Function at 0x401700
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path
Initialize winsock library
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x734
mov eax, dword [0x418310]
xor eax, esp
mov dword [esp + 0x730], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401758
push eax
push str.Unable_to_load_winsock:__d_n
call fcn.00406b4c
add esp, 8
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x1f400
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x419c50
mov dword [0x419c74], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.004053e0
mov dword [0x419c70], eax
test eax, eax
jne 0x4017e5
push str.LoadUpdateProviderFunction_Error_
call fcn.00406b4c
mov eax, dword [0x419c70]
add esp, 4
test eax, eax
je 0x4017a2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x419c74]
test eax, eax
je 0x4017bc
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [0x419c74], 0
push 0x419c50
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
push 0x414e30
push esi
call fcn.00406c11
add esp, 8
cmp eax, esi
jne 0x4019f3
push 0x104
lea ecx, [esp + 0x324]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...conf_setting.ini
lea edx, [esp + 0x324]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x320]
push eax
push 0x104
lea ecx, [esp + 0x530]
push ecx
push 0x414f74
push str.linkurl
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 7
lea edx, [esp + 0x52c]
push str.http:__
push edx
call fcn.00406de3
add esp, 0xc
test eax, eax
jne 0x4018a3
push 5
push eax
push eax
lea eax, [esp + 0x534]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
mov cl, 6
push 0x64
mov byte [esp + 0x19d], cl
mov byte [esp + 0x1a3], cl
mov al, 0x41
lea ecx, [esp + 0x2bc]
push 0
push ecx
mov byte [esp + 0x1a4], 0xa6
mov byte [esp + 0x1a6], 4
mov byte [esp + 0x1a7], al
mov byte [esp + 0x1a8], 0x28
mov byte [esp + 0x1a9], 0x59
mov byte [esp + 0x1aa], 0xf9
mov byte [esp + 0x1ac], 0xa
mov byte [esp + 0x1ad], 0x6c
mov byte [esp + 0x1ae], 0x86
mov byte [esp + 0x1af], 0xee
mov byte [esp + 0x1b0], 0x39
mov byte [esp + 0x1b1], 0x65
mov byte [esp + 0x1b2], al
mov byte [esp + 0x1b3], 0x66
mov byte [esp + 0x1b4], 0xd9
mov byte [esp + 0x1b5], 0x17
mov byte [esp + 0x1b6], 0xe4
mov byte [esp + 0x1b7], 0x60
mov byte [esp + 0x1b8], 0x45
call fcn.00408200
add esp, 0xc
lea edx, [esp + 0x2b8]
push edx
lea eax, [esp + 0x19c]
push eax
call fcn.00405d50
add esp, 8
push 3
lea edx, [esp + 0x2bc]
lea ecx, [esp + 0x1b8]
push edx
lea eax, [esp + 0x1b8]
mov dword [esp + 0x1b8], ecx
call fcn.00401e30
mov eax, dword [esp + 0x1b0]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x1b0]
lea ecx, [esp + 0x1b4]
cmp eax, ecx
je 0x4019d1
push eax
call fcn.00406f57
add esp, 4
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
push 2
push 0x414e9c
push esi
call fcn.00406de3
add esp, 0xc
test eax, eax
jne 0x401aec
call fcn.00401340
call fcn.004010b0
sub esp, 0x1c
mov esi, eax
mov eax, str.InstallLSP
mov ecx, esp
mov dword [esp + 0x20], esp
call fcn.00401d40
sub esp, 0x1c
mov dword [esp + 0x3c], esp
mov ecx, esp
test esi, esi
jne 0x401a91
mov eax, str.success
call fcn.00401d40
sub esp, 0x1c
mov eax, 0x414f74
mov ecx, esp
mov dword [esp + 0x58], esp
call fcn.00401d40
sub esp, 0x1c
mov eax, str.InstallLsp
mov ecx, esp
mov dword [esp + 0x74], esp
call fcn.00401d40
call fcn.004057f0
push str.Install_Success_
call fcn.00406b4c
add esp, 0x74
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
mov eax, str.fail
call fcn.00401d40
sub esp, 0x1c
mov eax, 0x414f74
mov ecx, esp
mov dword [esp + 0x58], esp
call fcn.00401d40
sub esp, 0x1c
mov eax, str.InstallLsp
mov ecx, esp
mov dword [esp + 0x74], esp
call fcn.00401d40
call fcn.004057f0
push esi
push str.Install_Fail__Error_Code:_d
call fcn.00406b4c
add esp, 0x78
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
push 2
push 0x414f08
push esi
call fcn.00406de3
add esp, 0xc
test eax, eax
jne 0x401c5f
call fcn.00401340
sub esp, 0x1c
mov esi, eax
mov eax, str.InstallLSP
mov ecx, esp
mov dword [esp + 0x20], esp
call fcn.00401d40
sub esp, 0x1c
mov dword [esp + 0x3c], esp
mov ecx, esp
test esi, esi
jne 0x401c04
mov eax, str.Success
call fcn.00401d40
sub esp, 0x1c
mov eax, 0x414f74
mov ecx, esp
mov dword [esp + 0x58], esp
call fcn.00401d40
sub esp, 0x1c
mov eax, str.UnInstallLsp
mov ecx, esp
mov dword [esp + 0x74], esp
call fcn.00401d40
call fcn.004057f0
push str.UnInstall_Success_
call fcn.00406b4c
add esp, 0x74
push 0x104
lea edx, [esp + 0x324]
push esi
push edx
call fcn.00408200
add esp, 0xc
push 0x104
lea eax, [esp + 0x1b4]
push esi
push eax
call fcn.00408200
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1b4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.AcSpi32.dll
lea edx, [esp + 0x1b4]
push edx
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x324]
call fcn.00401c90
mov ecx, eax
call fcn.00405c20
lea eax, [esp + 4]
call fcn.00401d20
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
mov eax, str.Fail
call fcn.00401d40
sub esp, 0x1c
mov eax, 0x414f74
mov ecx, esp
mov dword [esp + 0x58], esp
call fcn.00401d40
sub esp, 0x1c
mov eax, str.UnInstallLsp
mov ecx, esp
mov dword [esp + 0x74], esp
call fcn.00401d40
call fcn.004057f0
push esi
push str.UnInstall_Fail__Error_Code:_d
call fcn.00406b4c
add esp, 0x78
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10
push 2
push 0x414f6c
push esi
call fcn.00406de3
add esp, 0xc
test eax, eax
jne 0x401c78
call fcn.00401370
mov ecx, dword [esp + 0x734]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.00406b3d
mov esp, ebp
pop ebp
ret 0x10