Function at 0x405460
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x412e28
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x41913c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push edi
mov eax, dword [0x41913c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push esi
push eax
mov ebx, 0x415e50
call fcn.00404440
add esp, 8
mov dword [esp + 0x4c], 0
mov edi, dword [eax]
mov edx, dword [0x41ac48]
mov eax, dword [edx - 8]
mov ebx, 1
mov ecx, ebx
sub ecx, dword [edx - 4]
sub eax, 0xa
or eax, ecx
jge 0x4054db
lea ecx, [ebx + 9]
mov eax, 0x41ac48
call fcn.004021d0
mov edx, dword [0x41ac48]
push edi
push 0xa
push edx
push 0x415ec8
push 0x41684c
push 0x415e74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40551c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x41ac48]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00407c62
add esp, 8
test eax, eax
jl 0x40594a
mov ecx, dword [0x41ac48]
cmp eax, dword [ecx - 8]
jg 0x40594a
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ecx - 0xc], eax
mov edx, dword [0x41ac48]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [0x41ac48]
cmp dword [eax - 0xc], ebx
jne 0x4055bd
cmp word [eax], 0x30
jne 0x4055bd
lea eax, [esp + 0x10]
push esi
push eax
mov ebx, 0x415e50
call fcn.00404440
mov ecx, dword [eax]
add esp, 8
push ecx
push 0x416858
push 0x41684c
push 0x415d20
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4055b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [0x41ac38], 0
jmp 0x4055c3
mov dword [0x41ac38], ebx
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 8
push eax
push 1
push 0x416860
push 0x415e74
call edi
mov dword [0x41ac18], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405612
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [0x41ac18], 0
je 0x40563d
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov edx, dword [eax]
add esp, 8
push edx
push 0x415ec8
push 0x416870
jmp 0x4056ad
xor eax, eax
xor ecx, ecx
mov word [esp + 0x18], cx
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
lea edx, [esp + 0x1c]
push 0x416884
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x1c]
push esi
push eax
mov ebx, 0x415e50
call fcn.00404440
mov ecx, dword [eax]
add esp, 0x14
push ecx
lea edx, [esp + 0x1c]
push edx
push str.Shift0
push 0x415e74
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4056d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push str.UnSSDT
push 0x415e74
call edi
mov dword [0x41ac1c], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40571d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push str.CanHosts
push 0x415e74
call edi
mov dword [0x41ac30], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405766
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push 0x415f0c
push 0x415e74
call edi
mov dword [0x41ac2c], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4057af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push 0x4168c0
push 0x415e74
call edi
mov dword [0x41ac24], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4057f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push str.ADClient
push 0x415e74
call edi
mov dword [0x41ac20], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405841
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push 0x4168e0
push 0x415e74
call edi
mov dword [0x41ac28], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40588a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push str.SafeApi1
push 0x415e74
call edi
mov dword [0x41ac3c], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4058d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push esi
push ecx
mov ebx, 0x415e50
call fcn.00404440
mov eax, dword [eax]
add esp, 8
push eax
push 0
push str.SafeApi2
push 0x415e74
call edi
mov dword [0x41ac40], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40591c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x41abd8]
test eax, eax
je 0x40592c
call eax
mov dword [0x41ac44], eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00407684
add esp, 0x40
ret
push 0x80070057
call fcn.004023b0
int3