Function at 0x4025a0
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Query or enumerate registry value
Receive data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4389e4
mov eax, dword fs:[0]
push eax
mov eax, 0x10dc
call fcn.00424780
mov eax, dword [0x4475e0]
xor eax, esp
mov dword [esp + 0x10d8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4475e0]
xor eax, esp
push eax
lea eax, [esp + 0x10f0]
mov dword fs:[0], eax
push 0x43e998
lea ecx, [esp + 0x60]
call fcn.004013a0
xor ebx, ebx
push str.b_pnglueup_0_png3_blu_pngechip.p_pnghp_png
lea ecx, [esp + 0x6c]
mov dword [esp + 0x10fc], ebx
call fcn.004013a0
push 0x43e998
push str._png
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x1104], 1
call fcn.00404590
mov eax, dword [esp + 0x68]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x4c], esp
mov esi, esp
push eax
call fcn.00404dd0
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x1100], 2
mov ecx, esp
mov dword [esp + 0x68], esp
push str.ibluechip.kr
call fcn.004013a0
lea ecx, [esp + 0x60]
mov byte [esp + 0x1100], 1
call fcn.00401ff0
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x10fc], 3
call fcn.00404d50
mov byte [esp + 0x10f8], 1
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40269c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x5c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x4c], esp
mov esi, esp
push eax
call fcn.00404dd0
add esp, 4
lea ecx, [esp + 0x5c]
add eax, 0x10
push ecx
mov dword [esi], eax
call fcn.00401ed0
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x10fc], 4
call fcn.00404d50
mov byte [esp + 0x10f8], 1
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4026fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004017e0
xor eax, eax
mov byte [esp + 0x80], bl
mov dword [esp + 0x81], eax
mov dword [esp + 0x85], eax
mov byte [esp + 0x89], al
mov dword [esp + 0x44], ebx
push 0x43e998
lea ecx, [esp + 0x58]
mov byte [esp + 0x10fc], 6
call fcn.004013a0
push 0x103
lea edx, [esp + 0x199]
push ebx
mov byte [esp + 0x1100], 7
push edx
mov byte [esp + 0x1a0], bl
call fcn.00423db0
push 0x103
lea eax, [esp + 0x2ad]
push ebx
push eax
mov byte [esp + 0x2b4], bl
call fcn.00423db0
push 0x103
lea ecx, [esp + 0x3c1]
push ebx
push ecx
mov byte [esp + 0x3c8], bl
call fcn.00423db0
push 0x103
lea edx, [esp + 0x4d5]
push ebx
push edx
mov byte [esp + 0x4dc], bl
call fcn.00423db0
add esp, 0x30
call fcn.00408793
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4027cb
push 0x80004005
call fcn.004011c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x6c], eax
mov byte [esp + 0x10f8], 8
call fcn.00408793
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4027fd
push 0x80004005
call fcn.004011c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x70], eax
mov byte [esp + 0x10f8], 9
mov ecx, dword [esp + 0x5c]
mov edi, dword [ecx - 0xc]
lea edx, [edi + 2]
push edx
call fcn.00406398
mov ecx, dword [esp + 0x60]
mov esi, eax
add esp, 4
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x402830
mov byte [esi + edi], bl
mov byte [esi + edi + 1], bl
cmp byte [esi], 0xff
jne 0x40286f
cmp byte [esi + 1], 0xfe
jne 0x40286f
lea eax, [esi + 2]
push eax
lea ecx, [esp + 0x70]
call fcn.00404c90
push 0x3b
push str.File_starts_with_hex_FFFE__assumed_to_be_wide_char_format.
lea ecx, [esp + 0x78]
call fcn.00404b10
jmp 0x40288a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x402874
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x74]
call fcn.004016c0
push esi
call fcn.00406393
mov ebp, dword [esp + 0x70]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
sub eax, 0x14
add esp, 4
cmp ecx, eax
jl 0x4028e3
mov edx, ebp
lea esi, [esp + 0x14]
call fcn.00405020
cmp dword [esp + 0x24], ebx
je 0x4028e3
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, esi
call fcn.00405a90
test eax, eax
je 0x4028e1
cmp eax, dword [esp + 0x24]
jb 0x402a11
push 0x80070057
call fcn.004011c0
xor ebx, ebx
mov byte [esp + 0x10f8], 8
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40290b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x10f8], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40292f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10f8], 6
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402957
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10f8], 1
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x14], vtable.CMarkup.0
je 0x402978
push eax
call fcn.004220df
add esp, 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402998
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4029b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10f8], bl
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4029df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x10f8], 0xffffffff
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x404567
xor ebx, ebx
mov dword [esp + 0x30], eax
mov eax, str.MAINUPDATE
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], ebx
call fcn.00405140
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
je 0x402a5b
cmp dword [esp + 0x40], 1
jne 0x402a5b
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], ecx
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], ecx
mov eax, str.SETTING
lea ecx, [esp + 0x14]
call fcn.00405140
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
je 0x402a93
cmp dword [esp + 0x40], 1
jne 0x402a93
mov eax, dword [esp + 0x38]
xor edx, edx
cmp eax, ebx
setne dl
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], edx
mov eax, str.COUNT
lea ecx, [esp + 0x14]
call fcn.00405140
lea esi, [esp + 0x58]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x80]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x402ab7
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ae5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x80]
push ecx
call fcn.004221e3
mov edi, eax
mov eax, dword [esp + 0x34]
add esp, 4
cmp eax, ebx
mov dword [esp + 0x64], edi
je 0x402b3c
cmp eax, dword [esp + 0x24]
jb 0x402b13
push 0x80070057
call fcn.004011c0
mov esi, dword [esp + 0x34]
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov edx, eax
mov eax, dword [ecx + 0x14]
xor ecx, ecx
cmp edx, ebx
setne cl
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
cmp edi, ebx
mov dword [esp + 0x4c], ecx
jle 0x403089
push ecx
lea edx, [esp + 0x58]
push str.UPDATE_02d
push edx
call fcn.00404d30
add esp, 0xc
cmp dword [esp + 0x24], ebx
je 0x402bb3
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x402bb3
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
jmp 0x402bb7
mov eax, dword [esp + 0x34]
test eax, eax
je 0x402be3
cmp dword [esp + 0x40], 1
jne 0x402be3
mov ecx, dword [esp + 0x38]
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x30], eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x402c2e
mov ecx, dword [esp + 0x30]
push str.VERNAME
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x402c2e
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x58]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x194]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x402c44
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402c72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
je 0x402cc1
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push 0x43e728
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x402cc1
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x78]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x29c]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x402cd7
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402d05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
je 0x402d54
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push str.DOWNURL
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x402d54
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x74]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x3a4]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x402d70
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402d9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
je 0x402ded
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push str.FILENAME
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x402ded
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x60]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x4ac]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x402e03
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402e31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
xor ebx, ebx
cmp ecx, ebx
je 0x402e6c
cmp ecx, dword [esp + 0x24]
jae 0x4028d7
mov edx, dword [esp + 0x34]
mov eax, ecx
shl eax, 5
add eax, dword [esp + 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
cmp ecx, ebx
setne dl
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x40], edx
push 0x103
lea eax, [esp + 0x91]
push ebx
push eax
mov byte [esp + 0x98], 0
call fcn.00423db0
add esp, 0xc
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x54]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SOFTWARE_bluch
push SysReAllocStringLen
mov dword [esp + 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x402ecc
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x402ec4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x90]
push edx
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x50]
push eax
push ebx
lea ecx, [esp + 0x1a4]
push ecx
push edx
mov dword [esp + 0x68], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x402f1a
mov eax, dword [esp + 0x48]
cmp eax, 1
je 0x402f0c
cmp eax, 2
jne 0x402f1a
cmp dword [esp + 0x50], ebx
jne 0x402f1a
mov byte [esp + 0x8c], 0
lea eax, [esp + 0x8c]
push eax
call fcn.004221e3
lea ecx, [esp + 0x2a0]
push ecx
mov esi, eax
call fcn.004221e3
add esp, 8
cmp esi, eax
je 0x40305d
push 0x3ff
lea edx, [esp + 0xcf1]
push ebx
push edx
mov byte [esp + 0xcf8], 0
call fcn.00423db0
add esp, 0xc
push ebx
push 0x1a
lea eax, [esp + 0xcf4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0xcec]
add edi, 0xffffffff
jmp 0x402f80
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x402f80
mov cx, word [0x43e740]
lea eax, [esp + 0x4ac]
mov word [edi], cx
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402fa0
lea edi, [esp + 0xcec]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402fb5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push ebx
push ebx
mov ecx, eax
lea edx, [esp + 0xcf4]
push edx
lea eax, [esp + 0x3b0]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, ebx
jne 0x403035
push 1
push ebx
push 0x43e998
lea ecx, [esp + 0xcf8]
push ecx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [esp + 0x29c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [esp + 0x44]
add eax, 1
push eax
lea eax, [esp + 0x2a0]
push eax
push 1
push ebx
lea ecx, [esp + 0x1a4]
push ecx
push esi
call ebp
jmp 0x403061
push 0x43e998
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [esp + 0x44]
add eax, 1
push eax
push 0x43e998
push 1
push ebx
lea edx, [esp + 0x1a4]
push edx
push esi
call ebp
jmp 0x403061
mov esi, dword [esp + 0x44]
cmp esi, ebx
je 0x403070
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x44], ebx
mov ecx, dword [esp + 0x4c]
add ecx, 1
cmp ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
jl 0x402b50
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x4030c4
cmp eax, dword [esp + 0x24]
jb 0x40309d
push 0x80070057
call fcn.004011c0
mov edx, dword [esp + 0x34]
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
cmp eax, ebx
setne dl
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], edx
push ebx
push 0x43e998
lea ecx, [esp + 0x5c]
call fcn.004016c0
cmp dword [esp + 0x24], ebx
mov eax, dword [esp + 0x34]
je 0x40312b
mov ecx, dword [esp + 0x30]
push str.INIUPDATE
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403127
cmp eax, dword [esp + 0x24]
jb 0x403103
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], 1
jmp 0x40312f
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
test eax, eax
je 0x403157
cmp dword [esp + 0x40], 1
jne 0x403157
mov esi, ecx
mov dword [esp + 0x30], eax
mov eax, ecx
xor edx, edx
xor ecx, ecx
test esi, esi
setne dl
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x4031b0
mov ecx, dword [esp + 0x30]
push str.INISETTING
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x4031a8
cmp eax, dword [esp + 0x24]
jb 0x403184
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], 1
jmp 0x4031b0
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4031d8
cmp dword [esp + 0x40], 1
jne 0x4031d8
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x30], eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x403229
mov ecx, dword [esp + 0x30]
push str.INICOUNT
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403229
cmp eax, dword [esp + 0x24]
jb 0x403205
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x48]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x80]
nop
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403240
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40326e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x80]
push ecx
call fcn.004221e3
mov edi, eax
mov eax, dword [esp + 0x34]
xor ebx, ebx
add esp, 4
cmp eax, ebx
mov dword [esp + 0x64], edi
je 0x4032c7
cmp eax, dword [esp + 0x24]
jb 0x40329e
push 0x80070057
call fcn.004011c0
mov esi, dword [esp + 0x34]
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov edx, eax
mov eax, dword [ecx + 0x14]
xor ecx, ecx
cmp edx, ebx
setne cl
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], ecx
cmp edi, ebx
mov dword [esp + 0x50], ebx
jle 0x4038e0
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esp, [esp]
mov edx, dword [esp + 0x50]
push edx
lea eax, [esp + 0x58]
push str.INIDOWN_02d
push eax
call fcn.00404d30
mov eax, dword [esp + 0x40]
add esp, 0xc
cmp dword [esp + 0x24], ebx
je 0x40334b
mov ecx, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x34]
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403347
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov edx, dword [ecx + 0x14]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
jmp 0x40334b
mov eax, dword [esp + 0x34]
test eax, eax
je 0x403377
cmp dword [esp + 0x40], 1
jne 0x403377
mov ecx, dword [esp + 0x38]
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x30], eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x4033c2
mov ecx, dword [esp + 0x30]
push str.VERNAME
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x4033c2
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x48]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x194]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4033d8
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403406
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
je 0x403455
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push 0x43e728
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403455
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x60]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x29c]
jmp 0x403470
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403470
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40349e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
je 0x4034ed
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push str.DOWNURL
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x4034ed
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x74]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x3a4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403503
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403531
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
je 0x403580
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push str.FILENAME
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403580
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x78]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x4ac]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403596
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4035c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
xor ebx, ebx
cmp ecx, ebx
je 0x4035ff
cmp ecx, dword [esp + 0x24]
jae 0x4028d7
mov edx, dword [esp + 0x34]
mov eax, ecx
shl eax, 5
add eax, dword [esp + 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
cmp ecx, ebx
setne dl
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x40], edx
push 0x103
lea eax, [esp + 0x5b9]
push ebx
push eax
mov byte [esp + 0x5c0], 0
call fcn.00423db0
add esp, 0xc
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x50]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SOFTWARE_bluch
push SysReAllocStringLen
mov dword [esp + 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40365f
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x403657
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x5b8]
push edx
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x60]
push eax
push ebx
lea ecx, [esp + 0x1a4]
push ecx
push edx
mov dword [esp + 0x64], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x4036ad
mov eax, dword [esp + 0x58]
cmp eax, 1
je 0x40369f
cmp eax, 2
jne 0x4036ad
cmp dword [esp + 0x4c], ebx
jne 0x4036ad
mov byte [esp + 0x5b4], 0
lea eax, [esp + 0x5b4]
push eax
call fcn.004221e3
lea ecx, [esp + 0x2a0]
push ecx
mov esi, eax
call fcn.004221e3
push 0x103
lea edx, [esp + 0x9e1]
push ebx
push edx
mov edi, eax
mov byte [esp + 0x9e8], 0
call fcn.00423db0
push 0x103
lea eax, [esp + 0xaf5]
push ebx
push eax
mov byte [esp + 0xafc], 0
call fcn.00423db0
push 0x103
lea ecx, [esp + 0xc09]
push ebx
push ecx
mov byte [esp + 0xc10], 0
call fcn.00423db0
push 0x103
lea edx, [esp + 0xbd]
push ebx
push edx
mov byte [esp + 0xc4], 0
call fcn.00423db0
add esp, 0x38
push 0x104
lea eax, [esp + 0x9d8]
push eax
push str.bluchup.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebp
push ebx
push ebx
lea ecx, [esp + 0xbec]
push ecx
lea edx, [esp + 0xae8]
push edx
lea eax, [esp + 0x9e4]
push eax
call fcn.004223d8
lea ecx, [esp + 0x4c0]
push ecx
lea edx, [esp + 0xbfc]
push edx
lea eax, [esp + 0xaf8]
push eax
lea ecx, [esp + 0xac]
push str._s_s_s
push ecx
call fcn.00422422
add esp, 0x28
cmp esi, edi
je 0x403829
push ebx
push ebx
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x3b0]
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, ebx
jl 0x4037fa
lea ecx, [esp + 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x44]
add eax, 1
push eax
lea edx, [esp + 0x2a0]
push edx
push 1
push ebx
lea eax, [esp + 0x1a4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4038b4
push 0x43e998
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov eax, dword [esp + 0x48]
push 0x43e998
push 1
push ebx
lea edx, [esp + 0x1a4]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4038b4
lea ecx, [esp + 0x8c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40384f
push ebx
push ebx
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x3b0]
push eax
jmp 0x4038ae
lea ecx, [esp + 0x8c]
push 0x43e790
push ecx
call fcn.0042259c
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4038b4
push 2
push ebx
push esi
call fcn.00422636
push esi
call fcn.00422853
mov edi, eax
push edi
call fcn.00406398
push esi
call fcn.00421a83
add esp, 0x18
cmp edi, ebx
jne 0x4038b4
lea edx, [esp + 0x8c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push ebx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x3b0]
push ecx
push ebx
call sub.urlmon.dll_URLDownloadToFileA
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x4038c7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x50]
add eax, 1
cmp eax, dword [esp + 0x64]
mov dword [esp + 0x50], eax
jl 0x4032e0
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x40391b
cmp eax, dword [esp + 0x24]
jb 0x4038f4
push 0x80070057
call fcn.004011c0
mov edx, dword [esp + 0x34]
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
cmp eax, ebx
setne dl
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], edx
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x50]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SOFTWARE_bluch
push SysReAllocStringLen
mov dword [esp + 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40395f
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x403955
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x44], ebp
jmp 0x403963
mov ebp, dword [esp + 0x44]
push 0x103
lea edx, [esp + 0x7c9]
push 0
push edx
mov byte [esp + 0x7d0], 0
call fcn.00423db0
push 0x103
lea eax, [esp + 0x6cd]
push 0
push eax
mov byte [esp + 0x6d4], 0
call fcn.00423db0
push 0x103
lea ecx, [esp + 0x8e9]
push 0
push ecx
mov byte [esp + 0x8f0], 0
call fcn.00423db0
add esp, 0x24
push 0
push 0x43e998
lea ecx, [esp + 0x5c]
call fcn.004016c0
cmp dword [esp + 0x24], 0
mov eax, dword [esp + 0x34]
je 0x403a23
mov ecx, dword [esp + 0x30]
push str.CONTROL
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403a1f
cmp eax, dword [esp + 0x24]
jb 0x4039fb
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov edx, dword [ecx + 0x14]
xor ecx, ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], 1
jmp 0x403a27
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
test eax, eax
je 0x403a4f
cmp dword [esp + 0x40], 1
jne 0x403a4f
mov esi, ecx
mov dword [esp + 0x30], eax
mov eax, ecx
xor edx, edx
xor ecx, ecx
test esi, esi
setne dl
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x403aa8
mov ecx, dword [esp + 0x30]
push str.SEARCH
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403aa0
cmp eax, dword [esp + 0x24]
jb 0x403a7c
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], 1
jmp 0x403aa8
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x403ad0
cmp dword [esp + 0x40], 1
jne 0x403ad0
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x30], eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x403b21
mov ecx, dword [esp + 0x30]
push str.LIVE
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403b21
cmp eax, dword [esp + 0x24]
jb 0x403afd
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x48]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x7c4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403b37
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403b65
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x7c4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea edx, [esp + 0x7c8]
push edx
push 1
push 0
push str.searchlive
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x30]
test ecx, ecx
mov edi, dword [esp + 0x24]
je 0x403bd6
cmp ecx, edi
jb 0x403ba9
push 0x80070057
call fcn.004011c0
mov edx, dword [esp + 0x34]
mov eax, ecx
shl eax, 5
add eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
test esi, esi
setne dl
mov eax, esi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], edx
jmp 0x403bda
mov eax, dword [esp + 0x34]
test edi, edi
je 0x403c30
push str.ADDRESSBAR
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
mov edi, dword [esp + 0x24]
je 0x403c28
cmp eax, edi
jb 0x403c02
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
jmp 0x403c30
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
test eax, eax
je 0x403c5e
cmp dword [esp + 0x40], 1
jne 0x403c5e
mov esi, dword [esp + 0x38]
xor edx, edx
test esi, esi
setne dl
mov ecx, eax
mov eax, esi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
test edi, edi
je 0x403ca8
push str.LIVE
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403ca8
cmp eax, dword [esp + 0x24]
jb 0x403c84
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x48]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x6bc]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403cc0
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403cee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x6bc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea edx, [esp + 0x6c0]
push edx
push 1
push 0
push str.addressbarlive
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x30]
test ecx, ecx
mov edi, dword [esp + 0x24]
je 0x403d5f
cmp ecx, edi
jb 0x403d32
push 0x80070057
call fcn.004011c0
mov edx, dword [esp + 0x34]
mov eax, ecx
shl eax, 5
add eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
test esi, esi
setne dl
mov eax, esi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], edx
jmp 0x403d63
mov eax, dword [esp + 0x34]
test edi, edi
je 0x403db9
push str.SECOND_SEARCH
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
mov edi, dword [esp + 0x24]
je 0x403db1
cmp eax, edi
jb 0x403d8b
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
jmp 0x403db9
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
test eax, eax
je 0x403de7
cmp dword [esp + 0x40], 1
jne 0x403de7
mov esi, dword [esp + 0x38]
xor edx, edx
test esi, esi
setne dl
mov ecx, eax
mov eax, esi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
test edi, edi
je 0x403e31
push str.LIVE
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403e31
cmp eax, dword [esp + 0x24]
jb 0x403e0d
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x48]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x8cc]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403e47
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403e75
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x8cc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea edx, [esp + 0x8d0]
push edx
push 1
push 0
push str.secondSearchlive
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esp + 0x24], 0
mov eax, dword [esp + 0x34]
je 0x403ef8
mov ecx, dword [esp + 0x30]
push str.KEY_SET
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403ef4
cmp eax, dword [esp + 0x24]
jb 0x403ed0
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], 1
jmp 0x403efc
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
test eax, eax
je 0x403f24
cmp dword [esp + 0x40], 1
jne 0x403f24
mov esi, ecx
mov dword [esp + 0x30], eax
mov eax, ecx
xor edx, edx
xor ecx, ecx
test esi, esi
setne dl
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x403f7d
mov ecx, dword [esp + 0x30]
push str.SETTING
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403f75
cmp eax, dword [esp + 0x24]
jb 0x403f51
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], 1
jmp 0x403f7d
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x403fa5
cmp dword [esp + 0x40], 1
jne 0x403fa5
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x30], eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x403ff6
mov ecx, dword [esp + 0x30]
push str.COUNT
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x403ff6
cmp eax, dword [esp + 0x24]
jb 0x403fd2
push 0x80070057
call fcn.004011c0
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x48]
lea eax, [esp + 0x14]
call fcn.00401900
mov ecx, dword [eax]
lea edx, [esp + 0x80]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x404010
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40403e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x80]
push ecx
call fcn.004221e3
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x34]
add esp, 4
test eax, eax
mov dword [esp + 0x64], ebx
je 0x404099
cmp eax, ebp
jb 0x404072
push 0x80070057
call fcn.004011c0
mov edi, dword [esp + 0x34]
mov ecx, eax
shl ecx, 5
add ecx, esi
mov edx, eax
mov eax, dword [ecx + 0x14]
xor ecx, ecx
test edx, edx
setne cl
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], ecx
test ebx, ebx
mov dword [esp + 0x50], 0
jle 0x404375
mov edx, dword [esp + 0x50]
push edx
lea eax, [esp + 0x58]
push str.REFFER_02d
push eax
call fcn.00404d30
push 0x43e80c
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x6c]
push edx
call fcn.00404910
push str.Query
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0x111c], 0xa
call fcn.00404910
add esp, 0x24
mov byte [esp + 0x10f8], 0xb
cmp dword [esp + 0x24], 0
mov eax, dword [esp + 0x34]
je 0x40414d
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x30]
push edx
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x404149
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
jmp 0x40414d
mov eax, dword [esp + 0x34]
test eax, eax
je 0x404179
cmp dword [esp + 0x40], 1
jne 0x404179
mov ecx, dword [esp + 0x38]
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x30], eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edx
cmp dword [esp + 0x24], 0
je 0x4041c4
mov ecx, dword [esp + 0x30]
push str.CHECK
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x4041c4
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x48]
lea eax, [esp + 0x14]
call fcn.00401900
mov esi, dword [eax]
mov edi, dword [esp + 0x58]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x4027c1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [esp + 0x44]
add eax, 1
push eax
push esi
push 1
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404222
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
je 0x404271
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push str.QUERY
lea ebx, [esp + 0x18]
call fcn.00405a90
test eax, eax
je 0x404271
cmp eax, dword [esp + 0x24]
jae 0x4028d7
mov ecx, eax
shl ecx, 5
add ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 1
lea esi, [esp + 0x60]
lea eax, [esp + 0x14]
call fcn.00401900
mov esi, dword [eax]
mov edi, dword [esp + 0x4c]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x4027c1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push esi
push 1
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4042cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x404304
cmp ecx, dword [esp + 0x24]
jae 0x4028d7
mov edx, dword [esp + 0x34]
mov eax, ecx
shl eax, 5
add eax, dword [esp + 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
test ecx, ecx
setne dl
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x40], edx
mov byte [esp + 0x10f8], 0xa
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40432c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10f8], 9
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404354
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x50]
add eax, 1
cmp eax, dword [esp + 0x64]
mov dword [esp + 0x50], eax
jl 0x4040a9
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
test eax, eax
je 0x404416
cmp eax, ebp
jb 0x40438b
push 0x80070057
call fcn.004011c0
mov edx, dword [esp + 0x34]
mov ecx, eax
shl ecx, 5
add ecx, esi
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x38], edx
xor edx, edx
test eax, eax
setne dl
test ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], edx
je 0x404416
cmp ecx, ebp
jb 0x4043c2
push 0x80070057
call fcn.004011c0
mov edx, ecx
shl edx, 5
add edx, esi
mov edx, dword [edx + 0x14]
mov dword [esp + 0x38], eax
xor eax, eax
test ecx, ecx
setne al
test edx, edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x40], eax
je 0x404416
cmp edx, ebp
jb 0x4043f5
push 0x80070057
call fcn.004011c0
mov eax, edx
shl eax, 5
add eax, esi
mov eax, dword [eax + 0x14]
mov dword [esp + 0x38], ecx
xor ecx, ecx
test edx, edx
setne cl
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x40], ecx
mov esi, dword [esp + 0x44]
test esi, esi
je 0x40442b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x44], esi
mov byte [esp + 0x10f8], 8
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404453
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10f8], 7
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40447b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10f8], 6
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4044a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4044ae
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x10f8], 1
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x14], vtable.CMarkup.0
je 0x4044cf
push eax
call fcn.004220df
add esp, 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4044ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40450f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10f8], 0
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404537
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x10f8], 0xffffffff
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404562
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10d8]
xor ecx, esp
call fcn.004217b1
add esp, 0x10e8
ret