Function at 0x404a7a
Capabilities:
Read .ini file

Disassembly:
push 0x84c
mov eax, 0x45af76
call fcn.004451ce
mov esi, 0x1ff
push esi
xor edi, edi
lea eax, [ebp - 0x64f]
push edi
push eax
mov byte [ebp - 0x650], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x44f]
push edi
push eax
mov byte [ebp - 0x450], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x84f]
push edi
push eax
mov byte [ebp - 0x850], 0
call fcn.00444c50
push 0x3f
pop esi
push esi
lea eax, [ebp - 0xcf]
push edi
push eax
mov byte [ebp - 0xd0], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x10f]
push edi
push eax
mov byte [ebp - 0x110], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x18f]
push edi
push eax
mov byte [ebp - 0x190], 0
call fcn.00444c50
add esp, 0x48
push esi
lea eax, [ebp - 0x20f]
push edi
push eax
mov byte [ebp - 0x210], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x4f]
push edi
push eax
mov byte [ebp - 0x50], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x8f]
push edi
push eax
mov byte [ebp - 0x90], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x14f]
push edi
push eax
mov byte [ebp - 0x150], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x24f]
push edi
push eax
mov byte [ebp - 0x250], 0
call fcn.00444c50
push esi
lea eax, [ebp - 0x1cf]
push edi
push eax
mov byte [ebp - 0x1d0], 0
call fcn.00444c50
lea eax, [ebp - 0x650]
add esp, 0x48
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404b98
sub eax, ecx
jne 0x404bce
push 0x200
lea eax, [ebp - 0x650]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x650]
push 0x5c
push eax
call fcn.00441750
pop ecx
pop ecx
cmp eax, edi
je 0x404bce
mov byte [eax + 1], 0
lea eax, [ebp - 0x450]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404bd7
sub eax, edx
jne 0x404c0e
mov al, byte [ebp + edi - 0x650]
mov byte [ebp + edi - 0x450], al
inc edi
test al, al
jne 0x404be2
lea edi, [ebp - 0x450]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404bfc
mov esi, str.config.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x450]
push eax
push 0x40
push 0x47f128
push 0x4648dc
push str.PUSH
mov esi, 0x46486c
push esi
call ebx
mov edi, 0x46567c
push edi
push 0x47f128
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404c54
mov dword [0x47ebb4], 1
lea eax, [ebp - 0x450]
push eax
push 0x400
push 0x47f170
push 0x464857
push str.PBURL
push esi
call ebx
lea eax, [ebp - 0x450]
push eax
push 0x200
lea eax, [ebp - 0x850]
push eax
push 0x4648dc
push str.STSF
push esi
call ebx
lea eax, [ebp - 0x850]
push edi
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404caf
mov dword [0x47ecbc], 1
lea eax, [ebp - 0x450]
push eax
push 0x40
lea eax, [ebp - 0xd0]
push eax
push 0x4648dc
push str.JZBHO
push esi
call ebx
lea eax, [ebp - 0xd0]
push edi
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404ce9
mov dword [0x47f124], 1
lea eax, [ebp - 0x450]
push eax
push 0x40
lea eax, [ebp - 0x110]
push eax
push 0x4648dc
push str.SRAND
push esi
call ebx
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404d23
mov dword [0x47f168], 1
mov ecx, str.barclient.exe
call fcn.0040466d
test al, al
je 0x404d3b
mov dword [0x47f168], 1
lea eax, [ebp - 0x450]
push eax
push 0x104
mov edi, 0x47f590
push edi
push 0x464857
push str.URLXTIE
push esi
call ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404d5b
mov edx, 0x465cf4
mov esi, edx
movsw word es:[edi], word [esi]
mov esi, 0x47f590
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404d76
sub eax, edi
cmp eax, 4
jbe 0x404db4
push ecx
mov ecx, esp
mov dword [ebp - 0x854], esp
push edx
call fcn.0040230f
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x858], esp
push esi
mov edi, 0x4801a0
call fcn.0040230f
or dword [ebp - 4], 0xffffffff
call fcn.00404fe5
lea eax, [ebp - 0x450]
push eax
push 0x104
lea eax, [ebp - 0x190]
push eax
mov edi, 0x4648dc
push edi
push str.BAIDUVER
mov esi, 0x46486c
push esi
call ebx
lea eax, [ebp - 0x190]
push 0x46567c
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404dfb
mov dword [0x47f574], 1
lea eax, [ebp - 0x450]
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
push str.HTTPS
push esi
call ebx
lea eax, [ebp - 0x210]
push 0x46567c
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404e38
mov dword [0x47f578], 1
lea eax, [ebp - 0x450]
push eax
push 0x104
lea eax, [ebp - 0x50]
push eax
push edi
push str.JMSG
push esi
call ebx
lea eax, [ebp - 0x50]
push 0x46567c
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404e6f
mov dword [0x47f580], 1
lea eax, [ebp - 0x450]
push eax
push 0x104
lea eax, [ebp - 0x90]
push eax
push edi
push str.HTSBD
push esi
call ebx
lea eax, [ebp - 0x90]
push 0x46567c
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404eac
mov dword [0x47f57c], 1
lea eax, [ebp - 0x450]
push eax
push 0x104
lea eax, [ebp - 0x150]
push eax
push edi
push str.MOREN
push esi
call ebx
lea eax, [ebp - 0x150]
push 0x46567c
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404ee9
mov dword [0x47f584], 1
lea eax, [ebp - 0x450]
push eax
push 0x104
lea eax, [ebp - 0x1d0]
push eax
push edi
push str.PBACC
push esi
call ebx
lea eax, [ebp - 0x1d0]
push 0x46567c
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404f26
mov dword [0x47f89c], 1
lea eax, [ebp - 0x450]
push eax
push 0x104
lea eax, [ebp - 0x250]
push eax
push edi
push str.HTWORD
push esi
call ebx
lea eax, [ebp - 0x250]
push 0x46567c
push eax
call fcn.0044334c
pop ecx
pop ecx
test eax, eax
jne 0x404f63
mov dword [0x47f588], 1
lea eax, [ebp - 0x450]
push eax
push 0x200
push 0x47f698
push edi
push str.CLOSE
push esi
call ebx
mov edi, 0x47f698
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404f83
mov edx, 0x465cf4
mov esi, edx
movsw word es:[edi], word [esi]
mov esi, 0x47f698
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404f9e
sub eax, edi
cmp eax, 4
jbe 0x404fdf
push ecx
mov ecx, esp
mov dword [ebp - 0x858], esp
push edx
call fcn.0040230f
push ecx
mov dword [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x854], esp
push esi
mov edi, 0x4801b4
call fcn.0040230f
or dword [ebp - 4], 0xffffffff
call fcn.00404fe5
call fcn.00445251
ret