Function at 0x409f00
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ad06
mov eax, dword fs:[0]
push eax
sub esp, 0x9c8
mov eax, dword [0x4ae1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb
xor eax, eax
mov dword [ebp - 0x644], 7
push str.YZWallpaper
lea ecx, [ebp - 0x658]
mov dword [ebp - 0x648], 0
mov word [ebp - 0x658], ax
call fcn.00402070
push 2
push 0x48f710
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], 0
call fcn.00403cb0
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x658]
lea ecx, [ebp - 0x9d0]
cmovae eax, dword [ebp - 0x658]
push eax
call fcn.004198f0
lea ecx, [ebp - 0x9d0]
mov byte [ebp - 4], 1
call fcn.004026a0
test eax, eax
je 0x409fb0
xor esi, esi
jmp 0x40a83a
push 0x47
push str.http:__down.znshuru.com_wall_yz_md_059b1ecf1167fe5f61b4b4c58e63bc98.dat
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 0x6a4], 0xf
mov dword [ebp - 0x6a8], 0
mov byte [ebp - 0x6b8], 0
call fcn.004088b0
cmp dword [ebp - 0x6a8], 0
mov byte [ebp - 4], 2
jne 0x409ff1
xor esi, esi
jmp 0x40a82f
cmp dword [0x4afba8], 0
jne 0x409fff
call fcn.0040bef0
mov ecx, dword [0x4afba8]
push 0
call fcn.00407040
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00432e20
lea eax, [ebp - 0x728]
push str.PPCfgPath
push eax
call fcn.00421793
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x40a03b
mov eax, dword [eax]
push str.Config.ini
push str.Cache
push eax
lea eax, [ebp - 0x628]
push 0x48f878
push eax
call fcn.00409550
mov eax, dword [ebp - 0x714]
add esp, 0x14
cmp eax, 8
jb 0x40a078
inc eax
lea ecx, [ebp - 0x728]
push eax
push dword [ebp - 0x728]
call fcn.00402170
lea ecx, [ebp - 0x7b4]
call fcn.00421e79
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0x628]
mov dword [ebp - 0x9b8], esp
mov ecx, esp
push eax
call fcn.00401f10
cmp dword [0x4afb80], 0
mov byte [ebp - 4], 4
jne 0x40a0b0
call fcn.00405980
mov ecx, dword [0x4afb80]
call fcn.00409130
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401f10
lea ecx, [ebp - 0x7b4]
mov byte [ebp - 4], 3
call fcn.004229b0
lea ecx, [ebp - 0x87c]
call fcn.00422a08
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 5
call fcn.0041b108
cmp dword [0x4afb80], 0
mov byte [ebp - 4], 6
jne 0x40a101
call fcn.00405980
mov ecx, dword [0x4afb80]
call fcn.00401fa0
push eax
lea ecx, [ebp - 0x6d0]
call fcn.00401f10
lea eax, [ebp - 0x6d0]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x9ac]
call fcn.0041b38a
mov eax, dword [ebp - 0x6bc]
cmp eax, 8
jb 0x40a14c
inc eax
lea ecx, [ebp - 0x6d0]
push eax
push dword [ebp - 0x6d0]
call fcn.00402170
lea eax, [ebp - 0x768]
mov dword [ebp - method.std::_Func_impl_class__lambda_f58d582c4ddb8cd6edc371f59bea9b71___class_std::allocator_int___void__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.virtual_0], vtable.std::_Func_impl_class__lambda_f58d582c4ddb8cd6edc371f59bea9b71___class_std::allocator_int___void__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [ebp - 0x744], eax
lea eax, [ebp - 0x710]
mov dword [ebp - method.std::_Func_impl_class__lambda_00311f10fad049305ff1c6759f29a32f___class_std::allocator_int___unsigned_long_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.virtual_0], vtable.std::_Func_impl_class__lambda_00311f10fad049305ff1c6759f29a32f___class_std::allocator_int___unsigned_long_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [ebp - 0x6ec], eax
lea eax, [ebp - 0x768]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x710]
push eax
lea ecx, [ebp - 0x9ac]
call fcn.0041b41e
mov ecx, dword [ebp - 0x6ec]
test ecx, ecx
je 0x40a1bd
mov edx, dword [ecx]
lea eax, [ebp - 0x710]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x6ec], 0
mov ecx, dword [ebp - 0x744]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x40a1df
mov edx, dword [ecx]
lea eax, [ebp - 0x768]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
lea eax, [ebp - 0x7b4]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x40a203
mov eax, dword [ecx]
jmp 0x40a205
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x6b8]
push 0
push eax
call fcn.00405cc0
lea ecx, [ebp - 0x87c]
call fcn.00422e1a
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x40a240
mov eax, dword [ecx]
jmp 0x40a242
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x6b8]
push 0
push eax
call fcn.00405cc0
lea ecx, [ebp - 0x87c]
call fcn.00422e64
xor edi, edi
xor bh, bh
xor bl, bl
mov dword [ebp - 0x9b4], edi
mov byte [ebp - 0x9ae], bh
mov byte [ebp - 0x9ad], bl
nop dword [eax + eax]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov dword [ebp - 0x9b8], 0
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x40a2b2
mov eax, dword [ecx]
jmp 0x40a2b4
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x6b8]
push 0
push eax
call fcn.00405cc0
lea ecx, [ebp - 0x87c]
call fcn.00422c21
test al, al
jne 0x40a2de
test bh, bh
je 0x40a57c
lea ecx, [ebp - 0x87c]
call fcn.00422e0e
mov ebx, eax
test edi, edi
jne 0x40a40b
lea ecx, [ebp - 0x87c]
call fcn.00422e16
test al, al
je 0x40a40b
push 5
push str.66d7a
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x674], 0xf
mov dword [ebp - 0x678], edi
mov byte [ebp - 0x688], 0
call fcn.004088b0
lea ecx, [ebp - 0x9c0]
mov byte [ebp - 4], 0xa
call fcn.004233e0
lea eax, [ebp - 0x670]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x9c0]
call fcn.00427002
cmp dword [ebp - 0x65c], 0x10
lea esi, [ebp - 0x670]
lea edi, [ebp - 0x688]
mov byte [ebp - 4], 0xc
cmovae esi, dword [ebp - 0x670]
cmp dword [ebp - 0x674], 0x10
cmovae edi, dword [ebp - 0x688]
cmp dword [0x4afba8], 0
jne 0x40a38e
call fcn.0040bef0
mov ecx, dword [0x4afba8]
push esi
push 1
push edi
push 1
call fcn.00407b80
mov eax, dword [ebp - 0x65c]
cmp eax, 0x10
jb 0x40a3bd
inc eax
lea ecx, [ebp - 0x670]
push eax
push dword [ebp - 0x670]
call fcn.00405df0
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 0x65c], 0xf
mov dword [ebp - 0x660], 0
mov byte [ebp - 0x670], 0
call fcn.00406530
mov eax, dword [ebp - 0x674]
mov byte [ebp - 4], 6
cmp eax, 0x10
jb 0x40a405
inc eax
lea ecx, [ebp - 0x688]
push eax
push dword [ebp - 0x688]
call fcn.00405df0
mov edi, dword [ebp - 0x9b4]
cmp dword [0x4afb80], 0
jne 0x40a419
call fcn.00405980
mov ecx, dword [0x4afb80]
lea eax, [ebp - 0x740]
push eax
call fcn.00408f40
push 0
push 0
push eax
push ebx
push 0
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 0xd
call fcn.0041b2f9
movzx esi, al
mov eax, dword [ebp - 0x72c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x40a467
inc eax
lea ecx, [ebp - 0x740]
push eax
push dword [ebp - 0x740]
call fcn.00402170
test edi, edi
jne 0x40a55b
lea ecx, [ebp - 0x87c]
call fcn.00422e16
test al, al
je 0x40a55b
push str.db3d7
lea ecx, [ebp - 0x6e8]
call fcn.0040b720
lea ecx, [ebp - 0x9c8]
mov byte [ebp - 4], 0xe
call fcn.004233e0
lea eax, [ebp - 0x6a0]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x9c8]
call fcn.00427002
xor ebx, ebx
mov byte [ebp - 4], 0x10
test esi, esi
lea edi, [ebp - 0x6e8]
lea esi, [ebp - 0x6a0]
setne bl
cmp dword [ebp - 0x68c], 0x10
cmovae esi, dword [ebp - 0x6a0]
cmp dword [ebp - 0x6d4], 0x10
cmovae edi, dword [ebp - 0x6e8]
cmp dword [0x4afba8], 0
jne 0x40a4f8
call fcn.0040bef0
mov ecx, dword [0x4afba8]
push esi
push ebx
push edi
push 1
call fcn.00407b80
mov eax, dword [ebp - 0x68c]
cmp eax, 0x10
jb 0x40a526
inc eax
lea ecx, [ebp - 0x6a0]
push eax
push dword [ebp - 0x6a0]
call fcn.00405df0
lea ecx, [ebp - 0x9c8]
mov dword [ebp - 0x68c], 0xf
mov dword [ebp - 0x690], 0
mov byte [ebp - 0x6a0], 0
call fcn.00406530
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 6
call fcn.00405190
lea ecx, [ebp - 0x87c]
mov dword [ebp - 0x9b4], 1
call fcn.004233d3
mov bl, byte [ebp - 0x9ad]
mov bh, byte [ebp - 0x9ae]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00432e20
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00432e20
add esp, 0x18
lea eax, [ebp - 0x420]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.00432f7a
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
nop
movzx eax, word [ebp + ecx - 0x420]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21a], ax
test ax, ax
jne 0x40a5d0
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40a5f1
mov ecx, 0xb
mov esi, str.LocalLowExplorerMenu_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
movsw word es:[edi], word [esi]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40a614
mov eax, dword [str.YZWallpaper]
lea edi, [ebp - 0x218]
mov dword [ecx], eax
add edi, 0xfffffffe
mov eax, dword [0x48f4a8]
mov dword [ecx + 4], eax
mov eax, dword [0x48f4ac]
mov dword [ecx + 8], eax
mov eax, dword [0x48f4b0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x48f4b4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x48f4b8]
mov dword [ecx + 0x14], eax
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40a660
mov ecx, 6
lea eax, [ebp - 0x218]
mov esi, str.RunDate.ini
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a7b9
call fcn.0041af79
push 0
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.004207d6
add esp, 0xc
cmp dword [ebp - 0x630], 8
mov byte [ebp - 4], 0x11
jne 0x40a74f
push 4
push 4
lea eax, [ebp - 0x780]
push eax
lea ecx, [ebp - 0x640]
call fcn.004039c0
push eax
lea ecx, [ebp - 0x640]
call fcn.00403a50
lea ecx, [ebp - 0x780]
call fcn.00401ed0
cmp dword [ebp - 0x62c], 8
lea ecx, [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push ecx
push 0
push str.Interval
push eax
call edi
cmp dword [ebp - 0x62c], 8
lea ecx, [ebp - 0x218]
push ecx
mov esi, eax
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push 0xffffffffffffffff
push str.Disable
push eax
call edi
cmp eax, 1
je 0x40a74f
test esi, esi
je 0x40a74f
mov bh, 1
imul esi, esi, 0xea60
mov byte [ebp - 0x9ae], bh
jmp 0x40a755
mov esi, dword [ebp - 0x9b8]
mov eax, dword [ebp - 0x62c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x40a777
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00402170
test esi, esi
je 0x40a7b9
test bl, bl
jne 0x40a7a7
cmp dword [0x4afba8], 0
mov bl, 1
mov byte [ebp - 0x9ad], bl
jne 0x40a795
call fcn.0040bef0
mov ecx, dword [0x4afba8]
push str.db3d7
push 1
call fcn.004074d0
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x9b4]
jmp 0x40a280
lea ecx, [ebp - 0x87c]
call fcn.00422e12
test al, al
je 0x40a809
mov edi, dword [ebp - 0x9b4]
test bl, bl
jne 0x40a280
cmp dword [0x4afba8], 0
mov bl, 1
mov byte [ebp - 0x9ad], bl
jne 0x40a7ec
call fcn.0040bef0
mov ecx, dword [0x4afba8]
push str.db3d7
push 1
call fcn.004074d0
mov edi, dword [ebp - 0x9b4]
jmp 0x40a280
lea ecx, [ebp - 0x9ac]
mov esi, 1
call fcn.0041b11e
lea ecx, [ebp - 0x87c]
call fcn.00422b14
lea ecx, [ebp - 0x7b4]
call fcn.00421ea6
lea ecx, [ebp - 0x6b8]
call fcn.00405190
lea ecx, [ebp - 0x9d0]
call fcn.00419905
mov ecx, dword [ebp - 0x644]
cmp ecx, 8
jb 0x40a863
inc ecx
push ecx
push dword [ebp - 0x658]
lea ecx, [ebp - 0x658]
call fcn.00402170
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004134d9
mov esp, ebp
pop ebp
ret