Function at 0x472c60
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af260
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4dffd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x54], esi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], eax
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0x20], edi
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov byte [ebp - 4], 2
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0x48], ebx
cmp dword [esi + 0x30], 0
mov byte [ebp - 4], 3
je 0x472cfe
mov dword [ebp - 0x24], 1
jmp 0x473032
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
call fcn.004736d0
test eax, eax
je 0x473032
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00472220
mov eax, dword [eax]
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x472d4d
call fcn.00416c20
jmp 0x472d52
mov dword [ebp - 0x18], eax
xor eax, eax
cmp eax, esi
mov eax, dword [ebp - 0x28]
setge byte [ebp - 0x11]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x472d77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0x11], 0
je 0x473024
push str.var_hotDataInterface____r_n
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], esi
call fcn.00406d50
mov ecx, dword [ebp - 0x40]
cmp ecx, esi
jne 0x472d9d
mov dword [ebp - 0x2c], esi
jmp 0x472da8
mov eax, dword [ebp - 0x3c]
sub eax, ecx
sar eax, 3
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jle 0x472f78
push esi
lea ecx, [ebp - 0x44]
call fcn.004720f0
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x472f6c
push esi
lea ecx, [ebp - 0x44]
call fcn.004720f0
mov edx, dword [eax + 4]
add eax, 4
cmp dword [edx - 0xc], 0
je 0x472f6c
push esi
lea ecx, [ebp - 0x44]
call fcn.004720f0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404a50
lea ebx, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x5c], ebx
push esi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.004720f0
add eax, 4
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404a50
add eax, 0x10
add esp, 4
mov dword [ebp - 0x30], eax
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 6
call fcn.00406990
mov eax, dword [ebp - 0x50]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x58], esp
mov edi, esp
push eax
mov byte [ebp - 4], 7
call fcn.00404b10
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
add esp, 4
push eax
call fcn.004080d0
add esp, 8
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.00406cc0
mov edx, dword [ebp - 0x2c]
add edx, 0xffffffff
cmp esi, edx
mov byte [ebp - 4], 9
jne 0x472e90
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov edx, dword [0x500824]
push eax
push ebx
push ecx
push edx
push str.__url:__http:__www.baidu.com_s__sch4wd_s___imgUrl:_____text:___s___num:___s___r_n
lea eax, [ebp - 0x1c]
push eax
jmp 0x472ea8
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
mov eax, dword [0x500824]
push ecx
push ebx
push edx
push eax
push str.__url:__http:__www.baidu.com_s__sch4wd_s___imgUrl:_____text:___s___num:___s____r_n
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00405e90
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
add esp, 0x18
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.00425c00
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x472ee3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472f06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472f29
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472f4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472f6c
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
add esi, 1
cmp esi, dword [ebp - 0x2c]
jl 0x472db1
push 2
push 0x4bdba8
lea ecx, [ebp - 0x20]
call fcn.00425c00
call dword [0x4e0000]
mov edi, dword [ebp - 0x20]
test edi, edi
jne 0x472f9a
xor eax, eax
xor ecx, ecx
jmp 0x472fe2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x472fb1
xor eax, eax
xor ecx, ecx
jmp 0x472fe2
lea esi, [eax + eax]
mov eax, esi
call fcn.0048e990
mov eax, esp
push 0xfde9
push esi
push edi
push eax
call fcn.00421a90
test eax, eax
jne 0x472fd2
xor ecx, ecx
jmp 0x472fe2
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x472fd7
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00410830
mov ebx, dword [ebp - 0x48]
mov esi, dword [ebx - 0xc]
mov ecx, dword [ebp - 0x18]
push 0
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x473011
call fcn.00416c20
test eax, eax
jl 0x473024
cmp dword [ebp - 0x28], esi
jne 0x473024
mov edx, dword [ebp - 0x54]
mov eax, 1
mov dword [edx + 0x30], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x473032
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x473052
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x473075
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x473095
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x40]
test eax, eax
mov dword [ebp - 4], 0xffffffff
je 0x4730c1
mov ecx, dword [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp - 0x44]
push edx
push ecx
push eax
call fcn.0046e660
mov edx, dword [ebp - 0x40]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e5b2
mov esp, ebp
pop ebp
ret