Function at 0x401ce0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Query or enumerate registry value
Read .ini file
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x403538
mov eax, dword fs:[0]
push eax
sub esp, 0xd70
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0xd68], eax
push ebx
push esi
push edi
mov eax, dword [0x407018]
xor eax, esp
push eax
lea eax, [esp + 0xd80]
mov dword fs:[0], eax
call sub.mfc90.dll_Ordinal_4993
push 0
push 0
push 0
push 0x401960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x104
lea ecx, [esp + 0x748]
push 0
push ecx
mov dword [esp + 0x28], eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x958]
push 0
push edx
call sub.MSVCR90.dll_memset
xor eax, eax
add esp, 0xc
push 0x104
push eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov word [esp + 0x138], ax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov word [esp + 0x144], ax
lea eax, [esp + 0x32c]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x538]
push 0
push ecx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push str.SoftwareVTCLauncher
push 0x80000001
mov dword [esp + 0x2c], 0x104
call edi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x328]
push ecx
push 0
push 0
push str.path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x324]
push eax
lea ecx, [esp + 0x748]
push str._sAudition.exe
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x324]
push edx
lea eax, [esp + 0x958]
push str._sVTCGame.exe
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x324]
push ecx
lea edx, [esp + 0x538]
push str._s_version.xml
push edx
call ebx
add esp, 0xc
push 1
push 0x40
push 1
lea eax, [esp + 0x540]
push eax
lea ecx, [esp + 0x8c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int__int_]
push 0xa
push 0xc8
lea ecx, [esp + 0x84]
mov dword [esp + 0xd90], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::ignore_int__int_]
push 0xa
push 0x64
lea ecx, [esp + 0x84]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::ignore_int__int_]
lea ecx, [esp + 0x10c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x80]
push edx
mov byte [esp + 0xd90], 1
call dword [sym.imp.MSVCP90.dll_class_std::basic_istream_char__struct_std::char_traits_char______cdecl_std::operator___char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_istream_char__struct_std::char_traits_char_____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____]
mov eax, dword [esp + 0x118]
add esp, 8
cmp dword [esp + 0x124], 0x10
jae 0x401f05
lea eax, [esp + 0x110]
add eax, 9
push eax
lea eax, [esp + 0x138]
push str._.4s
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0xa
lea edx, [esp + 0x130]
push edx
push str._version_LoadVersion.php_g_ver1
call fcn.00401c30
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
movzx esi, al
mov eax, dword [esp + 0x20]
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_ntdll
push 0x80000001
mov byte [esp + eax + 0x13c], 0
mov dword [esp + 0x28], 0x104
call edi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x2c0]
push eax
push 0
push 0
push 0x404858
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x2bc]
push edx
lea eax, [esp + 0xb68]
push str._kcheckonl.php_gk_slgoutoffline
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x64
lea edx, [esp + 0x25c]
push edx
lea eax, [esp + 0xb70]
push eax
call fcn.00401c30
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov byte [esp + ecx + 0x254], 0
test esi, esi
je 0x4022eb
lea esi, [esp + 0x128]
lea eax, [esp + 0x134]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x402002
test cl, cl
je 0x401ffe
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x402002
add eax, 2
add esi, 2
test cl, cl
jne 0x401fe2
xor eax, eax
jmp 0x402007
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402024
push 0
push 0
push str.CLEAN_and_Update_Audition_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x44
lea edx, [esp + 0x38]
push 0
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareVTCLauncher
push 0x80000001
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x28], 0x104
call edi
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x430]
push edx
push 0
push 0
push str.Path
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 4]
test eax, eax
je 0x40201c
cmp dword [ecx + 8], 0
je 0x40201c
cmp dword [ecx + 0xc], 0
je 0x40201c
push 3
lea ecx, [esp + 0x154]
push eax
lea eax, [esp + 0x154]
mov dword [esp + 0x154], ecx
call fcn.00402530
sub esp, 0x84
mov edi, esp
lea edx, [esp + 0x6c0]
push 0x40490c
mov ecx, 0x21
lea esi, [esp + 0x1d4]
push edx
rep movsd dword es:[edi], dword [esi]
call ebx
mov eax, dword [esp + 0x1d8]
lea ecx, [esp + 0x1dc]
add esp, 0x8c
cmp eax, ecx
je 0x4020f9
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
push 3
lea edx, [esp + 0x154]
push ecx
lea eax, [esp + 0x154]
mov dword [esp + 0x154], edx
call fcn.00402530
sub esp, 0x84
mov edi, esp
lea edx, [esp + 0xae0]
push 0x40490c
mov ecx, 0x21
lea esi, [esp + 0x1d4]
push edx
rep movsd dword es:[edi], dword [esi]
call ebx
mov eax, dword [esp + 0x1d8]
lea ecx, [esp + 0x1dc]
add esp, 0x8c
cmp eax, ecx
je 0x402164
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xc]
push 3
lea edx, [esp + 0x154]
push ecx
lea eax, [esp + 0x154]
mov dword [esp + 0x154], edx
call fcn.00402530
sub esp, 0x84
mov edi, esp
lea edx, [esp + 0x8d0]
push 0x40490c
mov ecx, 0x21
lea esi, [esp + 0x1d4]
push edx
rep movsd dword es:[edi], dword [esi]
call ebx
mov eax, dword [esp + 0x1d8]
lea ecx, [esp + 0x1dc]
add esp, 0x8c
cmp eax, ecx
je 0x4021cf
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov esi, str._T3ENTER
lea eax, [esp + 0x63c]
jmp 0x4021e0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x402200
test cl, cl
je 0x4021fc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x402200
add eax, 2
add esi, 2
test cl, cl
jne 0x4021e0
xor eax, eax
jmp 0x402205
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40201c
push str..config.ini
push 0xa
lea edx, [esp + 0x148]
push edx
push 0x40492c
push str.WINMODE
push str.CONFIG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
lea eax, [esp + 0x42c]
push eax
lea ecx, [esp + 0x150]
push str._sconfig.ini
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x84c]
push edx
lea eax, [esp + 0xa60]
push eax
lea ecx, [esp + 0x644]
push ecx
lea edx, [esp + 0x438]
push edx
lea eax, [esp + 0xc7c]
push str._sAudition.exe__s__s__s
push eax
call ebx
add esp, 0x18
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x434]
push eax
push 0
push 4
push 0
push 0
push 0
lea ecx, [esp + 0xc8c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x144]
push eax
push str.WINMODE
push str.CONFIG
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, dword [esp + 0x24]
call fcn.00401120
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push str.Cant_connect_to_SERVER__please_try_again
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]