Function at 0x43c410
Capabilities:
Create process on windows
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e4462
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x5134a8]
xor eax, esp
mov dword [esp + 0x288], eax
push ebx
push esi
push edi
mov eax, dword [0x5134a8]
xor eax, esp
push eax
lea eax, [esp + 0x2a0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [eax + 0x108]
mov dword [esp + 0x28], eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x20], ebx
call eax
mov dword [esp + 0x2a8], 0
mov ecx, dword [ebx + 0x480]
mov edi, dword [sym.imp.LibDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov dword [esp + 0x18], ecx
lea esi, [ebx + 0x30]
push str.InstallNetCardLabel_tip
mov ecx, esi
call edi
push str.InstallCerLabel_tip
mov ecx, esi
mov dword [esp + 0x28], eax
call edi
push str.xfLabel_tip
mov ecx, esi
mov dword [esp + 0x24], eax
call edi
push 0x4feb80
lea ecx, [esp + 0x50]
mov dword [esp + 0x18], eax
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c4dd
mov ecx, ebx
call fcn.0043cce0
push 2
mov ecx, ebx
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CWindowWnd::Close_unsigned_int_]
jmp 0x43cc72
push str.copybtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c603
push str.view_richedit
mov ecx, esi
call edi
mov edx, dword [eax]
mov edx, dword [edx + 0x28]
lea ecx, [esp + 0xd4]
push ecx
mov ecx, eax
call edx
mov ecx, eax
mov byte [esp + 0x2a8], 1
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
lea ecx, [esp + 0x30]
call fcn.00455610
add esp, 4
lea ecx, [esp + 0xd4]
mov byte [esp + 0x2a8], 3
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43c5ad
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esp + 0x44]
inc ecx
push ecx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esp + 0x48], 0x10
mov ecx, dword [esp + 0x34]
jae 0x43c57f
lea ecx, [esp + 0x34]
mov edx, dword [esp + 0x44]
push ecx
inc edx
push edx
push eax
call fcn.00469e30
mov eax, dword [esp + 0x28]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x1c]
push ecx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push str.PasteLogLabel
mov ecx, esi
call edi
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xf8]
push 1
call eax
mov byte [esp + 0x2a8], 0
cmp dword [esp + 0x48], 0x10
jb 0x43c5e0
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00460a90
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.00401050
jmp 0x43cc72
push str.reset
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c6ad
push str.runopt
mov ecx, esi
call edi
push str.notsoft
mov ecx, esi
mov ebx, eax
call edi
push str.remepwdopt
mov ecx, esi
mov dword [esp + 0x18], eax
call edi
push str.autologinopt
mov ecx, esi
mov dword [esp + 0x1c], eax
call edi
mov edx, dword [ebx]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x1b0]
push 0
mov ecx, ebx
call eax
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1b0]
push 1
call eax
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1b0]
push 0
call eax
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1b0]
push 0
call eax
push str.lanlist
mov ecx, esi
call edi
mov edx, dword [eax + 0x698]
lea ecx, [eax + 0x698]
mov eax, dword [edx + 0xc]
push 0
push 0
call eax
jmp 0x43cc6e
push str.InstallNetCardBtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c704
mov ecx, dword [esp + 0x18]
add ecx, 0x1388
call fcn.004361e0
test eax, eax
je 0x43c6ef
mov eax, ebx
call fcn.0043d4c0
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4fec64
call eax
jmp 0x43cc72
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4fec78
call eax
jmp 0x43cc72
push str.UnInstallNetCardBtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c75b
mov ecx, dword [esp + 0x18]
add ecx, 0x1388
call fcn.00436530
test eax, eax
je 0x43c746
mov eax, ebx
call fcn.0043d4c0
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4fecb4
call eax
jmp 0x43cc72
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4fecc8
call eax
jmp 0x43cc72
push str.InstallCerBtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c7c0
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x1da0], 0
jne 0x43c790
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4fecf8
call eax
jmp 0x43cc7f
lea ecx, [eax + 0x1388]
call fcn.00435ca0
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
test eax, eax
mov eax, dword [edx + 0x2c]
je 0x43c7b4
push 0x4fed10
call eax
jmp 0x43cc72
push 0x4fed20
call eax
jmp 0x43cc72
push str.UnInstallCerBtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c810
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x1da0], 0
je 0x43c77b
lea ecx, [eax + 0x1388]
call fcn.00435f60
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
test eax, eax
mov eax, dword [edx + 0x2c]
je 0x43c804
push 0x4fed50
call eax
jmp 0x43cc72
push str.KfN_Rd
call eax
jmp 0x43cc72
push str.xfmodetwoBtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43c85b
call fcn.004278d0
test eax, eax
jne 0x43c846
call fcn.00427940
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4fed8c
call eax
jmp 0x43cc72
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4fedb4
call eax
jmp 0x43cc72
push str.xfmodeallBtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43cace
lea ecx, [esp + 0xd4]
push ecx
call fcn.0043e930
push str.exit_n
push ecx
push str.pause__n
push ecx
push str._echo
push ecx
push str.net_start__LanmanWorkstation__n
push ecx
push str.net_start__TapiSrv__n
push ecx
push str.net_start__PolicyAgent__n
push ecx
push str.net_start__RasAuto__n
push ecx
push str.net_start__RasMan__n
push ecx
push str.net_start__RemoteAccess__n
push ecx
push str.net_start__SstpSvc__n
push ecx
push str.net_start__EventLog__n
push ecx
push str.sc_config_LanmanWorkstation_start_AUTO_n
push ecx
push str.sc_config_EventLog_start_AUTO_n
push ecx
push str.sc_config_TapiSrv_start_DEMAND_n
push ecx
push str.sc_config_PolicyAgent_start_DEMAND_n
push ecx
push str.sc_config_SstpSvc_start_DEMAND_n
push ecx
push str.sc_config_NlaSvc_start_AUTO_n
push ecx
push str.sc_config_netprofm_start_DEMAND_n
push ecx
push str.sc_config_RasAuto_start_DEMAND_n
push ecx
push str.sc_config_RasMan_start_DEMAND_n
push ecx
push str.sc_config_RemoteAccess_start_DEMAND_n
push ecx
push str.sc_config_IKEEXT_start_AUTO_n
push ecx
push str.sc_config_nsi_start_AUTO_n
push ecx
push str.sc_config_BFE_start_AUTO_n
push ecx
lea edx, [esp + 0x194]
push str._echo_WindowsVPN
push edx
mov byte [esp + 0x370], 4
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 0xc
push eax
call fcn.0043f9f0
add esp, 8
lea esi, [esp + 0xd8]
call fcn.0043f100
test eax, eax
jne 0x43ca40
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0xdc]
lea ecx, [esp + ecx + 0xd4]
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x43ca38
or eax, 4
push 0
push eax
call fcn.00403d40
mov ecx, 0xa
mov esi, str.cmd__k_dataopen.cmd
lea edi, [esp + 0x26c]
rep movsd dword es:[edi], dword [esi]
push 0x40
lea ecx, [esp + 0x164]
push 0
push ecx
movsw word es:[edi], word [esi]
mov dword [esp + 0x168], 0x44
call fcn.00472a40
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x160]
push ecx
push 0
push 0
push 0x10
push 0
push 0
mov edx, 1
mov word [esp + 0x1a8], dx
push 0
lea edx, [esp + 0x28c]
push edx
push 0
mov dword [esp + 0x1b0], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esp + 0xd4]
mov byte [esp + 0x2a8], 0
call fcn.0043ccc0
jmp 0x43cc72
push str.setdnsBtn
lea ecx, [esp + 0x50]
call dword [sym.imp.LibDui.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x43cc72
push str.wangka
mov ecx, esi
call edi
push str.dnslist1
mov ecx, esi
mov ebx, eax
call edi
mov edx, dword [ebx + 0x698]
mov esi, eax
mov eax, dword [ebx + 0x550]
lea edi, [ebx + 0x550]
lea ecx, [ebx + 0x698]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 8]
call eax
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx]
mov ecx, edi
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x28]
lea ecx, [esp + 0x1e4]
push ecx
mov ecx, eax
call edx
mov byte [esp + 0x2a8], 5
mov eax, dword [esi + 0x698]
mov edx, dword [eax + 8]
mov ebx, dword [esi + 0x550]
lea edi, [esi + 0x550]
add esi, 0x698
mov ecx, esi
call edx
push eax
mov eax, dword [ebx]
mov ecx, edi
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x28]
lea ecx, [esp + 0xd4]
push ecx
mov ecx, eax
call edx
mov bl, 6
lea ecx, [esp + 0x15c]
mov byte [esp + 0x2a8], bl
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_void_]
mov byte [esp + 0x2a8], 7
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov esi, dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
test eax, eax
jne 0x43cbca
lea ecx, [esp + 0x1e4]
call esi
push eax
lea eax, [esp + 0x160]
push str.cmd__k_netsh_interface_ip_set_dns___s__sourcedhcp
push eax
call dword [sym.imp.LibDui.dll_public:_int___cdecl_DuiLib::CDuiString::Format_wchar_t_const__]
add esp, 0xc
jmp 0x43cbf4
lea ecx, [esp + 0xd4]
call esi
push eax
lea ecx, [esp + 0x1e8]
call esi
push eax
lea ecx, [esp + 0x164]
push str.cmd__k_netsh_interface_ip_set_dns___s__sourcestatic_addr_s
push ecx
call dword [sym.imp.LibDui.dll_public:_int___cdecl_DuiLib::CDuiString::Format_wchar_t_const__]
add esp, 0x10
sub esp, 0x84
mov edi, esp
mov dword [esp + 0x98], esp
push 0xffffffffffffffff
lea ecx, [esp + 0x1e4]
call esi
push eax
mov ecx, edi
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_]
call fcn.00436830
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 4]
push 0
push 0x4ff22c
push str.DNS
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [esp + 0x2a8], bl
mov esi, dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
lea ecx, [esp + 0x15c]
call esi
lea ecx, [esp + 0xd4]
mov byte [esp + 0x2a8], 5
call esi
lea ecx, [esp + 0x1e4]
mov byte [esp + 0x2a8], 0
call esi
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, ebx
call dword [sym.imp.LibDui.dll_protected_virtual:_void___thiscall_DuiLib::WindowImplBase::OnClick_struct_DuiLib::tagTNotifyUI__]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x2a8], 0xffffffff
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, dword [esp + 0x2a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x288]
xor ecx, esp
call fcn.00460790
mov esp, ebp
pop ebp
ret 4