Function at 0x4256d0
Capabilities:
Allocate or change rwx memory
Create directory
Create thread
Execute shellcode via indirect call
Get common file path
Get file attributes
Get graphical window text
Read .ini file
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4008
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x4c3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x834], ebx
jmp 0x425718
call dword [sym.imp.mfc140u.dll_CDialog::OnInitDialog]
push 0x422930
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.mfc140u.dll_CMenu::FromHandle]
mov edi, eax
test edi, edi
je 0x4257a4
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x65
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov eax, dword [ebp - 0x818]
cmp dword [eax - 0xc], 0
je 0x425791
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
push 0x800
push dword [edi + 4]
call esi
push dword [ebp - 0x818]
push 0x10
push 0
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00425630
push dword [ebx + 0xd0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xd0]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
push 0
push 0
push 0x1037
push dword [ebx + 0xf4]
call esi
or eax, 0x20
push eax
push 0
push 0x1036
push dword [ebx + 0xf4]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CListCtrl::InsertColumn]
lea edi, [ebx + 0xd4]
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b9bd0
push 0
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b9bd8
push 1
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x14
push 0
push 0x4b9be0
push 2
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push str.:S_rg
push 3
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b9bf0
push 4
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b9bf8
push 5
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b9c00
push 6
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b9c08
push 7
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b9c10
push 8
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b9c18
push 9
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b9c20
push 0xa
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b9c28
push 0xb
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b9c30
push 0xc
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b9c38
push 0xd
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 2
push str._m
push 0xe
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0xa
push 0
push 0x4b9c54
push 0xf
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0xa
push 0
push 0x4b9c6c
push 0x10
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x64
push 0
push 0x4b9c80
push 0x11
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x96
push 0
push 0x4b9c8c
push 0x12
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x64
push 0
push 0x4b9c98
push 0x13
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b9ca4
push 0x14
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b9cac
push 0x15
mov ecx, edi
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea ecx, [ebx + 0x1d4]
push 0x4b9cb8
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x4b9cb8
push 0
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b9cc0
push 1
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b9cc8
push 2
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b9cd0
lea ecx, [ebx + 0x2e2c]
call edi
push 0x4b9cd0
push 0
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b9cd8
push 1
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b9ce0
push 2
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b9ce8
push 3
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b9cf0
push 4
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b9cf8
push 5
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0
push 0
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 1
push 1
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 2
push 2
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 3
push 3
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 4
push 4
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 5
push 5
push 0x151
push dword [ebx + 0x2e4c]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 0
call esi
lea ecx, [ebx + 0xaa4]
push 0
call esi
lea ecx, [ebx + 0xba4]
push 0
call esi
lea ecx, [ebx + 0x6a4]
push 0
call esi
lea ecx, [ebx + 0xa24]
push 0
call esi
lea ecx, [ebx + 0xca4]
push 0
call esi
lea ecx, [ebx + 0x172c]
push 0
call esi
lea ecx, [ebx + 0x1c2c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1bac]
call esi
lea ecx, [ebx + 0x1b2c]
push 0
call esi
lea ecx, [ebx + 0x112c]
push 0
call esi
lea ecx, [ebx + 0x142c]
push 0
call esi
lea ecx, [ebx + 0xea4]
push 0
call esi
lea ecx, [ebx + 0xf24]
push 0
call esi
lea ecx, [ebx + 0x1dac]
push 0
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
lea ecx, [ebx + 0x1bac]
push 0
call edi
lea ecx, [ebx + 0x24ac]
push 0
call esi
lea ecx, [ebx + 0x282c]
push 0
call esi
lea ecx, [ebx + 0x122c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1dac]
call esi
lea ecx, [ebx + 0x1eac]
push 0
call esi
push 0
lea ecx, [ebx + 0x122c]
call edi
mov eax, dword [ebx + 0x254]
add ebx, 0x254
mov esi, dword [ebp - 0x834]
mov ecx, ebx
push 0xe801
push 0x50008200
push 0
push esi
call dword [eax + 0x1b0]
lea eax, [ebp - 0x830]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x824]
mov ecx, ebx
push 1
push 0x19
push dword [ebp - 0x828]
add eax, 0xffffffe2
push eax
push 0
call dword [sym.imp.mfc140u.dll_CWnd::MoveWindow]
push 5
push str.efghi
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CStatusBar::SetIndicators]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::GetDlgCtrlID]
mov ecx, ebx
push 0x64
push 0x8000000
call edi
mov esi, dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneInfo]
mov ecx, ebx
push eax
push 0
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 1
mov ecx, ebx
call esi
push 0x1e
push 0x8000000
mov ecx, ebx
call edi
push eax
push 2
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 3
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 4
mov ecx, ebx
call esi
push 1
push 0
push 0
push 0
push 0
push 0xe8ff
mov ecx, dword [ebp - 0x834]
push 0xe800
call dword [sym.imp.mfc140u.dll_CWnd::RepositionBars]
push 1
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
push str.D:LogInfo
mov dword [0x4c6204], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x425cc1
push 0
push str.D:LogInfo
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x410000
push 0
push dword [0x7c64c4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x200
mov dword [0x4c627c], eax
lea eax, [ebp - 0x410]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x820]
mov dword [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x200
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 2
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x814]
push str._sIPsET.ini
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0xc
push dword [ebp - 0x814]
push 0
push 0x4b9d34
push 0x4b9d40
call edi
mov ebx, dword [ebp - 0x834]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6190], eax
push 0
push 0x4b9d48
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x4c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x4c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6200], eax
push 0
push 0x4b9d50
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x544]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x544]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61a0], eax
push 0
push str.Rf
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x744]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x744]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6188], eax
push 0
push 0x4b9d68
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x7c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x7c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6250], eax
push 0
push 0x4b9d74
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x844]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x844]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61fc], eax
push 0
push str.0R
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xb44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xb44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61f8], eax
push 0
push str.S__Y
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c624c], eax
push 0
push 0x4b9d9c
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6098], eax
push 0
push 0x4b9da4
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52e4], eax
push 0
push 0x4b9dac
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xc44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xc44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61b0], eax
push 0
push 0x4b9db4
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xe44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xe44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52f8], eax
push 0
push 0x4b7128
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x134c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x134c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61e8], eax
push 0
push 0x4b9dc0
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x13cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x13cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c620c], eax
push 0
push 0x4b9dd0
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x14cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52f0], eax
push 0
push 0x4b9ddc
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x15cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x15cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60ac], eax
push 0
push 0x4b9de8
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x374c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x374c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52f4], eax
push 0
push 0x4b9df4
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x27cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x27cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60b4], eax
push 0
push 0x4b9e00
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x16cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x16cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6260], eax
push 0
push 0x4b9e0c
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x8c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x8c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61a8], eax
push 0
push str.R7R
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x264c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x264c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c619c], eax
push 0
push 0x4b9e28
push 0x4b9d40
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x17cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x17cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52e8], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b9e34
push 0x4b9e40
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x162c]
call edi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b9e4c
push 0x4b9e54
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2f2c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c41d4], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e64
push 0x4b9e68
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x302c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c5860], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e74
push 0x4b9e78
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x312c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c585c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e84
push 0x4b9e8c
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x31ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c41dc], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e74
push 0x4b9e98
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x33ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c41d0], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e74
push 0x4b9ea8
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x352c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3738], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e84
push 0x4b9eb4
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x36ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3734], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9ec0
push str._g0W
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x37ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c373c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e74
push 0x4b9ed0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x32ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4190], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9edc
push 0x4b9ee0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4c60d8], al
movzx eax, al
push 0
push eax
push 0x14e
push dword [ebx + 0x2e4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b9ef0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x18cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x18cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c94], eax
push 1
push 0x4b9efc
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1a4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b9f08
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x28cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x28cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6224], eax
push 0
push 0x4b9f14
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x294c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x294c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c621c], eax
push 0
push 0x4b9f20
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2a4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2a4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6240], eax
push 0
push 0x4b9f2c
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c623c], eax
push 0
push 0x4b9f38
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2c4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2c4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6238], eax
push 0
push 0x4b9f44
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61d4], eax
push 0
push str.sQN
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61dc], eax
push 0
push 0x4b9f5c
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2dcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2dcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60d4], eax
push 0
push str.AwardOpt
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ecc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ecc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6254], eax
push 0
push 0x4b9f80
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52fc], eax
push 0
push 0x4b9f8c
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x30cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x30cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60a4], eax
push 0
push 0x4b9f94
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x324c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x324c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6244], eax
push 0
push 0x4b9fa0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6274], eax
push 0
push 0x4b9fac
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x334c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x334c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61d0], eax
push 0
push str.R_Rd
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x384c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x384c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5858], eax
push 0
push 0x4b9fc8
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5984], eax
push 0
push 0x4b9fd4
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c609c], eax
push 0
push 0x4b9fe0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x38cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x38cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5854], eax
push 0
push 0x4b9fec
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6184], eax
push 0
push 0x4b9ffc
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3c4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3c4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6194], eax
push 0
push 0x4ba004
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c61d8], eax
push 0
push 0x4ba010
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c88], eax
push 0
push 0x4ba01c
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3dcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3dcc]
call esi
mov dword [0x4c6198], eax
push dword [ebp - 0x814]
push 0
push 0x4ba028
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x39cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x39cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6208], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b9e64
push 0x4ba034
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x392c]
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
push 0
push 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x818]
mov eax, dword [ebp - 0x818]
push 0
push 0
push dword [eax - 0xc]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0
push 0
call edi
mov ecx, dword [ebp - 0x818]
mov esi, eax
push 0
push 0
push esi
push 0x4c5840
push dword [ecx - 0xc]
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
push 0
call edi
lea ecx, [ebp - 0x818]
mov byte [esi + 0x4c5840], 0
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x814]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b9ec0
push 0x4ba040
push 0x4b9d40
call edi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4194], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push str.750000
push 0x4ba060
push 0x4b9d40
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3aac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
mov dword [0x4c4258], eax
push 0
push 0
push 0xf0
push dword [ebx + 0x1a4c]
call edi
push dword [ebp - 0x814]
neg eax
push 0
sbb al, al
push 0x4ba06c
add al, 2
push 0x4b9d40
mov byte [0x4c34cf], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x64
jne 0x426d75
push 0
push 1
push 0xf1
push dword [ebx + 0x104c]
call edi
mov dword [0x4c41d8], 0x64
jmp 0x426db9
cmp eax, 0x12c
jne 0x426d99
push 0
push 1
push 0xf1
push dword [ebx + 0x10cc]
call edi
mov dword [0x4c41d8], 0x12c
jmp 0x426db9
cmp eax, 0xa
jne 0x426db9
push 0
push 1
push 0xf1
push dword [ebx + 0xfcc]
call edi
mov dword [0x4c41d8], 0xa
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7dac
push 0x4ba078
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x426df3
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4ba084
push 0x4ba088
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x426e42
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x272c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4260], eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.20000
push 0x4ba0a0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0xda4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4ba0ac
push 0x4ba0b4
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x21ac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c61cc], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4ba084
push 0x4ba0c0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x152c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3728], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4ba0d0
push 0x4ba0d8
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x9a4]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c60c4], eax
mov dword [0x4c5864], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b9e74
push 0x4ba0e0
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1e2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4c34ce], al
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.1000
push 0x4ba0f8
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x182c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c583c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4ba0d0
push 0x4ba104
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2b2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
add esp, 4
lea eax, [ebp - 0x210]
fstp qword [0x4c41e0]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4ba110
push 0x4ba118
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x192c]
call esi
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
lea eax, [ebp - 0x210]
push eax
call esi
add esp, 4
mov dword [0x4c5834], eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x81c], 0
push eax
push 0x40
push 0x563
push dword [0x4c3bec]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0042d480
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 3
mov byte [ebp - 4], 4
call dword [sym.imp.plfl32.dll_P_GetDataValue]
push eax
lea eax, [ebp - 0x818]
push 0x4b7a54
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push dword [ebp - 0x818]
call esi
add esp, 0x10
mov dword [0x4c6258], eax
push 0
call dword [sym.imp.plfl32.dll_P_GetInfo]
push eax
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x818]
push 0x4b7288
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 1
call esi
push dword [ebp - 0x814]
push 0
push 0x4ba124
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x644]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x644]
call edi
push 1
lea ecx, [ebx + 0xa24]
mov dword [0x4c626c], eax
call esi
push 1
lea ecx, [ebx + 0xca4]
call esi
push 1
lea ecx, [ebx + 0x142c]
call esi
push dword [ebp - 0x814]
push 0
push str._rN9e
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x144c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x144c]
call edi
push dword [ebp - 0x814]
mov dword [0x4c61b8], eax
push 0
push 0x4ba13c
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xa44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xa44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c61c0], eax
push 0
push 0x4ba148
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xcc4]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xcc4]
call edi
mov dword [0x4c61bc], eax
mov eax, dword [0x4c6258]
cmp eax, 2
jl 0x4272c6
push 1
lea ecx, [ebx + 0x1bac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1bac]
call esi
push 1
lea ecx, [ebx + 0x122c]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1dac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1eac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x122c]
call esi
push 1
lea ecx, [ebx + 0x1dac]
call esi
push 1
lea ecx, [ebx + 0x1eac]
call esi
mov eax, dword [0x4c6258]
cmp eax, 5
jne 0x427331
push 1
lea ecx, [ebx + 0x1c2c]
call esi
push 1
lea ecx, [ebx + 0x6a4]
call esi
push 1
lea ecx, [ebx + 0x172c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4ba150
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x174c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x174c]
call edi
mov dword [0x4c52ec], eax
mov eax, dword [0x4c6258]
cmp eax, 5
je 0x427344
cmp eax, 3
je 0x427344
cmp eax, 4
je 0x427344
cmp eax, 6
jne 0x4274b1
push 1
lea ecx, [ebx + 0x1b2c]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.80000
push 0x4ba168
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1b2c]
call dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4294], eax
lea ecx, [ebx + 0xd24]
push 1
call esi
push 1
lea ecx, [ebx + 0x112c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4ba170
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xd44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xd44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c617c], eax
push 0
push 0x4ba17c
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x114c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x114c]
call edi
push 1
lea ecx, [ebx + 0xea4]
mov dword [0x4c6248], eax
call esi
push 1
lea ecx, [ebx + 0xf24]
call esi
push 1
lea ecx, [ebx + 0x24ac]
call esi
push 1
lea ecx, [ebx + 0x282c]
call esi
push 1
lea ecx, [ebx + 0xea4]
call esi
push 1
lea ecx, [ebx + 0x202c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4ba188
push 0x4b9d40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x204c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x204c]
call edi
mov dword [0x4c60c8], eax
mov eax, dword [0x4c6258]
cmp eax, 6
je 0x4274b6
cmp eax, 5
jne 0x4274e0
push 1
lea ecx, [ebx + 0xaa4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xac4]
call edi
push 1
lea ecx, [ebx + 0xba4]
mov dword [0x4c61f4], eax
call esi
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
push 0
push 0x4c5c98
push 0
call esi
push 0x4c5c98
push 0x4ba194
push 0x4c5b88
call fcn.0041fb80
add esp, 0xc
call fcn.00424b40
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x42758e
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x810]
push 0
push 0x10
push eax
push 0
call esi
lea eax, [ebp - 0x810]
push eax
push 0x4ba1a4
push 0x4c5320
call fcn.0041fb60
push 0
push 0
push 0
push 0x429bc0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x4275bb
push 0x42bed0
push 0x2710
push 0x2767
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x4255d0
push 0xfffffffffffffffc
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 0x4c6144
mov dword [0x4c5318], eax
mov ecx, str.dxdir1.speed.qq.com
call fcn.00422b00
mov edx, 0x4c6110
mov ecx, str.wtdir1.speed.qq.com
call fcn.00422b00
mov edx, 0x4c60dc
mov ecx, str.dx2dir1.speed.qq.com
call fcn.00422b00
mov ecx, 0x4c6144
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427605
sub ecx, edx
je 0x42763b
mov ecx, 0x4c6110
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427618
sub ecx, edx
je 0x42763b
mov ecx, 0x4c60dc
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427630
sub ecx, edx
jne 0x42764f
push 0
push str.speed.qq.com
push 0x4ba204
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x42765f
lea ecx, [ebp - 0x820]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044632d
mov esp, ebp
pop ebp
ret