Function at 0xa56710
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0xa9b49b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1eb4
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x1eb0], eax
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor eax, esp
push eax
lea eax, [esp + 0x1ec8]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, 0xd
mov esi, str.SOFTWAREMicroWorldeScan_for_WindowsSecondary_Server
lea edi, [esp + 0x1344]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x103
xor edi, edi
lea eax, [esp + 0xe21]
push edi
push eax
mov byte [esp + 0xe28], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0xf29]
push edi
push ecx
mov byte [esp + 0xf30], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [esp + 0x209]
push edi
push edx
mov byte [esp + 0x210], 0
call fcn.00a7ffb0
add esp, 0xc
push 0xa10
lea eax, [esp + 0x410]
push edi
push eax
call fcn.00a7ffb0
add esp, 0xc
push ebx
lea ecx, [esp + 0xe20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xe1c], 0
je 0xa56829
lea eax, [esp + 0xe1c]
nop
inc eax
cmp byte [eax], 0
jne 0xa56800
lea edx, [esp + 0xe1c]
sub eax, edx
je 0xa56829
cmp byte [esp + eax + 0xe1b], 0x5c
je 0xa56829
push 0xaa1564
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.eServ.ini
lea ecx, [esp + 0xe20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push edi
xor edx, edx
lea ecx, [esp + 0xe24]
call fcn.0095a0f0
add esp, 8
lea edx, [esp + 0xe1c]
push edx
test eax, eax
je 0xa5688f
lea eax, [esp + 0x1ba8]
push str._DFAS__Unable_to_locate_file__s_
push eax
call fcn.00a78f30
add esp, 0xc
push edi
push 1
lea ecx, [esp + 0x1bac]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor eax, eax
jmp 0xa56f10
push 0x104
lea eax, [esp + 0xf2c]
push eax
push 0xaa1543
push str.ClientLogDir
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0xf24], 0
jne 0xa568f7
lea ecx, [esp + 0xe1c]
push ecx
lea edx, [esp + 0x1db8]
push str._DFAS__Unable_to_locate_Entry_of_ClientLogDir_in__s_
push edx
call fcn.00a78f30
lea eax, [esp + 0x1dc0]
add esp, 0xc
push edi
push 1
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor eax, eax
jmp 0xa56f10
lea ecx, [esp + 0xf24]
call fcn.0095a450
test eax, eax
jne 0xa5692a
lea ecx, [esp + 0xf24]
push ecx
lea edx, [esp + 0x1cb0]
push str._DFAS__Unable_to_locate_ClientLogDir__s_
push edx
call fcn.00a78f30
lea eax, [esp + 0x1cb8]
jmp 0xa568dc
cmp dword [0xbdeea4], edi
jne 0xa56963
lea ecx, [esp + 0x1a9c]
push str._DFAS__Unable_to_locate_SendFileToAgentEx_Procedure_in_DNSLIB.DLL_
push ecx
call fcn.00a78f30
push edi
push 1
lea edx, [esp + 0x1aac]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
xor eax, eax
jmp 0xa56f10
cmp dword [ebp + 8], 2
jne 0xa56c99
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], ebx
call fcn.0097f770
push 0x207
mov dword [esp + 0x1ed4], edi
lea eax, [esp + 0x1589]
push edi
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x1590], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [esp + 0x1791]
push edi
push ecx
mov byte [esp + 0x1798], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [esp + 0x1381]
push edi
push edx
mov byte [esp + 0x1388], bl
call fcn.00a7ffb0
add esp, 0xc
push edi
lea eax, [esp + 0x1380]
push eax
lea ecx, [esp + 0x158c]
call fcn.0096be10
push 1
lea ecx, [esp + 0x1380]
push ecx
lea ecx, [esp + 0x1794]
call fcn.0096be10
lea edx, [esp + 0x24]
push edx
call fcn.00983790
push edi
lea eax, [esp + 0x24]
push eax
call fcn.00983e00
mov esi, dword [esp + 0x24]
cmp esi, edi
je 0xa56ad3
cmp byte [esi], bl
je 0xa56ac8
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], edi
push esi
mov bl, 0x2c
lea edi, [esp + 0x113c]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x14], 0xffffffff
je 0xa56ac4
jmp 0xa56a60
lea edx, [esp + 0x1134]
push str.127.0.0.1
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0xa56aa6
push 1
push 0
lea ecx, [esp + 0x113c]
lea edx, [esp + 0x34]
call fcn.0097faa0
test eax, eax
je 0xa56aa6
push 0
push 0x2c
lea eax, [esp + 0x113c]
push eax
lea edi, [esp + 0x1c]
call fcn.0098d640
lea ecx, [esp + 0x14]
push ecx
push esi
mov bl, 0x2c
lea edi, [esp + 0x113c]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x14], 0xffffffff
jne 0xa56a60
mov ebx, dword [esp + 0x10]
push esi
call fcn.00a78fec
add esp, 4
xor edi, edi
mov esi, dword [esp + 0x20]
cmp esi, edi
je 0xa56b83
cmp byte [esi], 0
je 0xa56b78
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], edi
push esi
mov bl, 0x2c
lea edi, [esp + 0x1244]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x18], 0xffffffff
je 0xa56b74
lea ebx, [ebx]
lea eax, [esp + 0x123c]
push str.127.0.0.1
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0xa56b56
push 1
push 0
lea ecx, [esp + 0x1244]
lea edx, [esp + 0x34]
call fcn.0097faa0
test eax, eax
je 0xa56b56
push 0
push 0x2c
lea ecx, [esp + 0x1244]
push ecx
lea edi, [esp + 0x1c]
call fcn.0098d640
lea edx, [esp + 0x18]
push edx
push esi
mov bl, 0x2c
lea edi, [esp + 0x1244]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x18], 0xffffffff
jne 0xa56b10
mov ebx, dword [esp + 0x10]
push esi
call fcn.00a78fec
add esp, 4
xor edi, edi
cmp ebx, edi
je 0xa56b99
cmp byte [ebx], 0
je 0xa56b99
push 0x2c
push ebx
mov ecx, str.127.0.0.1
call fcn.0098d4d0
cmp byte [esp + 0x137c], 0
je 0xa56bb7
push 0x2c
lea eax, [esp + 0x1380]
push eax
mov ecx, str.LocalHost
call fcn.0098d4d0
cmp byte [esp + 0x1584], 0
je 0xa56bd5
push 0x2c
lea ecx, [esp + 0x1588]
push ecx
mov ecx, str.127.0.0.1
call fcn.0098d4d0
cmp byte [esp + 0x178c], 0
je 0xa56bf3
push 0x2c
lea edx, [esp + 0x1790]
push edx
mov ecx, str.127.0.0.1
call fcn.0098d4d0
push str.LastPolicyAppliedOnLocal
lea eax, [esp + 0x2c]
lea edi, [esp + 0x410]
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsSecondary_Server
mov edx, 0x80000002
mov dword [esp + 0x2c], 0x400
call fcn.0094c020
mov eax, dword [0xbde56c]
mov dword [esp + 0xe14], eax
xor eax, eax
jmp 0xa56c30
mov cl, byte [esp + eax + 0x137c]
mov byte [esp + eax + 0x80c], cl
inc eax
test cl, cl
jne 0xa56c30
test ebx, ebx
je 0xa56c7c
cmp byte [ebx], cl
je 0xa56c73
push 0x400
lea ecx, [esp + 0xa18]
push ebx
push ecx
call fcn.00a7a620
add esp, 0xc
cmp byte [esp + 0xe13], 0
je 0xa56c73
mov byte [esp + 0xe14], 0
push ebx
call fcn.00a78fec
add esp, 4
lea ecx, [esp + 0x2c]
call fcn.0097f8c0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1ed0], 0xffffffff
call fcn.0097f840
lea edx, [esp + 0xf24]
push edx
lea eax, [esp + 0x1030]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x102c]
call fcn.00960910
push 0xaabc14
lea ecx, [esp + 0x1030]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea esi, [esp + 0xc4]
lea ecx, [esp + 0x102c]
lea edi, [ebx + 1]
call fcn.0094df40
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0xa56edf
test edi, edi
je 0xa56ed4
test byte [esp + 0xc4], 0x10
je 0xa56ebd
lea edx, [esp + 0xf0]
push 0xaacda4
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0xa56ebd
lea eax, [esp + 0xf0]
push 0xaacda8
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0xa56ebd
lea ecx, [esp + 0xf0]
push str.localhost
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0xa56ebd
mov eax, str.127.0.0.
lea ecx, [esp + 0xf0]
call fcn.0094c3e0
test eax, eax
je 0xa56ebd
lea edx, [esp + 0xf24]
push edx
lea eax, [esp + 0x1030]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x102c]
call fcn.00960910
lea ecx, [esp + 0xf0]
push ecx
lea edx, [esp + 0x1030]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp + 8], 2
jne 0xa56ebc
mov dword [esp + 0xe18], 0
xor eax, eax
jmp 0xa56dd0
mov cl, byte [esp + eax + 0xf0]
mov byte [esp + eax + 0x204], cl
inc eax
test cl, cl
jne 0xa56dd0
lea eax, [esp + 0x204]
push eax
push 0
push 0xa56240
inc ebx
call fcn.00a791b2
add esp, 0xc
cmp eax, 0xffffffff
je 0xa56ebd
push 0xbded94
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [esp + 0xe18], 0
jne 0xa56e34
lea esp, [esp]
mov esi, 5
call fcn.0094d160
cmp dword [esp + 0xe18], 0
je 0xa56e20
mov ecx, dword [0xbded94]
cmp ecx, 0x40
jl 0xa56ebd
cmp dword [0xbde56c], 0
je 0xa56e5e
mov edx, dword [0xbded94]
push edx
push str._MMC__DFAS__DFASThreadCount:_u._Will_wait_for_it_to_get_less_than_32...
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [0xbded94]
cmp eax, 0x20
jl 0xa56e86
jmp 0xa56e70
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0xbded94]
cmp ecx, 0x20
jge 0xa56e70
cmp dword [0xbde56c], 0
je 0xa56ebd
mov edx, dword [0xbded94]
push edx
push str._MMC__DFAS__DFASThreadCount_Now:_u._Continuing...
push 0
call fcn.0096a780
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea esi, [esp + 0xc4]
call fcn.0094e160
mov edi, eax
jmp 0xa56cf3
inc ebx
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0xc4]
call fcn.0094e160
mov edi, eax
jmp 0xa56cf3
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea ecx, [esp + 0x1998]
push str._DFAS__Secondary_Server_Client_Count:__u
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [esp + 0x199c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, ebx
mov ecx, dword [esp + 0x1ec8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1eb0]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret