Function at 0x40c380
Capabilities:
Create thread
Delete file
Print debug messages
Read .ini file
Terminate thread

Disassembly:
mov eax, 0x24a8
call fcn.004143e0
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push esi
push edi
push 0x4114c0
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push 0x4701f8
push 0
mov dword [0x4701f4], eax
call ebx
push 0x2e
push 0x4701f8
call fcn.00414640
mov edx, eax
add esp, 8
test edx, edx
je 0x40c3fd
inc edx
je 0x40c3fd
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x40c3fd
mov edi, 0x43e14c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4114d0
call ebp
push 0x104
push 0x4700f0
push 0
mov dword [0x4700ec], eax
call ebx
push 0x2e
push 0x4700f0
call fcn.00414640
mov edx, eax
add esp, 8
test edx, edx
je 0x40c460
inc edx
je 0x40c460
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x40c460
mov edi, 0x43e14c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [0x443dbc]
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x40c4f6
mov edi, ebp
mov ebp, dword [ebp]
mov ecx, dword [edi + 4]
mov edx, dword [edi]
lea esi, [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x40c4cd
push eax
mov ecx, esi
call fcn.00411210
cmp byte [eax], 0
je 0x40c4ba
mov edx, dword [esi + 4]
mov ecx, esi
push edx
call fcn.00411210
cmp byte [eax], 0xff
je 0x40c4ba
mov eax, dword [esi + 4]
mov ecx, esi
push eax
call fcn.00411210
dec byte [eax]
jmp 0x40c4cd
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
add ecx, 2
dec edx
push ecx
push edx
mov ecx, esi
call fcn.00411220
xor eax, eax
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00425b42
mov ecx, dword [0x443dc0]
add esp, 4
dec ecx
cmp ebp, ebx
mov dword [0x443dc0], ecx
jne 0x40c470
call fcn.004106d0
call fcn.0040ce70
test eax, eax
je 0x40ce5d
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x361]
mov byte [esp + 0x360], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x46fa24
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x464]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.processinfo.dat
call fcn.00425e4c
lea ecx, [esp + 0x14]
push ecx
call fcn.00410030
mov edi, dword [eax]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x464]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00425dde
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.vex.dat
call fcn.00425e4c
lea eax, [esp + 0x14]
push eax
call fcn.00410030
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x798]
push ecx
push 0x46fa24
push 0x43e12c
push edx
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00425dde
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WatchClient.ini
call fcn.00425e4c
lea eax, [esp + 0x14]
push eax
call fcn.00410030
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x130]
push ecx
push 0x46fa24
push 0x43e12c
push edx
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00425dde
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.WatchClientex.ini
call fcn.00425e4c
lea eax, [esp + 0x14]
push eax
call fcn.00410030
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x360]
push ecx
push 0x46fa24
push 0x43e12c
push edx
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00425dde
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x464]
push eax
call esi
lea ecx, [esp + 0x798]
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [esp + 0x18]
xor ebp, ebp
push edx
push ebp
push ebp
push 0x40f970
push ebp
push ebp
mov dword [esp + 0x30], ebp
call esi
mov dword [0x443dc4], eax
lea eax, [esp + 0x18]
push eax
push ebp
push ebp
push 0x410b70
push ebp
push ebp
call esi
mov dword [0x443dc8], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.msedtsf.dat
stosb byte es:[edi], al
call fcn.00425e4c
lea ecx, [esp + 0x14]
push ecx
call fcn.00410030
mov edx, dword [eax]
add esp, 8
push edx
push 0x46fa24
lea eax, [esp + 0x34]
push 0x43e12c
push eax
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00425dde
lea ecx, [esp + 0x2c]
push ebp
push ecx
call fcn.004145e3
add esp, 8
test eax, eax
jne 0x40c7b9
push ecx
mov dword [0x4700d4], 1
mov ecx, esp
mov dword [esp + 0x18], esp
push str.msedtsfex.dat
call fcn.00425e4c
lea edx, [esp + 0x14]
push edx
call fcn.00410030
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x2c]
push eax
push 0x46fa24
push 0x43e12c
push ecx
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00425dde
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.004145e3
add esp, 8
test eax, eax
jne 0x40c7a7
mov dword [0x4700d4], 2
mov eax, dword [0x46fe6c]
cmp eax, ebp
je 0x40c7b9
mov ecx, dword [0x4700d4]
push ecx
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.mshucv.dat
call fcn.00425e4c
lea edx, [esp + 0x14]
push edx
call fcn.00410030
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x2c]
push eax
push 0x46fa24
push 0x43e12c
push ecx
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00425dde
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.004145e3
add esp, 8
test eax, eax
jne 0x40c8f6
push ecx
mov esi, eax
mov ecx, esp
mov dword [esp + 0x18], esp
push str.mshucal.dat
mov dword [esp + 0x30], eax
mov edi, 1
call fcn.00425e4c
lea ecx, [esp + 0x14]
push ecx
call fcn.00410030
mov edx, dword [eax]
add esp, 8
lea eax, [esp + 0x2c]
push edx
push 0x46fa24
push 0x43e12c
push eax
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00425dde
lea ecx, [esp + 0x2c]
push ebp
push ecx
call fcn.004145e3
add esp, 8
test eax, eax
jne 0x40c870
mov esi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x130]
push edx
lea eax, [esp + 0x30]
push 0x104
push eax
push 0x442da0
push str.AuditProtect
push 0x43d6b4
call ebx
lea ecx, [esp + 0x2c]
push ecx
call fcn.0041451e
add esp, 4
cmp eax, ebp
jne 0x40c8da
lea edx, [esp + 0x360]
lea eax, [esp + 0x2c]
push edx
push 0x104
push eax
push 0x442da0
push str.AuditProtect
push 0x43d6b4
call ebx
lea ecx, [esp + 0x2c]
push ecx
call fcn.0041451e
add esp, 4
mov ecx, dword [0x46fe74]
cmp ecx, ebp
je 0x40c8f6
sub esp, 0xc
mov edx, esp
mov dword [edx], edi
mov dword [edx + 4], esi
mov dword [edx + 8], eax
call ecx
add esp, 0xc
cmp dword [0x46fe80], 4
jne 0x40c941
mov eax, dword [0x46fe70]
cmp eax, ebp
je 0x40c941
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0x45a568
call eax
cmp dword [esp + 0x10], 0x18ec
je 0x40c93c
push str.VRVSAFEC:_VrvShareMemory_Size_not_Same__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24a8
ret 0x10
call fcn.004102b0
lea ecx, [esp + 0xc04]
call fcn.004082e0
call fcn.0040e000
mov dword [esp + 0x10], ebp
lea edx, [esp + 0x8c4]
lea eax, [esp + 0x798]
push edx
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x40ccf4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x46fe80]
mov ecx, dword [esp + 0x10]
inc ecx
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40ca3c
cmp dword [0x46fe88], ebp
jne 0x40ca3c
cmp dword [0x4700d4], ebp
jne 0x40ca3c
lea ecx, [esp + 0x20]
call fcn.00409fe0
push 0x43e088
lea ecx, [esp + 0x24]
call fcn.0040a030
cmp eax, ebp
mov dword [0x46fe88], eax
je 0x40ca33
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.vrvhook.dll
call fcn.00425e4c
lea ecx, [esp + 0x20]
push ecx
call fcn.00410030
mov edx, dword [eax]
add esp, 8
lea eax, [esp + 0xa04]
push edx
push 0x46fa24
push 0x43e12c
push eax
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x1c]
call fcn.00425dde
mov ecx, dword [0x46fea0]
lea eax, [esp + 0xa04]
push 1
push eax
mov ecx, dword [ecx + 0xc]
mov eax, dword [0x46fe88]
push ebp
push eax
mov edx, dword [ecx]
call dword [edx + 0x14]
lea ecx, [esp + 0x20]
call fcn.0040a010
lea ecx, [esp + 0x464]
push ecx
call fcn.0040e780
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x130]
lea eax, [esp + 0x234]
push edx
push 0x12c
push eax
push 0x442da0
push str.HelpControlDevice
push 0x43d6b4
call esi
lea ecx, [esp + 0x234]
push ecx
call fcn.0041451e
mov ecx, dword [0x46fe50]
add esp, 4
cmp ecx, ebp
je 0x40caaa
cmp dword [0x46feac], eax
je 0x40caaa
push eax
mov dword [0x46feac], eax
call ecx
add esp, 4
mov ebx, 1
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x592]
mov word [esp + 0x590], bp
rep stosd dword es:[edi], eax
lea edx, [esp + 0x130]
stosw word es:[edi], ax
push edx
lea eax, [esp + 0x238]
push 0x12c
push eax
push 0x442da0
push str.DisableCreateDiskFile
push 0x43d6b4
call esi
lea ecx, [esp + 0x234]
push ecx
call fcn.0041451e
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x40cb59
lea edx, [esp + 0x130]
lea eax, [esp + 0x234]
push edx
push 0x104
push eax
push 0x442da0
push str.DisableCreateDiskInfo
push 0x43d6b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x590]
push 0x104
push ecx
lea edx, [esp + 0x23c]
push 0xffffffffffffffff
push edx
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x590]
push eax
call fcn.00423c2e
add esp, 4
cmp dword [0x46fe58], ebp
je 0x40cbb9
cmp dword [0x46feb0], esi
jne 0x40cb82
lea ecx, [esp + 0x590]
push ecx
push 0x46febc
call fcn.0041445e
add esp, 8
test eax, eax
je 0x40cbb9
lea edx, [esp + 0x590]
push edx
push 0x46febc
call fcn.00414439
push 0x46febc
push esi
mov dword [0x46feb0], esi
call dword [0x46fe58]
add esp, 0x10
push 0x46febc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, 1
cmp dword [esp + 0x10], 6
jne 0x40cc73
mov eax, dword [0x46fc3c]
mov dword [esp + 0x10], ebp
cmp eax, ebp
je 0x40cc03
call fcn.0040ef90
test eax, eax
je 0x40cc03
mov eax, 0x13bcc
call fcn.004143e0
mov ecx, 0x4ef3
mov esi, 0x45be58
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46fc3c]
add esp, 0x13bcc
mov ebx, 1
cmp dword [0x46fe54], ebp
je 0x40cc73
cmp dword [0x46feac], ebp
je 0x40cc73
lea ecx, [esp + 0xc04]
call fcn.00409650
test eax, eax
je 0x40cc73
sub esp, 0xb7c
mov ecx, 0x2df
lea esi, [esp + 0x17d4]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46fe54]
mov eax, dword [0x46feac]
mov ecx, 0x2df
lea esi, [esp + 0x17d4]
mov edi, 0x45b2d8
mov dword [0x45a774], eax
add esp, 0xb7c
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc04]
call fcn.00408730
mov ebx, 1
cmp dword [0x46fe80], 4
jne 0x40c956
cmp ebx, ebp
je 0x40c956
cmp dword [0x4700dc], ebp
je 0x40c956
mov eax, dword [0x46fe70]
cmp eax, ebp
je 0x40c956
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0x45a568
call eax
mov edi, dword [0x4700dc]
mov ecx, 0x63b
mov esi, 0x45a568
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x4700dc]
mov ecx, 0x4ef3
mov esi, 0x45be58
lea edi, [edx + 0x18ec]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4700e0]
cmp eax, ebp
je 0x40c956
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40c956
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, 0x443dc4
mov eax, dword [esi]
cmp eax, ebp
je 0x40cd10
push ebp
push eax
call edi
add esi, 4
cmp esi, 0x443dcc
jl 0x40cd06
mov ebx, dword [0x443dbc]
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x40cdb1
mov edi, ebp
mov ebp, dword [ebp]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
lea esi, [edi + 8]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x40cd88
push eax
mov ecx, esi
call fcn.00411210
cmp byte [eax], 0
je 0x40cd75
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.00411210
cmp byte [eax], 0xff
je 0x40cd75
mov edx, dword [esi + 4]
mov ecx, esi
push edx
call fcn.00411210
dec byte [eax]
jmp 0x40cd88
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
add eax, 2
dec ecx
push eax
push ecx
mov ecx, esi
call fcn.00411220
xor eax, eax
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00425b42
mov ecx, dword [0x443dc0]
add esp, 4
dec ecx
cmp ebp, ebx
mov dword [0x443dc0], ecx
jne 0x40cd2b
mov ebx, dword [0x443dac]
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x40ce47
mov edi, ebp
mov ebp, dword [ebp]
mov edx, dword [edi + 4]
mov eax, dword [edi]
lea esi, [edi + 8]
mov dword [edx], eax
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [ecx + 4], edx
mov eax, dword [esi + 4]
test eax, eax
je 0x40ce1e
push eax
mov ecx, esi
call fcn.00411210
cmp byte [eax], 0
je 0x40ce0b
mov eax, dword [esi + 4]
mov ecx, esi
push eax
call fcn.00411210
cmp byte [eax], 0xff
je 0x40ce0b
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.00411210
dec byte [eax]
jmp 0x40ce1e
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
add edx, 2
dec eax
push edx
push eax
mov ecx, esi
call fcn.00411220
xor eax, eax
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00425b42
mov ecx, dword [0x443db0]
add esp, 4
dec ecx
cmp ebp, ebx
mov dword [0x443db0], ecx
jne 0x40cdc1
call fcn.0040e180
call fcn.004103f0
lea ecx, [esp + 0xc04]
call fcn.00408430
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24a8
ret 0x10