Function at 0x401400
Capabilities:
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x54c4c2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2fe4
call fcn.005277d0
mov eax, dword [0x5a4e60]
xor eax, esp
mov dword [esp + 0x2fe0], eax
push ebx
push esi
push edi
mov eax, dword [0x5a4e60]
xor eax, esp
push eax
lea eax, [esp + 0x2ff8]
mov dword fs:[0], eax
push 0x401140
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.0041cd06
push 0
call fcn.0041dd7f
add esp, 4
call fcn.00401d20
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov ebx, eax
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x1030], eax
call edi
mov dword [esi + 0x1034], eax
cmp ebx, 4
jne 0x4014e7
push ebx
mov edi, 0x57c8e8
mov edx, 0x57c904
xor ecx, ecx
call fcn.00403760
add esp, 4
cmp eax, 6
jne 0x4014e0
mov ecx, esi
call fcn.004022c0
mov ecx, dword [esi + 0x1034]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x401b39
cmp ebx, 5
jne 0x401513
push 1
mov ecx, esi
call fcn.00402870
mov ecx, esi
call fcn.004031e0
test eax, eax
je 0x401529
xor ecx, ecx
call fcn.00403670
call fcn.004032e0
xor eax, eax
jmp 0x401b39
cmp ebx, 2
je 0x40151c
test ebx, ebx
jne 0x401529
push 0
mov ecx, esi
call fcn.00402870
test eax, eax
jne 0x4014f5
xor edi, edi
push edi
lea edx, [esp + 0x20]
push edx
lea eax, [esi + 0xc2c]
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
cmp ebx, edi
jne 0x4016ab
call fcn.00401ff0
call fcn.004021a0
push 0x206
lea edx, [esp + 0x29ea]
xor ecx, ecx
push edi
push edx
mov word [esp + 0x29f0], cx
call fcn.00525e90
add esp, 0xc
push 0x3e
lea ecx, [esp + 0x29aa]
xor eax, eax
push edi
push ecx
mov word [esp + 0x29b0], ax
call fcn.00525e90
add esp, 0xc
push 0x3e
lea eax, [esp + 0x296a]
xor edx, edx
push edi
push eax
mov word [esp + 0x2970], dx
call fcn.00525e90
add esp, 0xc
push str.Inst
lea ecx, [esp + 0x29a8]
push 0x20
push ecx
call fcn.005231b8
add esp, 0xc
lea edx, [esp + 0x29e4]
push edx
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.haogamerGameLoginStatistic.ini
lea eax, [esp + 0x29e8]
push 0x104
push eax
call fcn.00523249
add esp, 0xc
lea ecx, [esp + 0x29e4]
push ecx
push 0x20
lea edx, [esp + 0x296c]
push edx
push 0x57ce04
lea eax, [esp + 0x29b4]
push eax
push 0x57ce08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x2964]
push ecx
call fcn.00523a4c
add esp, 4
lea edi, [eax + 1]
push edi
push 0x57ce20
lea edx, [esp + 0x296c]
push 0x20
push edx
call fcn.0052350d
add esp, 0x10
lea eax, [esp + 0x29e4]
push eax
lea ecx, [esp + 0x2968]
push ecx
lea edx, [esp + 0x29ac]
push edx
push 0x57ce08
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
push str.http:__client.5054399.com_install.htm_tagqshaogamerver3.0.0.1
push str._scount_u
push 0x200
lea eax, [esp + 0x2bfc]
push eax
call fcn.0052350d
add esp, 0x14
lea eax, [esp + 0x2bec]
call fcn.00403370
jmp 0x4014d1
cmp ebx, 1
jne 0x401821
push 3
push edi
push edi
push str.http:__www.huowan.com_
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x206
lea eax, [esp + 0x29ea]
xor edx, edx
push edi
push eax
mov word [esp + 0x29f0], dx
call fcn.00525e90
add esp, 0xc
push 0x3e
lea edx, [esp + 0x29aa]
xor ecx, ecx
push edi
push edx
mov word [esp + 0x29b0], cx
call fcn.00525e90
add esp, 0xc
push 0x3e
lea ecx, [esp + 0x296a]
xor eax, eax
push edi
push ecx
mov word [esp + 0x2970], ax
call fcn.00525e90
add esp, 0xc
push 0x57cd80
lea edx, [esp + 0x29a8]
push 0x20
push edx
call fcn.005231b8
add esp, 0xc
lea eax, [esp + 0x29e4]
push eax
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.haogamerGameLoginStatistic.ini
lea ecx, [esp + 0x29e8]
push 0x104
push ecx
call fcn.00523249
add esp, 0xc
lea edx, [esp + 0x29e4]
push edx
push 0x20
lea eax, [esp + 0x296c]
push eax
push 0x57ce04
lea ecx, [esp + 0x29b4]
push ecx
push 0x57ce08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x2964]
push edx
call fcn.00523a4c
add esp, 4
lea edi, [eax + 1]
push edi
push 0x57ce20
lea eax, [esp + 0x296c]
push 0x20
push eax
call fcn.0052350d
add esp, 0x10
lea ecx, [esp + 0x29e4]
push ecx
lea edx, [esp + 0x2968]
push edx
lea eax, [esp + 0x29ac]
push eax
push 0x57ce08
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
push str.http:__client.5054399.com_active.htm_tagwebsinaver3.0.0.1
push str._scount_u
lea ecx, [esp + 0x2bf8]
push 0x200
push ecx
call fcn.0052350d
add esp, 0x14
lea eax, [esp + 0x2bec]
call fcn.00403370
mov edx, dword [esi + 0x1034]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x401b39
cmp ebx, 2
je 0x40182f
cmp ebx, 3
jne 0x401971
push 0x206
lea ecx, [esp + 0x29ea]
xor eax, eax
push edi
push ecx
mov word [esp + 0x29f0], ax
call fcn.00525e90
add esp, 0xc
push 0x3e
lea eax, [esp + 0x29aa]
xor edx, edx
push edi
push eax
mov word [esp + 0x29b0], dx
call fcn.00525e90
add esp, 0xc
push 0x3e
lea edx, [esp + 0x296a]
xor ecx, ecx
push edi
push edx
mov word [esp + 0x2970], cx
call fcn.00525e90
add esp, 0xc
push str.Game
lea eax, [esp + 0x29a8]
push 0x20
push eax
call fcn.005231b8
add esp, 0xc
lea ecx, [esp + 0x29e4]
push ecx
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.haogamerGameLoginStatistic.ini
lea edx, [esp + 0x29e8]
push 0x104
push edx
call fcn.00523249
add esp, 0xc
lea eax, [esp + 0x29e4]
push eax
push 0x20
lea ecx, [esp + 0x296c]
push ecx
push 0x57ce04
lea edx, [esp + 0x29b4]
push edx
push 0x57ce08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x2964]
push eax
call fcn.00523a4c
add esp, 4
lea edi, [eax + 1]
push edi
push 0x57ce20
lea ecx, [esp + 0x296c]
push 0x20
push ecx
call fcn.0052350d
add esp, 0x10
lea edx, [esp + 0x29e4]
push edx
lea eax, [esp + 0x2968]
push eax
lea ecx, [esp + 0x29ac]
push ecx
push 0x57ce08
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
push str.http:__client.5054399.com_active.htm_tagqshaogamerver3.0.0.1
push str._scount_u
lea edx, [esp + 0x2bf8]
push 0x200
push edx
call fcn.0052350d
add esp, 0x14
lea eax, [esp + 0x2bec]
call fcn.00403370
call fcn.0040aa10
cmp ebx, 6
je 0x4019bd
cmp ebx, 7
je 0x4019bd
lea eax, [esp + 0x2c]
push eax
call fcn.00404a60
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3000], 3
mov dword [esi + 0x20], ecx
call fcn.0042557a
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x3004], 0xffffffff
call fcn.00401b60
xor eax, eax
jmp 0x401b39
call fcn.0041e3a4
test eax, eax
jne 0x4019e2
push eax
mov edi, 0x57c8e8
mov edx, 0x57cb08
xor ecx, ecx
call fcn.00403760
add esp, 4
xor eax, eax
jmp 0x401b39
or edi, 0xffffffff
cmp ebx, 6
jne 0x401a57
push 0x200
call fcn.0041abed
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
xor eax, eax
mov dword [esp + 0x3000], eax
cmp ebx, eax
je 0x401a1c
mov eax, dword [0x5ad1d4]
push eax
call fcn.00421005
push eax
push ebx
call fcn.004142e0
mov dword [esp + 0x3000], edi
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x170]
call eax
cmp eax, 2
jne 0x401a57
mov ecx, dword [0x5ad1d4]
push 0x112f
push 0xf060
push 0x112
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x401b39
push 0x8c
call fcn.0041abed
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x3000], 1
test eax, eax
je 0x401a94
push 0x57f8bc
push 0x57fc28
push 0x57f728
push 0x80
mov ecx, eax
call fcn.00425884
jmp 0x401a96
xor eax, eax
mov dword [esp + 0x3000], edi
test eax, eax
je 0x4014e0
push eax
mov ecx, esi
call fcn.00425e16
lea ecx, [esp + 0x2964]
call fcn.0041c4fb
lea edx, [esp + 0x2964]
push edx
mov ecx, esi
mov dword [esp + 0x3004], 2
call fcn.0041b8e7
lea eax, [esp + 0x2964]
push eax
mov ecx, esi
call fcn.00425c66
test eax, eax
jne 0x401afd
lea ecx, [esp + 0x2964]
mov dword [esp + 0x3000], edi
call fcn.0041c565
xor eax, eax
jmp 0x401b39
mov ecx, dword [esi + 0x20]
push 0x57c8e8
call fcn.00426388
mov ecx, dword [esi + 0x20]
push 0
call fcn.00426453
mov esi, dword [esi + 0x20]
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x2964]
mov dword [esp + 0x3000], edi
call fcn.0041c565
mov eax, 1
mov ecx, dword [esp + 0x2ff8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2fe0]
xor ecx, esp
call fcn.00523022
mov esp, ebp
pop ebp
ret