Function at 0x407600
Capabilities:
Create process on windows
Create thread
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5447
mov eax, dword fs:[0]
push eax
sub esp, 0x6dc
mov eax, dword [0x50e5d4]
xor eax, ebp
mov dword [ebp - 0x98], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6a8], ecx
lea eax, [ebp - 0x608]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x88]
mov edx, dword [edx]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x6ac], eax
mov ecx, dword [ebp - 0x6ac]
mov dword [ebp - 0x6b0], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x6b0]
call dword [sym.imp.ui_d.dll_public:_char_const____thiscall_DuiLib::CDuiString::operator_char_const__void_const]
push eax
lea ecx, [ebp - 0x10]
call fcn.004018b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x608]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
push str.click
mov ecx, dword [ebp + 8]
call dword [sym.imp.ui_d.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_char_const__const]
movzx edx, al
test edx, edx
je 0x407dbf
push str.checktime
lea eax, [ebp - 0x10]
push eax
call fcn.004253a0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4076fa
push 0
push 0
mov edx, dword [ebp - 0x6a8]
sub edx, 0x10
push edx
push 0x408da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00426070
jmp 0x4081af
push str.checktimeSys
lea eax, [ebp - 0x10]
push eax
call fcn.004253a0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x407777
mov dword [ebp - 0x70], str.rundll32.exe__d_shell32.dll_Control_RunDLL_timedate.cpl
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
push 0x44
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.004c36d0
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00426070
jmp 0x4081af
push 0x4f87d8
lea ecx, [ebp - 0x10]
push ecx
call fcn.004253a0
add esp, 8
movzx edx, al
test edx, edx
je 0x4077c0
push 5
push 0
push 0
push str.http:__www.xiaoxinrili.com_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00426070
jmp 0x4081af
push str.setclbtn
lea eax, [ebp - 0x10]
push eax
call fcn.004253a0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x407804
push 1
push 0
mov ecx, dword [ebp - 0x6a8]
sub ecx, 0x10
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CWindowWnd::ShowWindow_bool__bool_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00426070
jmp 0x4081af
push str.timeFormat1
lea edx, [ebp - 0x10]
push edx
call fcn.004253a0
add esp, 8
movzx eax, al
test eax, eax
je 0x40797f
mov ecx, dword [ebp - 0x6a8]
mov ecx, dword [ecx + 0x20]
call dword [sym.imp.ui_d.dll_public:_char_const____thiscall_DuiLib::CControlUI::GetBkImage_void_]
push eax
lea ecx, [ebp - 0x78]
call fcn.004018b0
mov byte [ebp - 4], 3
mov byte [ebp - 0x71], 0
mov edx, dword [ebp - 0x6a8]
cmp dword [edx + 0x24], 1
jne 0x40788b
push str.tray_xp_yes.png
lea ecx, [ebp - 0x78]
call fcn.00424f00
test eax, eax
jne 0x407889
push str.tray_xp_yes.png
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x1c]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
push str.tray_xp_no.png
mov ecx, dword [ebp - 0x6a8]
mov ecx, dword [ecx + 0x20]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
mov byte [ebp - 0x71], 1
jmp 0x4078c8
push str.tray_yes.png
lea ecx, [ebp - 0x78]
call fcn.00424f00
test eax, eax
jne 0x4078c8
push str.tray_yes.png
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [edx + 0x1c]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
push str.tray_no.png
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x20]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
mov byte [ebp - 0x71], 1
movzx ecx, byte [ebp - 0x71]
test ecx, ecx
je 0x40796e
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push 0x4f82ec
push str.NoClock
push str.Main
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push str._ddd_hh:nn_nyyyy_mm_dd_
push str.Format
push str.Main
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.004065a0
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x40796e
push 0
push 0
push 0x401
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x402
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x40a
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x40b
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.00426070
jmp 0x407dba
push str.timeFormat2
lea eax, [ebp - 0x10]
push eax
call fcn.004253a0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x407af8
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [edx + 0x1c]
call dword [sym.imp.ui_d.dll_public:_char_const____thiscall_DuiLib::CControlUI::GetBkImage_void_]
push eax
lea ecx, [ebp - 0x84]
call fcn.004018b0
mov byte [ebp - 4], 4
mov byte [ebp - 0x7d], 0
mov eax, dword [ebp - 0x6a8]
cmp dword [eax + 0x24], 1
jne 0x407a0c
push str.tray_xp_yes.png
lea ecx, [ebp - 0x84]
call fcn.00424f00
test eax, eax
jne 0x407a0a
push str.tray_xp_no.png
mov ecx, dword [ebp - 0x6a8]
mov ecx, dword [ecx + 0x1c]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
push str.tray_xp_yes.png
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [edx + 0x20]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
mov byte [ebp - 0x7d], 1
jmp 0x407a4c
push str.tray_yes.png
lea ecx, [ebp - 0x84]
call fcn.00424f00
test eax, eax
jne 0x407a4c
push str.tray_no.png
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x1c]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
push str.tray_yes.png
mov ecx, dword [ebp - 0x6a8]
mov ecx, dword [ecx + 0x20]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
mov byte [ebp - 0x7d], 1
movzx edx, byte [ebp - 0x7d]
test edx, edx
je 0x407ae4
mov ecx, 0x51a9c0
call fcn.00401600
push eax
push 0x4f8494
push str.NoClock
push str.Main
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.004065a0
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x407ae4
push 0
push 0
push 0x401
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x402
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x40a
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x40b
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84]
call fcn.00426070
jmp 0x407dba
push str.settime
lea ecx, [ebp - 0x10]
push ecx
call fcn.004253a0
add esp, 8
movzx edx, al
test edx, edx
je 0x407dba
lea ecx, [ebp - 0x90]
call fcn.00403be0
mov byte [ebp - 4], 5
push 0x400
lea eax, [ebp - 0x5a4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x5a4]
add ecx, 0xffffffff
mov dword [ebp - 0x6b4], ecx
mov edx, dword [ebp - 0x6b4]
mov al, byte [edx + 1]
mov byte [ebp - 0x6b5], al
add dword [ebp - 0x6b4], 1
cmp byte [ebp - 0x6b5], 0
jne 0x407b4c
mov edi, dword [ebp - 0x6b4]
mov ecx, dword [str.__run]
mov dword [edi], ecx
mov dx, word [0x4f8830]
mov word [edi + 4], dx
mov al, byte [0x4f83ac]
mov byte [ebp - 0x1a4], al
push 0x103
push 0
lea ecx, [ebp - 0x1a3]
push ecx
call fcn.004c36d0
add esp, 0xc
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [edx + 0x18]
call dword [sym.imp.ui_d.dll_public:_char_const____thiscall_DuiLib::CControlUI::GetBkImage_void_]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004018b0
mov byte [ebp - 4], 6
push str.S_22.png
lea eax, [ebp - 0x8c]
push eax
call fcn.004253a0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x407c9b
push str.S_11.png
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [edx + 0x18]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
lea ecx, [ebp - 0x5ac]
call fcn.004429e0
mov byte [ebp - 4], 7
push 0x2001f
push ecx
mov ecx, esp
mov dword [ebp - 0x60c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004018b0
mov dword [ebp - 0x6bc], eax
push SysReAllocString
lea ecx, [ebp - 0x5ac]
call fcn.00442a30
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
je 0x407c87
push ecx
mov ecx, esp
mov dword [ebp - 0x610], esp
push str.riliRun
call fcn.004018b0
mov dword [ebp - 0x6c4], eax
lea ecx, [ebp - 0x5ac]
call fcn.00442bf0
mov ecx, 0x51aa14
call fcn.00401600
push eax
push 0x4f82ec
push str.autorun
push str.Info
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5ac]
call fcn.00442a10
jmp 0x407d9c
push str.S_11.png
lea eax, [ebp - 0x8c]
push eax
call fcn.004253a0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x407d9c
push str.S_22.png
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [edx + 0x18]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_char_const__]
lea ecx, [ebp - 0x5b4]
call fcn.004429e0
mov byte [ebp - 4], 8
push 0x2001f
push ecx
mov ecx, esp
mov dword [ebp - 0x614], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004018b0
mov dword [ebp - 0x6c8], eax
push SysReAllocString
lea ecx, [ebp - 0x5b4]
call fcn.00442a30
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 0
je 0x407d8d
push ecx
mov ecx, esp
mov dword [ebp - 0x618], esp
lea eax, [ebp - 0x5a4]
push eax
call fcn.004018b0
mov dword [ebp - 0x6d0], eax
mov ecx, dword [ebp - 0x6d0]
mov dword [ebp - 0x6d4], ecx
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x61c], esp
push str.riliRun
call fcn.004018b0
mov dword [ebp - 0x6d8], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5b4]
call fcn.00442b90
mov ecx, 0x51aa14
call fcn.00401600
push eax
push 0x4f8494
push str.autorun
push str.Info
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5b4]
call fcn.00442a10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8c]
call fcn.00426070
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x90]
call fcn.00426070
jmp 0x4081a0
push str.itemselect
mov ecx, dword [ebp + 8]
call dword [sym.imp.ui_d.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_char_const__const]
movzx edx, al
test edx, edx
je 0x4081a0
lea ecx, [ebp - 0x5b8]
call fcn.00403be0
mov byte [ebp - 4], 0xa
push str.province
lea eax, [ebp - 0x10]
push eax
call fcn.004253a0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x407e39
mov ecx, dword [ebp - 0x6a8]
sub ecx, 0x10
call fcn.00407440
push 0
push 0
mov edx, dword [ebp - 0x6a8]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ebp - 0x6a8]
mov ecx, dword [ecx + 0x2c]
add ecx, 0x310
mov edx, dword [eax + 0x310]
mov eax, dword [edx + 8]
call eax
jmp 0x4080c6
push str.dijicity
lea ecx, [ebp - 0x10]
push ecx
call fcn.004253a0
add esp, 8
movzx edx, al
test edx, edx
je 0x4080c6
mov ecx, dword [ebp - 0x6a8]
sub ecx, 0x10
call fcn.004075d0
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x30]
mov edx, dword [ebp - 0x6a8]
mov eax, dword [edx + 0x30]
add eax, 0x2e0
mov edx, dword [ecx + 0x2e0]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jle 0x407ed5
push 1
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ecx + 0x30]
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x30]
mov edx, dword [edx]
mov eax, dword [edx + 0xcc]
call eax
push 0
push 0
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ecx + 0x30]
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x30]
add ecx, 0x310
mov edx, dword [edx + 0x310]
mov eax, dword [edx + 8]
call eax
jmp 0x4080c6
push 0
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ecx + 0x30]
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x30]
mov edx, dword [edx]
mov eax, dword [edx + 0xcc]
call eax
lea ecx, [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0x6a8]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ebp - 0x6a8]
mov ecx, dword [ecx + 0x2c]
mov edx, dword [eax]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x6dc], eax
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp - 0x6e0], ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x6e0]
call dword [sym.imp.ui_d.dll_public:_char_const____thiscall_DuiLib::CDuiString::operator_char_const__void_const]
push eax
lea ecx, [ebp - 0x5c0]
call fcn.004018b0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x660]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
lea edx, [ebp - 0x6a4]
push edx
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0x6a8]
mov eax, dword [edx + 0x28]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x6e4], eax
mov ecx, dword [ebp - 0x6e4]
mov dword [ebp - 0x6e8], ecx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x6e8]
call dword [sym.imp.ui_d.dll_public:_char_const____thiscall_DuiLib::CDuiString::operator_char_const__void_const]
push eax
lea ecx, [ebp - 0x5bc]
call fcn.004018b0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x6a4]
call dword [sym.imp.ui_d.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov dword [ebp - 0x5c4], 0
jmp 0x407fcc
mov edx, dword [ebp - 0x5c4]
add edx, 1
mov dword [ebp - 0x5c4], edx
mov ecx, 0x51a628
call fcn.00425800
cmp dword [ebp - 0x5c4], eax
jae 0x4080a8
lea ecx, [ebp - 0x5c0]
call fcn.00401600
push eax
mov eax, dword [ebp - 0x5c4]
push eax
mov ecx, 0x51a628
call fcn.00425820
add eax, 4
mov ecx, eax
call fcn.00424f00
test eax, eax
jne 0x4080a3
lea ecx, [ebp - 0x5bc]
call fcn.00401600
push eax
mov ecx, dword [ebp - 0x5c4]
push ecx
mov ecx, 0x51a628
call fcn.00425820
mov ecx, eax
call fcn.00424f00
test eax, eax
jne 0x4080a3
cmp dword [0x51a144], 1
jne 0x4080a1
mov edx, dword [ebp - 0x5c4]
push edx
mov ecx, 0x51a628
call fcn.00425820
add eax, 8
push eax
mov ecx, 0x51a9c8
call fcn.0042f3b0
mov ecx, 0x51a9cc
call fcn.00401600
push eax
push 0
mov ecx, 0x51a9c8
call fcn.00401c40
push eax
push 0x4f886c
push str.Info
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0x15
push 0x8001
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 4]
call dword [sym.imp.ui_d.dll_public:_long_int___thiscall_DuiLib::CWindowWnd::PostMessageA_unsigned_int__unsigned_int__long_int_]
jmp 0x4080a8
jmp 0x407fbd
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5bc]
call fcn.00426070
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5c0]
call fcn.00426070
cmp dword [0x51a144], 1
jne 0x408191
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [eax + 0x28]
add ecx, 0x310
mov edx, dword [edx + 0x310]
mov eax, dword [edx + 4]
call eax
push eax
push 0x4fa97c
lea ecx, [ebp - 0x5b8]
push ecx
call fcn.00403bb0
add esp, 0xc
mov ecx, 0x51a9cc
call fcn.00401600
push eax
lea ecx, [ebp - 0x5b8]
call fcn.00401600
push eax
push str.item1
push str.Info
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [ebp - 0x6a8]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ebp - 0x6a8]
mov ecx, dword [ecx + 0x2c]
add ecx, 0x310
mov edx, dword [eax + 0x310]
mov eax, dword [edx + 4]
call eax
push eax
push 0x4fa97c
lea ecx, [ebp - 0x5b8]
push ecx
call fcn.00403bb0
add esp, 0xc
mov ecx, 0x51a9cc
call fcn.00401600
push eax
lea ecx, [ebp - 0x5b8]
call fcn.00401600
push eax
push str.item2
push str.Info
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5b8]
call fcn.00426070
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00426070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.004bee8a
mov esp, ebp
pop ebp
ret 4