Function at 0x4ee340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x579aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x798
mov eax, dword [0x5e5e08]
xor eax, ebp
mov dword [ebp - 0x58], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x568], ecx
mov dword [ebp - 0x564], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004ea5e0
add esp, 4
mov ecx, dword [ebp - 0x568]
mov dword [ecx + 0x11c], eax
mov dword [ebp - 0x28], 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.004eaa60
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
jmp 0x4ee3c3
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x24]
call fcn.0044ba50
cmp dword [ebp - 0x2c], eax
jae 0x4efaf7
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x24]
call fcn.0044ba70
push eax
lea ecx, [ebp - 0x50]
call fcn.0044fe40
mov byte [ebp - 4], 1
push 0x59be28
lea ecx, [ebp - 0x154]
call fcn.00401770
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x564]
or eax, 1
mov dword [ebp - 0x564], eax
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x50]
call fcn.00438850
push eax
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x50]
call fcn.00438880
mov ecx, eax
call fcn.00438920
movzx ecx, al
test ecx, ecx
jne 0x4ee4aa
push 0x59be30
lea ecx, [ebp - 0x180]
call fcn.00401770
mov dword [ebp - 4], 3
mov edx, dword [ebp - 0x564]
or edx, 2
mov dword [ebp - 0x564], edx
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x50]
call fcn.00438850
push eax
lea ecx, [ebp - 0x180]
push ecx
lea edx, [ebp - 0x188]
push edx
lea ecx, [ebp - 0x50]
call fcn.00438880
mov ecx, eax
call fcn.00438920
movzx eax, al
test eax, eax
jne 0x4ee4aa
mov dword [ebp - 0x56c], 0
jmp 0x4ee4b4
mov dword [ebp - 0x56c], 1
mov cl, byte [ebp - 0x56c]
mov byte [ebp - 0x135], cl
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x564]
and edx, 2
je 0x4ee4e4
and dword [ebp - 0x564], 0xfffffffd
lea ecx, [ebp - 0x180]
call fcn.004017f0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x564]
and eax, 1
je 0x4ee508
and dword [ebp - 0x564], 0xfffffffe
lea ecx, [ebp - 0x154]
call fcn.004017f0
movzx ecx, byte [ebp - 0x135]
test ecx, ecx
je 0x4ee524
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.0044f210
jmp 0x4ee3ba
push 0x254
call fcn.004bd2b3
add esp, 4
mov dword [ebp - 0x198], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x198], 0
je 0x4ee557
mov ecx, dword [ebp - 0x198]
call fcn.004f18e0
mov dword [ebp - 0x570], eax
jmp 0x4ee561
mov dword [ebp - 0x570], 0
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0x194], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x11c], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x19c], esp
push 0x59be40
call fcn.00401770
mov dword [ebp - 0x574], eax
mov edx, dword [ebp - 0x574]
mov dword [ebp - 0x578], edx
mov byte [ebp - 4], 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1a0], esp
push str.display
call fcn.00401770
mov dword [ebp - 0x57c], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x580], eax
mov edx, dword [ebp - 0x580]
mov dword [ebp - 0x584], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x584]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0xc4
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c0], esp
push 0x59be54
call fcn.00401770
mov dword [ebp - 0x588], eax
mov ecx, dword [ebp - 0x588]
mov dword [ebp - 0x58c], ecx
mov byte [ebp - 4], 7
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c4], esp
push str.filename
call fcn.00401770
mov dword [ebp - 0x590], eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x1e0]
push eax
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x594], eax
mov ecx, dword [ebp - 0x594]
mov dword [ebp - 0x598], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x598]
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x8c
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1e0]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1e4], esp
push 0x59be6c
call fcn.00401770
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x5a0], eax
mov byte [ebp - 4], 9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1e8], esp
push 0x59be70
call fcn.00401770
mov dword [ebp - 0x5a4], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x204]
push edx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x5ac], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x5ac]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x144
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x204]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x208], esp
push 0x59be78
call fcn.00401770
mov dword [ebp - 0x5b0], eax
mov edx, dword [ebp - 0x5b0]
mov dword [ebp - 0x5b4], edx
mov byte [ebp - 4], 0xb
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20c], esp
push str.reg2
call fcn.00401770
mov dword [ebp - 0x5b8], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x228]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x5bc], eax
mov edx, dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x5c0]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x160
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x22c], esp
push 0x59be88
call fcn.00401770
mov dword [ebp - 0x5c4], eax
mov ecx, dword [ebp - 0x5c4]
mov dword [ebp - 0x5c8], ecx
mov byte [ebp - 4], 0xd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x230], esp
push str.blockedprocesslist
call fcn.00401770
mov dword [ebp - 0x5cc], eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x24c]
push eax
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x5d0], eax
mov ecx, dword [ebp - 0x5d0]
mov dword [ebp - 0x5d4], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x5d4]
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x17c
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x250], esp
push 0x59beb4
call fcn.00401770
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x5dc], eax
mov byte [ebp - 4], 0xf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x254], esp
push str.injectblockedprocesslist
call fcn.00401770
mov dword [ebp - 0x5e0], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x270]
push edx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x5e8], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x5e8]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x198
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x270]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x274], esp
push 0x59beec
call fcn.00401770
mov dword [ebp - 0x5ec], eax
mov edx, dword [ebp - 0x5ec]
mov dword [ebp - 0x5f0], edx
mov byte [ebp - 4], 0x11
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x278], esp
push str.showprocesslist
call fcn.00401770
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x294]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x5f8], eax
mov edx, dword [ebp - 0x5f8]
mov dword [ebp - 0x5fc], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x5fc]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x1b4
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x294]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x298], esp
push 0x59bf10
call fcn.00401770
mov dword [ebp - 0x600], eax
mov ecx, dword [ebp - 0x600]
mov dword [ebp - 0x604], ecx
mov byte [ebp - 4], 0x13
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x29c], esp
push str.desktopfile
call fcn.00401770
mov dword [ebp - 0x608], eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b8]
push eax
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x60c], eax
mov ecx, dword [ebp - 0x60c]
mov dword [ebp - 0x610], ecx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x610]
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x1d0
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2b8]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2bc], esp
push 0x59bf2c
call fcn.00401770
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x618], eax
mov byte [ebp - 4], 0x15
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c0], esp
push str.appdatafile
call fcn.00401770
mov dword [ebp - 0x61c], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x2dc]
push edx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x624], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x624]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x1ec
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2dc]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2e0], esp
push 0x59bf48
call fcn.00401770
mov dword [ebp - 0x628], eax
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x62c], edx
mov byte [ebp - 4], 0x17
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2e4], esp
push str.localappdatafile
call fcn.00401770
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x300]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x634], eax
mov edx, dword [ebp - 0x634]
mov dword [ebp - 0x638], edx
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x638]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x208
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x300]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x304], esp
push 0x59bf70
call fcn.00401770
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x640], ecx
mov byte [ebp - 4], 0x19
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x308], esp
push str.desktopnofilelist
call fcn.00401770
mov dword [ebp - 0x644], eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x324]
push eax
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x648], eax
mov ecx, dword [ebp - 0x648]
mov dword [ebp - 0x64c], ecx
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x64c]
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x230
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x324]
call fcn.004017f0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x328], esp
push str.installinterval
call fcn.00401770
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x50]
push eax
call fcn.004efc40
add esp, 0x24
mov dword [ebp - 0x654], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x654]
mov dword [ecx + 0x24c], edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x32c], esp
push 0x59bfb8
call fcn.00401770
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x65c], eax
mov byte [ebp - 4], 0x1b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x330], esp
push str.command
call fcn.00401770
mov dword [ebp - 0x660], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x34c]
push edx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x668]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x120
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x350], esp
push 0x59bfcc
call fcn.00401770
mov dword [ebp - 0x66c], eax
mov edx, dword [ebp - 0x66c]
mov dword [ebp - 0x670], edx
mov byte [ebp - 4], 0x1d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x354], esp
push 0x59bfd0
call fcn.00401770
mov dword [ebp - 0x674], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x370]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x678], eax
mov edx, dword [ebp - 0x678]
mov dword [ebp - 0x67c], edx
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x67c]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x370]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x374], esp
push 0x59bfd8
call fcn.00401770
mov dword [ebp - 0x680], eax
mov ecx, dword [ebp - 0x680]
mov dword [ebp - 0x684], ecx
mov byte [ebp - 4], 0x1f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x378], esp
push str.url2
call fcn.00401770
mov dword [ebp - 0x688], eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x394]
push eax
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x68c], eax
mov ecx, dword [ebp - 0x68c]
mov dword [ebp - 0x690], ecx
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x690]
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x1c
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x394]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x398], esp
push 0x59bfe8
call fcn.00401770
mov dword [ebp - 0x694], eax
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x698], eax
mov byte [ebp - 4], 0x21
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x39c], esp
push 0x59bfec
call fcn.00401770
mov dword [ebp - 0x69c], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x3b8]
push edx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x6a4], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x6a4]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x38
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3b8]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push 0x59bff4
call fcn.00401770
mov dword [ebp - 0x6a8], eax
mov edx, dword [ebp - 0x6a8]
mov dword [ebp - 0x6ac], edx
mov byte [ebp - 4], 0x23
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c0], esp
push str.rand
call fcn.00401770
mov dword [ebp - 0x6b0], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x3dc]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x6b4], eax
mov edx, dword [ebp - 0x6b4]
mov dword [ebp - 0x6b8], edx
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x6b8]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x54
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3dc]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3e0], esp
push 0x59c004
call fcn.00401770
mov dword [ebp - 0x6bc], eax
mov ecx, dword [ebp - 0x6bc]
mov dword [ebp - 0x6c0], ecx
mov byte [ebp - 4], 0x25
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3e4], esp
push str.randignore
call fcn.00401770
mov dword [ebp - 0x6c4], eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x400]
push eax
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x6c8], eax
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], ecx
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x6cc]
push edx
mov ecx, dword [ebp - 0x30]
add ecx, 0x70
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x400]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0x59c020
call fcn.00401770
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x6d4], eax
mov byte [ebp - 4], 0x27
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x408], esp
push str.name
call fcn.00401770
mov dword [ebp - 0x6d8], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x424]
push edx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x6e0], eax
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x6e0]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xe0
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x424]
call fcn.004017f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x428], esp
push 0x59c030
call fcn.00401770
mov dword [ebp - 0x6e4], eax
mov edx, dword [ebp - 0x6e4]
mov dword [ebp - 0x6e8], edx
mov byte [ebp - 4], 0x29
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x42c], esp
push str.privateparam
call fcn.00401770
mov dword [ebp - 0x6ec], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x448]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x6f0], eax
mov edx, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f4], edx
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x6f4]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0xfc
call fcn.00401810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x448]
call fcn.004017f0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44c], esp
push 0x59c050
call fcn.00401770
mov dword [ebp - 0x6f8], eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.004efc40
add esp, 0x24
mov dword [ebp - 0x6fc], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6fc]
mov dword [edx + 0x118], eax
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x450], esp
push str.selected
call fcn.00401770
mov dword [ebp - 0x700], eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.004efc40
add esp, 0x24
mov dword [ebp - 0x704], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x704]
mov dword [edx + 0x224], eax
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp edx, dword [ecx + 0x224]
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x13c], eax
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x454], esp
push str.type
call fcn.00401770
mov dword [ebp - 0x708], eax
lea edx, [ebp - 0x50]
push edx
call fcn.004efc40
add esp, 0x24
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x70c]
mov dword [eax + 0x140], ecx
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x458], esp
push str.show
call fcn.00401770
mov dword [ebp - 0x710], eax
lea edx, [ebp - 0x50]
push edx
call fcn.004efc40
add esp, 0x24
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x714]
mov dword [eax + 0x228], ecx
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x45c], esp
push str.recommend
call fcn.00401770
mov dword [ebp - 0x718], eax
lea edx, [ebp - 0x50]
push edx
call fcn.004efc40
add esp, 0x24
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
setne al
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x250], al
mov edx, dword [ebp - 0x568]
mov eax, dword [ebp - 0x28]
cmp eax, dword [edx + 0x11c]
jb 0x4ef250
jmp 0x4efad1
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004ebae0
add esp, 4
test eax, eax
je 0x4ef265
jmp 0x4efad1
mov edx, dword [ebp - 0x30]
push edx
call fcn.004ec200
add esp, 4
test eax, eax
je 0x4ef28a
mov eax, dword [ebp - 0x30]
push eax
call fcn.004ec460
add esp, 4
test eax, eax
je 0x4ef28a
jmp 0x4efad1
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004ec6c0
add esp, 4
test eax, eax
je 0x4ef29f
jmp 0x4efad1
mov edx, dword [ebp - 0x30]
push edx
call fcn.004ec6d0
add esp, 4
test eax, eax
jne 0x4ef2b4
jmp 0x4efad1
lea eax, [ebp - 0x50]
push eax
call fcn.004ec970
add esp, 4
test eax, eax
jne 0x4ef2c9
jmp 0x4efad1
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x22c], 1
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x460], esp
push str.maxshowcount
call fcn.00401770
mov dword [ebp - 0x720], eax
lea edx, [ebp - 0x50]
push edx
call fcn.004efc40
add esp, 0x24
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jle 0x4ef4d4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x464], esp
push 0x59c0b4
call fcn.00401770
mov dword [ebp - 0x728], eax
mov ecx, dword [ebp - 0x728]
mov dword [ebp - 0x72c], ecx
mov byte [ebp - 4], 0x2b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x468], esp
push str.showcounturl
call fcn.00401770
mov dword [ebp - 0x730], eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x484]
push eax
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x734], eax
mov ecx, dword [ebp - 0x734]
mov dword [ebp - 0x738], ecx
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x738]
call fcn.00401830
push eax
lea edx, [ebp - 0xac]
push edx
call fcn.00569590
add esp, 8
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x484]
call fcn.004017f0
lea ecx, [ebp - 0xc8]
call fcn.004048c0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xac]
call fcn.00401610
cmp eax, 0xa
jae 0x4ef46a
mov ecx, dword [ebp - 0x30]
add ecx, 0xe0
call fcn.00401830
push eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00569590
add esp, 8
mov dword [ebp - 0x73c], eax
mov ecx, dword [ebp - 0x73c]
mov dword [ebp - 0x740], ecx
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x740]
push edx
push str.http:__api.kpzip.com_showcountnew.php_paramshowname
lea eax, [ebp - 0x4bc]
push eax
call fcn.00403d60
add esp, 0xc
mov dword [ebp - 0x744], eax
mov ecx, dword [ebp - 0x744]
mov dword [ebp - 0x748], ecx
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x748]
push edx
lea ecx, [ebp - 0xac]
call fcn.00401470
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x4bc]
call fcn.00404950
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x4a0]
call fcn.00404950
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xac]
push ecx
call fcn.00560c50
add esp, 8
movzx edx, al
test edx, edx
je 0x4ef4ac
lea ecx, [ebp - 0xc8]
call fcn.004048a0
push eax
call fcn.004b71da
add esp, 4
cmp dword [ebp - 0x54], eax
jg 0x4ef4aa
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x22c], 0
jmp 0x4ef4b6
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x22c], 0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xc8]
call fcn.00404950
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.00404950
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c0], esp
push 0x59c10c
call fcn.00401770
mov dword [ebp - 0x74c], eax
mov edx, dword [ebp - 0x74c]
mov dword [ebp - 0x750], edx
mov byte [ebp - 4], 0x32
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c4], esp
push str.showcitys
call fcn.00401770
mov dword [ebp - 0x754], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x74]
push ecx
mov byte [ebp - 4], 1
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x758], eax
mov byte [ebp - 4], 0x33
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c8], esp
push 0x59c124
call fcn.00401770
mov dword [ebp - 0x75c], eax
mov edx, dword [ebp - 0x75c]
mov dword [ebp - 0x760], edx
mov byte [ebp - 4], 0x34
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4cc], esp
push str.noshowcitys
call fcn.00401770
mov dword [ebp - 0x764], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x90]
push ecx
mov byte [ebp - 4], 0x33
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x768], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x74]
call fcn.0043d4c0
movzx edx, al
test edx, edx
jne 0x4ef612
push 0x5eda18
lea eax, [ebp - 0x4ec]
push eax
call fcn.00568c20
add esp, 8
mov dword [ebp - 0x76c], eax
mov ecx, dword [ebp - 0x76c]
mov dword [ebp - 0x770], ecx
mov byte [ebp - 4], 0x36
mov edx, dword [ebp - 0x564]
or edx, 4
mov dword [ebp - 0x564], edx
mov ecx, dword [ebp - 0x770]
call fcn.00401830
push eax
lea ecx, [ebp - 0x74]
call fcn.00401830
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4ef612
mov dword [ebp - 0x774], 1
jmp 0x4ef61c
mov dword [ebp - 0x774], 0
mov al, byte [ebp - 0x774]
mov byte [ebp - 0x4cd], al
mov dword [ebp - 4], 0x35
mov ecx, dword [ebp - 0x564]
and ecx, 4
je 0x4ef64c
and dword [ebp - 0x564], 0xfffffffb
lea ecx, [ebp - 0x4ec]
call fcn.004017f0
movzx edx, byte [ebp - 0x4cd]
test edx, edx
je 0x4ef666
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x22c], 0
jmp 0x4ef72e
lea ecx, [ebp - 0x90]
call fcn.0043d4c0
movzx ecx, al
test ecx, ecx
jne 0x4ef6df
push 0x5eda18
lea edx, [ebp - 0x50c]
push edx
call fcn.00568c20
add esp, 8
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x77c], eax
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp - 0x564]
or ecx, 8
mov dword [ebp - 0x564], ecx
mov ecx, dword [ebp - 0x77c]
call fcn.00401830
push eax
lea ecx, [ebp - 0x90]
call fcn.00401830
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4ef6df
mov dword [ebp - 0x780], 1
jmp 0x4ef6e9
mov dword [ebp - 0x780], 0
mov dl, byte [ebp - 0x780]
mov byte [ebp - 0x4ed], dl
mov dword [ebp - 4], 0x35
mov eax, dword [ebp - 0x564]
and eax, 8
je 0x4ef719
and dword [ebp - 0x564], 0xfffffff7
lea ecx, [ebp - 0x50c]
call fcn.004017f0
movzx ecx, byte [ebp - 0x4ed]
test ecx, ecx
je 0x4ef72e
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x22c], 0
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax + 0x22c]
test ecx, ecx
je 0x4ef9e9
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x250]
test eax, eax
je 0x4ef9e9
mov byte [ebp - 0xe9], 0
lea ecx, [ebp - 0xe4]
call fcn.00429310
mov byte [ebp - 4], 0x38
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x510], esp
push 0x59c140
call fcn.00401770
mov dword [ebp - 0x784], eax
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x788], ecx
mov byte [ebp - 4], 0x39
lea edx, [ebp - 0xe4]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x514], esp
push 0x59c144
call fcn.00401770
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x790], eax
mov byte [ebp - 4], 0x3a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x518], esp
push str.reglist
call fcn.00401770
mov dword [ebp - 0x794], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x534]
push edx
mov byte [ebp - 4], 0x39
call fcn.004efb40
add esp, 0x40
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x79c], eax
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x79c]
call fcn.00401830
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x230
call fcn.0041a5f0
push eax
mov byte [ebp - 4], 0x3c
call fcn.00451100
add esp, 0x24
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x534]
call fcn.004017f0
lea ecx, [ebp - 0xf4]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.00429870
jmp 0x4ef862
lea ecx, [ebp - 0xf4]
call fcn.0044bf00
lea edx, [ebp - 0x53c]
push edx
lea ecx, [ebp - 0xe4]
call fcn.004297a0
push eax
lea ecx, [ebp - 0xf4]
call fcn.0044fe10
movzx eax, al
test eax, eax
je 0x4ef9c5
lea ecx, [ebp - 0xf4]
call fcn.0044b6b0
mov ecx, eax
call fcn.0043d4c0
movzx ecx, al
test ecx, ecx
jne 0x4ef9c0
lea edx, [ebp - 0xe8]
push edx
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xf4]
call fcn.0044b6b0
mov ecx, eax
call fcn.00401830
push eax
call fcn.004eb8d0
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x4ef9c0
mov dword [ebp - 0xf8], 0
lea edx, [ebp - 0xf8]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
je 0x4ef949
cmp dword [ebp - 0xcc], reloc.WS2_32.dll_accept
jne 0x4ef949
lea edx, [ebp - 0xf8]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xfc], eax
call fcn.00567ea0
movzx ecx, al
test ecx, ecx
je 0x4ef986
cmp dword [ebp - 0xfc], 0
je 0x4ef986
lea edx, [ebp - 0xf8]
push edx
push 0x20119
push 0
mov eax, dword [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xfc], eax
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x540], edx
mov eax, dword [ebp - 0x540]
push eax
call fcn.004b5f6c
add esp, 4
mov ecx, dword [ebp - 0xf8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xfc], 0
jne 0x4ef9c0
mov byte [ebp - 0xe9], 1
jmp 0x4ef9c5
jmp 0x4ef857
movzx edx, byte [ebp - 0xe9]
test edx, edx
jne 0x4ef9da
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x22c], 0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xe4]
call fcn.00429380
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x22c]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x54], 0
jle 0x4efab6
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax + 0x22c]
test ecx, ecx
je 0x4efab6
mov ecx, dword [ebp - 0x30]
add ecx, 0xe0
call fcn.00401830
push eax
lea edx, [ebp - 0x55c]
push edx
call fcn.00569590
add esp, 8
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x7a4], eax
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x7a4]
push ecx
push str.http:__api.kpzip.com_showcountnew.php_name
lea edx, [ebp - 0x118]
push edx
call fcn.00403d60
add esp, 0xc
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x55c]
call fcn.00404950
lea ecx, [ebp - 0x134]
call fcn.004048c0
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.00560c50
add esp, 8
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x134]
call fcn.00404950
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x118]
call fcn.00404950
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x90]
call fcn.004017f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004017f0
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x568]
add ecx, 0x104
call fcn.004f05c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.0044f210
jmp 0x4ee3ba
mov byte [0x5edb44], 1
mov dword [ebp - 0x560], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0044b9f0
mov eax, dword [ebp - 0x560]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x58]
xor ecx, ebp
call fcn.004b645d
mov esp, ebp
pop ebp
ret 4