Function at 0x420da0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45c11b
push eax
mov eax, 0x1518
mov dword fs:[0], esp
call fcn.0043ae00
mov eax, dword [0x471a34]
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [ebx + 4]
lea edx, [esp + 8]
push ecx
push 0x46e150
push edx
mov dword [esp + 0x1534], 0
call fcn.0044af2b
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0xc
push 0x473bd8
push eax
push 0x46f59c
push 0x4705e8
call ebp
mov ecx, dword [ebx + 0x18]
lea edx, [esp + 8]
push ecx
push 0x46e150
push edx
call fcn.0044af2b
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x473bd8
push eax
push 0x47067c
push 0x4705e8
call ebp
mov ecx, dword [ebx + 0x20]
lea edx, [esp + 8]
push ecx
push 0x46e150
push edx
call fcn.0044af2b
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x473bd8
push eax
push 0x470694
push 0x4705e8
call ebp
mov ecx, dword [ebx + 0x28]
lea edx, [esp + 8]
push ecx
push 0x46e150
push edx
call fcn.0044af2b
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x473bd8
push eax
push 0x470684
push 0x4705e8
call ebp
mov ecx, dword [ebx + 0x30]
lea edx, [esp + 8]
push ecx
push 0x46e150
push edx
call fcn.0044af2b
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x473bd8
push eax
push 0x470674
push 0x4705e8
call ebp
mov eax, dword [ebx + 0xa994]
test eax, eax
mov eax, 0x46e358
jne 0x420ecd
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AutoDetect
push str.system
call ebp
mov eax, dword [ebx + 0xc88]
test eax, eax
mov eax, 0x46e358
jne 0x420ef3
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AutoHide
push str.system
call ebp
mov eax, dword [ebx + 0xc84]
test eax, eax
mov eax, 0x46e358
jne 0x420f19
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AutoRun
push str.system
call ebp
mov eax, dword [ebx + 0x50]
test eax, eax
mov eax, 0x46e358
jne 0x420f3c
mov eax, 0x46e374
push 0x473bd8
push eax
push str.Dial
push str.system
call ebp
mov eax, dword [ebx + 0x3c]
test eax, eax
mov eax, 0x46e358
jne 0x420f5f
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartDNS
push str.system
call ebp
mov eax, dword [ebx + 0x1c]
test eax, eax
mov eax, 0x46e358
jne 0x420f82
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartFTP
push str.system
call ebp
mov eax, dword [ebx + 8]
test eax, eax
mov eax, 0x46e358
jne 0x420fa5
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartFTPWeb
push str.system
call ebp
mov eax, dword [ebx + 0xc]
test eax, eax
mov eax, 0x46e358
jne 0x420fc8
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartGopher
push str.system
call ebp
cmp dword [ebx], 0
mov eax, 0x46e358
jne 0x420fe9
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartHTTP
push str.system
call ebp
mov eax, dword [ebx + 0x38]
test eax, eax
mov eax, 0x46e358
jne 0x42100c
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartMail
push str.system
call ebp
mov eax, dword [ebx + 0x2c]
test eax, eax
mov eax, 0x46e358
jne 0x42102f
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartNews
push str.system
call ebp
mov eax, dword [ebx + 0x34]
test eax, eax
mov eax, 0x46e358
jne 0x421052
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartSecure
push str.system
call ebp
mov eax, dword [ebx + 0x10]
test eax, eax
mov eax, 0x46e358
jne 0x421075
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartSocks
push str.system
call ebp
mov eax, dword [ebx + 0x24]
test eax, eax
mov eax, 0x46e358
jne 0x421098
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartTelnet
push str.system
call ebp
mov eax, dword [ebx + 0x44]
test eax, eax
mov eax, 0x46e358
jne 0x4210bb
mov eax, 0x46e374
push 0x473bd8
push eax
push str.WebCached
push str.system
call ebp
mov eax, dword [ebx + 0x40]
test eax, eax
mov eax, 0x46e358
jne 0x4210de
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartMap
push str.system
call ebp
mov eax, dword [ebx + 0xa554]
cmp eax, 1
mov eax, 0x46e358
je 0x421105
mov eax, 0x46e374
push 0x473bd8
push eax
push str.NewLogDaily
push 0x46e234
call ebp
lea ecx, [esp + 0x111c]
push 0x400
push ecx
push 0
mov byte [esp + 0x1528], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x46eefc
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call fcn.0042e4e0
push 0
push 0x46eefc
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push bind
call fcn.0042e4e0
mov eax, dword [ebx + 0xc84]
add esp, 0x20
test eax, eax
je 0x421177
lea edx, [esp + 0x111c]
push edx
jmp 0x421179
push 0
push 0x46eefc
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call fcn.0042e4e0
add esp, 0x10
lea eax, [ebx + 0xa564]
push esi
push edi
push 0x473bd8
push eax
push str.LocalIP
push str.system
call ebp
mov cl, byte [0x473aa0]
xor eax, eax
mov byte [esp + 0x120], cl
mov ecx, 0x400
lea edi, [esp + 0x121]
push 0x473bd8
rep stosd dword es:[edi], eax
mov edi, 0x4fb08c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fb08c
push ecx
push str.DNSPrimary
push 0x46f248
call ebp
mov edi, 0x4fb48c
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fb48c
push ecx
push str.DNSSecondary
push 0x46f248
call ebp
mov edx, dword [0x4fb88c]
lea eax, [esp + 0x120]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0xc
lea ecx, [esp + 0x120]
push 0x473bd8
push ecx
push str.MaxTries
push 0x46f248
call ebp
mov edx, dword [0x4fb890]
lea eax, [esp + 0x120]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0xc
lea ecx, [esp + 0x120]
push 0x473bd8
push ecx
push str.MailInterval
push 0x46f248
call ebp
mov edx, dword [0x4fb894]
lea eax, [esp + 0x120]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0xc
lea ecx, [esp + 0x120]
push 0x473bd8
push ecx
push str.ThreadCount
push 0x46f248
call ebp
mov edx, dword [0x4fb898]
lea eax, [esp + 0x120]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0xc
lea ecx, [esp + 0x120]
push 0x473bd8
push ecx
push str.PortSMTP
push 0x46f248
call ebp
mov edx, dword [0x4fb89c]
lea eax, [esp + 0x120]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0xc
lea ecx, [esp + 0x120]
push 0x473bd8
push ecx
push str.PortPOP3
push 0x46f248
call ebp
mov edx, dword [0x4fb8a0]
lea eax, [esp + 0x120]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0xc
lea ecx, [esp + 0x120]
push 0x473bd8
push ecx
push str.EnableESMTP
push 0x46f248
call ebp
mov edi, 0x4f7804
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4f7804
push ecx
push str.EntrySelected
push str.Dial
call ebp
mov edi, 0x4f7c04
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4f7c04
push ecx
push str.UserName
push str.Dial
call ebp
mov edi, 0x4f8004
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x120]
neg ecx
sbb ecx, ecx
push 0x473bd8
and ecx, edx
push ecx
push 0x4706c4
push str.Dial
call ebp
mov eax, dword [0x4f8408]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.IdleTimeout
push str.Dial
call ebp
mov eax, dword [0x4f8404]
test eax, eax
mov eax, 0x46e358
jne 0x42145f
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AutoDisconnect
push str.Dial
call ebp
mov eax, dword [0x4f840c]
test eax, eax
mov eax, 0x46e358
jne 0x421484
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AutoDial
push str.Dial
call ebp
mov eax, dword [0x4f8418]
test eax, eax
mov eax, 0x46e358
jne 0x4214a9
mov eax, 0x46e374
push 0x473bd8
push eax
push 0x470698
push str.Dial
call ebp
mov eax, dword [0x4f841c]
test eax, eax
mov eax, 0x46e358
jne 0x4214ce
mov eax, 0x46e374
push 0x473bd8
push eax
push 0x46f248
push str.Dial
call ebp
mov eax, dword [0x4f8420]
test eax, eax
mov eax, 0x46e358
jne 0x4214f3
mov eax, 0x46e374
push 0x473bd8
push eax
push 0x470694
push str.Dial
call ebp
mov eax, dword [0x4f8424]
test eax, eax
mov eax, 0x46e358
jne 0x421518
mov eax, 0x46e374
push 0x473bd8
push eax
push 0x47068c
push str.Dial
call ebp
mov eax, dword [0x4f8428]
test eax, eax
mov eax, 0x46e358
jne 0x42153d
mov eax, 0x46e374
push 0x473bd8
push eax
push 0x470684
push str.Dial
call ebp
mov eax, dword [0x4f842c]
test eax, eax
mov eax, 0x46e358
jne 0x421562
mov eax, 0x46e374
push 0x473bd8
push eax
push 0x47067c
push str.Dial
call ebp
mov eax, dword [0x4f8430]
test eax, eax
mov eax, 0x46e358
jne 0x421587
mov eax, 0x46e374
push 0x473bd8
push eax
push 0x470674
push str.Dial
call ebp
mov eax, dword [0x4f8410]
test eax, eax
mov eax, 0x46e358
jne 0x4215ac
mov eax, 0x46e374
push 0x473bd8
push eax
push str.DialWhenStartup
push str.Dial
call ebp
mov eax, dword [0x4f8414]
test eax, eax
mov eax, 0x46e358
jne 0x4215d1
mov eax, 0x46e374
push 0x473bd8
push eax
push str.DisconnectWhenShutdown
push str.Dial
call ebp
mov eax, dword [0x4f77f8]
test eax, eax
mov eax, 0x46e358
jne 0x4215f6
mov eax, 0x46e374
push 0x473bd8
push eax
push str.LoadFromCache
push 0x46e248
call ebp
mov eax, dword [0x4f77fc]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.CacheTimeout
push 0x46e248
call ebp
mov eax, dword [0x4fb8a4]
test eax, eax
mov eax, 0x46e358
jne 0x42164f
mov eax, 0x46e374
push 0x473bd8
push eax
push str.CascadingProxy
push str.System
call ebp
mov edi, 0x4fb8a8
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fb8a8
push ecx
push str.ProxyAddr
push str.CascadingProxy
call ebp
mov edi, 0x4fbca8
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fbca8
push ecx
push 0x4705f4
push str.CascadingProxy
call ebp
mov eax, dword [0x4fc0a8]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push 0x4705e8
push str.CascadingProxy
call ebp
mov eax, dword [0x4fc0ac]
test eax, eax
mov eax, 0x46e358
jne 0x4216fe
mov eax, 0x46e374
push 0x473bd8
push eax
push str.NeedAuth
push str.CascadingProxy
call ebp
mov edi, 0x4fc0b0
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fc0b0
push ecx
push str.UserName
push str.CascadingProxy
call ebp
mov edi, 0x4fc4b0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x120]
neg ecx
sbb ecx, ecx
push 0x473bd8
and ecx, edx
push ecx
push 0x4706c4
push str.CascadingProxy
call ebp
mov eax, dword [0x4fc8b0]
test eax, eax
mov eax, 0x46e358
jne 0x4217b7
mov eax, 0x46e374
push 0x473bd8
push eax
push str.CascadingWWW
push str.CascadingProxy
call ebp
mov edi, 0x4fc8c4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fc8c4
push ecx
push str.WWWProxyAddr
push str.CascadingProxy
call ebp
mov edi, 0x4fdcc4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fdcc4
push ecx
push str.WWWProtocol
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0c4]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.WWWPort
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0d8]
test eax, eax
mov eax, 0x46e358
jne 0x421866
mov eax, 0x46e374
push 0x473bd8
push eax
push str.WWWNeedAuth
push str.CascadingProxy
call ebp
mov edi, 0x4ff0ec
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4ff0ec
push ecx
push str.WWWUserName
push str.CascadingProxy
call ebp
mov edi, 0x5004ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x120]
neg ecx
sbb ecx, ecx
push 0x473bd8
and ecx, edx
push ecx
push str.WWWPassword
push str.CascadingProxy
call ebp
mov eax, dword [0x4fc8b4]
test eax, eax
mov eax, 0x46e358
jne 0x42191f
mov eax, 0x46e374
push 0x473bd8
push eax
push str.CascadingSOCKS
push str.CascadingProxy
call ebp
mov edi, 0x4fccc4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fccc4
push ecx
push str.SOCKSProxyAddr
push str.CascadingProxy
call ebp
mov edi, 0x4fe0c4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fe0c4
push ecx
push str.SOCKSProtocol
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0c8]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.SOCKSPort
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0dc]
test eax, eax
mov eax, 0x46e358
jne 0x4219ce
mov eax, 0x46e374
push 0x473bd8
push eax
push str.SOCKSNeedAuth
push str.CascadingProxy
call ebp
mov edi, 0x4ff4ec
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4ff4ec
push ecx
push str.SOCKSUserName
push str.CascadingProxy
call ebp
mov edi, 0x5008ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x120]
neg ecx
sbb ecx, ecx
push 0x473bd8
and ecx, edx
push ecx
push str.SOCKSPassword
push str.CascadingProxy
call ebp
mov eax, dword [0x4fc8b8]
test eax, eax
mov eax, 0x46e358
jne 0x421a87
mov eax, 0x46e374
push 0x473bd8
push eax
push str.CascadingSMTP
push str.CascadingProxy
call ebp
mov edi, 0x4fd0c4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fd0c4
push ecx
push str.SMTPProxyAddr
push str.CascadingProxy
call ebp
mov edi, 0x4fe4c4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fe4c4
push ecx
push str.SMTPProtocol
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0cc]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.SMTPPort
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0e0]
test eax, eax
mov eax, 0x46e358
jne 0x421b36
mov eax, 0x46e374
push 0x473bd8
push eax
push str.SMTPNeedAuth
push str.CascadingProxy
call ebp
mov edi, 0x4ff8ec
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4ff8ec
push ecx
push str.SMTPUserName
push str.CascadingProxy
call ebp
mov edi, 0x500cec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x120]
neg ecx
sbb ecx, ecx
push 0x473bd8
and ecx, edx
push ecx
push str.SMTPPassword
push str.CascadingProxy
call ebp
mov eax, dword [0x4fc8bc]
test eax, eax
mov eax, 0x46e358
jne 0x421bef
mov eax, 0x46e374
push 0x473bd8
push eax
push str.CascadingPOP3
push str.CascadingProxy
call ebp
mov edi, 0x4fd4c4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fd4c4
push ecx
push str.POP3ProxyAddr
push str.CascadingProxy
call ebp
mov edi, 0x4fe8c4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fe8c4
push ecx
push str.POP3Protocol
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0d0]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.POP3Port
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0e4]
test eax, eax
mov eax, 0x46e358
jne 0x421c9e
mov eax, 0x46e374
push 0x473bd8
push eax
push str.POP3NeedAuth
push str.CascadingProxy
call ebp
mov edi, 0x4ffcec
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4ffcec
push ecx
push str.POP3UserName
push str.CascadingProxy
call ebp
mov edi, 0x5010ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x120]
neg ecx
sbb ecx, ecx
push 0x473bd8
and ecx, edx
push ecx
push str.POP3Password
push str.CascadingProxy
call ebp
mov eax, dword [0x4fc8c0]
test eax, eax
mov eax, 0x46e358
jne 0x421d57
mov eax, 0x46e374
push 0x473bd8
push eax
push str.CascadingOTHERS
push str.CascadingProxy
call ebp
mov edi, 0x4fd8c4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fd8c4
push ecx
push str.OTHERSProxyAddr
push str.CascadingProxy
call ebp
mov edi, 0x4fecc4
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4fecc4
push ecx
push str.OTHERSProtocol
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0d4]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.OTHERSPort
push str.CascadingProxy
call ebp
mov eax, dword [0x4ff0e8]
test eax, eax
mov eax, 0x46e358
jne 0x421e06
mov eax, 0x46e374
push 0x473bd8
push eax
push str.OTHERSNeedAuth
push str.CascadingProxy
call ebp
mov edi, 0x5000ec
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x5000ec
push ecx
push str.OTHERSUserName
push str.CascadingProxy
call ebp
mov edi, 0x5014ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x120]
neg ecx
sbb ecx, ecx
push 0x473bd8
and ecx, edx
push ecx
push str.OTHERSPassword
push str.CascadingProxy
call ebp
mov eax, dword [0x5018ec]
test eax, eax
mov eax, 0x46e358
jne 0x421ebf
mov eax, 0x46e374
push 0x473bd8
push eax
push str.SaveLogs
push 0x46e234
call ebp
mov edi, 0x5018f0
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x5018f0
push ecx
push str.LogPath
push 0x46e234
call ebp
mov eax, dword [0x501cf0]
test eax, eax
mov eax, 0x46e358
jne 0x421f0f
mov eax, 0x46e374
push 0x473bd8
push eax
push str.RequestURL
push 0x46e234
call ebp
mov eax, dword [0x501cf4]
test eax, eax
mov eax, 0x46e358
jne 0x421f34
mov eax, 0x46e374
push 0x473bd8
push eax
push str.PicInfo
push 0x46e234
call ebp
mov eax, dword [0x501cf8]
test eax, eax
mov eax, 0x46e358
jne 0x421f59
mov eax, 0x46e374
push 0x473bd8
push eax
push str.MailInfo
push 0x46e234
call ebp
mov eax, dword [0x501cfc]
test eax, eax
mov eax, 0x46e358
jne 0x421f7e
mov eax, 0x46e374
push 0x473bd8
push eax
push str.MailOutcoming
push 0x46e234
call ebp
mov eax, dword [0x501d00]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.MaxLine
push 0x46e234
call ebp
mov edi, 0x4f8848
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x4f8848
push ecx
push 0x46f18c
push str.System
call ebp
mov eax, dword [0x502140]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.SocketIdleTimeout
push str.System
call ebp
mov eax, dword [0x4f843c]
test eax, eax
mov eax, 0x46e358
jne 0x422036
mov eax, 0x46e374
push 0x473bd8
push eax
push str.PasswordProtect
push str.System
call ebp
mov eax, dword [0x4f8440]
test eax, eax
mov eax, 0x46e358
jne 0x42205b
mov eax, 0x46e374
push 0x473bd8
push eax
push str.PasswordProtectStartup
push str.System
call ebp
mov edi, 0x4f8444
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call fcn.0040a150
add esp, 4
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push 0x4706c4
push str.System
call ebp
mov eax, dword [0x4f8844]
test eax, eax
mov eax, 0x46e358
jne 0x4220d2
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AllHide
push str.System
call ebp
mov eax, dword [0x501d10]
test eax, eax
mov eax, 0x46e358
jne 0x4220f7
mov eax, 0x46e374
push 0x473bd8
push eax
push str.DisableExternalUser
push str.System
call ebp
mov edi, 0x502148
or ecx, 0xffffffff
xor eax, eax
push 0x473bd8
repne scasb al, byte es:[edi]
not ecx
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0x502148
push ecx
push str.WebSitesCheckInternet
push str.System
call ebp
mov eax, dword [0x4f77c4]
test eax, eax
mov eax, 0x46e358
jne 0x422147
mov eax, 0x46e374
push 0x473bd8
push eax
push str.StartSocks4
push str.System
call ebp
mov eax, dword [0x50314c]
test eax, eax
mov eax, 0x46e358
jne 0x42216c
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AutoScanComputerName
push str.System
call ebp
mov eax, dword [0x4f43a0]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.MaxUserCount
push str.System
call ebp
mov eax, dword [0x4f43ac]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.MaxTimeSchedule
push str.System
call ebp
mov eax, dword [0x4f43b8]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.MaxWebFilter
push str.System
call ebp
mov eax, dword [0x46f468]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.MaxConnection
push str.System
call ebp
mov eax, dword [ebx + 0x34b0]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.NTService
push str.System
call ebp
mov eax, dword [ebx + 0x34ac]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.AddMessage
push str.System
call ebp
push 0x473bd8
push 0x4f8c4c
push str.WebAuthTitle
push str.StringEx
call ebp
push 0x473bd8
push 0x4f9854
push str.AuthorityFailed
push str.StringEx
call ebp
push 0x473bd8
push 0x4f904c
push str.WebSiteForbidden
push str.StringEx
call ebp
push 0x473bd8
push 0x4f9450
push str.WebContentForbidden
push str.StringEx
call ebp
mov eax, dword [ebx + 0xb9a0]
test eax, eax
mov eax, 0x46e374
je 0x422324
mov eax, 0x46e358
push 0x473bd8
push eax
push str.EnableScanMAC
push str.System
call ebp
mov eax, dword [ebx + 0x34b8]
test eax, eax
mov eax, 0x46e374
je 0x42234a
mov eax, 0x46e358
push 0x473bd8
push eax
push str.ShutDownWhenIdle
push str.System
call ebp
mov eax, dword [0x51a844]
test eax, eax
mov eax, 0x46e374
je 0x42236f
mov eax, 0x46e358
push 0x473bd8
push eax
push str.BugTrace
push str.System
call ebp
mov eax, dword [0x501d08]
test eax, eax
mov eax, 0x46e374
je 0x422394
mov eax, 0x46e358
push 0x473bd8
push eax
push str.SaveUserData
push 0x46e234
call ebp
mov eax, dword [0x501d0c]
lea ecx, [esp + 0x120]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x120]
push 0x473bd8
push edx
push str.SaveUserDataInterval
push 0x46e234
call ebp
mov eax, dword [ebx + 0x34bc]
test eax, eax
mov eax, 0x46e358
jne 0x4223ee
mov eax, 0x46e374
push 0x473bd8
push eax
push str.Enable
push str.ShutDown
call ebp
lea eax, [ebx + 0x34c0]
push 0x473bd8
push eax
push str.Time
push str.ShutDown
call ebp
mov ecx, dword [ebx + 0x23084]
lea edx, [esp + 0x120]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x120]
push 0x473bd8
push eax
push str.Count
push 0x46ffe8
call ebp
mov eax, dword [ebx + 0x23084]
test eax, eax
jle 0x422592
lea ecx, [ebx + 0x1fae4]
mov esi, 1
mov dword [esp + 0x14], ecx
mov dl, byte [0x473aa0]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], dl
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push str.Host_d
push eax
call fcn.0043afc4
mov edi, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x18]
lea ecx, [edi - 0x108]
push 0x473bd8
push ecx
push edx
push 0x46ffe8
call ebp
push esi
lea eax, [esp + 0x1c]
push str.PortOut_d
push eax
call fcn.0043afc4
mov ecx, dword [edi]
lea edx, [esp + 0x12c]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0x18
lea eax, [esp + 0x120]
lea ecx, [esp + 0x18]
push 0x473bd8
push eax
push ecx
push 0x46ffe8
call ebp
push esi
lea edx, [esp + 0x1c]
push str.PortIn_d
push edx
call fcn.0043afc4
mov eax, dword [edi + 4]
lea ecx, [esp + 0x12c]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0x18
lea edx, [esp + 0x120]
lea eax, [esp + 0x18]
push 0x473bd8
push edx
push eax
push 0x46ffe8
call ebp
push esi
lea ecx, [esp + 0x1c]
push str.PortType_d
push ecx
call fcn.0043afc4
mov edx, dword [edi - 0x10c]
lea eax, [esp + 0x12c]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0x18
lea ecx, [esp + 0x120]
lea edx, [esp + 0x18]
push 0x473bd8
push ecx
push edx
push 0x46ffe8
call ebp
inc esi
add edi, 0x118
mov dword [esp + 0x14], edi
lea eax, [esi - 1]
cmp eax, dword [ebx + 0x23084]
jl 0x42246a
mov ecx, dword [ebx + 0xb9a4]
lea edx, [esp + 0x120]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x120]
push 0x473bd8
push eax
push str.MaxConnectionMode
push str.System
call ebp
mov ecx, dword [ebx + 0x38c4]
lea edx, [esp + 0x120]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x120]
push 0x473bd8
push eax
push str.EnableRemoteControl
push str.System
call ebp
mov ecx, dword [ebx + 0xb9a8]
lea edx, [esp + 0x120]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x120]
push 0x473bd8
push eax
push str.TimeoutMAC
push str.System
call ebp
mov ecx, dword [ebx + 0xb9ac]
lea edx, [esp + 0x120]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x120]
push 0x473bd8
push eax
push str.SOCKS5UDP
push str.System
call ebp
mov ecx, dword [ebx + 0x38c8]
lea edx, [esp + 0x120]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x120]
push 0x473bd8
push eax
push str.CloseConfirm
push str.System
call ebp
mov eax, dword [ebx + 0x23098]
pop edi
test eax, eax
pop esi
mov eax, 0x46e358
jne 0x4226b1
mov eax, 0x46e374
push 0x473bd8
push eax
push str.EnableRecord
push 0x46ff68
call ebp
mov eax, dword [ebx + 0x38cc]
test eax, eax
mov eax, 0x46e358
jne 0x4226d7
mov eax, 0x46e374
push 0x473bd8
push eax
push str.EnableMultiRun
push str.System
call ebp
mov ecx, dword [ebx + 0x38d0]
lea edx, [esp + 0x118]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x118]
push 0x473bd8
push eax
push str.MaximumConnectionsChart
push str.System
call ebp
mov ecx, dword [ebx + 0x38d4]
lea edx, [esp + 0x118]
push ecx
push 0x46f45c
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x118]
push 0x473bd8
push eax
push str.MaximumBandwidthChart
push str.System
call ebp
mov ecx, dword [ebx + 0x38d8]
lea edx, [esp + 0x118]
push ecx
push str.CTRLALT_c
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x118]
push 0x473bd8
push eax
push str.HotKey
push str.System
call ebp
mov ecx, dword [ebx + 0x1b9b4]
lea edx, [esp + 0x118]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x118]
push 0x473bd8
push eax
push str.AntiVirusGate
push str.System
call ebp
mov ecx, dword [0x4f67a4]
lea edx, [esp + 0x118]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x118]
push 0x473bd8
push eax
push str.NTUserAuth
push str.System
call ebp
push 0x473bd8
push 0x4f67a8
push str.NTDomain
push str.System
call ebp
mov ecx, dword [ebx + 0x34b4]
lea edx, [esp + 0x118]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x118]
push 0x473bd8
push eax
push str.TerminalServices
push str.System
call ebp
mov ecx, dword [ebx + 0x1b9b8]
lea edx, [esp + 0x118]
push ecx
push 0x46e150
push edx
call fcn.0043afc4
add esp, 0xc
lea eax, [esp + 0x118]
push 0x473bd8
push eax
push str.PortDisabled
push str.DestDisabled
call ebp
lea ecx, [ebx + 0x1b9bc]
push 0x473bd8
push ecx
push 0x4705e8
push str.DestDisabled
call ebp
mov edx, dword [ebx + 0x1c9c0]
lea eax, [esp + 0x118]
push edx
push 0x46e150
push eax
call fcn.0043afc4
add esp, 0xc
lea ecx, [esp + 0x118]
push 0x473bd8
push ecx
push str.IPDisabled
push str.DestDisabled
call ebp
lea edx, [ebx + 0x1c9c4]
push 0x473bd8
push edx
push 0x46feac
push str.DestDisabled
call ebp
mov eax, dword [ebx + 0x1d9c8]
lea ecx, [esp + 0x118]
push eax
push 0x46e150
push ecx
call fcn.0043afc4
add esp, 0xc
lea edx, [esp + 0x118]
push 0x473bd8
push edx
push str.ConnectionsBasedIP
push str.System
call ebp
mov eax, dword [ebx + 0x1d9cc]
test eax, eax
mov eax, 0x46e358
jne 0x422920
mov eax, 0x46e374
push 0x473bd8
push eax
push str.AutoCloseNAVAlert
push str.AntiVirus
call ebp
lea eax, [ebx + 0x1d9d0]
push 0x473bd8
push eax
push str.NVATitle
push str.AntiVirus
call ebp
add ebx, 0x1e9d1
push 0x473bd8
push ebx
push str.NVAClass
push str.AntiVirus
call ebp
lea ecx, [esp + 8]
mov dword [esp + 0x1528], 0xffffffff
call fcn.00450e93
mov ecx, dword [esp + 0x1520]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1524
ret