Function at 0x408460
Capabilities:
Download url
Get common file path
Initialize winsock library
Read .ini file
Receive data
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x870]
mov dword [ebp - 0x874], ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x408720
push 0x435bf8
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.DirSvrInfo1.ini
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.0040b0c0
add esp, 0xc
lea eax, [ebp - 0x2d0]
push eax
push 0x40
lea eax, [ebp - 0xc8]
push eax
push 0x431688
push 0x43169c
push str.ServerInfo1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str..DirSvrInfo1.ini
push 0x40
lea eax, [ebp - 0x48]
push eax
push str.127.0.0.1
push str.Domain
push 0x431398
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x40855e
mov edi, dword [ebx + 0xc]
cmp dword [edi], 0
je 0x40855e
push 0x20
call fcn.004090bd
add esp, 4
mov esi, eax
xorps xmm0, xmm0
push 0x20
movups xmmword [esi], xmm0
push esi
movups xmmword [esi + 0x10], xmm0
movsx eax, word [ebx + 8]
push dword [edi]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntop]
cmp dword [edi + 4], 0
lea edi, [edi + 4]
mov dword [0x437560], esi
jne 0x408527
jmp 0x408564
mov esi, dword [0x437560]
lea edi, [ebp - 0xc8]
mov ebx, 0x437550
test esi, esi
je 0x4085b6
push str..DirSvrInfo1.ini
push esi
push 0x4316d0
push 0x431398
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor edi, edi
nop dword [eax + eax]
push esi
call fcn.00410a2e
add esp, 4
mov byte [ebx], al
lea ebx, [ebx + 1]
push 0x2e
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov esi, eax
test esi, esi
je 0x4085de
inc edi
inc esi
cmp edi, 4
jb 0x408590
jmp 0x4085de
xor esi, esi
push edi
call fcn.004109ef
add esp, 4
mov byte [ebx], al
lea ebx, [ebx + 1]
push 0x2e
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x4085de
inc esi
add edi, 2
cmp esi, 4
jb 0x4085b8
lea eax, [ebp - 0x2d0]
push eax
push 0x40
lea eax, [ebp - 0xc8]
push eax
push str.27015_27015_27015
push str.Ports
push str.ServerInfo1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x2c
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x40861b
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xc8]
push eax
call fcn.004109ef
movups xmm0, xmmword [str.wobushicheshen]
add esp, 4
mov word [0x437554], ax
lea eax, [ebp - 0x6e0]
movups xmmword [0x437564], xmm0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x4d8]
push str._siniLoaderBG.bmp
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x4d8]
push 0
push 0
push eax
push str.http:__43.198.91.248:8887_bg_bg2.php
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x4086a9
push 0x2010
push 0
push 0
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [0x437558], eax
jmp 0x4086ae
mov eax, dword [0x437558]
test eax, eax
jne 0x4086ca
push 0x84
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov dword [0x437558], eax
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [0x437558]
mov dword [0x437574], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0x407c30
push dword [ebp - 0x874]
push 0x81
push dword [0x4371d0]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push dword [0x437558]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x437574]
call dword [sym.imp.GDI32.dll_DeleteDC]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408e6f
mov esp, ebp
pop ebp
ret