Function at 0x401770
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x209c
call fcn.00402e90
mov eax, dword [0x40601c]
xor eax, esp
mov dword [esp + 0x2098], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.user32.dll
call ebx
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x4017ca
push str.SetProcessDPIAware
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4017c3
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x206
lea ecx, [esp + 0x26]
push edi
push ecx
mov word [esp + 0x2c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x24]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x206
lea eax, [esp + 0xc56]
push edi
push eax
mov word [esp + 0xc5c], di
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xc54]
push 0x104
push edx
call esi
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401835
sub eax, edx
sar eax, 1
add eax, 0xffffffff
cmp eax, edi
jl 0x401862
jmp 0x401850
cmp word [esp + eax*2 + 0x20], 0x5c
je 0x401862
sub eax, 1
mov word [esp + eax*2 + 0x22], di
jns 0x401850
push 0x103e
lea eax, [esp + 0x1066]
push edi
push eax
mov word [esp + 0x106c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1064]
push 0x104
push edx
call esi
add esp, 0xc
push 0x206
lea eax, [esp + 0x436]
push edi
push eax
mov word [esp + 0x43c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x206
lea ecx, [esp + 0x63e]
push edi
push ecx
mov word [esp + 0x644], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x63c]
push 0x104
push eax
call esi
mov esi, dword [sym.imp.MSVCR80.dll_wcsncat]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x434]
push str.1.0.0.1
push ecx
call esi
lea edx, [esp + 0x43c]
add esp, 0xc
push edx
lea ecx, [esp + 0x63c]
call fcn.00401c20
add esp, 4
push 0x104
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x28]
push ecx
call esi
add esp, 0xc
push 0x104
lea edx, [esp + 0x24]
push str.Bindesktopentry.dll
push edx
call esi
add esp, 0xc
push 0x206
lea eax, [esp + 0x22e]
push edi
push eax
mov word [esp + 0x234], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1064]
push ecx
lea edx, [esp + 0x230]
push edx
call esi
add esp, 0xc
push 0x104
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x230]
push ecx
call esi
add esp, 0xc
push 0x104
lea edx, [esp + 0x22c]
push str.Bin
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x206
lea ecx, [esp + 0x846]
push edi
push ecx
mov word [esp + 0x84c], di
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0xc
push str.libeay32.dll
lea edx, [esp + 0x22c]
push edx
push str._s_s
lea eax, [esp + 0x84c]
push 0x104
push eax
call esi
add esp, 0x14
lea ecx, [esp + 0x840]
push ecx
call ebx
test eax, eax
je 0x401b26
push 0x206
lea edx, [esp + 0xa4e]
push edi
push edx
mov word [esp + 0xa54], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push str._ssleay32.dll
lea eax, [esp + 0x22c]
push eax
push str._s_s
lea ecx, [esp + 0xa54]
push 0x104
push ecx
call esi
add esp, 0x14
lea edx, [esp + 0xa48]
push edx
call ebx
test eax, eax
je 0x401b26
lea eax, [esp + 0x430]
push eax
lea esi, [esp + 0x1064]
call fcn.00401b90
lea ecx, [esp + 0x24]
add esp, 4
push ecx
call fcn.004021d0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
sub esp, 0xc
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.00402290
call fcn.00401420
lea edx, [esp + 0x20]
push edx
call ebx
mov esi, eax
cmp esi, edi
je 0x401b26
push str.QDRunDesktop
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.QDRunAutoUpdate
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ebx, edi
je 0x401b1f
cmp eax, edi
je 0x401b1f
push 0x206
lea eax, [esp + 0xe5e]
push edi
push eax
mov word [esp + 0xe64], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea esi, [esp + 0x20]
lea eax, [esp + 0xe58]
call fcn.00401b40
call ebx
call fcn.004016a0
jmp 0x401b26
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20a4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040256a
mov esp, ebp
pop ebp
ret 0x10