Function at 0x406310
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5eed8c
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x64c874]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x90], 8
jb 0x406360
mov eax, dword [ebx + 0x7c]
jmp 0x406363
lea eax, [ebx + 0x7c]
push eax
push 0xffffffffffffffff
push 0x60a38c
push str.setup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
sub esp, 0x1c
mov ecx, esp
mov dword [ebx + 0x278], eax
mov dword [esp + 0x30], esp
xor edi, edi
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
lea eax, [ebx + 0x204]
push edi
mov word [ecx + 4], di
call fcn.00402580
push ebx
call fcn.0040a1e0
cmp eax, edi
jne 0x40643a
mov esi, dword [ebx + 0x674]
cmp esi, edi
je 0x4063fa
mov eax, dword [esi]
cmp eax, edi
je 0x4063e1
mov eax, dword [eax + 0x10]
cmp eax, 0xffffffff
je 0x4063e1
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4063e1
mov esi, dword [esi]
cmp esi, edi
je 0x4063e1
call fcn.00430380
mov eax, dword [ebx + 0x674]
cmp eax, edi
je 0x4063f4
mov edi, eax
call fcn.00405f30
xor edi, edi
mov dword [ebx + 0x674], edi
push 4
call fcn.0059b847
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, edi
mov dword [esp + 0x1a8], edi
je 0x406422
push ebx
push 0x40a1d0
mov esi, eax
call fcn.004303a0
jmp 0x406424
xor eax, eax
mov dword [esp + 0x1a8], 0xffffffff
mov dword [ebx + 0x674], eax
call fcn.004303f0
mov ecx, ebx
call fcn.00409190
test eax, eax
setne al
cmp dword [ebx + 0x234], edi
mov byte [ebx + 0x68c], al
je 0x406473
cmp dword [ebx + 0x238], 8
jb 0x406465
mov eax, dword [ebx + 0x224]
jmp 0x40646b
lea eax, [ebx + 0x224]
push eax
mov ecx, ebx
call fcn.005a27ed
lea ecx, [ebx + 0xe8]
push ecx
push 0x605a20
push 0x81
call fcn.00403110
add esp, 0xc
lea edx, [ebx + 0xf8]
push edx
push 0x605a20
push 0x82
call fcn.00403110
add esp, 0xc
lea eax, [ebx + 0xf4]
push eax
push 0x605a20
push 0x85
call fcn.00403110
add esp, 0xc
lea ecx, [ebx + 0xec]
push ecx
push 0x605a20
push 0x83
call fcn.00403110
add esp, 0xc
lea edx, [ebx + 0xf0]
push edx
push 0x605a20
push 0x84
call fcn.00403110
add esp, 0xc
push edi
push 0x6190bc
lea esi, [esp + 0x40]
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], edi
mov word [esp + 0x44], di
call fcn.00402770
mov eax, esi
push eax
lea ecx, [esp + 0xc8]
push ecx
mov dword [esp + 0x1b0], 1
call fcn.0040e040
mov byte [esp + 0x1a8], 3
cmp dword [esp + 0x50], 8
jb 0x406547
mov edx, dword [esp + 0x3c]
push edx
call fcn.0059b877
add esp, 4
cmp dword [ebx + 0x274], 0xffffffff
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], edi
mov word [esp + 0x3c], di
jne 0x40662c
call fcn.005a585b
mov esi, dword [eax + 0xc]
push 0x60a398
push 0x86
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x40662c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
lea edi, [esp + 0xc4]
call fcn.0040d600
test al, al
je 0x40662a
lea ecx, [ebx + 0x1cc]
push ecx
mov ecx, edi
call fcn.00413650
add esp, 4
lea esi, [esp + 0x54]
mov dword [ebx + 0x274], eax
call fcn.0042b8c0
mov esi, 8
cmp dword [ebx + 0x90], esi
jb 0x4065e2
mov ecx, dword [ebx + 0x7c]
jmp 0x4065e5
lea ecx, [ebx + 0x7c]
cmp dword [eax + 0x18], esi
jb 0x4065ef
mov eax, dword [eax + 4]
jmp 0x4065f2
add eax, 4
push ecx
push eax
push str.BoxId
push str.setup
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [esp + 0x6c], esi
jb 0x406617
mov edx, dword [esp + 0x58]
push edx
call fcn.0059b877
add esp, 4
xor eax, eax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], eax
mov word [esp + 0x58], ax
xor edi, edi
lea eax, [esp + 0x18]
push eax
call fcn.005a21db
mov eax, dword [ebx + 0x278]
cmp eax, edi
je 0x406702
cmp eax, 0xffffffff
je 0x406702
mov dword [esp + 0xa4], 7
mov dword [esp + 0xa0], edi
mov word [esp + 0x90], di
push eax
push str.http:__www.kuai8.com__cgameboxid0qdgameid_d
lea ecx, [esp + 0x94]
mov byte [esp + 0x1b0], 5
call fcn.0042b990
mov eax, dword [esp + 0x98]
add esp, 8
cmp dword [esp + 0xa4], 8
jae 0x40669c
lea eax, [esp + 0x90]
lea ecx, [esp + 0x18]
push ecx
mov edx, ecx
push edx
push ecx
push edx
push eax
push str._bLLLL
push edi
push edi
push 1
lea esi, [ebx + 0x94]
push 0x68
push esi
call fcn.005a2905
add esp, 0x2c
mov byte [esp + 0x1a8], 4
cmp dword [esp + 0xa4], 8
jb 0x4066e3
mov eax, dword [esp + 0x90]
push eax
call fcn.0059b877
add esp, 4
mov dword [esp + 0xa4], 7
mov dword [esp + 0xa0], edi
mov word [esp + 0x90], di
jmp 0x4067a6
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], edi
mov word [esp + 0x74], di
mov byte [esp + 0x1a8], 6
mov ecx, dword [ebx + 0x274]
push ecx
push str.http:__www.kuai8.com__cgameboxid_dqdgameid0
lea ecx, [esp + 0x78]
call fcn.0042b990
mov eax, dword [esp + 0x7c]
add esp, 8
cmp dword [esp + 0x88], 8
jae 0x40674b
lea eax, [esp + 0x74]
lea edx, [esp + 0x18]
push edx
mov ecx, edx
push ecx
push edx
push ecx
push eax
push str._bLLLL
push edi
push edi
push 1
lea esi, [ebx + 0x94]
push 0x68
push esi
call fcn.005a2905
add esp, 0x2c
mov byte [esp + 0x1a8], 4
cmp dword [esp + 0x88], 8
jb 0x40678f
mov edx, dword [esp + 0x74]
push edx
call fcn.0059b877
add esp, 4
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], edi
mov word [esp + 0x74], di
push 1
push 0x228
push 0x3bc
push 0x28
push 1
mov ecx, esi
call fcn.005a2849
call fcn.0040a8a0
push 4
call fcn.0059b847
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
xor edi, edi
cmp esi, edi
mov byte [esp + 0x1a8], 7
je 0x40681b
push 0x18
call fcn.0059b847
add esp, 4
cmp eax, edi
je 0x406806
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 0x10], 0xffffffff
mov byte [eax + 8], 0
mov dword [eax + 0x14], edi
mov dword [eax + 0xc], edi
jmp 0x406808
xor eax, eax
cmp eax, edi
mov dword [esi], eax
je 0x40681d
mov dword [eax], ebx
mov eax, dword [esi]
mov dword [eax + 4], 0x408560
jmp 0x40681d
xor esi, esi
cmp esi, edi
mov byte [esp + 0x1a8], 4
je 0x406830
mov eax, esi
call fcn.004303f0
cmp dword [ebx + 0x790], 1
jne 0x4068d4
push 0x1c
push str.url.dll_FileProtocolHandler
lea esi, [esp + 0xb0]
mov dword [esp + 0xc8], 7
mov dword [esp + 0xc4], edi
mov word [esp + 0xb4], di
call fcn.00402770
push edi
lea ecx, [ebx + 0x770]
push ecx
or eax, 0xffffffff
mov byte [esp + 0x1b0], 8
call fcn.00402990
mov eax, dword [esp + 0xac]
mov esi, 8
cmp dword [esp + 0xc0], esi
jae 0x40689e
lea eax, [esp + 0xac]
push 1
push edi
push eax
push str.rundll32.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0x1a8], 4
cmp dword [esp + 0xc0], esi
jb 0x4068d4
mov edx, dword [esp + 0xac]
push edx
call fcn.0059b877
add esp, 4
push edi
call fcn.005b8b28
add esp, 4
cmp dword [ebx + 0x90], 8
mov esi, eax
mov dword [esp + 0x2c], esi
mov edi, edx
jb 0x4068f3
mov eax, dword [ebx + 0x7c]
jmp 0x4068f6
lea eax, [ebx + 0x7c]
push eax
push 0xffffffffffffffff
push str.XmlLastTime
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
sub esi, 0x2a300
mov ecx, edi
cdq
sbb ecx, 0
cmp ecx, edx
jg 0x406933
jl 0x40691f
cmp esi, eax
ja 0x406933
cmp edi, edx
jg 0x406a20
jl 0x406933
cmp dword [esp + 0x2c], eax
jae 0x406a20
push 0x44
call fcn.0059b847
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
xor eax, eax
cmp edi, eax
mov byte [esp + 0x1a8], 9
je 0x406986
lea ecx, [ebx + 0x284]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x48], esp
push 0x24
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], eax
push str.http:__www.qq5.com_new_qidongnew.xml
mov word [esi + 4], ax
call fcn.00402770
mov esi, edi
call fcn.00405410
mov esi, eax
jmp 0x406988
xor esi, esi
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x7ac]
lea ecx, [esi + 0x20]
mov byte [esp + 0x1b0], 4
call fcn.00402580
mov eax, dword [ebx + 0x20]
push 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0x468
call fcn.0059b847
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov byte [esp + 0x1a8], 0xa
je 0x4069d8
push esi
push 0x403900
mov esi, eax
call fcn.004303a0
jmp 0x4069da
xor eax, eax
call fcn.004303f0
mov eax, dword [esp + 0x2c]
push 0xa
lea edx, [esp + 0x174]
push edx
push eax
call fcn.005b8bb2
add esp, 0xc
cmp dword [ebx + 0x90], 8
jb 0x406a04
mov ebx, dword [ebx + 0x7c]
jmp 0x406a07
add ebx, 0x7c
push ebx
lea ecx, [esp + 0x174]
push ecx
push str.XmlLastTime
push str.update
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0xc4]
push eax
mov dword [esp + 0x1ac], 0xffffffff
call fcn.0040e190
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.005b88a9
mov esp, ebp
pop ebp
ret