Function at 0x422f90
Capabilities:
Allocate or change rwx memory
Create directory
Create thread
Execute shellcode via indirect call
Get common file path
Get file attributes
Get graphical window text
Read .ini file
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a04d8
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x4be014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x834], ebx
jmp 0x422fd8
call dword [sym.imp.mfc140u.dll_CDialog::OnInitDialog]
push 0x420930
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.mfc140u.dll_CMenu::FromHandle]
mov edi, eax
test edi, edi
je 0x423064
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x65
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
mov eax, dword [ebp - 0x818]
cmp dword [eax - 0xc], 0
je 0x423051
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
push 0x800
push dword [edi + 4]
call esi
push dword [ebp - 0x818]
push 0x10
push 0
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
call fcn.00422ef0
push dword [ebx + 0xd0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xd0]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
push 0
push 0
push 0x1037
push dword [ebx + 0xf4]
call esi
or eax, 0x20
push eax
push 0
push 0x1036
push dword [ebx + 0xf4]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CListCtrl::InsertColumn]
lea edi, [ebx + 0xd4]
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b41bc
push 0
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b41c4
push 1
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x14
push 0
push 0x4b41cc
push 2
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push str.:S_rg
push 3
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b41dc
push 4
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b41e4
push 5
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b41ec
push 6
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b41f4
push 7
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b41fc
push 8
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b4204
push 9
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b420c
push 0xa
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b4214
push 0xb
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b421c
push 0xc
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b4224
push 0xd
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x50
push 2
push str._m
push 0xe
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b4240
push 0xf
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x19
push 0
push 0x4b4258
push 0x10
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x64
push 0
push 0x4b426c
push 0x11
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x78
push 0
push 0x4b4278
push 0x12
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x78
push 0
push 0x4b4284
push 0x13
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b4290
push 0x14
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b4298
push 0x15
mov ecx, edi
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea ecx, [ebx + 0x1d4]
push 0x4b42a4
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x4b42a4
push 0
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b42ac
push 1
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b42b4
push 2
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b42bc
lea ecx, [ebx + 0x2e2c]
call edi
push 0x4b42bc
push 0
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b42c4
push 1
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b42cc
push 2
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b42d4
push 3
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b42dc
push 4
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b42e4
push 5
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0
push 0
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 1
push 1
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 2
push 2
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 3
push 3
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 4
push 4
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 5
push 5
push 0x151
push dword [ebx + 0x2e4c]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 0
call esi
lea ecx, [ebx + 0xaa4]
push 0
call esi
lea ecx, [ebx + 0xba4]
push 0
call esi
lea ecx, [ebx + 0x6a4]
push 0
call esi
lea ecx, [ebx + 0xa24]
push 0
call esi
lea ecx, [ebx + 0xca4]
push 0
call esi
lea ecx, [ebx + 0x172c]
push 0
call esi
lea ecx, [ebx + 0x1c2c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1bac]
call esi
lea ecx, [ebx + 0x1b2c]
push 0
call esi
lea ecx, [ebx + 0x112c]
push 0
call esi
lea ecx, [ebx + 0x142c]
push 0
call esi
lea ecx, [ebx + 0xea4]
push 0
call esi
lea ecx, [ebx + 0xf24]
push 0
call esi
lea ecx, [ebx + 0x1dac]
push 0
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
lea ecx, [ebx + 0x1bac]
push 0
call edi
lea ecx, [ebx + 0x24ac]
push 0
call esi
lea ecx, [ebx + 0x282c]
push 0
call esi
lea ecx, [ebx + 0x122c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1dac]
call esi
lea ecx, [ebx + 0x1eac]
push 0
call esi
push 0
lea ecx, [ebx + 0x122c]
call edi
mov eax, dword [ebx + 0x254]
add ebx, 0x254
mov esi, dword [ebp - 0x834]
mov ecx, ebx
push 0xe801
push 0x50008200
push 0
push esi
call dword [eax + 0x1b0]
lea eax, [ebp - 0x830]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x824]
mov ecx, ebx
push 1
push 0x19
push dword [ebp - 0x828]
add eax, 0xffffffe2
push eax
push 0
call dword [sym.imp.mfc140u.dll_CWnd::MoveWindow]
push 5
push str.efghi
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CStatusBar::SetIndicators]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::GetDlgCtrlID]
mov ecx, ebx
push 0x64
push 0x8000000
call edi
mov esi, dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneInfo]
mov ecx, ebx
push eax
push 0
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 1
mov ecx, ebx
call esi
push 0x1e
push 0x8000000
mov ecx, ebx
call edi
push eax
push 2
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 3
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 4
mov ecx, ebx
call esi
push 1
push 0
push 0
push 0
push 0
push 0xe8ff
push 0xe800
mov ecx, dword [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_CWnd::RepositionBars]
push 1
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
push str.D:LogInfo
mov dword [0x4c0f88], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x423578
push 0
push str.D:LogInfo
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x200
lea eax, [ebp - 0x410]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x820]
mov dword [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x200
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 2
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x814]
push str._sIPsET.ini
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0xc
push dword [ebp - 0x814]
push 0
push 0x4b4320
push 0x4b432c
call edi
mov ebx, dword [ebp - 0x834]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f24], eax
push 0
push 0x4b4334
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x4c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x4c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f84], eax
push 0
push 0x4b433c
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x544]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x544]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f14], eax
push 0
push str.Rf
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x744]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x744]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f1c], eax
push 0
push 0x4b4354
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x7c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x7c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fd4], eax
push 0
push 0x4b4360
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x844]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x844]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f80], eax
push 0
push 0x4b436c
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xb44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xb44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f7c], eax
push 0
push str.S__Y
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fd0], eax
push 0
push 0x4b4388
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0e28], eax
push 0
push 0x4b4390
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c1128], eax
push 0
push 0x4b4398
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xc44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xc44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f38], eax
push 0
push 0x4b43a0
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xe44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xe44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c113c], eax
push 0
push 0x4b30cc
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x134c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x134c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f6c], eax
push 0
push 0x4b43ac
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x13cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x13cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f90], eax
push 0
push 0x4b43bc
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x14cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c1134], eax
push 0
push 0x4b43c8
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x15cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x15cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0e3c], eax
push 0
push 0x4b43d4
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x374c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x374c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c1138], eax
push 0
push 0x4b43e0
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x27cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x27cc]
call esi
mov dword [0x4c0e44], eax
push dword [ebp - 0x814]
push 0
push 0x4b43ec
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x16cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x16cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c10e4], eax
push 0
push 0x4b43f8
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x8c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x8c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f30], eax
push 0
push str.R7R
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x264c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x264c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f28], eax
push 0
push 0x4b4414
push 0x4b432c
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x17cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x17cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c112c], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b4420
push 0x4b442c
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x162c]
call edi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b4438
push 0x4b4440
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2f2c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf1cc], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4450
push 0x4b4454
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x302c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c07f4], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4460
push 0x4b4464
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x312c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c07f0], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4470
push 0x4b4478
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x31ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf1d4], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4460
push 0x4b4484
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x33ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf1c8], eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b4460
push 0x4b4494
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x352c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4be730], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4470
push 0x4b44a0
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x36ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4be72c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b44ac
push 0x4b44b0
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x37ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4be734], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4460
push 0x4b44bc
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x32ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf188], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b44c8
push 0x4b44cc
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4c0e68], al
push 0
movzx eax, al
push eax
push 0x14e
push dword [ebx + 0x2e4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b44dc
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x18cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x18cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0e24], eax
push 1
push 0x4b44e8
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1a4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b44f4
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x28cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x28cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fa8], eax
push 0
push 0x4b4500
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x294c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x294c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fa0], eax
push 0
push 0x4b450c
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2a4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2a4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fc4], eax
push 0
push 0x4b4518
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fc0], eax
push 0
push 0x4b4524
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2c4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2c4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fbc], eax
push 0
push 0x4b4530
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f5c], eax
push 0
push 0x4b453c
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f60], eax
push 0
push 0x4b4548
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2dcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2dcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0e64], eax
push 0
push str.AwardOpt
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ecc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ecc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c10d8], eax
push 0
push 0x4b456c
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c1140], eax
push 0
push 0x4b4578
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x30cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x30cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0e34], eax
push 0
push 0x4b4580
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x324c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x324c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0fc8], eax
push 0
push 0x4b458c
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c10f8], eax
push 0
push 0x4b4598
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x334c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x334c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f58], eax
push 0
push 0x4b45a4
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x384c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x384c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c07ec], eax
push 0
push 0x4b45b4
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0a18], eax
push 0
push 0x4b45c0
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0e2c], eax
push 0
push 0x4b45cc
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x38cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x38cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c07e8], eax
push 0
push 0x4b45d8
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f18], eax
push 0
push 0x4b45e8
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x39cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x39cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c0f8c], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b4450
push 0x4b45f4
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x392c]
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
push 0
push 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x818]
mov eax, dword [ebp - 0x818]
push 0
push 0
push dword [eax - 0xc]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0
push 0
call edi
mov ecx, dword [ebp - 0x818]
mov esi, eax
push 0
push 0
push esi
push 0x4c07d4
push dword [ecx - 0xc]
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
push 0
call edi
lea ecx, [ebp - 0x818]
mov byte [esi + 0x4c07d4], 0
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b44ac
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4b4600
push 0x4b432c
call edi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf18c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push str.750000
push 0x4b4620
push 0x4b432c
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3aac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
mov dword [0x4bf250], eax
push 0
push 0
push 0xf0
push dword [ebx + 0x1a4c]
call edi
push dword [ebp - 0x814]
neg eax
push 0
sbb al, al
push 0x4b462c
add al, 2
push 0x4b432c
mov byte [0x4be4cf], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x64
jne 0x42451c
push 0
push 1
push 0xf1
push dword [ebx + 0x104c]
call edi
mov dword [0x4bf1d0], 0x64
jmp 0x424560
cmp eax, 0x12c
jne 0x424540
push 0
push 1
push 0xf1
push dword [ebx + 0x10cc]
call edi
mov dword [0x4bf1d0], 0x12c
jmp 0x424560
cmp eax, 0xa
jne 0x424560
push 0
push 1
push 0xf1
push dword [ebx + 0xfcc]
call edi
mov dword [0x4bf1d0], 0xa
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b3d18
push 0x4b4638
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x42459a
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b4644
push 0x4b4648
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4245e9
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x272c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf258], eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.20000
push 0x4b4660
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0xda4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b466c
push 0x4b4674
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x21ac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c0f54], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4644
push 0x4b4680
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x152c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf298], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4690
push 0x4b4698
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x9a4]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c0e54], eax
mov dword [0x4c07f8], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4460
push 0x4b46a0
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1e2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4be4ce], al
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b46ac
push 0x4b46b8
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x182c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c07d0], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b4690
push 0x4b46c4
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2b2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
add esp, 4
lea eax, [ebp - 0x210]
fstp qword [0x4bf1d8]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b46d0
push 0x4b46d8
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x192c]
call esi
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
lea eax, [ebp - 0x210]
push eax
call esi
add esp, 4
mov dword [0x4c07c8], eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x81c], 0
push eax
push 0x40
push 0x563
push dword [0x4bebe4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0042a8b0
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 3
mov byte [ebp - 4], 4
call dword [sym.imp.plfl32.dll_P_GetDataValue]
push eax
lea eax, [ebp - 0x818]
push 0x4b39fc
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push dword [ebp - 0x818]
call esi
add esp, 0x10
mov dword [0x4c10dc], eax
push 0
call dword [sym.imp.plfl32.dll_P_GetInfo]
push eax
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x818]
push 0x4b3220
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 1
call esi
push dword [ebp - 0x814]
push 0
push 0x4b46e4
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x644]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x644]
call edi
push 1
lea ecx, [ebx + 0xa24]
mov dword [0x4c10f0], eax
call esi
push 1
lea ecx, [ebx + 0xca4]
call esi
push 1
lea ecx, [ebx + 0x142c]
call esi
push dword [ebp - 0x814]
push 0
push str._rN9e
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x144c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x144c]
call edi
push dword [ebp - 0x814]
mov dword [0x4c0f40], eax
push 0
push 0x4b46fc
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xa44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xa44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c0f48], eax
push 0
push 0x4b4708
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xcc4]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xcc4]
call edi
mov dword [0x4c0f44], eax
mov eax, dword [0x4c10dc]
cmp eax, 2
jl 0x424a6d
push 1
lea ecx, [ebx + 0x1bac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1bac]
call esi
push 1
lea ecx, [ebx + 0x122c]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1dac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1eac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x122c]
call esi
push 1
lea ecx, [ebx + 0x1dac]
call esi
push 1
lea ecx, [ebx + 0x1eac]
call esi
mov eax, dword [0x4c10dc]
cmp eax, 5
jne 0x424ad8
push 1
lea ecx, [ebx + 0x1c2c]
call esi
push 1
lea ecx, [ebx + 0x6a4]
call esi
push 1
lea ecx, [ebx + 0x172c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b4710
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x174c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x174c]
call edi
mov dword [0x4c1130], eax
mov eax, dword [0x4c10dc]
cmp eax, 5
je 0x424aeb
cmp eax, 3
je 0x424aeb
cmp eax, 4
je 0x424aeb
cmp eax, 6
jne 0x424c58
push 1
lea ecx, [ebx + 0x1b2c]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.80000
push 0x4b4728
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1b2c]
call dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4bf28c], eax
lea ecx, [ebx + 0xd24]
push 1
call esi
push 1
lea ecx, [ebx + 0x112c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b4730
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xd44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xd44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c0f0c], eax
push 0
push 0x4b473c
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x114c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x114c]
call edi
push 1
lea ecx, [ebx + 0xea4]
mov dword [0x4c0fcc], eax
call esi
push 1
lea ecx, [ebx + 0xf24]
call esi
push 1
lea ecx, [ebx + 0x24ac]
call esi
push 1
lea ecx, [ebx + 0x282c]
call esi
push 1
lea ecx, [ebx + 0xea4]
call esi
push 1
lea ecx, [ebx + 0x202c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b4748
push 0x4b432c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x204c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x204c]
call edi
mov dword [0x4c0e58], eax
mov eax, dword [0x4c10dc]
cmp eax, 6
je 0x424c5d
cmp eax, 5
jne 0x424c87
push 1
lea ecx, [ebx + 0xaa4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xac4]
call edi
push 1
lea ecx, [ebx + 0xba4]
mov dword [0x4c0f78], eax
call esi
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
push 0
push 0x4c0a20
push 0
call esi
call fcn.00422ab0
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x424d1e
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x810]
push 0
push 0x10
push eax
push 0
call esi
lea eax, [ebp - 0x810]
push eax
push 0x4b4754
push 0x4c02b0
call fcn.0041da40
push 0
push 0
push 0
push 0x427060
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x424d4b
push 0x429330
push 0x2710
push 0x2767
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x422e90
push 0xfffffffffffffffc
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 0x4c0ed4
mov dword [0x4c02ac], eax
mov ecx, str.dxdir1.speed.qq.com
call fcn.00420b00
mov edx, 0x4c0ea0
mov ecx, str.wtdir1.speed.qq.com
call fcn.00420b00
mov edx, 0x4c0e6c
mov ecx, str.dx2dir1.speed.qq.com
call fcn.00420b00
mov ecx, 0x4c0ed4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x424d95
sub ecx, edx
je 0x424dcb
mov ecx, 0x4c0ea0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x424da8
sub ecx, edx
je 0x424dcb
mov ecx, 0x4c0e6c
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x424dc0
sub ecx, edx
jne 0x424ddf
push 0
push str.speed.qq.com
push 0x4b47b4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x424def
lea ecx, [ebp - 0x820]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004429bd
mov esp, ebp
pop ebp
ret