Function at 0x422c09
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0x10
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x2c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx], 0x5d75b5
push ebx
add ebx, 4
push ebx
push 8
call fcn.0042e1cd
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
add ebx, 4
push ebx
push 8
call fcn.0042e1cd
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
add ebx, 4
push ebx
push 0x10
call fcn.0042e1cd
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
pop ebx
pop ebx
push ebx
mov eax, esp
push eax
call fcn.0040c66e
pop ebx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x5c], eax
mov edi, eax
mov esi, 0x4ea38f
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x68], eax
mov edi, eax
mov esi, 0x4ea38f
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x74], eax
mov edi, eax
mov esi, 0x4ea38f
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
push 0xd
call fcn.004154d3
mov dword [ebp - 0x90], eax
push dword [ebp - 0x90]
push 0x7bccbf
mov ecx, 2
call fcn.004010c8
add esp, 8
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x422e49
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x422e60
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, str.Dalvik_1.6.0__Linux__U__Android_4.4.4__MI_3_MIUI_5.4.17_
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x422e7a
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push str.deviceId
mov ecx, 2
call fcn.004010c8
add esp, 8
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x422eb0
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
fild dword [ebp + 8]
fstp qword [ebp - 0x94]
fld qword [ebp - 0x94]
fsub qword [0x4ea39e]
fstp qword [ebp - 0x9c]
push 0x80000301
push 0
push 2
fld qword [ebp - 0x9c]
call fcn.004018d0
push 0x80000301
push 0
push eax
push 0x30004
push 0x160100b9
push 0x520100b6
push 3
mov eax, 2
mov ebx, 0x4b1330
call fcn.0042e1f7
add esp, 0x28
mov dword [ebp - 0xa0], eax
fild dword [ebp + 8]
fstp qword [ebp - 0xa8]
fld qword [ebp - 0xa8]
fsub qword [0x4ea39e]
fstp qword [ebp - 0xb0]
push 0x80000301
push 0
push 1
fld qword [ebp - 0xb0]
call fcn.004018d0
push 0x80000301
push 0
push eax
push 0x30004
push 0x160100b9
push 0x520100b6
push 3
mov eax, 2
mov ebx, 0x4b1330
call fcn.0042e1f7
add esp, 0x28
mov dword [ebp - 0xb4], eax
push dword [ebp - 0xb4]
push str.qs_253F_json_253Dtrue_2526sid_253Deshopmobile_signVEcuJqZg6TvZaPz_2BtqigVgmRUjA_3Duser
push dword [ebp - 0xa0]
push str._jsontruecallbackhttp_3A_2F_2Fapp.shopapi.xiaomi.com_2Fv1_2Fauthorize_2Fsso_callbacksideshopmobilepwd
mov ecx, 4
call fcn.004010c8
add esp, 0x10
mov dword [ebp - 0xb8], eax
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x422fbc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb4]
test ebx, ebx
je 0x422fcf
push ebx
call fcn.0042e1d3
add esp, 4
push dword [ebp - 8]
push str.Content_Type:_application_x_www_form_urlencoded_r_nHost:_account.xiaomi.com_r_nConnection:_Keep_Alive_r_nAccept_Encoding:__r_nContent_Length:_220_r_nUser_Agent:
mov ecx, 2
call fcn.004010c8
add esp, 8
mov dword [ebp - 0xbc], eax
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0xc0], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 0xc4], 0
push 0
push dword [ebp - 0xc4]
mov dword [ebp - 0xc8], 0
push 0
lea eax, [ebp - 0xc8]
push eax
mov dword [ebp - 0xcc], 0
push 0
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xd0], 0
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xd4], 0
push 0
lea eax, [ebp - 0xd4]
push eax
mov dword [ebp - 0xd8], 0
push 0
lea eax, [ebp - 0xd8]
push eax
push 1
push 1
mov dword [ebp - 0xdc], 0
push 0
lea eax, [ebp - 0xdc]
push eax
mov dword [ebp - 0xe0], 0
push 0
lea eax, [ebp - 0xe0]
push eax
push 1
lea eax, [ebp - 0xbc]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0xb8]
push eax
push 1
push 1
mov eax, str.https:__account.xiaomi.com_pass_serviceLoginAuth2
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004083d9
mov dword [ebp - 0xe8], eax
mov ebx, dword [ebp - 0xe4]
test ebx, ebx
je 0x423107
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb8]
test ebx, ebx
je 0x42311a
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xbc]
test ebx, ebx
je 0x42312d
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xe0]
test ebx, ebx
je 0x423140
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xd8]
test ebx, ebx
je 0x423153
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xd4]
test ebx, ebx
je 0x423166
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xcc]
test ebx, ebx
je 0x423179
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xc8]
test ebx, ebx
je 0x42318c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xc0]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x432c80
call fcn.0042e1e5
add esp, 0x10
call fcn.0042e1d3
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0xe8]
test eax, eax
jne 0x4231c8
mov eax, 0x4ea38f
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0xec], eax
mov ebx, dword [ebp - 0xe8]
test ebx, ebx
je 0x4231f4
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xec]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42320b
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040c16d
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x423235
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push 0x5d7450
push VariantClear
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42326a
mov eax, 0x4ea2d1
push eax
push 4
mov ebx, 0x42eda0
call fcn.0042e1e5
add esp, 0x34
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
je 0x425435
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov eax, str.___userId
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push eax
mov eax, str.location_:_
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00409925
mov dword [ebp - 0xa0], eax
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
je 0x4232fa
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x98]
test ebx, ebx
je 0x42330d
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xa0]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x423324
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push str.Content_Type:_application_x_www_form_urlencoded_r_nHost:_app.shopapi.xiaomi.com_r_nConnection:_Keep_Alive_r_nAccept_Encoding:__r_nUser_Agent:
mov ecx, 2
call fcn.004010c8
add esp, 8
mov dword [ebp - 0x90], eax
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x94], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x98], 0
push 0
push dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0xa0], 0
push 0
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa4], 0
push 0
push dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0
push 0
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xac], 0
push 0
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0xb0], 0
push 0
push dword [ebp - 0xb0]
mov dword [ebp - 0xb4], 0
push 0
lea eax, [ebp - 0xb4]
push eax
mov dword [ebp - 0xb8], 0
push 0
lea eax, [ebp - 0xb8]
push eax
push 1
lea eax, [ebp - 0x90]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xbc], 0
push 0
lea eax, [ebp - 0xbc]
push eax
mov dword [ebp - 0xc0], 0
push 0
push dword [ebp - 0xc0]
lea eax, [ebp - 0x18]
push eax
call fcn.004083d9
mov ebx, eax
test ebx, ebx
je 0x423468
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xbc]
test ebx, ebx
je 0x42347b
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x42348e
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb8]
test ebx, ebx
je 0x4234a1
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xac]
test ebx, ebx
je 0x4234b4
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x4234c7
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x4234da
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
je 0x4234ed
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x94]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x432c80
call fcn.0042e1e5
add esp, 0x10
call fcn.0042e1d3
add esp, 4
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
mov dword [ebp - 0x94], 0
push 0
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x98], 0
push 0
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x9c], 0
push 0
push dword [ebp - 0x9c]
mov dword [ebp - 0xa0], 0
push 0
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa4], 0
push 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa8], 0
push 0
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xac], 0
push 0
push dword [ebp - 0xac]
push 1
lea eax, [ebp - 0x20]
push eax
push 1
mov eax, str.Host:_a.hd.mi.com_r_nConnection:_keep_alive_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8_r_nUser_Agent:_Mozilla_5.0__Linux__Android_4.4.4__MI_3_Build_KTU84P__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_33.0.0.0_Mobile_Safari_537.36_XiaoMi_Shop_3.0.20150331_r_nReferer:_http:__s1.mi.com_m_product_minotetop_index.html_r_nAccept_Encoding:_gzip_deflate_r_nAccept_Language:_zh_CN_en_US_q0.8_r_nX_Requested_With:_com.xiaomi.shop
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xb0]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xb4], 0
push 0
lea eax, [ebp - 0xb4]
push eax
mov dword [ebp - 0xb8], 0
push 0
push dword [ebp - 0xb8]
mov eax, str.http:__a.hd.mi.com_productv2_book_a_36_m_1_s_miphone
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0040a916
mov dword [ebp - 0xc0], eax
mov ebx, dword [ebp - 0xbc]
test ebx, ebx
je 0x423623
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb4]
test ebx, ebx
je 0x423636
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb0]
test ebx, ebx
je 0x423649
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x42365c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
je 0x42366f
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x423682
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x98]
test ebx, ebx
je 0x423695
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x94]
test ebx, ebx
je 0x4236a8
push ebx
call fcn.0042e1d3
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0xc0]
test eax, eax
jne 0x4236be
mov eax, 0x4ea38f
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0xc4], eax
mov ebx, dword [ebp - 0xc0]
test ebx, ebx
je 0x4236ea
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xc4]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x423701
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov eax, str.__here_
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push eax
mov eax, str._a_href_
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00409925
mov dword [ebp - 0xa0], eax
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
je 0x42376f
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x98]
test ebx, ebx
je 0x423782
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xa0]
push eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x423799
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x24], eax
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x90], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x98], 0
push 0
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x9c], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0xa0], 0
push 0
push dword [ebp - 0xa0]
mov dword [ebp - 0xa4], 0
push 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa8], 0
push 0
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xac], 0
push 0
push dword [ebp - 0xac]
mov dword [ebp - 0xb0], 0
push 0
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0xb4], 0
push 0
lea eax, [ebp - 0xb4]
push eax
push 1
mov eax, str.Host:_a.hd.mi.com_r_nConnection:_keep_alive_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8_r_nUser_Agent:_Mozilla_5.0__Linux__Android_4.4.4__MI_3_Build_KTU84P__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_33.0.0.0_Mobile_Safari_537.36_XiaoMi_Shop_3.0.20150331_r_nReferer:_http:__s1.mi.com_m_product_minotetop_index.html_r_nAccept_Encoding:_deflate_r_nAccept_Language:_zh_CN_en_US_q0.8_r_nX_Requested_With:_com.xiaomi.shop
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xbc], 0
push 0
lea eax, [ebp - 0xbc]
push eax
mov dword [ebp - 0xc0], 0
push 0
push dword [ebp - 0xc0]
lea eax, [ebp - 0x24]
push eax
call fcn.004083d9
mov dword [ebp - 0xc4], eax
mov ebx, dword [ebp - 0xbc]
test ebx, ebx
je 0x4238d7
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb8]
test ebx, ebx
je 0x4238ea
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb4]
test ebx, ebx
je 0x4238fd
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x423910
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
je 0x423923
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
je 0x423936
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x98]
test ebx, ebx
je 0x423949
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x90]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x432c80
call fcn.0042e1e5
add esp, 0x10
call fcn.0042e1d3
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0xc4]
test eax, eax
jne 0x423985
mov eax, 0x4ea38f
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0xc8], eax
mov ebx, dword [ebp - 0xc4]
test ebx, ebx
je 0x4239b1
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xc8]
push eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x4239c8
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040c16d
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x4239f2
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x28], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str._title_
push VariantClear
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x423a27
mov eax, 0x4ea2d1
push eax
push 4
mov ebx, 0x42eda0
call fcn.0042e1e5
add esp, 0x34
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
jne 0x4253ba
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x98], 0
push 0
push dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push 0
push dword [ebp - 0x9c]
lea eax, [ebp - 0x28]
push eax
mov eax, str.sessionId_.1_20____useCommonAuthCode
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x423acc
push ebx
call fcn.0042e1d3
add esp, 4
mov dword [ebp - 0x90], 0
push 0
lea eax, [ebp - 0x90]
push eax
push 1
push 1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x423b14
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x98], 0
push 0
push dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push 0
push dword [ebp - 0x9c]
lea eax, [ebp - 0x28]
push eax
mov eax, str.authForForm_:__.1_10____productSource
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x423b97
push ebx
call fcn.0042e1d3
add esp, 4
mov dword [ebp - 0x90], 0
push 0
lea eax, [ebp - 0x90]
push eax
push 1
push 1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x423bdf
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x34], eax
xor ecx, ecx
lea eax, [ebp - 0x38]
mov ebx, eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, 3
jg 0x42440f
push dword [ebp - 0x30]
push str.http:__captcha.hd.mi.com_captcha_styleletterservicea.hd.mi.comsessionId
mov ecx, 2
call fcn.004010c8
add esp, 8
mov dword [ebp - 0x90], eax
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x94], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x98], 0
push 0
push dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0xa0], 0
push 0
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa4], 0
push 0
push dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0
push 0
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xac], 0
push 0
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0xb0], 0
push 0
push dword [ebp - 0xb0]
mov dword [ebp - 0xb4], 0
push 0
lea eax, [ebp - 0xb4]
push eax
mov dword [ebp - 0xb8], 0
push 0
lea eax, [ebp - 0xb8]
push eax
push 1
mov eax, str.Host:_captcha.hd.mi.com_r_nConnection:_keep_alive_r_nAccept:_image_webp___q0.8_r_nUser_Agent:_Mozilla_5.0__Linux__Android_4.4.4__MI_3_Build_KTU84P__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_33.0.0.0_Mobile_Safari_537.36_XiaoMi_Shop_3.0.20150331_r_nReferer:_http:__a.hd.mi.com_productv2_book_a_36_m_1_s_miphone_r_nAccept_Encoding:_deflate_r_nAccept_Language:_zh_CN_en_US_q0.8_r_nX_Requested_With:_com.xiaomi.shop
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xbc]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc0], 0
push 0
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 0xc4], 0
push 0
push dword [ebp - 0xc4]
lea eax, [ebp - 0x90]
push eax
call fcn.004083d9
mov dword [ebp - 0xc8], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x423d50
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xc0]
test ebx, ebx
je 0x423d63
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xbc]
test ebx, ebx
je 0x423d76
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb8]
test ebx, ebx
je 0x423d89
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xac]
test ebx, ebx
je 0x423d9c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x423daf
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x423dc2
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
je 0x423dd5
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x94]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x432c80
call fcn.0042e1e5
add esp, 0x10
call fcn.0042e1d3
add esp, 4
push 0
push dword [ebp - 0xc8]
push 0xffffffffffffffff
push 0xa
push 0x160127d1
push 0x520100b6
call fcn.0042e1eb
add esp, 0x18
mov ebx, dword [ebp - 0xc8]
test ebx, ebx
je 0x423e2c
push ebx
call fcn.0042e1d3
add esp, 4
push 0xffffffffffffffff
push 0x12
push 0x160127d0
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jne 0x423f7c
push 0xffffffffffffffff
push 8
push 0x160127d2
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x423e87
mov eax, 0x4ea2d1
push eax
push 1
mov ebx, 0x42e7f0
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x423eb3
push ebx
call fcn.0042e1d3
add esp, 4
cmp dword [ebp - 0x94], 4
jne 0x423f65
push 0xffffffffffffffff
push 8
push 0x160127d2
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x423ef2
mov eax, 0x4ea2d1
push eax
push 1
mov ebx, 0x42f440
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x423f1e
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [0x841458]
test ebx, ebx
je 0x423f38
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [0x841458], eax
push 0
push 0x4ea2d1
push 0xffffffffffffffff
push 8
push 0x160127d2
push 0x520100b6
call fcn.0042e1eb
add esp, 0x18
jmp 0x423f7c
push 0
mov ebx, 0x430de0
call fcn.0042e1e5
add esp, 4
jmp 0x423e55
push 0xffffffffffffffff
push 0x12
push 0x160127cf
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jne 0x423fcf
mov eax, str.1004
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x90]
push eax
call fcn.004201e2
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x423fcf
push ebx
call fcn.0042e1d3
add esp, 4
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
call fcn.00411fe3
mov dword [ebp - 0x94], eax
push str.callbackjsonp1
push dword [ebp - 0x94]
push str.servicea.hd.mi.com_
push dword [0x841458]
push str.http:__captcha.hd.mi.com_captcha_auth_answer
mov ecx, 5
call fcn.004010c8
add esp, 0x14
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp - 0x94]
test ebx, ebx
je 0x42402d
push ebx
call fcn.0042e1d3
add esp, 4
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x9c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0xa0], 0
push 0
push dword [ebp - 0xa0]
mov dword [ebp - 0xa4], 0
push 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa8], 0
push 0
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xac], 0
push 0
push dword [ebp - 0xac]
mov dword [ebp - 0xb0], 0
push 0
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0xb4], 0
push 0
lea eax, [ebp - 0xb4]
push eax
mov dword [ebp - 0xb8], 0
push 0
push dword [ebp - 0xb8]
mov dword [ebp - 0xbc], 0
push 0
lea eax, [ebp - 0xbc]
push eax
mov dword [ebp - 0xc0], 0
push 0
lea eax, [ebp - 0xc0]
push eax
push 1
mov eax, str.Host:_captcha.hd.mi.com_r_nConnection:_keep_alive_r_nAccept:_image_webp___q0.8_r_nUser_Agent:_Mozilla_5.0__Linux__Android_4.4.4__MI_3_Build_KTU84P__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_33.0.0.0_Mobile_Safari_537.36_XiaoMi_Shop_3.0.20150331_r_nReferer:_http:__a.hd.mi.com_productv2_book_a_36_m_1_s_miphone_r_nAccept_Encoding:_deflate_r_nAccept_Language:_zh_CN_en_US_q0.8_r_nX_Requested_With:_com.xiaomi.shop
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xc4]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc8], 0
push 0
lea eax, [ebp - 0xc8]
push eax
mov dword [ebp - 0xcc], 0
push 0
push dword [ebp - 0xcc]
lea eax, [ebp - 0x98]
push eax
call fcn.004083d9
mov dword [ebp - 0xd0], eax
mov ebx, dword [ebp - 0x98]
test ebx, ebx
je 0x42416a
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xc8]
test ebx, ebx
je 0x42417d
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xc4]
test ebx, ebx
je 0x424190
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xc0]
test ebx, ebx
je 0x4241a3
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb4]
test ebx, ebx
je 0x4241b6
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb0]
test ebx, ebx
je 0x4241c9
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x4241dc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
je 0x4241ef
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x9c]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x432c80
call fcn.0042e1e5
add esp, 0x10
call fcn.0042e1d3
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0xd0]
test eax, eax
jne 0x42422b
mov eax, 0x4ea38f
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0xd4], eax
mov ebx, dword [ebp - 0xd0]
test ebx, ebx
je 0x424257
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xd4]
push eax
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x42426e
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x3c], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.result_:true
push VariantClear
push 0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x4242a3
mov eax, 0x4ea2d1
push eax
push 4
mov ebx, 0x42eda0
call fcn.0042e1e5
add esp, 0x34
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
je 0x4243b8
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x98], 0
push 0
push dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push 0
push dword [ebp - 0x9c]
lea eax, [ebp - 0x3c]
push eax
mov eax, str._result_:true__token_:__.1_40____meta
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x424348
push ebx
call fcn.0042e1d3
add esp, 4
mov dword [ebp - 0x90], 0
push 0
lea eax, [ebp - 0x90]
push eax
push 1
push 1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x424390
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x40], eax
mov eax, 0x5dc4d8
push eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x4243aa
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x44], eax
jmp 0x42440f
push VariantClear
push 0
push 0x7bd538
push 0x80000301
push 0
push 1
push 0x30002
push 0x160100bb
push 0x520100b6
push 3
mov eax, 2
mov ebx, 0x4b1180
call fcn.0042e1f7
add esp, 0x28
push 0
mov ebx, 0x430de0
call fcn.0042e1e5
add esp, 4
pop ebx
pop ecx
jmp 0x423bea
add esp, 8
push 0x5dc4d8
push dword [ebp - 0x44]
call fcn.00401124
add esp, 8
cmp eax, 0
jne 0x42533f
push 0xffffffffffffffff
push 0x12
push 0x160127cd
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jne 0x424486
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x20]
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.004220bb
push 0xffffffffffffffff
push 0x12
push 0x160127cc
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jne 0x424f55
push 0
push 0
push 0
push 1
mov ebx, 0x42e850
call fcn.0042e1e5
add esp, 0x10
push 0xffffffffffffffff
push 8
push 0x1601253b
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
push 0
push 0
push 0
push VariantClear
push 0
push 0x4ea3ad
push VariantClear
push 0
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x42450b
mov eax, 0x4ea2d1
push eax
push 3
mov ebx, 0x42f670
call fcn.0042e1e5
add esp, 0x28
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x424537
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 0x5c]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x42455c
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x424558
imul eax, dword [ebx]
jmp 0x42454d
mov ecx, eax
test ecx, ecx
je 0x42457b
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x424574
push ebx
push eax
call fcn.0042e1d3
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x424562
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x5c], eax
mov ebx, dword [ebp - 0x5c]
call fcn.00401d79
mov dword [ebp - 0x60], eax
mov ebx, dword [ebp - 0x5c]
call fcn.004013e8
push ebx
push ecx
push 0x80000301
push 0
push dword [ebp - 0x60]
push 0x80000301
push 0
push 1
push 2
mov ebx, 0x42e890
call fcn.0042e1e5
add esp, 0x1c
dec eax
jns 0x4245d4
push 4
call fcn.0042e1d9
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x4245e7
push 1
call fcn.0042e1d9
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x94], ebx
mov ebx, dword [ebp - 0x94]
mov eax, dword [ebx]
test eax, eax
je 0x424613
push eax
mov ebx, eax
call fcn.0040105d
inc eax
push eax
call fcn.0042e1cd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x424624
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
call fcn.00414fa0
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424650
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push 0xffffffffffffffff
push 8
push 0x1601253d
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
push 0
push 0
push 0
push VariantClear
push 0
push 0x4ea3ad
push VariantClear
push 0
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x42469a
mov eax, 0x4ea2d1
push eax
push 3
mov ebx, 0x42f670
call fcn.0042e1e5
add esp, 0x28
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x4246c6
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 0x68]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4246eb
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4246e7
imul eax, dword [ebx]
jmp 0x4246dc
mov ecx, eax
test ecx, ecx
je 0x42470a
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x424703
push ebx
push eax
call fcn.0042e1d3
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4246f1
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x68]
call fcn.00401d79
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x68]
call fcn.004013e8
push ebx
push ecx
push 0x80000301
push 0
push dword [ebp - 0x6c]
push 0x80000301
push 0
push 1
push 2
mov ebx, 0x42e890
call fcn.0042e1e5
add esp, 0x1c
dec eax
jns 0x424763
push 4
call fcn.0042e1d9
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x424776
push 1
call fcn.0042e1d9
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x94], ebx
mov ebx, dword [ebp - 0x94]
mov eax, dword [ebx]
test eax, eax
je 0x4247a2
push eax
mov ebx, eax
call fcn.0040105d
inc eax
push eax
call fcn.0042e1cd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x70]
test ebx, ebx
je 0x4247b3
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push eax
call fcn.0041534d
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4247df
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
push 0xffffffffffffffff
push 8
push 0x1601253f
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
push 0
push 0
push 0
push VariantClear
push 0
push 0x4ea3ad
push VariantClear
push 0
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x424829
mov eax, 0x4ea2d1
push eax
push 3
mov ebx, 0x42f670
call fcn.0042e1e5
add esp, 0x28
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x424855
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 0x74]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x42487a
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x424876
imul eax, dword [ebx]
jmp 0x42486b
mov ecx, eax
test ecx, ecx
je 0x424899
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x424892
push ebx
push eax
call fcn.0042e1d3
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x424880
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x74], eax
mov ebx, dword [ebp - 0x74]
call fcn.00401d79
mov dword [ebp - 0x78], eax
mov ebx, dword [ebp - 0x74]
call fcn.004013e8
push ebx
push ecx
push 0x80000301
push 0
push dword [ebp - 0x78]
push 0x80000301
push 0
push 1
push 2
mov ebx, 0x42e890
call fcn.0042e1e5
add esp, 0x1c
dec eax
jns 0x4248f2
push 4
call fcn.0042e1d9
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x424905
push 1
call fcn.0042e1d9
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x94], ebx
mov ebx, dword [ebp - 0x94]
mov eax, dword [ebx]
test eax, eax
je 0x424931
push eax
mov ebx, eax
call fcn.0040105d
inc eax
push eax
call fcn.0042e1cd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x7c]
test ebx, ebx
je 0x424942
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004155d3
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp + 0x18]
mov ebx, dword [ebx]
test ebx, ebx
je 0x42496e
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 1
push 2
mov ebx, 0x42e890
call fcn.0042e1e5
add esp, 0x1c
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jne 0x424a40
push 1
push 1
push 3
call fcn.00416296
mov dword [ebp - 0x90], eax
push 4
call fcn.004154d3
mov dword [ebp - 0x94], eax
push str._163.com
push dword [ebp - 0x94]
push dword [ebp - 0x90]
mov ecx, 3
call fcn.004010c8
add esp, 0xc
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x424a09
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x94]
test ebx, ebx
je 0x424a1c
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424a35
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
jmp 0x424bf5
cmp dword [ebp - 0x80], 2
jne 0x424adf
push 1
push 1
push 3
call fcn.00416296
mov dword [ebp - 0x90], eax
push 4
call fcn.004154d3
mov dword [ebp - 0x94], eax
push str._sohu.com
push dword [ebp - 0x94]
push dword [ebp - 0x90]
mov ecx, 3
call fcn.004010c8
add esp, 0xc
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x424aa8
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x94]
test ebx, ebx
je 0x424abb
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424ad4
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
jmp 0x424bf5
cmp dword [ebp - 0x80], 3
jne 0x424b5b
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
call fcn.00411fe3
mov dword [ebp - 0x94], eax
push str._qq.com
push dword [ebp - 0x94]
mov ecx, 2
call fcn.004010c8
add esp, 8
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp - 0x94]
test ebx, ebx
je 0x424b37
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424b50
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
jmp 0x424bf5
cmp dword [ebp - 0x80], 4
jne 0x424bf5
push 1
push 1
push 3
call fcn.00416296
mov dword [ebp - 0x90], eax
push 4
call fcn.004154d3
mov dword [ebp - 0x94], eax
push str._126.com
push dword [ebp - 0x94]
push dword [ebp - 0x90]
mov ecx, 3
call fcn.004010c8
add esp, 0xc
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x424bc3
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x94]
test ebx, ebx
je 0x424bd6
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424bef
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
push 0xffffffffffffffff
push 8
push 0x16012539
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x424c27
mov eax, 0x4ea2d1
push eax
push 1
mov ebx, 0x42f440
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x90]
test ebx, ebx
je 0x424c53
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0x94]
push eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x424c6a
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x48], eax
push 0xffffffffffffffff
push 0x13
push 0x16012535
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
push 0x80000301
push 0
push eax
push 0x1000e
push 0x16012535
push 0x520100b6
push 2
mov ebx, 0x4316c0
call fcn.0042e1e5
add esp, 0x1c
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x424ce4
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x4c], eax
push 0xffffffffffffffff
push 9
push 0x16012535
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp + 0x24]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424d1d
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x24]
mov dword [ebx], eax
push 0xffffffffffffffff
push 0x13
push 0x16012536
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
push 0x80000301
push 0
push eax
push 0x1000e
push 0x16012536
push 0x520100b6
push 2
mov ebx, 0x4316c0
call fcn.0042e1e5
add esp, 0x1c
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x424d99
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x50], eax
push 0xffffffffffffffff
push 9
push 0x16012536
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp + 0x20]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424dd2
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x20]
mov dword [ebx], eax
push 0xffffffffffffffff
push 0x13
push 0x16012537
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
push 0x80000301
push 0
push eax
push 0x1000e
push 0x16012537
push 0x520100b6
push 2
mov ebx, 0x4316c0
call fcn.0042e1e5
add esp, 0x1c
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x424e4e
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x54], eax
push 0xffffffffffffffff
push 9
push 0x16012537
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp + 0x1c]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424e87
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], eax
push 0xffffffffffffffff
push 0x13
push 0x16012ba7
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
push 0x80000301
push 0
push eax
push 0x1000e
push 0x16012ba7
push 0x520100b6
push 2
mov ebx, 0x4316c0
call fcn.0042e1e5
add esp, 0x1c
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
mov ebx, dword [ebp - 0x84]
test ebx, ebx
je 0x424f06
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x84], eax
push 0xffffffffffffffff
push 9
push 0x16012ba7
push 0x520100b6
call fcn.0042e1f1
add esp, 0x10
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push eax
mov ebx, dword [ebp + 0x28]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424f42
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov ebx, dword [ebp + 0x28]
mov dword [ebx], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00422641
push 1
push 1
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
push dword [ebp + 0xc]
call fcn.00418247
mov dword [ebp - 0x94], eax
push 1
push 1
mov dword [ebp - 0x98], 0
push 0
push dword [ebp - 0x98]
push dword [ebp + 0x18]
call fcn.00418247
mov dword [ebp - 0x9c], eax
push dword [ebp - 0x40]
push str.protocolonauthcode_token
push dword [0x841458]
push 0x5d77ab
push dword [ebp - 0x58]
push 0x5d74c2
push dword [ebp - 0x48]
push str.postalcode
push dword [ebp - 0x9c]
push str.edittextarea
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push str.email
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push str.mobile
push dword [ebp - 0x94]
push str.insurance0product_5B_5DMIPHONEversionG3username
push dword [ebp - 0x34]
push str.area_aff
push dword [ebp - 0x54]
push str.dis
push dword [ebp - 0x50]
push str.city
push dword [ebp - 0x4c]
push str.province
mov ecx, 0x18
call fcn.004010c8
add esp, 0x60
mov dword [ebp - 0xa0], eax
mov ebx, dword [ebp - 0x94]
test ebx, ebx
je 0x425036
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
je 0x425049
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xa0]
push eax
mov ebx, dword [ebp - 0x88]
test ebx, ebx
je 0x425063
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x88], eax
push 8
call fcn.0042e1cd
add esp, 4
mov dword [ebp - 0x90], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x98], 0
push 0
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x9c], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0xa0], 0
push 0
push dword [ebp - 0xa0]
mov dword [ebp - 0xa4], 0
push 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa8], 0
push 0
lea eax, [ebp - 0xa8]
push eax
push 1
push 1
mov dword [ebp - 0xac], 0
push 0
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0xb0], 0
push 0
lea eax, [ebp - 0xb0]
push eax
push 1
mov eax, str.Host:_a.hd.mi.com_r_nConnection:_keep_alive_r_nAccept:___r_nOrigin:_http:__a.hd.mi.com_r_nX_Requested_With:_XMLHttpRequest_r_nUser_Agent:_Mozilla_5.0__Linux__Android_4.4.4__MI_3_Build_KTU84P__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_33.0.0.0_Mobile_Safari_537.36_XiaoMi_Shop_3.0.20150331_r_nContent_Type:_application_x_www_form_urlencoded_r_nReferer:_http:__a.hd.mi.com_productv2_book_a_36_m_1_s_miphone_r_nAccept_Encoding:_deflate_r_nAccept_Language:_zh_CN_en_US_q0.8
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xb4]
push eax
mov dword [ebp - 0xb8], 0
push 0
lea eax, [ebp - 0xb8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x88]
push eax
push 1
push 1
mov eax, str.http:__a.hd.mi.com_productv2_dobook_a_36_m_1_s_MIPHONE
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004083d9
mov dword [ebp - 0xc0], eax
mov ebx, dword [ebp - 0xbc]
test ebx, ebx
je 0x42519f
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb8]
test ebx, ebx
je 0x4251b2
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb4]
test ebx, ebx
je 0x4251c5
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xb0]
test ebx, ebx
je 0x4251d8
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x4251eb
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
je 0x4251fe
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
je 0x425211
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x98]
test ebx, ebx
je 0x425224
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x90]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x432c80
call fcn.0042e1e5
add esp, 0x10
call fcn.0042e1d3
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0xc0]
test eax, eax
jne 0x425260
mov eax, 0x4ea38f
push eax
push 1
mov ebx, 0x42ff00
call fcn.0042e1e5
add esp, 0x10
mov dword [ebp - 0xc4], eax
mov ebx, dword [ebp - 0xc0]
test ebx, ebx
je 0x42528c
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, dword [ebp - 0xc4]
push eax
mov ebx, dword [ebp - 0x8c]
test ebx, ebx
je 0x4252a6
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov dword [ebp - 0x8c], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.waitingUrl
push VariantClear
push 0
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x4252e1
mov eax, 0x4ea2d1
push eax
push 4
mov ebx, 0x42eda0
call fcn.0042e1e5
add esp, 0x34
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
je 0x425316
mov eax, 0x5dc4d8
jmp 0x4255ab
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x425335
push eax
mov ebx, eax
call fcn.0040105d
inc eax
push eax
call fcn.0042e1cd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4255ab
fild dword [ebp + 8]
fstp qword [ebp - 0x94]
fld qword [ebp - 0x94]
fsub qword [0x4ea39e]
fstp qword [ebp - 0x9c]
push VariantClear
push 0
push 0x7bd7ca
push 0x80000301
push 0
push 3
fld qword [ebp - 0x9c]
call fcn.004018d0
push 0x80000301
push 0
push eax
push 0x30004
push 0x160100b9
push 0x520100b6
push 4
mov eax, 2
mov ebx, 0x4b1500
call fcn.0042e1f7
add esp, 0x34
mov eax, 0x7bbbce
jmp 0x4255ab
fild dword [ebp + 8]
fstp qword [ebp - 0x94]
fld qword [ebp - 0x94]
fsub qword [0x4ea39e]
fstp qword [ebp - 0x9c]
push VariantClear
push 0
push 0x7bd7fd
push 0x80000301
push 0
push 3
fld qword [ebp - 0x9c]
call fcn.004018d0
push 0x80000301
push 0
push eax
push 0x30004
push 0x160100b9
push 0x520100b6
push 4
mov eax, 2
mov ebx, 0x4b1500
call fcn.0042e1f7
add esp, 0x34
mov eax, 0x7bbbce
jmp 0x4255ab
mov dword [ebp - 0x90], 0
push 0
push dword [ebp - 0x90]
mov dword [ebp - 0x94], 0
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x98], 0
push 0
push dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push 0
push dword [ebp - 0x9c]
lea eax, [ebp - 0x10]
push eax
mov eax, str._u4e00_u9fa5_1_20
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x4254b4
push ebx
call fcn.0042e1d3
add esp, 4
fild dword [ebp + 8]
fstp qword [ebp - 0x94]
fld qword [ebp - 0x94]
fsub qword [0x4ea39e]
fstp qword [ebp - 0x9c]
push 1
mov eax, 1
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x1c]
mov dword [ebp - 0xa4], eax
push 0x5d7921
push dword [ebp - 0xa4]
push 0x7bd82c
mov ecx, 3
call fcn.004010c8
add esp, 0xc
mov dword [ebp - 0xa8], eax
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
je 0x425532
push ebx
call fcn.0042e1d3
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 0xa8]
test eax, eax
jne 0x425548
mov eax, 0x4ea2d1
push eax
push 0x80000301
push 0
push 3
fld qword [ebp - 0x9c]
call fcn.004018d0
push 0x80000301
push 0
push eax
push 0x30004
push 0x160100b9
push 0x520100b6
push 4
mov eax, 2
mov ebx, 0x4b1500
call fcn.0042e1f7
add esp, 0x34
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x4255a1
push ebx
call fcn.0042e1d3
add esp, 4
mov eax, 0x7bbbce
jmp 0x4255ab
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4255bc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4255cc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4255dc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4255ec
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4255fc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x42560c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x42561c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x42562c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x42563c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x42564c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x2c]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x42566c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x42567c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x42568c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x42569c
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x4256ac
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x4256bc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x4256cc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x4256dc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x4256ec
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x4256fc
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x5c]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x42571a
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x425716
imul eax, dword [ebx]
jmp 0x42570b
mov ecx, eax
test ecx, ecx
je 0x425739
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x425732
push ebx
push eax
call fcn.0042e1d3
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x425720
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x425751
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x68]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x42576f
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x42576b
imul eax, dword [ebx]
jmp 0x425760
mov ecx, eax
test ecx, ecx
je 0x42578e
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x425787
push ebx
push eax
call fcn.0042e1d3
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x425775
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x70]
test ebx, ebx
je 0x4257a6
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x74]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4257c4
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4257c0
imul eax, dword [ebx]
jmp 0x4257b5
mov ecx, eax
test ecx, ecx
je 0x4257e3
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4257dc
push ebx
push eax
call fcn.0042e1d3
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4257ca
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x7c]
test ebx, ebx
je 0x4257fb
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x84]
test ebx, ebx
je 0x42580e
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x88]
test ebx, ebx
je 0x425821
push ebx
call fcn.0042e1d3
add esp, 4
mov ebx, dword [ebp - 0x8c]
test ebx, ebx
je 0x425834
push ebx
call fcn.0042e1d3
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x28