Function at 0x409db0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a210
mov eax, dword fs:[0]
push eax
sub esp, 0x76c
mov eax, dword [0x4ad1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb
xor eax, eax
mov dword [ebp - 0x454], 7
push str.YZWallpaper
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov word [ebp - 0x468], ax
call fcn.00402070
push 2
push 0x48e668
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], 0
call fcn.004045d0
cmp dword [ebp - 0x454], 8
lea eax, [ebp - 0x468]
lea ecx, [ebp - 0x774]
cmovae eax, dword [ebp - 0x468]
push eax
call fcn.00419e10
lea ecx, [ebp - 0x774]
mov byte [ebp - 4], 1
call fcn.004026a0
test eax, eax
je 0x409e60
xor esi, esi
jmp 0x40a62d
push 0x47
push str.http:__down.znshuru.com_wall_yz_md_059b1ecf1167fe5f61b4b4c58e63bc98.dat
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x43c], 0xf
mov dword [ebp - 0x440], 0
mov byte [ebp - 0x450], 0
call fcn.00409030
cmp dword [ebp - 0x440], 0
mov byte [ebp - 4], 2
jne 0x409ea1
xor esi, esi
jmp 0x40a5f4
cmp dword [0x4aeba8], 0
jne 0x409eaf
call fcn.0040c460
mov ecx, dword [0x4aeba8]
push 0
call fcn.004078a0
lea ecx, [ebp - 0x620]
call fcn.00421bcf
lea ecx, [ebp - 0x750]
mov byte [ebp - 4], 3
call fcn.0041b60e
cmp dword [0x4aeb80], 0
mov byte [ebp - 4], 4
jne 0x409ee8
call fcn.00406220
mov ecx, dword [0x4aeb80]
call fcn.00401fa0
push eax
lea ecx, [ebp - 0x4e0]
call fcn.00401f10
lea eax, [ebp - 0x4e0]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x750]
call fcn.0041b91e
mov eax, dword [ebp - 0x4cc]
cmp eax, 8
jb 0x409f33
inc eax
lea ecx, [ebp - 0x4e0]
push eax
push dword [ebp - 0x4e0]
call fcn.00402170
lea eax, [ebp - 0x548]
mov dword [ebp - method.std::_Func_impl_class__lambda_af2fc8102f7ffa80479b1d5120478cc7___class_std::allocator_int___void__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.virtual_0], vtable.std::_Func_impl_class__lambda_af2fc8102f7ffa80479b1d5120478cc7___class_std::allocator_int___void__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [ebp - 0x524], eax
lea eax, [ebp - 0x508]
mov dword [ebp - method.std::_Func_impl_class__lambda_1d74fcdfe5221be0d77c6800c337a081___class_std::allocator_int___unsigned_long_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.virtual_0], vtable.std::_Func_impl_class__lambda_1d74fcdfe5221be0d77c6800c337a081___class_std::allocator_int___unsigned_long_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x548]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x750]
call fcn.0041b9b2
mov ecx, dword [ebp - 0x4e4]
test ecx, ecx
je 0x409fa4
mov edx, dword [ecx]
lea eax, [ebp - 0x508]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x4e4], 0
mov ecx, dword [ebp - 0x524]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x409fc6
mov edx, dword [ecx]
lea eax, [ebp - 0x548]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x409fe3
mov eax, dword [ecx]
jmp 0x409fe5
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.00406590
lea ecx, [ebp - 0x620]
call fcn.00421fdb
xor edi, edi
xor bh, bh
xor bl, bl
mov dword [ebp - 0x758], edi
mov byte [ebp - 0x752], bh
mov byte [ebp - 0x751], bl
nop dword [eax + eax]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov dword [ebp - 0x75c], 0
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x40a052
mov eax, dword [ecx]
jmp 0x40a054
mov eax, ecx
push 0x47
push str.http:__down.znshuru.com_wall_yz_md_059b1ecf1167fe5f61b4b4c58e63bc98.dat
mov byte [eax], 0
call fcn.00409030
lea ecx, [ebp - 0x620]
call fcn.00421de2
test al, al
jne 0x40a07a
test bh, bh
je 0x40a344
lea ecx, [ebp - 0x620]
call fcn.00421fcf
mov ebx, eax
test edi, edi
jne 0x40a1a7
lea ecx, [ebp - 0x620]
call fcn.00421fd7
test al, al
je 0x40a1a7
push 5
push str.66d7a
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x484], 0xf
mov dword [ebp - 0x488], edi
mov byte [ebp - 0x498], 0
call fcn.00409030
lea ecx, [ebp - 0x764]
mov byte [ebp - 4], 8
call fcn.004224b4
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x764]
call fcn.00426161
cmp dword [ebp - 0x46c], 0x10
lea esi, [ebp - 0x480]
lea edi, [ebp - 0x498]
mov byte [ebp - 4], 0xa
cmovae esi, dword [ebp - 0x480]
cmp dword [ebp - 0x484], 0x10
cmovae edi, dword [ebp - 0x498]
cmp dword [0x4aeba8], 0
jne 0x40a12a
call fcn.0040c460
mov ecx, dword [0x4aeba8]
push esi
push 1
push edi
push 1
call fcn.00408300
mov eax, dword [ebp - 0x46c]
cmp eax, 0x10
jb 0x40a159
inc eax
lea ecx, [ebp - 0x480]
push eax
push dword [ebp - 0x480]
call fcn.004066c0
lea ecx, [ebp - 0x764]
mov dword [ebp - 0x46c], 0xf
mov dword [ebp - 0x470], 0
mov byte [ebp - 0x480], 0
call fcn.00434890
mov eax, dword [ebp - 0x484]
mov byte [ebp - 4], 4
cmp eax, 0x10
jb 0x40a1a1
inc eax
lea ecx, [ebp - 0x498]
push eax
push dword [ebp - 0x498]
call fcn.004066c0
mov edi, dword [ebp - 0x758]
cmp dword [0x4aeb80], 0
jne 0x40a1b5
call fcn.00406220
mov ecx, dword [0x4aeb80]
lea eax, [ebp - 0x520]
push eax
call fcn.004096c0
push 0
push 0
push eax
push ebx
push 0
lea ecx, [ebp - 0x750]
mov byte [ebp - 4], 0xb
call fcn.0041b88d
movzx esi, al
mov eax, dword [ebp - 0x50c]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x40a203
inc eax
lea ecx, [ebp - 0x520]
push eax
push dword [ebp - 0x520]
call fcn.00402170
test edi, edi
jne 0x40a323
lea ecx, [ebp - 0x620]
call fcn.00421fd7
test al, al
je 0x40a323
push 5
push str.db3d7
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], 0xf
mov dword [ebp - 0x4b8], edi
mov byte [ebp - 0x4c8], 0
call fcn.00409030
lea ecx, [ebp - 0x76c]
mov byte [ebp - 4], 0xc
call fcn.004224b4
lea eax, [ebp - 0x4b0]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x76c]
call fcn.00426161
xor ebx, ebx
mov byte [ebp - 4], 0xe
test esi, esi
lea edi, [ebp - 0x4c8]
lea esi, [ebp - 0x4b0]
setne bl
cmp dword [ebp - 0x49c], 0x10
cmovae esi, dword [ebp - 0x4b0]
cmp dword [ebp - 0x4b4], 0x10
cmovae edi, dword [ebp - 0x4c8]
cmp dword [0x4aeba8], 0
jne 0x40a2ad
call fcn.0040c460
mov ecx, dword [0x4aeba8]
push esi
push ebx
push edi
push 1
call fcn.00408300
mov eax, dword [ebp - 0x49c]
cmp eax, 0x10
jb 0x40a2db
inc eax
lea ecx, [ebp - 0x4b0]
push eax
push dword [ebp - 0x4b0]
call fcn.004066c0
lea ecx, [ebp - 0x76c]
mov dword [ebp - 0x49c], 0xf
mov dword [ebp - 0x4a0], 0
mov byte [ebp - 0x4b0], 0
call fcn.00434890
mov eax, dword [ebp - 0x4b4]
mov byte [ebp - 4], 4
cmp eax, 0x10
jb 0x40a323
inc eax
lea ecx, [ebp - 0x4c8]
push eax
push dword [ebp - 0x4c8]
call fcn.004066c0
lea ecx, [ebp - 0x620]
mov dword [ebp - 0x758], 1
call fcn.004224a7
mov bl, byte [ebp - 0x751]
mov bh, byte [ebp - 0x752]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00432360
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00432360
add esp, 0x18
lea eax, [ebp - 0x420]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.004324ba
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x420]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21a], ax
test ax, ax
jne 0x40a3a0
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40a3c1
mov ecx, 0xb
mov esi, str.LocalLowExplorerMenu_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
movsw word es:[edi], word [esi]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40a3e4
mov eax, dword [str.YZWallpaper]
lea edi, [ebp - 0x218]
mov dword [ecx], eax
add edi, 0xfffffffe
mov eax, dword [0x48e498]
mov dword [ecx + 4], eax
mov eax, dword [0x48e49c]
mov dword [ecx + 8], eax
mov eax, dword [0x48e4a0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x48e4a4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x48e4a8]
mov dword [ecx + 0x14], eax
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40a430
mov ecx, 6
lea eax, [ebp - 0x218]
mov esi, str.RunDate.ini
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a589
call fcn.0041b47f
push 0
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.00420b35
add esp, 0xc
cmp dword [ebp - 0x428], 8
mov byte [ebp - 4], 0xf
jne 0x40a51f
push 4
push 4
lea eax, [ebp - 0x560]
push eax
lea ecx, [ebp - 0x438]
call fcn.00404170
push eax
lea ecx, [ebp - 0x438]
call fcn.004041b0
lea ecx, [ebp - 0x560]
call fcn.00401ed0
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push ecx
push 0
push str.Interval
push eax
call edi
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
mov esi, eax
lea eax, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x438]
push eax
push 0xffffffffffffffff
push str.Disable
push ecx
call edi
cmp eax, 1
je 0x40a51f
test esi, esi
je 0x40a51f
mov bh, 1
imul esi, esi, 0xea60
mov byte [ebp - 0x752], bh
jmp 0x40a525
mov esi, dword [ebp - 0x75c]
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x40a547
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00402170
test esi, esi
je 0x40a589
test bl, bl
jne 0x40a577
cmp dword [0x4aeba8], 0
mov bl, 1
mov byte [ebp - 0x751], bl
jne 0x40a565
call fcn.0040c460
mov ecx, dword [0x4aeba8]
push str.db3d7
push 1
call fcn.00407c50
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x758]
jmp 0x40a020
lea ecx, [ebp - 0x620]
call fcn.00421fd3
test al, al
je 0x40a5d9
mov edi, dword [ebp - 0x758]
test bl, bl
jne 0x40a020
cmp dword [0x4aeba8], 0
mov bl, 1
mov byte [ebp - 0x751], bl
jne 0x40a5bc
call fcn.0040c460
mov ecx, dword [0x4aeba8]
push str.db3d7
push 1
call fcn.00407c50
mov edi, dword [ebp - 0x758]
jmp 0x40a020
lea ecx, [ebp - 0x750]
mov esi, 1
call fcn.0041b624
lea ecx, [ebp - 0x620]
call fcn.00421cd5
mov eax, dword [ebp - 0x43c]
cmp eax, 0x10
jb 0x40a612
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.004066c0
mov dword [ebp - 0x43c], 0xf
mov dword [ebp - 0x440], 0
mov byte [ebp - 0x450], 0
lea ecx, [ebp - 0x774]
call fcn.00419e25
mov ecx, dword [ebp - 0x454]
cmp ecx, 8
jb 0x40a656
inc ecx
push ecx
push dword [ebp - 0x468]
lea ecx, [ebp - 0x468]
call fcn.00402170
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004139c2
mov esp, ebp
pop ebp
ret