Function at 0x401000
Capabilities:
Create thread
Read .ini file

Disassembly:
sub esp, 0x170
push ebx
push ebp
push esi
lea eax, [esp + 0x7c]
push edi
push eax
call fcn.00402560
mov edi, str.admin.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x80]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x80]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x64]
push 0x1e
push ecx
push str.8080
push str.WebPort
push str.SERVERINFO
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x60]
push edx
call fcn.00403163
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, str.sanxiaweb
add esp, 4
mov dword [esp + 0x18], eax
mov dword [0x183d550], 0
mov dword [esp + 0x14], edi
lea eax, [esp + 0x80]
push eax
call fcn.00402560
or ecx, 0xffffffff
xor eax, eax
add esp, 4
lea edx, [esp + 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x80]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x80]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40119d
push str.MD_Load
push esi
call ebp
push str.MD_BuildReloadLogin
push esi
mov edi, eax
call ebp
lea ecx, [esp + 0x10]
mov dword [0x183d954], eax
push ecx
push 0x183bcd0
mov dword [esp + 0x18], 0
call edi
mov ebx, dword [0x183d550]
mov ecx, dword [esp + 0x18]
add esp, 8
cmp ebx, ecx
mov dword [esp + 0x1c], eax
jge 0x40118f
lea edx, [ebx + ebx*2]
shl edx, 4
add edx, ebx
lea edi, [edx*4 + 0x183bd90]
lea eax, [edi - 0x40]
push eax
push esi
call ebp
mov dword [edi], eax
mov eax, dword [0x183d550]
inc eax
inc ebx
mov dword [0x183d550], eax
mov eax, dword [esp + 0x10]
add edi, 0xc4
cmp ebx, eax
jl 0x401168
mov eax, dword [esp + 0x1c]
test eax, eax
jl 0x4012b8
jle 0x40119d
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x14]
add edi, 0x40
cmp edi, str.WEB_SERVER_PROCESS__d
mov dword [esp + 0x14], edi
jl 0x401096
mov eax, 0x4222d0
mov dword [eax], 0xffffffff
add eax, 0x28f8
cmp eax, 0x43bc80
jl 0x4011b9
mov ecx, dword [esp + 0x18]
mov dword [0x183bcc0], 0
push ecx
push 0
mov dword [0x183bc90], 1
call fcn.00402670
mov ebp, eax
add esp, 8
cmp ebp, 0xffffffff
je 0x4012b8
push 0x183bca8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
push eax
lea edx, [esp + 0x24]
push str.WEB_SERVER_ACCEPT__d
push edx
call fcn.00403086
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
push 1
push 0
call edi
mov dword [0x183bcc4], eax
call esi
push eax
lea ecx, [esp + 0x24]
push str.WEB_SERVER_PROCESS__d
push ecx
call fcn.00403086
add esp, 0xc
lea edx, [esp + 0x20]
push edx
push 0
push 1
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x183bcc8], eax
mov dword [0xe3bc80], ebp
mov esi, 5
push 0
push 0
push ebp
push 0x4013e0
push 0
push 0
call ebx
dec esi
jne 0x40126f
xor edi, edi
mov esi, 0x183bc94
push 0
push 0
push edi
push 0x4016b0
push 0
push 0
mov dword [esi], 0xffffffff
call ebx
add esi, 4
inc edi
cmp esi, 0x183bca8
jl 0x401289
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x170
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x170
ret