Function at 0x403c40
Capabilities:
Move file
Read .ini file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52839d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x4a5c
call fcn.00504d20
mov eax, dword [0x573790]
xor eax, esp
mov dword [esp + 0x4a58], eax
push ebx
push esi
push edi
mov eax, dword [0x573790]
xor eax, esp
push eax
lea eax, [esp + 0x4a70]
mov dword fs:[0], eax
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push str.3CCollection
xor ebx, ebx
push ebx
call edi
push eax
call fcn.0041188e
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
cmp eax, ebx
je 0x403cbc
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x10
push eax
call esi
push str.Kill_3CCollection
call fcn.004012b0
add esp, 4
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call edi
push eax
call fcn.0041188e
cmp eax, ebx
je 0x403ce5
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x10
push eax
call esi
push str.Kill_Microsoft_Visual_C_Runtime_Library
call fcn.004012b0
add esp, 4
push str.vshttpserver
push ebx
call edi
push eax
call fcn.0041188e
cmp eax, ebx
je 0x403d0e
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x10
push eax
call esi
push str.Kill_vshttpserver
call fcn.004012b0
add esp, 4
push 0x5540a4
push ebx
call edi
push eax
call fcn.0041188e
cmp eax, ebx
je 0x403d37
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x10
push eax
call esi
push str.Kill_C3
call fcn.004012b0
add esp, 4
push 0x5540c8
push ebx
call edi
push eax
call fcn.0041188e
cmp eax, ebx
je 0x403d60
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x10
push eax
call esi
push str.Kill_web
call fcn.004012b0
add esp, 4
push 0x553a98
push str.tasklist
mov edi, 0x10
call fcn.0050042d
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x403dae
push 0x4710
lea eax, [esp + 0x358]
push ebx
push eax
call fcn.005023a0
push esi
push 0x470f
lea ecx, [esp + 0x368]
push 1
push ecx
call fcn.00500c0a
push esi
call fcn.005008f5
add esp, 0x20
lea edx, [esp + 0x354]
push 0x5540e4
push edx
call fcn.0040a520
or esi, 0xffffffff
add esp, 8
cmp eax, esi
jne 0x403e1a
push 0x5540f8
call fcn.004012b0
lea eax, [esp + 0x50]
push str.C3UpdateClient.exe
push eax
call fcn.00407a90
add esp, 0xc
mov dword [esp + 0x4a78], ebx
mov ecx, dword [esp + 0x4c]
cmp dword [esp + 0x60], edi
jae 0x403dfb
lea ecx, [esp + 0x4c]
call fcn.00401c00
mov dword [esp + 0x4a78], esi
cmp dword [esp + 0x60], edi
jb 0x403e1a
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0040c4d4
add esp, 4
lea edx, [esp + 0x354]
push 0x554120
push edx
call fcn.0040a520
add esp, 8
cmp eax, esi
jne 0x403e87
push 0x554130
call fcn.004012b0
lea eax, [esp + 0x50]
push str.BoardCtrl.exe
push eax
call fcn.00407a90
add esp, 0xc
mov dword [esp + 0x4a78], 1
mov ecx, dword [esp + 0x4c]
cmp dword [esp + 0x60], edi
jae 0x403e68
lea ecx, [esp + 0x4c]
call fcn.00401c00
mov dword [esp + 0x4a78], esi
cmp dword [esp + 0x60], edi
jb 0x403e87
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0040c4d4
add esp, 4
lea edx, [esp + 0x354]
push str.vshttpserver.exe
push edx
call fcn.0040a520
add esp, 8
mov edi, 0xf
cmp eax, 0xffffffff
jne 0x40402e
cmp dword [0x574ab4], 0x10
mov eax, dword [0x574aa0]
mov byte [esp + 0x14], bl
mov dword [esp + 0x15], ebx
mov dword [esp + 0x19], ebx
mov dword [esp + 0x1d], ebx
mov dword [esp + 0x21], ebx
mov word [esp + 0x25], bx
mov byte [esp + 0x27], bl
jae 0x403eda
mov eax, 0x574aa0
push eax
push 0x14
lea eax, [esp + 0x1c]
push eax
push str.127.0.0.1
push 0x554180
push 0x554184
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x14]
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403f10
sub eax, esi
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00408e80
lea edx, [esp + 0x68]
push edx
lea edx, [esp + 0x34]
mov dword [esp + 0x4a7c], 2
call fcn.0040a420
mov esi, eax
lea eax, [esp + 0x50]
push str._vshttpserver.exe_80
push eax
mov byte [esp + 0x4a84], 3
call fcn.00407a90
mov ecx, eax
lea edx, [esp + 0xcc]
push edx
mov eax, esi
mov byte [esp + 0x4a88], 4
call fcn.00407ba0
add esp, 0x10
cmp dword [esp + 0x60], 0x10
jb 0x403f8a
mov eax, dword [esp + 0x4c]
push eax
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov esi, 0x10
cmp dword [esp + 0x7c], esi
jb 0x403fae
mov ecx, dword [esp + 0x68]
push ecx
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
mov byte [esp + 0x4a78], 8
cmp dword [esp + 0x44], esi
jb 0x403fd5
mov edx, dword [esp + 0x30]
push edx
call fcn.0040c4d4
add esp, 4
push 0x5541a0
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.004012b0
mov ecx, dword [esp + 0xc4]
add esp, 4
cmp dword [esp + 0xd4], esi
jae 0x404005
lea ecx, [esp + 0xc0]
call fcn.00401c00
mov dword [esp + 0x4a78], 0xffffffff
cmp dword [esp + 0xd4], esi
jb 0x40402e
mov eax, dword [esp + 0xc0]
push eax
call fcn.0040c4d4
add esp, 4
lea ecx, [esp + 0x354]
push str.vsftpserver.exe
push ecx
call fcn.0040a520
add esp, 8
cmp eax, 0xffffffff
jne 0x4043b9
lea edx, [esp + 0xa4]
push str.password
push edx
call fcn.00407a90
add esp, 8
mov dword [esp + 0x4a78], 9
cmp dword [esp + 0xb8], 0x10
mov eax, dword [esp + 0xa4]
jae 0x404084
lea eax, [esp + 0xa4]
push 0x553a98
push eax
call fcn.004ff91f
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x404394
push 0xff
lea eax, [esp + 0x258]
push ebx
push eax
call fcn.005023a0
push esi
push 0xff
lea ecx, [esp + 0x268]
push 1
push ecx
call fcn.00500c0a
add esp, 0x1c
cmp eax, ebx
jle 0x404394
cmp dword [0x574ab4], 0x10
mov eax, dword [0x574aa0]
mov byte [esp + 0x14], bl
mov dword [esp + 0x15], ebx
mov dword [esp + 0x19], ebx
mov dword [esp + 0x1d], ebx
mov dword [esp + 0x21], ebx
mov word [esp + 0x25], bx
mov byte [esp + 0x27], bl
jae 0x4040ff
mov eax, 0x574aa0
push eax
push 0x14
lea edx, [esp + 0x1c]
push edx
push str.127.0.0.1
push 0x554180
push 0x554184
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0xf
lea eax, [esp + 0x14]
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404134
sub eax, esi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x70]
call fcn.00408e80
mov byte [esp + 0x4a78], 0xa
lea eax, [esp + 0x254]
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404170
sub eax, esi
push eax
lea ecx, [esp + 0x258]
push ecx
lea ecx, [esp + 0x38]
call fcn.00408e80
lea edx, [esp + 0x114]
push edx
lea edx, [esp + 0x6c]
mov byte [esp + 0x4a7c], 0xb
call fcn.0040a420
mov esi, eax
lea eax, [esp + 0x134]
push eax
lea edx, [esp + 0x38]
mov byte [esp + 0x4a80], 0xc
call fcn.0040a420
mov edi, eax
lea ecx, [esp + 0x100]
push str._vsftpserver.exe_5000
push ecx
mov byte [esp + 0x4a88], 0xd
call fcn.00407a90
mov ecx, eax
lea edx, [esp + 0x5c]
push edx
mov eax, edi
mov byte [esp + 0x4a8c], 0xe
call fcn.00407ba0
push eax
mov eax, 0x5541c8
lea ecx, [esp + 0xd8]
mov byte [esp + 0x4a90], 0xf
call fcn.00407c20
mov ecx, eax
lea eax, [esp + 0x9c]
push eax
mov eax, esi
mov byte [esp + 0x4a94], 0x10
call fcn.00407ba0
add esp, 0x1c
cmp dword [esp + 0xd4], 0x10
jb 0x404241
mov ecx, dword [esp + 0xc0]
push ecx
call fcn.0040c4d4
add esp, 4
mov esi, 0xf
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
mov edi, 0x10
cmp dword [esp + 0x60], edi
jb 0x404273
mov edx, dword [esp + 0x4c]
push edx
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
cmp dword [esp + 0x10c], edi
jb 0x404298
mov eax, dword [esp + 0xf8]
push eax
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
cmp dword [esp + 0x144], edi
jb 0x4042c6
mov ecx, dword [esp + 0x130]
push ecx
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x144], esi
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
cmp dword [esp + 0x128], edi
jb 0x4042f4
mov edx, dword [esp + 0x114]
push edx
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x128], esi
mov dword [esp + 0x124], ebx
mov byte [esp + 0x114], bl
cmp dword [esp + 0x44], edi
jb 0x40431c
mov eax, dword [esp + 0x30]
push eax
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x4a78], 0x18
cmp dword [esp + 0x7c], edi
jb 0x404343
mov ecx, dword [esp + 0x68]
push ecx
call fcn.0040c4d4
add esp, 4
push 0x5541e4
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x6c], bl
call fcn.004012b0
mov ecx, dword [esp + 0x88]
add esp, 4
cmp dword [esp + 0x98], edi
jae 0x404376
lea ecx, [esp + 0x84]
call fcn.00401c00
cmp dword [esp + 0x98], edi
jb 0x404394
mov edx, dword [esp + 0x84]
push edx
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x4a78], 0xffffffff
cmp dword [esp + 0xb8], 0x10
jb 0x4043b9
mov eax, dword [esp + 0xa4]
push eax
call fcn.0040c4d4
add esp, 4
lea ecx, [esp + 0x354]
push 0x5541f4
push ecx
call fcn.0040a520
add esp, 8
cmp eax, 0xffffffff
jne 0x404652
push 0x55420c
call fcn.004012b0
add esp, 4
push 0xa
push str._echo_off_n
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.00408e80
lea edx, [esp + 0x84]
push edx
mov dword [esp + 0x4a7c], 0x19
call fcn.00407c70
push eax
mov eax, 0x553730
lea ecx, [esp + 0xac]
mov byte [esp + 0x4a80], 0x1a
call fcn.00407c20
add esp, 8
push ebx
push eax
or eax, 0xffffffff
lea esi, [esp + 0x38]
mov byte [esp + 0x4a80], 0x1b
call fcn.00407810
mov edi, 0x10
cmp dword [esp + 0xb8], edi
jb 0x40446d
mov eax, dword [esp + 0xa4]
push eax
call fcn.0040c4d4
add esp, 4
mov byte [esp + 0x4a78], 0x19
mov dword [esp + 0xb8], 0xf
mov dword [esp + 0xb4], ebx
mov byte [esp + 0xa4], bl
cmp dword [esp + 0x98], edi
jb 0x4044a7
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0040c4d4
add esp, 4
push 1
lea edx, [esp + 0x14]
push edx
push 0x574a84
xor eax, eax
mov byte [esp + 0x1c], 0x3a
call fcn.00407630
inc eax
push eax
xor ecx, ecx
lea esi, [esp + 0xa8]
mov edx, 0x574a84
call fcn.004072f0
push eax
mov eax, 0x553730
lea ecx, [esp + 0x50]
mov byte [esp + 0x4a7c], 0x1c
call fcn.00407c20
add esp, 4
mov byte [esp + 0x4a78], 0x1e
cmp dword [esp + 0xb8], edi
jb 0x40450f
mov eax, dword [esp + 0xa4]
push eax
call fcn.0040c4d4
add esp, 4
push ebx
lea ecx, [esp + 0x50]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x38]
mov dword [esp + 0xc0], 0xf
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
call fcn.00407810
lea edx, [esp + 0x68]
push str.3GFileSystemClient.exe
push edx
call fcn.00407a90
add esp, 8
push ebx
lea eax, [esp + 0x6c]
push eax
or eax, 0xffffffff
mov byte [esp + 0x4a80], 0x1f
call fcn.00407810
lea ecx, [esp + 0x14]
push str._tmp.bat
push ecx
call fcn.00407a90
add esp, 8
mov byte [esp + 0x4a78], 0x20
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x40458a
lea eax, [esp + 0x14]
push 0x554254
push eax
call fcn.004ff91f
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x44], edi
jae 0x4045a8
lea eax, [esp + 0x30]
push eax
push 0x553734
push esi
call fcn.0050010e
push esi
call fcn.004ffb74
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp dword [esp + 0x28], edi
jae 0x4045cb
lea ecx, [esp + 0x14]
call fcn.00401c00
cmp dword [esp + 0x28], edi
jb 0x4045e3
mov edx, dword [esp + 0x14]
push edx
call fcn.0040c4d4
add esp, 4
mov esi, 0xf
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x7c], edi
jb 0x404607
mov eax, dword [esp + 0x68]
push eax
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
cmp dword [esp + 0x60], edi
jb 0x404626
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0040c4d4
add esp, 4
mov dword [esp + 0x4a78], 0xffffffff
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
cmp dword [esp + 0x44], edi
jb 0x404657
mov edx, dword [esp + 0x30]
push edx
call fcn.0040c4d4
add esp, 4
jmp 0x404657
mov edi, 0x10
push 0x12
push 0x5540e4
lea ecx, [esp + 0xe4]
mov dword [esp + 0xf8], 0xf
mov dword [esp + 0xf4], ebx
mov byte [esp + 0xe4], bl
call fcn.00408e80
push 0x103
lea eax, [esp + 0x151]
push ebx
mov dword [esp + 0x4a80], 0x21
push eax
mov byte [esp + 0x158], bl
call fcn.005023a0
mov eax, dword [0x574a84]
add esp, 0xc
cmp dword [0x574a98], edi
jae 0x4046bd
mov eax, 0x574a84
push eax
lea ecx, [esp + 0x150]
push str._sC3UpdateClientC3UpdateClient.exe
push ecx
call fcn.004ff6e3
lea edx, [esp + 0x158]
push ebx
push edx
call fcn.00500da4
add esp, 0x14
cmp eax, 0xffffffff
jne 0x404701
lea eax, [esp + 0x14c]
push 2
push eax
call fcn.00500da4
add esp, 8
cmp eax, 0xffffffff
je 0x4047b0
mov ecx, dword [esp + 0xdc]
cmp dword [esp + 0xf0], edi
jae 0x404718
lea ecx, [esp + 0xdc]
push 1
call fcn.00401f60
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x574a84]
cmp dword [0x574a98], edi
jae 0x40473c
mov eax, 0x574a84
mov dword [esp + 0x90], ebx
mov dword [esp + 0x90], eax
lea eax, [esp + 0x84]
mov ecx, 0x210
lea edx, [esp + 0x14c]
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x94], ebx
push eax
mov dword [esp + 0x88], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov word [esp + 0xa4], bx
mov word [esp + 0x98], cx
mov dword [esp + 0x90], edx
mov dword [esp + 0x8c], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
cmp dword [esp + 0xf0], edi
jb 0x4047c9
mov ecx, dword [esp + 0xdc]
push ecx
call fcn.0040c4d4
add esp, 4
mov ecx, dword [esp + 0x4a70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4a58]
xor ecx, esp
call fcn.004fecc6
mov esp, ebp
pop ebp
ret