Function at 0x404620
Capabilities:
Check if file exists
Check os version
Create process on windows
Create process suspended
Delete file
Enumerate files on windows
Enumerate gui resources
Get common file path
Query environment variable
Read .ini file
Self delete

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x416bdc
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0x814
and eax, 0xff
dec eax
push ebx
push ebp
push esi
cmp eax, 0x8e
push edi
ja case.0x404a05.6
xor ecx, ecx
mov cl, byte [eax + 0x405eac]
jmp dword [ecx*4 + 0x405e84]
mov esi, dword [esp + 0x840]
cmp byte [esi], 1
je 0x404676
mov dword [esi + 0x2c], 0
mov edi, dword [esp + 0x848]
mov edx, dword [esp + 0x838]
push esi
push edi
push 0
push 0
push edx
mov ecx, 0x41c1b0
call dword [sym.imp.RSCLASS.dll_public:_struct__HOSTINFO____thiscall_CHostListing::AutoParseSAP_struct_HWND_____struct_HWND_____unsigned_long_int__struct_sockaddr_in___struct__FORMAT_SAP_T__]
mov ecx, dword [0x41d1a0]
test ecx, ecx
je case.0x404a05.6
mov eax, dword [0x41ceb4]
mov edx, dword [edi + 4]
cmp eax, edx
jne case.0x404a05.6
mov al, byte [esi + 0xc]
test al, 0x82
je 0x4046c9
test byte [esi + 0xd], 1
jne 0x4046c9
test al, 8
jne case.0x404a05.6
mov eax, dword [0x41d198]
test eax, eax
jne case.0x404a05.6
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp case.0x404a05.6
mov ecx, dword [esp + 0x840]
cmp dword [ecx + 0xc], 1
jne case.0x404a05.6
xor edx, edx
mov ecx, dword [esp + 0x848]
mov dword [esp + 0x1c], edx
xor eax, eax
mov dword [esp + 0x20], edx
mov word [esp + 0x1e], ax
mov dword [esp + 0x24], edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x838]
push 1
push eax
mov eax, dword [esp + 0x83c]
mov dword [esp + 0x30], edx
push 0x10
push ecx
lea edx, [esp + 0x2c]
push 0x10
push edx
push eax
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], 0x8f
mov dword [esp + 0x3c], 0x10
mov dword [esp + 0x44], 2
call sub.REDCOMM.dll_Ordinal_34
test eax, eax
jne case.0x404a05.6
xor eax, eax
jmp 0x405e6b
mov esi, dword [esp + 0x840]
or ebx, 0xffffffff
mov eax, dword [esi + 0x10]
test eax, eax
je 0x404784
mov eax, dword [0x41d1a0]
test eax, eax
je 0x404784
cmp dword [esi + 0xc], ebx
jne case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
mov edi, eax
mov eax, dword [esi + 4]
sub eax, 0x24
xor ecx, ecx
shr eax, 2
je 0x4047a7
lea edx, [esi + 0x24]
cmp dword [edx], edi
je 0x4047b0
inc ecx
add edx, 4
cmp ecx, eax
jb 0x40479b
cmp dword [esi + 0xc], edi
jne case.0x404a05.6
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x40481b
cmp eax, edi
je 0x40481b
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne 0x40481b
mov eax, dword [0x41d17c]
mov edi, dword [esp + 0x838]
test eax, eax
je 0x4047e2
push edi
call fcn.00403200
add esp, 4
mov eax, dword [0x41c214]
test eax, eax
je 0x404800
mov eax, dword [0x41c200]
cmp eax, ebx
je 0x404800
push 0x20
push eax
push edi
call fcn.004080b0
add esp, 0xc
mov ecx, dword [esi + 0xc]
mov dword [0x41ceb4], ecx
mov edx, dword [esi + 0x1c]
push edx
push edi
call fcn.0040bd30
add esp, 8
jmp 0x405e6b
mov eax, dword [0x41d1a0]
mov dword [0x41ceb4], ebx
test eax, eax
je 0x404831
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0xc]
cmp eax, edi
jne case.0x404a05.6
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x40484a
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x404885
cmp eax, edi
jne case.0x404a05.6
mov eax, dword [esi + 0x10]
test eax, eax
je case.0x404a05.6
mov eax, dword [esi + 0x18]
test eax, eax
je case.0x404a05.6
mov eax, dword [0x41d17c]
test eax, eax
jne case.0x404a05.6
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov ecx, dword [eax + 0x38]
test ecx, ecx
jne case.0x404a05.6
mov eax, dword [esi + 0x20]
test eax, eax
je 0x404913
cmp eax, 0x64
jne 0x4048b1
push 0
push str.UseJPEGCompression
call sub.REDCOMM.dll_Ordinal_16
push 0
push str.UseConvertTo16bit
call sub.REDCOMM.dll_Ordinal_16
push 0x50
jmp 0x404909
cmp eax, 0x5f
jne 0x4048d2
push 0
push str.UseJPEGCompression
call sub.REDCOMM.dll_Ordinal_16
push 1
push str.UseConvertTo16bit
call sub.REDCOMM.dll_Ordinal_16
push 0x50
jmp 0x404909
push 1
push str.UseJPEGCompression
call sub.REDCOMM.dll_Ordinal_16
push 0
push str.UseConvertTo16bit
call sub.REDCOMM.dll_Ordinal_16
mov eax, dword [esi + 0x20]
cmp eax, 5
jl 0x4048fc
cmp eax, 0x5a
jge 0x404903
cmp eax, 5
jge 0x404908
mov eax, 5
jmp 0x404908
mov eax, 0x5a
push eax
push str.JPEGQuality
call sub.REDCOMM.dll_Ordinal_17
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.0040e6ee
push eax
call fcn.0040e6bf
add esp, 8
call fcn.0040e6cc
and eax, reloc.WS2_32.dll_accept
jns 0x40493c
dec eax
or eax, 0xfffffffe
inc eax
jne 0x404964
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
je 0x404964
mov ecx, dword [esi + 0x14]
mov edx, dword [0x41c1ac]
push ecx
push edx
call fcn.00402fd0
add esp, 8
jmp case.0x404a05.6
mov eax, dword [esi + 0x14]
mov ecx, dword [0x41c1ac]
push eax
push ecx
call fcn.00402fd0
add esp, 8
jmp case.0x404a05.6
mov ebx, dword [esp + 0x840]
cmp dword [ebx + 0xc], 0x200001
je case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
mov ecx, dword [ebx + 0xc]
mov ebp, 0x10000000
cmp ecx, ebp
jae 0x4049cf
mov edx, dword [ebx + 4]
lea edi, [edx - 0x14]
test edi, edi
je 0x4049cf
cmp dword [ebx + 0x10], eax
je 0x4049cf
xor edx, edx
shr edi, 2
je case.0x404a05.6
lea esi, [ebx + 0x14]
cmp dword [esi], eax
je 0x4049cf
inc edx
add esi, 4
cmp edx, edi
jb 0x4049be
jmp case.0x404a05.6
cmp ecx, 0x1001
ja 0x404e29
je 0x404e07
cmp ecx, 0x80
ja 0x404d19
je 0x404cdf
dec ecx
cmp ecx, 0x3f
ja case.0x404a05.6
xor edx, edx
mov dl, byte [ecx + 0x405f54]
jmp dword [edx*4 + 0x405f3c]
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne case.0x404a05.6
mov eax, dword [0x41d17c]
mov esi, dword [esp + 0x838]
test eax, eax
je 0x404a37
push esi
call fcn.00403200
add esp, 4
mov eax, dword [0x41c214]
test eax, eax
je 0x404a56
mov eax, dword [0x41c200]
cmp eax, 0xffffffff
je 0x404a56
push 0x20
push eax
push esi
call fcn.004080b0
add esp, 0xc
mov eax, dword [0x41d1a0]
mov dword [0x41ceb4], 0xffffffff
test eax, eax
je 0x404a70
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x404a8b
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov ecx, dword [eax]
push ecx
push 6
call sub.REDCOMM.dll_Ordinal_59
jmp case.0x404a05.6
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov eax, dword [edx]
push eax
push 2
call sub.REDCOMM.dll_Ordinal_59
jmp case.0x404a05.6
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne case.0x404a05.6
mov eax, dword [0x41d17c]
mov esi, dword [esp + 0x838]
test eax, eax
je 0x404acb
push esi
call fcn.00403200
add esp, 4
mov eax, dword [0x41c214]
test eax, eax
je 0x404aea
mov eax, dword [0x41c200]
cmp eax, 0xffffffff
je 0x404aea
push 0x20
push eax
push esi
call fcn.004080b0
add esp, 0xc
mov eax, dword [0x41d1a0]
mov dword [0x41ceb4], 0xffffffff
test eax, eax
je 0x404b04
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [esp + 0x3dc]
mov dword [esp + 0x3dc], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x3ec], 2
jne 0x404b38
cmp dword [esp + 0x3e0], 5
jb 0x404b38
mov eax, 1
jmp 0x404b3a
xor eax, eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
test ecx, ecx
mov ecx, dword [edx]
push ecx
je 0x404b5f
neg eax
sbb eax, eax
and eax, 7
add eax, 5
push eax
call sub.REDCOMM.dll_Ordinal_59
jmp case.0x404a05.6
neg eax
sbb eax, eax
and eax, 7
inc eax
push eax
call sub.REDCOMM.dll_Ordinal_59
jmp case.0x404a05.6
mov edx, dword [0x41c1ac]
mov dword [0x41d250], 0
push edx
call fcn.00402950
mov eax, dword [0x41c1ac]
push 1
push 0x41d168
push eax
call fcn.00402ce0
add esp, 0x10
jmp case.0x404a05.6
mov ecx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov eax, dword [ecx + 0x34]
test eax, eax
je case.0x404a05.6
push 0
push 0x3ed
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x404a05.6
mov eax, dword [0x41d218]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x404bfe
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push str.VCLIENT.DLL
call esi
push eax
push str.RS_VIDEOOWNER
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [0x41d218], 0
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x404c1f
push 0
push str.vcd_NoDaemonPlaying
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
je case.0x404a05.6
push str.VCLIENT.DLL
call esi
mov esi, eax
test esi, esi
jne 0x404ca7
mov ecx, dword [0x41c1f0]
lea eax, [esp + 0x50]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x404c5f
lea edx, [esp + 0x50]
push 0x5c
push edx
call fcn.0040e650
add esp, 8
mov edx, eax
mov edi, str.VClient.dll
jmp 0x404c68
lea edx, [esp + 0x50]
mov edi, str.C:VClient.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x404ca7
lea edx, [esp + 0x50]
push edx
push eax
push eax
call sub.REDCOMM.dll_Ordinal_22
jmp case.0x404a05.6
push str.FUN_OpenDlgVClientPlayer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x404ccf
push str.FUN_OpenDlgVClientPlayer
push eax
push eax
call sub.REDCOMM.dll_Ordinal_22
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x404a05.6
mov ecx, dword [ebx + 0x10]
push ecx
call eax
mov dword [0x41d218], eax
jmp case.0x404a05.6
mov eax, dword [0x41d218]
test eax, eax
je case.0x404a05.6
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push str.VCLIENT.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push str.RS_VIDEOOWNER
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [0x41d218], 0
jmp case.0x404a05.6
cmp ecx, 0x400
ja 0x404dec
je 0x404dd3
cmp ecx, 0x100
je 0x404d62
cmp ecx, 0x200
jne case.0x404a05.6
mov eax, dword [0x41d1a0]
mov dword [0x41ceb4], 0xffffffff
test eax, eax
je case.0x404a05.6
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp case.0x404a05.6
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne case.0x404a05.6
mov eax, dword [0x41d1a0]
test eax, eax
jne case.0x404a05.6
mov eax, dword [0x41d17c]
mov esi, dword [esp + 0x838]
test eax, eax
je 0x404d9a
push esi
call fcn.00403200
add esp, 4
mov eax, dword [0x41c214]
test eax, eax
je 0x404db9
mov eax, dword [0x41c200]
cmp eax, 0xffffffff
je 0x404db9
push 0x20
push eax
push esi
call fcn.004080b0
add esp, 0xc
push 1
push esi
mov dword [0x41ceb4], 0xffffffff
call fcn.0040bd30
add esp, 8
jmp 0x405e6b
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
mov dword [0x41d258], 1
jmp case.0x404a05.6
cmp ecx, 0x800
jne case.0x404a05.6
mov dword [0x41d258], 0
jmp case.0x404a05.6
mov eax, dword [0x41d17c]
test eax, eax
je case.0x404a05.6
mov edx, dword [esp + 0x838]
push edx
call fcn.00403200
add esp, 4
jmp case.0x404a05.6
cmp ecx, 0x200000
ja 0x405624
je 0x4055e2
cmp ecx, 0x10001
ja 0x4050bb
je 0x405098
sub ecx, 0x4000
je 0x405020
dec ecx
jne case.0x404a05.6
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne case.0x404a05.6
mov ecx, dword [0x41c1f0]
lea eax, [esp + 0x50]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x404ea3
push str.Data.
lea edx, [esp + 0x54]
push 0x5c
push edx
call fcn.0040e650
add esp, 8
jmp 0x404eac
push str.C:Data.
lea eax, [esp + 0x54]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x50]
push ecx
call esi
push str.Data.
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea edx, [esp + 0x29c]
lea eax, [esp + 0x50]
push edx
push eax
call ebp
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je case.0x404a05.6
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x404ef9
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
test byte [esp + 0x29c], 0x10
je 0x404ff5
lea ecx, [esp + 0x2c8]
push ecx
call esi
cmp eax, 8
jne 0x404ff5
xor esi, esi
movsx edx, byte [esp + esi + 0x2c8]
push edx
call fcn.0040ee36
add esp, 4
test eax, eax
je 0x405010
inc esi
cmp esi, 8
jl 0x404f1c
lea eax, [esp + 0x50]
lea ecx, [esp + 0x198]
push eax
push ecx
call edi
lea edx, [esp + 0x2c8]
lea eax, [esp + 0x198]
push edx
push 0x5c
push eax
call fcn.0040e650
add esp, 8
inc eax
push eax
call edi
lea ecx, [esp + 0x198]
push str..rep
push ecx
call ebx
lea edx, [esp + 0x4dc]
lea eax, [esp + 0x198]
push edx
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x404ff5
test byte [esp + 0x4dc], 0x10
jne 0x404fdb
lea ecx, [esp + 0x508]
lea edx, [esp + 0x198]
push ecx
push 0x5c
push edx
call fcn.0040e650
add esp, 8
inc eax
push eax
call edi
push 0
lea eax, [esp + 0x19c]
push 0
push eax
call sub.REDCOMM.dll_Ordinal_19
test eax, eax
je 0x404fdb
lea ecx, [esp + 0x198]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x4dc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404f90
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x29c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404ef3
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x404a05.6
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne case.0x404a05.6
lea eax, [esp + 0x50]
push 0x104
push eax
push 0
call sub.REDCOMM.dll_Ordinal_165
test eax, eax
je 0x405051
lea ecx, [esp + 0x50]
push ecx
call sub.REDCOMM.dll_Ordinal_124
lea edx, [esp + 0x50]
push 0x104
push edx
push 1
call sub.REDCOMM.dll_Ordinal_165
test eax, eax
je 0x405070
lea eax, [esp + 0x50]
push eax
call sub.REDCOMM.dll_Ordinal_124
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 2
call sub.REDCOMM.dll_Ordinal_165
test eax, eax
je case.0x404a05.6
lea edx, [esp + 0x50]
push edx
call sub.REDCOMM.dll_Ordinal_124
jmp case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
cmp dword [ebx + 0x10], eax
jne 0x4050a9
xor eax, eax
jmp 0x405e6b
push 0
push 0x403f10
call dword [sym.imp.USER32.dll_EnumWindows]
jmp case.0x404a05.6
sub ecx, 0x100000
je 0x405377
dec ecx
jne case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
cmp dword [ebx + 0x10], eax
jne 0x4050df
xor eax, eax
jmp 0x405e6b
push 0
push str.Manager_Installed
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x40475a
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne 0x40475a
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
call sub.REDCOMM.dll_Ordinal_106
push eax
call fcn.00404050
test eax, eax
jne 0x40475a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40475a
mov edx, dword [0x41c1f0]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x198]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x198]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x405176
lea eax, [esp + 0x198]
push 0x5c
push eax
call fcn.0040e650
add esp, 8
mov edx, eax
mov edi, str.DATA
jmp 0x405182
lea edx, [esp + 0x198]
mov edi, 0x41a6ac
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.WebCtrl.ini
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x19c]
push ecx
call esi
push 0
push 0x80
push 2
push 0
push 1
lea edx, [esp + 0x1ac]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4051e0
xor eax, eax
jmp 0x405e6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29c]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x4dc]
rep stosd dword es:[edi], eax
call sub.REDCOMM.dll_Ordinal_106
mov edi, dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call edi
push eax
lea eax, [esp + 0x2a0]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x4dc]
push eax
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esp + 0x198]
lea ecx, [esp + 0x29c]
push eax
push ecx
push str.LocalIPAddress
push str.Header
call edi
test eax, eax
je 0x405e6b
lea edx, [esp + 0x198]
lea eax, [esp + 0x4dc]
push edx
push eax
push str.GatewayAddress
push str.Header
call edi
test eax, eax
je 0x405e6b
lea ecx, [esp + 0x198]
push ecx
push 0x41a698
push str.DisableGateWay
push str.Header
call edi
test eax, eax
je 0x405e6b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3dc]
lea edx, [esp + 0x3dc]
push str.delete_0.0.0.0_mask_0.0.0.0
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x4dc]
lea ecx, [esp + 0x3dc]
push eax
push ecx
call esi
mov edx, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov eax, dword [edx + 4]
push 0x104
test ebp, eax
je 0x405335
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je case.0x404a05.6
lea ecx, [esp + 0x50]
push str._route.exe
push ecx
call esi
push 0
lea edx, [esp + 0x3e0]
push 0
lea eax, [esp + 0x58]
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x404a05.6
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je case.0x404a05.6
lea edx, [esp + 0x50]
push str._route.exe
push edx
call esi
push 0
lea eax, [esp + 0x3e0]
push 0
lea ecx, [esp + 0x58]
push eax
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
cmp dword [ebx + 0x10], eax
jne 0x405388
xor eax, eax
jmp 0x405e6b
push 0
push str.Manager_Installed
call sub.REDCOMM.dll_Ordinal_27
test eax, eax
jne 0x40475a
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
jne 0x40475a
mov ecx, 0x41
lea edi, [esp + 0x198]
rep stosd dword es:[edi], eax
mov eax, dword [0x41c1f0]
lea edx, [esp + 0x198]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4053f4
lea ecx, [esp + 0x198]
push 0x5c
push ecx
call fcn.0040e650
add esp, 8
mov edx, eax
mov edi, str.DATA
jmp 0x405400
lea edx, [esp + 0x198]
mov edi, 0x41a6ac
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, ecx
mov esi, edi
mov edi, edx
push str.WebCtrl.ini
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x19c]
push ecx
call ebx
push 0
push 0x80
push 3
push 0
push 1
lea edx, [esp + 0x1ac]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40545e
xor eax, eax
jmp 0x405e6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x4dc]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x198]
lea ecx, [esp + 0x4dc]
push eax
push 0x100
push ecx
push 0x41a698
push str.DisableGateWay
push str.Header
call esi
mov al, byte [esp + 0x4dc]
xor ecx, ecx
test al, al
lea edx, [esp + 0x4dc]
je 0x4054d2
cmp al, 0x30
jl 0x4054ce
cmp al, 0x39
jg 0x4054ce
movsx eax, al
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [eax + ecx*2 - 0x30]
mov al, byte [edx]
test al, al
jne 0x4054b5
test ecx, ecx
jne 0x4054d9
xor eax, eax
jmp 0x405e6b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29c]
lea edx, [esp + 0x29c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x198]
push ecx
push 0x100
push edx
push 0x41d29c
push str.GatewayAddress
push str.Header
call esi
test eax, eax
je 0x405e6b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3dc]
push str.add_0.0.0.0_mask_0.0.0.0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x29c]
lea edx, [esp + 0x3dc]
push ecx
push edx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x50]
push 0x104
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.RSCLASS.dll_struct__ENVVAR_gEnvVar]
test dword [eax + 4], ebp
je 0x405596
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4055cf
lea edx, [esp + 0x50]
push str._route.exe
push edx
call ebx
push 0
lea eax, [esp + 0x3e0]
push 0
lea ecx, [esp + 0x58]
push eax
push ecx
jmp 0x4055c2
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4055cf
lea eax, [esp + 0x50]
push str._route.exe
push eax
call ebx
push 0
lea ecx, [esp + 0x3e0]
push 0
lea edx, [esp + 0x58]
push ecx
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
cmp dword [ebx + 0x10], eax
jne 0x4055f3
xor eax, eax
jmp 0x405e6b
push str.RSpider.exe
call sub.REDCOMM.dll_Ordinal_121
test eax, eax
je 0x405608
xor eax, eax
jmp 0x405e6b
mov eax, dword [0x41d268]
test eax, eax
jne case.0x404a05.6
push 0
call fcn.00402670
add esp, 4
jmp case.0x404a05.6
cmp ecx, 0x10000001
ja 0x405aaf
je 0x405668
sub ecx, 0x200002
je 0x405643
sub ecx, 2
jne case.0x404a05.6
mov eax, dword [0x41d268]
test eax, eax
je case.0x404a05.6
push 0
push 0x3ed
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x404a05.6
mov eax, dword [0x41a340]
test eax, eax
je case.0x404a05.6
mov edi, dword [esp + 0x840]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x198]
lea ebp, [edi + 0x24]
push ebp
push ecx
call ebx
lea esi, [edi + 0x14]
push str.open
push esi
mov dword [esp + 0x20], esi
call fcn.0040ed02
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4056c9
push str.print
push esi
call fcn.0040ed02
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4056e2
lea edx, [esp + 0x198]
push 0x5c
push edx
call fcn.0040e650
add esp, 8
test eax, eax
je 0x4056e2
mov byte [eax], 0
push str.open
push esi
mov dword [esp + 0x1c], 0
call fcn.0040ed02
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405a85
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x405a85
push 0x41a73c
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405a85
lea ecx, [esp + 0x30]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::constructor_void_]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x82c], 0
test eax, eax
je 0x405a59
xor ecx, ecx
mov edx, dword [esp + 0x840]
mov dword [esp + 0x1c], ecx
xor eax, eax
mov dword [esp + 0x20], ecx
lea edi, [esp + 0x154]
mov dword [esp + 0x24], ecx
push 0x41a13c
mov dword [esp + 0x2c], ecx
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x20]
lea ecx, [esp + 0x620]
neg eax
sbb eax, eax
push ecx
and eax, 2
mov dword [esp + 0x15c], 0x44
inc eax
mov dword [esp + 0x188], 1
mov word [esp + 0x18c], ax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x61c]
push ebp
push edx
call esi
lea eax, [esp + 0x61c]
push 0x41a738
push eax
call esi
mov ecx, dword [esp + 0x840]
lea edx, [esp + 0x61c]
lea eax, [ecx + 0x128]
push eax
push edx
call esi
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x154]
push eax
mov eax, dword [esp + 0x50]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x638]
push 0
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x405a51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405845
push eax
push str.CMD_RUN_APPS.CreateProcessAsUser
push 1
push 0
call sub.REDCOMM.dll_Ordinal_40
jmp 0x405a59
push 0x5c
push ebp
call fcn.0040e650
add esp, 8
test eax, eax
jne 0x405a59
mov ecx, 0x41
lea edi, [esp + 0x29c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4dc]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
push ecx
mov dword [esp + 0x34], 0x104
call ebx
lea edx, [esp + 0x4dc]
push ebp
push edx
call esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x29c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x4e8]
push str.Path
push eax
push reloc.REDHOOKS.dll_Ordinal_2
call sub.REDCOMM.dll_Ordinal_141
test eax, eax
je 0x405953
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x29c]
push ecx
call edi
test eax, eax
jle 0x405959
cmp dword [esp + 0x10], 2
jne 0x405912
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x50]
lea edx, [esp + 0x50]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x2a0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [esp + 0x50]
lea edx, [esp + 0x29c]
push ecx
push edx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x29c]
push eax
call edi
test eax, eax
jle 0x405943
lea ecx, [esp + 0x29c]
push ecx
call edi
cmp byte [esp + eax + 0x29b], 0x5c
je 0x405943
lea edx, [esp + 0x29c]
push 0x41a6d0
push edx
call esi
lea eax, [esp + 0x29c]
push ebp
push eax
call esi
jmp 0x4059d7
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x29c]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x4e8]
push 0x41d29c
push ecx
push reloc.REDHOOKS.dll_Ordinal_2
call sub.REDCOMM.dll_Ordinal_141
test eax, eax
je 0x405a59
lea edx, [esp + 0x29c]
push edx
call edi
test eax, eax
jle 0x405a59
cmp dword [esp + 0x10], 2
jne 0x4059d7
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x50]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
lea ecx, [esp + 0x2a0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x50]
lea eax, [esp + 0x29c]
push edx
push eax
call ebx
lea ecx, [esp + 0x61c]
push 0x41a13c
push ecx
call ebx
lea edx, [esp + 0x29c]
lea eax, [esp + 0x61c]
push edx
push eax
call esi
lea ecx, [esp + 0x61c]
push 0x41a738
push ecx
call esi
mov edx, dword [esp + 0x840]
lea eax, [edx + 0x128]
push eax
lea eax, [esp + 0x620]
push eax
call esi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x154]
push ecx
mov ecx, dword [esp + 0x50]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x638]
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x405a59
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x30]
mov dword [esp + 0x82c], 0xffffffff
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::destructor_void_]
mov eax, dword [esp + 0x14]
test eax, eax
jne case.0x404a05.6
mov edi, dword [esp + 0x840]
mov esi, dword [esp + 0x18]
mov edx, dword [edi + 0x20]
lea eax, [esp + 0x198]
neg edx
sbb edx, edx
add edi, 0x128
and edx, 2
inc edx
push edx
push eax
push edi
push ebp
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x404a05.6
cmp ecx, 0x10000002
jne case.0x404a05.6
mov eax, dword [0x41a340]
test eax, eax
je case.0x404a05.6
add ebx, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_SetSystemTime]
jmp case.0x404a05.6
mov eax, dword [0x41a340]
test eax, eax
je case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
mov ebp, dword [esp + 0x840]
mov esi, eax
lea ecx, [ebp + 0xe]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp esi, eax
je case.0x404a05.6
mov eax, dword [0x41c1f0]
lea edx, [esp + 0x50]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.NETTALK.EXE
lea ecx, [esp + 0x54]
push 0x5c
push ecx
call fcn.0040e650
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 8
push eax
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x198]
lea edx, [esp + 0x50]
push 0x5c
push edx
rep stosd dword es:[edi], eax
call fcn.0040e650
mov ecx, eax
lea eax, [esp + 0x58]
sub ecx, eax
lea esi, [esp + 0x58]
mov edx, ecx
lea edi, [esp + 0x1a0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add esp, 8
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x30]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::constructor_void_]
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x405c31
xor eax, eax
mov ecx, 0x11
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x154]
mov dword [esp + 0x20], eax
push 0x41a13c
mov dword [esp + 0x28], eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x620]
mov dword [esp + 0x2c], eax
push ecx
mov dword [esp + 0x15c], 0x44
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x50]
lea eax, [esp + 0x61c]
push edx
push eax
call esi
lea ecx, [esp + 0x61c]
push 0x41a738
push ecx
call esi
lea edx, [ebp + 0xc]
lea eax, [esp + 0x61c]
push edx
push eax
call esi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x154]
push ecx
lea eax, [esp + 0x19c]
push edx
mov edx, dword [esp + 0x54]
push eax
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x638]
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x405c57
mov edx, dword [esp + 0x838]
lea eax, [esp + 0x198]
push 1
add ebp, 0xc
push eax
lea ecx, [esp + 0x58]
push ebp
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x30]
call dword [sym.imp.REDCOMM.dll_public:_void___thiscall_CImpersonateLoggedOnUser::destructor_void_]
jmp case.0x404a05.6
call sub.REDCOMM.dll_Ordinal_106
mov edi, dword [esp + 0x840]
xor ebp, ebp
xor ebx, ebx
xor edx, edx
mov ecx, dword [edi + 4]
sub ecx, 0x14
shr ecx, 2
je 0x405c92
lea esi, [edi + 0x14]
cmp dword [esi], eax
je 0x405ca8
inc edx
add esi, 4
cmp edx, ecx
jb 0x405c86
mov esi, 1
cmp ebx, ebp
mov dword [0x41a340], ebx
jne 0x405cb1
mov eax, esi
jmp 0x405e6b
mov esi, 1
mov ebx, esi
jmp 0x405c97
mov eax, dword [edi + 0x10]
dec eax
je 0x405d61
dec eax
je 0x405cc5
mov eax, esi
jmp 0x405e6b
cmp dword [edi + 0xc], esi
jne 0x405d32
lea eax, [esp + 0x18]
push eax
call fcn.0040e6ee
mov eax, dword [0x41d234]
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp eax, ebp
je 0x405d10
mov ebx, dword [0x41d238]
mov edx, ecx
sub edx, ebx
cmp edx, 3
jge 0x405d10
mov ecx, dword [esp + 0x848]
cmp eax, dword [ecx + 4]
je 0x405dee
mov dword [0x41d23c], esi
mov eax, esi
jmp 0x405e6b
mov edx, dword [esp + 0x848]
mov eax, dword [edx + 4]
mov dword [0x41d238], ecx
mov dword [0x41d234], eax
mov dword [0x41d23c], ebp
mov eax, esi
jmp 0x405e6b
mov ecx, dword [esp + 0x848]
mov edx, dword [0x41d234]
cmp edx, dword [ecx + 4]
jne 0x405dee
mov dword [0x41d234], ebp
mov dword [0x41d238], ebp
mov dword [0x41d23c], ebp
mov eax, esi
jmp 0x405e6b
cmp dword [edi + 0xc], esi
jne 0x405dca
lea eax, [esp + 0x18]
push eax
call fcn.0040e6ee
mov eax, dword [0x41d224]
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp eax, ebp
je 0x405da8
mov ebx, dword [0x41d228]
mov edx, ecx
sub edx, ebx
cmp edx, 3
jge 0x405da8
mov ecx, dword [esp + 0x848]
cmp eax, dword [ecx + 4]
je 0x405dee
mov dword [0x41d22c], esi
mov eax, esi
jmp 0x405e6b
mov edx, dword [esp + 0x848]
mov eax, dword [edx + 4]
mov dword [0x41d228], ecx
mov dword [0x41d224], eax
mov dword [0x41d22c], ebp
mov eax, esi
jmp 0x405e6b
mov ecx, dword [esp + 0x848]
mov edx, dword [0x41d224]
cmp edx, dword [ecx + 4]
jne 0x405dee
mov dword [0x41d224], ebp
mov dword [0x41d228], ebp
mov dword [0x41d22c], ebp
mov eax, esi
jmp 0x405e6b
mov eax, dword [esp + 0x848]
mov ecx, dword [esp + 0x844]
mov edx, dword [esp + 0x840]
push eax
mov eax, dword [esp + 0x83c]
push ecx
push edx
push eax
call fcn.00403380
add esp, 0x10
jmp case.0x404a05.6
mov ecx, dword [esp + 0x848]
mov edx, dword [esp + 0x844]
mov eax, dword [esp + 0x840]
push ecx
mov ecx, dword [esp + 0x83c]
push edx
push eax
push ecx
call fcn.004038d0
add esp, 0x10
jmp case.0x404a05.6
mov eax, dword [0x41a340]
test eax, eax
je case.0x404a05.6
mov edx, dword [esp + 0x840]
push edx
call dword [sym.imp.RSCLASS.dll_int___stdcall_FUN_SetParametersToLocal_struct__FORMAT_SYSPARAMETERS__]
push 1
push 1
call sub.RSCLASS.dll_Ordinal_103
mov eax, 1
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x820
ret