Function at 0x401650
Capabilities:
Delete file
Read .ini file
Set file attributes

Disassembly:
sub esp, 0x2a4
push ebx
push ebp
mov ebp, ecx
xor eax, eax
xor ecx, ecx
mov dword [esp + 9], eax
mov dword [esp + 0x15], ecx
push esi
mov word [esp + 0x1d], cx
push edi
xor ebx, ebx
mov word [esp + 0x15], ax
mov byte [esp + 0x23], cl
mov ecx, 0x40
lea edi, [esp + 0xad]
mov byte [esp + 0x17], al
mov byte [esp + 0xac], bl
mov byte [esp + 0x5c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x5d]
xor edx, edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp + 0x2bc]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x44], edx
repne scasb al, byte es:[edi]
mov dword [esp + 0x48], edx
mov dword [esp + 0x30], ebx
not ecx
mov dword [esp + 0x4c], edx
sub edi, ecx
mov dword [esp + 0x50], edx
lea edx, [esp + 0xac]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov byte [esp + 0x10], bl
rep movsb byte es:[edi], byte [esi]
mov edi, str.code.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x1c], bl
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xac]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x69
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x28], esi
jne 0x401b2c
lea ecx, [esp + 0xac]
lea edx, [esp + 0x5c]
push ecx
push 0x40
push edx
push 0x4064a8
push str.code
push str.code
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x5c]
push 1
push eax
call fcn.00403040
add esp, 8
lea ecx, [esp + 0x5c]
push ecx
push str.szAgentID_s_n
call fcn.00402cf0
lea edi, [esp + 0x64]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x48]
mov byte [esp + 0x50], bl
cmp al, bl
je 0x4017ce
lea ecx, [esp + 0x44]
lea edx, [esp + 0x48]
push ecx
push str._08X
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
mov eax, dword [esp + 0x44]
push eax
push str.AgentID0x_lX_n
call fcn.00402cf0
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x64]
add esp, 8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xac]
lea edx, [esp + 0x5c]
push ecx
push 0x3f
push edx
push 0x4064a8
push str.time
push str.code
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x5c]
push 1
push eax
call fcn.00403040
add esp, 8
lea ecx, [esp + 0x5c]
push ecx
push str.time_s_n
call fcn.00402cf0
mov al, byte [esp + 0x64]
add esp, 8
cmp al, bl
je 0x401854
lea edx, [ebp + 0xa4]
lea eax, [esp + 0x5c]
push edx
push 0x4062ac
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [ebp + 0xa4], ebx
jne 0x401866
mov dword [ebp + 0xa4], 0x14
mov ecx, dword [ebp + 0xa4]
push ecx
push str.time_u_min_x__n
call fcn.00402cf0
add esp, 8
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 4
xor eax, eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
call fcn.004033b0
mov ecx, dword [esp + 0x4f]
mov edx, dword [esp + 0x4e]
mov eax, dword [esp + 0x4d]
add esp, 0x10
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x3f]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x42]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x45]
push edx
mov edx, dword [esp + 0x48]
and eax, 0xff
and ecx, 0xff
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
push eax
mov eax, dword [esp + 0x2d]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x33]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x36]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x39]
push edx
mov edx, dword [esp + 0x3c]
and eax, 0xff
and ecx, 0xff
push eax
and edx, 0xff
push ecx
push edx
push str.MAC_02X__02X__02X__02X__02X__02X_IP_u._u._u._u__GateWay_u._u._u._u_n
call fcn.00402cf0
mov al, byte [esp + 0x4c]
add esp, 0x3c
cmp al, bl
jne 0x4019a7
cmp byte [esp + 0x11], bl
jne 0x4019a7
cmp byte [esp + 0x12], bl
jne 0x4019a7
cmp byte [esp + 0x13], bl
jne 0x4019a7
cmp byte [esp + 0x14], bl
jne 0x4019a7
cmp byte [esp + 0x15], bl
jne 0x4019a7
push 0xbb8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
mov eax, esi
dec esi
test eax, eax
jne 0x401893
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x401a1c
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
push edx
push eax
mov dword [esp + 0x28], ecx
call fcn.00403440
mov byte [esp + 0x2a], bl
mov edx, dword [esp + 0x27]
mov byte [esp + 0x2b], bl
mov eax, dword [esp + 0x29]
mov ecx, dword [esp + 0x28]
add esp, 8
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x22]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x25]
push edx
mov edx, dword [esp + 0x28]
and eax, 0xff
and ecx, 0xff
push eax
and edx, 0xff
push ecx
push edx
push str.GateWay_MAC_02X__02X__02X__02X__02X__02X_n
call fcn.00402cf0
add esp, 0x1c
mov ecx, ebp
call fcn.00401590
test eax, eax
jne 0x401b4c
call fcn.00402be0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [ebp + 0xa8], eax
mov eax, dword [ebp + 0xa0]
lea edi, [ebp + 0x3c0]
mov dword [ebp + 0xac], ecx
cmp eax, ebx
mov dword [ebp + 0xb0], edx
push edi
je 0x401a63
push 0x67
jmp 0x401a65
push 0x65
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
jne 0x401e3f
push 3
push 1
push edi
push str.baihan
mov ecx, ebp
call fcn.00401f70
mov esi, eax
cmp esi, ebx
jne 0x401e4b
mov eax, dword [ebp + 0xa0]
cmp eax, ebx
lea eax, [ebp + 0x5c8]
mov dword [esp + 0x2c], eax
push eax
je 0x401aad
push 0x83
jmp 0x401ab2
push 0x82
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
jne 0x401e57
mov eax, dword [ebp + 0xa0]
lea edi, [ebp + 0x4c4]
cmp eax, ebx
push edi
je 0x401adb
push 0x85
jmp 0x401ae0
push 0x84
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
jne 0x401e63
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0xac]
push eax
push edi
push str.__s___s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
push ebx
push ebx
push ebx
lea edx, [esp + 0xc8]
push ebx
push edx
push ebx
call fcn.00403c90
add esp, 0x28
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x102
push esi
call fcn.00402d00
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
push str.Get_old_AgentID..._n
call fcn.00402cf0
add esp, 4
lea eax, [esp + 0xac]
push str.baihan
push str.SYSTEMCurrentControlSet_services_sParameters
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0xb8]
push ecx
push str.CodeID
push edx
push connect
call fcn.00402e50
mov eax, dword [esp + 0x4c]
add esp, 0x1c
push eax
push str.Exist_AgentID0x_lX__n
call fcn.00402cf0
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x38]
add esp, 8
cmp eax, edx
je 0x401f53
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1b1]
mov byte [esp + 0x1b0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp + 0x1b8]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x28], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x2c], 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xac]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401c2c
lea eax, [esp + ecx + 0xab]
mov cl, byte [esp + ecx + 0xab]
cmp cl, 0x5c
jne 0x401c2c
mov byte [eax], bl
lea ecx, [esp + 0xac]
push edx
push ecx
lea edx, [esp + 0x1b8]
push str._s_08X.INI
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.dload_txt_from_driver..._n
call fcn.00402cf0
add esp, 4
lea eax, [esp + 0x1b0]
mov ecx, ebp
push eax
call fcn.00402500
mov esi, eax
cmp esi, ebx
je 0x401cd8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x162
push esi
call fcn.00402d00
add esp, 0xc
push str.dload_txt_of_old_AgentID..._n
call fcn.00402cf0
mov eax, dword [esp + 0x34]
add esp, 4
lea ecx, [esp + 0x1b0]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00402720
mov esi, eax
cmp esi, ebx
je 0x401cd8
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x167
push esi
call fcn.00402d00
mov eax, dword [esp + 0x50]
add esp, 0xc
mov ecx, ebp
push eax
call fcn.00402460
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
lea ecx, [esp + 0x9c]
mov dword [esp + 0x58], ebx
push ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xac]
lea edx, [esp + 0x1b0]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0xb0]
push 0x104
push eax
push 0x4064a8
push str.upDataLoad
push str.switch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401d5d
lea ecx, [esp + 0xac]
push 1
push ecx
call fcn.00403040
add esp, 8
lea edx, [esp + 0x58]
lea eax, [esp + 0xac]
push edx
push 0x40615c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [esp + 0x58], ebx
je 0x401dfb
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xac]
lea edx, [esp + 0xac]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1b0]
push ecx
push 0x104
push edx
push 0x4064a8
push str.Agent
push str.updata
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401dd7
lea eax, [esp + 0xac]
push 1
push eax
call fcn.00403040
add esp, 8
lea ecx, [esp + 0x28]
lea edx, [esp + 0x54]
lea eax, [esp + 0xac]
push ecx
push edx
push str._u__u
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x28]
cmp ecx, ebx
jne 0x401de7
cmp edx, ebx
je 0x401dff
mov eax, dword [esp + 0xa4]
and eax, 0xffff
cmp eax, ecx
jb 0x401dfb
cmp eax, edx
jb 0x401dff
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x1b0]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x2c], ebx
je 0x401b1f
mov eax, dword [esp + 0x44]
mov ecx, ebp
push eax
call fcn.00402460
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1ae
jmp 0x401e6d
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1b6
jmp 0x401e6d
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1d0
jmp 0x401e6d
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1dc
push esi
call fcn.00402d00
add esp, 0xc
cmp eax, ebx
je 0x401b1f
mov eax, dword [esp + 0x37]
mov ecx, 0xa
and eax, 0xff
cdq
idiv ecx
test edx, edx
jne 0x401b1f
mov edx, dword [esp + 0x15]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x13]
and edx, 0xff
push str.15.1.19.1
and eax, 0xff
push edx
mov edx, dword [esp + 0x1a]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x1d]
push ecx
mov ecx, dword [esp + 0x20]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x35]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x3b]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x3e]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x41]
push ecx
mov ecx, dword [esp + 0x44]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x70]
and ecx, 0xff
push eax
push ecx
push edx
lea eax, [esp + 0xe4]
push str.60__08X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X_8_0__s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x40
lea ecx, [esp + 0xac]
push ecx
mov ecx, ebp
call fcn.00402620
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret