Function at 0x404d80
Capabilities:
Copy file
Create directory
Create process on windows
Create thread
Delete file
Get common file path
Initialize winsock library
Read .ini file
Resolve dns
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44ad1a
mov eax, dword fs:[0]
push eax
sub esp, 0x1e8
mov eax, dword [0x45f684]
xor eax, esp
mov dword [esp + 0x1e0], eax
push ebx
push esi
push edi
mov eax, dword [0x45f684]
xor eax, esp
push eax
lea eax, [esp + 0x1f8]
mov dword fs:[0], eax
lea eax, [esp + 0x40]
push eax
xor ebx, ebx
push ebx
push 0x463940
push 0x404d70
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x44]
call fcn.0041a8b3
push 0x452d18
lea ecx, [esp + 0x14]
push 0x463940
push ecx
mov dword [esp + 0x20c], ebx
call fcn.00406160
add esp, 0xc
mov byte [esp + 0x200], 1
mov eax, dword [eax]
push ebx
push eax
lea ecx, [esp + 0x4c]
call fcn.0041a941
mov esi, eax
mov byte [esp + 0x200], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404e3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
lea ecx, [esp + 0x10]
je 0x404fa0
push 0x452d18
push 0x463940
push ecx
call fcn.00406160
add esp, 0xc
mov byte [esp + 0x200], 2
mov esi, dword [eax]
mov edx, dword [0x463990]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x100
or eax, ecx
jge 0x404e97
push 0x100
mov ecx, 0x463990
call fcn.00401100
mov edx, dword [0x463990]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x100
push edx
mov edx, dword [0x463940]
push edx
push str.startname
push str.main
call edi
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404edf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x463990]
cmp edx, ebx
jne 0x404eed
xor eax, eax
jmp 0x404f07
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404ef2
sub eax, esi
sar eax, 1
js 0x404f96
cmp eax, dword [edx - 8]
jg 0x404f96
mov dword [edx - 0xc], eax
mov ecx, dword [0x463990]
mov word [ecx + eax*2], bx
mov edx, dword [0x463990]
push 0x5c
push edx
call fcn.0042f57a
add esp, 8
cmp eax, ebx
jne 0x404f37
or eax, 0xffffffff
jmp 0x404f3f
sub eax, dword [0x463990]
sar eax, 1
add eax, 1
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, 0x463990
call fcn.00406020
push eax
mov ecx, 0x463940
mov byte [esp + 0x204], 3
call fcn.00406510
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40507b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40507b
push 0x80070057
call fcn.00401080
push str.mcyyouxi.ini
push 0x463940
push ecx
mov dword [0x46399c], 1
call fcn.00406160
add esp, 0xc
mov byte [esp + 0x200], 4
mov esi, dword [eax]
mov edx, dword [0x463990]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x100
or eax, ecx
jge 0x404ff6
push 0x100
mov ecx, 0x463990
call fcn.00401100
mov edx, dword [0x463990]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x100
push edx
push 0x45315c
push str.FILENAME
push str.main
call edi
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40503c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x463990]
cmp edx, ebx
jne 0x40504a
xor eax, eax
jmp 0x405065
mov eax, edx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405050
sub eax, esi
sar eax, 1
js 0x404f96
cmp eax, dword [edx - 8]
jg 0x404f96
mov dword [edx - 0xc], eax
mov ecx, dword [0x463990]
mov word [ecx + eax*2], bx
push str.mcyyouxi.ini
lea edx, [esp + 0x14]
push 0x463940
push edx
call fcn.00406160
add esp, 0xc
mov byte [esp + 0x200], 5
mov esi, dword [eax]
mov edx, dword [0x463984]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x100
or eax, ecx
jge 0x4050cb
push 0x100
mov ecx, 0x463984
call fcn.00401100
mov edx, dword [0x463984]
push esi
push 0x100
push edx
push 0x45315c
push 0x452d7c
push str.main
call edi
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40510b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x463984]
cmp edx, ebx
jne 0x405119
xor eax, eax
jmp 0x405135
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405120
sub eax, esi
sar eax, 1
js 0x404f96
cmp eax, dword [edx - 8]
jg 0x404f96
mov dword [edx - 0xc], eax
mov ecx, dword [0x463984]
push str.mcyyouxi.ini
lea edx, [esp + 0x14]
push 0x463940
push edx
mov word [ecx + eax*2], bx
call fcn.00406160
add esp, 0xc
mov byte [esp + 0x200], 6
mov esi, dword [eax]
mov edx, dword [0x463988]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x100
or eax, ecx
jge 0x40519b
push 0x100
mov ecx, 0x463988
call fcn.00401100
mov edx, dword [0x463988]
push esi
push 0x100
push edx
push 0x45315c
push str.GAMEID
push str.main
call edi
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4051db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x463988]
cmp edx, ebx
jne 0x4051e9
xor eax, eax
jmp 0x405205
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4051f0
sub eax, esi
sar eax, 1
js 0x404f96
cmp eax, dword [edx - 8]
jg 0x404f96
mov dword [edx - 0xc], eax
mov ecx, dword [0x463988]
push str.mcyyouxi.ini
lea edx, [esp + 0x14]
push 0x463940
push edx
mov word [ecx + eax*2], bx
call fcn.00406160
add esp, 0xc
mov byte [esp + 0x200], 7
mov esi, dword [eax]
mov edx, dword [0x46398c]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x100
or eax, ecx
jge 0x40526b
push 0x100
mov ecx, 0x46398c
call fcn.00401100
mov edx, dword [0x46398c]
push esi
push 0x100
push edx
push 0x45315c
push str.GAMENAME
push str.main
call edi
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4052ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x46398c]
cmp edx, ebx
jne 0x4052b9
xor eax, eax
jmp 0x4052d5
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4052c0
sub eax, esi
sar eax, 1
js 0x404f96
cmp eax, dword [edx - 8]
jg 0x404f96
mov dword [edx - 0xc], eax
mov ecx, dword [0x46398c]
push str.mcyyouxi.ini
lea edx, [esp + 0x14]
push 0x463940
push edx
mov word [ecx + eax*2], bx
call fcn.00406160
add esp, 0xc
mov byte [esp + 0x200], 8
mov esi, dword [eax]
mov edx, dword [0x463994]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x100
or eax, ecx
jge 0x40533b
push 0x100
mov ecx, 0x463994
call fcn.00401100
mov edx, dword [0x463994]
push esi
push 0x100
push edx
push 0x45315c
push str.GAMETIP
push str.main
call edi
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40537b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x463994]
cmp edx, ebx
jne 0x405389
xor eax, eax
jmp 0x4053a5
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405390
sub eax, esi
sar eax, 1
js 0x404f96
cmp eax, dword [edx - 8]
jg 0x404f96
mov dword [edx - 0xc], eax
mov ecx, dword [0x463994]
push str.mcyyouxi.ini
lea edx, [esp + 0x14]
push 0x463940
push edx
mov word [ecx + eax*2], bx
call fcn.00406160
mov eax, dword [eax]
add esp, 0xc
push eax
push ebx
push 0x452db8
push str.flag
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x463998], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40540b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004115c0
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x405425
push 0x80004005
call fcn.00401080
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov byte [esp + 0x200], 9
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x100
or eax, ecx
jge 0x405463
push 0x100
lea ecx, [esp + 0x1c]
call fcn.00401100
mov esi, dword [esp + 0x18]
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp esi, ebx
jne 0x405477
xor eax, eax
jmp 0x405495
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405480
sub eax, edx
sar eax, 1
js 0x404f96
cmp eax, dword [esi - 8]
jg 0x404f96
mov dword [esi - 0xc], eax
mov word [esi + eax*2], bx
cmp dword [esi - 0xc], ebx
jge 0x4054af
or eax, 0xffffffff
jmp 0x4054ca
push 0x452dcc
push esi
call fcn.0042f51b
add esp, 8
cmp eax, ebx
jne 0x4054c6
or eax, 0xffffffff
jmp 0x4054ca
sub eax, esi
sar eax, 1
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call fcn.00406020
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x204], 0xa
call fcn.00406510
mov byte [esp + 0x200], 9
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405513
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x452dd0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639b0
mov byte [esp + 0x204], 0xb
call fcn.00406510
mov byte [esp + 0x200], 9
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405565
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4639b0]
push ebx
push ecx
lea ecx, [esp + 0x4c]
call fcn.0041a941
test eax, eax
jne 0x405588
mov edx, dword [0x4639b0]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.004115c0
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4055a2
push 0x80004005
call fcn.00401080
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
push 7
push str.http:__
lea ecx, [esp + 0x24]
mov byte [esp + 0x208], 0xc
call fcn.00402f90
call fcn.004115c0
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4055e4
push 0x80004005
call fcn.00401080
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x200], 0xd
mov eax, dword [0x463998]
sub eax, ebx
lea ecx, [esp + 0x20]
je 0x405625
sub eax, 1
je 0x40561c
sub eax, 1
jne 0x405625
push 0xe
push 0x452e5c
jmp 0x40562c
push 0xd
push 0x452e40
jmp 0x40562c
push 0xd
push 0x452e24
call fcn.00402f90
call fcn.004115c0
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40564b
push 0x80004005
call fcn.00401080
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x5c]
push ecx
push 0x202
mov byte [esp + 0x208], 0xe
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jne 0x40576b
mov eax, dword [0x463998]
sub eax, 0
je 0x4056a1
sub eax, 1
je 0x40569a
sub eax, 1
jne 0x4056a1
push str.new.yxdown.com
jmp 0x4056a6
push str.new.newyx.net
jmp 0x4056a6
push str.new.wanyx.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x405712
mov esi, dword [ebx]
mov edi, str.sz.redirect.local
mov ecx, 0x12
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4056c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4056f7
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x38]
push str._d._d._d._d
push eax
call fcn.004012d0
add esp, 0x18
mov esi, dword [ebx]
mov edi, str.sz.redirect.local
mov ecx, 0x12
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40570e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405753
push str.www.ppzy.net
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x405753
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
movzx edx, byte [eax + 3]
movzx ecx, byte [eax + 2]
push edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x38]
push str._d._d._d._d
push ecx
call fcn.004012d0
add esp, 0x18
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp dword [esp + 0x10], 0
mov edi, dword [esp + 0x28]
je 0x40576b
mov eax, dword [edi - 0xc]
push eax
push edi
jmp 0x405774
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00402f90
mov eax, dword [0x463998]
sub eax, 0
je 0x4059bd
sub eax, 1
je 0x4058fc
sub eax, 1
je 0x40583b
push 0x452ee8
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a0
mov byte [esp + 0x204], 0x15
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4057ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xf
push str.wanyxmodule.exe
mov ecx, 0x4639a4
call fcn.00401700
push str.Program_Fileswanyx_
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a8
mov byte [esp + 0x204], 0x16
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x3c]
jmp 0x405a56
push 0x452fd0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a0
mov byte [esp + 0x204], 0x13
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40588d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Program_Filesyxdown_
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a8
mov byte [esp + 0x204], 0x14
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4058df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x10
push str.yxdownmodule.exe
mov ecx, 0x4639a4
call fcn.00401700
push 0x10
push str.yxdownupdate.exe
jmp 0x405a79
push 0x452f5c
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a0
mov byte [esp + 0x204], 0x11
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40594e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Program_Files_newyx_
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a8
mov byte [esp + 0x204], 0x12
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4059a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xf
push str.newyxmodule.exe
mov ecx, 0x4639a4
call fcn.00401700
push 0xf
push str.newyxupdate.exe
jmp 0x405a79
push 0x452ee8
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a0
mov byte [esp + 0x204], 0xf
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xf
push str.wanyxmodule.exe
mov ecx, 0x4639a4
call fcn.00401700
push str.Program_Fileswanyx_
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00406160
add esp, 0xc
push eax
mov ecx, 0x4639a8
mov byte [esp + 0x204], 0x10
call fcn.00406510
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xf
push str.wanyxupdate.exe
mov ecx, 0x4639ac
call fcn.00401700
cmp dword [0x46399c], 0
je 0x405d51
push 0x4639a4
lea ecx, [esp + 0x28]
push 0x4639a8
push ecx
call fcn.004060a0
add esp, 0xc
mov byte [esp + 0x200], 0x17
mov eax, dword [eax]
push 0
push eax
lea ecx, [esp + 0x4c]
call fcn.0041a941
mov esi, eax
mov byte [esp + 0x200], 0xe
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405ae7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x405d51
call fcn.004115c0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x405b09
push 0x80004005
call fcn.00401080
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov bl, 0x18
mov byte [esp + 0x200], bl
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x100
or eax, ecx
jge 0x405b48
push 0x100
lea ecx, [esp + 0x14]
call fcn.00401100
mov esi, dword [esp + 0x10]
push 0x100
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test esi, esi
jne 0x405b5e
xor eax, eax
jmp 0x405b78
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405b63
sub eax, edx
sar eax, 1
js 0x404f96
cmp eax, dword [esi - 8]
jg 0x404f96
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
mov dword [esi - 0xc], eax
push str.FileVersion
mov word [esi + eax*2], 0
call fcn.00401310
push ecx
mov ecx, esp
mov byte [esp + 0x208], 0x19
mov dword [esp + 0x34], esp
push 0x4639a4
push 0x4639a8
push ecx
call fcn.004060a0
add esp, 0xc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x208], bl
call fcn.00410a90
add esp, 4
mov byte [esp + 0x204], 0x1a
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FileVersion
call fcn.00401310
push ecx
mov byte [esp + 0x208], 0x1b
lea eax, [esi - 0x10]
mov dword [esp + 0x34], esp
mov edi, esp
push eax
call fcn.00401260
add eax, 0x10
mov dword [edi], eax
add esp, 4
lea ecx, [esp + 0x38]
mov byte [esp + 0x208], 0x1a
call fcn.00410a90
mov bl, 0x1c
mov byte [esp + 0x208], bl
mov eax, dword [esp + 0x2c]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.00401260
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x208], 0x1d
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov dword [esp + 0x34], esp
mov edi, esp
push eax
call fcn.00401260
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x208], bl
call fcn.00410d50
add esp, 8
cmp eax, 1
jne 0x405cfb
push 0x4639a4
lea edx, [esp + 0x18]
push 0x4639a8
push edx
call fcn.004060a0
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405cb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x4639a4
lea ecx, [esp + 0x18]
push 0x4639a8
push ecx
call fcn.004060a0
mov edx, dword [eax]
add esp, 0xc
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405cfb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00405e90
push 0x4639a4
lea ecx, [esp + 0x18]
push 0x4639a8
push ecx
call fcn.004060a0
mov edx, dword [eax]
add esp, 0xc
push 1
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405d4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call fcn.0042f48f
push 0x1a
push str.Intel_Core_i5_750_2.66GHz_
mov ecx, 0x463978
call fcn.00401700
push 0xd
push str.DDR3_1333_4GB
mov ecx, 0x46397c
call fcn.00401700
push 0x1a
push str.NVIDIA_GeForce_GTS_250_1GB
mov ecx, 0x463974
call fcn.00401700
push 0xa
push str.Windows_XP
mov ecx, 0x463970
call fcn.00401700
push 0xd
push str.DDR3_1333_4GB
mov ecx, 0x46397c
call fcn.00401700
push 0x1d
push str.DirectX_9.0C__4.09.0000.0904_
mov ecx, 0x463980
call fcn.00401700
lea eax, [edi - 0x10]
mov byte [esp + 0x200], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405ddb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x200], 0xc
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405e03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x200], 9
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405e2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x200], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405e53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x200], 0xffffffff
call fcn.0041a8d9
mov ecx, dword [esp + 0x1f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1e0]
xor ecx, esp
call fcn.0042eae0
mov esp, ebp
pop ebp
ret