Function at 0x464c20
Capabilities:
Extract resource via kernel32 functions
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.0046be80
mov eax, dword [0x4a5c78]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0x4a74d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x4a74d8
call fcn.0046e1d9
add esp, 8
test eax, eax
jne 0x464c71
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468861
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov edx, 0x4a7808
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x464c80
push 0x104
push 0x4a73c0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x4a73c0
call fcn.00469fa0
add esp, 8
test eax, eax
je 0x464c5c
mov byte [eax], 0
inc eax
mov edx, 0x4a76f8
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x464cc0
push ebx
push esi
push edi
push 0x34
push 0
push 0x4a7388
call fcn.00468360
add esp, 0xc
push 2
push 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
je 0x464d4d
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x464d46
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x464d46
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
test edi, edi
je 0x464d46
cmp dword [ecx + eax], 0xfeef04bd
je 0x464d37
inc ecx
cmp ecx, edi
jb 0x464d27
jmp 0x464d46
lea esi, [ecx + eax]
mov ecx, 0xd
mov edi, 0x4a7388
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x4a7390], 0
jne 0x464e93
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
push 0xffe
push eax
lea ecx, [ebp - 0x1012]
push ecx
mov word [ebp - 0x1014], ax
call fcn.00468360
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [ebp - 0x201c]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x2018]
push ecx
push 0
push 0x49ac78
push edx
mov dword [ebp - 0x2018], 1
mov dword [ebp - 0x201c], 0x800
call ebx
lea eax, [ebp - 0x1014]
push 0x2e
push eax
call fcn.0046e1b2
mov esi, eax
add esp, 8
test esi, esi
jne 0x464ded
mov esi, 0x49ac74
jmp 0x464df0
add esi, 2
lea ecx, [ebp - 0x1014]
push ecx
call fcn.0046e3ff
mov edi, eax
push esi
shl edi, 0x10
call fcn.0046e3ff
add esp, 8
add eax, edi
lea edx, [ebp - 0x201c]
push edx
mov edx, dword [ebp - 8]
mov dword [0x4a7390], eax
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x2018]
push ecx
push 0
push str.BuildLabEx
push edx
mov dword [ebp - 0x2018], 1
mov dword [ebp - 0x201c], 0x800
call ebx
lea eax, [ebp - 0x1014]
push 0x2e
push eax
call fcn.0046e1b2
mov esi, eax
add esp, 8
test esi, esi
jne 0x464e65
mov esi, 0x49ac74
jmp 0x464e68
add esi, 2
lea ecx, [ebp - 0x1014]
push ecx
call fcn.0046e3ff
mov edi, eax
push esi
shl edi, 0x10
call fcn.0046e3ff
mov edx, dword [ebp - 8]
add esp, 8
add eax, edi
push edx
mov dword [0x4a7394], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SetProcessDPIAware
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a7a14], eax
push 0x1000
lea eax, [ebp - 0x2014]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x2014]
push 0
push ecx
call fcn.00461090
lea edx, [ebp - 0x2014]
push edx
call fcn.00488781
lea eax, [ebp - 0x2014]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x464ef0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x464ef0
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea ecx, [ebp - 0x2014]
push ecx
call fcn.00440de0
push str.BINDATA
push str.MAINRES
push 0
mov dword [ebp - 0x2018], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x464fc6
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x464fc6
push 8
call fcn.004688aa
add esp, 4
test eax, eax
je 0x464f6d
push 0
mov ecx, eax
call fcn.00440b70
mov esi, eax
jmp 0x464f6f
xor esi, esi
mov edx, dword [ebp - 8]
push edx
mov ecx, esi
call fcn.00440b00
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push edi
push eax
call fcn.00467c80
push esi
call fcn.00441d00
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
add esp, 0x10
cmp dword [esi + 4], ecx
jae 0x464fc6
mov edx, dword [ebp - 0x2018]
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4a7c60
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], esi
call fcn.00450530
push eax
lea ecx, [ebp - 0xc]
push ecx
mov ecx, 0x4a7c60
call fcn.0044d8a0
push str.wke.dll
call fcn.0045a6f0
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x465512
push eax
call fcn.00442610
mov esi, eax
lea edx, [esi + 4]
push edx
call fcn.004697f8
mov edi, eax
mov eax, dword [ebp - 8]
push esi
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.004426b0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004425d0
push edi
mov dword [esi + edi], 0
call fcn.00439b70
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4652b6
push str.wkeInit
push esi
call fcn.00439860
push str.wkeShutdown
push esi
mov dword [0x4a7a18], eax
call fcn.00439860
push str.wkeCreateWebView
push esi
mov dword [0x4a7a1c], eax
call fcn.00439860
push str.wkeDestroyWebView
push esi
mov dword [0x4a7a20], eax
call fcn.00439860
push str.wkeSetFileSystem
push esi
mov dword [0x4a7a24], eax
call fcn.00439860
push str.wkeSetClientHandler
push esi
mov dword [0x4a7a28], eax
call fcn.00439860
push str.wkeToStringW
push esi
mov dword [0x4a7378], eax
call fcn.00439860
push str.jsBindFunction
push esi
mov dword [0x4a73bc], eax
call fcn.00439860
add esp, 0x40
push str.jsBindGetter
push esi
mov dword [0x4a7368], eax
call fcn.00439860
push str.jsBindSetter
push esi
mov dword [0x4a733c], eax
call fcn.00439860
push str.jsArg
push esi
mov dword [0x4a7358], eax
call fcn.00439860
push str.jsArgCount
push esi
mov dword [0x4a7380], eax
call fcn.00439860
push str.jsArgType
push esi
mov dword [0x4a76ec], eax
call fcn.00439860
push str.jsTypeOf
push esi
mov dword [0x4a7354], eax
call fcn.00439860
push str.jsIsNumber
push esi
mov dword [0x4a76f4], eax
call fcn.00439860
push str.jsIsUndefined
push esi
mov dword [0x4a76e4], eax
call fcn.00439860
add esp, 0x40
push str.jsToInt
push esi
mov dword [0x4a735c], eax
call fcn.00439860
push str.jsToDouble
push esi
mov dword [0x4a77fc], eax
call fcn.00439860
push str.jsToString
push esi
mov dword [0x4a7370], eax
call fcn.00439860
push str.jsToStringW
push esi
mov dword [0x4a7360], eax
call fcn.00439860
push str.jsUndefined
push esi
mov dword [0x4a7384], eax
call fcn.00439860
push str.jsInt
push esi
mov dword [0x4a74c4], eax
call fcn.00439860
push str.jsDouble
push esi
mov dword [0x4a7328], eax
call fcn.00439860
push str.jsString
push esi
mov dword [0x4a7330], eax
call fcn.00439860
add esp, 0x40
push str.jsStringW
push esi
mov dword [0x4a74d4], eax
call fcn.00439860
push str.jsTrue
push esi
mov dword [0x4a732c], eax
call fcn.00439860
push str.jsFalse
push esi
mov dword [0x4a76e8], eax
call fcn.00439860
push str.jsObject
push esi
mov dword [0x4a736c], eax
call fcn.00439860
push str.jsGet
push esi
mov dword [0x4a76f0], eax
call fcn.00439860
push str.jsSet
push esi
mov dword [0x4a74cc], eax
call fcn.00439860
push str.jsGetAt
push esi
mov dword [0x4a74c8], eax
call fcn.00439860
push str.jsSetAt
push esi
mov dword [0x4a734c], eax
call fcn.00439860
add esp, 0x40
push str.jsGetGlobal
push esi
mov dword [0x4a7344], eax
call fcn.00439860
push str.jsSetGlobal
push esi
mov dword [0x4a737c], eax
call fcn.00439860
push str.jsGetLength
push esi
mov dword [0x4a76e0], eax
call fcn.00439860
push str.jsSetLength
push esi
mov dword [0x4a7348], eax
call fcn.00439860
push str.jsGlobalObject
push esi
mov dword [0x4a7338], eax
call fcn.00439860
push str.jsEval
push esi
mov dword [0x4a7340], eax
call fcn.00439860
push str.jsCall
push esi
mov dword [0x4a7350], eax
call fcn.00439860
push str.jsGetWebView
mov dword [0x4a74d0], eax
push esi
call fcn.00439860
add esp, 0x40
mov dword [0x4a7364], eax
jmp 0x4652bb
mov eax, dword [0x4a7364]
xor edi, edi
cmp dword [0x4a7a18], edi
jne 0x465527
push 0x4a74d8
lea edx, [ebp - 0x1014]
push str._swke.dll
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x465504
push str.wkeInit
push edi
call ebx
push str.wkeShutdown
push edi
mov dword [0x4a7a18], eax
call ebx
push str.wkeCreateWebView
push edi
mov dword [0x4a7a1c], eax
call ebx
push str.wkeDestroyWebView
push edi
mov dword [0x4a7a20], eax
call ebx
push str.wkeSetFileSystem
push edi
mov dword [0x4a7a24], eax
call ebx
push str.wkeSetClientHandler
push edi
mov dword [0x4a7a28], eax
call ebx
push str.wkeToStringW
push edi
mov dword [0x4a7378], eax
call ebx
push str.jsBindFunction
push edi
mov dword [0x4a73bc], eax
call ebx
push str.jsBindGetter
push edi
mov dword [0x4a7368], eax
call ebx
push str.jsBindSetter
push edi
mov dword [0x4a733c], eax
call ebx
push str.jsArg
push edi
mov dword [0x4a7358], eax
call ebx
push str.jsArgCount
push edi
mov dword [0x4a7380], eax
call ebx
push str.jsArgType
push edi
mov dword [0x4a76ec], eax
call ebx
push str.jsTypeOf
push edi
mov dword [0x4a7354], eax
call ebx
push str.jsIsNumber
push edi
mov dword [0x4a76f4], eax
call ebx
push str.jsIsUndefined
push edi
mov dword [0x4a76e4], eax
call ebx
push str.jsToInt
push edi
mov dword [0x4a735c], eax
call ebx
push str.jsToDouble
push edi
mov dword [0x4a77fc], eax
call ebx
push str.jsToString
push edi
mov dword [0x4a7370], eax
call ebx
push str.jsToStringW
push edi
mov dword [0x4a7360], eax
call ebx
mov dword [0x4a7384], eax
push str.jsUndefined
push edi
call ebx
push str.jsInt
push edi
mov dword [0x4a74c4], eax
call ebx
push str.jsDouble
push edi
mov dword [0x4a7328], eax
call ebx
push str.jsString
push edi
mov dword [0x4a7330], eax
call ebx
push str.jsStringW
push edi
mov dword [0x4a74d4], eax
call ebx
push str.jsTrue
push edi
mov dword [0x4a732c], eax
call ebx
push str.jsFalse
push edi
mov dword [0x4a76e8], eax
call ebx
push str.jsObject
push edi
mov dword [0x4a736c], eax
call ebx
push str.jsGet
push edi
mov dword [0x4a76f0], eax
call ebx
push str.jsSet
push edi
mov dword [0x4a74cc], eax
call ebx
push str.jsGetAt
push edi
mov dword [0x4a74c8], eax
call ebx
push str.jsSetAt
push edi
mov dword [0x4a734c], eax
call ebx
push str.jsGetGlobal
push edi
mov dword [0x4a7344], eax
call ebx
push str.jsSetGlobal
push edi
mov dword [0x4a737c], eax
call ebx
push str.jsGetLength
push edi
mov dword [0x4a76e0], eax
call ebx
push str.jsSetLength
push edi
mov dword [0x4a7348], eax
call ebx
push str.jsGlobalObject
push edi
mov dword [0x4a7338], eax
call ebx
push str.jsEval
push edi
mov dword [0x4a7340], eax
call ebx
push str.jsCall
push edi
mov dword [0x4a7350], eax
call ebx
push str.jsGetWebView
push edi
mov dword [0x4a74d0], eax
call ebx
mov dword [0x4a7364], eax
jmp 0x465509
mov eax, dword [0x4a7364]
cmp dword [0x4a7a18], 0
jne 0x465527
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468861
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [eax + 0xaa0]
lea edx, [eax + 0x75a380]
mov dword [0x4a7b38], ecx
add eax, 0x5d201d
mov dword [0x4a7374], edx
mov ecx, 0x461740
sub ecx, eax
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0x13], ecx
push 5
lea ecx, [ebp - 0x14]
mov dword [0x4a7b3c], eax
push ecx
add eax, 0xfffffffb
push eax
xor ebx, ebx
mov dword [0x4a7334], 0x4562d0
mov dword [0x4a7800], 0x456410
mov byte [ebp - 0x14], 0xe9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call dword [0x4a7a18]
push 0x442710
push fcn.004426b0
push fcn.00442610
push fcn.004425d0
push fcn.0045a6f0
call dword [0x4a7a28]
push ebx
push 0x45ce40
push str.GetCoreVersion
call dword [0x4a7368]
push 2
push 0x461760
push str.wke_FILE_add_path
call dword [0x4a7368]
push 1
push 0x4555d0
push str.WKELoadFile
call dword [0x4a7368]
push 2
push 0x455660
push str.wkeLoadFile
call dword [0x4a7368]
add esp, 0x44
push 2
push 0x455480
push str.wieLoadFile
call dword [0x4a7368]
push 2
push 0x455870
push str.wkeRunJS
call dword [0x4a7368]
push 2
push 0x4628e0
push str.wke_curl_setopt
call dword [0x4a7368]
push 2
push 0x455720
push str.wkeSetClientHandler
call dword [0x4a7368]
push 4
push 0x45c400
push str.unzip
call dword [0x4a7368]
push 6
push 0x45ca50
push str.un7z
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x450bc0
push str.dllexport_7zc
call dword [0x4a7368]
push 1
push 0x445a90
push str.dllexport_7zc_get_progress
call dword [0x4a7368]
push 1
push 0x445b10
push str.dllexport_7zc_get_all_info
call dword [0x4a7368]
push 1
push 0x44ab60
push str.dllexport_7zc_free
call dword [0x4a7368]
push 2
push 0x446430
push str.WriteUTF8File
call dword [0x4a7368]
push 1
push 0x45d430
push str.ReadUTF8File
call dword [0x4a7368]
add esp, 0x48
push 6
push 0x448390
push str.CreateShortcut
call dword [0x4a7368]
push 2
push 0x4484e0
push str.CreateMutex
call dword [0x4a7368]
push 1
push 0x448560
push 0x49a914
call dword [0x4a7368]
push 2
push 0x448590
push str.SetEnvironmentVariable
call dword [0x4a7368]
push 1
push 0x4485e0
push str.GetEnvironmentVariable
call dword [0x4a7368]
push ebx
push 0x448680
push str.GetKernel32DllVersion
call dword [0x4a7368]
add esp, 0x48
push ebx
push 0x448930
push 0x49a8b8
call dword [0x4a7368]
push ebx
push 0x448960
push 0x49a8a0
call dword [0x4a7368]
push ebx
push 0x448990
push 0x49a88c
call dword [0x4a7368]
push 3
push 0x4489c0
push str.CreateEvent
call dword [0x4a7368]
push 3
push 0x448a50
push str.OpenEvent
call dword [0x4a7368]
push 1
push 0x448b00
push 0x49a868
call dword [0x4a7368]
add esp, 0x48
push 4
push 0x448b70
push 0x49a854
call dword [0x4a7368]
push 1
push 0x448c30
push 0x49a848
call dword [0x4a7368]
push 2
push 0x448ca0
push 0x49a838
call dword [0x4a7368]
push 1
push 0x448d50
push 0x49a828
call dword [0x4a7368]
push 1
push 0x448dc0
push 0x49a818
call dword [0x4a7368]
push 6
push 0x45dae0
push str.CreateFileMapping
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x459510
push str.ReadFileMapping
call dword [0x4a7368]
push 3
push 0x448e30
push str.WriteFileMapping
call dword [0x4a7368]
push 1
push 0x455350
push str.CloseFileMapping
call dword [0x4a7368]
push 3
push 0x448f10
push str.OpenFileMapping
call dword [0x4a7368]
push 4
push 0x448fd0
push 0x49a7ac
call dword [0x4a7368]
push 1
push 0x449110
push 0x49a79c
call dword [0x4a7368]
add esp, 0x48
push ebx
push 0x449190
push 0x498dc8
call dword [0x4a7368]
push 1
push 0x4553f0
push str.GetKeyString
call dword [0x4a7368]
push 2
push 0x463470
push str.SetKeyString
call dword [0x4a7368]
push 3
push 0x459640
push str.wkeUpdateRenderFM
call dword [0x4a7368]
push ebx
push 0x445c20
push 0x49a758
call dword [0x4a7368]
push 1
push 0x445c90
push 0x49a744
call dword [0x4a7368]
add esp, 0x48
push 5
push 0x45f0e0
push str.wkeCreateWindow
call dword [0x4a7368]
push 5
push 0x457710
push str.wieCreateWindow
call dword [0x4a7368]
push 2
push 0x445cc0
push str.FindWindow
call dword [0x4a7368]
push 2
push 0x451020
push 0x49a70c
call dword [0x4a7368]
push 2
push 0x451160
push 0x49a700
call dword [0x4a7368]
push ebx
push 0x445d20
push 0x49a6ec
call dword [0x4a7368]
add esp, 0x48
push 1
push 0x4512a0
push 0x49a6dc
call dword [0x4a7368]
push 1
push 0x451420
push 0x49a6c0
call dword [0x4a7368]
push 6
push 0x451570
push 0x49a6b4
call dword [0x4a7368]
push 7
push 0x4516e0
push 0x49a6a4
call dword [0x4a7368]
push 2
push 0x451a60
push str.SetWindowText
call dword [0x4a7368]
push 2
push 0x451b60
push str.GetWindowLong
call dword [0x4a7368]
add esp, 0x48
push 3
push 0x451c70
push str.SetWindowLong
call dword [0x4a7368]
push 1
push 0x451d90
push 0x49a668
call dword [0x4a7368]
push 1
push 0x451e70
push 0x49a65c
call dword [0x4a7368]
push 6
push 0x445d50
push str.LoadImage
call dword [0x4a7368]
push 2
push 0x445e70
push str.LoadIcon
call dword [0x4a7368]
push 3
push 0x445ef0
push str.ExtractIcon
call dword [0x4a7368]
add esp, 0x48
push 3
push 0x445fb0
push str.ExtractIconEx
call dword [0x4a7368]
push 1
push 0x4460a0
push 0x49a61c
call dword [0x4a7368]
push ebx
push 0x4460f0
push str.EnumDisplaySettings
call dword [0x4a7368]
push ebx
push 0x4462f0
push str.SetProcessDPIAware
call dword [0x4a7368]
push 2
push 0x452080
push 0x49a5fc
call dword [0x4a7368]
push 4
push 0x4521a0
push str.PostMessage
call dword [0x4a7368]
add esp, 0x48
push 4
push 0x452330
push str.SendMessage
call dword [0x4a7368]
push 4
push 0x446310
push 0x49a5d8
call dword [0x4a7368]
push 1
push 0x4524c0
push 0x49a5cc
call dword [0x4a7368]
push 1
push 0x4525b0
push 0x49a5c0
call dword [0x4a7368]
push ebx
push 0x446400
push 0x49a5b0
call dword [0x4a7368]
push 2
push 0x45cee0
push str.ShellNotifyIcon
call dword [0x4a7368]
add esp, 0x48
push 4
push 0x4526a0
push str.MessageBoxTimeout
call dword [0x4a7368]
push 3
push 0x451f50
push str.SetWindowMinTrackSize
call dword [0x4a7368]
push 1
push 0x452e80
push str.CreateGlobalHWND
call dword [0x4a7368]
push ebx
push 0x446570
push str.DestroyGlobalHWND
call dword [0x4a7368]
push 2
push 0x452f60
push str.UpdateGlobalHWND
call dword [0x4a7368]
push 1
push 0x446590
push str.GetGlobalHWND
call dword [0x4a7368]
add esp, 0x48
push 1
push 0x446630
push str.SetForegroundGlobalHWND
call dword [0x4a7368]
push 1
push 0x453040
push 0x49a4fc
call dword [0x4a7368]
push 1
push 0x4578d0
push str.SetCurrentWindowFlag
call dword [0x4a7368]
push 2
push 0x452800
push str.SetWindowHitTestCallBack
call dword [0x4a7368]
push 1
push 0x452930
push str.InitWindowHitTestData
call dword [0x4a7368]
push 5
push 0x452a30
push str.SetWindowNoDragRect
call dword [0x4a7368]
add esp, 0x48
push 5
push 0x452ba0
push str.SetWindowDragRect
call dword [0x4a7368]
push 5
push 0x452d10
push str.SetWindowThickFrame
call dword [0x4a7368]
push 2
push 0x4575d0
push str.SetWinMsgProcRunJS
call dword [0x4a7368]
push 3
push 0x458400
push str.RegQueryString
call dword [0x4a7368]
push 4
push 0x4586a0
push str.RegWriteString
call dword [0x4a7368]
push 3
push 0x458a20
push str.RegQueryInfoKey
call dword [0x4a7368]
add esp, 0x48
push 4
push 0x458ea0
push str.RegDeleteKeyValue
call dword [0x4a7368]
push 3
push 0x4591a0
push str.RegDeleteKeyEx
call dword [0x4a7368]
push 2
push 0x459340
push str.RegDeleteTree
call dword [0x4a7368]
push 3
push 0x4480e0
push str.GetPrivateProfileString
call dword [0x4a7368]
push 4
push 0x4481b0
push str.WritePrivateProfileString
call dword [0x4a7368]
push 1
push 0x448230
push 0x49a3ac
call dword [0x4a7368]
add esp, 0x48
push ebx
push 0x454790
push str.SHBrowseForFolder
call dword [0x4a7368]
push 2
push 0x454930
push str.SHFileOperation
call dword [0x4a7368]
push 1
push 0x454e20
push str.GetOpenFileName
call dword [0x4a7368]
push 1
push 0x455040
push str.GetSaveFileName
call dword [0x4a7368]
push ebx
push 0x4467e0
push str.GetCommandLine
call dword [0x4a7368]
push ebx
push 0x446800
push str.GetProcessPath
call dword [0x4a7368]
add esp, 0x48
push ebx
push 0x4466c0
push str.GetTempPath
call dword [0x4a7368]
push 1
push 0x446740
push str.GetFullPathName
call dword [0x4a7368]
push ebx
push 0x446880
push str.GetCurrentDirectory
call dword [0x4a7368]
push 1
push 0x446900
push str.GetDiskFreeSpaceEx
call dword [0x4a7368]
push 3
push 0x446c60
push str.CopyFile
call dword [0x4a7368]
push 1
push 0x446cc0
push str.GetFileSize
call dword [0x4a7368]
add esp, 0x48
push 3
push 0x446d70
push str.MoveFileEx
call dword [0x4a7368]
push 1
push 0x446e50
push str.DeleteFile
call dword [0x4a7368]
push 1
push 0x446e80
push str.RemoveDirectory
call dword [0x4a7368]
push 1
push 0x4531b0
push str.DeleteDirectory
call dword [0x4a7368]
push 1
push 0x45d890
push str.GetFileCRC32
call dword [0x4a7368]
push 3
push 0x4620c0
push str.GetFileList
call dword [0x4a7368]
add esp, 0x48
push 1
push 0x446eb0
push str.IsPathExists
call dword [0x4a7368]
push 1
push 0x446ef0
push str.IsFileExists
call dword [0x4a7368]
push 1
push 0x446f40
push str.IsFileBeLock
call dword [0x4a7368]
push 1
push 0x446f90
push str.CreateDirectory
call dword [0x4a7368]
push 1
push 0x446fc0
push str.CreateFile
call dword [0x4a7368]
push 4
push 0x453340
push 0x49a240
call dword [0x4a7368]
add esp, 0x48
push 4
push 0x453670
push 0x49a234
call dword [0x4a7368]
push 3
push 0x447320
push 0x49a220
call dword [0x4a7368]
push 1
push 0x447450
push str.fopen
call dword [0x4a7368]
push 3
push 0x4474b0
push str.fseek
call dword [0x4a7368]
push 1
push 0x447550
push str.fclose
call dword [0x4a7368]
push 5
push 0x4475b0
push str.CreateProcess
call dword [0x4a7368]
add esp, 0x48
push 3
push 0x4477e0
push 0x49a1ec
call dword [0x4a7368]
push 1
push 0x4478b0
push str.LoadLibrary
call dword [0x4a7368]
push 1
push 0x447900
push 0x49a1d4
call dword [0x4a7368]
push 2
push 0x447950
push str.GetModuleHandle
call dword [0x4a7368]
push 2
push 0x447a50
push 0x49a1b4
call dword [0x4a7368]
push 2
push 0x447ad0
push str.GetModuleHandle64
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x447b30
push str.GetProcAddress64
call dword [0x4a7368]
push 1
push 0x4539a0
push str.CallFunction
call dword [0x4a7368]
push 1
push 0x447bb0
push str.SetLastErrorFromX64Call
call dword [0x4a7368]
push 2
push 0x447be0
push str.GetModuleBaseName
call dword [0x4a7368]
push 2
push 0x447ca0
push str.GetModuleFileNameEx
call dword [0x4a7368]
push 1
push 0x458150
push str.GetProcessImageFileName
call dword [0x4a7368]
add esp, 0x48
push 1
push 0x447d60
push 0x49a110
call dword [0x4a7368]
push 1
push 0x447ea0
push 0x49a104
call dword [0x4a7368]
push 2
push 0x447ef0
push 0x49a0f4
call dword [0x4a7368]
push ebx
push 0x44f520
push str.exit
call dword [0x4a7368]
push 3
push 0x453d10
push 0x49a0d8
call dword [0x4a7368]
push 5
push 0x453f80
push str.ShellExecute
call dword [0x4a7368]
add esp, 0x48
push 5
push 0x447ff0
push 0x49a0b8
call dword [0x4a7368]
push 6
push 0x4544e0
push str.ShellExecuteEx
call dword [0x4a7368]
push 1
push 0x448090
push 0x49a0a0
call dword [0x4a7368]
push 2
push 0x446ab0
push str.GetPEFileVerInfo
call dword [0x4a7368]
push 9
push 0x45d640
push str.SetPEFileVerInfo
call dword [0x4a7368]
push 2
push 0x459770
push 0x49a064
call dword [0x4a7368]
add esp, 0x48
push 1
push 0x4491c0
push str.OutputDebugString
call dword [0x4a7368]
push 3
push 0x45dd70
push str.PlaySound
call dword [0x4a7368]
push ebx
push 0x455260
push str.ChooseFont
call dword [0x4a7368]
push 2
push 0x4491f0
push str.my_EncodeFileData
call dword [0x4a7368]
push 2
push 0x464a20
push str.Handware_Info
call dword [0x4a7368]
push 1
push 0x4598b0
push str.GetHWID
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x449320
push str.GetRunTimeState
call dword [0x4a7368]
push 3
push 0x4493d0
push str.SetHOSTDNS
call dword [0x4a7368]
push 2
push 0x455930
push str.GetSteamIDUint64
call dword [0x4a7368]
push 3
push 0x45e0b0
push str.module_control_startup
call dword [0x4a7368]
push 3
push 0x449510
push str.module_control
call dword [0x4a7368]
push 2
push 0x4495b0
push str.module_control_immediately
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x459970
push str.RegisterGlobalJSCallback
call dword [0x4a7368]
push 2
push 0x455b30
push str.CallGlobalJSCallback
call dword [0x4a7368]
push 1
push 0x455cc0
push str.RegJSCB_WM_CLOSE
call dword [0x4a7368]
push 1
push 0x455d40
push str.RegJSCB_WM_SYSCOMMAND
call dword [0x4a7368]
push 1
push 0x455dc0
push str.RegJSCB_WM_GETMINMAXINFO
call dword [0x4a7368]
push 1
push 0x455e40
push str.RegJSCB_WM_DROPFILES
call dword [0x4a7368]
add esp, 0x48
push 3
push 0x4568e0
push str.RegWMCallback
call dword [0x4a7368]
push 1
push 0x442e00
push str.malloc
call dword [0x4a7368]
push 1
push 0x442e60
push str.free
call dword [0x4a7368]
push 2
push 0x442eb0
push str.realloc
call dword [0x4a7368]
push 3
push 0x442f60
push str.memcpy
call dword [0x4a7368]
push 2
push 0x443030
push str.memset
call dword [0x4a7368]
add esp, 0x48
push 3
push 0x4430d0
push str.memmove
call dword [0x4a7368]
push 3
push 0x4431a0
push str.memcmp
call dword [0x4a7368]
push 1
push 0x4432d0
push str.GetMemoryAddress
call dword [0x4a7368]
push 5
push 0x4433d0
push 0x499f14
call dword [0x4a7368]
push 4
push 0x443500
push 0x499f04
call dword [0x4a7368]
push 5
push 0x443600
push 0x499ef0
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x443780
push 0x499ee0
call dword [0x4a7368]
push 5
push 0x4439f0
push str.VirtualAllocEx64
call dword [0x4a7368]
push 4
push 0x443b20
push str.VirtualFreeEx64
call dword [0x4a7368]
push 5
push 0x443c00
push str.VirtualProtectEx64
call dword [0x4a7368]
push 2
push 0x443d70
push str.VirtualQueryEx64
call dword [0x4a7368]
push 4
push 0x4440a0
push 0x499e80
call dword [0x4a7368]
add esp, 0x48
push 5
push 0x444220
push 0x499e6c
call dword [0x4a7368]
push 5
push 0x4631a0
push str.memaobscan
call dword [0x4a7368]
push 1
push 0x4444a0
push str.BT_session_create
call dword [0x4a7368]
push 1
push 0x444780
push str.BT_session_destroy
call dword [0x4a7368]
push 4
push 0x4447e0
push str.BT_session_listen
call dword [0x4a7368]
push 7
push 0x444b80
push str.BT_session_add_torrent
call dword [0x4a7368]
add esp, 0x48
push 3
push 0x444ce0
push str.BT_session_remove_torrent
call dword [0x4a7368]
push 1
push 0x4448a0
push str.BT_session_use_dht
call dword [0x4a7368]
push 1
push 0x444910
push str.BT_session_disable_dht
call dword [0x4a7368]
push 1
push 0x444980
push str.BT_session_get_rate_limit
call dword [0x4a7368]
push 2
push 0x444a60
push str.BT_session_set_rate_limit
call dword [0x4a7368]
push 3
push 0x444dc0
push str.BT_torrent_connect_peer
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x444e50
push str.BT_torrent_add_url_seed
call dword [0x4a7368]
push 1
push 0x444ec0
push str.BT_torrent_remove_all_tracker
call dword [0x4a7368]
push 2
push 0x444f20
push str.BT_torrent_add_tracker
call dword [0x4a7368]
push 2
push 0x444f90
push str.BT_torrent_set_seed_mode
call dword [0x4a7368]
push 1
push 0x445020
push str.BT_torrent_get_status
call dword [0x4a7368]
push 1
push 0x4452a0
push str.BT_torrent_is_finished
call dword [0x4a7368]
add esp, 0x48
push 1
push 0x445310
push str.BT_torrent_is_valid
call dword [0x4a7368]
push 1
push 0x445380
push str.BT_torrent_pause
call dword [0x4a7368]
push 1
push 0x4453f0
push str.BT_torrent_resume
call dword [0x4a7368]
push 2
push 0x445460
push str.BT_torrent_set_ratio
call dword [0x4a7368]
push 1
push 0x445550
push str.BT_torrent_get_upload_limit
call dword [0x4a7368]
push 2
push 0x4454e0
push str.BT_torrent_set_upload_limit
call dword [0x4a7368]
add esp, 0x48
push 1
push 0x445630
push str.BT_torrent_get_download_limit
call dword [0x4a7368]
push 2
push 0x4455c0
push str.BT_torrent_set_download_limit
call dword [0x4a7368]
push 1
push 0x4456a0
push str.BT_torrent_is_sequential
call dword [0x4a7368]
push 2
push 0x445710
push str.BT_torrent_set_sequential
call dword [0x4a7368]
push 1
push 0x445790
push str.BT_torrent_get_files_count
call dword [0x4a7368]
push 1
push 0x445810
push str.BT_torrent_get_priorities
call dword [0x4a7368]
add esp, 0x48
push 2
push 0x445890
push str.BT_torrent_set_priorities
call dword [0x4a7368]
push ebx
push 0x450720
push 0x499b6c
call dword [0x4a7368]
push ebx
push 0x456df0
push str.GetDI8KeyboardStatus
call dword [0x4a7368]
push str.exe.zip.index.html
call fcn.0045a6f0
add esp, 0x28
cmp eax, ebx
je 0x4667a9
push eax
call fcn.004425d0
add esp, 4
push ebx
mov dword [0x4a7ad8], 0x30
mov dword [0x4a7adc], ebx
mov dword [0x4a7ae0], 0x460e90
mov dword [0x4a7ae4], ebx
mov dword [0x4a7ae8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IDR_MAINFRAM
push eax
mov dword [0x4a7aec], eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [str.my_wke_engine_v1]
push 0x4a7ad8
mov dword [0x4a7af0], eax
mov dword [0x4a7af4], ebx
mov dword [0x4a7af8], ebx
mov dword [0x4a7afc], ebx
mov dword [0x4a7b00], edx
call dword [sym.imp.USER32.dll_RegisterClassExW]
push ebx
mov dword [0x4a7b08], 0x30
mov dword [0x4a7b0c], ebx
mov dword [0x4a7b10], 0x456580
mov dword [0x4a7b14], ebx
mov dword [0x4a7b18], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x4a7b1c], eax
mov eax, dword [0x4a7aec]
push str.IDR_MAINFRAM
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [0x4a58f4]
push 0x4a7b08
mov dword [0x4a7b20], eax
mov dword [0x4a7b24], ebx
mov dword [0x4a7b28], ebx
mov dword [0x4a7b2c], ebx
mov dword [0x4a7b30], ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0x18
push str.FuKuanResult
call fcn.00440de0
push ebx
lea edx, [ebp - 0xc]
push edx
mov ecx, 0x4a7d10
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], fcn.00445c10
call fcn.00450530
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4a7d10
call fcn.0044d8a0
lea ecx, [ebp - 8]
push ecx
call fcn.0045f050
add esp, 4
cmp dword [ebp - 8], ebx
je 0x466716
mov ecx, dword [ebp - 8]
push ebx
push ebx
push SysReAllocString
push 0x499afc
call fcn.00457080
mov ecx, dword [ebp - 8]
push 0x499afc
call fcn.004429d0
xor eax, eax
mov dword [ebp - 0x2038], eax
mov dword [ebp - 0x2034], eax
mov dword [ebp - 0x2030], eax
mov dword [ebp - 0x202c], eax
mov dword [ebp - 0x2028], eax
mov dword [ebp - 0x2024], eax
mov dword [ebp - 0x2020], eax
cmp eax, 0x12
je 0x4667a9
push 1
push ebx
push ebx
push ebx
lea edx, [ebp - 0x2038]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x466779
lea eax, [ebp - 0x2038]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x2038]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x466790
cmp dword [0x4a7c98], ebx
jne 0x466788
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x4a7a11], 1
jne 0x4667a0
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [ebp - 0x2034], 0x12
jne 0x466747
mov ecx, dword [0x4a7c94]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4667e2
mov ebx, dword [eax + 0x10]
test ebx, ebx
je 0x4667cf
mov ecx, ebx
call fcn.0045ed50
push ebx
call fcn.00467c75
add esp, 4
lea ecx, [ebp - 8]
call fcn.00449640
mov eax, dword [ebp - 8]
cmp eax, dword [0x4a7c94]
jne 0x4667b8
mov eax, dword [0x4a7bf0]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4667fe
push eax
call ebx
mov dword [0x4a7bf0], 0
call dword [0x4a74c4]
call dword [0x4a7a1c]
test edi, edi
je 0x466815
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x466822
push esi
call fcn.00439940
add esp, 4
mov eax, dword [ebp - 0x2018]
test eax, eax
je 0x466835
push eax
call fcn.00468870
add esp, 4
mov eax, dword [0x4a7c74]
mov esi, dword [eax]
cmp esi, eax
je 0x46689a
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esi + 0x10]
push edx
call edi
cmp byte [esi + 0x15], 0
jne 0x466892
mov eax, dword [esi + 8]
cmp byte [eax + 0x15], 0
jne 0x466871
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
jne 0x466892
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
je 0x466865
jmp 0x466892
mov eax, dword [esi + 4]
cmp byte [eax + 0x15], 0
jne 0x466890
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x466890
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x466880
mov esi, eax
cmp esi, dword [0x4a7c74]
jne 0x466846
mov eax, dword [0x4a7cb4]
mov esi, dword [eax]
cmp esi, eax
je 0x46690a
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x4668b0
mov eax, dword [esi + 0x20]
push eax
call edi
mov ecx, dword [esi + 0x18]
push ecx
call ebx
cmp byte [esi + 0x31], 0
jne 0x466902
mov eax, dword [esi + 8]
cmp byte [eax + 0x31], 0
jne 0x4668e1
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x31], 0
jne 0x466902
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x31], 0
je 0x4668d5
jmp 0x466902
mov eax, dword [esi + 4]
cmp byte [eax + 0x31], 0
jne 0x466900
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x466900
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x31], 0
je 0x4668f0
mov esi, eax
cmp esi, dword [0x4a7cb4]
jne 0x4668b0
mov eax, dword [0x4a7c64]
mov esi, dword [eax]
cmp esi, eax
je 0x466991
mov edi, dword [esi + 0x10]
test edi, edi
je 0x466941
mov eax, dword [edi]
test eax, eax
je 0x46692b
push eax
call fcn.00468870
add esp, 4
push edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00467c75
add esp, 4
cmp byte [esi + 0x15], 0
mov dword [esi + 0x10], 0
jne 0x466988
mov eax, dword [esi + 8]
cmp byte [eax + 0x15], 0
jne 0x46696d
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
jne 0x466988
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
je 0x466961
jmp 0x466988
mov eax, dword [esi + 4]
cmp byte [eax + 0x15], 0
jne 0x466986
cmp esi, dword [eax + 8]
jne 0x466986
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x466976
mov esi, eax
mov eax, dword [0x4a7c64]
cmp esi, eax
jne 0x466915
mov esi, dword [eax]
cmp esi, eax
je 0x466a12
mov edi, dword [esi + 0x10]
test edi, edi
je 0x4669c3
mov eax, dword [edi]
test eax, eax
je 0x4669ad
push eax
call fcn.00468870
add esp, 4
push edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00467c75
add esp, 4
cmp byte [esi + 0x15], 0
mov dword [esi + 0x10], 0
jne 0x466a0a
mov eax, dword [esi + 8]
cmp byte [eax + 0x15], 0
jne 0x4669ef
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
jne 0x466a0a
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
je 0x4669e3
jmp 0x466a0a
mov eax, dword [esi + 4]
cmp byte [eax + 0x15], 0
jne 0x466a08
cmp esi, dword [eax + 8]
jne 0x466a08
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x4669f8
mov esi, eax
cmp esi, dword [0x4a7c64]
jne 0x466997
mov eax, dword [0x4a7c00]
test eax, eax
je 0x466a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4a7c00], 0
mov eax, dword [0x4a7bdc]
test eax, eax
je 0x466a46
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4a7bdc], 0
mov eax, dword [0x4a7b44]
test eax, eax
je 0x466a6e
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x20]
call eax
mov eax, dword [0x4a7b44]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x4a7b44], 0
mov eax, dword [0x4a7b40]
test eax, eax
je 0x466a89
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x4a7b40], 0
mov eax, dword [0x4a7aec]
mov ecx, dword [str.my_wke_engine_v1]
push eax
push ecx
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00468861
mov esp, ebp
pop ebp
ret 0x10