Function at 0x41cd40
Capabilities:
Create directory
Create thread
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4934a7
mov eax, dword fs:[0]
push eax
sub esp, 0xc6c
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call fcn.00464011
add esp, 4
push 1
lea ecx, [ebp - 0xc78]
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xbbc], edx
call fcn.00409f40
push 0
push 0x1a
lea eax, [ebp - 0x114]
push eax
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.KlLauncherTERA
lea ecx, [ebp - 0x114]
push 0x104
push ecx
call fcn.0046438a
lea eax, [ebp - 0x114]
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cdd0
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
mov ebx, eax
push ebx
lea edx, [ebp - 0x114]
push edx
push 0
push 0
call edi
mov esi, eax
cmp esi, 0x104
jb 0x41ce02
mov esi, 0x103
push esi
lea eax, [ebp - 0x79c]
push eax
push ebx
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0
call edi
lea eax, [ebp - 0x79c]
xor edx, edx
push eax
mov word [ebp + esi*2 - 0x79c], dx
call fcn.004288f0
add esp, 4
test al, al
jne 0x41ce44
push 0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.conf.ini
lea edx, [ebp - 0x114]
push 0x104
push edx
call fcn.0046438a
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0x80
lea ecx, [ebp - 0x194]
push ecx
push 0x497784
push str.guid
push str.GENERAL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x194], 0
jne 0x41cf7b
lea edx, [ebp - 0xba4]
push edx
call fcn.0041c1f0
mov edi, dword [ebp - 0xba4]
mov eax, edi
add esp, 4
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ceb0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 1]
push eax
call fcn.00463d76
mov esi, eax
mov eax, edi
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ced3
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 1]
push ecx
push 0
push esi
call fcn.00462010
mov edx, dword [ebp - 0xba4]
mov eax, edx
add esp, 0xc
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cf00
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 1]
push eax
push edx
push esi
call fcn.0041a690
lea edx, [ebp - 0x194]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41cf28
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x194]
push edx
push str.guid
push str.GENERAL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push esi
call fcn.0046247d
mov eax, dword [ebp - 0xba4]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cf7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xbb0]
push ecx
call fcn.0041cbc0
add esp, 4
push 0x2d
lea ecx, [ebp - 0xbb0]
mov byte [ebp - 4], 1
call fcn.0041ba60
mov edx, dword [0x4ae00c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ae00c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xba4], esi
mov ecx, str.9K1lCm7EuE9UzyBdanY14rimQ5qCIpwJKO7BcdJK2MXl51jhRKw6lWksQur7G.3fUZUPtYnvKJdPKPz8ONdJow00
mov byte [ebp - 4], 2
test ecx, 0xffff0000
jne 0x41cfe8
mov edx, ecx
movzx edi, dx
push 0
push edi
call fcn.00404500
add esp, 8
test eax, eax
je 0x41cffe
push edi
push eax
lea ecx, [ebp - 0xba4]
call fcn.00407a60
jmp 0x41cff8
push str.9K1lCm7EuE9UzyBdanY14rimQ5qCIpwJKO7BcdJK2MXl51jhRKw6lWksQur7G.3fUZUPtYnvKJdPKPz8ONdJow00
lea ecx, [ebp - 0xba4]
call fcn.00407740
mov esi, dword [ebp - 0xba4]
push 0x3ff
lea eax, [ebp - 0xb9b]
push 0
push eax
mov byte [ebp - 4], 3
mov byte [ebp - 0xb9c], 0
call fcn.00462010
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d024
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 1]
push ecx
call fcn.00463d76
mov edx, eax
mov eax, esi
add esp, 4
mov dword [ebp - 0xbb4], edx
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d050
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 1]
push eax
push 0
push edx
call fcn.00462010
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d074
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 1]
mov eax, esi
mov dword [ebp - 0xbac], ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d092
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
sub eax, edx
push 0
sar eax, 1
mov ebx, eax
push ebx
push esi
push 0
push 0
call edi
mov ecx, dword [ebp - 0xbac]
cmp eax, ecx
jbe 0x41d0c5
mov eax, ecx
mov edx, dword [ebp - 0xbb4]
push 0
push 0
push eax
push edx
push ebx
push esi
push 0
push 0
call edi
mov esi, dword [ebp - 0xbb0]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d0e4
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 1]
push eax
call fcn.00463d76
mov ebx, eax
mov eax, esi
add esp, 4
mov dword [ebp - 0xbac], ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d110
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 1]
push ecx
push 0
push ebx
call fcn.00462010
mov ecx, dword [ebp - 0xbb0]
mov eax, ecx
add esp, 0xc
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41d140
sub eax, esi
sar eax, 1
lea edi, [eax + eax + 1]
mov eax, ecx
mov dword [ebp - 0xba8], ecx
lea esi, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41d160
push 0
push 0
push 0
sub eax, esi
push 0
sar eax, 1
mov esi, eax
push esi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
jbe 0x41d18b
mov eax, edi
mov edx, dword [ebp - 0xba8]
push 0
push 0
push eax
push ebx
push esi
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbb4]
push str.E045AB0AB5AB680C0E2665F05B89F26B2F1EFADCA070B1A28024EFB4636C6DDF
push eax
push 0x4e
push ecx
lea edx, [ebp - 0x194]
push edx
push ebx
push 0x4a6336a
lea eax, [ebp - 0xb9c]
push str._d_s_s_s_d_d_s
push eax
call fcn.00464907
add esp, 0x24
lea ecx, [ebp - 0xb9d]
call fcn.00424670
lea ecx, [ebp - 0xb9c]
push ecx
lea ecx, [ebp - 0xb9d]
mov byte [ebp - 4], 4
call fcn.00425090
lea ecx, [ebp - 0xb9d]
mov esi, eax
mov byte [ebp - 4], 3
call fcn.00424680
push 0x800
call fcn.00463d76
push 0x800
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0xbb8], ebx
call fcn.00462010
add esp, 0x10
test esi, esi
je 0x41d27e
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d236
push 0
push 0
sub eax, edx
push eax
push esi
push 0
push 0
mov dword [ebp - 0xba8], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, 0x400
jb 0x41d264
mov edi, 0x3ff
mov edx, dword [ebp - 0xba8]
push edi
push ebx
push edx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
mov word [ebx + edi*2], ax
push 0x20
call fcn.00463d76
mov edi, eax
push 0xa
push edi
push 0x4e
call fcn.00467309
push 0x20
call fcn.00463d76
mov ebx, eax
push 0xa
push ebx
push 0x4a6336a
call fcn.00467309
mov edx, dword [ebp - 0xbac]
add esp, 0x20
lea ecx, [ebp - 0x114]
push ecx
push edx
push 0x498384
push str.GENERAL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x114]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x49836c
push str.GENERAL
call edi
lea ecx, [ebp - 0x114]
push ecx
push ebx
push str.mark
push str.GENERAL
call edi
mov ebx, dword [ebp - 0xbb4]
lea edx, [ebp - 0x114]
push edx
push ebx
push str.flashcookie
push str.GENERAL
call edi
lea eax, [ebp - 0x114]
push eax
push 0x498368
push 0x498364
push str.GENERAL
call edi
push 0x3ff
lea ecx, [ebp - 0x593]
push 0
push ecx
mov byte [ebp - 0x594], 0
call fcn.00462010
mov edx, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbac]
push 0x498368
push esi
push edx
push 0x4e
push ebx
lea eax, [ebp - 0x194]
push eax
push ecx
push 0x4a6336a
lea edx, [ebp - 0x594]
push str.http:__log.item.kunlun.com_dclog.php_mark_dlog201mac_sguid_sflashcookie_spid_dtime_ldsign_sv_s
push edx
call fcn.0041acb0
push 0x800
call fcn.00463d76
push 0x800
mov esi, eax
push 0
push esi
call fcn.00462010
lea eax, [ebp - 0x594]
add esp, 0x44
lea edi, [eax + 1]
jmp 0x41d3a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d3a0
push 0
push 0
sub eax, edi
push eax
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0x594]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, 0x400
jb 0x41d3d4
mov edi, 0x3ff
mov ecx, dword [ebp - 0xba8]
push edi
push esi
push ecx
lea edx, [ebp - 0x594]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00464083
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea ecx, [ebp - 0xba8]
push ecx
push 0
push edi
push 0x41a5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
mov dword [0x4afc7c], eax
call fcn.0046247d
push ebx
call fcn.0046247d
mov edx, dword [ebp - 0xbac]
push edx
call fcn.0046247d
mov eax, dword [ebp - 0xbb8]
push eax
call fcn.0046247d
mov eax, dword [ebp - 0xba4]
add eax, 0xfffffff0
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d471
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xbb0]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d497
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xc08]
mov dword [ebp - 4], 0xffffffff
call fcn.0040a090
lea ecx, [ebp - 0xc08]
push ecx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00460133
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004615db
mov esp, ebp
pop ebp
ret