Function at 0x10005150
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1001e068
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov ebx, edx
mov esi, ecx
mov dword [esp + 0x24], 1
mov word [esp + 0x28], bp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
push str.hangame.com
push ebx
mov byte [esp + 0x48], 2
call fcn.10016760
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 8
test eax, eax
je 0x10005205
push ebp
call edi
or edx, 0xffffffff
mov ecx, str.tryif_LOGIN._currentSecureMode_null_window.cacheLOGIN._currentSecureMode_if_LOGIN._currentSecureMode_1_LOGIN.setSecureMode_1_true___j_login_steptxt_.text_window.cache__catch_e_
call fcn.100058d0
lea ecx, [esp + 0x28]
mov ebx, eax
mov eax, dword [esi]
push ecx
push str.javascript
push ebx
push esi
mov dword [esp + 0x20], ebx
call dword [eax + pe_nt_image_headers32]
push ebx
call edi
or edx, 0xffffffff
mov ecx, str.tryif_LOGIN_nullLOGIN.proxynull_LOGIN.proxyLOGIN.getCurrentIDField_LOGIN.getCurrentIDFieldfunction__document.cookieIEPROXYU:LOGIN.proxy__.valueLOGIN.getCurrentPWField__.value:_return_LOGIN.proxy___catch_e_
call fcn.100058d0
mov edx, dword [esi]
mov ebp, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], ebp
push eax
push str.javascript
push ebp
push esi
call dword [edx + pe_nt_image_headers32]
jmp 0x10005899
push str.df.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x100052ce
push str.www.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
jne 0x100052ce
push str.nxlogin.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
jne 0x100052ce
push eax
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_proxynulllogin_null_window.login_proxylogin_loginfunction__aos_copy_to_form_frm_login__collObjects__frm_login.getElementsByTagName__input___var_i_for__i0__i_collObjects.length__i__if__collObjects_i_.type__password_if_collObjects_i_.value.length_3_strPwdcollObjects_i_.value_document.cookieIEPROXYU:frm_login.id.value_login_sitestrPwd:_return_window.login_proxy___catch_e_
call fcn.100058d0
mov ebp, eax
push 0
mov dword [esp + 0x14], ebp
call edi
or edx, 0xffffffff
mov ecx, str.tryif_frm_logininstallKeyCrypt_installKeyCrypt.toString__.indexOf_proxy__1__window.keycrypt_proxyinstallKeyCrypt_installKeyCryptfunction_opts_opts.clean__false__return_window.keycrypt_proxy_opts__catch_e_
call fcn.100058d0
mov ebx, eax
push 0
mov dword [esp + 0x18], ebx
call edi
or edx, 0xffffffff
mov ecx, str.tryif_frm_loginotp_login_submit_otp_login_submit.toString__.indexOf_proxy__1__window.right_proxyotp_login_submit_otp_login_submitfunction__var_i_var_strOtpPwd_aos_copy_to_form_document.frm_login__collObjects__document.frm_login.getElementsByTagName__input___for__i0__i_collObjects.length__i__if__collObjects_i_.type__password_if_collObjects_i_.value.length8_strOtpPwdcollObjects_i_.value_if_strOtpPwd.length_8_aos_copy_to_form_document.forms_0___collObjects__document.forms_0_.getElementsByTagName__input___for__i0__i_collObjects.length__i__if__collObjects_i_.type__password_if_collObjects_i_.value.length8_strOtpPwdcollObjects_i_.value_document.cookieIEPROXYU:OTPstrOtpPwd:_return_window.right_proxy___catch_e_
call fcn.100058d0
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
push str.javascript
push ebp
push esi
mov dword [esp + 0x28], eax
call dword [ecx + pe_nt_image_headers32]
mov eax, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push str.javascript
push ebx
push esi
call dword [eax + pe_nt_image_headers32]
mov edx, dword [esi]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x18]
push eax
push str.javascript
push ecx
push esi
call dword [edx + pe_nt_image_headers32]
jmp 0x10005899
push str.nxlogin.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x10005322
push str.df.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x10005322
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_LfErrproxynullNgbLogin.Login_null_window.login_LfErrproxyNgbLogin.Login_NgbLogin.Loginfunction_id_pw_document.x_userid_document.x_passpw_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_LfErrproxy_id_pw__catch_e_
call fcn.100058d0
mov edx, dword [esi]
mov ebp, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], ebp
push eax
push str.javascript
push ebp
push esi
call dword [edx + pe_nt_image_headers32]
jmp 0x10005899
push str.www.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x10005364
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_proxynullNgbLogin.Login_null_window.login_proxyNgbLogin.Login2_NgbLogin.Login2function_id_pw_c_document.x_userid_document.x_passpw_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy_id_pw_c__catch_e_
call fcn.100058d0
mov ecx, dword [esi]
lea edx, [esp + 0x28]
mov ebp, eax
push edx
push str.javascript
push ebp
push esi
mov dword [esp + 0x20], ebp
call dword [ecx + pe_nt_image_headers32]
jmp 0x10005899
push str.netmarble.net
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x100053af
mov eax, dword [0x10042b2c]
test eax, eax
je 0x100053af
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_proxynullCryptography.RSAEncrypt_null_Cryptography.RSAEncrypt.toString__.indexOf_proxy__1__window.login_proxyCryptography.RSAEncrypt_Cryptography.RSAEncryptfunction_pw_document.x_userNETOTP_document.x_passpw_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy_pw__catch_e_
call fcn.100058d0
lea ecx, [esp + 0x28]
mov ebp, eax
mov eax, dword [esi]
push ecx
push str.javascript
push ebp
push esi
mov dword [esp + 0x20], ebp
call dword [eax + pe_nt_image_headers32]
jmp 0x10005899
push str.www.cultureland.co.kr
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x10005475
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_proxynullfrm_giftcard.submit_null_window.login_proxyfrm_giftcard.submit_frm_giftcard.submitfunction_id_document.x_userCULSNISOK_document.x_passCULSNISOK_document.cookieIEPROXYU:document.x_userdocument.x_pass:__catch_e_
call fcn.100058d0
mov ebp, eax
push 0
mov dword [esp + 0x14], ebp
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.keycrypt_proxynullfnChargeTmpCheck_null_window.keycrypt_proxyfnChargeTmpCheck_fnChargeTmpCheckfunction_c1_c2_c3_return__catch_e_
call fcn.100058d0
mov dword [esp + 0x14], eax
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.zzChk_proxynullfnZZChargeCheck_null_window.zzChk_proxyfnZZChargeCheck_fnZZChargeCheckfunction_c1_c2_return__catch_e_
call fcn.100058d0
mov edx, dword [esi]
mov ebx, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x18], ebx
push eax
push str.javascript
push ebp
push esi
call dword [edx + pe_nt_image_headers32]
mov ecx, dword [esi]
lea edx, [esp + 0x28]
mov eax, dword [esp + 0x14]
push edx
push str.javascript
push eax
push esi
call dword [ecx + pe_nt_image_headers32]
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
push str.javascript
push ebx
push esi
call dword [ecx + pe_nt_image_headers32]
push ebx
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.Fkclr_proxynullclear_box_null_window.Fkclr_proxyclear_box_clear_boxfunction_obj_id_var_SCR__document.getElementById_obj_id_.value_document.x_userobj_id_document.x_passSCR_document.cookieIEPROXYU:document.x_userdocument.x_pass:_var_obj__document.getElementById_obj_id__var_newObj__changeText_obj__password___r_nobj.parentNode.replaceChild_newObj_obj__document.getElementById_obj_id_.value__SCR35790757543454678345_document.getElementById_obj_id_.maxLength__24_document.getElementById_obj_id_.readonly___on__document.getElementById_obj_id_.style.width_120px___catch_e_
call fcn.100058d0
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
push str.javascript
push eax
push esi
mov dword [esp + 0x28], eax
call dword [ecx + pe_nt_image_headers32]
jmp 0x10005899
push str.kr.battle.net
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x100054b7
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_proxynullcheckEntry_null_window.login_proxycheckEntry_checkEntryfunction__document.x_userKBLSNISOK_document.x_passKBLSNISOK_document.cookieIEPROXYU:document.x_userdocument.x_pass:__catch_e_
call fcn.100058d0
lea ecx, [esp + 0x28]
mov ebp, eax
mov eax, dword [esi]
push ecx
push str.javascript
push ebp
push esi
mov dword [esp + 0x20], ebp
call dword [eax + pe_nt_image_headers32]
jmp 0x10005899
push str.www.booknlife.com_ticket_n_cash_n
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x10005524
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_proxynullfill_up_null_window.login_proxyfill_up_fill_upfunction__document.x_userBOKSNISOK_var_bookpass_if_document.frm.pinpwd.value____bookpassdocument.frm.pinno1.value_document.frm.pinno2.value_document.frm.pinno3.value_document.frm.pinno4.value_document.frm.pinpwd.value_document.x_pass__bookpass_document.cookieIEPROXYU:document.x_userdocument.x_pass:__catch_e_
call fcn.100058d0
mov ebp, eax
push 0
mov dword [esp + 0x14], ebp
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.keycrypt_proxynullLogSave_null_window.keycrypt_proxyLogSave_LogSavefunction__document.frm.pinpwd.readOnly__false_return_true__catch_e_
call fcn.100058d0
mov edx, dword [esi]
mov ebx, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x14], ebx
push eax
push str.javascript
push ebp
push esi
call dword [edx + pe_nt_image_headers32]
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
push str.javascript
push ebx
push esi
call dword [ecx + pe_nt_image_headers32]
jmp 0x10005899
push 0x1002b29c
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x1000558f
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.keycrypt_proxynullclearUserText_null_window.keycrypt_proxyclearUserText_clearUserTextfunction_id_if_idNexonExitIE_document.x_userNXSNTICK_document.x_passNXSNTICK_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_else_if_idNexonCHEAT_document.x_userNXSNCHEAT_document.x_passNXSNCHEAT_document.cookieIEPROXYU:document.x_userdocument.x_pass:_document.getElementById_ctl00_ContentPlaceHolder1_PayInfoControl_HPControl_btn_request_confirm_.style.displaynone_document.getElementById_ctl00_ContentPlaceHolder1_PayInfoControl_HPControl_ddl_corp_.disableddisabled_document.getElementById_ctl00_ContentPlaceHolder1_PayInfoControl_HPControl_ddl_phone1_.disableddisabled_document.getElementById_ctl00_ContentPlaceHolder1_PayInfoControl_HPControl_txt_phone3_.disableddisabled_document.getElementById_ctl00_ContentPlaceHolder1_PayInfoControl_HPControl_txt_phone2_.disableddisabled_document.getElementById_ctl00_ContentPlaceHolder1_PayInfoControl_HPControl_txt_ssn1_.disableddisabled_document.getElementById_ctl00_ContentPlaceHolder1_PayInfoControl_HPControl_txt_ssn2_.disableddisabled_elsereturn_window.login_proxy_id___catch_e_
call fcn.100058d0
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
push str.javascript
push eax
push esi
mov dword [esp + 0x24], eax
call dword [ecx + pe_nt_image_headers32]
push 0
call edi
or edx, 0xffffffff
mov ecx, str.tryif_window.login_proxynullshowLayer_null_window.login_proxyshowLayer_showLayerfunction_id_if_idloading_document.x_userNXSNISOK_document.x_passNXSNISOK_document.cookieIEPROXYU:document.x_userdocument.x_pass:_elsereturn_window.login_proxy_id___catch_e_
call fcn.100058d0
lea ecx, [esp + 0x28]
mov ebp, eax
mov eax, dword [esi]
push ecx
push str.javascript
push ebp
push esi
mov dword [esp + 0x20], ebp
call dword [eax + pe_nt_image_headers32]
jmp 0x10005899
push str.heroes.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x100055fc
push 0
call edi
push 0
push 0
push 0xffffffffffffffff
push str.tryif_window.login_proxynullNgbLogin.Login_null_window.login_proxyNgbLogin.Login_NgbLogin.Loginfunction_id_pw_document.x_userid_document.x_passpw_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy_id_pw__catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
dec ebx
push ebx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebp, eax
test ebp, ebp
je 0x100055df
push ebx
push ebp
push 0xffffffffffffffff
push str.tryif_window.login_proxynullNgbLogin.Login_null_window.login_proxyNgbLogin.Login_NgbLogin.Loginfunction_id_pw_document.x_userid_document.x_passpw_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy_id_pw__catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [esi]
lea eax, [esp + 0x28]
push eax
push str.javascript
push ebp
push esi
mov dword [esp + 0x20], ebp
call dword [edx + pe_nt_image_headers32]
jmp 0x10005899
push str.baram.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x1000576e
lea ecx, [esp + 0x20]
mov byte [0x10044350], 0
push ecx
push 0x2001f
push 0
push str.CLSIDHOK_OTP
push SysReAllocStringLen
mov byte [0x10044454], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100056a8
mov ecx, dword [esp + 0x20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push 0x10044350
push eax
push 0
mov ebp, 1
push str.name
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x34], ebp
call ebx
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push edx
push 0x10044454
push eax
push 0
push str.pass
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x34], ebp
call ebx
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call edi
push 0
push 0
push 0xffffffffffffffff
push str.tryif_window.login_proxynullDoLogin_null_window.login_proxyDoLogin_DoLoginfunction__document.x_userjQuery.trim_____txtID__.val_____document.x_passjQuery.trim_____txtPwd__.val_____if__typeof__NgbAOS____object__typeof__MKD25____object__document.x_pass__NgbAOS.GetText_____txtPwd____0_____document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy___catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
dec ebp
push ebp
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
test ebx, ebx
je 0x100056e6
push ebp
push ebx
push 0xffffffffffffffff
push str.tryif_window.login_proxynullDoLogin_null_window.login_proxyDoLogin_DoLoginfunction__document.x_userjQuery.trim_____txtID__.val_____document.x_passjQuery.trim_____txtPwd__.val_____if__typeof__NgbAOS____object__typeof__MKD25____object__document.x_pass__NgbAOS.GetText_____txtPwd____0_____document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy___catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push str.javascript
mov ebp, ebx
push ebx
push esi
mov dword [esp + 0x20], ebp
call dword [eax + pe_nt_image_headers32]
mov eax, dword [0x10042bc4]
test eax, eax
je 0x10005899
push 0
call edi
push 0
push 0
push 0xffffffffffffffff
push str.tryif_window.login_NgbproxynullNgbLogin.Login_null_window.login_NgbproxyNgbLogin.Login_NgbLogin.Loginfunction_id_pw_idbaeteahi_gmail.com_pwasdf7410_return_window.login_Ngbproxy_id_pw__catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
dec ebx
push ebx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
mov dword [esp + 0x20], eax
je 0x10005751
push ebx
push eax
push 0xffffffffffffffff
push str.tryif_window.login_NgbproxynullNgbLogin.Login_null_window.login_NgbproxyNgbLogin.Login_NgbLogin.Loginfunction_id_pw_idbaeteahi_gmail.com_pwasdf7410_return_window.login_Ngbproxy_id_pw__catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x20]
mov edx, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push str.javascript
push eax
push esi
mov dword [esp + 0x24], eax
call dword [edx + pe_nt_image_headers32]
jmp 0x10005899
push 0x1002c7d0
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x100057bd
push 0
call edi
push 0
push 0
push 0xffffffffffffffff
push str.tryif_window.login_proxynulllogin_null_window.login_proxylogin_loginfunction__document.x_userdocument.loginUser.sID.value_document.x_passdocument.loginUser.sPASSWORD.value_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy___catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
dec ebx
push ebx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebp, eax
test ebp, ebp
je 0x100055df
push ebx
push ebp
push 0xffffffffffffffff
push str.tryif_window.login_proxynulllogin_null_window.login_proxylogin_loginfunction__document.x_userdocument.loginUser.sID.value_document.x_passdocument.loginUser.sPASSWORD.value_document.cookieIEPROXYU:document.x_userdocument.x_pass:_return_window.login_proxy___catch_e_
jmp 0x100055d5
push str.elsword.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x10005827
push 0
call edi
push 0
push 0
push 0xffffffffffffffff
push str.tryif_window.login_proxynullDoLogin_null_DoLogin.toString__.indexOf_proxy__1__window.login_proxyDoLogin_DoLoginfunction__if__typeof__NgbAOS____object__typeof__MKD25____object__aos_copy_to_form_document.forms_0___var_strID__jQuery.trim_____txtID__.val_____var_strPas__jQuery.trim_____txtPwd__.val_____document.cookieIEPROXYU:strIDstrPas:_return_window.login_proxy___catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
dec ebx
push ebx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebp, eax
test ebp, ebp
je 0x1000580d
push ebx
push ebp
push 0xffffffffffffffff
push str.tryif_window.login_proxynullDoLogin_null_DoLogin.toString__.indexOf_proxy__1__window.login_proxyDoLogin_DoLoginfunction__if__typeof__NgbAOS____object__typeof__MKD25____object__aos_copy_to_form_document.forms_0___var_strID__jQuery.trim_____txtID__.val_____var_strPas__jQuery.trim_____txtPwd__.val_____document.cookieIEPROXYU:strIDstrPas:_return_window.login_proxy___catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push edx
push str.javascript
push ebp
push esi
mov dword [esp + 0x20], ebp
call dword [ecx + pe_nt_image_headers32]
jmp 0x10005899
push str.fifaonline3.nexon.com
push ebx
call fcn.10016760
add esp, 8
test eax, eax
je 0x10005891
push 0
call edi
push 0
push 0
push 0xffffffffffffffff
push str.tryif_window.login_proxynullDoLogin_null_DoLogin.toString__.indexOf_proxy__1__window.login_proxyDoLogin_DoLoginfunction__var_strID__jQuery.trim___inputID_.val____var_strPas__jQuery.trim___inputPW_.val____if__typeof__NgbAOS___object__typeof__MKD25___object__strPas__NgbAOS.GetText___inputPW__0___document.cookieIEPROXYU:strIDstrPas:_return_window.login_proxy___catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
dec ebx
push ebx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebp, eax
test ebp, ebp
je 0x10005877
push ebx
push ebp
push 0xffffffffffffffff
push str.tryif_window.login_proxynullDoLogin_null_DoLogin.toString__.indexOf_proxy__1__window.login_proxyDoLogin_DoLoginfunction__var_strID__jQuery.trim___inputID_.val____var_strPas__jQuery.trim___inputPW_.val____if__typeof__NgbAOS___object__typeof__MKD25___object__strPas__NgbAOS.GetText___inputPW__0___document.cookieIEPROXYU:strIDstrPas:_return_window.login_proxy___catch_e_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push str.javascript
push ebp
push esi
mov dword [esp + 0x20], ebp
call dword [eax + pe_nt_image_headers32]
jmp 0x10005899
mov dword [esp + 0x24], 0
mov edx, dword [esp + 0x18]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
push ebp
call edi
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret