Function at 0x401650
Capabilities:
Delete file
Read .ini file
Set file attributes

Disassembly:
sub esp, 0x2a4
push ebx
push ebp
mov ebp, ecx
xor eax, eax
xor ecx, ecx
mov dword [esp + 9], eax
mov dword [esp + 0x15], ecx
push esi
mov word [esp + 0x1d], cx
push edi
xor ebx, ebx
mov word [esp + 0x15], ax
mov byte [esp + 0x23], cl
mov ecx, 0x40
lea edi, [esp + 0xad]
mov byte [esp + 0x17], al
mov byte [esp + 0xac], bl
mov byte [esp + 0x5c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x5d]
xor edx, edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp + 0x2bc]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x44], edx
repne scasb al, byte es:[edi]
mov dword [esp + 0x48], edx
mov dword [esp + 0x30], ebx
not ecx
mov dword [esp + 0x4c], edx
sub edi, ecx
mov dword [esp + 0x50], edx
lea edx, [esp + 0xac]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov byte [esp + 0x10], bl
rep movsb byte es:[edi], byte [esi]
mov edi, str.code.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x1c], bl
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xac]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x69
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x28], esi
jne 0x401b72
lea ecx, [esp + 0xac]
lea edx, [esp + 0x5c]
push ecx
push 0x40
push edx
push 0x4077d8
push str.code
push str.code
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x5c]
push 1
push eax
call fcn.00404bf0
add esp, 8
lea ecx, [esp + 0x5c]
push ecx
push str.szAgentID_s_n
call fcn.004048a0
lea edi, [esp + 0x64]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x48]
mov byte [esp + 0x50], bl
cmp al, bl
je 0x4017ce
lea ecx, [esp + 0x44]
lea edx, [esp + 0x48]
push ecx
push str._08X
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
mov eax, dword [esp + 0x44]
push eax
push str.AgentID0x_lX_n
call fcn.004048a0
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x64]
add esp, 8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xac]
lea edx, [esp + 0x5c]
push ecx
push 0x3f
push edx
push 0x4077d8
push str.time
push str.code
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x5c]
push 1
push eax
call fcn.00404bf0
add esp, 8
lea ecx, [esp + 0x5c]
push ecx
push str.time_s_n
call fcn.004048a0
mov al, byte [esp + 0x64]
add esp, 8
cmp al, bl
je 0x401854
lea edx, [ebp + 0xa4]
lea eax, [esp + 0x5c]
push edx
push 0x4072ac
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [ebp + 0xa4], ebx
jne 0x401866
mov dword [ebp + 0xa4], 0x14
mov ecx, dword [ebp + 0xa4]
push ecx
push str.time_u_min_x__n
call fcn.004048a0
add esp, 8
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 4
xor eax, eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
call fcn.00404f60
mov ecx, dword [esp + 0x4f]
mov edx, dword [esp + 0x4e]
mov eax, dword [esp + 0x4d]
add esp, 0x10
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x3f]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x42]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x45]
push edx
mov edx, dword [esp + 0x48]
and eax, 0xff
and ecx, 0xff
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
push eax
mov eax, dword [esp + 0x2d]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x33]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x36]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x39]
push edx
mov edx, dword [esp + 0x3c]
and eax, 0xff
and ecx, 0xff
push eax
and edx, 0xff
push ecx
push edx
push str.MAC_02X__02X__02X__02X__02X__02X_IP_u._u._u._u__GateWay_u._u._u._u_n
call fcn.004048a0
mov al, byte [esp + 0x4c]
add esp, 0x3c
cmp al, bl
jne 0x4019a7
cmp byte [esp + 0x11], bl
jne 0x4019a7
cmp byte [esp + 0x12], bl
jne 0x4019a7
cmp byte [esp + 0x13], bl
jne 0x4019a7
cmp byte [esp + 0x14], bl
jne 0x4019a7
cmp byte [esp + 0x15], bl
jne 0x4019a7
push 0xbb8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
mov eax, esi
dec esi
test eax, eax
jne 0x401893
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x401a1c
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
push edx
push eax
mov dword [esp + 0x28], ecx
call fcn.00404ff0
mov byte [esp + 0x2a], bl
mov edx, dword [esp + 0x27]
mov byte [esp + 0x2b], bl
mov eax, dword [esp + 0x29]
mov ecx, dword [esp + 0x28]
add esp, 8
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x22]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x25]
push edx
mov edx, dword [esp + 0x28]
and eax, 0xff
and ecx, 0xff
push eax
and edx, 0xff
push ecx
push edx
push str.GateWay_MAC_02X__02X__02X__02X__02X__02X_n
call fcn.004048a0
add esp, 0x1c
mov ecx, ebp
call fcn.00401590
test eax, eax
jne 0x401b92
push ebx
call fcn.00402c20
push ebx
call fcn.00403180
push ebx
call fcn.00403370
push ebx
call fcn.00403560
push ebx
call fcn.00403750
push ebx
call fcn.00403ab0
push ebx
call fcn.00403ce0
push ebx
call fcn.00403e80
push ebx
call fcn.004040f0
push ebx
call fcn.00404210
push ebx
call fcn.00404410
push ebx
call fcn.004046b0
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov dword [ebp + 0xa8], eax
mov eax, dword [ebp + 0xa0]
add esp, 0x30
lea edi, [ebp + 0x3c0]
mov dword [ebp + 0xac], ecx
cmp eax, ebx
mov dword [ebp + 0xb0], edx
push edi
je 0x401aa9
push 0x67
jmp 0x401aab
push 0x65
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
jne 0x401e85
push 3
push 1
push edi
push str.baihan
mov ecx, ebp
call fcn.00401fb0
mov esi, eax
cmp esi, ebx
jne 0x401e91
mov eax, dword [ebp + 0xa0]
cmp eax, ebx
lea eax, [ebp + 0x5c8]
mov dword [esp + 0x2c], eax
push eax
je 0x401af3
push 0x83
jmp 0x401af8
push 0x82
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
jne 0x401e9d
mov eax, dword [ebp + 0xa0]
lea edi, [ebp + 0x4c4]
cmp eax, ebx
push edi
je 0x401b21
push 0x85
jmp 0x401b26
push 0x84
mov ecx, ebp
call fcn.00401470
mov esi, eax
cmp esi, ebx
jne 0x401ea9
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0xac]
push eax
push edi
push str.__s___s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
push ebx
push ebx
push ebx
lea edx, [esp + 0xc8]
push ebx
push edx
push ebx
call fcn.00405840
add esp, 0x28
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x102
push esi
call fcn.004048b0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
push str.Get_old_AgentID..._n
call fcn.004048a0
add esp, 4
lea eax, [esp + 0xac]
push str.baihan
push str.SYSTEMCurrentControlSet_services_sParameters
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0xb8]
push ecx
push str.CodeID
push edx
push connect
call fcn.00404a00
mov eax, dword [esp + 0x4c]
add esp, 0x1c
push eax
push str.Exist_AgentID0x_lX__n
call fcn.004048a0
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x38]
add esp, 8
cmp eax, edx
je 0x401f99
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1b1]
mov byte [esp + 0x1b0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp + 0x1b8]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x28], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x2c], 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xac]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401c72
lea eax, [esp + ecx + 0xab]
mov cl, byte [esp + ecx + 0xab]
cmp cl, 0x5c
jne 0x401c72
mov byte [eax], bl
lea ecx, [esp + 0xac]
push edx
push ecx
lea edx, [esp + 0x1b8]
push str._s_08X.INI
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.dload_txt_from_driver..._n
call fcn.004048a0
add esp, 4
lea eax, [esp + 0x1b0]
mov ecx, ebp
push eax
call fcn.00402540
mov esi, eax
cmp esi, ebx
je 0x401d1e
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x162
push esi
call fcn.004048b0
add esp, 0xc
push str.dload_txt_of_old_AgentID..._n
call fcn.004048a0
mov eax, dword [esp + 0x34]
add esp, 4
lea ecx, [esp + 0x1b0]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00402760
mov esi, eax
cmp esi, ebx
je 0x401d1e
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x167
push esi
call fcn.004048b0
mov eax, dword [esp + 0x50]
add esp, 0xc
mov ecx, ebp
push eax
call fcn.004024a0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
lea ecx, [esp + 0x9c]
mov dword [esp + 0x58], ebx
push ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xac]
lea edx, [esp + 0x1b0]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0xb0]
push 0x104
push eax
push 0x4077d8
push str.upDataLoad
push str.switch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401da3
lea ecx, [esp + 0xac]
push 1
push ecx
call fcn.00404bf0
add esp, 8
lea edx, [esp + 0x58]
lea eax, [esp + 0xac]
push edx
push 0x40715c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [esp + 0x58], ebx
je 0x401e41
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xac]
lea edx, [esp + 0xac]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1b0]
push ecx
push 0x104
push edx
push 0x4077d8
push str.Agent
push str.updata
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401e1d
lea eax, [esp + 0xac]
push 1
push eax
call fcn.00404bf0
add esp, 8
lea ecx, [esp + 0x28]
lea edx, [esp + 0x54]
lea eax, [esp + 0xac]
push ecx
push edx
push str._u__u
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x28]
cmp ecx, ebx
jne 0x401e2d
cmp edx, ebx
je 0x401e45
mov eax, dword [esp + 0xa4]
and eax, 0xffff
cmp eax, ecx
jb 0x401e41
cmp eax, edx
jb 0x401e45
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x1b0]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x2c], ebx
je 0x401b65
mov eax, dword [esp + 0x44]
mov ecx, ebp
push eax
call fcn.004024a0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1b9
jmp 0x401eb3
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1c1
jmp 0x401eb3
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1db
jmp 0x401eb3
push str.D:WorkHPServiceShangHaiBackDllBackDllApp.cpp
push 0x1e7
push esi
call fcn.004048b0
add esp, 0xc
cmp eax, ebx
je 0x401b65
mov eax, dword [esp + 0x37]
mov ecx, 0xa
and eax, 0xff
cdq
idiv ecx
test edx, edx
jne 0x401b65
mov edx, dword [esp + 0x15]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x13]
and edx, 0xff
push str.15.1.19.1
and eax, 0xff
push edx
mov edx, dword [esp + 0x1a]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x1d]
push ecx
mov ecx, dword [esp + 0x20]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x35]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x3b]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x3e]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x41]
push ecx
mov ecx, dword [esp + 0x44]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x70]
and ecx, 0xff
push eax
push ecx
push edx
lea eax, [esp + 0xe4]
push str.60__08X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X__02X_8_0__s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x40
lea ecx, [esp + 0xac]
push ecx
mov ecx, ebp
call fcn.00402660
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret