Function at 0x4028e0
Capabilities:
Delete file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44666c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00402ce0
mov eax, dword [0x449334]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00402bd0
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x402920
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 7
mov esi, str.C_Svjaual_EmictRwOekaCeri_
lea edi, [ebp - 0x270]
rep movsd dword es:[edi], dword [esi]
push 0xdd
lea edx, [ebp - 0x253]
push 0
push edx
movsb byte es:[edi], byte [esi]
call fcn.004256b0
xor eax, eax
add esp, 0xc
lea ecx, [ebp - 0x270]
cmp byte [ebp - 0x270], al
je 0x402970
lea esp, [esp]
xor byte [ecx], al
inc eax
inc ecx
cmp eax, 8
jne 0x40296b
xor eax, eax
cmp byte [ecx], 0
jne 0x402960
mov eax, dword [str.SmFqrc]
mov ecx, dword [0x43cd90]
mov dx, word [0x43cd94]
push pe_nt_image_headers32
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x166]
push 0
push eax
mov dword [ebp - 0x16c], ecx
mov word [ebp - 0x168], dx
call fcn.004256b0
xor eax, eax
add esp, 0xc
lea ecx, [ebp - 0x170]
cmp byte [ebp - 0x170], al
je 0x4029d0
jmp 0x4029c0
xor byte [ecx], al
inc eax
inc ecx
cmp eax, 8
jne 0x4029cb
xor eax, eax
cmp byte [ecx], 0
jne 0x4029c0
lea edx, [ebp - 0x170]
lea ecx, [ebp - 0x2b4]
push edx
or eax, 0xffffffff
lea esi, [ebp - 0x2b8]
mov dword [ebp - 0x2b8], ecx
mov byte [ebp - 0x2b4], 0
call fcn.004139f0
mov eax, dword [ebp - 0x2b8]
push eax
call fcn.00402bd0
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 1
call edi
test eax, eax
je 0x402a1e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x270]
lea ecx, [ebp - 0x2fc]
push edx
or eax, 0xffffffff
lea esi, [ebp - 0x300]
mov dword [ebp - 0x300], ecx
mov byte [ebp - 0x2fc], 0
call fcn.004139f0
mov eax, dword [ebp - 0x2b8]
push eax
mov eax, esi
call fcn.004138f0
mov ecx, dword [ebp - 0x300]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [0x449334]
mov eax, dword [edx + 8]
push eax
call fcn.00402bd0
push eax
push 0
push 1
call edi
test eax, eax
je 0x402a8f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x449334]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00402bd0
push eax
push 0
push 1
call edi
test eax, eax
je 0x402ab2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x390]
call fcn.00414180
mov edx, 0x43c7f1
mov ecx, str.Unins.exe
lea edi, [ebp - 0x390]
call fcn.00413bb0
mov ecx, dword [ebp - 0x390]
lea eax, [ebp - 0x344]
mov dword [ebp - 0x348], eax
push ecx
or eax, 0xffffffff
lea esi, [ebp - 0x348]
mov byte [ebp - 0x344], 0
call fcn.004139f0
push str.DataSysConfig.ini
mov eax, esi
call fcn.004138f0
push 0x64
lea edx, [ebp - 0x70]
push 0
push edx
call fcn.004256b0
mov eax, dword [ebp - 0x348]
add esp, 0xc
push eax
push 0x64
lea ecx, [ebp - 0x70]
push ecx
push str.ByServer.exe
push str.RunSetup
push str.SysConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x70]
push edx
call fcn.00402bd0
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x402b59
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x348]
lea ecx, [ebp - 0x344]
cmp eax, ecx
je 0x402b72
push eax
call fcn.0041dba1
add esp, 4
mov eax, dword [ebp - 0x390]
lea edx, [ebp - 0x38c]
cmp eax, edx
je 0x402b8b
push eax
call fcn.0041dba1
add esp, 4
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x2fc]
cmp eax, ecx
je 0x402ba4
push eax
call fcn.0041dba1
add esp, 4
mov eax, dword [ebp - 0x2b8]
lea edx, [ebp - 0x2b4]
cmp eax, edx
je 0x402bbd
push eax
call fcn.0041dba1
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041d129
mov esp, ebp
pop ebp
ret