Function at 0x40d440
Capabilities:
Create process on windows
Delete file
Get common file path
Get program files directory
Get session user name
Initialize winsock library
Move file
Print debug messages

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
sub esp, 0x7f4
mov dword [0x41c1f0], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
push esi
push edi
push ecx
push 0x41d1b0
call ebx
push 0x41d1b0
call fcn.0040ed02
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
add esp, 4
mov eax, dword [edx + 4]
test eax, 0x10000000
je 0x40d4b9
cmp eax, 0x10000004
jb 0x40d4b9
push 0
push str.IsStartFromRunKey
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x40d4b9
push str.Global_red_spider
push 0x41d1b0
call sub.REDCOMM.dll_Ordinal_120
test eax, eax
jne 0x40d4d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7f4
ret 0x10
push str.red_spider
push 0x41d1b0
call sub.REDCOMM.dll_Ordinal_120
test eax, eax
je 0x40e2ca
push 0x10
call sub.REDCOMM.dll_Ordinal_140
test eax, eax
je 0x40e2ca
push str.GlobalExit_ePointer
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
test esi, esi
je 0x40d510
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.EPOINTER.EXE
call fcn.0040d1e0
mov ecx, dword [0x41c1f0]
add esp, 4
lea eax, [esp + 0x570]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x570]
push 0x5c
push edx
call fcn.0040e650
mov edx, eax
mov edi, 0x41b134
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str._noalert__noshow
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x57c]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [esp + 0x674]
push edx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40d5c2
push 0x7d0
push eax
push str.WSAStartup
push 0
push 0
call sub.REDCOMM.dll_Ordinal_24
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x7f4
ret 0x10
push 0
push str.HasSetSecurityDescriptor
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x40d5e7
call fcn.0040ced0
test eax, eax
je 0x40d5e7
push 1
push str.HasSetSecurityDescriptor
call sub.REDCOMM.dll_Ordinal_16
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov eax, dword [eax + 4]
test eax, 0x10000000
je 0x40dee5
cmp eax, 0x10000020
jb 0x40dee5
lea ecx, [esp + 0x30]
lea edx, [esp + 0x368]
push ecx
push edx
mov dword [esp + 0x38], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40dee5
lea eax, [esp + 0x368]
push str.SYSTEM
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40dee5
lea ecx, [esp + 0x244]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::constructor_void_]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x264]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x264]
push ecx
push eax
push eax
push 0x26
push eax
call esi
test eax, eax
jge 0x40d69f
lea edx, [esp + 0x264]
push edx
push 1
push 0
push 0x26
push 0
call esi
test eax, eax
jge 0x40d69f
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x264]
push eax
call ebp
test eax, eax
jle 0x40ded8
lea ecx, [esp + 0x264]
push ecx
call ebp
cmp byte [esp + eax + 0x263], 0x5c
jne 0x40d6dd
lea edx, [esp + 0x264]
push edx
call ebp
mov byte [esp + eax + 0x263], 0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x46c]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [0x41c1f0]
lea eax, [esp + 0x470]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40ded8
lea edx, [esp + 0x264]
push edx
call ebp
mov byte [esp + eax + 0x46c], 0
lea eax, [esp + 0x264]
lea ecx, [esp + 0x46c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40ded8
lea edx, [esp + 0x46c]
push edx
call ebp
lea ebp, [esp + eax + 0x46d]
push 0x5c
push ebp
call fcn.0040e650
add esp, 8
test eax, eax
je 0x40d764
mov byte [eax], 0
jmp 0x40d768
mov byte [ebp], 0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x140]
push eax
push 0
push 0
push 0x1c
push 0
call esi
test eax, eax
jge 0x40d7b4
lea ecx, [esp + 0x140]
push ecx
push 1
push 0
push 0x1c
push 0
call esi
test eax, eax
jge 0x40d7b4
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40ded8
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x140]
push str.VirtualStoreProgram_Files
push eax
call esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40d7f5
lea ecx, [esp + 0x140]
push ebp
push ecx
call esi
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str..exe
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
mov ebp, dword [sym.imp.SHELL32.dll_SHFileOperationA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str..dll
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str..ini
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str..red
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.NewClass.dat
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.Language.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.Resource.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.Skin.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.DriversMirrorw2k.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.DriversLanguage.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.DriversSkin.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.Drivers.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.upgrade.
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], eax
mov word [esp + 0x20], 0x1694
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.ExamPaperEnglish_Testing_Sample.emp
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str.ExamPaperEnglish_Testing_Sample.txt
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
push 0
push str.HasClearedVirtualStore
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x40ded8
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str..udf
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str..err
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x3c]
push str..log
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
push str.Scene.dat
lea ecx, [esp + 0x40]
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call fcn.0040d390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], 0x1694
call ebp
lea edx, [esp + 0x38]
push 4
push edx
push 4
push str.HasClearedVirtualStore
mov dword [esp + 0x48], 1
call sub.REDCOMM.dll_Ordinal_26
lea ecx, [esp + 0x244]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::destructor_void_]
push 0
push str.TheFirstRunning_Agent
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
je 0x40e02a
lea eax, [esp + 0x38]
xor esi, esi
mov ebp, 1
push eax
push esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], esi
call sub.REDCOMM.dll_Ordinal_57
cmp eax, 0x7a
jne 0x40dfb8
mov eax, dword [esp + 0x38]
cmp eax, esi
jbe 0x40dfb8
push eax
call fcn.0040e5b5
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x40dfb8
lea ecx, [esp + 0x38]
push ecx
push ebx
call sub.REDCOMM.dll_Ordinal_57
test eax, eax
jne 0x40dfaf
mov eax, dword [ebx]
cmp eax, esi
jbe 0x40dfaf
lea edi, [ebx + 4]
mov edx, dword [edi]
push edx
call sub.REDCOMM.dll_Ordinal_37
cmp eax, 1
jne 0x40df64
inc dword [esp + 0x30]
mov eax, dword [ebx]
inc esi
add edi, 0x2bc
cmp esi, eax
jb 0x40df53
cmp dword [esp + 0x30], 1
jle 0x40dfaf
mov ecx, dword [ebx]
mov eax, 1
cmp ecx, eax
jbe 0x40dfaf
lea edx, [ebx + 0x20]
mov ecx, dword [edx + 0x2b8]
mov edi, edx
lea esi, [edx + 0x2bc]
xor ebp, ebp
repe cmpsb byte [esi], byte es:[edi]
jne 0x40dfad
mov ecx, dword [ebx]
inc eax
add edx, 0x2bc
cmp eax, ecx
jb 0x40df86
mov ebp, dword [esp + 0x34]
jmp 0x40dfaf
xor ebp, ebp
push ebx
call fcn.0040e677
add esp, 4
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
test dword [eax + 4], 0x10000000
je 0x40dffc
lea ecx, [esp + 0x34]
lea edx, [esp + 0x368]
push ecx
push edx
mov dword [esp + 0x3c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40dffc
lea eax, [esp + 0x368]
push str.SYSTEM
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40e02a
test ebp, ebp
jne 0x40e02a
push ebp
call fcn.0040c9c0
test eax, eax
je 0x40e02a
push 1
push 1
call sub.RSCLASS.dll_Ordinal_103
lea ecx, [esp + 0x34]
push 4
push ecx
push 4
push str.TheFirstRunning_Agent
mov dword [esp + 0x44], ebp
call sub.REDCOMM.dll_Ordinal_26
lea edx, [esp + 0x30]
xor esi, esi
push edx
push esi
mov dword [esp + 0x38], esi
call sub.REDCOMM.dll_Ordinal_57
cmp eax, 0x7a
jne 0x40e155
mov eax, dword [esp + 0x30]
cmp eax, esi
jbe 0x40e155
push eax
call fcn.0040e5b5
mov ebx, eax
add esp, 4
cmp ebx, esi
mov dword [esp + 0x34], ebx
je 0x40e155
lea eax, [esp + 0x30]
push eax
push ebx
call sub.REDCOMM.dll_Ordinal_57
test eax, eax
jne 0x40e14c
mov eax, dword [ebx]
cmp eax, esi
jbe 0x40e14c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebp, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [esp + 0x38], esi
lea esi, [ebx + 0x24]
mov ecx, dword [esi - 0x20]
push ecx
call sub.REDCOMM.dll_Ordinal_37
cmp eax, 1
jne 0x40e133
xor edx, edx
xor eax, eax
mov dl, byte [esi + 1]
mov al, byte [esi]
xor ecx, ecx
push edx
mov cl, byte [esi - 1]
push eax
xor edx, edx
push ecx
mov dl, byte [esi - 2]
xor eax, eax
mov al, byte [esi - 3]
xor ecx, ecx
mov cl, byte [esi - 4]
push edx
push eax
push ecx
lea edx, [esp + 0x380]
push str._02X_02X_02X_02X_02X_02X
push edx
call fcn.0040f06c
mov ebx, dword [esi - 0x20]
add esp, 0x20
lea eax, [esp + 0x368]
push 0x41aca4
push eax
call edi
push ebx
call ebp
lea ecx, [esp + 0x368]
push eax
push ecx
call edi
lea edx, [esp + 0x368]
push str.___
push edx
call edi
lea eax, [esi + 0x214]
lea ecx, [esp + 0x368]
push eax
push ecx
call edi
lea edx, [esp + 0x368]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ecx, dword [ebx]
inc eax
add esi, 0x2bc
cmp eax, ecx
mov dword [esp + 0x38], eax
jb 0x40e097
push ebx
call fcn.0040e677
add esp, 4
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov eax, dword [eax + 4]
test eax, 0x10000000
je 0x40e182
cmp eax, 0x10000004
jb 0x40e182
push 0
push str.IsStartFromRunKey
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x40e182
push str.Global_red_spider_sync
jmp 0x40e187
push str.red_spider_sync
push 0x41d1b0
call sub.REDCOMM.dll_Ordinal_120
test eax, eax
jne 0x40e1aa
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x7f4
ret 0x10
mov ecx, 0xb
xor eax, eax
mov edi, 0x41d168
push str._noservice
rep stosd dword es:[edi], eax
mov ecx, 0xb
mov edi, 0x41c200
rep stosd dword es:[edi], eax
or eax, 0xffffffff
push 0x41d1b0
mov dword [0x41d168], eax
mov dword [0x41c200], eax
call fcn.0040e8a0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
test eax, eax
je 0x40e22c
mov ecx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
test dword [ecx + 4], 0x10000000
jne 0x40e22c
push str.KERNEL32.DLL
call esi
mov edi, eax
call ebx
push str.RegisterServiceProcess
push edi
mov dword [esp + 0x3c], eax
call ebp
test eax, eax
je 0x40e22c
mov edx, dword [esp + 0x34]
push 1
push edx
call eax
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0x409f80
mov eax, dword [esp + 0x810]
push 0
push 0x86
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push str.Riched20.dll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
push str._noservice
push 0x41d1b0
call fcn.0040e8a0
add esp, 8
test eax, eax
je 0x40e2b2
mov ecx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
test dword [ecx + 4], 0x10000000
jne 0x40e2b2
push str.KERNEL32.DLL
call esi
mov esi, eax
call ebx
push str.RegisterServiceProcess
push esi
mov edi, eax
call ebp
test eax, eax
je 0x40e2b2
push 0
push edi
call eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [0x41c1f0]
push edx
push str.RedEagle.DIBFullView.MiniBar
call dword [sym.imp.USER32.dll_UnregisterClassA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x7f4
ret 0x10