Function at 0x406740
Capabilities:
Create process on windows
Create thread
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x479698
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x497650]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 4]
call fcn.004188bc
push 0x72
push eax
mov dword [ebx + 0x5d8], 0x1fc
mov dword [ebx + 0x5dc], esi
mov dword [ebx + 0x5e0], 0x72
mov dword [ebx + 0x5e4], 7
mov dword [ebx + 0x5e8], 0x473
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebx + 0x5ec], eax
push 0x48a640
lea eax, [ebx + 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, ebx
call fcn.00407210
push 0x14
call fcn.00417314
add esp, 4
push 0x14
mov dword [ebx + 0x4ec], eax
call fcn.00417314
add esp, 4
push 0x14
mov dword [ebx + 0x4f0], eax
call fcn.00417314
mov ecx, dword [ebx + 0x4ec]
mov edx, dword [ebx + 0x484]
mov dword [ebx + 0x4f4], eax
mov dword [ecx], edx
mov eax, dword [ebx + 0x4ec]
mov ecx, dword [ebx + 0x488]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 0x4ec]
mov eax, dword [ebx + 0x48c]
mov dword [edx + 8], eax
mov ecx, dword [ebx + 0x4ec]
mov edx, dword [ebx + 0x490]
mov dword [ecx + 0xc], edx
mov eax, dword [ebx + 0x4ec]
mov ecx, dword [ebx + 0x494]
mov dword [eax + 0x10], ecx
mov edx, dword [ebx + 0x4f0]
mov eax, dword [ebx + 0x4a8]
mov dword [edx], eax
mov ecx, dword [ebx + 0x4f0]
mov edx, dword [ebx + 0x4ac]
mov dword [ecx + 4], edx
mov eax, dword [ebx + 0x4f0]
mov ecx, dword [ebx + 0x4b0]
mov dword [eax + 8], ecx
mov edx, dword [ebx + 0x4f0]
mov eax, dword [ebx + 0x4b4]
mov dword [edx + 0xc], eax
mov ecx, dword [ebx + 0x4f0]
mov edx, dword [ebx + 0x4b8]
mov dword [ecx + 0x10], edx
mov eax, dword [ebx + 0x4f4]
mov ecx, dword [ebx + 0x4cc]
mov dword [eax], ecx
mov edx, dword [ebx + 0x4f4]
mov eax, dword [ebx + 0x4d0]
mov dword [edx + 4], eax
mov ecx, dword [ebx + 0x4f4]
mov edx, dword [ebx + 0x4d4]
mov dword [ecx + 8], edx
mov eax, dword [ebx + 0x4f4]
mov ecx, dword [ebx + 0x4d8]
mov dword [eax + 0xc], ecx
mov eax, dword [ebx + 0x4dc]
mov edx, dword [ebx + 0x4f4]
mov dword [edx + 0x10], eax
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0x5cc]
mov dword [0x49a440], ecx
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
add esp, 4
sub eax, 0x104
or eax, ecx
jge 0x40690d
mov eax, 0x104
lea ecx, [ebx + 0x5cc]
call fcn.00401f40
mov eax, dword [ebx + 0x5cc]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebx + 0x5cc]
mov ecx, dword [eax - 8]
test eax, eax
je 0x406940
push ecx
push eax
call fcn.0045cd4e
add esp, 8
test eax, eax
js 0x407201
mov ecx, dword [ebx + 0x5cc]
cmp eax, dword [ecx - 8]
jg 0x407201
mov dword [ecx - 0xc], eax
mov edx, dword [ebx + 0x5cc]
mov byte [eax + edx], 0
mov eax, dword [ebx + 0x5cc]
push 0x5c
push eax
call fcn.0045eb83
add esp, 8
test eax, eax
jne 0x40697b
mov dword [esp + 0x18], 0xffffffff
jmp 0x406985
sub eax, dword [ebx + 0x5cc]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x1c]
xor ecx, ecx
lea edx, [ebx + 0x5cc]
call fcn.00409af0
mov dword [esp + 0x50], 0
mov ecx, dword [eax]
mov edi, dword [ebx + 0x5d0]
lea eax, [ecx - 0x10]
sub edi, 0x10
cmp eax, edi
je 0x406a01
cmp dword [edi + 0xc], 0
jl 0x4069f2
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x4069f2
call fcn.004026b0
mov dword [esp + 0x30], eax
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4069e3
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov ecx, dword [esp + 0x30]
add ecx, 0x10
mov dword [ebx + 0x5d0], ecx
jmp 0x406a01
mov edi, dword [ecx - 0xc]
push ecx
lea eax, [ebx + 0x5d0]
call fcn.00401e40
mov dword [esp + 0x50], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406a29
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
inc ecx
lea esi, [esp + 0x2c]
lea edx, [ebx + 0x5cc]
call fcn.00409ad0
mov dword [esp + 0x50], 1
mov ecx, dword [eax]
mov edi, dword [ebx + 0x5d4]
lea eax, [ecx - 0x10]
sub edi, 0x10
cmp eax, edi
je 0x406aa3
cmp dword [edi + 0xc], 0
jl 0x406a94
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x406a94
call fcn.004026b0
mov dword [esp + 0x30], eax
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406a85
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov ecx, dword [esp + 0x30]
add ecx, 0x10
mov dword [ebx + 0x5d4], ecx
jmp 0x406aa3
mov edi, dword [ecx - 0xc]
push ecx
lea eax, [ebx + 0x5d4]
call fcn.00401e40
mov dword [esp + 0x50], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406acb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebx + 0x5d4]
push 0x48a908
push esi
call fcn.0045e8ba
add esp, 8
test eax, eax
jne 0x406d18
mov ecx, dword [ebx + 0x45c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1e0]
push 1
call eax
mov ecx, dword [ebx + 0x4c0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1e0]
push 0
call eax
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [ebx + 0x4f4]
mov ecx, dword [esi + ecx]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe8]
push 0
call eax
add esi, 4
cmp esi, 0x14
jl 0x406b10
mov ecx, ebx
call fcn.00405ee0
test al, al
jne 0x406b55
push 0
push 0x48a7e0
push 0x48a918
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
mov ecx, ebx
call fcn.0041f23f
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x50], 2
mov ecx, dword [ebx + 0x510]
push ecx
push 0x48a934
lea edi, [esp + 0x28]
call fcn.004025a0
mov ecx, dword [ebx + 0x4bc]
mov edx, dword [ecx]
mov eax, dword [esp + 0x28]
mov edx, dword [edx + 0x2c]
add esp, 8
push eax
call edx
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x50], 3
mov eax, dword [ebx + 0x510]
push eax
push 0x48a940
lea edi, [esp + 0x24]
call fcn.004025a0
mov ecx, dword [ebx + 0x4c4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x24]
mov edx, dword [edx + 0x2c]
add esp, 8
push eax
call edx
mov edx, dword [0x49a47c]
mov ecx, dword [0x49a478]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov eax, edx
xor esi, esi
shr eax, 0x1f
xor edi, edi
add eax, edx
mov dword [esp + 0x18], esi
je 0x406cb8
jmp 0x406c18
mov ecx, dword [0x49a478]
mov eax, dword [esi + ecx + 0x10]
cmp eax, 5
je 0x406c26
cmp eax, 6
jne 0x406c8a
cmp edi, 5
jge 0x406c8a
mov eax, dword [esi + ecx]
mov ecx, dword [ebx + 0x4f4]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
call eax
mov ecx, dword [ebx + 0x4f4]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe8]
push 1
call eax
mov ecx, dword [ebx + 0x4f4]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x160]
push 1
call eax
mov ecx, dword [ebx + 0x4f4]
mov ecx, dword [ecx + edi*4]
mov eax, dword [0x49a478]
mov edx, dword [ecx]
mov edx, dword [edx + 0xe0]
add eax, esi
push eax
call edx
inc edi
cmp edi, 5
je 0x406cb8
mov ecx, dword [0x49a47c]
sub ecx, dword [0x49a478]
inc dword [esp + 0x18]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, 0x18
cmp dword [esp + 0x18], eax
jb 0x406c12
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406cdd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x50], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406d05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
push 0x48a4d4
push 0x48a95c
push str.http:__d.guaihou.com_azb_getconfig.php_type_sid_s
lea edi, [esp + 0x3c]
mov dword [esp + 0x5c], 4
call fcn.004025a0
mov ecx, dword [ebx + 0x458]
add esp, 0xc
push 0
call fcn.00421fa3
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, dword [ebx + 0x458]
call fcn.0042378c
mov ecx, ebx
call fcn.004056a0
test al, al
jne 0x406dcd
push 0
push 0x48a7e0
push 0x48a960
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push str.http:__d.guaihou.com_azb_cuowu.html
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0
mov ecx, ebx
call fcn.0041edbc
mov esi, ebx
call fcn.00406580
push 0
push 0
push 0
push 0x404c20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
lea eax, [ebx + 0x520]
mov esi, 0x10
mov byte [esp + 0x50], 5
cmp dword [eax + 0x14], esi
jb 0x406dfb
mov eax, dword [eax]
push eax
push 0x48a9bc
lea edi, [esp + 0x34]
call fcn.004025a0
mov ecx, dword [ebx + 0x460]
mov edx, dword [ecx]
mov eax, dword [esp + 0x34]
mov edx, dword [edx + 0x2c]
add esp, 8
push eax
call edx
mov ecx, dword [ebx + 0x45c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1e0]
push 0
call edx
mov ecx, dword [ebx + 0x464]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1e0]
push 0
call edx
mov ecx, dword [ebx + 0x470]
mov eax, dword [ecx]
mov edx, dword [eax + 0x160]
push 1
call edx
call fcn.00404f60
mov byte [esp + 0x17], al
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [esp + 0x28], eax
lea eax, [ebx + 0x574]
mov byte [esp + 0x50], 6
cmp dword [eax + 0x14], esi
jb 0x406e86
mov eax, dword [eax]
movsx esi, byte [esp + 0x17]
push eax
push str.Game
push esi
push str._c:_s_s
lea edi, [esp + 0x38]
call fcn.004025a0
mov ecx, dword [ebx + 0x478]
mov eax, dword [ecx]
mov edx, dword [esp + 0x38]
mov eax, dword [eax + 0x2c]
add esp, 0x10
push edx
call eax
mov edx, dword [section..data]
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
push esi
push str._c:_
lea edi, [esp + 0x2c]
mov byte [esp + 0x58], 7
call fcn.004025a0
mov edx, dword [esp + 0x2c]
add esp, 8
xor esi, esi
push esi
push esi
lea ecx, [esp + 0x44]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x50], 8
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00406640
add esp, 0xc
mov edi, eax
mov byte [esp + 0x50], 9
mov eax, dword [ebx + 0x4fc]
mov ecx, dword [ebx + 0x4f8]
push eax
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00406640
add esp, 0xc
mov byte [esp + 0x50], 0xa
mov ecx, dword [edi]
mov edx, dword [eax]
push ecx
push edx
push 0x48a9dc
lea edi, [esp + 0x28]
call fcn.004025a0
mov byte [esp + 0x5c], 9
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x50], 8
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406fbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx + 0x474]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 0x2c]
push eax
call edx
xor edi, edi
nop
mov eax, dword [ebx + 0x4ec]
mov ecx, dword [edi + eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe8]
push esi
call eax
mov ecx, dword [ebx + 0x4f0]
mov ecx, dword [edi + ecx]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe8]
push esi
call eax
add edi, 4
cmp edi, 0x14
jl 0x406fd0
mov edx, dword [0x49a47c]
mov ecx, dword [0x49a478]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
je 0x40715c
nop
mov eax, dword [esi + ecx + 0x10]
cmp eax, 1
je 0x40703e
cmp eax, 2
jne 0x4070ab
cmp edi, 5
jge 0x4070ab
mov eax, dword [esi + ecx]
mov ecx, dword [ebx + 0x4ec]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
call eax
mov ecx, dword [ebx + 0x4ec]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe8]
push 1
call eax
mov ecx, dword [ebx + 0x4ec]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x160]
push 1
call eax
mov ecx, dword [ebx + 0x4ec]
mov ecx, dword [ecx + edi*4]
mov eax, dword [0x49a478]
mov edx, dword [ecx]
mov edx, dword [edx + 0xe0]
add eax, esi
push eax
call edx
inc edi
cmp edi, 5
je 0x40715c
jmp 0x40712c
cmp eax, 3
je 0x4070b9
cmp eax, 4
jne 0x407132
mov edx, dword [esp + 0x18]
cmp edx, 5
jge 0x407132
mov eax, dword [esi + ecx]
mov ecx, dword [ebx + 0x4f0]
mov ecx, dword [ecx + edx*4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
call eax
mov ecx, dword [ebx + 0x4f0]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe8]
push 1
call edx
mov eax, dword [ebx + 0x4f0]
mov ecx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x160]
push 1
call eax
mov ecx, dword [ebx + 0x4f0]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov edx, dword [0x49a478]
mov eax, dword [ecx]
mov eax, dword [eax + 0xe0]
add edx, esi
push edx
call eax
inc dword [esp + 0x18]
mov ecx, dword [0x49a478]
mov edx, dword [0x49a47c]
inc dword [esp + 0x20]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, 0x18
cmp dword [esp + 0x20], eax
jb 0x407030
mov byte [esp + 0x50], 7
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407181
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x50], 6
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4071a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x50], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4071cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x50], 4
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4071f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x50], 0xffffffff
mov eax, dword [esp + 0x30]
jmp 0x406ce9
push 0x80070057
call fcn.00402140
int3