Function at 0x41c7f0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521263
mov eax, dword fs:[0]
push eax
sub esp, 0x5d8
mov eax, dword [0x5793bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
xor eax, eax
mov dword [ebp - 0x46c], 7
push 0x525548
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x470], 0
mov word [ebp - 0x480], ax
call fcn.0041b090
push 0xa
push 0x525818
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], 0
call fcn.0041c290
cmp dword [ebp - 0x46c], 8
lea eax, [ebp - 0x480]
lea ecx, [ebp - 0x5cc]
cmovae eax, dword [ebp - 0x480]
push eax
call fcn.004ebd0f
lea ecx, [ebp - 0x5cc]
mov byte [ebp - 4], 1
call fcn.004ebd58
test eax, eax
jne 0x41c8a0
xor esi, esi
jmp 0x41d0ac
lea ecx, [ebp - 0x540]
call fcn.004de10d
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 2
call fcn.004e324f
mov eax, dword [0x583210]
mov byte [ebp - 4], 3
test eax, eax
jne 0x41c8f6
push 0x14c
call fcn.00427707
add esp, 4
mov dword [ebp - 0x5bc], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x41c8eb
mov ecx, eax
call fcn.0041b520
jmp 0x41c8ed
xor eax, eax
mov byte [ebp - 4], 3
mov dword [0x583210], eax
mov ecx, eax
call fcn.0041b6c0
push eax
lea ecx, [ebp - 0x438]
call fcn.0041e330
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x5b0]
call fcn.004e3556
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x41c941
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.0041b190
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x41c95e
mov eax, dword [ecx]
jmp 0x41c960
mov eax, ecx
push 0x34
push str.http:__down.znshuru.com_yasuo_pudding_svc_cld_tt.dat
mov byte [eax], 0
call fcn.00418410
lea ecx, [ebp - 0x540]
call fcn.004de511
xor edi, edi
mov byte [ebp - 0x5b1], 0
mov dword [ebp - 0x5b8], edi
nop dword [eax]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x5bc], ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
cmp dword [ecx + 0x14], 0x10
jb 0x41c9bc
mov eax, dword [ecx]
jmp 0x41c9be
mov eax, ecx
push 0x34
push str.http:__down.znshuru.com_yasuo_pudding_svc_cld_tt.dat
mov byte [eax], bl
call fcn.00418410
lea ecx, [ebp - 0x540]
call fcn.004de31f
test al, al
jne 0x41c9e7
cmp byte [ebp - 0x5b1], bl
je 0x41ce2c
lea ecx, [ebp - 0x540]
call fcn.004de509
mov ebx, eax
test edi, edi
jne 0x41cba4
lea ecx, [ebp - 0x540]
call fcn.004de50d
test al, al
je 0x41cba4
push 7
push str.LSCPSKS
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], edi
mov byte [ebp - 0x438], 0
call fcn.00418410
lea ecx, [ebp - 0x5c0]
mov byte [ebp - 4], 6
call fcn.004de937
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x5c0]
call fcn.004e2bc0
mov eax, dword [0x583214]
mov byte [ebp - 4], 8
test eax, eax
jne 0x41ca99
push 0x94
call fcn.00427707
add esp, 4
mov dword [ebp - 0x5d4], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x41ca8e
mov ecx, eax
call fcn.00418aa0
jmp 0x41ca90
xor eax, eax
mov byte [ebp - 4], 8
mov dword [0x583214], eax
push 0
mov ecx, eax
call fcn.004199e0
cmp dword [ebp - 0x454], 0x10
lea esi, [ebp - 0x468]
mov eax, dword [0x583214]
lea edi, [ebp - 0x438]
cmovae esi, dword [ebp - 0x468]
cmp dword [ebp - 0x424], 0x10
cmovae edi, dword [ebp - 0x438]
test eax, eax
jne 0x41cb02
push 0x94
call fcn.00427707
add esp, 4
mov dword [ebp - 0x5d8], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x41caf7
mov ecx, eax
call fcn.00418aa0
jmp 0x41caf9
xor eax, eax
mov byte [ebp - 4], 8
mov dword [0x583214], eax
push esi
push 1
push edi
push 1
mov ecx, eax
call fcn.00419f20
mov esi, dword [0x583214]
test esi, esi
je 0x41cb38
mov ecx, esi
call fcn.00418c10
push 0x94
push esi
call fcn.0042773f
add esp, 8
mov dword [0x583214], 0
mov eax, dword [ebp - 0x454]
cmp eax, 0x10
jb 0x41cb56
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00418580
lea ecx, [ebp - 0x5c0]
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x458], 0
mov byte [ebp - 0x468], 0
call fcn.0044f850
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x41cb9e
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00418580
mov edi, dword [ebp - 0x5b8]
mov eax, dword [0x583210]
test eax, eax
jne 0x41cbdc
push 0x14c
call fcn.00427707
add esp, 4
mov dword [ebp - 0x5dc], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x41cbd1
mov ecx, eax
call fcn.0041b520
jmp 0x41cbd3
xor eax, eax
mov byte [ebp - 4], 3
mov dword [0x583210], eax
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.0041b920
push 1
push 1
push eax
push ebx
push 0
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 0xc
call fcn.004e34ce
movzx esi, al
mov eax, dword [ebp - 0x424]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x41cc61
mov ecx, dword [ebp - 0x438]
inc eax
cmp eax, 0x7fffffff
ja 0x41d08c
add eax, eax
cmp eax, 0x1000
jb 0x41cc58
test cl, 0x1f
jne 0x41d08c
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41d08c
sub ecx, eax
cmp ecx, 4
jb 0x41d08c
cmp ecx, 0x23
ja 0x41d08c
mov ecx, eax
push ecx
call fcn.0042773a
add esp, 4
test edi, edi
jne 0x41ce11
lea ecx, [ebp - 0x540]
call fcn.004de50d
test al, al
je 0x41ce11
push 6
push str.LSCPYX
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x458], edi
mov byte [ebp - 0x468], 0
call fcn.00418410
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], 0xd
call fcn.004de937
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x5c4]
call fcn.004e2bc0
mov eax, dword [0x583214]
xor ebx, ebx
test esi, esi
mov byte [ebp - 4], 0xf
setne bl
test eax, eax
jne 0x41cd0d
push 0x94
call fcn.00427707
add esp, 4
mov dword [ebp - 0x5e0], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x41cd02
mov ecx, eax
call fcn.00418aa0
jmp 0x41cd04
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [0x583214], eax
push 0
mov ecx, eax
call fcn.004199e0
cmp dword [ebp - 0x424], 0x10
lea esi, [ebp - 0x438]
mov eax, dword [0x583214]
lea edi, [ebp - 0x468]
cmovae esi, dword [ebp - 0x438]
cmp dword [ebp - 0x454], 0x10
cmovae edi, dword [ebp - 0x468]
test eax, eax
jne 0x41cd76
push 0x94
call fcn.00427707
add esp, 4
mov dword [ebp - 0x5e4], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x41cd6b
mov ecx, eax
call fcn.00418aa0
jmp 0x41cd6d
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [0x583214], eax
push esi
push ebx
push edi
push 1
mov ecx, eax
call fcn.00419f20
mov esi, dword [0x583214]
test esi, esi
je 0x41cdab
mov ecx, esi
call fcn.00418c10
push 0x94
push esi
call fcn.0042773f
add esp, 8
mov dword [0x583214], 0
mov eax, dword [ebp - 0x424]
cmp eax, 0x10
jb 0x41cdc9
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00418580
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], 0
mov byte [ebp - 0x438], 0
call fcn.0044f850
mov eax, dword [ebp - 0x454]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x41ce11
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00418580
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x5b8], 1
call fcn.004de92a
mov ebx, dword [ebp - 0x5bc]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f1300
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004f1300
add esp, 0x18
lea eax, [ebp - 0x420]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.004f145a
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
nop
movzx eax, word [ebp + ecx - 0x420]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21a], ax
test ax, ax
jne 0x41ce80
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41cea1
mov ecx, 0xb
mov esi, str.LocalLowExplorerMenu_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
movsw word es:[edi], word [esi]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41cec4
mov eax, dword [0x525548]
lea edi, [ebp - 0x218]
mov dword [ecx], eax
add edi, 0xfffffffe
mov eax, dword [0x52554c]
mov dword [ecx + 4], eax
mov eax, dword [0x525550]
mov dword [ecx + 8], eax
mov eax, dword [0x525554]
mov dword [ecx + 0xc], eax
mov eax, dword [0x525558]
mov dword [ecx + 0x10], eax
mov ax, word [0x52555c]
mov word [ecx + 0x14], ax
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41cf10
mov ecx, 6
lea eax, [ebp - 0x218]
mov esi, str.RunDate.ini
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d091
call fcn.004d96f6
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.004da982
add esp, 8
cmp dword [ebp - 0x440], 8
mov byte [ebp - 4], 0x12
jne 0x41d054
push 4
push 4
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x450]
call fcn.0041eec0
mov esi, eax
lea eax, [ebp - 0x450]
cmp eax, esi
je 0x41cfce
mov eax, dword [ebp - 0x43c]
cmp eax, 8
jb 0x41cfa5
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.0041b190
xor eax, eax
mov dword [ebp - 0x43c], 7
push esi
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], 0
mov word [ebp - 0x450], ax
call fcn.0041c020
mov eax, dword [ebp - 0x424]
cmp eax, 8
jb 0x41cfec
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.0041b190
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push ecx
push 0
push str.Interval
push eax
call edi
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x218]
push ecx
mov esi, eax
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push 0xffffffffffffffff
push str.Disable
push eax
call edi
cmp eax, 1
je 0x41d054
test esi, esi
je 0x41d054
mov byte [ebp - 0x5b1], 1
imul ebx, esi, 0xea60
mov eax, dword [ebp - 0x43c]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x41d076
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.0041b190
test ebx, ebx
je 0x41d091
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x5b8]
jmp 0x41c990
call fcn.004f40a1
lea ecx, [ebp - 0x5b0]
mov esi, 1
call fcn.004e3265
lea ecx, [ebp - 0x540]
call fcn.004de212
lea ecx, [ebp - 0x5cc]
call fcn.004ebd3e
mov ecx, dword [ebp - 0x46c]
cmp ecx, 8
jb 0x41d0d5
inc ecx
push ecx
push dword [ebp - 0x480]
lea ecx, [ebp - 0x480]
call fcn.0041b190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042774d
mov esp, ebp
pop ebp
ret