Function at 0x40ce40
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5aa5d8
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40ce97
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 2
lea ebp, [esi + 8]
push 0x5d617c
mov ecx, ebp
mov dword [esp + 0x240], 0
call fcn.00402270
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 5
lea ecx, [esp + 0x2c]
push ecx
push 0
call ebx
test eax, eax
je 0x40cf0f
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cee1
sub eax, edx
sar eax, 1
test eax, eax
jle 0x40cf0f
cmp word [esp + eax*2 + 0x22], 0x5c
lea eax, [esp + eax*2 + 0x22]
jne 0x40cf03
mov word [eax], cx
lea edx, [esp + 0x24]
push edx
mov ecx, ebp
call fcn.004021f0
push 0
push 0xd
lea eax, [esp + 0x2c]
push eax
push 0
call ebx
test eax, eax
lea ecx, [esi + 4]
je 0x40cf4c
lea eax, [esp + 0x24]
lea edi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40cf30
sub eax, edi
sar eax, 1
push eax
lea edx, [esp + 0x28]
push edx
call fcn.00402270
jmp 0x40cf52
push ebp
call fcn.00402330
push 0
push 0x26
lea eax, [esp + 0x2c]
push eax
push 0
call ebx
test eax, eax
lea ecx, [esi + 0xc]
je 0x40cf8c
lea eax, [esp + 0x24]
lea edi, [eax + 2]
lea ecx, [ecx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40cf70
sub eax, edi
sar eax, 1
push eax
lea edx, [esp + 0x28]
push edx
call fcn.00402270
jmp 0x40cf92
push ebp
call fcn.00402330
lea eax, [esp + 0x24]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
lea ecx, [esi + 0x10]
jbe 0x40cfcc
lea eax, [esp + 0x24]
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40cfb0
sub eax, esi
sar eax, 1
push eax
lea edx, [esp + 0x28]
push edx
call fcn.00402270
jmp 0x40cfd2
push ebp
call fcn.00402330
mov esi, dword [ebp]
push esi
call fcn.0044adc0
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
test eax, eax
jne 0x40d01d
push 0
push esi
call edi
test eax, eax
jne 0x40d01d
mov eax, dword [ebp]
cmp dword [eax - 0xc], 2
jle 0x40d01d
mov ecx, eax
push ecx
lea edx, [esp + 0x1c]
push 0x5d6184
push edx
call fcn.00404650
mov eax, dword [esp + 0x24]
add esp, 0xc
push 0
push 0
push eax
call fcn.0055e834
push str._binTGHistory.dll
lea ecx, [esp + 0x20]
call fcn.004023b0
push 0x63c660
mov ecx, 0x63c670
mov byte [esp + 0x23c], 1
call fcn.00402330
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push 0x63c660
push edx
call fcn.00401ae0
mov eax, dword [eax]
add esp, 0xc
push eax
call fcn.0044adc0
add esp, 4
test eax, eax
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d089
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40d173
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d0ab
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x238], 2
mov eax, dword [0x63c094]
push eax
push eax
push eax
lea ecx, [esp + 0x20]
push 0x5d61e8
push ecx
call fcn.00404650
mov esi, dword [esp + 0x28]
add esp, 0x14
push 0
push 0
push esi
call fcn.0055e834
mov ecx, 0x63c670
call fcn.00402180
lea eax, [esi - 0x10]
mov byte [esp + 0x238], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d119
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d141
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x238], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d16c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40d6a8
push str.data
lea ecx, [esp + 0x18]
push 0x63c670
push ecx
call fcn.00401ba0
mov esi, dword [eax]
add esp, 0xc
push esi
call fcn.0044adc0
add esp, 4
test eax, eax
je 0x40d1a0
mov eax, 1
jmp 0x40d1ab
push 0
push esi
call edi
neg eax
sbb eax, eax
neg eax
test eax, eax
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d1d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40d23e
push str.data
lea ecx, [esp + 0x18]
push 0x63c670
push ecx
call fcn.00401ba0
add esp, 0xc
mov byte [esp + 0x238], 3
mov edx, dword [eax]
push edx
lea eax, [esp + 0x1c]
push 0x5d6258
push eax
call fcn.00404650
mov byte [esp + 0x244], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d230
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push 0
push 0
push ecx
call fcn.0055e834
push str.webicon
lea edx, [esp + 0x18]
push 0x63c670
push edx
call fcn.00401ba0
add esp, 0xc
push eax
mov ecx, 0x63c678
mov byte [esp + 0x23c], 4
call fcn.00402330
mov byte [esp + 0x238], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d290
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [0x63c678]
push esi
call fcn.0044adc0
add esp, 4
test eax, eax
jne 0x40d2b5
push eax
push esi
call edi
test eax, eax
jne 0x40d2b5
mov ecx, 0x63c678
call fcn.00402180
push ebp
mov ecx, 0x63c684
call fcn.00402330
push ebp
mov ecx, 0x63c688
call fcn.00402330
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d2e5
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x5d62a4
lea ecx, [esp + 0x24]
push 0x63c670
push ecx
mov byte [esp + 0x244], 5
call fcn.00401ba0
add esp, 0xc
mov byte [esp + 0x238], 6
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
call fcn.0044a860
mov byte [esp + 0x23c], 5
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d353
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x40d5cf
push 0
push 0x63c844
lea ebx, [esp + 0x1c]
call fcn.0045b600
mov ecx, 3
cmp dword [0x63c850], ecx
jge 0x40d388
push 0x63c848
call fcn.004147d0
push str.APPINI
mov ebx, 0x63c844
call fcn.0045b8b0
mov ebp, eax
test ebp, ebp
jl 0x40d5cf
mov ecx, str.SOFTNAME
mov esi, ebx
call fcn.0045b920
push eax
mov ecx, 0x63c0b8
call fcn.00402330
mov ebx, 0x63c0b8
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, 0x5d62e0
mov eax, ebp
call fcn.0045b920
push eax
mov ecx, 0x63c0bc
call fcn.00402330
mov ebx, 0x63c0bc
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, str.HOMENAME
mov eax, ebp
call fcn.0045b920
push eax
mov ecx, 0x63c0d0
call fcn.00402330
mov ebx, 0x63c0d0
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, 0x5d6304
mov eax, ebp
call fcn.0045b920
push eax
mov ecx, 0x63c0d4
call fcn.00402330
mov ebx, 0x63c0d4
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, str.BAIDUID
mov eax, ebp
call fcn.0045b920
push eax
mov ecx, 0x63c0ac
call fcn.00402330
mov ebx, 0x63c0ac
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, str.GOOGLEID
mov eax, ebp
call fcn.0045b920
push eax
mov ecx, 0x63c0b4
call fcn.00402330
mov ebx, 0x63c0b4
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, str.MARKETID
mov eax, ebp
call fcn.0045b920
push eax
mov ecx, 0x63c0a8
call fcn.00402330
mov ebx, 0x63c0a8
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, str.FIRSTRUN
mov eax, ebp
call fcn.0045b920
push eax
mov ecx, 0x63c860
call fcn.00402330
mov ebx, 0x63c860
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ecx, str.MUSICFUNC
mov eax, ebp
call fcn.0045b920
mov ebx, eax
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov eax, dword [ebx]
push 0x5d6374
push eax
call fcn.00577334
add esp, 8
test eax, eax
je 0x40d523
mov ebx, dword [ebx]
push str.hide
push ebx
call fcn.00577334
add esp, 8
test eax, eax
jne 0x40d52d
mov dword [0x63c864], 0
mov ecx, str.DATADIR
mov eax, ebp
mov esi, 0x63c844
call fcn.0045b920
mov ebx, eax
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov edx, dword [ebx]
cmp dword [edx - 0xc], 0
je 0x40d55f
push ebx
mov ecx, 0x63c13c
call fcn.00402330
mov ecx, str.SKINMENU
mov eax, ebp
mov esi, 0x63c844
call fcn.0045b920
mov ebx, eax
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ebx, dword [ebx]
push 0x5d6374
push ebx
call fcn.00577334
add esp, 8
test eax, eax
jne 0x40d597
mov dword [0x63c134], eax
mov ecx, str.UPDATE
mov eax, ebp
mov esi, 0x63c844
call fcn.0045b920
mov ebx, eax
call fcn.004146b0
mov edi, eax
call fcn.00414730
mov ebx, dword [ebx]
push 0x5d6374
push ebx
call fcn.00577334
add esp, 8
test eax, eax
jne 0x40d5cf
mov dword [0x63c0c0], eax
push str.plugin
lea eax, [esp + 0x24]
push 0x63c670
push eax
call fcn.00401ba0
add esp, 0xc
push 0
mov byte [esp + 0x23c], 7
mov eax, dword [eax]
push 0x63c868
push eax
call fcn.0044bb10
mov byte [esp + 0x244], 5
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d628
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x238], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d650
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d678
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x238], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d6a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00577139
add esp, 0x228
ret