Function at 0x403370
Capabilities:
Move file
Read .ini file

Disassembly:
sub esp, 0x10c
xor eax, eax
push esi
mov dword [esp + 5], eax
push edi
mov word [esp + 0xd], ax
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
push 0x406aec
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
push 8
push ecx
push 0x4065a0
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.FirstInstalled
push str.ICGAUTHCLIENT
mov byte [esp + 0x20], 0
call edi
mov esi, 0x40657c
lea eax, [esp + 8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4033ee
test cl, cl
je 0x4033ea
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4033ee
add eax, 2
add esi, 2
test cl, cl
jne 0x4033ca
xor eax, eax
jmp 0x4033f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035de
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 8
push eax
push 0x406aec
call ebp
push 0x406aec
call fcn.00403300
mov edi, 0x406aec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov byte [eax + 1], 0
mov edi, str.AdAuth.log
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 8
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 0x406aec
rep movsb byte es:[edi], byte [esi]
call ebp
push 0x406aec
call fcn.00403300
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 4
push 0x4069e8
push 0x40657c
push str.RunState
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push str.ADMIT
push str.AuthMode
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x406548
push str.ShowTrayIcon
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x406534
push str.MustAddAd
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x406534
push str.AutoRun
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x406534
push str.ShowFailInfo
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x406548
push str.CanChangePwd
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x4064fc
push str.HearTime
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x406534
push str.SaveConfig
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push str.211.100.26.34
push str.AuthTcpIp
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push str.2223
push str.AuthTcpPort
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push str.211.100.26.34
push str.HeartUdpIp
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push str.2229
push str.HeartUdpPort
push str.ICGAUTHCLIENT
call esi
push 0x406aec
push 0x4065a0
push str.FirstInstalled
push str.ICGAUTHCLIENT
call esi
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 0x10c
ret
push 0x4069e8
lea ecx, [esp + 0xc]
push 8
xor eax, eax
push ecx
push 0x4065a0
mov dword [esp + 0x18], eax
push str.RunState
push str.ICGAUTHCLIENT
mov dword [esp + 0x24], eax
call edi
push 0x4069e8
call fcn.00403e50
add esp, 4
mov esi, 0x4065a0
lea eax, [esp + 8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40363f
test cl, cl
je 0x40363b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40363f
add eax, 2
add esi, 2
test cl, cl
jne 0x40361b
xor eax, eax
jmp 0x403644
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403660
push str.RunState:0
call fcn.00403e50
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x10c
ret
push str.RunState:1
call fcn.00403e50
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x10c
ret