Function at 0x10012010
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006935f
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x1007a200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
xor ebx, ebx
mov edi, ecx
mov word [ebp - 0x230], ax
push ebx
mov eax, 0x1006dc30
lea esi, [ebp - 0x234]
mov dword [ebp - 0x2bc], edi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
call fcn.10002d50
mov dword [ebp - 4], ebx
cmp byte [edi + 0x11], bl
je 0x10012093
cmp dword [ebp - 0x21c], 8
jb 0x1001236a
mov ecx, dword [ebp - 0x230]
push ecx
jmp 0x10012362
lea ecx, [ebp - 0x234]
call fcn.1001ea70
push str.EVPConfig.ini
mov eax, 0xd
lea edx, [ebp - 0x234]
call fcn.100095e0
cmp dword [edi + 0x18], ebx
jne 0x100120e7
push 0xf0
call fcn.10048937
add esp, 4
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x100120df
push eax
mov ebx, edi
call fcn.1000ecc0
xor ebx, ebx
jmp 0x100120e1
xor eax, eax
mov byte [ebp - 4], bl
mov dword [edi + 0x18], eax
lea esi, [edi + 0x270]
push esi
call sub.EVPNet.dll_EVPNETReference
lea eax, [edi + 0x274]
push eax
call sub.EVPNet.dll_EVPNETReferenceNM
mov eax, dword [edi + 0x274]
mov esi, dword [esi]
mov dword [edi + 0xd4], eax
mov edx, dword [esi]
lea eax, [edi + 0xc]
push eax
mov eax, dword [edx]
push esi
call eax
mov eax, 0xf
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x2a0], ebx
mov byte [ebp - 0x2b0], bl
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x280], ebx
mov byte [ebp - 0x290], bl
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], ebx
mov byte [ebp - 0x270], bl
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], ebx
mov byte [ebp - 0x254], bl
mov dword [ebp - 0x2b8], ebx
mov byte [ebp - 0x23c], bl
mov byte [ebp - 0x23b], bl
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x238], 0xffffffff
push 0x206
lea edx, [ebp - 0x216]
xor ecx, ecx
push ebx
mov byte [ebp - 4], 2
push edx
mov word [ebp - 0x218], cx
call fcn.10049f60
mov eax, dword [ebp - 0x230]
add esp, 0xc
cmp dword [ebp - 0x21c], 8
jae 0x100121c4
lea eax, [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.rtp.bav.baidu.com
push str.CSServer
push str.EVPNET
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub esp, 0x1c
mov esi, esp
xor ecx, ecx
lea eax, [ebp - 0x218]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov dword [ebp - 0x2c0], esp
mov word [esi + 4], cx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10012210
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
call fcn.10002d50
lea esi, [ebp - 0x2dc]
call fcn.1001ea00
add esp, 0x1c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 3
call fcn.100023a0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c4], 0x10
jb 0x10012268
mov edx, dword [ebp - 0x2d8]
push edx
call fcn.10047382
add esp, 4
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x1001227d
lea eax, [ebp - 0x230]
push eax
push 0xfa6
push str.CSServerPort
push str.EVPNET
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea esi, [edi + 0x100]
lea edi, [ebp - 0x2b8]
mov dword [ebp - 0x298], eax
call fcn.10011b30
mov esi, dword [ebp - 0x2bc]
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x26c], ebx
mov byte [esi + 0x10], bl
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea edi, [esi + 4]
mov dword [esi + 0x14], eax
cmp dword [edi + 4], ebx
jne 0x100122e1
push ebx
push ebx
push edi
push 0x1000b1a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
cmp dword [esi + 0xd8], ebx
lea edi, [esi + 0x1c]
jne 0x10012318
push ebx
push ebx
push ebx
push ebx
mov byte [edi + 0xc0], bl
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push edi
push 0x10004ba0
push ebx
push ebx
mov dword [edi + 0x98], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xbc], eax
mov byte [esi + 0x11], 1
mov eax, dword [0x1007e134]
cmp eax, ebx
je 0x10012347
mov ecx, dword [eax]
mov edx, dword [ecx]
push str.CTaskManger::Open
push str._s_Execute_OK__n
push 0x59
push str.CTaskManger::Open
push str..TaskManger.cc
push 2
push eax
call edx
add esp, 0x1c
lea esi, [ebp - 0x2b8]
call fcn.10011780
cmp dword [ebp - 0x21c], 8
jb 0x1001236a
mov eax, dword [ebp - 0x230]
push eax
call fcn.10047382
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004738d
mov esp, ebp
pop ebp
ret