Function at 0x43e940
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d2960
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0xb08]
cmp eax, ebx
mov eax, dword [esi + 0x16e8]
jne 0x43e9c0
cmp eax, ebx
jle 0x43e9d9
mov ecx, dword [0x5317dc]
mov dword [esp + 0x18], ecx
push eax
lea edx, [esp + 0x1c]
push 0x51e1ec
push edx
mov dword [esp + 0x44], ebx
call fcn.004b1390
add esp, 8
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004b7771
mov ecx, esi
mov byte [esp + 0x3c], bl
call fcn.0043add0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x18]
jmp 0x43ee8c
cmp eax, ebx
jle 0x43e9d9
push ebx
push ebx
push ebx
push ebx
push esi
push 0x43eec0
mov dword [esi + 0xb08], ebx
call fcn.004b8878
mov eax, dword [0x5317dc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], 2
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0x16ec]
lea edx, [esi + 0xed1]
push ecx
push ecx
mov bl, 3
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], bl
call fcn.004b7a6a
mov ecx, dword [esi + 0x2048]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x44], bl
call fcn.00407c40
mov ecx, dword [eax]
lea edx, [esi + 0x10c5]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov byte [esp + 0x48], 5
call fcn.004b7a6a
mov ecx, dword [esi + 0x2048]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 5
call fcn.00407c40
mov ecx, dword [eax]
lea edx, [esi + 0x173a]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x4c], 7
call fcn.004b7a6a
mov ecx, dword [esi + 0x2048]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x4c], 7
call fcn.00407c40
mov ecx, dword [eax]
lea edx, [esi + 0x192e]
push ecx
push edx
push ecx
lea eax, [esi + 0x1938]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
mov byte [esp + 0x54], 9
call fcn.004b7a6a
lea ecx, [esp + 0x34]
mov byte [esp + 0x50], 9
push ecx
mov ecx, dword [esi + 0x2048]
call fcn.00407c40
mov edx, dword [eax]
lea eax, [esi + 0x179e]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
mov byte [esp + 0x54], 0xb
push eax
call fcn.004b7a6a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0xb
push ecx
mov ecx, dword [esi + 0x2048]
call fcn.00407c40
mov edx, dword [eax]
lea eax, [esi + 0x1a00]
push edx
push eax
push ecx
lea edx, [esi + 0x1708]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
mov byte [esp + 0x60], 0xd
call fcn.004b7a6a
mov ecx, dword [esi + 0x2048]
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x60], 0xd
call fcn.00407c40
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push ecx
push str._estar_client_SetInfo.asp_actionClient_AddInfoInfoSign0AddSignNewInfoMsg_Code_sMsg_Type_sMsg_Content_sMsg_Tel_sMsg_Flag_sMsg_StartCity_sMsg_NetPhone_sMsg_Company_sInfoNum_d
push edx
mov byte [esp + 0x64], 0xf
call fcn.004b1390
add esp, 0x2c
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0xd
call fcn.004b79fc
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0xb
call fcn.004b79fc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 9
call fcn.004b79fc
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 7
call fcn.004b79fc
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 5
call fcn.004b79fc
lea ecx, [esp + 0x28]
mov byte [esp + 0x38], bl
call fcn.004b79fc
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004b7771
push ecx
lea edx, [esi + 0xe3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x44], 0x10
call fcn.004b7771
push ecx
mov byte [esp + 0x44], 0x11
mov ecx, esp
mov dword [esp + 0x30], esp
push str.POST
call fcn.004b7a6a
mov ecx, dword [esi + 0x2048]
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x48], bl
call fcn.00406690
mov byte [esp + 0x38], 0x13
push eax
lea ecx, [esp + 0x10]
call fcn.004b7b35
lea ecx, [esp + 0x28]
mov byte [esp + 0x38], bl
call fcn.004b79fc
mov ecx, dword [esp + 0xc]
push str.Error
push ecx
call fcn.0049fe02
add esp, 8
test eax, eax
je 0x43ee56
mov edx, dword [esp + 0xc]
push 0x533b8c
push edx
call fcn.0049fe02
add esp, 8
test eax, eax
je 0x43ee56
mov eax, dword [esp + 0xc]
push str.AddError
push eax
call fcn.0049fe02
add esp, 8
test eax, eax
jne 0x43ec5c
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51e0d8
call fcn.004b7a6a
jmp 0x43ee67
mov ecx, dword [esp + 0xc]
push str.AddFull
push ecx
call fcn.0049fe02
add esp, 8
test eax, eax
jne 0x43ec88
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51e080
call fcn.004b7a6a
jmp 0x43ee67
mov edx, dword [esp + 0xc]
push str.AddOK
push edx
call fcn.0049fe02
add esp, 8
test eax, eax
jne 0x43ee20
mov ecx, esi
call fcn.0043f180
mov eax, dword [0x5317dc]
mov dword [esp + 0x18], eax
lea edi, [esi + 0x1a05]
lea ecx, [esp + 0x18]
push edi
push 0x505480
push ecx
mov byte [esp + 0x44], 0x16
call fcn.004b1390
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 0xe18]
push edx
push eax
call fcn.0049fe02
add esp, 0x14
test eax, eax
jne 0x43ed02
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004b7771
mov ecx, esi
mov byte [esp + 0x3c], 0x16
call fcn.0043f5b0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.strCountpeizaiwangcn
call fcn.004b7a6a
lea ecx, [esp + 0x14]
push str.SoftwareMicrosoftWindowsCurrentVersion_
push ecx
mov ecx, dword [esi + 0x2048]
mov byte [esp + 0x44], 0x16
call fcn.00406ef0
mov edx, dword [esp + 0x10]
push str.Error
push edx
mov byte [esp + 0x40], 0x19
call fcn.0049fe02
add esp, 8
test eax, eax
jne 0x43ed81
push 0x51263c
lea ecx, [esp + 0x14]
call fcn.004b7b85
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004b7771
mov ecx, dword [esi + 0x2048]
push str.strCountpeizaiwangcn
push str.SoftwareMicrosoftWindowsCurrentVersion_
mov byte [esp + 0x44], 0x19
call fcn.00406510
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004a0849
inc eax
lea edx, [esp + 0x14]
push eax
push 0x5054b4
push edx
call fcn.004b1390
add esp, 0xc
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004b7771
mov ecx, dword [esi + 0x2048]
push str.strCountpeizaiwangcn
push str.SoftwareMicrosoftWindowsCurrentVersion_
mov byte [esp + 0x44], 0x19
call fcn.00406510
mov ecx, dword [esi + 0x2048]
push str.SoftwareMicrosoftWindowsCurrentVersionpeizaiwangcn_
call fcn.004078d0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.004b7a6a
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 0x19
call fcn.0043eeb0
mov ecx, dword [esi + 0x2048]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionpeizaiwangcn_
call fcn.00406510
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0x16
call fcn.004b79fc
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], bl
call fcn.004b79fc
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 2
call fcn.004b79fc
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004b79fc
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51dff4
call fcn.004b7a6a
mov ecx, esi
mov byte [esp + 0x3c], bl
call fcn.0043add0
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 2
call fcn.004b79fc
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004b79fc
mov ecx, dword [esp + 0x30]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret