Function at 0x409ec0
Capabilities:
Contain obfuscated stackstrings
Create directory
Persist via run registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eea66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc90
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebp - 0x50]
call fcn.00427790
mov esi, dword [ebx + 0x98]
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], edi
call fcn.00427790
push str.QvodPlayer
lea ecx, [ebp - 0x64]
mov word [ebp - 0x64], di
call fcn.00406940
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x64]
push eax
push ecx
push str.selectSingleNode
lea ecx, [esi + 4]
mov byte [ebp - 4], 2
call fcn.004080f0
lea edx, [ebp - 0x64]
mov dword [esi + 8], eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push edx
mov byte [ebp - 4], 1
call esi
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x38]
cmp ecx, edi
jl 0x409f65
cmp eax, edi
je 0x409f65
push eax
lea ecx, [ebp - 0x50]
call fcn.004080d0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], 1
cmp eax, edi
mov byte [ebp - 4], 0
je 0x409f73
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x3c], edi
je 0x40b1f8
lea ecx, [ebp - 0x10]
call fcn.00427790
cmp dword [ebp + 8], edi
jne 0x409ff8
mov edx, dword [ebx + 0x98]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x40], edx
call fcn.00427790
push str.General
lea ecx, [ebp - 0x24]
mov word [ebp - 0x24], di
call fcn.00406940
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x24]
push eax
push ecx
push str.createElement
lea ecx, [edx + 4]
mov byte [ebp - 4], 5
call fcn.004080f0
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x24]
push edx
mov byte [ebp - 4], 4
mov dword [ecx + 8], eax
call esi
mov eax, dword [ebp - 0x40]
cmp dword [eax + 8], edi
jl 0x409fef
mov eax, dword [ebp - 0x38]
cmp eax, edi
je 0x409fef
push eax
lea ecx, [ebp - 0x10]
call fcn.004080d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
jmp 0x40a053
lea ecx, [ebp - 0x40]
call fcn.00427790
push str.General
lea ecx, [ebp - 0x24]
mov word [ebp - 0x24], di
call fcn.00406940
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x24]
push ecx
push edx
push str.selectSingleNode
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 7
call fcn.004080f0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 6
call esi
cmp dword [ebp - 0x54], edi
jl 0x40a04c
mov eax, dword [ebp - 0x40]
cmp eax, edi
je 0x40a04c
push eax
lea ecx, [ebp - 0x10]
call fcn.004080d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.0042ca10
mov eax, dword [ebx + 0x28]
lea ecx, [ebp - 0x34]
push eax
mov word [ebp - 0x34], di
call fcn.00406940
push str.Insertpath
lea ecx, [ebp - 0x24]
mov word [ebp - 0x24], di
call fcn.00406940
lea ecx, [ebp - 0x34]
push edi
lea edx, [ebp - 0x24]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 9
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
call esi
lea ecx, [ebp - 0x34]
push ecx
call esi
mov eax, dword [ebx + 0x2c]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.Insertexe
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0x30]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.StartupMinimize
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xd
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 3
push eax
call esi
push str.Qvodcfg.ini
lea ecx, [ebp - 0x44]
push 0x525768
push ecx
call fcn.00402910
mov edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
push edx
mov byte [ebp - 4], 0xe
call fcn.00431670
mov eax, dword [ebx + 0x34]
mov byte [ebp - 4], 0xf
cmp eax, edi
je 0x40a16b
push 0x50e448
jmp 0x40a170
push 0x50d1e8
push str.AutoRun
push str.QVODTERMINAL
lea ecx, [ebp - 0x5c]
call fcn.00431750
mov eax, dword [ebx + 0x38]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Opensave
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x11
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x3c]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Connnum
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x13
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
push ecx
call esi
cmp dword [ebp + 8], edi
jne 0x40a241
mov edx, dword [ebx + 0x40]
cmp dword [edx - 8], edi
jne 0x40a241
mov eax, str.C:Media_
test eax, eax
je 0x40a233
push str.C:Media_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.C:Media_
push eax
lea ecx, [ebx + 0x40]
call fcn.004021f0
mov eax, dword [ebx + 0x40]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.Defaultsavepath
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x15
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
push ecx
call esi
cmp dword [ebp + 8], edi
jne 0x40a2a9
mov edx, dword [ebx + 0x28]
lea eax, [ebx + 0x44]
push edx
push str._sFavorite_
push eax
call fcn.004074f0
add esp, 0xc
mov eax, dword [ebx + 0x44]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.Defaultfavpath
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x17
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
push ecx
call esi
mov eax, dword [ebx + 0x44]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40a4c8
mov edx, dword [0x50d0e0]
mov dword [ebp - 0x38], edx
mov eax, dword [ebx + 0x44]
lea ecx, [ebp - 0x38]
push eax
push 0x50ddc8
push ecx
mov byte [ebp - 4], 0x18
call fcn.004074f0
mov eax, dword [ebp - 0x38]
add esp, 0xc
cmp eax, edi
mov dword [ebp - 0x3c], eax
jne 0x40a33a
xor eax, eax
jmp 0x40a363
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x4c], eax
add eax, 3
and al, 0xfc
call fcn.004ded50
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x3c]
mov eax, esp
push edi
push edx
push ecx
push eax
call fcn.00406870
push 0x50ddc4
push eax
call fcn.004deb38
add esp, 8
cmp eax, edi
mov dword [ebp - 0x48], eax
je 0x40a46a
mov edx, dword [0x50d0e0]
mov dword [ebp - 0x40], edx
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x28]
push eax
push ecx
lea edx, [ebp - 0x40]
push 0x50de74
push edx
mov byte [ebp - 4], 0x19
call fcn.004074f0
mov eax, dword [ebp - 0x40]
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0x3c], eax
jne 0x40a3b1
mov dword [ebp - 0x3c], edi
jmp 0x40a3dd
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x4c], eax
add eax, 3
and al, 0xfc
call fcn.004ded50
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x3c]
mov eax, esp
push edi
push ecx
push edx
push eax
call fcn.00406870
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str._.ShellClassInfo__r_nIconFile_s_r_nIconIndex26_r_nInfoTipQvod_Player
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + ecx + 0x104]
push edi
call fcn.004de48f
mov edx, eax
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x48]
push eax
push str._.ShellClassInfo__r_nIconFile_s_r_nIconIndex26_r_nInfoTipQvod_Player
push edi
call fcn.004deacb
push edi
call fcn.004dea4e
mov eax, dword [ebp - 0x40]
mov edx, dword [0x50d0e4]
add esp, 0x14
mov byte [ebp - 4], 0x18
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40a468
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40a468
mov edx, dword [ebp - 0x40]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
xor edi, edi
mov eax, dword [ebx + 0x44]
lea ecx, [ebp - 0x38]
push eax
push 0x50ddc8
push ecx
call fcn.004074f0
mov edx, dword [ebp - 0x38]
add esp, 0xc
push 2
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebx + 0x44]
push 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x38]
mov edx, dword [0x50d0e4]
mov byte [ebp - 4], 0xf
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40a4c8
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40a4c8
mov edx, dword [ebp - 0x38]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
cmp dword [ebp + 8], edi
jne 0x40a4e2
mov eax, dword [ebx + 0x28]
lea ecx, [ebx + 0x48]
push eax
push str._sSkin_
push ecx
call fcn.004074f0
add esp, 0xc
mov eax, dword [ebx + 0x48]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.Defaultskinpath
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1b
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0x58]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Opentorrentpath
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1d
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0xf
push eax
call esi
cmp dword [ebp + 8], edi
jne 0x40a590
mov ecx, dword [ebx + 0x28]
lea edx, [ebx + 0x4c]
push ecx
push str._sLang_
push edx
call fcn.004074f0
add esp, 0xc
mov eax, dword [ebx + 0x4c]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.Defaultlangpath
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1f
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x54]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Langid
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x21
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
push ecx
call esi
lea ecx, [ebp - 0xc9c]
call fcn.004c4430
mov eax, dword [ebx + 0x19c]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Clickpause
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x24
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0x60]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Connlimit
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x26
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x1b8]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Exitlimit
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x28
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
push ecx
call esi
mov eax, dword [ebx + 0x1bc]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Mediashowother
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x2a
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0x64]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x34], di
push str.Viewframe
lea ecx, [ebp - 0x34]
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x2c
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x68]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Soundtrack
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x2e
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
push ecx
call esi
mov eax, dword [ebx + 0x6c]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Bosskey
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x30
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0x70]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Bossvalue
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
mov byte [ebp - 4], 0x32
push edi
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x74]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Bossctrl
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x34
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
push ecx
call esi
mov eax, dword [ebx + 0x78]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Closeandexit
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x36
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0x7c]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Menutip
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x38
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x80]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Mute
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x3a
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
push ecx
call esi
mov eax, dword [ebx + 0x88]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Volume
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x3c
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0xe0]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Mediaindex
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x3e
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x1a0]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.SendMsn
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x40
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
push ecx
call esi
mov eax, dword [ebx + 0x528]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.exitclearlist
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x42
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0x22
push edx
call esi
cmp dword [ebp + 8], edi
jne 0x40aac8
mov eax, dword [ebx + 0x28]
lea ecx, [ebx + 0x8c]
push eax
push str._sPicture_
push ecx
call fcn.004074f0
add esp, 0xc
mov eax, dword [ebx + 0x8c]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.Snapshotpath
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x44
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0x22
push edx
call esi
cmp dword [ebp + 8], edi
jne 0x40ab33
mov eax, dword [ebx + 0x28]
lea ecx, [ebx + 0x50]
push eax
push str._sResmenuselect.bmp
push ecx
call fcn.004074f0
add esp, 0xc
mov eax, dword [ebx + 0x50]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.Menulistimage
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x46
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0x22
push edx
call esi
cmp dword [ebp + 8], edi
jne 0x40abf0
mov ecx, dword [ebx + 0x28]
lea eax, [ebx + 0x184]
push ecx
push str._sSkinlogo.bmp
push eax
call fcn.004074f0
mov edx, dword [ebx + 0x18c]
mov eax, dword [ebx + 0x184]
lea ecx, [ebx + 0x18c]
add esp, 0xc
cmp edx, eax
je 0x40abf0
cmp dword [edx - 0xc], edi
jge 0x40abc4
add edx, 0xfffffff4
cmp edx, dword [0x50d0e4]
jne 0x40abc9
cmp dword [eax - 0xc], edi
jge 0x40abd5
mov edx, dword [eax - 8]
push eax
push edx
call fcn.004021f0
jmp 0x40abf0
call fcn.00402350
mov eax, dword [ebx + 0x184]
mov dword [ebx + 0x18c], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebx + 0x184]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.BgDefault
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x48
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x18c]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.BgSetfiles
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x4a
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
push ecx
call esi
mov eax, dword [ebx + 0x188]
lea ecx, [ebp - 0x24]
push eax
mov word [ebp - 0x24], di
call fcn.00406940
push str.BgUserselect
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x4c
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebx + 0x180]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.Keshisuji
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea eax, [ebp - 0x24]
push edi
lea ecx, [ebp - 0x34]
push eax
push ecx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x4e
call fcn.00406a10
lea edx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push edx
call esi
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [ebx + 0x198]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.ImagePlaytimes
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea ecx, [ebp - 0x24]
push edi
lea edx, [ebp - 0x34]
push ecx
push edx
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x50
call fcn.00406a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call esi
lea ecx, [ebp - 0x24]
push ecx
call esi
mov eax, dword [ebx + 0x190]
mov word [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
push str.VideoAdjust
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], di
call fcn.00406940
lea edx, [ebp - 0x24]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
push str.setAttribute
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x52
call fcn.00406a10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
call esi
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0x22
push edx
call esi
cmp dword [ebp + 8], edi
jne 0x40aebb
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x54]
push eax
call fcn.00409c30
mov ecx, dword [ebx + 0x118]
lea esi, [ebx + 0x118]
cmp dword [ecx - 8], edi
jne 0x40ae01
mov edx, 0x50da1c
test edx, edx
jne 0x40ade9
xor eax, eax
jmp 0x40adf4
push 0x50da1c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x50da1c
push eax
mov ecx, esi
call fcn.004021f0
mov eax, dword [ebx + 0x11c]
lea esi, [ebx + 0x11c]
cmp dword [eax - 8], edi
jne 0x40aebb
push 0x5209fc
push SysReAllocStringLen
lea ecx, [ebp - 0x888]
call fcn.004c4470
mov ecx, 0x104
xor eax, eax
lea edi, [ebp - 0x474]
push 0x208
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 0x53
push ecx
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea ecx, [ebp - 0x888]
call fcn.004c44c0
lea edx, [ebp - 0x474]
mov ecx, esi
push edx
call fcn.00406e00
lea eax, [ebp - 0x474]
push eax
call fcn.004debba
add esp, 4
cmp word [ebp + eax*2 - 0x474], 0x5c
je 0x40aeaa
push 0x50e0a8
lea ecx, [ebp - 0x48]
push esi
push ecx
call fcn.00402910
push eax
mov ecx, esi
mov byte [ebp - 4], 0x54
call fcn.00402090
lea ecx, [ebp - 0x48]
call fcn.00402160
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0x22
call fcn.004c44b0
xor edi, edi
mov edx, dword [ebx + 0x10c]
lea ecx, [ebp - 0x14]
push edx
push str.imagerows
call fcn.00408550
mov eax, dword [ebx + 0x110]
lea ecx, [ebp - 0x14]
push eax
push str.imagecols
call fcn.00408550
mov ecx, dword [ebx + 0x114]
push ecx
push str.imagewidth
lea ecx, [ebp - 0x14]
call fcn.00408550
mov eax, dword [ebx + 0x118]
lea ecx, [ebp - 0x14]
push eax
push str.imagepoint
call fcn.00408380
mov eax, dword [ebx + 0x11c]
lea ecx, [ebp - 0x14]
push eax
push str.imagepath
call fcn.00408380
mov edx, dword [ebx + 0x1c0]
lea ecx, [ebp - 0x14]
push edx
push str.bsavepro
call fcn.00408550
mov eax, dword [ebx + 0x1c4]
lea ecx, [ebp - 0x14]
push eax
push str.strsavepro
call fcn.00408380
mov eax, dword [ebx + 0x1c8]
lea ecx, [ebp - 0x14]
push eax
push str.nsavepro
call fcn.00408550
mov ecx, dword [ebx + 0x534]
push ecx
push str.bEveryday
lea ecx, [ebp - 0x14]
call fcn.00408550
mov eax, dword [ebx + 0x640]
cmp dword [eax - 8], edi
je 0x40af88
push eax
push str.AboutTitle
lea ecx, [ebp - 0x14]
call fcn.00408380
lea edx, [ebx + 0x538]
lea ecx, [ebp - 0x3c]
push edx
call fcn.0040b220
mov eax, dword [ebx + 0x63c]
mov byte [ebp - 4], 0x55
cmp eax, edi
je 0x40afbe
cmp dword [ebx + 0x6cc], edi
jne 0x40afbe
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x14]
push eax
push str.Terminalip
call fcn.00408380
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x22
call fcn.00402160
mov eax, dword [ebx + 0x644]
lea ecx, [ebp - 0x14]
push eax
push str.AudioOut
call fcn.00408380
mov ecx, dword [ebx + 0x650]
push ecx
push str.PingBao
lea ecx, [ebp - 0x14]
call fcn.00408550
mov edx, dword [ebx + 0x654]
lea ecx, [ebp - 0x14]
push edx
push str.ClickClose
call fcn.00408550
mov eax, dword [ebx + 0x658]
lea ecx, [ebp - 0x14]
push eax
push str.PlayTiao
call fcn.00408550
mov ecx, dword [ebx + 0x65c]
push ecx
push str.GaoQing
lea ecx, [ebp - 0x14]
call fcn.00408550
mov edx, dword [ebx + 0x660]
lea ecx, [ebp - 0x14]
push edx
push str.ConnBTFile
call fcn.00408550
mov eax, dword [ebx + 0x664]
lea ecx, [ebp - 0x14]
push eax
push str.SubAddpath
call fcn.00408380
mov eax, dword [ebx + 0x668]
lea ecx, [ebp - 0x14]
push eax
push str.Savevideof
call fcn.00408550
mov ecx, dword [ebx + 0x668]
push ecx
push str.Savevideofenbian
lea ecx, [ebp - 0x14]
call fcn.00408550
mov eax, dword [ebx + 0x670]
lea ecx, [ebp - 0x14]
push eax
push str.Savevideopath
call fcn.00408380
mov eax, dword [ebx + 0x680]
lea ecx, [ebp - 0x14]
push eax
push str.adupdatetime
call fcn.00408380
mov edx, dword [ebx + 0x684]
lea ecx, [ebp - 0x14]
push edx
push str.pauseadshow
call fcn.00408550
cmp dword [ebx + 0x63c], edi
je 0x40b0d6
mov eax, dword [ebx + 0x678]
lea ecx, [ebp - 0x14]
push eax
push str.webadder
call fcn.00408380
mov eax, dword [ebx + 0x688]
lea ecx, [ebp - 0x14]
push eax
push str.autovideosize
call fcn.00408550
mov ecx, dword [ebx + 0x68c]
push ecx
push str.autodeletefile
lea ecx, [ebp - 0x14]
call fcn.00408550
mov eax, dword [ebx + 0x690]
lea esi, [ebx + 0x690]
cmp eax, edi
jg 0x40b117
push esi
call fcn.004de872
add esp, 4
mov edx, dword [esi]
lea ecx, [ebp - 0x14]
push edx
push str.autodeletetime
call fcn.00409d50
mov eax, dword [ebx + 0x6a0]
lea ecx, [ebp - 0x14]
push eax
push str.Nextdownplay
call fcn.00408550
mov ecx, dword [ebx + 0x6a4]
push ecx
push str.Xuanran
lea ecx, [ebp - 0x14]
call fcn.00408550
mov edx, dword [ebx + 0x6b0]
lea ecx, [ebp - 0x14]
push edx
push str.protocol
call fcn.00408550
mov eax, dword [ebx + 0x6b4]
lea ecx, [ebp - 0x14]
push eax
push str.exitall
call fcn.00408550
mov ecx, dword [ebx + 0x6c0]
push ecx
push str.stopad
lea ecx, [ebp - 0x14]
call fcn.00408550
cmp dword [ebp + 8], edi
je 0x40b1b6
cmp dword [ebx + 0x6c4], edi
je 0x40b19f
push 0x50e448
jmp 0x40b1a4
push 0x50d1e8
push str.Home
push str.Other
lea ecx, [ebp - 0x5c]
call fcn.00431750
mov ecx, dword [ebx + 0x98]
push edi
call fcn.00402ba0
lea ecx, [ebp - 0xc9c]
mov byte [ebp - 4], 0xf
call fcn.004c44b0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x5c], 0x4fb734
call fcn.0040b370
lea ecx, [ebp - 0x44]
call fcn.00402160
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.0042ca10
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.0042ca10
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0xca8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4