Function at 0x40d0b0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4814c7
mov eax, dword fs:[0]
push eax
sub esp, 0x724
mov eax, dword [0x4a31d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xe
xor eax, eax
mov dword [ebp - 0x484], 7
push 0x4853f0
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x488], 0
mov word [ebp - 0x498], ax
call fcn.00407570
push 3
push 0x485644
lea ecx, [ebp - 0x498]
mov dword [ebp - 4], 0
call fcn.00407fe0
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
lea ecx, [ebp - 0x724]
cmovae eax, dword [ebp - 0x498]
push eax
call fcn.0041a6ba
lea ecx, [ebp - 0x724]
mov byte [ebp - 4], 1
call fcn.0041a716
test eax, eax
je 0x40d160
xor esi, esi
jmp 0x40d962
push 0x4e
push str.http:__bmzwe.sichuanqixin.com_image_hudie_6f37ffdf310e470d637f3b8cbdf1c8ec.bbf
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x46c], 0xf
mov dword [ebp - 0x470], 0
mov byte [ebp - 0x480], 0
call fcn.00409c00
cmp dword [ebp - 0x470], 0
mov byte [ebp - 4], 2
jne 0x40d1a1
xor esi, esi
jmp 0x40d929
lea ecx, [ebp - 0x4cc]
call fcn.0041befe
mov byte [ebp - 4], 3
call fcn.004097e0
mov ecx, eax
call fcn.0040c750
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x708], esp
push eax
call fcn.00407440
mov byte [ebp - 4], 4
call fcn.004097e0
mov ecx, eax
call fcn.0040c750
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00407440
lea ecx, [ebp - 0x4cc]
mov byte [ebp - 4], 3
call fcn.0041c9c4
push 0
call fcn.0040ead0
mov ecx, eax
call fcn.0040ad00
lea ecx, [ebp - 0x5f4]
call fcn.004245bb
lea ecx, [ebp - 0x6fc]
mov byte [ebp - 4], 5
call fcn.0041ca38
mov byte [ebp - 4], 6
call fcn.004097e0
mov ecx, eax
call fcn.004074a0
push eax
lea ecx, [ebp - 0x438]
call fcn.00407440
lea eax, [ebp - 0x4cc]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x6fc]
call fcn.0041cbe5
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x40d27a
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00407670
lea eax, [ebp - 0x4cc]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x40d29e
mov eax, dword [ecx]
jmp 0x40d2a0
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x480]
push 0
push eax
call fcn.00409ad0
lea ecx, [ebp - 0x5f4]
call fcn.004249cb
xor edi, edi
xor bh, bh
xor bl, bl
mov dword [ebp - 0x704], edi
mov byte [ebp - 0x6fe], bh
mov byte [ebp - 0x6fd], bl
nop word [eax + eax]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov dword [ebp - 0x708], 0
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x40d312
mov eax, dword [ecx]
jmp 0x40d314
mov eax, ecx
push 0x4e
push str.http:__bmzwe.sichuanqixin.com_image_hudie_6f37ffdf310e470d637f3b8cbdf1c8ec.bbf
mov byte [eax], 0
call fcn.00409c00
lea ecx, [ebp - 0x5f4]
call fcn.00424843
test al, al
jne 0x40d33a
test bh, bh
je 0x40d64b
lea ecx, [ebp - 0x5f4]
call fcn.004249bf
mov ebx, eax
test edi, edi
jne 0x40d48d
lea ecx, [ebp - 0x5f4]
call fcn.004249c7
test al, al
je 0x40d48d
push 5
push str.bdfc9
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], edi
mov byte [ebp - 0x438], 0
call fcn.00409c00
lea ecx, [ebp - 0x714]
mov byte [ebp - 4], 8
call fcn.00424e38
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x714]
call fcn.00428d8d
cmp dword [ebp - 0x454], 0x10
lea esi, [ebp - 0x468]
mov eax, dword [0x4a44e4]
lea edi, [ebp - 0x438]
cmovae esi, dword [ebp - 0x468]
cmp dword [ebp - 0x424], 0x10
mov byte [ebp - 4], 0xa
cmovae edi, dword [ebp - 0x438]
test eax, eax
jne 0x40d414
push 0x94
call fcn.00415b46
add esp, 4
mov dword [ebp - 0x728], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x40d409
mov ecx, eax
call fcn.0040a080
jmp 0x40d40b
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [0x4a44e4], eax
push esi
push 1
push edi
push 1
mov ecx, eax
call fcn.0040b830
mov eax, dword [ebp - 0x454]
cmp eax, 0x10
jb 0x40d43f
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00409d70
lea ecx, [ebp - 0x714]
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x458], 0
mov byte [ebp - 0x468], 0
call fcn.00429970
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 6
cmp eax, 0x10
jb 0x40d487
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00409d70
mov edi, dword [ebp - 0x704]
mov ecx, dword [0x4a44e0]
push 0
push 0
test ecx, ecx
jne 0x40d4ca
push 0x60
call fcn.00415b46
add esp, 4
mov dword [ebp - 0x72c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x40d4be
mov ecx, eax
call fcn.0040c650
mov ecx, eax
jmp 0x40d4c0
xor ecx, ecx
mov byte [ebp - 4], 6
mov dword [0x4a44e0], ecx
sub esp, 0x18
push esp
call fcn.0040c9a0
push ebx
push 0
lea ecx, [ebp - 0x6fc]
call fcn.0041cb2e
movzx esi, al
test edi, edi
jne 0x40d62a
lea ecx, [ebp - 0x5f4]
call fcn.004249c7
test al, al
je 0x40d62a
push 5
push str.3731d
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x458], edi
mov byte [ebp - 0x468], 0
call fcn.00409c00
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0xd
call fcn.00424e38
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x71c]
call fcn.00428d8d
mov eax, dword [0x4a44e4]
lea edi, [ebp - 0x468]
xor ebx, ebx
mov byte [ebp - 4], 0xf
test esi, esi
lea esi, [ebp - 0x438]
setne bl
cmp dword [ebp - 0x424], 0x10
cmovae esi, dword [ebp - 0x438]
cmp dword [ebp - 0x454], 0x10
cmovae edi, dword [ebp - 0x468]
test eax, eax
jne 0x40d5b8
push 0x94
call fcn.00415b46
add esp, 4
mov dword [ebp - 0x730], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x40d5ad
mov ecx, eax
call fcn.0040a080
jmp 0x40d5af
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [0x4a44e4], eax
push esi
push ebx
push edi
push 1
mov ecx, eax
call fcn.0040b830
mov eax, dword [ebp - 0x424]
cmp eax, 0x10
jb 0x40d5e2
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00409d70
lea ecx, [ebp - 0x71c]
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], 0
mov byte [ebp - 0x438], 0
call fcn.00429970
mov eax, dword [ebp - 0x454]
mov byte [ebp - 4], 6
cmp eax, 0x10
jb 0x40d62a
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00409d70
lea ecx, [ebp - 0x5f4]
mov dword [ebp - 0x704], 1
call fcn.00424e28
mov bl, byte [ebp - 0x6fd]
mov bh, byte [ebp - 0x6fe]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004332a0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004332a0
add esp, 0x18
lea eax, [ebp - 0x420]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.004333fa
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
nop
movzx eax, word [ebp + ecx - 0x420]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21a], ax
test ax, ax
jne 0x40d6a0
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40d6c1
mov ecx, 0xb
mov esi, str.LocalLowExplorerMenu_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
movsw word es:[edi], word [esi]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40d6e4
mov eax, dword [str.BtfiOi]
lea edi, [ebp - 0x218]
mov dword [ecx], eax
add edi, 0xfffffffe
mov eax, dword [0x48584c]
mov dword [ecx + 4], eax
mov eax, dword [0x485850]
mov dword [ecx + 8], eax
mov ax, word [0x485854]
mov word [ecx + 0xc], ax
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40d720
mov ecx, 6
lea eax, [ebp - 0x218]
mov esi, str.RunDate.ini
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d8c6
call fcn.004235c5
push 0
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.00422c4e
add esp, 0xc
cmp dword [ebp - 0x440], 8
mov byte [ebp - 4], 0x11
jne 0x40d869
push 4
push 4
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x450]
call fcn.00407b80
mov esi, eax
lea eax, [ebp - 0x450]
cmp eax, esi
je 0x40d7e0
mov eax, dword [ebp - 0x43c]
cmp eax, 8
jb 0x40d7b7
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.00407670
xor eax, eax
mov dword [ebp - 0x43c], 7
push esi
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], 0
mov word [ebp - 0x450], ax
call fcn.00407f70
mov eax, dword [ebp - 0x424]
cmp eax, 8
jb 0x40d7fe
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00407670
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push ecx
push 0
push str.Interval
push eax
call edi
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
mov esi, eax
lea eax, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x450]
push eax
push 0xffffffffffffffff
push str.Disable
push ecx
call edi
cmp eax, 1
je 0x40d869
test esi, esi
je 0x40d869
mov bh, 1
imul esi, esi, 0xea60
mov byte [ebp - 0x6fe], bh
jmp 0x40d86f
mov esi, dword [ebp - 0x708]
mov eax, dword [ebp - 0x43c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x40d891
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.00407670
test esi, esi
je 0x40d8c6
test bl, bl
jne 0x40d8b4
push str.3731d
mov bl, 1
push 1
mov byte [ebp - 0x6fd], bl
call fcn.0040ead0
mov ecx, eax
call fcn.0040b180
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x704]
jmp 0x40d2e0
lea ecx, [ebp - 0x5f4]
call fcn.004249c3
test al, al
je 0x40d903
mov edi, dword [ebp - 0x704]
test bl, bl
jne 0x40d2e0
push str.3731d
mov bl, 1
push 1
mov byte [ebp - 0x6fd], bl
call fcn.0040ead0
mov ecx, eax
call fcn.0040b180
jmp 0x40d2e0
lea ecx, [ebp - 0x6fc]
mov esi, 1
call fcn.0041ca4e
lea ecx, [ebp - 0x5f4]
call fcn.004246e7
lea ecx, [ebp - 0x4cc]
call fcn.0041bf2b
mov eax, dword [ebp - 0x46c]
cmp eax, 0x10
jb 0x40d947
inc eax
lea ecx, [ebp - 0x480]
push eax
push dword [ebp - 0x480]
call fcn.00409d70
mov dword [ebp - 0x46c], 0xf
mov dword [ebp - 0x470], 0
mov byte [ebp - 0x480], 0
lea ecx, [ebp - 0x724]
call fcn.0041a6cf
mov ecx, dword [ebp - 0x484]
cmp ecx, 8
jb 0x40d98b
inc ecx
push ecx
push dword [ebp - 0x498]
lea ecx, [ebp - 0x498]
call fcn.00407670
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415b8c
mov esp, ebp
pop ebp
ret