Function at 0x406cb0
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows
Create thread
Delete file
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0c96
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x4d9700]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
push esi
push edi
mov eax, dword [0x4d9700]
xor eax, esp
push eax
lea eax, [esp + 0x4a8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00461801
xor eax, eax
mov dword [ebx + 0x12323], eax
mov dword [ebx + 0x12327], eax
mov dword [ebx + 0x1232b], eax
mov dword [ebx + 0x1232f], eax
mov dword [ebx + 0x12333], eax
mov dword [ebx + 0x12337], eax
mov dword [ebx + 0x1233b], eax
push eax
mov dword [ebx + 0x1233f], eax
mov eax, dword [ebx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00469ae8
mov esi, eax
test esi, esi
je 0x406de3
call fcn.0046416b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406d5e
push 0x80004005
call fcn.00405a40
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push 0x65
mov dword [esp + 0x4b4], 0
call fcn.00469be0
test eax, eax
je 0x406d94
push 0x65
push eax
lea ecx, [esp + 0x1c]
call fcn.0040b9d0
mov edi, dword [esp + 0x14]
cmp dword [edi - 0xc], 0
je 0x406dbc
mov ecx, dword [esi + 4]
push 0
push 0
push 0x800
push ecx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov edx, dword [esi + 4]
push edi
push 0x10
push 0
push edx
call dword [sym.imp.USER32.dll_AppendMenuA]
add edi, 0xfffffff0
mov dword [esp + 0x4b0], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406de3
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, dword [ebx + 0xcd85]
mov ecx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov edi, 1
push edi
push 0x80
push ecx
call esi
mov eax, dword [ebx + 0xcd85]
mov edx, dword [ebx + 0x20]
push eax
push 0
push 0x80
push edx
call esi
xor eax, eax
mov dword [esp + 0x2c], eax
push str.Unity_1129
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
push edi
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x34], 0xc
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebx + 0x1231f], eax
test eax, eax
je 0x406e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406e69
mov ecx, ebx
call fcn.004614d8
mov eax, edi
jmp 0x40748b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 0x18]
call fcn.0040b830
mov dword [esp + 0x4b0], edi
mov ecx, dword [esp + 0x14]
push 0x4cb9b4
push ecx
call fcn.0047cb8e
add esp, 8
test eax, eax
sete al
test al, al
jne 0x406f69
mov edx, dword [esp + 0x14]
push 0x4cb850
push edx
call fcn.0047cb8e
add esp, 8
test eax, eax
sete al
test al, al
jne 0x406f69
push 4
push 0x4cb9b8
push 0x4cb9c0
mov ecx, ebx
call fcn.0045c07f
cmp eax, 6
jne 0x406f9f
push 0x40
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x40], 0x44
call fcn.0047e5b0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push str.show
mov ecx, edi
push 0x4cb9f0
mov dword [esp + 0x88], edi
mov word [esp + 0x8c], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406f3e
push eax
push eax
push 0x4cb9fc
mov ecx, ebx
call fcn.0045c07f
jmp 0x406f9f
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov ecx, ebx
call fcn.004614d8
lea ecx, [esp + 0x14]
call fcn.00405850
mov eax, edi
jmp 0x40748b
mov eax, dword [esp + 0x14]
push 0x4cb850
push eax
call fcn.0047cb8e
add esp, 8
test eax, eax
sete al
push 0
test al, al
je 0x406f92
mov ecx, dword [ebx + 0x20]
push edi
push 0x401
push ecx
jmp 0x406f9d
mov edx, dword [ebx + 0x20]
push 0
push 0x401
push edx
call esi
mov dword [esp + 0x4b0], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406fca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x104
lea ecx, [esp + 0x188]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x184]
push 0x5c
push edx
call fcn.0047c6b0
add esp, 8
test eax, eax
je 0x406ff8
mov byte [eax], 0
push str.conf.ini
lea eax, [esp + 0x188]
push 0x104
push eax
call fcn.0047bf1b
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
lea ecx, [esp + 0x184]
push ecx
push 0x104
lea edx, [esp + 0x39c]
push edx
push 0x4cb223
push str.GamePath
push 0x4cba54
call esi
lea eax, [esp + 0x394]
push eax
push 0x3ee
mov ecx, ebx
call fcn.0046087d
lea ecx, [esp + 0x184]
push ecx
push 0x20
lea edx, [ebx + 0xcc60]
push edx
push 0x4cb223
push str.SvrName
push 0x4cba54
call esi
push 0x1fc
lea esi, [ebx + 0x12347]
push 0
push esi
call fcn.0047e5b0
mov eax, dword [ebx + 0x20]
add esp, 0xc
push str.cnapk
mov dword [ebx + 0x1234b], eax
mov eax, dword [ebx + 0xcd85]
lea ecx, [ebx + 0x1235f]
push 0x80
push ecx
mov dword [ebx + 0x1234f], 0x80
mov dword [ebx + 0x12353], 7
mov dword [ebx + 0x12357], 0x7e8
mov dword [ebx + 0x1235b], eax
call fcn.0047bf8f
add esp, 0xc
push esi
push 0
mov dword [esi], 0x1fc
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
cmp dword [ebx + 0xcda9], 0
jne 0x40734d
push 0
push 0
push 0x4cba6c
push 0
lea esi, [ebx + 0x125f3]
push edi
mov ecx, esi
call fcn.00464467
push 0
push 0
push 0x4cba78
push edi
push edi
mov ecx, esi
call fcn.00464467
push 0
push 0
push 0x4cba80
push 2
push edi
mov ecx, esi
call fcn.00464467
push 0
push 0
push 0x4cba88
push 3
push edi
mov ecx, esi
call fcn.00464467
push 0
push 0
push 0x4cba94
push 4
push edi
mov ecx, esi
call fcn.00464467
mov esi, dword [ebx + 0x1209b]
lea edi, [ebx + 0x1209b]
push 0x3fa
mov ecx, ebx
add esi, 0x13c
call fcn.00460800
mov edx, dword [esi]
push eax
push 0x81
mov ecx, edi
call edx
mov esi, dword [ebx + 0x1216b]
push 0x3fa
mov ecx, ebx
add esi, 0x13c
call fcn.00460800
push eax
mov eax, dword [esi]
push 0x85
lea ecx, [ebx + 0x1216b]
call eax
mov esi, dword [ebx + 0x12243]
push 0x3fa
mov ecx, ebx
add esi, 0x13c
call fcn.00460800
mov edx, dword [esi]
push eax
push 0x83
lea ecx, [ebx + 0x12243]
call edx
mov esi, dword [ebx + 0xce9d]
push 0x3fa
mov ecx, ebx
add esi, 0x13c
call fcn.00460800
push eax
mov eax, dword [esi]
push 0x8d
lea ecx, [ebx + 0xce9d]
call eax
mov eax, dword [ebx + 0xcd89]
lea esi, [ebx + 0xcd89]
add eax, 0x13c
mov dword [esp + 0x14], eax
push 0x3fa
mov ecx, ebx
call fcn.00460800
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx]
push 0x8e
mov ecx, esi
call eax
push 0
push 0
push 0
push 0
push 0
push str.http:__www.rexuexiaoniao.com_wgupdata.html
mov ecx, esi
call fcn.0046aab9
mov ecx, dword [ebx + 0xcdfd]
mov edx, dword [ecx + 8]
lea eax, [ebx + 0xcdfd]
push eax
call edx
mov ecx, dword [ebx + 0x12613]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
add dword [esp + 0x1c], 0x17
mov edx, dword [esp + 0x18]
sub eax, 2
mov dword [esp + 0x24], eax
sub eax, dword [esp + 0x1c]
sub ecx, 2
push 1
inc edx
push eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
sub ecx, edx
push ecx
push eax
push edx
mov ecx, esi
mov dword [esp + 0x2c], edx
call fcn.004609a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xce9d]
call fcn.004609a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, edi
call fcn.004609a0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub ecx, eax
push 1
push ecx
mov ecx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x1216b]
call fcn.004609a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x12243]
call fcn.004609a0
push 1
mov ecx, esi
call fcn.004609e0
mov eax, dword [ebx + 0x12613]
push 0
push 0
push 0x130c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x104
lea ecx, [esp + 0x80]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x7c]
push 0x5c
push edx
call fcn.0047c6b0
add esp, 8
test eax, eax
je 0x407378
mov byte [eax], 0
push str.Unity.exe
lea eax, [esp + 0x80]
push eax
push str._s_s
lea ecx, [esp + 0x298]
push 0x104
push ecx
call fcn.0047c074
add esp, 0x14
lea edx, [esp + 0x28c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esi, [esp + 0x7c]
call fcn.00407f30
push 0
call fcn.0047beca
add esp, 4
push eax
call fcn.0047be96
add esp, 4
xor esi, esi
jmp 0x4073d0
call fcn.0047bea8
cdq
mov ecx, 0x1a
idiv ecx
lea edi, [ebx + 0x12323]
inc esi
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add al, 0x41
cmp esi, 8
mov byte [edi + esi - 1], al
jl 0x4073d0
push str..dll
push 0x20
push edi
call fcn.0047bf1b
add esp, 0xc
push edi
lea edx, [esp + 0x80]
push edx
push str._s_s
lea eax, [esp + 0x298]
push 0x104
push eax
call fcn.0047c074
add esp, 0x14
push str.zzr.zzr
lea ecx, [esp + 0x80]
push 0x104
push ecx
call fcn.0047bf1b
add esp, 0xc
lea edx, [esp + 0x28c]
push edx
lea eax, [esp + 0x80]
push eax
call fcn.00407de0
mov ecx, dword [ebx + 0x20]
push 0
push 0xbb8
push 0
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00408030
push ebx
push 0
push 0x407ad0
call fcn.0047c1b4
mov dword [ebx + 0x12317], eax
add esp, 0xc
mov eax, 1
mov ecx, dword [esp + 0x4a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x490]
xor ecx, esp
call fcn.0047bc57
mov esp, ebp
pop ebp
ret