Function at 0x40d6e0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x432c1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac0
push ebx
push ebp
push esi
push edi
mov edi, dword [0x46fe80]
xor eax, eax
test edi, edi
setne al
mov dword [0x46fa20], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ecx
mov dword [0x45be58], eax
mov ecx, esp
mov dword [esp + 0x18], esp
push str.vpservice.dat
call fcn.00425e4c
lea ecx, [esp + 0x18]
push ecx
call fcn.00410030
mov edx, dword [eax]
add esp, 8
lea eax, [esp + 0x878]
push edx
push 0x46fa24
push 0x43e12c
push eax
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.00425dde
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x43e49c
call fcn.00425e4c
lea ecx, [esp + 0x18]
push ecx
call fcn.00410030
mov edx, dword [eax]
add esp, 8
lea eax, [esp + 0x54c]
push edx
push 0x46fa24
push 0x43e12c
push eax
call fcn.00412f35
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.00425dde
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x878]
push ecx
push edx
call fcn.004105d0
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x442da0
push 0x43e498
push str.debug
call ebx
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40d818
lea edx, [esp + 0x14c]
push edx
call fcn.0041451e
add esp, 4
mov dword [0x46fea4], eax
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x442da0
push str.switch
push str.debug
call ebx
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40d866
lea edx, [esp + 0x14c]
push edx
call fcn.0041451e
add esp, 4
mov dword [0x46fea8], eax
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x442da0
push str.program
push str.process
call ebx
lea ecx, [esp + 0x18]
call fcn.00409fe0
lea ecx, [esp + 0x18]
mov dword [esp + 0xad8], 0
call fcn.0040a1a0
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
test edx, edx
je 0x40d915
mov ebp, 0x45be5c
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40d915
sub eax, esi
lea ecx, [esp + 0x20]
push eax
push esi
push ecx
call fcn.00413b10
add esp, 0xc
lea edx, [esp + 0x20]
lea ecx, [esp + 0x18]
lea esi, [edi + 1]
push edx
call fcn.0040a2a0
test eax, eax
je 0x40d8c0
mov ecx, dword [esp + 0x10]
mov dword [ebp], eax
inc ecx
add ebp, 4
mov dword [esp + 0x10], ecx
jmp 0x40d8c0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x9a4]
push 0x12c
push ecx
push 0
mov dword [0x45bfe8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40d972
lea edx, [esp + 0x9a4]
push 0x5c
push edx
call fcn.00414270
mov edi, eax
inc edi
push edi
call fcn.00423d6b
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x45bfec
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x442da0
push str.program
push str.process
mov ebp, 1
call ebx
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
push eax
call fcn.00423d6b
lea ecx, [esp + 0x150]
add esp, 4
test ecx, ecx
je 0x40da05
mov dword [esp + 0x10], 0x45c050
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40da05
mov edx, edi
sub edx, esi
push edx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00413b10
add esp, 0xc
inc ebp
add esi, 0x64
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x40d9c7
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x442da0
push str.processname
push str.hideprocess
mov dword [0x45e6fc], ebp
call ebx
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push edx
call fcn.00423d6b
lea eax, [esp + 0x150]
add esp, 4
xor ebp, ebp
test eax, eax
je 0x40dab3
mov dword [esp + 0x10], 0x45e700
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40dab3
mov ecx, edi
lea edx, [esp + 0x20]
sub ecx, esi
push ecx
push esi
push edx
call fcn.00413b10
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
lea esi, [edi + 1]
push eax
call fcn.0040a2a0
test eax, eax
je 0x40da5d
mov ecx, dword [esp + 0x10]
inc ebp
mov dword [ecx], eax
add ecx, 4
mov dword [esp + 0x10], ecx
jmp 0x40da5d
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x442da0
push str.processname
mov dword [0x45e890], ebp
push str.hideprocess
xor ebp, ebp
call ebx
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
push eax
call fcn.00423d6b
lea ecx, [esp + 0x150]
add esp, 4
test ecx, ecx
je 0x40db49
mov dword [esp + 0x10], 0x45e894
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40db49
mov edx, edi
sub edx, esi
push edx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00413b10
add esp, 0xc
inc ebp
add esi, 0x64
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x40db0b
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x442da0
push str.name
push str.filename
mov dword [0x460fa4], ebp
call ebx
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push edx
call fcn.00423d6b
lea eax, [esp + 0x150]
add esp, 4
xor ebp, ebp
test eax, eax
je 0x40dbdf
mov dword [esp + 0x10], 0x460fa8
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40dbdf
mov ecx, edi
sub ecx, esi
push ecx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00413b10
add esp, 0xc
inc ebp
add esi, 0x64
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x40dba1
lea edx, [esp + 0x54c]
lea eax, [esp + 0x14c]
push edx
push 0x400
push eax
push 0x442da0
push str.name
push str.service
mov dword [0x4636b8], ebp
call ebx
lea ecx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push ecx
call fcn.00423d6b
lea edx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test edx, edx
je 0x40dc73
mov dword [esp + 0x10], 0x4636bc
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40dc73
sub eax, esi
push eax
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00413b10
add esp, 0xc
inc ebp
add esi, 0x64
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x40dc37
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x442da0
push str.name
push str.keyname
mov dword [0x465dcc], ebp
call ebx
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
push eax
call fcn.00423d6b
lea ecx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test ecx, ecx
je 0x40dd09
mov dword [esp + 0x10], 0x465dd0
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40dd09
mov edx, edi
sub edx, esi
push edx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00413b10
add esp, 0xc
inc ebp
add esi, 0x64
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x40dccb
lea eax, [esp + 0x54c]
lea ecx, [esp + 0x14c]
push eax
push 0x400
push ecx
push 0x442da0
push str.name
push str.keyvaluename
mov dword [0x4684e0], ebp
call ebx
lea edx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push edx
call fcn.00423d6b
lea eax, [esp + 0x150]
add esp, 4
xor ebp, ebp
test eax, eax
je 0x40dd9f
mov dword [esp + 0x10], 0x4684e4
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40dd9f
mov ecx, edi
sub ecx, esi
push ecx
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00413b10
add esp, 0xc
inc ebp
add esi, 0x64
mov dword [esp + 0x10], esi
lea esi, [edi + 1]
jmp 0x40dd61
lea edx, [esp + 0x54c]
lea eax, [esp + 0x14c]
push edx
push 0x400
push eax
push 0x442da0
push str.name
push str.invalid
mov dword [0x46abf4], ebp
call ebx
lea ecx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push ecx
call fcn.00423d6b
lea edx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test edx, edx
je 0x40de2e
mov ebx, 0x46abf8
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov edi, eax
add esp, 8
test edi, edi
je 0x40de28
sub eax, esi
push eax
push esi
push ebx
call fcn.00413b10
add esp, 0xc
inc ebp
add ebx, 0x64
lea esi, [edi + 1]
jmp 0x40ddf4
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x54c]
lea edx, [esp + 0x14c]
push ecx
push 0x400
push edx
push 0x442da0
push str.name
push str.hookprocess
mov dword [0x46d308], ebp
call ebx
lea eax, [esp + 0x14c]
lea esi, [esp + 0x14c]
push eax
call fcn.00423d6b
lea ecx, [esp + 0x150]
add esp, 4
xor ebp, ebp
test ecx, ecx
je 0x40defa
mov dword [esp + 0x10], 0x4445d4
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40def4
mov edx, ebx
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x74c]
sub edx, esi
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x750]
push esi
push eax
call fcn.00413b10
mov esi, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x74c]
push ecx
push 0x43e410
push esi
call fcn.0041483a
add esp, 0xc
inc ebp
add esi, 0x258
mov dword [esp + 0x10], esi
lea esi, [ebx + 1]
jmp 0x40de86
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x54c]
lea eax, [esp + 0x14c]
push edx
push 0x400
push eax
push 0x442da0
push str.name
push str.unhookprocess
mov dword [0x4445d0], ebp
call ebx
lea ecx, [esp + 0x14c]
lea esi, [esp + 0x14c]
push ecx
call fcn.00423d6b
lea edx, [esp + 0x150]
add esp, 4
test edx, edx
mov dword [esp + 0x10], 0
je 0x40dfb6
mov ebp, 0x46d30c
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0x20]
push 0x3b
rep stosd dword es:[edi], eax
push esi
call fcn.00414640
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40dfb6
sub eax, esi
lea ecx, [esp + 0x20]
push eax
push esi
push ecx
call fcn.00413b10
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
lea esi, [ebx + 1]
inc ecx
add ebp, 0x64
mov dword [esp + 0x10], ecx
jmp 0x40df55
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov dword [0x46fa1c], eax
mov dword [esp + 0xad8], 0xffffffff
call fcn.0040a010
mov ecx, dword [esp + 0xad0]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xacc
ret