Function at 0x401520
Capabilities:
Check for time delay via gettickcount
Connect to http server
Copy file
Create http request
Create process on windows
Delete file
Get common file path
Move file
Resolve function by parsing pe exports
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42fad1
mov eax, dword fs:[0]
push eax
sub esp, 0x858
mov eax, dword [0x43bff0]
xor eax, esp
mov dword [esp + 0x850], eax
push ebx
push esi
push edi
mov eax, dword [0x43bff0]
xor eax, esp
push eax
lea eax, [esp + 0x868]
mov dword fs:[0], eax
push 0
push 0
mov dword [esp + 0x30], ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
je 0x4015a6
push 0
push 0
push str.Init_OLE_Error_
call fcn.0040f5ce
xor eax, eax
mov ecx, dword [esp + 0x868]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x850]
xor ecx, esp
call fcn.004194fa
mov esp, ebp
pop ebp
ret
call fcn.004030c0
test eax, eax
je 0x4015ba
push 0
push 0
push 0x433ce8
jmp 0x40157b
call fcn.0040d2e3
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x60]
push eax
lea ecx, [esp + 0x50]
call fcn.00404800
mov dword [esp + 0x870], 0
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4015f4
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov byte [esp + 0x870], 1
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x100
or eax, ecx
jge 0x401632
push 0x100
lea ecx, [esp + 0x14]
call fcn.004054f0
mov esi, dword [esp + 0x10]
call fcn.0040d2e3
mov eax, dword [eax + 8]
push 0x100
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test esi, esi
jne 0x40164f
xor eax, eax
jmp 0x401669
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401654
sub eax, edx
sar eax, 1
js 0x401c18
cmp eax, dword [esi - 8]
jg 0x401c18
push 4
mov dword [esi - 0xc], eax
push 0x433d00
lea ecx, [esp + 0x54]
mov word [esi + eax*2], 0
call fcn.004055b0
mov ecx, dword [esp + 0x4c]
mov esi, dword [esi - 0xc]
sub esi, dword [ecx - 0xc]
lea edx, [esp + 0x14]
push esi
push edx
lea ecx, [esp + 0x18]
call fcn.00404ba0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x874], 2
call fcn.00405110
mov byte [esp + 0x870], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4016de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
call fcn.00404b20
push 0x433d0c
push eax
call fcn.00404df0
mov bl, al
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40171e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x401730
push 0x433d0c
lea ecx, [esp + 0x14]
call fcn.00404a60
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40174a
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x44], edi
mov byte [esp + 0x870], 3
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40177c
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x870], 4
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4017ae
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x2c], esi
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x870], 5
mov eax, dword [ecx + 0x48]
mov word [esp + 0x25c], 0
cmp word [eax], 0
jne 0x401923
push 0x433d10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00404d10
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x80
push str.WorkOrder_XP.dat
push str.name
lea edx, [esp + 0x26c]
mov ecx, str.AutoUpdate
call fcn.0040a300
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40183e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp word [esp + 0x25c], 0
jne 0x40193f
push 0
push 0
push 0x433d74
call fcn.0040f5ce
lea eax, [esi - 0x10]
mov byte [esp + 0x870], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40187f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [esp + 0x870], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 1
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x870], 0xffffffff
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401580
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x401580
lea edx, [esp + 0x25c]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401930
lea eax, [esp + 0x25c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401950
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x260]
push ecx
lea ecx, [esp + 0x24]
call fcn.00405440
push 0x433d10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00404d10
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x80
push 0x433cb0
push 0x433d80
lea edx, [esp + 0x26c]
mov ecx, 0x433d90
call fcn.0040a300
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4019ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp word [esp + 0x25c], 0
mov edi, dword [esp + 0x28]
jne 0x4019e4
push str.GPRS_SXZCH.SN
jmp 0x4019ec
lea ecx, [esp + 0x25c]
push ecx
lea ecx, [edi + 0xa4]
call fcn.00404980
call fcn.004042b0
test eax, eax
jne 0x401a06
push edi
call fcn.00403390
push 0
push 0x433cb0
lea ecx, [esp + 0x34]
call fcn.00405440
mov esi, dword [esp + 0x1c]
cmp dword [esi - 0xc], 0
jle 0x401adb
push 0x20
push esi
call fcn.0041967f
add esp, 8
test eax, eax
je 0x401adb
sub eax, esi
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x401adb
lea edx, [esi + 1]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.00404af0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x874], 6
call fcn.00405110
mov byte [esp + 0x870], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401a92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x24]
call fcn.00404ba0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x874], 7
call fcn.00405110
mov byte [esp + 0x870], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401adb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x433dd0
call fcn.00419996
add esp, 4
push str.SinoETS
mov dword [edi + 0x54], eax
call fcn.00419996
add esp, 4
push 0
push str.connection
push str.setting
lea ecx, [esp + 0x64]
push ecx
mov ecx, edi
mov dword [edi + 0x68], eax
call fcn.00415dba
push 0x433e1c
lea ecx, [esp + 0x5c]
mov byte [esp + 0x874], 8
call fcn.00404aa0
test eax, eax
jne 0x401c22
mov edx, dword [esp + 0x2c]
push 0x433e20
push edx
call fcn.0041a037
add esp, 8
test eax, eax
je 0x401c52
lea esi, [edi + 0xa8]
push 0x433cb0
mov ecx, esi
call fcn.00404980
push 0x433d10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00404d10
add esp, 0xc
mov byte [esp + 0x870], 9
mov eax, dword [eax]
push eax
push 0x100
push 0x100
mov ecx, esi
call fcn.00404e50
push str.GPRS
push str.connection
mov edx, eax
mov ecx, str.setting
call fcn.0040a300
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x870], 8
call fcn.00404960
mov ecx, dword [esi]
test ecx, ecx
jne 0x401bc4
xor eax, eax
jmp 0x401be1
mov eax, ecx
lea ebx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401bd0
sub eax, ebx
sar eax, 1
js 0x401c18
cmp eax, dword [ecx - 8]
jg 0x401c18
mov dword [ecx - 0xc], eax
mov edx, dword [esi]
mov word [edx + eax*2], 0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x401c05
push str.GPRS
mov ecx, esi
call fcn.00404980
cmp dword [edi + 0x1ac], 0
mov esi, dword [esi]
jne 0x401c52
push esi
call fcn.00402d10
jmp 0x401c52
push 0x80070057
call fcn.004011d0
push 0x433e40
lea ecx, [esp + 0x5c]
call fcn.00404aa0
test eax, eax
jne 0x401c48
cmp dword [edi + 0x1ac], eax
jne 0x401c52
push 0x433cb0
call fcn.00402d10
jmp 0x401c52
mov dword [edi + 0x1ac], 1
lea ecx, [esp + 0xa4]
push ecx
call fcn.00405760
lea edx, [esp + 0x18c]
push edx
mov byte [esp + 0x874], 0xa
call fcn.00406ba0
mov byte [esp + 0x870], 0xb
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401c96
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov byte [esp + 0x870], 0xc
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401cc8
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0x870], 0xd
cmp dword [edi + 0x1ac], 0
jne 0x40286d
push 0
push 0x8d
lea ecx, [esp + 0x194]
call fcn.0040dfb6
push 0x433e44
lea ecx, [esp + 0x210]
call fcn.00404980
push 0
lea ecx, [esp + 0x190]
call fcn.004127ca
push 5
lea ecx, [esp + 0x190]
call fcn.0040d4fc
mov ecx, dword [esp + 0x1ac]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x433d10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00404d10
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x80
push 0x433cb0
push str.host
lea edx, [esp + 0x36c]
mov ecx, str.setting
call fcn.0040a300
add esp, 0x10
test eax, eax
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x401dc7
xor eax, eax
jmp 0x401db0
movzx ecx, word [eax + 0x433cb0]
mov word [esp + eax + 0x35c], cx
add eax, 2
test cx, cx
jne 0x401db0
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401de1
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x870], 0xe
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401e13
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov byte [esp + 0x870], 0xf
mov dword [esp + 0x14], 0
call fcn.00415f1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401e4d
push 0x80004005
call fcn.004011d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x24]
push str.ETSMain_XP.dat
push ecx
mov byte [esp + 0x878], 0x10
call fcn.00405680
mov esi, dword [esp + 0x2c]
push esi
lea edx, [esp + 0x368]
push edx
lea eax, [esp + 0x54]
push str._s_update__s
push eax
call fcn.00405680
add esp, 0x18
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x74]
push ecx
push edx
call fcn.0040f9fc
test eax, eax
je 0x40234b
push esi
lea eax, [esp + 0x360]
push eax
lea ecx, [esp + 0x3c]
push str._s_servlet_com.sino.pda.QueryUpdate_module_s
push ecx
call fcn.00405680
push 0x433d10
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x50]
push eax
call fcn.00404d10
add esp, 0x1c
mov ebx, dword [esp + 0x28]
mov byte [esp + 0x870], 0x11
mov eax, dword [eax]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push eax
mov edx, esi
mov edi, ebx
call fcn.00402f80
lea ecx, [esp + 0x38]
mov edi, eax
mov byte [esp + 0x870], 0x10
call fcn.00404960
test edi, edi
je 0x40234f
lea esi, [esp + 0x174]
call fcn.00402c80
push 5
lea ecx, [esp + 0x190]
mov byte [esp + 0x874], 0x12
call fcn.0040d4fc
xor esi, esi
push esi
push 0x66
lea ecx, [esp + 0xac]
call fcn.0040dfb6
mov edx, dword [ebx + 0x50]
push edx
lea ecx, [esp + 0xa8]
call fcn.0040d4bb
push 0x433f04
lea ecx, [esp + 0x170]
call fcn.00404980
push esi
lea ecx, [esp + 0xa8]
call fcn.004127ca
push 5
lea ecx, [esp + 0xa8]
call fcn.0040d4fc
mov eax, dword [esp + 0xc4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x3e8
mov dword [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x433cb0
push 0x433cb0
push esi
push str.SINOETS_1.0__p_
mov dword [esp + 0x78], esi
mov dword [esp + 0x74], 0x433cf8
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
mov dword [esp + 0x20], esi
je 0x402302
push 4
lea ecx, [esp + 0x54]
push ecx
push 2
push esi
mov dword [esp + 0x60], 0x2710
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x40]
push 0
push 0x4400000
push 3
push 0x433cb0
push 0x433cb0
push edx
push eax
push esi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esp + 0x38], eax
je 0x402302
mov edx, dword [esp + 0x48]
push 0
push 0x4400000
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push edx
push 0x433f50
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esp + 0x30], eax
je 0x402302
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
setne al
test al, al
je 0x402302
lea eax, [esp + 0x65c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x45c]
push ecx
push 0
push 0x433f58
lea edx, [esp + 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [esp + 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402310
mov ecx, dword [esp + 0x138]
push 0x640001
push 0
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
lea edx, [esp + 0x174]
push 0x433f60
push edx
call fcn.00405680
mov eax, dword [esp + 0x17c]
add esp, 0x10
push eax
push 0x3ea
lea ecx, [esp + 0xac]
call fcn.0040d3be
mov ecx, eax
call fcn.0040d4bb
push 0x3ea
lea ecx, [esp + 0xa8]
call fcn.0040d3be
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [esp + 0x94], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x7c]
mov dword [esp + 0x80], edx
mov edx, dword [esp + 0x30]
push edi
mov ecx, esi
lea eax, [esp + 0xa8]
mov dword [esp + 0x80], 0x28
mov dword [esp + 0x88], 0
call fcn.00402ed0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
lea eax, [esp + 0x174]
push 0x433f60
push eax
call fcn.00405680
mov ecx, dword [esp + 0x17c]
add esp, 0x10
push ecx
push 0x3ea
lea ecx, [esp + 0xac]
call fcn.0040d3be
mov ecx, eax
call fcn.0040d4bb
push 0x3ea
lea ecx, [esp + 0xa8]
call fcn.0040d3be
mov edx, dword [eax + 0x20]
mov esi, dword [sym.imp.USER32.dll_UpdateWindow]
push edx
call esi
mov eax, dword [esp + 0xc4]
push eax
call esi
cmp ebx, edi
jl 0x4022e9
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00404c50
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
push eax
call esi
lea ecx, [esp + 0x18]
call fcn.00404960
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00404c50
add esp, 0xc
mov byte [esp + 0x870], 0x13
mov eax, dword [eax]
lea ecx, [esp + 0x45c]
push ecx
mov ecx, eax
call fcn.00403260
test eax, eax
lea ecx, [esp + 0x18]
sete bl
mov byte [esp + 0x870], 0x12
call fcn.00404960
test bl, bl
je 0x4022a2
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00404c50
mov eax, dword [eax]
add esp, 0xc
push 0
push eax
lea edx, [esp + 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x18]
call fcn.00404960
lea eax, [esp + 0x45c]
push eax
call esi
push 0x433d10
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00404d10
add esp, 0xc
mov byte [esp + 0x870], 0x14
mov eax, dword [eax]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
push eax
call fcn.0040a710
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00404960
jmp 0x402310
lea eax, [esp + 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0x433f80
jmp 0x40230b
push 0
push 0
push 0x433f90
call fcn.0040f5ce
mov eax, dword [esp + 0x30]
test eax, eax
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x402321
push eax
call esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40232c
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x402337
push eax
call esi
lea esi, [esp + 0x174]
mov byte [esp + 0x870], 0x10
call fcn.00402cd0
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x360]
push ecx
lea edx, [esp + 0x4c]
push str._s_update__s
push edx
call fcn.00405680
add esp, 0x10
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x74]
push eax
push ecx
call fcn.0040f9fc
test eax, eax
jne 0x4023a1
push eax
push eax
push 0x433fcc
call fcn.0040f5ce
jmp 0x40284a
push esi
lea edx, [esp + 0x360]
push edx
lea eax, [esp + 0x3c]
push str._s_servlet_com.sino.pda.QueryUpdate_module_s
push eax
call fcn.00405680
push 0x433d10
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.00404d10
add esp, 0x1c
mov byte [esp + 0x870], 0x15
mov eax, dword [eax]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push eax
mov edx, esi
mov edi, ebx
call fcn.00402f80
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00404960
test edi, edi
je 0x40284a
lea esi, [esp + 0x174]
call fcn.00402c80
mov byte [esp + 0x870], 0x16
cmp dword [esp + 0x14], 0
jne 0x402484
push 5
lea ecx, [esp + 0x190]
call fcn.0040d4fc
push 0
push 0x66
lea ecx, [esp + 0xac]
call fcn.0040dfb6
mov edx, dword [ebx + 0x50]
push edx
lea ecx, [esp + 0xa8]
call fcn.0040d4bb
push 0x433f04
lea ecx, [esp + 0x170]
call fcn.00404980
push 0
lea ecx, [esp + 0xa8]
call fcn.004127ca
push 5
lea ecx, [esp + 0xa8]
call fcn.0040d4fc
mov eax, dword [esp + 0xc4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
push ebx
push 0x433cb0
push 0x433cb0
push ebx
push str.SINOETS_1.0__p_
mov dword [esp + 0x78], ebx
mov dword [esp + 0x74], 0x433cf8
mov dword [esp + 0x28], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x38], esi
je 0x40280b
push 4
lea ecx, [esp + 0x24]
push ecx
push 2
push esi
mov dword [esp + 0x30], 0x2710
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x40]
push ebx
push 0x4400000
push 3
push 0x433cb0
push 0x433cb0
push edx
push eax
push esi
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x40280b
mov edx, dword [esp + 0x48]
push ebx
push 0x4400000
lea ecx, [esp + 0x68]
push ecx
push ebx
push ebx
push edx
push 0x433f50
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
cmp eax, ebx
mov dword [esp + 0x30], eax
je 0x40280b
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
setne al
test al, al
je 0x40280b
lea eax, [esp + 0x65c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x45c]
push ecx
push ebx
push 0x433f58
lea edx, [esp + 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea eax, [esp + 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402817
mov ecx, dword [esp + 0x138]
push 0x640001
push ebx
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push ebx
lea edx, [esp + 0x174]
push 0x433f60
push edx
call fcn.00405680
mov eax, dword [esp + 0x17c]
add esp, 0x10
push eax
push 0x3ea
lea ecx, [esp + 0xac]
call fcn.0040d3be
mov ecx, eax
call fcn.0040d4bb
push 0x3ea
lea ecx, [esp + 0xa8]
call fcn.0040d3be
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x7c]
mov dword [esp + 0x80], edx
mov edx, dword [esp + 0x30]
push edi
mov ecx, esi
lea eax, [esp + 0xa8]
mov dword [esp + 0x80], 0x28
mov dword [esp + 0x88], ebx
mov dword [esp + 0x98], 1
call fcn.00402ed0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
lea eax, [esp + 0x174]
push 0x433f60
push eax
call fcn.00405680
mov ecx, dword [esp + 0x17c]
add esp, 0x10
push ecx
push 0x3ea
lea ecx, [esp + 0xac]
call fcn.0040d3be
mov ecx, eax
call fcn.0040d4bb
push 0x3ea
lea ecx, [esp + 0xa8]
call fcn.0040d3be
mov edx, dword [eax + 0x20]
mov esi, dword [sym.imp.USER32.dll_UpdateWindow]
push edx
call esi
mov eax, dword [esp + 0xc4]
push eax
call esi
add edi, 0xfffffc18
cmp ebx, edi
jl 0x4027f2
push str.WorkOrder_XP.bak
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.00404d10
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x87c], 0x17
call fcn.00404c50
mov esi, dword [esi]
mov eax, dword [eax]
add esp, 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0x18]
call fcn.00404960
lea ecx, [esp + 0x50]
mov byte [esp + 0x870], 0x16
call fcn.00404960
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00404c50
add esp, 0xc
mov byte [esp + 0x870], 0x18
mov eax, dword [eax]
lea ecx, [esp + 0x45c]
push ecx
mov ecx, eax
call fcn.00403260
test eax, eax
lea ecx, [esp + 0x18]
sete bl
mov byte [esp + 0x870], 0x16
call fcn.00404960
test bl, bl
je 0x4027a7
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00404c50
mov eax, dword [eax]
add esp, 0xc
push 0
push eax
lea edx, [esp + 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x18]
call fcn.00404960
lea eax, [esp + 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x433d10
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00404d10
add esp, 0xc
mov byte [esp + 0x870], 0x19
mov eax, dword [eax]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
push eax
call fcn.0040a710
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00404960
jmp 0x402817
lea eax, [esp + 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0x433f80
jmp 0x402812
push ebx
push ebx
push 0x433f90
call fcn.0040f5ce
mov eax, dword [esp + 0x30]
test eax, eax
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x402828
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x402833
push eax
call esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40283e
push eax
call esi
lea esi, [esp + 0x174]
call fcn.00402cd0
lea ecx, [esp + 0x24]
call fcn.00404960
lea ecx, [esp + 0x3c]
call fcn.00404960
lea ecx, [esp + 0x34]
mov byte [esp + 0x870], 0xd
call fcn.00404960
push 0x44
lea ecx, [esp + 0x218]
push 0
push ecx
call fcn.0041c1a0
xor eax, eax
add esp, 0xc
lea edx, [esp + 0x1c]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x64]
push ecx
mov dword [esp + 0x220], 0x44
call fcn.00404c50
add esp, 0xc
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0x218]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
mov byte [esp + 0x890], 0x1a
mov ecx, dword [esp + 0x7c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push ecx
call edi
test eax, eax
jne 0x402a21
push eax
push eax
push 0x434018
call fcn.0040f5ce
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00404c50
add esp, 0xc
mov esi, eax
push str.WorkOrder_XP.bak
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x87c], 0x1b
call fcn.00404d10
mov esi, dword [esi]
mov eax, dword [eax]
add esp, 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40295d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 0x1a
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402985
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00404c50
add esp, 0xc
mov esi, eax
mov byte [esp + 0x870], 0x1c
mov eax, dword [esp + 0x2c]
cmp dword [eax - 4], 1
jle 0x4029bd
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x30]
call fcn.00405290
mov eax, dword [esi]
lea edx, [esp + 0x6c]
push edx
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x218]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
push edx
push eax
call edi
test eax, eax
mov byte [esp + 0x870], 0x1a
mov eax, dword [esp + 0x20]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a0d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x402a61
push 0
push 0
push 0x434038
call fcn.0040f5ce
jmp 0x402a61
push str.WorkOrder_XP.bak
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00404d10
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
cmp dword [ecx + 0x1ac], 0
jne 0x402a7c
push 0
lea ecx, [esp + 0x190]
call fcn.0040d4fc
mov byte [esp + 0x870], 0xd
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402aa4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 0xc
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402acc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 0xb
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402af4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x18c]
mov byte [esp + 0x870], 0xa
call fcn.00402c30
lea ecx, [esp + 0xa4]
push ecx
mov byte [esp + 0x874], 8
call fcn.00402bb0
mov byte [esp + 0x870], 5
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402b45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 4
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 3
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x870], 1
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
jmp 0x4018ae