Function at 0x418c6a
Capabilities:
Contain obfuscated stackstrings
Get file system object information

Disassembly:
mov eax, 0x4ac2e6
call fcn.0049f0d0
sub esp, 0x5b8
mov eax, dword [0x4f0dd0]
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0xe8]
push edi
xor eax, ebp
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4d0], esi
je 0x419c03
mov eax, dword [ebp + 8]
sub eax, edi
je 0x419127
dec eax
jne 0x419c03
cmp dword [ebx + 4], edi
jne 0x418cf4
push 0x10
call fcn.0049ecb8
push 0x10
push edi
push eax
mov dword [ebx + 4], eax
call sub.MSVCR71.dll_memset
mov eax, dword [ebx + 4]
add esp, 0x10
mov dword [eax], 1
push 0x4bc03c
lea eax, [ebp - 0x588]
push eax
mov ecx, esi
call fcn.0041826a
mov ecx, eax
mov dword [ebp - 4], 0x30
call fcn.00414b9f
mov ecx, dword [ebx + 4]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x588]
add ecx, 0xfffffff0
call fcn.004014d5
mov eax, dword [ebx + 4]
cmp dword [eax + 8], edi
mov dword [ebp - 0x4d4], edi
jle 0x418d48
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x4d4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0x14]
cmp eax, edi
je 0x418d1f
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x4d4]
push dword [eax + ecx*4]
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
inc dword [ebp - 0x4d4]
mov eax, dword [ebx + 4]
pop ecx
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [eax + 8]
jl 0x418d02
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
cmp eax, edi
je 0x418d5f
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
mov eax, dword [ebx + 4]
pop ecx
mov dword [eax + 4], edi
mov eax, dword [ebx + 4]
mov dword [eax + 8], edi
mov dword [ebp - 0x4f0], edi
mov dword [ebp - 0x4ec], edi
mov dword [ebp - 0x4e8], edi
lea eax, [ebp - 0x4f4]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x31
call fcn.0041729c
cmp dword [ebp - 0x4f0], edi
je 0x418fef
mov esi, dword [ebp - 0x4ec]
sub esi, dword [ebp - 0x4f0]
sar esi, 2
je 0x418fef
push 0x413461
push dword [ebp - 0x4ec]
push dword [ebp - 0x4f0]
call fcn.00417de7
add esp, 0xc
cmp esi, 3
jb 0x418dce
push 3
pop esi
mov eax, dword [ebx + 4]
mov dword [eax + 8], esi
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
shl eax, 2
push eax
call fcn.0049ecdd
pop ecx
mov ecx, dword [ebx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
xor esi, esi
cmp dword [eax + 8], edi
jle 0x418e21
push 0x18
call fcn.0049ecb8
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
push 0x18
push edi
push dword [eax + esi*4]
call sub.MSVCR71.dll_memset
mov eax, dword [ebx + 4]
add esp, 0x10
inc esi
cmp esi, dword [eax + 8]
jl 0x418df4
mov eax, dword [ebx + 4]
cmp dword [eax + 8], edi
mov dword [ebp - 0x4e0], edi
jle 0x4190d9
mov esi, 0x4b82fc
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [ebp - 0x4e0]
mov edi, dword [eax + ecx*4]
push dword [edi]
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x4d8], edi
call fcn.00402ce0
mov dword [ebp - 0x4dc], eax
push dword [edi + 4]
lea ecx, [ebp - 0x5bc]
mov byte [ebp - 4], 0x32
call fcn.00402ce0
push dword [ebp - 0x4dc]
mov byte [ebp - 4], 0x33
push eax
lea eax, [ebp - 0x4d4]
push eax
call fcn.00416de8
add esp, 0xc
mov ecx, dword [ebp - 0x5bc]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x5b4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x35
call fcn.004014d5
cmp dword [edi + 0x1c], 2
jne 0x418ef2
push str.win7.jumplist.bttask
lea ecx, [ebp - 0x550]
call fcn.00402ce0
mov ecx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x550]
push eax
mov byte [ebp - 4], 0x37
call fcn.00418843
mov ecx, dword [ebp - 0x550]
add ecx, 0xfffffff0
mov dword [ebp - 0x4e4], eax
mov byte [ebp - 4], 0x35
call fcn.004014d5
jmp 0x418f53
push 0
push dword [ebp - 0x4d4]
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
test eax, eax
mov dword [ebp - 0x4e4], eax
jne 0x418f53
and dword [ebp - 0x4cc], eax
push 0x4511
mov ecx, 0xac
lea edi, [ebp - 0x4c8]
push 0x2b4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4cc]
push eax
push 0x80
push dword [ebp - 0x4d4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4cc]
mov edi, dword [ebp - 0x4d8]
mov dword [ebp - 0x4e4], eax
push esi
lea ecx, [ebp - 0x574]
call fcn.00402ce0
push dword [edi]
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], 0x38
call fcn.00402ce0
push dword [ebp - 0x4e4]
add edi, 8
push edi
mov edi, dword [ebp - 0x4e0]
lea ecx, [ebp - 0x574]
push ecx
lea ecx, [ebp - 0x4d4]
push ecx
mov ecx, dword [ebp - 0x4d0]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
push 0
push dword [eax + edi*4]
mov byte [ebp - 4], 0x39
call fcn.00416b3d
mov ecx, dword [ebp - 0x5c4]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x574]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x4d4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x31
call fcn.004014d5
mov eax, dword [ebx + 4]
inc edi
cmp edi, dword [eax + 8]
mov dword [ebp - 0x4e0], edi
jl 0x418e38
jmp 0x4190d7
mov eax, dword [ebx + 4]
mov dword [eax + 8], 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
shl eax, 2
push eax
call fcn.0049ecdd
pop ecx
mov ecx, dword [ebx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
xor esi, esi
cmp dword [eax + 8], edi
jle 0x419046
push 0x18
call fcn.0049ecb8
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
push 0x18
push edi
push dword [eax + esi*4]
call sub.MSVCR71.dll_memset
mov eax, dword [ebx + 4]
add esp, 0x10
inc esi
cmp esi, dword [eax + 8]
jl 0x419019
mov esi, 0x4b82fc
push esi
lea ecx, [ebp - 0x584]
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 0x3a
call fcn.00402ce0
mov ecx, dword [ebp - 0x4d0]
push 0x4bc028
lea eax, [ebp - 0x590]
push eax
mov byte [ebp - 4], 0x3b
call fcn.0041826a
xor ecx, ecx
push ecx
push ecx
lea edx, [ebp - 0x584]
push edx
lea edx, [ebp - 0x57c]
push edx
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
push ecx
push dword [eax]
mov ecx, dword [ebp - 0x4d0]
mov byte [ebp - 4], 0x3c
call fcn.00416b3d
mov ecx, dword [ebp - 0x590]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x57c]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x584]
add ecx, 0xfffffff0
call fcn.004014d5
xor edi, edi
xor ebx, ebx
mov ecx, dword [ebp - 0x4f0]
cmp ecx, edi
je 0x41910c
mov eax, dword [ebp - 0x4ec]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jae 0x41910c
mov esi, dword [ecx + ebx*4]
cmp esi, edi
je 0x419109
mov ecx, esi
call fcn.004136fa
push esi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
inc ebx
jmp 0x4190db
lea ecx, [ebp - 0x4f4]
call fcn.0040de32
lea ecx, [ebp - 0x4f4]
call fcn.0040de32
jmp 0x419c03
cmp dword [ebx], edi
jne 0x41994e
push 0x10
call fcn.0049ecb8
push 0x10
push edi
push eax
mov dword [ebx], eax
call sub.MSVCR71.dll_memset
mov eax, dword [ebx]
add esp, 0x10
push str.User_Task
mov dword [eax], edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebx]
push 0x28
mov dword [ecx + 0xc], eax
call fcn.0049ecdd
pop ecx
mov ecx, dword [ebx]
mov dword [ecx + 4], eax
mov eax, dword [ebx]
mov dword [eax + 8], 0xa
mov eax, dword [ebx]
cmp dword [eax + 8], edi
mov dword [ebp - 0x4d4], edi
jle 0x4191b9
push 0x18
call fcn.0049ecb8
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [edx + 4]
shl ecx, 2
mov dword [ecx + edx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push 0x18
push edi
push dword [eax + ecx]
call sub.MSVCR71.dll_memset
mov eax, dword [ebx]
add esp, 0x10
inc dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [eax + 8]
jl 0x41917b
mov word [ebp - 0x218], di
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x218]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.win7.jumplist.newtask
lea ecx, [ebp - 0x53c]
call fcn.00402ce0
push str._task:newtask
lea ecx, [ebp - 0x500]
mov dword [ebp - 4], edi
call fcn.00402ce0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 1
call fcn.00402ce0
push 0x4bc004
lea eax, [ebp - 0x5b8]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0041826a
mov dword [ebp - 0x4d8], eax
lea eax, [ebp - 0x53c]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00418843
push eax
push edi
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x530]
push eax
push dword [ebp - 0x4d8]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax]
mov ecx, esi
call fcn.00416b3d
mov ecx, dword [ebp - 0x5b8]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x530]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x500]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x53c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push str.win7.jumplist.startalltask
lea ecx, [ebp - 0x510]
call fcn.00402ce0
push str._task:startall
lea ecx, [ebp - 0x544]
mov dword [ebp - 4], 4
call fcn.00402ce0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], 5
call fcn.00402ce0
push 0x4bbff4
lea eax, [ebp - 0x598]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.0041826a
mov dword [ebp - 0x4d8], eax
lea eax, [ebp - 0x510]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.00418843
push eax
push edi
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x508]
push eax
push dword [ebp - 0x4d8]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax + 4]
mov ecx, esi
call fcn.00416b3d
mov ecx, dword [ebp - 0x598]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x508]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x544]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x510]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push str.win7.jumplist.pausealltask
lea ecx, [ebp - 0x554]
call fcn.00402ce0
push str._task:pauseall
lea ecx, [ebp - 0x518]
mov dword [ebp - 4], 8
call fcn.00402ce0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x54c]
mov byte [ebp - 4], 9
call fcn.00402ce0
push 0x4bbfe4
lea eax, [ebp - 0x5b0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.0041826a
mov dword [ebp - 0x4d8], eax
lea eax, [ebp - 0x554]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00418843
push eax
push edi
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x54c]
push eax
push dword [ebp - 0x4d8]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax + 8]
mov ecx, esi
call fcn.00416b3d
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x54c]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x518]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x554]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push str.win7.jumplist.exit
lea ecx, [ebp - 0x528]
call fcn.00402ce0
push str._shell:exit
lea ecx, [ebp - 0x55c]
mov dword [ebp - 4], 0xc
call fcn.00402ce0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0xd
call fcn.00402ce0
push 0x4bbfc0
lea eax, [ebp - 0x5a0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.0041826a
mov dword [ebp - 0x4d8], eax
lea eax, [ebp - 0x528]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xf
call fcn.00418843
push eax
push edi
lea eax, [ebp - 0x55c]
push eax
lea eax, [ebp - 0x520]
push eax
push dword [ebp - 0x4d8]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax + 0xc]
mov ecx, esi
call fcn.00416b3d
mov ecx, dword [ebp - 0x5a0]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x520]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x55c]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x528]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
mov esi, 0x4b82fc
push esi
lea ecx, [ebp - 0x570]
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x56c]
mov dword [ebp - 4], 0x10
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x11
call fcn.00402ce0
mov ecx, dword [ebp - 0x4d0]
push edi
push edi
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x564]
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push 1
push dword [eax + 0x10]
mov byte [ebp - 4], 0x12
call fcn.00416b3d
mov ecx, dword [ebp - 0x564]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x56c]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x570]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push str.win7.jumplist.kankan
lea ecx, [ebp - 0x540]
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x560]
mov dword [ebp - 4], 0x13
call fcn.00402ce0
push str.http:__www.xunlei.com__id137
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 0x14
call fcn.00402ce0
mov ecx, dword [ebp - 0x4d0]
push 0x4bbf78
lea eax, [ebp - 0x5c0]
push eax
mov byte [ebp - 4], 0x15
call fcn.0041826a
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x540]
push eax
mov byte [ebp - 4], 0x16
call fcn.00418843
mov ecx, dword [ebp - 0x4d0]
push eax
push edi
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x538]
push eax
push dword [ebp - 0x4d8]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax + 0x14]
call fcn.00416b3d
mov ecx, dword [ebp - 0x5c0]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x538]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x560]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x540]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push str.win7.jumplist.gougou
lea ecx, [ebp - 0x568]
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x548]
mov dword [ebp - 4], 0x17
call fcn.00402ce0
push str.http:__www.gougou.com__id94
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x18
call fcn.00402ce0
mov ecx, dword [ebp - 0x4d0]
push 0x4bbf30
lea eax, [ebp - 0x5a8]
push eax
mov byte [ebp - 4], 0x19
call fcn.0041826a
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x568]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00418843
mov ecx, dword [ebp - 0x4d0]
push eax
push edi
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x580]
push eax
push dword [ebp - 0x4d8]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax + 0x18]
call fcn.00416b3d
mov ecx, dword [ebp - 0x5a8]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x580]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x548]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x568]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push str.win7.jumplist.vip
lea ecx, [ebp - 0x558]
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x578]
mov dword [ebp - 4], 0x1b
call fcn.00402ce0
push str.http:__vip.xunlei.com__referfromXL_160
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x1c
call fcn.00402ce0
mov ecx, dword [ebp - 0x4d0]
push 0x4bbed4
lea eax, [ebp - 0x58c]
push eax
mov byte [ebp - 4], 0x1d
call fcn.0041826a
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x558]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00418843
push eax
push edi
lea eax, [ebp - 0x578]
push eax
mov ecx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x4f8]
push eax
push dword [ebp - 0x4d8]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax + 0x1c]
call fcn.00416b3d
mov ecx, dword [ebp - 0x58c]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x4f8]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x578]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x558]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push esi
lea ecx, [ebp - 0x4fc]
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x534]
mov dword [ebp - 4], 0x1f
call fcn.00402ce0
push esi
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0x20
call fcn.00402ce0
mov ecx, dword [ebp - 0x4d0]
push edi
push edi
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x52c]
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push 1
push dword [eax + 0x20]
mov byte [ebp - 4], 0x21
call fcn.00416b3d
mov ecx, dword [ebp - 0x52c]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x534]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x4fc]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
push esi
lea ecx, [ebp - 0x514]
call fcn.00402ce0
push str.http:__i.xunlei.com
lea ecx, [ebp - 0x50c]
mov dword [ebp - 4], 0x22
call fcn.00402ce0
push str.Username
lea ecx, [ebp - 0x504]
mov byte [ebp - 4], 0x23
call fcn.00402ce0
push edi
lea eax, [ebp - 0x514]
push edi
push eax
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x50c]
mov ecx, dword [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x504]
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
push edi
push dword [eax + 0x24]
call fcn.00416b3d
mov ecx, dword [ebp - 0x504]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x50c]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x514]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004014d5
mov esi, dword [ebp - 0x4d0]
mov eax, dword [ebx]
mov ebx, dword [eax + 4]
add ebx, 0x24
mov eax, dword [ebx]
cmp eax, edi
je 0x419c03
mov eax, dword [eax + 0x14]
cmp eax, edi
je 0x41996e
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esi + 0xe4]
cmp eax, edi
je 0x419b61
lea edx, [ebp - 0x4dc]
push edx
mov dword [ebp - 0x4dc], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
xor eax, eax
cmp word [ebp - 0x4dc], 0xffff
sete al
cmp eax, edi
je 0x419b61
mov eax, dword [esi + 0xe4]
cmp eax, edi
je 0x419b61
mov dword [ebp - 0x4dc], edi
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x4d0], edi
mov ecx, dword [eax]
lea edx, [ebp - 0x4d0]
push edx
push eax
mov byte [ebp - 4], 0x26
call dword [ecx + 0x2c]
mov dword [ebp - 0x4e4], edi
mov eax, dword [esi + 0xe4]
mov ecx, dword [eax]
lea edx, [ebp - 0x4e4]
push edx
push eax
mov byte [ebp - 4], 0x27
call dword [ecx + 0x20]
mov eax, dword [ebp - 0x4e4]
cmp eax, edi
je 0x419a0a
mov ecx, dword [eax]
lea edx, [ebp - 0x4dc]
push edx
push eax
call dword [ecx + 0x1c]
lea ecx, [ebp - 0x4e0]
call fcn.00401f19
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x594]
mov byte [ebp - 4], 0x28
call fcn.00402ce0
push dword [eax]
lea eax, [ebp - 0x4e0]
push 0x4bbe88
push eax
mov byte [ebp - 4], 0x29
call fcn.00416dd5
mov ecx, dword [ebp - 0x594]
add esp, 0xc
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x28
call fcn.004014d5
lea ecx, [ebp - 0x4e0]
call fcn.00414b9f
mov ecx, dword [ebx]
mov dword [ecx + 4], eax
push str.win7.jumplist.useronline
lea ecx, [ebp - 0x51c]
call fcn.00402ce0
lea eax, [ebp - 0x51c]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2a
call fcn.00418843
mov ecx, dword [ebx]
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0x51c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x28
call fcn.004014d5
push str.http:__jump.xunlei.com_jump__jump_key
lea ecx, [ebp - 0x4d4]
call fcn.00402ce0
push dword [ebp - 0x4d0]
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0x2b
call fcn.00402ce0
push eax
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0x2c
call fcn.0041746d
mov ecx, dword [ebp - 0x59c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x2b
call fcn.004014d5
push str.u1
lea ecx, [ebp - 0x4d4]
call fcn.00416f17
push str.http:__i.xunlei.com
lea ecx, [ebp - 0x4d4]
call fcn.00416f17
lea ecx, [ebp - 0x4d4]
call fcn.00414b9f
mov ecx, dword [ebx]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0x4d4]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0x4e0]
add ecx, 0xfffffff0
call fcn.004014d5
mov eax, dword [ebp - 0x4e4]
cmp eax, edi
mov byte [ebp - 4], 0x26
je 0x419b46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x4d0]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x4dc]
call esi
jmp 0x419c03
push str.gvU_
lea ecx, [ebp - 0x5a4]
call fcn.00402ce0
mov ecx, eax
mov dword [ebp - 4], 0x2d
call fcn.00414b9f
mov ecx, dword [ebx]
or dword [ebp - 4], 0xffffffff
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x5a4]
add ecx, 0xfffffff0
call fcn.004014d5
push str.win7.jumplist.useroffline
lea ecx, [ebp - 0x524]
call fcn.00402ce0
lea eax, [ebp - 0x524]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2e
call fcn.00418843
mov ecx, dword [ebx]
or dword [ebp - 4], 0xffffffff
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0x524]
add ecx, 0xfffffff0
call fcn.004014d5
push str.http:__i.xunlei.com
lea ecx, [ebp - 0x5ac]
call fcn.00402ce0
mov ecx, eax
mov dword [ebp - 4], 0x2f
call fcn.00414b9f
mov ecx, dword [ebx]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0x5ac]
add ecx, 0xfffffff0
call fcn.004014d5
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049f127
leave
ret 4