Function at 0x4b9ad0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c1e82
mov eax, dword fs:[0]
push eax
mov eax, 0x313c
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x310c], eax
xor eax, eax
push 0x208e
mov word [ebp - 0x20a0], ax
xor edi, edi
lea eax, [ebp - 0x209e]
push edi
push eax
call fcn.00596530
mov eax, dword [0x63696c]
mov ebx, 0x63696c
add esp, 0xc
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x312c], eax
mov esi, 0x6bad88
push esi
push str.http:__www.hao123.com__tn_s
lea eax, [ebp - 0x312c]
mov dword [ebp - 4], edi
call fcn.00404f66
mov eax, dword [0x63696c]
pop ecx
pop ecx
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3128], eax
xor ebx, ebx
push esi
inc ebx
push str.http:__www.baidu.com__tn_s
lea eax, [ebp - 0x3128]
mov byte [ebp - 4], bl
call fcn.00404f66
pop ecx
pop ecx
mov dword [ebp - 0x3124], edi
cmp dword [0x64590c], edi
jne 0x4b9d9e
mov dword [0x64590c], ebx
cmp dword [0x63d1e8], edi
je 0x4b9bb1
mov eax, 0x63d1f0
jmp 0x4b9bbe
call fcn.00401461
cmp eax, edi
je 0x4b9d9e
cmp word [eax], di
je 0x4b9d9e
mov ecx, str.__class
mov esi, eax
call fcn.004254af
push 7
pop esi
cmp eax, esi
je 0x4b9d9e
lea eax, [ebp - 0x3144]
push eax
call fcn.00440517
lea eax, [ebp - 0x3144]
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
call fcn.0042e174
mov eax, dword [ebp - 0x3134]
sub eax, dword [ebp - 0x3138]
pop ecx
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, edi
je 0x4b9d6f
xor ecx, ecx
mov dword [ebp - 0x3124], ebx
mov dword [ebp - 0x30ec], esi
mov dword [ebp - 0x30f0], edi
mov word [ebp - 0x3100], cx
mov byte [ebp - 4], 3
mov dword [ebp - 0x3108], edi
cmp eax, edi
jbe 0x4b9d40
push dword [ebp - 0x3108]
lea esi, [ebp - 0x3144]
call fcn.00404e8b
cmp dword [eax + 0x18], 8
jb 0x4b9c66
mov esi, dword [eax + 4]
jmp 0x4b9c69
lea esi, [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, esi
call fcn.0042de8f
pop ecx
test eax, eax
je 0x4b9ca2
push str.http:__www.hao123.com__tn92786829_o2_hao_pg
lea eax, [ebp - 0x3104]
push eax
call fcn.0046da7a
call fcn.0045f8eb
push ebx
push 0xa
pop ecx
mov edx, str.typeurl
call fcn.0045f9b4
jmp 0x4b9cce
push dword [ebp - 0x3108]
lea esi, [ebp - 0x3144]
call fcn.00404e8b
cmp dword [eax + 0x18], 8
jb 0x4b9cbe
mov eax, dword [eax + 4]
jmp 0x4b9cc1
add eax, 4
push eax
lea eax, [ebp - 0x3104]
push eax
call fcn.0046da7a
mov eax, dword [ebp - 0x3134]
sub eax, dword [ebp - 0x3138]
push 0x1c
cdq
pop ecx
idiv ecx
dec eax
cmp dword [ebp - 0x3108], eax
je 0x4b9cfa
push 0x5df2dc
lea eax, [ebp - 0x3104]
push eax
call fcn.0046da7a
call fcn.0045f8eb
push ebx
push 0x14
pop ecx
mov edx, str.siteurl
call fcn.0045f9b4
mov eax, dword [ebp - 0x3134]
sub eax, dword [ebp - 0x3138]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x3108]
cmp dword [ebp - 0x3108], eax
jb 0x4b9c4a
cmp dword [ebp - 0x30ec], 8
mov eax, dword [ebp - 0x3100]
jae 0x4b9d46
lea eax, [ebp - 0x3100]
push eax
push 0x5db9e0
lea eax, [ebp - 0x20a0]
push 0x1047
push eax
call fcn.0058f42f
add esp, 0x10
push edi
push ebx
lea esi, [ebp - 0x3104]
call fcn.00404eaf
jmp 0x4b9d83
push 0x1048
lea ebx, [ebp - 0x20a0]
call fcn.0045e408
xor ebx, ebx
pop ecx
inc ebx
lea esi, [ebp - 0x3144]
mov byte [ebp - 4], bl
call fcn.00404ef6
push dword [ebp - 0x3144]
call fcn.0058f3c4
jmp 0x4b9db1
push 0x1048
lea ebx, [ebp - 0x20a0]
call fcn.0045e408
xor ebx, ebx
inc ebx
xor eax, eax
pop ecx
cmp ax, word [ebp - 0x20a0]
jne 0x4b9dd7
push 0x7ffffffe
mov eax, str.juzi:newtab
mov ecx, 0x1048
lea edx, [ebp - 0x20a0]
call fcn.004054ba
lea eax, [ebp - 0x20a0]
mov dword [ebp - 0x3118], eax
mov dword [ebp - 0x3120], edi
cmp dword [0x6b4518], edi
je 0x4b9e3f
cmp dword [0x6b4564], edi
je 0x4b9e3f
cmp dword [0x6348a4], edi
je 0x4b9f6f
mov esi, str.juzi:last
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4b9f6f
mov ecx, dword [ebp - 0x310c]
push edi
push edi
push edi
push edi
push ebx
push ebx
push edi
mov edx, esi
mov dword [0x6348a4], edi
mov dword [ebp - 0x3120], ebx
call fcn.004ba40b
jmp 0x4b9f6f
call fcn.00463f39
call fcn.00465482
test eax, eax
je 0x4b9f6f
cmp dword [0x6348a8], edi
je 0x4b9f6f
mov eax, dword [0x63696c]
mov ecx, 0x63696c
mov dword [0x6348a8], edi
mov dword [ebp - 0x3120], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3108], eax
push 4
pop esi
lea eax, [ebp - 0x3110]
push eax
lea eax, [ebp - 0x311c]
push eax
lea eax, [ebp - 0x3114]
push eax
push 0x5f3c34
mov byte [ebp - 4], 4
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x311c], edi
mov dword [ebp - 0x3114], esi
mov dword [ebp - 0x3110], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4b9f0f
cmp dword [ebp - 0x3114], esi
jne 0x4b9f0f
cmp ax, word [0x63f288]
jne 0x4b9ee0
call fcn.00404168
mov esi, eax
jmp 0x4b9ee5
mov esi, 0x63f288
push dword [ebp - 0x311c]
call fcn.0042942a
movzx eax, al
push eax
push 0x6bad08
push esi
push str.http:__soft.123juzi.com_go.php_leafwelver_scid_sfop_di_d
lea eax, [ebp - 0x3108]
call fcn.00404f66
add esp, 0x14
jmp 0x4b9f4a
xor eax, eax
cmp ax, word [0x63f288]
jne 0x4b9f23
call fcn.00404168
mov esi, eax
jmp 0x4b9f28
mov esi, 0x63f288
call fcn.0042942a
movzx eax, al
push eax
push 0x6bad08
push esi
push str.http:__soft.123juzi.com_go.php_leafwelver_scid_sfop_d
lea eax, [ebp - 0x3108]
call fcn.00404f66
add esp, 0x10
mov esi, dword [ebp - 0x3108]
mov ecx, dword [ebp - 0x310c]
push edi
push edi
push edi
push edi
push ebx
push ebx
push edi
mov edx, esi
call fcn.004ba40b
lea eax, [esi - 0x10]
mov byte [ebp - 4], bl
call fcn.00407b6b
lea eax, [ebp - 0x20a0]
push 0x5df2dc
push eax
call fcn.0058fdd9
mov dword [ebp - 0x3108], eax
xor eax, eax
push 0x1046
mov word [ebp - 0x30e8], ax
lea eax, [ebp - 0x30e6]
push edi
push eax
mov dword [ebp - 0x3110], ebx
call fcn.00596530
add esp, 0x14
mov dword [ebp - 0x3114], edi
mov esi, dword [ebp - 0x3118]
cmp dword [ebp - 0x3108], edi
je 0x4b9fd0
mov ecx, dword [ebp - 0x3108]
xor eax, eax
add dword [ebp - 0x3108], 4
mov word [ecx], ax
cmp esi, edi
je 0x4ba187
cmp word [esi], di
je 0x4ba187
cmp dword [ebp + 0xc], edi
je 0x4ba035
mov ecx, str.about:blank
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ba013
cmp dx, di
je 0x4ba00f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ba013
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4b9fed
xor eax, eax
jmp 0x4ba018
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4ba113
push str.juzi:newtab
push esi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4ba113
mov ecx, dword [ebp - 0x310c]
push ebx
push edi
push edi
mov edx, esi
push ebx
cmp dword [ebp - 0x3110], edi
je 0x4ba058
xor eax, eax
cmp dword [ebp - 0x3120], edi
setne al
inc eax
push eax
jmp 0x4ba05a
push 2
push ebx
push edi
call fcn.004ba40b
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3110], eax
mov byte [ebp - 4], 5
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x311c], eax
mov byte [ebp - 4], 6
call fcn.004ab9aa
mov eax, dword [ebp - 0x310c]
mov ecx, dword [ebp - 0x3118]
mov ebx, dword [eax + 0x2c]
lea edi, [ebp - 0x311c]
lea esi, [ebp - 0x3110]
call fcn.004ac7b2
cmp dword [ebp - 0x3124], 0
je 0x4ba0e1
push dword [ebp - 0x3118]
mov edi, dword [ebp - 0x310c]
call fcn.004ba86c
test eax, eax
je 0x4ba0e1
mov dword [eax + 0x675c], 1
mov eax, dword [ebp - 0x311c]
add eax, 0xfffffff0
call fcn.00407b6b
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3110]
add eax, 0xfffffff0
call fcn.00407b6b
and dword [ebp - 0x3110], 0
mov esi, dword [ebp - 0x3118]
xor ebx, ebx
xor edi, edi
inc ebx
cmp dword [ebp + 0xc], edi
je 0x4ba187
mov ecx, str.about:blank
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ba145
cmp dx, di
je 0x4ba141
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ba145
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4ba11f
xor eax, eax
jmp 0x4ba14a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4ba167
push str.juzi:newtab
push esi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4ba167
mov dword [ebp - 0x3114], edi
jmp 0x4ba187
push esi
push 0x5db9e0
lea eax, [ebp - 0x30e8]
push 0x823
push eax
call fcn.0058f42f
add esp, 0x10
mov dword [ebp - 0x3114], ebx
mov esi, dword [ebp - 0x3108]
mov dword [ebp - 0x3118], esi
cmp esi, edi
je 0x4ba1b3
push 0x5df2dc
push esi
call fcn.0058fdd9
pop ecx
pop ecx
mov dword [ebp - 0x3108], eax
cmp word [esi], di
jne 0x4b9fb0
cmp dword [ebp - 0x3114], edi
je 0x4ba1e9
cmp word [ebp - 0x30e8], di
je 0x4ba1e9
mov eax, dword [ebp - 0x3120]
mov ecx, dword [ebp - 0x310c]
push edi
push edi
push edi
neg eax
push ebx
sbb eax, eax
and eax, 2
push eax
push ebx
push edi
lea edx, [ebp - 0x30e8]
call fcn.004ba40b
mov esi, dword [ebp - 0x312c]
cmp dword [0x6b4548], edi
je 0x4ba239
cmp dword [ebp - 0x3124], edi
je 0x4ba239
cmp dword [0x6348ac], edi
je 0x4ba239
mov dword [0x6348ac], edi
mov edi, dword [ebp - 0x310c]
push esi
call fcn.004ba86c
test eax, eax
jne 0x4ba239
call fcn.0042df6b
test eax, eax
je 0x4ba239
push ebx
xor eax, eax
push eax
push eax
push ebx
push 2
push ebx
push eax
mov edx, esi
mov ecx, edi
call fcn.004ba40b
mov eax, dword [ebp - 0x3128]
add eax, 0xfffffff0
call fcn.00407b6b
lea eax, [esi - 0x10]
call fcn.00407b6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058f3cf
leave
ret 8