Function at 0x43d070
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583064
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x62140
call fcn.00546de0
mov eax, dword [0x6459b8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x62110], esi
mov ecx, 0x64b2f0
call fcn.0040a530
test eax, eax
jne 0x43eada
call fcn.00444998
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x43d0dc
push 0x80004005
call fcn.00403760
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x620e8], eax
mov dword [ebp - 4], 1
call fcn.00444998
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x43d10f
push 0x80004005
call fcn.00403760
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x620ec], eax
mov byte [ebp - 4], 3
call fcn.00444998
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x43d13f
push 0x80004005
call fcn.00403760
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x620f0], eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x62108], edi
mov eax, dword [esi + 0x48]
push 0x5999a0
push eax
call fcn.0054704c
add esp, 8
cmp eax, edi
jne 0x43d199
push 0x1a
push str.globe_pis.foxitservice.com
lea ecx, [ebp - 0x620e8]
call fcn.004050c0
push 0x21
push str._desktop_FoxitOfficeSuite_pis.php
lea ecx, [ebp - 0x620ec]
call fcn.004050c0
jmp 0x43d3dc
mov eax, dword [esi + 0x48]
push 0x5965f4
push eax
call fcn.0054704c
add esp, 8
cmp eax, edi
jne 0x43d215
mov eax, dword [esi + 0x20]
push str.zh_CN
push eax
call fcn.0054704c
add esp, 8
cmp eax, edi
jne 0x43d215
lea ecx, [ebp - 0x620e8]
cmp dword [esi + 0x9c], edi
je 0x43d1fb
push str.globe_pus.foxitservice.com
call fcn.00406060
push str._reader_r.php
lea ecx, [ebp - 0x620ec]
call fcn.00406060
push str.https:__globe_pus.foxitservice.com_reader_r.php_dofirst
lea ecx, [ebp - 0x620f0]
jmp 0x43d3d7
push str.cn_pis.foxitsoftware.com
call fcn.00406060
push str._desktop_reader_r.php
lea ecx, [ebp - 0x620ec]
jmp 0x43d3d7
mov eax, dword [esi + 0x48]
push 0x595174
push eax
call fcn.0054704c
add esp, 8
push str.globe_pis.foxitservice.com
lea ecx, [ebp - 0x620e8]
cmp eax, edi
jne 0x43d36f
call fcn.00406060
push str._desktop_phantomPDF_r.php
lea ecx, [ebp - 0x620ec]
call fcn.00406060
push str.https:__globe_pis.foxitservice.com_desktop_phantomPDF_r.php_dofirst
lea ecx, [ebp - 0x620f0]
call fcn.00406060
push ecx
mov dword [ebp - 0x6210c], esp
mov ecx, esp
push 0xffffffffffffffff
push str.packagelang
call fcn.0056cdab
mov byte [ebp - 4], 6
push ecx
mov dword [ebp - 0x620e0], esp
mov ecx, esp
push 0xffffffffffffffff
push str.SOFTWAREFoxit_SoftwareFoxit_Reader
call fcn.0056cdab
mov byte [ebp - 4], 7
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x620fc]
push ecx
mov byte [ebp - 4], 5
call fcn.00437080
add esp, 0x10
mov byte [ebp - 4], 8
mov eax, dword [eax]
cmp eax, edi
je 0x43d2b7
add eax, 0xc
jmp 0x43d2bc
mov eax, 0x616ba8
push eax
lea ecx, [ebp - 0x620dc]
call fcn.00406440
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x620fc]
call fcn.0056bf07
push str.zh_CN
mov edx, dword [ebp - 0x620dc]
push edx
call fcn.0054704c
add esp, 8
cmp eax, edi
jne 0x43d30f
push str.cn_pis.foxitservice.com
lea ecx, [ebp - 0x620e8]
call fcn.00406060
push str.https:__cn_pis.foxitservice.com_desktop_phantomPDF_r.php_dofirst
lea ecx, [ebp - 0x620f0]
call fcn.00406060
cmp dword [esi + 0x9c], edi
je 0x43d347
push str.globe_pus.foxitservice.com
lea ecx, [ebp - 0x620e8]
call fcn.00406060
push str._phantom_p.php
lea ecx, [ebp - 0x620ec]
call fcn.00406060
push str.https:__globe_pus.foxitservice.com_phantom_p.php_dofirst
lea ecx, [ebp - 0x620f0]
call fcn.00406060
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x620dc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43d3dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x43d3dc
call fcn.00406060
push str._desktop_reader_r.php
lea ecx, [ebp - 0x620ec]
call fcn.00406060
push str.https:__globe_pis.foxitservice.com_desktop_reader_r.php_dofirst
lea ecx, [ebp - 0x620f0]
call fcn.00406060
cmp dword [esi + 0x9c], edi
je 0x43d3dc
push str.globe_pus.foxitservice.com
lea ecx, [ebp - 0x620e8]
call fcn.00406060
push str._reader_r.php
lea ecx, [ebp - 0x620ec]
call fcn.00406060
push str.https:__globe_pus.foxitservice.com_reader_r.php_dofirst
lea ecx, [ebp - 0x620f0]
call fcn.00406060
push 0x616ba8
lea ecx, [esi + 0x98]
call fcn.00406060
lea ecx, [ebp - 0x620d4]
call fcn.00440c20
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xd
cmp dword [esi + 0x9c], edi
je 0x43d457
lea eax, [esi + 0x2c]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], edi
je 0x43d457
push 0x5965f4
push eax
call fcn.00407e60
add esp, 8
test al, al
je 0x43d457
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x620d4]
call fcn.00440cd0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x620f0]
call fcn.00404610
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x620ec]
call fcn.00404610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x620e8]
call fcn.00404610
jmp 0x43eada
mov dword [ebp - 0x448], 0xf
mov dword [ebp - 0x44c], edi
mov byte [ebp - 0x45c], 0
mov byte [ebp - 4], 0xe
push 0xffffffffffffffff
push 0x595170
lea ecx, [ebp - 0x620fc]
call fcn.0056bf21
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x620e0], esp
lea edx, [ebp - 0x620fc]
push edx
call fcn.0056cb95
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x45c]
push eax
mov byte [ebp - 4], 0xf
mov ecx, 0x64b2f0
call fcn.0040c7b0
lea ecx, [ebp - 0x45c]
push ecx
lea edx, [ebp - 0x578]
push edx
call fcn.00435710
add esp, 8
mov byte [ebp - 4], 0x11
push edi
push edi
push edi
push str.xmlrequest
mov ecx, 0x64b97c
call fcn.00442b50
mov ecx, 0x64b97c
call fcn.00441750
cmp dword [esi + 0x9c], edi
je 0x43d754
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x620e4]
call fcn.00406440
mov byte [ebp - 4], 0x12
push str.FXSInILogFile.ini
lea ecx, [ebp - 0x620e4]
call fcn.004092f0
lea ecx, [ebp - 0x62100]
call fcn.004045a0
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x620e4]
push edx
push 0x104
push 0x104
lea ecx, [ebp - 0x62100]
call fcn.00404e00
push eax
push 0x616ba8
push str.CustomerID
push str.FoxitInI
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call edi
lea ecx, [ebp - 0x620dc]
call fcn.004045a0
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x620e4]
push eax
push 0x104
push 0x104
lea ecx, [ebp - 0x620dc]
call fcn.00404e00
push eax
push 0x616ba8
push str.langid
push str.FoxitInI
call edi
mov ecx, dword [ebp - 0x620e4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x620dc]
push edx
call fcn.00546f3e
mov dword [ebp - 0x620e0], eax
push eax
lea eax, [ebp - 0x620e0]
push eax
call fcn.00573240
add esp, 0xc
mov byte [ebp - 4], 0x15
mov ecx, eax
call fcn.00403620
push eax
lea ecx, [ebp - 0x620d8]
call fcn.00406440
mov bl, 0x17
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x620e0]
call fcn.0056bf07
mov ecx, dword [ebp - 0x620d8]
cmp dword [ecx - 0xc], 1
jge 0x43d622
push str.lang_en_US.xml
lea ecx, [ebp - 0x620d8]
call fcn.00406060
push 0
push str..xml
lea ecx, [ebp - 0x620d8]
call fcn.00404670
push eax
lea edx, [ebp - 0x620e0]
push edx
lea ecx, [ebp - 0x620d8]
call fcn.00407fe0
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x620d8]
call fcn.004059f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x620e0]
call fcn.00404610
push 0
push 0x595d88
lea ecx, [ebp - 0x620d8]
call fcn.00404670
add eax, 5
push eax
lea eax, [ebp - 0x620e0]
push eax
lea ecx, [ebp - 0x620d8]
call fcn.00405980
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x620d8]
call fcn.004059f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x620e0]
call fcn.00404610
push 0x616ba8
lea ecx, [ebp - 0x62100]
push ecx
call fcn.00407e00
add esp, 8
test al, al
je 0x43d6fe
lea edx, [ebp - 0x620d8]
push edx
lea eax, [esi + 0x10]
push eax
lea ecx, [esi + 0x14]
push ecx
lea edx, [ebp - 0x620e0]
push edx
mov ecx, esi
call fcn.0043a4e0
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x62100]
call fcn.004059f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x620e0]
call fcn.00404610
push 0
push 0
mov eax, dword [ebp - 0x62100]
push eax
push str.customerID
mov ecx, 0x64b97c
call fcn.00442b50
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x620d8]
call fcn.00404610
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x620dc]
call fcn.00404610
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x62100]
call fcn.00404610
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x620e4]
call fcn.00404610
mov eax, dword [esi + 0xcc]
push 0
push 0
push eax
push str.uuid
mov ecx, 0x64b97c
call fcn.00442b50
cmp dword [ebp - 0x564], 8
mov eax, dword [ebp - 0x578]
jae 0x43d783
lea eax, [ebp - 0x578]
push 0
push 0
push eax
push 0x595070
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0xc0]
push 0
push 0
push eax
push str.enclosureType
mov ecx, 0x64b97c
call fcn.00442b50
cmp dword [esi + 0x9c], 0
je 0x43d863
push 0x616ba8
lea ecx, [ebp - 0x620e4]
call fcn.00406440
mov byte [ebp - 4], 0x1b
lea eax, [esi + 0xc8]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 1
lea ecx, [ebp - 0x620e4]
jge 0x43d7f2
push str.None
call fcn.00406060
jmp 0x43d7f8
push eax
call fcn.004059f0
push 0
push 0
mov edx, dword [ebp - 0x620e4]
push edx
push str.firstRunDate
mov ecx, 0x64b97c
call fcn.00442b50
push 0x5965f4
lea ecx, [esi + 0x48]
call fcn.00408950
test eax, eax
jne 0x43d83d
push str.Unused
lea ecx, [esi + 0x28]
call fcn.00408950
test eax, eax
jne 0x43d83d
push eax
push eax
push 0x616ba8
jmp 0x43d845
mov eax, dword [esi + 0x28]
push 0
push 0
push eax
push str.status
mov ecx, 0x64b97c
call fcn.00442b50
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x620e4]
call fcn.00404610
push 0
push 0
push 0
push str.data
mov ecx, 0x64b97c
call fcn.00442b50
mov ecx, 0x64b97c
call fcn.00441750
push 0
push 0
push 0
push 0x595054
mov ecx, 0x64b97c
call fcn.00442b50
lea ebx, [esi + 0x48]
mov eax, dword [ebx]
push eax
push 0x59504c
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x10]
push eax
push 0x59503c
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
push str.Foxit_Reader
lea ecx, [esi + 0x4c]
call fcn.00406060
mov edi, dword [esi + 0x4c]
push edi
push 0x595030
mov edx, dword [0x64b9a0]
push edx
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x20]
push eax
push 0x59501c
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x9c], 0
jne 0x43d9e6
mov eax, dword [esi + 0x58]
push eax
push str.green
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x9c], 0
jne 0x43d9e6
push 0
push 0
push 0
push str.newuser
mov ecx, 0x64b97c
call fcn.00442b50
lea edi, [esi + 0x2c]
mov ecx, edi
call fcn.00405860
mov ecx, edi
call fcn.004057e0
mov edx, dword [edi]
cmp dword [edx - 0xc], 0
je 0x43d992
push 0x5965f4
push edi
call fcn.00407e00
add esp, 8
test al, al
jne 0x43d992
push 0x59657c
push str.status
mov eax, dword [0x64b9a0]
push eax
jmp 0x43d9a3
push 0x5965f4
push str.status
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0xc4]
push eax
push str.downloadFrom
mov edx, dword [0x64b9a0]
push edx
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0xbc]
push eax
push str.upgradeFrom
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
push 0
push 0
push 0
push 0x59b8b8
mov ecx, 0x64b97c
call fcn.00442b50
lea ecx, [ebp - 0x620f8]
push ecx
mov ecx, esi
call fcn.0043bd70
mov byte [ebp - 4], 0x1c
call fcn.004386d0
test al, al
je 0x43da1d
push str.Windows_10
jmp 0x43da2b
call fcn.004386c0
test al, al
je 0x43da36
push str.Windows_8.1
lea ecx, [ebp - 0x620f8]
call fcn.00406060
mov edx, dword [ebp - 0x620f8]
push edx
push 0x595030
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
mov ecx, esi
call fcn.00438900
test eax, eax
je 0x43da70
push 0x59b880
push str.platform
mov ecx, dword [0x64b9a0]
push ecx
jmp 0x43da81
push 0x59b864
push str.platform
mov edx, dword [0x64b9a0]
push edx
mov ecx, 0x64b97c
call fcn.004425e0
push 0
push 0
push 0
push str.agent
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0x14]
push eax
push 0x59504c
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x24]
push eax
push 0x595030
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
push 0x595174
push ebx
call fcn.00407e00
add esp, 8
test al, al
je 0x43db4d
cmp dword [esi + 0x9c], 0
jne 0x43db6b
lea ecx, [ebp - 0x130]
call fcn.00407100
mov bl, 0x1d
mov byte [ebp - 4], bl
lea edx, [ebp - 0x478]
push edx
lea ecx, [ebp - 0x130]
call fcn.004067c0
mov byte [ebp - 4], 0x1e
cmp dword [eax + 0x14], 8
jb 0x43db1c
mov eax, dword [eax]
push 0
push 0
push eax
push 0x594ff8
mov ecx, 0x64b97c
call fcn.00442b50
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x478]
call fcn.00404e70
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x130]
call fcn.004055e0
cmp dword [esi + 0x9c], 0
jne 0x43db6b
push 0
push 0
push 0
push str.settings
mov ecx, 0x64b97c
call fcn.00442b50
mov ecx, 0x64b97c
call fcn.00441750
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x424]
push ecx
push 0
push str.youdao
mov edx, ecx
push edx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call ebx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x620f4]
call fcn.00406440
mov byte [ebp - 4], 0x1f
push 0x2e
lea ecx, [ebp - 0x620f4]
call fcn.00407dd0
dec eax
push eax
lea ecx, [ebp - 0x620e0]
push ecx
lea ecx, [ebp - 0x620f4]
call fcn.00407fe0
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x620f4]
call fcn.004059f0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x620e0]
call fcn.00404610
push str..exe
lea ecx, [ebp - 0x620f4]
call fcn.004092f0
mov eax, dword [esi + 0x3c]
push 0
mov edx, dword [ebp - 0x620f4]
push edx
push eax
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
call edi
cmp dword [esi + 0x8c], 0
je 0x43ddfe
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x59b838
mov edx, ecx
push edx
call ebx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x620d8]
call fcn.00406440
mov byte [ebp - 4], 0x21
push 0x2e
lea ecx, [ebp - 0x620d8]
call fcn.00407dd0
dec eax
push eax
lea ecx, [ebp - 0x620e0]
push ecx
lea ecx, [ebp - 0x620d8]
call fcn.00407fe0
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0x620d8]
call fcn.004059f0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x620e0]
call fcn.00404610
push str..exe
lea ecx, [ebp - 0x620d8]
call fcn.004092f0
mov eax, dword [esi + 0x5c]
xor ebx, ebx
push ebx
mov edx, dword [ebp - 0x620d8]
push edx
push eax
call edi
push 0x3c
push ebx
lea eax, [ebp - 0x62150]
push eax
call fcn.00546d60
add esp, 0xc
mov dword [ebp - 0x62150], 0x3c
mov dword [ebp - 0x62120], ebx
mov dword [ebp - 0x6214c], 0x40
mov dword [ebp - 0x6211c], ebx
mov ecx, dword [ebp - 0x620d8]
mov dword [ebp - 0x62140], ecx
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x6213c], eax
lea edx, [ebp - 0x62150]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x62118]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push ebx
push ebx
push str.kingsoftoffice
mov ecx, 0x64b97c
call fcn.00442b50
push ecx
mov ecx, esp
mov dword [ebp - 0x620dc], esp
push str.UninstallString
call fcn.00406440
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0x620e4], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office
call fcn.00406440
mov byte [ebp - 4], 0x24
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x620e0]
push ecx
mov byte [ebp - 4], 0x21
mov ecx, esi
call fcn.00438d90
mov byte [ebp - 4], 0x25
mov edx, dword [eax]
cmp dword [edx - 0xc], ebx
setne bl
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x620e0]
call fcn.00404610
test bl, bl
je 0x43ddae
push 0x5965f4
push str.status
mov eax, dword [0x64b9a0]
push eax
jmp 0x43ddbf
push 0x59657c
push str.status
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
push 0
mov edx, dword [ebp - 0x620d8]
push edx
call fcn.00547156
add esp, 8
test eax, eax
jne 0x43ddeb
mov eax, dword [ebp - 0x620d8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x620d8]
call fcn.00404610
xor edi, edi
jmp 0x43de53
xor edi, edi
cmp dword [esi + 0x88], edi
je 0x43de53
push edi
push edi
push edi
push str.kingsoftoffice
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0x50]
push eax
push str.status
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x54]
cmp dword [eax - 0xc], edi
je 0x43de53
push eax
push str.defaultprogram
mov edx, dword [0x64b9a0]
push edx
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x70], edi
je 0x43de9d
push edi
push edi
push edi
push str.baidu_tool
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0xc]
push eax
push str.status
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x20]
push eax
push 0x59501c
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x78], edi
je 0x43dee7
push edi
push edi
push edi
push str.ask_tool
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0x30]
push eax
push str.status
mov edx, dword [0x64b9a0]
push edx
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x34]
push eax
push str.homepage
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x74], edi
je 0x43df32
push edi
push edi
push edi
push str.elex_v9
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0x18]
push eax
push str.status
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x1c]
push eax
push 0x59501c
mov edx, dword [0x64b9a0]
push edx
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x90], edi
je 0x43df7f
push edi
push edi
push edi
push str.find22
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0x68]
push eax
push str.status
mov eax, dword [0x64b9a0]
push eax
mov ecx, 0x64b97c
call fcn.004425e0
mov eax, dword [esi + 0x1c]
push eax
push 0x59501c
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x7c], edi
je 0x43e060
push 0x3c
push edi
lea edx, [ebp - 0x4b4]
push edx
call fcn.00546d60
add esp, 0xc
mov dword [ebp - 0x4b4], 0x3c
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x4b0], 0x40
mov dword [ebp - 0x480], edi
mov eax, dword [ebp - 0x620f4]
mov dword [ebp - 0x4a4], eax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x4a0], eax
lea ecx, [ebp - 0x4b4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x47c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push edi
push edi
push str.youdao
mov ecx, 0x64b97c
call fcn.00442b50
lea eax, [ebp - 0x620e0]
push eax
mov ecx, dword [ebp - 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, 0x64b97c
cmp dword [ebp - 0x620e0], edi
jne 0x43e031
push 0x5965f4
push str.status
mov edx, dword [0x64b9a0]
push edx
jmp 0x43e041
push 0x59657c
push str.status
mov eax, dword [0x64b9a0]
push eax
call fcn.004425e0
mov eax, dword [esi + 0x20]
push eax
push 0x59501c
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
push edi
mov edx, dword [ebp - 0x620f4]
push edx
call fcn.00547156
add esp, 8
test eax, eax
jne 0x43e081
mov eax, dword [ebp - 0x620f4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x80], edi
je 0x43e0b5
push edi
push edi
push edi
push str.joyinker
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0x40]
push eax
push str.status
mov ecx, dword [0x64b9a0]
push ecx
mov ecx, 0x64b97c
call fcn.004425e0
cmp dword [esi + 0x84], edi
je 0x43e0e9
push edi
push edi
push edi
push str.hao123
mov ecx, 0x64b97c
call fcn.00442b50
mov eax, dword [esi + 0x44]
push eax
push str.status
mov edx, dword [0x64b9a0]
push edx
mov ecx, 0x64b97c
call fcn.004425e0
push str.Content_Type:_application_x_www_form_urlencoded
lea ecx, [ebp - 0x6210c]
call fcn.00406440
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x62104]
push eax
mov ecx, 0x64b97c
call fcn.00405520
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x31350]
call fcn.00440c20
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x62104]
push ecx
lea ecx, [ebp - 0x4d0]
call fcn.00406170
mov byte [ebp - 4], 0x29
lea edx, [ebp - 0x4d0]
push edx
lea eax, [ebp - 0x508]
push eax
call fcn.004358d0
add esp, 8
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x4d0]
call fcn.00404e70
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x508]
push ecx
lea ecx, [esi + 0xa0]
call fcn.00405b60
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_6.0_
push 1
mov edx, dword [ebp - 0x620f0]
push edx
lea ecx, [ebp - 0x31350]
call fcn.00441420
test eax, eax
je 0x43e553
push 0x595178
lea ecx, [ebp - 0x4ec]
call fcn.004060b0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x31350]
call fcn.004405e0
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004060b0
mov byte [ebp - 4], 0x2d
mov eax, 0xf
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x430], edi
mov byte [ebp - 0x440], 0
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x514], edi
mov byte [ebp - 0x524], 0
mov byte [ebp - 4], 0x2f
cmp dword [ebp - 0x4d8], 0x10
mov eax, dword [ebp - 0x4ec]
jae 0x43e209
lea eax, [ebp - 0x4ec]
mov ecx, dword [ebp - 0x4dc]
push ecx
push 0
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00403e10
mov edi, eax
push edi
push 0
lea edx, [ebp - 0x478]
push edx
lea ecx, [ebp - 0x4d0]
call fcn.004060f0
mov byte [ebp - 4], 0x30
push eax
lea ecx, [ebp - 0x440]
call fcn.00406270
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x478]
call fcn.00404e40
add edi, dword [ebp - 0x4dc]
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004060f0
mov byte [ebp - 4], 0x31
push eax
lea ecx, [ebp - 0x524]
call fcn.00406270
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x478]
call fcn.00404e40
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x494]
push edx
call fcn.004359a0
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x440]
push ecx
push 8
lea edx, [ebp - 0x478]
push edx
call fcn.0043fae0
add esp, 0x18
mov byte [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0x508]
call fcn.00406270
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x478]
call fcn.00404e40
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x508]
push ecx
lea edx, [ebp - 0x5cc]
push edx
call fcn.00406510
add esp, 0xc
mov byte [ebp - 4], 0x34
mov ebx, 0x10
cmp dword [ebp - 0x5b8], ebx
mov eax, dword [ebp - 0x5cc]
jae 0x43e31d
lea eax, [ebp - 0x5cc]
push eax
push 1
lea ecx, [ebp - 0x620d4]
call fcn.00440bc0
lea ecx, [ebp - 0x620dc]
call fcn.004045a0
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x620ec]
push eax
mov ecx, dword [ebp - 0x620e8]
push ecx
push str.https:___s_s
lea edx, [ebp - 0x620dc]
push edx
call fcn.00405f60
add esp, 0x10
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_6.0_
push 2
mov eax, dword [ebp - 0x620dc]
push eax
lea ecx, [ebp - 0x620d4]
call fcn.00441420
mov dword [ebp - 0x62108], eax
mov ecx, esi
call fcn.0043c9f0
cmp dword [esi + 0x9c], 0
jne 0x43e4e8
push str._recordDate_
lea ecx, [ebp - 0x55c]
call fcn.004060b0
mov byte [ebp - 4], 0x36
push str.__recordDate_
lea ecx, [ebp - 0x540]
call fcn.004060b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x620d4]
call fcn.004405e0
push eax
lea ecx, [ebp - 0x594]
call fcn.004060b0
mov byte [ebp - 4], 0x38
cmp dword [ebp - 0x548], ebx
mov eax, dword [ebp - 0x55c]
jae 0x43e3e6
lea eax, [ebp - 0x55c]
mov ecx, dword [ebp - 0x54c]
push ecx
push 0
push eax
lea ecx, [ebp - 0x594]
call fcn.00403e10
mov edi, eax
cmp dword [ebp - 0x52c], ebx
mov eax, dword [ebp - 0x540]
jae 0x43e411
lea eax, [ebp - 0x540]
mov edx, dword [ebp - 0x530]
push edx
push 0
push eax
lea ecx, [ebp - 0x594]
call fcn.00403e10
sub eax, edi
sub eax, 0xc
test edi, edi
jle 0x43e4bb
test eax, eax
jle 0x43e4bb
push eax
add edi, 0xc
push edi
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x594]
call fcn.004060f0
mov bl, 0x39
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x478]
push ecx
lea edx, [ebp - 0x5b0]
push edx
call fcn.004359a0
add esp, 8
mov byte [ebp - 4], 0x3a
cmp dword [ebp - 0x59c], 8
mov eax, dword [ebp - 0x5b0]
jae 0x43e486
lea eax, [ebp - 0x5b0]
push eax
push str.StartDate
push str.SOFTWAREFoxit_SoftwareFoxit_Reader
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004371a0
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5b0]
call fcn.00404e70
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x478]
call fcn.00404e40
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x594]
call fcn.00404e40
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x540]
call fcn.00404e40
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x55c]
call fcn.00404e40
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x620dc]
call fcn.00404610
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x5cc]
call fcn.00404e40
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x494]
call fcn.00404e70
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x524]
call fcn.00404e40
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x440]
call fcn.00404e40
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x4d0]
call fcn.00404e40
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x4ec]
call fcn.00404e40
xor edi, edi
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x508]
call fcn.00404e40
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x31350]
call fcn.00440cd0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x62104]
call fcn.00404610
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6210c]
call fcn.00404610
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x620f4]
call fcn.00404610
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x620f8]
call fcn.00404610
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x578]
call fcn.00404e70
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x620fc]
call fcn.0056bf07
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x45c]
call fcn.00404e40
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x62108], edi
je 0x43e9ab
call fcn.00444998
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43e667
push 0x80004005
call fcn.00403760
mov dword [ebp - 0x62108], 0
mov eax, dword [ebp - 0x62114]
mov esi, dword [eax + 8]
lea ecx, [ebp - 0x620dc]
call fcn.004045a0
mov byte [ebp - 4], 0x3c
push esi
push str.Send_Request_Error_:__d_
lea ecx, [ebp - 0x620dc]
push ecx
call fcn.00405f60
add esp, 0xc
mov edx, dword [ebp - 0x620dc]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x620dc]
call fcn.00404610
mov dword [ebp - 4], 0xc
mov eax, 0x43e9a5
ret
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x620fc], eax
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x620d4]
call fcn.004405e0
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43e6a8
sub ecx, edi
push ecx
push eax
lea ecx, [ebp - 0x440]
call fcn.00405c50
mov bl, 0x3f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x45c]
push edx
call fcn.004359a0
add esp, 8
mov byte [ebp - 4], 0x40
cmp dword [eax + 0x14], 8
jb 0x43e6e7
mov edx, dword [eax]
jmp 0x43e6e9
mov edx, eax
test edx, edx
jne 0x43e6f1
xor eax, eax
jmp 0x43e705
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43e6f6
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x620fc]
call fcn.004050c0
mov byte [ebp - 4], bl
cmp dword [ebp - 0x448], 8
jb 0x43e72d
mov eax, dword [ebp - 0x45c]
push eax
call fcn.00443897
add esp, 4
mov dword [ebp - 0x448], 7
mov dword [ebp - 0x44c], 0
xor ecx, ecx
mov word [ebp - 0x45c], cx
mov byte [ebp - 4], 0x3e
cmp dword [ebp - 0x42c], 0x10
jb 0x43e766
mov edx, dword [ebp - 0x440]
push edx
call fcn.00443897
add esp, 4
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
mov edi, dword [ebp - 0x620fc]
cmp dword [edi - 0xc], 0
jne 0x43e811
mov byte [ebp - 4], 0xc
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e7b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x620d4]
call fcn.00440cd0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x620f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e7e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x620ec]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e80c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x43eab1
lea ecx, [ebp - 0x62104]
call fcn.004045a0
mov byte [ebp - 4], 0x45
mov ecx, dword [esi + 0x9c]
push ecx
push str.is_uninstall____d
lea edx, [ebp - 0x62104]
push edx
call fcn.00405f60
add esp, 0xc
cmp dword [esi + 0x9c], 0
je 0x43e966
lea ecx, [ebp - 0x4ac]
call fcn.00404af0
mov byte [ebp - 4], 0x46
push edi
lea ecx, [ebp - 0x4ac]
call fcn.00443740
lea ecx, [ebp - 0x4ac]
call fcn.00441a70
test al, al
je 0x43e957
push str.code
lea ecx, [ebp - 0x4ac]
call fcn.00441f60
lea eax, [ebp - 0x620dc]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.004389a0
mov bl, 0x47
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x620dc]
call fcn.00419450
push 0x59b5a8
lea ecx, [ebp - 0x4ac]
call fcn.00441f60
lea ecx, [ebp - 0x620f8]
push ecx
lea ecx, [ebp - 0x4ac]
call fcn.004389a0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x620f8]
call fcn.00419450
push 0x59b5a0
lea edx, [ebp - 0x620dc]
push edx
call fcn.00407e00
add esp, 8
test al, al
je 0x43e93a
push 0x616ba8
lea eax, [ebp - 0x620f8]
push eax
call fcn.00407e60
add esp, 8
test al, al
je 0x43e93a
cmp dword [esi + 0xd8], 0
jne 0x43e93a
push str.Licesend
lea ecx, [esi + 0x28]
call fcn.00408950
test eax, eax
je 0x43e93a
push 3
push 0
push 0
mov ecx, dword [ebp - 0x620f8]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x620f8]
call fcn.00404610
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x620dc]
call fcn.00404610
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x4ac]
call fcn.00404bc0
mov byte [ebp - 4], 0x3e
mov eax, dword [ebp - 0x62104]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43e98c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x43ea4a
call fcn.00444998
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43e9c5
push 0x80004005
call fcn.00403760
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x620e4], eax
mov byte [ebp - 4], 0x4c
push 8
push str.https:__
lea ecx, [ebp - 0x620e4]
call fcn.00408e40
mov eax, dword [ebp - 0x620e8]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x620e4]
call fcn.00408e40
mov eax, dword [ebp - 0x620ec]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x620e4]
call fcn.00408e40
cmp dword [esi + 0x9c], 0
jne 0x43ea30
mov ecx, dword [ebp - 0x620e4]
push ecx
mov ecx, esi
call fcn.0043ab00
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x620e4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43ea56
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x620d4]
call fcn.00440cd0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x620f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43ea8b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x620ec]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43eab1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x620e8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43eada
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00546bde
mov esp, ebp
pop ebp
ret