eax, eax
jne 0x7023acd5
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.702e95e0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.360weiboguard.exe
push 0x70359d48
lea eax, [ebp - 0x218]
push eax
mov edi, 1
call esi
lea eax, [ebp - 0x218]
call fcn.702b4730
test eax, eax
je 0x7023acc2
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.702156d0
add esp, 0xc
test eax, eax
je 0x7023ac68
mov eax, dword [ebp - 0x240]
mov ecx, eax
shr ecx, 0x10
cmp ecx, edi
jne 0x7023ac68
test ax, ax
jne 0x7023ac68
mov eax, dword [ebp - 0x23c]
mov edx, eax
shr edx, 0x10
test edx, edx
jne 0x7023ac68
mov ecx, 0x3e9
cmp ax, cx
jne 0x7023ac68
xor edi, edi
push 1
push 0x1a
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x7023acc2
push str.360safe
lea eax, [ebp - 0x218]
push eax
mov ecx, eax
push ecx
call esi
push str.wdsns.ini
lea edx, [ebp - 0x218]
push edx
mov eax, edx
push eax
call esi
lea ecx, [ebp - 0x218]
push ecx
push edi
push str.ProtectSnsSite
push 0x7032ae50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov eax, 1
jne 0x7023acc7
mov eax, 2
push eax
push 0x7036ee20
call ebx
mov edi, dword [ebp - 0x238]
mov edx, dword [0x7036ee20]
cmp edx, 1
jne 0x7023aeab
push edi
call fcn.7023a900
test eax, eax
je 0x7023aeab
push 0
push 1
push 0x7036ee24
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x7023ad54
push 3
push 0x7036ee24
call ebx
push 0x1c
call fcn.702e1f8d
mov esi, eax
add esp, 4
mov dword [ebp - 0x238], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x7023ad33
push esi
call fcn.7022b0d0
jmp 0x7023ad35
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [0x7036ee28], esi
call fcn.7026a1d0
test eax, eax
je 0x7023ad54
push 2
push 0x7036ee24
call ebx
mov eax, dword [0x7036ee24]
cmp eax, 2
jne 0x7023aeab
mov esi, dword [edi]
test esi, esi
je 0x7023ad96
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x7023ad7b
xor esi, esi
jmp 0x7023ad96
lea edi, [eax + eax]
mov eax, edi
call fcn.702e98d0
mov ebx, esp
mov eax, esi
xor edx, edx
mov ecx, edi
mov esi, ebx
call fcn.7020c920
mov esi, eax
push 0x703274b4
push esi
call fcn.702e3c10
add esp, 8
test eax, eax
jne 0x7023adac
mov eax, esi
jmp 0x7023adaf
add eax, 3
mov cl, byte [eax]
test cl, cl
je 0x7023aeab
lea esp, [esp]
cmp cl, 0x2f
je 0x7023add2
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x7023adc0
jmp 0x7023aeab
cmp byte [eax], 0
je 0x7023aeab
inc eax
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], 0
mov byte [ebp - 0x230], 0
mov dword [ebp - 4], 1
mov dl, byte [eax]
mov ecx, eax
test dl, dl
je 0x7023aeab
lea ebx, [ebx]
cmp dl, 0x23
je 0x7023ae1d
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x7023ae10
cmp ecx, eax
je 0x7023aeab
cmp byte [ecx], 0x23
mov ebx, 0x10
jne 0x7023ae52
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.7020c1f0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x21c], ebx
jae 0x7023ae52
lea eax, [ebp - 0x230]
mov edi, dword [0x7036ee28]
test edi, edi
je 0x7023ae94
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x7023ae61
push edi
sub ecx, esi
push ecx
push eax
call fcn.7026a320
test eax, eax
je 0x7023ae94
cmp dword [ebp - 0x21c], ebx
jb 0x7023ae8d
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.702e1c24
add esp, 4
mov eax, 1
jmp 0x7023aead
cmp dword [ebp - 0x21c], ebx
jb 0x7023aeab
mov edx, dword [ebp - 0x230]
push edx
call fcn.702e1c24
add esp, 4
xor eax, eax
lea esp, [ebp - 0x250]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret