Function at 0x40fa40
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6f4
mov eax, dword [0x4612a8]
push ebx
push esi
mov dword [esp + 0x6f8], eax
push edi
mov ebx, ecx
jmp 0x40fa6f
mov esi, dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHEncrypt::MD5Encrypt_wchar_t_const___wchar_t__const_]
lea eax, [esp + 0x218]
push eax
lea ecx, [ebx + 0x192]
push ecx
call esi
lea edx, [esp + 0x1d8]
push edx
lea eax, [ebx + 0x1d4]
push eax
call esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
mov dword [esi], 0x6230003
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetMachineIDEx_wchar_t__const_]
mov cx, word [ebx + 0x74]
mov word [esi + 0xca], cx
mov dl, byte [ebx + 0x76]
xor eax, eax
mov word [esp + 0x504], 0
mov ecx, 0x81
lea edi, [esp + 0x506]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x504]
push 0x104
push eax
mov byte [esi + 0xcc], dl
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
mov word [esp + 0x304], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x306]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x50c]
push ecx
push str._sCheckCode.ini
lea edx, [esp + 0x30c]
push 0x104
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x2c
lea eax, [esp + 0x2e8]
push eax
push 0
push str.code
push 0x44e320
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp al, 1
movzx ecx, byte [esi + 0xcc]
jne 0x40fb54
add ecx, 3
cmp al, 2
mov byte [esi + 0xcc], cl
movzx ecx, cl
jne 0x40fb64
add ecx, 0xa
cmp al, 3
mov byte [esi + 0xcc], cl
movzx eax, cl
jne 0x40fb74
add eax, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov byte [esi + 0xcc], al
lea eax, [ebx + 0xd2]
push 0x20
push eax
lea ecx, [esi + 0x127]
push ecx
mov dword [esp + 0x20], eax
call edi
lea eax, [ebx + 0x112]
push 0x20
push eax
lea edx, [esi + 0x167]
push edx
mov dword [esp + 0x24], eax
call edi
push 0x20
lea eax, [ebx + 0x152]
push eax
lea ecx, [esi + 0x1a7]
push ecx
call edi
push 0x21
lea edx, [esp + 0x21c]
lea eax, [esi + 0x46]
push edx
push eax
mov dword [esp + 0x28], eax
call edi
push 0x21
lea eax, [esp + 0x1d4]
push eax
lea ecx, [esi + 0x88]
push ecx
call edi
push 0x13
lea edx, [ebx + 0x216]
push edx
lea eax, [esi + 0x1e7]
push eax
call edi
push 0x10
lea ecx, [ebx + 0x23c]
push ecx
lea edx, [esi + 0x20d]
push edx
call edi
lea eax, [ebx + 0x25c]
push 0x21
push eax
mov dword [esp + 0x18], eax
lea eax, [esi + 0x22d]
push eax
call edi
push 0xc
add ebx, 0xba
push ebx
lea ecx, [esi + 0x10f]
push ecx
call edi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
mov edi, 6
mov eax, 0x4d
mov edx, 0x63
mov word [esp + 0x20], 0x2c
mov word [esp + 0x22], 8
mov word [esp + 0x24], 5
mov word [esp + 0x26], 0x69
mov word [esp + 0x28], 0x50
mov word [esp + 0x2a], 0x38
mov word [esp + 0x2c], 0x59
mov word [esp + 0x2e], 0x73
mov word [esp + 0x30], di
mov word [esp + 0x32], 7
mov word [esp + 0x34], ax
mov word [esp + 0x36], dx
mov word [esp + 0x38], 0x46
mov word [esp + 0x3a], 0x6a
mov word [esp + 0x58], di
mov word [esp + 0x3c], ax
xor ebx, ebx
mov ecx, 0x62
mov word [esp + 0x40], cx
mov word [esp + 0x5e], cx
mov eax, 0x30
mov word [esp + 0x4e], ax
mov word [esp + 0x54], ax
xor eax, eax
mov word [esp + 0xf8], bx
mov ecx, 0x10
lea edi, [esp + 0xfa]
rep stosd dword es:[edi], eax
mov word [esp + 0xb0], bx
mov ecx, 0x10
lea edi, [esp + 0xb2]
rep stosd dword es:[edi], eax
mov word [esp + 0x140], bx
mov ecx, 0x10
lea edi, [esp + 0x142]
rep stosd dword es:[edi], eax
mov word [esp + 0x188], bx
mov ecx, 0x10
lea edi, [esp + 0x18a]
rep stosd dword es:[edi], eax
mov word [esp + 0x260], bx
mov ecx, 0x20
lea edi, [esp + 0x262]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x60], dx
mov word [esp + 0x68], bx
mov ecx, 0x10
lea edi, [esp + 0x6a]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHEncrypt::MD5Encrypt_wchar_t_const___wchar_t__const_]
lea edx, [esp + 0xf8]
push edx
push eax
mov word [esp + 0x46], 0x2e
mov word [esp + 0x4a], 0x66
mov word [esp + 0x4c], 0x5a
mov word [esp + 0x4e], 0x4c
mov word [esp + 0x50], 0x31
mov word [esp + 0x52], 0x54
mov word [esp + 0x54], 0x41
mov word [esp + 0x58], bx
mov word [esp + 0x5a], 0x41
mov word [esp + 0x5e], bx
mov word [esp + 0x62], 0x2d
mov word [esp + 0x64], bx
call edi
add esp, 8
jmp 0x40fdd2
xor eax, eax
mov dword [esp + 0xc], 0x42
lea esp, [esp]
jmp 0x40fdf2
mov ecx, eax
and ecx, 0x80000001
jns 0x40fe01
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x40fe0d
mov cx, word [esp + eax*2 + 0xf8]
jmp 0x40fe12
mov cx, word [esp + eax*2 + 0x20]
mov word [esp + eax*2 + 0x260], cx
jmp 0x40fe2a
mov ecx, dword [esp + 0xc]
inc eax
dec ecx
mov dword [esp + 0xc], ecx
jne 0x40fde0
jmp 0x40fe48
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x264]
push eax
call edi
lea ecx, [esp + 0x70]
push ecx
mov edx, ecx
push edx
call edi
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0xc0]
push eax
push ecx
call edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1a0]
push edx
push eax
call edi
lea ecx, [esp + 0x160]
push ecx
lea eax, [esi + 4]
push eax
call edi
add esp, 0x28
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ebx
jmp 0x40feb0
xor eax, eax
lea ecx, [esi + 0x26e]
cmp ax, 0x21
jae 0x40ff1d
jmp 0x40fed0
mov edx, ebx
and edx, 0x80000001
jns 0x40fedf
dec edx
or edx, 0xfffffffe
inc edx
jne 0x40fef7
mov edi, dword [esp + 0xc]
movzx edx, di
mov dx, word [esp + edx*2 + 0x140]
inc edi
mov dword [esp + 0xc], edi
jmp 0x40ff08
mov edi, dword [esp + 0x18]
movzx edx, di
mov dx, word [esp + edx*2 + 0x68]
inc edi
mov dword [esp + 0x18], edi
mov word [ecx], dx
jmp 0x40ff1b
jmp 0x40ff7d
jmp 0x40ff2f
mov edx, ebx
and edx, 0x80000001
jns 0x40ff3e
dec edx
or edx, 0xfffffffe
inc edx
jne 0x40ff56
mov edi, dword [esp + 0x14]
movzx edx, di
mov dx, word [esp + edx*2 + 0xb0]
inc edi
mov dword [esp + 0x14], edi
jmp 0x40ff6a
mov edi, dword [esp + 0x10]
movzx edx, di
mov dx, word [esp + edx*2 + 0x188]
inc edi
mov dword [esp + 0x10], edi
mov word [ecx], dx
jmp 0x40ff7d
inc eax
inc ebx
add ecx, 2
cmp ax, 0x41
jb 0x40feb8
jmp 0x40ff9e
mov al, byte [ebp + 0x10]
mov byte [esi + 0x26d], al
call dword [sym.imp.PlatformData.dll_public:_static_class_CGlobalUserInfo____cdecl_CGlobalUserInfo::GetInstance_void_]
mov ecx, eax
call dword [sym.imp.PlatformData.dll_public:_struct_tagGlobalUserData____thiscall_CGlobalUserInfo::GetGlobalUserData_void_]
mov ecx, dword [esp + 0x1c]
push 0x21
push ecx
add eax, 0x90
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x40ffd8
mov ecx, dword [esp + 0x6fc]
mov ax, 0x2f2
call fcn.004430ed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc