Function at 0x4601f0
Capabilities:
Download url
Query or enumerate registry value
Receive data
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb158
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x654c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x148], 0
push 7
push str.SM_X910
lea ecx, [ebp - 0x1e4]
movq qword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x1e4], xmm0
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1d0], 0
call fcn.00456320
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1cc]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x1bc], 0
push str.SM_S918B
movups xmmword [ebp - 0x1cc], xmm0
mov dword [ebp - 0x1b8], 0
call fcn.00456320
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 4], 1
push ecx
lea eax, [ebp - 0x1b4]
push eax
push ecx
lea ecx, [ebp - 0x150]
call fcn.004532b0
push fcn.00454110
push 2
push 0x18
lea eax, [ebp - 0x1e4]
mov byte [ebp - 4], 3
push eax
call fcn.005c5ab1
xorps xmm0, xmm0
mov dword [ebp - 0x188], 0
push 7
push str.Samsung
lea ecx, [ebp - 0x2a0]
movq qword [ebp - 0x190], xmm0
movups xmmword [ebp - 0x2a0], xmm0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0
call fcn.00456320
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x288]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x278], 0
push str.Apple
movups xmmword [ebp - 0x288], xmm0
mov dword [ebp - 0x274], 0
call fcn.00456320
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x270]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x260], 0
push str.Xiaomi
movups xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x25c], 0
call fcn.00456320
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x258]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x248], 0
push str.Asus
movups xmmword [ebp - 0x258], xmm0
mov dword [ebp - 0x244], 0
call fcn.00456320
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2a0]
push ecx
lea eax, [ebp - 0x240]
push eax
push ecx
lea ecx, [ebp - 0x190]
call fcn.004532b0
push fcn.00454110
push 4
push 0x18
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 9
push eax
call fcn.005c5ab1
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x234]
push eax
push 2
push 0
push str.SoftwareTencentMobileGamePC
push reloc.WS2_32.dll_accept
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x46059c
mov ecx, dword [ebp - 0x18c]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x190]
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
call edi
xor edx, edx
div esi
mov eax, dword [ebp - 0x190]
lea ecx, [edx + edx*2]
lea eax, [eax + ecx*8]
push eax
lea ecx, [ebp - 0x168]
call fcn.00454160
mov byte [ebp - 4], 0xa
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x14c]
sub ecx, dword [ebp - 0x150]
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
call edi
xor edx, edx
div esi
mov eax, dword [ebp - 0x150]
lea ecx, [edx + edx*2]
lea ecx, [eax + ecx*8]
push ecx
lea ecx, [ebp - 0x144]
call fcn.00454160
mov byte [ebp - 4], 0xb
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x14c]
sub ecx, dword [ebp - 0x150]
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
call edi
xor edx, edx
div esi
mov eax, dword [ebp - 0x150]
lea ecx, [edx + edx*2]
lea eax, [eax + ecx*8]
push eax
lea ecx, [ebp - 0x184]
call fcn.00454160
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x168]
mov ecx, dword [ebp - 0x158]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc ecx
cmp dword [ebp - 0x154], 0xf
push ecx
cmova eax, dword [ebp - 0x168]
push eax
push 1
push 0
push str.VMDeviceManufacturer
push dword [ebp - 0x234]
call esi
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0x144]
inc ecx
cmp dword [ebp - 0x130], 0xf
push ecx
cmova eax, dword [ebp - 0x144]
push eax
push 1
push 0
push str.VMDeviceModel
push dword [ebp - 0x234]
call esi
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 0x184]
inc ecx
cmp dword [ebp - 0x170], 0xf
push ecx
cmova eax, dword [ebp - 0x184]
push eax
push 1
push 0
push str.VMPhoneDevice
push dword [ebp - 0x234]
call esi
push dword [ebp - 0x234]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea ecx, [ebp - 0x184]
call fcn.00455150
lea ecx, [ebp - 0x144]
call fcn.00455150
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 9
call fcn.00455150
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x238]
push eax
push 2
push 0
push str.SoftwareTencentMobileGamePC
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x4605e3
push 4
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.AdbDisable
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x238]
call esi
lea eax, [ebp - 0x23c]
push eax
push 2
push 0
push str.SoftwareTencentMobileGamePC
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x46062a
push 4
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.RootEnabled
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x23c]
call esi
push 0x2a
xorps xmm0, xmm0
mov dword [ebp - 0x1a4], 0
push str.SOFTWAREWOW6432NodeTencentMobileGamePC_
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x1a0], 0
movups xmmword [ebp - 0x1b4], xmm0
call fcn.00456320
xorps xmm0, xmm0
mov dword [ebp - 0x1bc], 0
movups xmmword [ebp - 0x1cc], xmm0
mov dword [ebp - 0x1b8], 0xf
mov byte [ebp - 0x1cc], 0
movq qword [ebp - 0x19c], xmm0
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 0
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 0xf
call fcn.0045fe40
mov edi, bind
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1ec]
mov eax, edi
sub eax, ecx
cmp eax, 0xf
jb 0x460bc2
cmp dword [ebp - 0x1e8], 0xf
lea eax, [ebp - 0x1fc]
push 0xf
cmova eax, dword [ebp - 0x1fc]
push str.inter_skin.txt
push ecx
push eax
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x22c]
call fcn.00456cc0
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 0xf
push 0
cmova eax, dword [ebp - 0x22c]
push 0
push eax
push str.https:__dl.dropbox.com_scl_fi_c64m7dyi9s9anrbczkwsm_skin.txt_rlkeyv69qcfc7x3gd7jgf6f6fna0ststvhcvdiindl0
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
cmp dword [ebp - 0x1a0], 0xf
lea ecx, [ebp - 0x230]
push ecx
push 0x20019
lea eax, [ebp - 0x1b4]
cmova eax, dword [ebp - 0x1b4]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x460b35
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x16c], eax
mov eax, edi
sub eax, ecx
cmp eax, 2
jb 0x460bc7
cmp dword [ebp - 0x1a0], 0xf
lea eax, [ebp - 0x1b4]
push 2
cmova eax, dword [ebp - 0x1b4]
push 0x642170
push ecx
push eax
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x214]
call fcn.00456cc0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x114]
cmp dword [ebp - 0x200], 0xf
lea eax, [ebp - 0x214]
push ecx
cmova eax, dword [ebp - 0x214]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x460b24
push 0xff
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x16c], 0xff
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push str.InstallPath
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x460b1c
xorps xmm0, xmm0
mov dword [ebp - 0x174], eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x170], eax
movups xmmword [ebp - 0x184], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x460850
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x184]
call fcn.00456320
mov byte [ebp - 4], 0x13
mov eax, edi
mov ecx, dword [ebp - 0x174]
sub eax, ecx
cmp eax, 0x16
jb 0x460bc2
cmp dword [ebp - 0x170], 0xf
lea eax, [ebp - 0x184]
push 0x16
cmova eax, dword [ebp - 0x184]
push 0x642180
push ecx
push eax
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x12c]
call fcn.00456cc0
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x118]
mov eax, edx
mov ecx, dword [ebp - 0x11c]
sub eax, ecx
cmp eax, 1
jb 0x4608f5
inc ecx
lea esi, [ebp - 0x12c]
cmp edx, 0xf
mov dword [ebp - 0x11c], ecx
push ecx
cmova esi, dword [ebp - 0x12c]
push esi
lea eax, [esi + 1]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi], 0x22
jmp 0x460911
sub esp, 0xc
mov byte [ebp - 0x240], 0
push dword [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x12c]
call fcn.004699e0
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x134], 0
push str..exe_
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x130], 0
movups xmmword [ebp - 0x144], xmm0
call fcn.00456320
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x168]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x158], 0
push str..exe
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x154], 0
call fcn.00456320
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x168]
cmp dword [ebp - 0x154], 0xf
lea ecx, [ebp - 0x12c]
push dword [ebp - 0x158]
cmova eax, dword [ebp - 0x168]
cmp dword [ebp - 0x118], 0xf
mov edx, dword [ebp - 0x11c]
cmova ecx, dword [ebp - 0x12c]
push eax
push 0
call fcn.00455f40
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x460a47
mov edi, dword [ebp - 0x134]
nop dword [eax]
cmp dword [ebp - 0x130], 0xf
lea ecx, [ebp - 0x144]
push edi
cmova ecx, dword [ebp - 0x144]
mov edi, dword [ebp - 0x158]
push ecx
push edi
push esi
lea ecx, [ebp - 0x12c]
call fcn.00468270
cmp dword [ebp - 0x154], 0xf
lea eax, [ebp - 0x168]
mov edx, dword [ebp - 0x11c]
lea ecx, [ebp - 0x12c]
cmova eax, dword [ebp - 0x168]
cmp dword [ebp - 0x118], 0xf
push edi
mov edi, dword [ebp - 0x134]
cmova ecx, dword [ebp - 0x12c]
push eax
lea eax, [edi + esi]
push eax
call fcn.00455f40
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x4609d0
mov edi, bind
lea ecx, [ebp - 0x168]
call fcn.00455150
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x14
call fcn.00455150
mov ecx, dword [ebp - 0x11c]
sub edi, ecx
cmp edi, 8
jb 0x460bc2
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
push 8
cmova eax, dword [ebp - 0x12c]
push str.__vm_100
push ecx
push eax
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x144]
call fcn.00456cc0
mov byte [ebp - 4], 0x18
lea edx, [ebp - 0x144]
cmp dword [ebp - 0x130], 0xf
xorps xmm0, xmm0
cmova edx, dword [ebp - 0x144]
sub esp, 0x18
mov esi, esp
mov ecx, edx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edi, [ecx + 1]
mov dword [esi + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x460ad7
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00456320
call fcn.00451a30
add esp, 0x18
lea ecx, [ebp - 0x144]
call fcn.00455150
lea ecx, [ebp - 0x12c]
call fcn.00455150
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x12
call fcn.00455150
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x114]
call esi
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x11
call fcn.00455150
jmp 0x460b52
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x45d430
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n____Please_install_the_emulator_properly_n
mov ecx, eax
call fcn.004559f0
push dword [ebp - 0x230]
call esi
lea ecx, [ebp - 0x22c]
call fcn.00455150
lea ecx, [ebp - 0x1fc]
call fcn.00455150
lea ecx, [ebp - 0x19c]
call fcn.00454f60
lea ecx, [ebp - 0x1cc]
call fcn.00455150
lea ecx, [ebp - 0x1b4]
call fcn.00455150
lea ecx, [ebp - 0x190]
call fcn.00454f60
lea ecx, [ebp - 0x150]
call fcn.00454f60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c56ce
mov esp, ebp
pop ebp
ret
call fcn.0044e660
call fcn.0044e660
int3