Function at 0x10008760
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a088
mov eax, dword fs:[0]
push eax
sub esp, 0x6f4
mov eax, dword [0x10091018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0xa4], 0
call fcn.10006ac0
mov dword [ebp - 4], 0
mov dword [ebp - method.CWString.virtual_0], vtable.rg_HuoShanShiChuang_JSONCaoZuo::rg_JSONDuiXiangLei.0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x13c]
call fcn.10002c10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
push esi
mov dword [ebp - 0x3c], vtable.CWString.0
call fcn.10043f00
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x9c], edx
test edx, edx
je 0x10008811
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008800
sub ecx, esi
sar ecx, 1
jmp 0x1000882b
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x1000881f
mov edx, 0x10080564
jmp 0x10008825
mov edx, dword [ebp - 0x20]
shr ecx, 1
dec ecx
mov dword [ebp - 0x9c], edx
push 0
push 0
push 0
push 0
push ecx
push edx
push 0
push 0xfde9
mov dword [ebp - 0xa8], ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
lea ecx, [edi + 1]
push ecx
call fcn.1004738c
add esp, 4
mov esi, eax
mov dword [ebp - 0xc0], esi
push 0
push 0
push edi
push esi
push dword [ebp - 0xa8]
push dword [ebp - 0x9c]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [esi + edi], 0
mov dword [ebp - 0xbc], edi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x27c]
push edi
push esi
call fcn.10021bc0
mov byte [ebp - 4], 4
push esi
call fcn.100473a3
add esp, 4
mov dword [ebp - 0xc0], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.100039d0
lea ecx, [ebp - 0x68]
call fcn.10002c10
mov byte [ebp - 4], 6
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], str.Action
mov byte [ebp - 4], 7
mov edi, 0x10080564
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x100088ef
cmp dword [ebp - 0x44], 0
mov eax, edi
cmovne eax, dword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10017ea0
mov edx, eax
mov byte [ebp - 4], 8
cmp dword [edx + 0x14], 8
jb 0x1000890d
mov edx, dword [edx]
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x3c], vtable.CWString.0
call fcn.10043f00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
call dword [eax + 0x44]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x12c]
call dword [eax + 0x44]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10003f90
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x3c]
call fcn.100039d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x80]
call fcn.10017e10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68]
call fcn.100039d0
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x100089a7
mov ecx, eax
jmp 0x100089b7
cmp dword [ebp - 0x118], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x120]
mov edx, str.ResetProxy
nop dword [eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x100089e6
test si, si
je 0x100089e2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x100089e6
add ecx, 4
add edx, 4
test si, si
jne 0x100089c0
xor ecx, ecx
jmp 0x100089eb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x10008a3a
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10093a78]
mov ecx, 0x10093a78
call dword [eax + 0x28]
or dword [0x10093a7c], 1
mov ecx, 0x10091bfc
call fcn.1003ce60
call fcn.10011fe0
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 1
jmp 0x10008ea6
test eax, eax
jne 0x10008a4e
cmp dword [ebp - 0x118], 0
mov eax, edi
cmovne eax, dword [ebp - 0x120]
mov ecx, str.SetGameType
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10008a79
test dx, dx
je 0x10008a75
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10008a79
add eax, 4
add ecx, 4
test dx, dx
jne 0x10008a53
xor eax, eax
jmp 0x10008a7e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10008adc
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], str.Type
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x10008abf
cmp dword [ebp - 0x18], eax
cmovne edi, dword [ebp - 0x20]
mov eax, edi
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov dword [0x10091a84], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
jmp 0x10008d6f
mov edx, str.SetFilterTcpUdp
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x10008d8d
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0x68]
call fcn.10002c10
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], str.FilterUdp
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x10008b32
cmp dword [ebp - 0x44], 0
mov eax, edi
cmovne eax, dword [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
push eax
lea ecx, [ebp - 0x2b8]
call fcn.100157f0
mov esi, eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], str.FilterTcp
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x10008b7f
cmp dword [ebp - 0x18], 0
mov eax, edi
cmovne eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
push eax
lea ecx, [ebp - 0x168]
call fcn.100157f0
mov byte [ebp - 4], 0x14
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x10008baf
cmp dword [esi + 0x24], ecx
mov ecx, 0x10080564
je 0x10008baf
mov ecx, dword [esi + 0x1c]
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x10008bc3
cmp dword [eax + 0x24], esi
mov esi, 0x10080564
je 0x10008bc3
mov esi, dword [eax + 0x1c]
call fcn.10015890
mov ecx, esi
mov dword [ebp - 0xa8], eax
call fcn.10015890
mov ecx, dword [0x10091bcc]
mov dword [ebp - 0x9c], eax
test ecx, ecx
je 0x10008be9
mov edx, ecx
jmp 0x10008bf9
cmp dword [0x10091be4], 0
mov edx, edi
cmovne edx, dword [0x10091bdc]
mov eax, 0x10080af8
nop
mov si, word [edx]
cmp si, word [eax]
jne 0x10008c26
test si, si
je 0x10008c22
mov si, word [edx + 2]
cmp si, word [eax + 2]
jne 0x10008c26
add edx, 4
add eax, 4
test si, si
jne 0x10008c00
xor eax, eax
jmp 0x10008c2b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10008c68
cmp dword [0x100938a0], eax
je 0x10008c68
cmp dword [ebp - 0x9c], eax
setne al
push eax
call dword [0x100938dc]
cmp dword [0x100938a0], 0
je 0x10008c62
xor eax, eax
cmp dword [ebp - 0xa8], eax
setne al
push eax
call dword [0x100938d8]
mov ecx, dword [0x10091bcc]
test ecx, ecx
je 0x10008c70
mov eax, ecx
jmp 0x10008c80
cmp dword [0x10091be4], 0
mov eax, edi
cmovne eax, dword [0x10091bdc]
mov edx, 0x100800fc
mov si, word [eax]
cmp si, word [edx]
jne 0x10008cab
test si, si
je 0x10008ca7
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x10008cab
add eax, 4
add edx, 4
test si, si
jne 0x10008c85
xor eax, eax
jmp 0x10008cb0
sbb eax, eax
or eax, 1
mov esi, dword [ebp - 0x9c]
test eax, eax
jne 0x10008ce0
cmp dword [0x100938e8], eax
je 0x10008ce0
cmp dword [ebp - 0xa8], eax
sete al
push eax
xor eax, eax
test esi, esi
sete al
push eax
call dword [0x10093904]
mov ecx, dword [0x10091bcc]
test ecx, ecx
jne 0x10008cf3
cmp dword [0x10091be4], ecx
cmovne edi, dword [0x10091bdc]
mov ecx, edi
mov eax, 0x10080af0
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10008d1e
test dx, dx
je 0x10008d1a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10008d1e
add ecx, 4
add eax, 4
test dx, dx
jne 0x10008cf8
xor eax, eax
jmp 0x10008d23
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10008d3e
cmp dword [0x10093910], eax
je 0x10008d3e
push dword [ebp - 0xa8]
push esi
push 1
call dword [0x1009391c]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x168]
call fcn.100039d0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x3c]
call fcn.100039d0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2b8]
call fcn.100039d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68]
call fcn.100039d0
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetProcess
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x10008ee4
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0x68]
call fcn.10002c10
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x1008071c
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x10080720
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x10008e01
cmp dword [ebp - 0x18], 0
mov eax, edi
cmovne eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10017ea0
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
jb 0x10008e1d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x168]
call fcn.10002660
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x5c]
test edx, edx
jne 0x10008e3d
cmp dword [ebp - 0x44], edx
cmovne edi, dword [ebp - 0x4c]
mov edx, edi
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x10008e51
cmp dword [eax + 0x24], ecx
mov ecx, 0x10080564
je 0x10008e51
mov ecx, dword [eax + 0x1c]
sub esp, 8
push edx
mov edx, 0x10091bfc
call fcn.10040e90
add esp, 0xc
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x168]
call fcn.100039d0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x80]
call fcn.10017e10
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x3c]
call fcn.100039d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68]
call fcn.100039d0
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13c]
call fcn.100039d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28c]
call fcn.100070f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10046e38
mov esp, ebp
pop ebp
ret
mov edx, str.AddNode
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x10009154
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.Enable
lea ecx, [ebp - 0xec]
call fcn.10018570
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x194]
push str.Pass
call fcn.10018570
mov byte [ebp - 4], 0x20
mov ecx, eax
call fcn.10016010
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10017ea0
mov byte [ebp - 4], 0x21
cmp dword [eax + 0x14], 8
jb 0x10008f5c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x334]
call fcn.10002660
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1e4]
push str.User
call fcn.10018570
mov byte [ebp - 4], 0x23
mov ecx, eax
call fcn.10016010
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10017ea0
mov byte [ebp - 4], 0x24
cmp dword [eax + 0x14], 8
jb 0x10008fa9
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x210]
call fcn.10002660
mov dword [ebp - 0xb4], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x23c]
push str.Port
call fcn.10018570
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x308]
push str.Ipaddress
call fcn.10018570
mov byte [ebp - 4], 0x27
mov ecx, eax
call fcn.10016010
push eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10017ea0
mov byte [ebp - 4], 0x28
cmp dword [eax + 0x14], 8
jb 0x10009010
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.10002660
mov edi, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x168]
push 0x10080788
call fcn.10018570
mov esi, eax
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x98]
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx ecx, al
push ecx
push dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
push dword [ebp - 0xb4]
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
push eax
mov ecx, esi
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov edx, edi
mov ecx, eax
call fcn.10012440
mov esi, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x168]
call fcn.100039d0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x2b8]
call fcn.100039d0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x80]
call fcn.10017e10
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x308]
call fcn.100039d0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x23c]
call fcn.100039d0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x210]
call fcn.100039d0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x54]
call fcn.10017e10
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1e4]
call fcn.100039d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x334]
call fcn.100039d0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x28]
call fcn.10017e10
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x194]
call fcn.100039d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10008ea6
mov edx, str.DelNode
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x10009315
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10080788
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0x31
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
xor edi, edi
mov dword [ebp - 0x98], eax
test dword [0x10093a98], 0xfffffffc
jbe 0x100092c7
nop word [eax + eax]
lea ecx, [ebp - 0x4b0]
call fcn.1001cd10
mov byte [ebp - 4], 0x32
xor ecx, ecx
cmp dword [0x10093a98], ecx
mov eax, dword [0x10093a90]
cmove eax, ecx
lea ecx, [ebp - 0x4b0]
mov esi, dword [eax + edi*4]
mov eax, dword [ebp - 0x4b0]
call dword [eax + 0x44]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x4ac], eax
mov eax, dword [esi + 8]
push esi
mov dword [ebp - 0x4a8], eax
call fcn.1001ce80
mov esi, dword [ebp - 0x98]
cmp dword [ebp - 0x4a4], esi
je 0x100092ec
mov byte [ebp - 4], 0x39
lea eax, [ebp - 0x388]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x37c]
call fcn.10003a80
mov byte [ebp - 4], 0x39
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x3b8]
call fcn.100039d0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x3ec]
call fcn.100039d0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x418]
call fcn.100039d0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x448]
call fcn.100039d0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x474]
call fcn.100039d0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x4a0]
call fcn.100039d0
mov byte [ebp - 4], 0x31
inc edi
mov eax, dword [0x10093a98]
shr eax, 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
cmp edi, eax
jl 0x100091c0
xor esi, esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10008ea6
push ecx
push edi
mov ecx, 0x10093a78
call fcn.1003d2f0
mov ecx, esi
call fcn.10012f50
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x4b0]
call fcn.10006600
mov esi, 1
jmp 0x100092c9
mov edx, str.GetNodeInfo
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x100098d0
lea ecx, [ebp - 0x2dc]
call fcn.10007090
mov byte [ebp - 4], 0x3f
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10093088]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10093df0]
cmp eax, dword [ecx + 4]
jg 0x1000b78f
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
test dword [0x10093a98], 0xfffffffc
mov dword [ebp - 0xb4], esi
jbe 0x1000983f
lea ecx, [ebp - 0x358]
call fcn.10006ac0
mov byte [ebp - 4], 0x41
mov dword [ebp - method.CWString.virtual_0], vtable.rg_HuoShanShiChuang_JSONCaoZuo::rg_JSONDuiXiangLei.0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x4b0]
call fcn.1001cd10
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 0x44
xor ecx, ecx
cmp dword [0x10093a98], ecx
mov eax, dword [0x10093a90]
cmove eax, ecx
lea ecx, [ebp - 0x4b0]
mov esi, dword [eax + esi*4]
mov eax, dword [ebp - 0x4b0]
call dword [eax + 0x44]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x4ac], eax
mov eax, dword [esi + 8]
push esi
mov dword [ebp - 0x4a8], eax
call fcn.1001ce80
lea ecx, [ebp - 0x1e4]
call fcn.10002c10
mov byte [ebp - 4], 0x45
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1d8], str.NodeId
mov byte [ebp - 4], 0x46
mov eax, dword [ebp - 0x1d8]
test eax, eax
jne 0x1000943c
cmp dword [ebp - 0x1c0], 0
mov eax, edi
cmovne eax, dword [ebp - 0x1c8]
push dword [ebp - 0x4a4]
lea ecx, [ebp - 0x348]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1e4]
call fcn.100039d0
lea ecx, [ebp - 0x210]
call fcn.10002c10
mov byte [ebp - 4], 0x48
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x204], str.UseCount
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x204]
test eax, eax
jne 0x1000949e
cmp dword [ebp - 0x1ec], 0
mov eax, edi
cmovne eax, dword [ebp - 0x1f4]
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x348]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x210]
call fcn.100039d0
test dword [ebp - 0x364], 0xfffffffc
mov dword [ebp - 0xa8], 0
jbe 0x1000973e
nop dword [eax]
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x100094f1
cmp dword [ebp - 0x18], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x20]
mov eax, 0x10080564
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1000951c
test dx, dx
je 0x10009518
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1000951c
add ecx, 4
add eax, 4
test dx, dx
jne 0x100094f6
xor eax, eax
jmp 0x10009521
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100095c7
lea ecx, [ebp - 0x94]
call fcn.10002c10
mov byte [ebp - 4], 0x4b
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], 0x10080564
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x68]
mov esi, dword [ebp - 0xa4]
or esi, 1
mov dword [ebp - 0xa4], esi
call fcn.10002c10
mov dword [ebp - 4], 0x4d
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], vtable.CWString.0
call dword [eax + 0x44]
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x58]
call fcn.10003f90
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0x68]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 4], 0x4e
or esi, 2
mov dword [ebp - 0xa4], esi
jmp 0x100095f1
push 0x100807dc
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x194]
call fcn.10044bd0
add esp, 4
mov dword [ebp - 0x9c], eax
mov dword [ebp - 4], 0x4f
or dword [ebp - 0xa4], 4
mov ecx, dword [ebp - 0x36c]
xor eax, eax
cmp dword [ebp - 0x364], eax
mov edx, dword [ebp - 0xa8]
cmove ecx, eax
mov edx, dword [ecx + edx*4]
lea ecx, [ebp - 0x168]
call fcn.10002c10
mov dword [ebp - 4], 0x50
test edx, edx
mov eax, edi
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
cmovne eax, edx
lea ecx, [ebp - 0x168]
push eax
call fcn.10043f00
mov dword [ebp - 4], 0x51
lea eax, [ebp - 0x168]
mov edx, dword [ebp - 0x9c]
lea ecx, [ebp - 0xec]
push eax
call fcn.10044a50
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x3c]
mov edx, dword [ebp - 0x3c]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x38], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10003f90
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x168]
call fcn.100039d0
mov dword [ebp - 4], 0x4e
mov eax, dword [ebp - 0xa4]
test al, 4
je 0x100096db
and eax, 0xfffffffb
lea ecx, [ebp - 0x194]
mov dword [ebp - 0xa4], eax
call fcn.100039d0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 4], 0x4c
test al, 2
je 0x100096fd
and eax, 0xfffffffd
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xa4], eax
call fcn.100039d0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 4], 0x44
test al, 1
je 0x10009720
and eax, 0xfffffffe
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x94]
call fcn.100039d0
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x364]
inc edx
shr eax, 2
mov dword [ebp - 0xa8], edx
cmp edx, eax
jl 0x100094e0
lea ecx, [ebp - 0x23c]
call fcn.10002c10
mov byte [ebp - 4], 0x54
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x230], 0x100807e0
mov byte [ebp - 4], 0x55
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x10009776
cmp dword [ebp - 0x18], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x230]
test eax, eax
jne 0x10009790
cmp dword [ebp - 0x218], 0
mov eax, edi
cmovne eax, dword [ebp - 0x220]
push ecx
push eax
lea ecx, [ebp - 0x348]
call fcn.10014690
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x23c]
call fcn.100039d0
push ecx
lea edx, [ebp - 0x358]
lea ecx, [ebp - 0x2dc]
call fcn.10021a50
lea ecx, [ebp - 0x330]
call fcn.10035910
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x3c]
call fcn.100039d0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x4b0]
call fcn.10006600
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0x348]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x330]
call fcn.10034c50
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x3f
mov esi, dword [ebp - 0xb4]
mov eax, dword [0x10093a98]
inc esi
shr eax, 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0xb4], esi
cmp esi, eax
jl 0x10009383
sub esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2cc]
push eax
call fcn.10014320
mov byte [ebp - 4], 0x5c
cmp dword [eax + 0x14], 8
jb 0x1000985d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xec]
call fcn.10002660
mov byte [ebp - 4], 0x5d
mov ecx, 0x10093df4
push eax
call fcn.10005ee0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x28]
call fcn.10017e10
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x10093e00]
test esi, esi
jne 0x100098bc
cmp dword [0x10093e18], 0
mov esi, edi
cmovne esi, dword [0x10093e10]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2dc]
call fcn.100070f0
jmp 0x10008ea6
mov edx, str.GetProcessInfo
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x10009f89
lea ecx, [ebp - 0x1b8]
call fcn.10007090
mov byte [ebp - 4], 0x5e
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10093088]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10093e20]
cmp eax, dword [ecx + 4]
jg 0x1000b7d7
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
test dword [0x10093ac0], 0xfffffffc
mov dword [ebp - 0x98], esi
jbe 0x10009f06
nop
lea ecx, [ebp - 0x110]
call fcn.10006ac0
mov byte [ebp - 4], 0x60
mov dword [ebp - method.CWString.virtual_0], vtable.rg_HuoShanShiChuang_JSONCaoZuo::rg_JSONDuiXiangLei.0
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x700]
call fcn.1001e030
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x3e0]
call fcn.1001db10
mov byte [ebp - 4], 0x63
xor ecx, ecx
cmp dword [0x10093ac0], ecx
xorps xmm0, xmm0
mov eax, dword [0x10093ab8]
cmove eax, ecx
movlpd qword [ebp - 0xb8], xmm0
lea ecx, [ebp - 0x700]
movlpd qword [ebp - 0xac], xmm0
mov esi, dword [eax + esi*4]
mov eax, dword [ebp - 0x700]
call dword [eax + 0x44]
push esi
lea ecx, [ebp - 0x700]
call fcn.10007330
lea ecx, [ebp - 0x23c]
call fcn.10002c10
mov byte [ebp - 4], 0x64
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x230], str.Guid
mov byte [ebp - 4], 0x65
mov eax, dword [ebp - 0x230]
test eax, eax
jne 0x100099fd
cmp dword [ebp - 0x218], 0
mov eax, edi
cmovne eax, dword [ebp - 0x220]
push dword [ebp - 0x6f4]
lea ecx, [ebp - 0x100]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x23c]
call fcn.100039d0
lea ecx, [ebp - 0x210]
call fcn.10002c10
mov byte [ebp - 4], 0x67
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x204], str.NodeId
mov byte [ebp - 4], 0x68
mov eax, dword [ebp - 0x204]
test eax, eax
jne 0x10009a5f
cmp dword [ebp - 0x1ec], 0
mov eax, edi
cmovne eax, dword [ebp - 0x1f4]
push dword [ebp - 0x654]
lea ecx, [ebp - 0x100]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x210]
call fcn.100039d0
lea ecx, [ebp - 0x1e4]
call fcn.10002c10
mov byte [ebp - 4], 0x6a
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1d8], str.Ipaddress
mov byte [ebp - 4], 0x6b
mov ecx, dword [ebp - 0x5ec]
test ecx, ecx
jne 0x10009ac1
cmp dword [ebp - 0x5d4], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x5dc]
mov eax, dword [ebp - 0x1d8]
test eax, eax
jne 0x10009adb
cmp dword [ebp - 0x1c0], 0
mov eax, edi
cmovne eax, dword [ebp - 0x1c8]
push ecx
push eax
lea ecx, [ebp - 0x100]
call fcn.10014690
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x1e4]
call fcn.100039d0
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 0x6d
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], str.MacId
mov byte [ebp - 4], 0x6e
mov ecx, dword [ebp - 0x6d4]
test ecx, ecx
jne 0x10009b2f
cmp dword [ebp - 0x6bc], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x10009b40
cmp dword [ebp - 0x18], 0
mov eax, edi
cmovne eax, dword [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x100]
call fcn.10014690
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x3c]
call fcn.100039d0
lea ecx, [ebp - 0x68]
call fcn.10002c10
mov byte [ebp - 4], 0x70
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], str.StartTime
mov byte [ebp - 4], 0x71
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x10009b88
cmp dword [ebp - 0x44], 0
mov eax, edi
cmovne eax, dword [ebp - 0x4c]
push dword [ebp - 0x508]
lea ecx, [ebp - 0x100]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x68]
call fcn.100039d0
mov ecx, dword [ebp - 0x668]
mov dword [ebp - 0xa0], 0
test ecx, 0xfffffffc
jbe 0x10009c8e
mov eax, dword [ebp - 0xb4]
mov edi, dword [ebp - 0xa0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xa8], eax
nop dword [eax + eax]
mov eax, dword [ebp - 0x670]
xor edx, edx
test ecx, ecx
lea ecx, [ebp - 0x3e0]
cmove eax, edx
mov esi, dword [eax + edi*4]
mov eax, dword [ebp - 0x3e0]
call dword [eax + 0x44]
push esi
lea ecx, [ebp - 0x3e0]
call fcn.10007200
mov esi, dword [ebp - 0xb4]
add esi, dword [ebp - 0x370]
mov edx, dword [ebp - 0xb0]
adc edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x368]
mov ecx, dword [ebp - 0x668]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x9c]
adc eax, dword [ebp - 0x364]
inc edi
mov dword [ebp - 0x9c], eax
mov eax, ecx
shr eax, 2
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], edx
cmp edi, eax
jl 0x10009c00
mov edi, 0x10080564
jmp 0x10009cb2
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xb8]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0x94]
call fcn.10002c10
mov byte [ebp - 4], 0x73
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], str.FlowSend
mov byte [ebp - 4], 0x74
mov eax, dword [ebp - 0x88]
test eax, eax
jne 0x10009ced
cmp dword [ebp - 0x70], 0
mov eax, edi
cmovne eax, dword [ebp - 0x78]
push edx
push esi
push eax
lea ecx, [ebp - 0x100]
call fcn.10013d50
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x94]
call fcn.100039d0
lea ecx, [ebp - 0x308]
call fcn.10002c10
mov byte [ebp - 4], 0x76
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2fc], str.FlowRecv
mov byte [ebp - 4], 0x77
mov ecx, dword [ebp - 0x2fc]
test ecx, ecx
jne 0x10009d4b
cmp dword [ebp - 0x2e4], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa8]
push eax
push ecx
lea ecx, [ebp - 0x100]
call fcn.10013d50
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x308]
call fcn.100039d0
lea ecx, [ebp - 0x2b8]
call fcn.10002c10
mov byte [ebp - 4], 0x79
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2ac], str.ProcessCount
mov byte [ebp - 4], 0x7a
mov ecx, dword [ebp - 0x2ac]
test ecx, ecx
jne 0x10009db5
cmp dword [ebp - 0x294], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x668]
push 0
shr eax, 2
push eax
push ecx
lea ecx, [ebp - 0x100]
call fcn.10013d50
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x2b8]
call fcn.100039d0
lea ecx, [ebp - 0x168]
call fcn.10002c10
mov byte [ebp - 4], 0x7c
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x15c], str.BindId
mov byte [ebp - 4], 0x7d
mov ecx, dword [ebp - 0x4d0]
test ecx, ecx
jne 0x10009e1d
cmp dword [ebp - 0x4b8], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x4c0]
mov eax, dword [ebp - 0x15c]
test eax, eax
jne 0x10009e37
cmp dword [ebp - 0x144], 0
mov eax, edi
cmovne eax, dword [ebp - 0x14c]
push ecx
push eax
lea ecx, [ebp - 0x100]
call fcn.10014690
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x168]
call fcn.100039d0
push ecx
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x1b8]
call fcn.10021a50
lea ecx, [ebp - 0xe8]
call fcn.10035910
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x3a0]
call fcn.100039d0
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x3d4]
call fcn.100039d0
mov byte [ebp - 4], 0x62
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x700]
call fcn.100074c0
mov byte [ebp - 4], 0x83
lea eax, [ebp - 0x100]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0xe8]
call fcn.10034c50
mov byte [ebp - 4], 0x83
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x5e
mov esi, dword [ebp - 0x98]
mov eax, dword [0x10093ac0]
inc esi
shr eax, 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x98], esi
cmp esi, eax
jl 0x10009940
sub esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.10014320
mov byte [ebp - 4], 0x87
cmp dword [eax + 0x14], 8
jb 0x10009f24
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xec]
call fcn.10002660
mov byte [ebp - 4], 0x88
mov ecx, 0x10093e24
push eax
call fcn.10005ee0
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x28]
call fcn.10017e10
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x10093e24
call fcn.10016010
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1b8]
call fcn.100070f0
jmp 0x10008ea6
mov edx, str.GetSubProcessInfo
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000a5d1
lea ecx, [ebp - 0x358]
call fcn.10007090
mov byte [ebp - 4], 0x89
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10093088]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10093e50]
cmp eax, dword [ecx + 4]
jg 0x1000b81f
push str.Guid
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0x8b
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov ecx, dword [0x10093a74]
add ecx, 8
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
test dword [0x10093ac0], 0xfffffffc
mov dword [ebp - 0x98], esi
jbe 0x1000a594
lea ecx, [ebp - 0x1b8]
call fcn.10006ac0
mov byte [ebp - 4], 0x8d
mov dword [ebp - method.CWString.virtual_0], vtable.rg_HuoShanShiChuang_JSONCaoZuo::rg_JSONDuiXiangLei.0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x700]
call fcn.1001e030
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x3e0]
call fcn.1001db10
mov byte [ebp - 4], 0x90
xor ecx, ecx
cmp dword [0x10093ac0], ecx
mov eax, dword [0x10093ab8]
cmove eax, ecx
lea ecx, [ebp - 0x700]
mov esi, dword [eax + esi*4]
mov eax, dword [ebp - 0x700]
call dword [eax + 0x44]
push esi
lea ecx, [ebp - 0x700]
call fcn.10007330
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x6f4], eax
je 0x1000a14a
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0x3a0]
call fcn.100039d0
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0x3d4]
call fcn.100039d0
mov byte [ebp - 4], 0x8f
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x700]
call fcn.100074c0
mov byte [ebp - 4], 0xad
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0x190]
call fcn.10034c50
mov byte [ebp - 4], 0xad
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x89
mov esi, dword [ebp - 0x98]
mov eax, dword [0x10093ac0]
inc esi
shr eax, 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x98], esi
cmp esi, eax
jl 0x1000a034
jmp 0x1000a594
mov ecx, dword [ebp - 0x668]
xor edx, edx
mov dword [ebp - 0xb0], edx
test ecx, 0xfffffffc
jbe 0x1000a513
mov eax, dword [ebp - 0x670]
xor esi, esi
test ecx, ecx
lea ecx, [ebp - 0x3e0]
cmove eax, esi
mov esi, dword [eax + edx*4]
mov eax, dword [ebp - 0x3e0]
call dword [eax + 0x44]
push esi
lea ecx, [ebp - 0x3e0]
call fcn.10007200
lea ecx, [ebp - 0x168]
call fcn.10002c10
mov byte [ebp - 4], 0x91
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x15c], 0x100808b8
mov byte [ebp - 4], 0x92
mov eax, dword [ebp - 0x15c]
test eax, eax
jne 0x1000a1d0
cmp dword [ebp - 0x144], 0
mov eax, edi
cmovne eax, dword [ebp - 0x14c]
push dword [ebp - 0x3a8]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x168]
call fcn.100039d0
lea ecx, [ebp - 0x2b8]
call fcn.10002c10
mov byte [ebp - 4], 0x94
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2ac], str.ParentId
mov byte [ebp - 4], 0x95
mov eax, dword [ebp - 0x2ac]
test eax, eax
jne 0x1000a232
cmp dword [ebp - 0x294], 0
mov eax, edi
cmovne eax, dword [ebp - 0x29c]
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x2b8]
call fcn.100039d0
lea ecx, [ebp - 0x308]
call fcn.10002c10
mov byte [ebp - 4], 0x97
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2fc], str.Name
mov byte [ebp - 4], 0x98
mov ecx, dword [ebp - 0x3c8]
test ecx, ecx
jne 0x1000a294
cmp dword [ebp - 0x3b0], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x2fc]
test eax, eax
jne 0x1000a2ae
cmp dword [ebp - 0x2e4], 0
mov eax, edi
cmovne eax, dword [ebp - 0x2ec]
push ecx
push eax
lea ecx, [ebp - 0x1a8]
call fcn.10014690
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x308]
call fcn.100039d0
lea ecx, [ebp - 0x23c]
call fcn.10002c10
mov byte [ebp - 4], 0x9a
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x230], str.FlowSend
mov byte [ebp - 4], 0x9b
mov eax, dword [ebp - 0x230]
test eax, eax
jne 0x1000a30b
cmp dword [ebp - 0x218], 0
mov eax, edi
cmovne eax, dword [ebp - 0x220]
push dword [ebp - 0x36c]
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x370]
push eax
call fcn.10013d50
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x23c]
call fcn.100039d0
lea ecx, [ebp - 0x210]
call fcn.10002c10
mov byte [ebp - 4], 0x9d
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x204], str.FlowRecv
mov byte [ebp - 4], 0x9e
mov eax, dword [ebp - 0x204]
test eax, eax
jne 0x1000a373
cmp dword [ebp - 0x1ec], 0
mov eax, edi
cmovne eax, dword [ebp - 0x1f4]
push dword [ebp - 0x364]
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x368]
push eax
call fcn.10013d50
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x210]
call fcn.100039d0
lea ecx, [ebp - 0x1e4]
call fcn.10002c10
mov byte [ebp - 4], 0xa0
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1d8], str.StartTime
mov byte [ebp - 4], 0xa1
mov eax, dword [ebp - 0x1d8]
test eax, eax
jne 0x1000a3db
cmp dword [ebp - 0x1c0], 0
mov eax, edi
cmovne eax, dword [ebp - 0x1c8]
push dword [ebp - 0x360]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.100151d0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x1e4]
call fcn.100039d0
lea ecx, [ebp - 0x3c]
call fcn.10002c10
mov byte [ebp - 4], 0xa3
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], str.EnableProxy
mov byte [ebp - 4], 0xa4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x1000a437
cmp dword [ebp - 0x18], 0
mov eax, edi
cmovne eax, dword [ebp - 0x20]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x35c], 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
setne byte [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.1004738c
add esp, 4
mov edi, eax
mov dword [ebp - 0xc0], edi
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push dword [ebp - 0x98]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [edi + esi], 0
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xa5
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0xa0]
push edi
call fcn.10013860
mov byte [ebp - 4], 0xa4
push edi
call fcn.100473a3
add esp, 4
mov dword [ebp - 0xc0], 0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x3c]
call fcn.100039d0
push ecx
lea edx, [ebp - 0x1b8]
lea ecx, [ebp - 0x358]
call fcn.10021a50
lea ecx, [ebp - 0x190]
call fcn.10035910
mov edx, dword [ebp - 0xb0]
mov edi, 0x10080564
mov ecx, dword [ebp - 0x668]
inc edx
mov eax, ecx
mov dword [ebp - 0xb0], edx
shr eax, 2
cmp edx, eax
jl 0x1000a164
sub esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x348]
push eax
call fcn.10014320
mov byte [ebp - 4], 0xa7
cmp dword [eax + 0x14], 8
jb 0x1000a531
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xec]
call fcn.10002660
mov byte [ebp - 4], 0xa8
mov ecx, 0x10093e54
push eax
call fcn.10005ee0
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x28]
call fcn.10017e10
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x3e0]
call fcn.100072c0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x700]
call fcn.100074c0
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x1b8]
call fcn.100070f0
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x10093e60]
test esi, esi
jne 0x1000a5bd
cmp dword [0x10093e78], 0
mov esi, edi
cmovne esi, dword [0x10093e70]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x358]
call fcn.100070f0
jmp 0x10008ea6
mov edx, str.GetGlobalInfo
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000a7ae
lea ecx, [ebp - 0x2dc]
call fcn.10008010
mov byte [ebp - 4], 0xb1
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10093088]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10093e80]
cmp eax, dword [ecx + 4]
jg 0x1000b867
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.ProcessesCount
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xb3
mov ecx, dword [0x10093ac0]
shr ecx, 2
push ecx
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x2cc]
call fcn.100151d0
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0xec]
call fcn.100039d0
push str.NodeCount
lea ecx, [ebp - 0x194]
call fcn.10018570
mov byte [ebp - 4], 0xb5
mov ecx, dword [0x10093a98]
shr ecx, 2
push ecx
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x2cc]
call fcn.100151d0
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x194]
call fcn.100039d0
push str.FlowSend
lea ecx, [ebp - 0x334]
call fcn.10018570
mov byte [ebp - 4], 0xb7
mov ecx, eax
push dword [0x10091b1c]
push dword [0x10091b18]
call fcn.10016010
push eax
lea ecx, [ebp - 0x2cc]
call fcn.10013d50
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x334]
call fcn.100039d0
push str.FlowRecv
lea ecx, [ebp - 0x168]
call fcn.10018570
mov byte [ebp - 4], 0xb9
mov ecx, eax
push dword [0x10091b24]
push dword [0x10091b20]
call fcn.10016010
push eax
lea ecx, [ebp - 0x2cc]
call fcn.10013d50
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x168]
call fcn.100039d0
sub esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2cc]
push eax
call fcn.10014320
mov byte [ebp - 4], 0xbb
cmp dword [eax + 0x14], 8
jb 0x1000a749
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xec]
call fcn.10002660
mov byte [ebp - 4], 0xbc
mov ecx, 0x10093e84
push eax
call fcn.10005ee0
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x28]
call fcn.10017e10
mov eax, dword [0x10093a74]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x10093e84
call fcn.10016010
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2dc]
call fcn.100070f0
jmp 0x10008ea6
mov edx, str.ResetLsp
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000a86d
lea ecx, [ebp - 0x168]
call fcn.100223e0
mov esi, eax
mov byte [ebp - 4], 0xbd
lea ecx, [ebp - 0x334]
push str.cmd__c_netsh_winsock_reset__
call fcn.10018570
mov byte [ebp - 4], 0xbe
mov edx, eax
push esi
lea ecx, [ebp - 0x194]
call fcn.10044a50
mov byte [ebp - 4], 0xbf
mov edx, eax
push str.ResetLsp.txt
lea ecx, [ebp - 0xec]
call fcn.10044bd0
mov byte [ebp - 4], 0xc0
add esp, 4
mov ecx, eax
call fcn.10016010
mov ecx, eax
call fcn.10041c70
add esp, 4
mov byte [ebp - 4], 0xbf
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0xbe
lea ecx, [ebp - 0x194]
call fcn.100039d0
mov byte [ebp - 4], 0xbd
lea ecx, [ebp - 0x334]
call fcn.100039d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x168]
call fcn.100039d0
mov esi, 1
jmp 0x10008ea6
mov edx, str.RepairDriveNet
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000a8f5
lea ecx, [ebp - 0x110]
call fcn.10006ac0
mov byte [ebp - 4], 0xc2
mov dword [ebp - method.CWString.virtual_0], vtable.rg_HuoShanShiChuang_JSONCaoZuo::rg_JSONDuiXiangLei.0
mov byte [ebp - 4], 0xc3
cmp dword [0x100938e8], 0
je 0x1000a8ad
call dword [0x1009390c]
mov byte [ebp - 4], 0xc5
lea eax, [ebp - 0x100]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0xc7
lea ecx, [ebp - 0xe8]
call fcn.10034c50
mov byte [ebp - 4], 0xc5
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 2
mov esi, 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
jmp 0x10008ea6
mov edx, str.SetFlowMonitor
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000a9e9
push str.Enable
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xc9
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100039d0
push str.MonitorKB
lea ecx, [ebp - 0x194]
call fcn.10018570
mov byte [ebp - 4], 0xcb
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov dword [0x10091a70], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x194]
call fcn.100039d0
push str.MonitorTime
lea ecx, [ebp - 0x334]
call fcn.10018570
mov byte [ebp - 4], 0xcd
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov dword [0x10091a74], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x334]
call fcn.100039d0
mov eax, dword [0x10091a70]
mov ecx, 0x400
test eax, eax
cmovle eax, ecx
mov ecx, 0x3c
mov dword [0x10091a70], eax
mov eax, dword [0x10091a74]
test eax, eax
cmovle eax, ecx
lea esi, [ecx - 0x3b]
mov dword [0x10091a74], eax
jmp 0x10008ea6
mov edx, str.SetFilterFlow
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000ab57
push str.FilterFlowRecv
lea ecx, [ebp - 0x334]
call fcn.10018570
mov esi, eax
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0x194]
push str.FilterMonitorTime
call fcn.10018570
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0xec]
push str.FilterFlow
call fcn.10018570
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 0xd1
mov ecx, esi
call fcn.10016010
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
mov dword [ebp - 0xa0], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.1004738c
add esp, 4
mov edi, eax
mov dword [ebp - 0xc0], edi
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push dword [ebp - 0xa0]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [edi + esi], 0
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0x27c]
push edi
call fcn.100135e0
mov esi, eax
mov dword [ebp - 0xa0], edx
mov byte [ebp - 4], 0xd1
push edi
call fcn.100473a3
mov ecx, dword [ebp - 0x98]
add esp, 4
mov dword [ebp - 0xc0], 0
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov ecx, dword [ebp - 0xb0]
mov edi, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
cmp dword [0x10093910], 0
movzx eax, al
je 0x1000ab25
push dword [ebp - 0xa0]
push esi
push edi
push eax
call dword [0x10093918]
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0x194]
call fcn.100039d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x334]
call fcn.100039d0
mov edi, 0x10080564
mov edx, str.CloseProcess
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000abb2
push str.GUID
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xd6
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov ecx, eax
call fcn.10011c10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetDriveType
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000acd5
cmp dword [0x10093870], 1
je 0x1000b785
lea ecx, [ebp - 0x168]
call fcn.10002c10
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0x194]
push str.DriveType
call fcn.10018570
mov byte [ebp - 4], 0xd9
mov ecx, eax
call fcn.10016010
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10017ea0
mov byte [ebp - 4], 0xda
cmp dword [eax + 0x14], 8
jb 0x1000ac1d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xec]
call fcn.10002660
mov byte [ebp - 4], 0xdb
lea ecx, [ebp - 0x168]
push eax
call fcn.10005ee0
mov byte [ebp - 4], 0xda
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0xd9
lea ecx, [ebp - 0x28]
call fcn.10017e10
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0x194]
call fcn.100039d0
mov edx, 0x10080af0
lea ecx, [ebp - 0x168]
call fcn.10005d90
test eax, eax
je 0x1000ac7e
push 0x10080af0
jmp 0x1000acb2
mov edx, 0x100800fc
lea ecx, [ebp - 0x168]
call fcn.10005d90
test eax, eax
jne 0x1000acad
mov edx, 0x10080af8
lea ecx, [ebp - 0x168]
call fcn.10005d90
test eax, eax
je 0x1000acad
push 0x10080af8
jmp 0x1000acb2
push 0x100800fc
mov ecx, 0x10091bc0
call fcn.10043e20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x168]
call fcn.100039d0
mov esi, 1
jmp 0x10008ea6
mov edx, str.Install
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000ad05
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.1000b8c0
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x10008ea6
mov edx, str.Uninstall
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000aefd
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp dword [0x10093870], 0
jne 0x1000ad3d
xor esi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x10008ea6
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x1009386c], 1
nop dword [eax]
push 0
push dword [0x10093878]
call esi
cmp eax, 0x102
je 0x1000ad86
cmp eax, 0xffffffff
je 0x1000ad6b
cmp eax, 1
je 0x1000ad86
push 0
push dword [0x10093874]
call esi
cmp eax, 0x102
je 0x1000ad86
cmp eax, 0xffffffff
je 0x1000ad90
cmp eax, 1
jne 0x1000ad90
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000ad50
cmp dword [0x10093894], 0
je 0x1000ad9f
call dword [0x10093898]
cmp dword [0x1009387c], 0
je 0x1000adbd
call dword [0x10093880]
cmp dword [0x1009387c], 0
je 0x1000adbd
call dword [0x1009388c]
mov eax, dword [0x10091bcc]
test eax, eax
je 0x1000adca
mov ecx, eax
jmp 0x1000adda
cmp dword [0x10091be4], 0
mov ecx, edi
cmovne ecx, dword [0x10091bdc]
mov edx, 0x10080af8
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000ae06
test si, si
je 0x1000ae02
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000ae06
add ecx, 4
add edx, 4
test si, si
jne 0x1000ade0
xor ecx, ecx
jmp 0x1000ae0b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x1000ae31
cmp dword [0x100938a0], ecx
je 0x1000ae31
call dword [0x100938b8]
cmp dword [0x100938a0], 0
je 0x1000ae2c
call dword [0x100938e0]
mov eax, dword [0x10091bcc]
test eax, eax
je 0x1000ae39
mov ecx, eax
jmp 0x1000ae49
cmp dword [0x10091be4], 0
mov ecx, edi
cmovne ecx, dword [0x10091bdc]
mov edx, 0x100800fc
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000ae76
test si, si
je 0x1000ae72
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000ae76
add ecx, 4
add edx, 4
test si, si
jne 0x1000ae50
xor ecx, ecx
jmp 0x1000ae7b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x1000ae92
cmp dword [0x100938e8], ecx
je 0x1000ae92
call dword [0x100938f4]
mov eax, dword [0x10091bcc]
test eax, eax
jne 0x1000aea5
cmp dword [0x10091be4], eax
cmovne edi, dword [0x10091bdc]
mov eax, edi
mov ecx, 0x10080af0
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000aed6
test dx, dx
je 0x1000aed2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000aed6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000aeb0
xor eax, eax
jmp 0x1000aedb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000aeed
cmp dword [0x10093910], eax
je 0x1000aeed
call dword [0x10093928]
mov esi, 1
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x10008ea6
mov edx, str.CloseProcess
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000af55
push str.ProcessTreeGuid
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xdd
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov ecx, eax
call fcn.10011c10
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
jmp 0x10008ea6
mov edx, str.SetProxyEmulator
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b044
push str.Enable
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xde
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx eax, al
mov dword [0x10091a7c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
cmp dword [0x10091a7c], 0
je 0x1000b030
push 0x100811b8
lea ecx, [ebp - 0x194]
call fcn.10018570
mov esi, eax
mov byte [ebp - 4], 0xdf
lea ecx, [ebp - 0xec]
push 0x10091b60
call fcn.10002860
mov edx, eax
mov byte [ebp - 4], 0xe0
sub esp, 8
mov ecx, esi
call fcn.10016010
push eax
mov ecx, edx
call fcn.100447a0
mov ecx, eax
call fcn.10016010
mov edx, 0x10091c2c
mov ecx, eax
call fcn.10040e90
add esp, 0xc
mov byte [ebp - 4], 0xdf
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x194]
call fcn.100182c0
mov esi, 1
jmp 0x10008ea6
mov ecx, 0x10091c2c
call fcn.1003ce60
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetProxyWin
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b0a0
push str.Enable
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe1
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx eax, al
mov dword [0x1009385c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetEnableBind
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b0fc
push str.Enable
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe2
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx eax, al
mov dword [0x10093860], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetProxyModel
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b171
push str.Model
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe3
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov dword [0x10093864], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
mov eax, dword [0x10093864]
test eax, eax
js 0x1000b15d
cmp eax, 2
jle 0x1000b785
mov dword [0x10093864], 0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetDisabledLocal
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b1cd
push str.Enable
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe4
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx eax, al
mov dword [0x10093858], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetVirtuaMac
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b229
push str.virtua
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe5
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx eax, al
mov dword [0x10093854], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetVirtuaHardDisk
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b285
push str.virtua
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe6
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx eax, al
mov dword [0x10093850], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetVirtuaComputerName
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b2d9
push str.virtua
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe7
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
mov esi, 1
jmp 0x10008ea6
mov edx, str.SetNodeMaxQuota
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b447
push 0x10080788
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xe8
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
push str.MaxQuota
lea ecx, [ebp - 0x194]
call fcn.10018570
mov byte [ebp - 4], 0xe9
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov esi, eax
mov dword [ebp - 0x98], esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x194]
call fcn.100182c0
xor edi, edi
mov dword [0x10091a78], esi
test dword [0x10093a98], 0xfffffffc
jbe 0x1000b785
lea ecx, [ebp - 0x4b0]
call fcn.1001cd10
mov byte [ebp - 4], 0xea
xor ecx, ecx
cmp dword [0x10093a98], ecx
mov eax, dword [0x10093a90]
cmove eax, ecx
lea ecx, [ebp - 0x4b0]
mov esi, dword [eax + edi*4]
mov eax, dword [ebp - 0x4b0]
call dword [eax + 0x44]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x4ac], eax
mov eax, dword [esi + 8]
push esi
mov dword [ebp - 0x4a8], eax
call fcn.1001ce80
mov eax, dword [ebp - 0xa0]
test eax, eax
jne 0x1000b3fc
mov eax, dword [ebp - 0x98]
mov ecx, 0x10093a78
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x4b0]
push eax
push edi
call fcn.1003d3d0
jmp 0x1000b404
cmp dword [ebp - 0x4a4], eax
je 0x1000b42e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4b0]
call fcn.10006600
mov eax, dword [0x10093a98]
inc edi
shr eax, 2
cmp edi, eax
jl 0x1000b383
mov esi, 1
jmp 0x10008ea6
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x4b0]
push eax
push edi
jmp 0x1000b76c
mov edx, str.SetNodeBind
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x1000b639
lea ecx, [ebp - 0x2b8]
call fcn.10002c10
mov byte [ebp - 4], 0xeb
lea ecx, [ebp - 0xec]
push 0x10080788
call fcn.10018570
mov byte [ebp - 4], 0xec
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov edi, eax
mov byte [ebp - 4], 0xeb
lea ecx, [ebp - 0xec]
call fcn.100182c0
push str.Bind
lea ecx, [ebp - 0x194]
call fcn.10018570
mov byte [ebp - 4], 0xed
mov ecx, eax
call fcn.10016010
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10017ea0
mov byte [ebp - 4], 0xee
mov ecx, eax
call fcn.10018040
push eax
lea ecx, [ebp - 0xec]
call fcn.10002660
mov byte [ebp - 4], 0xef
lea ecx, [ebp - 0x2b8]
push eax
call fcn.10005ee0
mov byte [ebp - 4], 0xee
lea ecx, [ebp - 0xec]
call fcn.100039d0
mov byte [ebp - 4], 0xed
lea ecx, [ebp - 0x28]
call fcn.10017e10
mov byte [ebp - 4], 0xeb
lea ecx, [ebp - 0x194]
call fcn.100182c0
lea ecx, [ebp - 0x168]
call fcn.10002480
mov byte [ebp - 4], 0xf0
lea ecx, [ebp - 0x334]
push 0x100807dc
call fcn.10018570
mov byte [ebp - 4], 0xf1
sub esp, 8
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x2b8]
call fcn.10016010
lea edx, [ebp - 0x15c]
mov ecx, eax
call fcn.10040e90
add esp, 0xc
mov byte [ebp - 4], 0xf0
lea ecx, [ebp - 0x334]
call fcn.100182c0
xor esi, esi
test dword [0x10093a98], 0xfffffffc
jbe 0x1000b5da
nop dword [eax + eax]
lea ecx, [ebp - 0x4b0]
call fcn.1001cd10
mov byte [ebp - 4], 0xf2
mov ecx, 0x10093a78
push esi
call fcn.10015290
push eax
lea ecx, [ebp - 0x4b0]
call fcn.100065d0
cmp dword [ebp - 0x4a4], edi
je 0x1000b5ff
mov byte [ebp - 4], 0xf0
lea ecx, [ebp - 0x4b0]
call fcn.10006600
mov eax, dword [0x10093a98]
inc esi
shr eax, 2
cmp esi, eax
jl 0x1000b590
xor esi, esi
mov byte [ebp - 4], 0xeb
lea ecx, [ebp - 0x168]
call fcn.10002500
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2b8]
call fcn.100039d0
jmp 0x10008ea6
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x388]
call fcn.100065b0
lea eax, [ebp - 0x4b0]
mov ecx, 0x10093a78
push eax
push esi
call fcn.1003d3d0
mov byte [ebp - 4], 0xf0
lea ecx, [ebp - 0x4b0]
call fcn.10006600
mov esi, 1
jmp 0x1000b5dc
mov edx, str.SetNodeEnable
lea ecx, [ebp - 0x13c]
call fcn.10005d90
test eax, eax
je 0x10008ea4
push 0x10080788
lea ecx, [ebp - 0xec]
call fcn.10018570
mov byte [ebp - 4], 0xf3
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015f50
mov edi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.100182c0
push str.Enable
lea ecx, [ebp - 0x194]
call fcn.10018570
mov byte [ebp - 4], 0xf4
mov ecx, eax
call fcn.10016010
push eax
lea ecx, [ebp - 0x27c]
call fcn.10015730
movzx eax, al
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x194]
call fcn.100182c0
xor esi, esi
test dword [0x10093a98], 0xfffffffc
jbe 0x1000b785
nop word [eax + eax]
lea ecx, [ebp - 0x4b0]
call fcn.1001cd10
mov byte [ebp - 4], 0xf5
mov ecx, 0x10093a78
push esi
call fcn.10015290
push eax
lea ecx, [ebp - 0x4b0]
call fcn.100065d0
test edi, edi
jne 0x1000b72a
mov eax, dword [ebp - 0x98]
mov ecx, 0x10093a78
mov dword [ebp - 0x38c], eax
lea eax, [ebp - 0x4b0]
push eax
push esi
call fcn.1003d3d0
jmp 0x1000b732
cmp dword [ebp - 0x4a4], edi
je 0x1000b758
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4b0]
call fcn.10006600
mov eax, dword [0x10093a98]
inc esi
shr eax, 2
cmp esi, eax
jl 0x1000b6e0
mov esi, 1
jmp 0x10008ea6
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x38c], eax
lea eax, [ebp - 0x4b0]
push eax
push esi
mov ecx, 0x10093a78
call fcn.1003d3d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4b0]
call fcn.10006600
mov esi, 1
jmp 0x10008ea6
push 0x10093df0
call fcn.10046f79
add esp, 4
cmp dword [0x10093df0], 0xffffffff
jne 0x1000935c
mov byte [ebp - 4], 0x40
mov ecx, 0x10093df4
call fcn.10002c10
push 0x10073440
call fcn.10047377
mov byte [ebp - 4], 0x3f
push 0x10093df0
call fcn.10046f2f
add esp, 8
jmp 0x1000935c
push 0x10093e20
call fcn.10046f79
add esp, 4
cmp dword [0x10093e20], 0xffffffff
jne 0x10009917
mov byte [ebp - 4], 0x5f
mov ecx, 0x10093e24
call fcn.10002c10
push 0x10073430
call fcn.10047377
mov byte [ebp - 4], 0x5e
push 0x10093e20
call fcn.10046f2f
add esp, 8
jmp 0x10009917
push 0x10093e50
call fcn.10046f79
add esp, 4
cmp dword [0x10093e50], 0xffffffff
jne 0x10009fd0
mov byte [ebp - 4], 0x8a
mov ecx, 0x10093e54
call fcn.10002c10
push 0x10073420
call fcn.10047377
mov byte [ebp - 4], 0x89
push 0x10093e50
call fcn.10046f2f
add esp, 8
jmp 0x10009fd0
push 0x10093e80
call fcn.10046f79
add esp, 4
cmp dword [0x10093e80], 0xffffffff
jne 0x1000a618
mov byte [ebp - 4], 0xb2
mov ecx, 0x10093e84
call fcn.10002c10
push 0x10073410
call fcn.10047377
mov byte [ebp - 4], 0xb1
push 0x10093e80
call fcn.10046f2f
add esp, 8
jmp 0x1000a618