Function at 0x100d5660
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162c7d
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov esi, dword [0x101c82ac]
test esi, esi
jne 0x100d56ca
push 0x1c8
call fcn.1010a843
mov esi, eax
add esp, 4
mov dword [ebp - 0x2fc], esi
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1003f040
mov byte [ebp - 4], 0
mov dword [0x101c82ac], esi
add esi, 0xe4
cmp dword [esi + 0x14], 8
jb 0x100d56d8
mov esi, dword [esi]
mov eax, dword [0x101c82b0]
test eax, eax
jne 0x100d5703
push 8
call fcn.1010a843
mov dword [ebp - 0x2fc], eax
add esp, 4
mov dword [0x101c82b0], eax
mov dword [eax], vtable.CLibShareConfigManager.0
mov dword [eax + 4], 0
mov edx, dword [eax]
mov ecx, eax
push 0xcc
call dword [edx]
test eax, eax
jne 0x100d577c
push edi
cmp dword [ebp + 0x18], eax
jbe 0x100d572b
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push str.https:__www.baidu.com_s_tn_swd_s
jmp 0x100d5735
push str.https:__www.baidu.com_s_wd
push 0x10184440
lea eax, [ebp - 0x2e0]
push eax
call fcn.10041b40
add esp, 0x10
push esi
push 0
push str.SearchBaiduNum
push str.SearchCand
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
lea eax, [ebp - 0xd8]
push 0x10184420
push eax
call fcn.10041b40
add esp, 0xc
lea eax, [ebp - 0xd8]
push esi
push eax
push str.SearchBaiduNum
jmp 0x100d57e6
cmp dword [ebp + 0x18], 0
jbe 0x100d5796
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push edi
push str.https:__www.so.com_s_q_sls_s
jmp 0x100d57a1
push edi
push str.https:__www.so.com_s_q
push 0x10184440
lea eax, [ebp - 0x2e0]
push eax
call fcn.10041b40
add esp, 0x10
push esi
push 0
push str.Search360Num
push str.SearchCand
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
lea eax, [ebp - 0xd8]
push 0x10184420
push eax
call fcn.10041b40
add esp, 0xc
lea eax, [ebp - 0xd8]
push esi
push eax
push str.Search360Num
push str.SearchCand
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [0x101c86cc]
test eax, eax
jne 0x100d5821
push 0x2c8
call fcn.1010a843
add esp, 4
mov dword [ebp - 0x2fc], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.100d0c30
mov byte [ebp - 4], 0
mov dword [0x101c86cc], eax
mov ecx, dword [eax + 0x1b4]
test ecx, ecx
je 0x100d5876
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
je 0x100d5876
lea eax, [ebp - 0x2e0]
push eax
push str.microsoft_edge:_s
push 0x101cbdb8
call fcn.10041b40
add esp, 0xc
lea eax, [ebp - 0x2fc]
push eax
push 0
push 0x101cbdb8
push 0x100d5650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100d5908
xor eax, eax
mov dword [ebp - 0x2e4], 7
mov dword [ebp - 0x2e8], 0
mov word [ebp - 0x2f8], ax
mov byte [ebp - 4], 3
cmp dword [0x101c8710], eax
jne 0x100d58b4
push 0x20
call fcn.1010a843
mov dword [ebp - 0x2fc], eax
add esp, 4
mov dword [0x101c8710], eax
sub esp, 0x18
lea eax, [ebp - 0x2e0]
mov ecx, esp
push eax
call fcn.10041a70
call fcn.100475a0
mov eax, dword [ebp - 0x2e4]
add esp, 0x18
cmp eax, 8
jb 0x100d58eb
inc eax
lea ecx, [ebp - 0x2f8]
push eax
push dword [ebp - 0x2f8]
call fcn.10042120
xor eax, eax
mov dword [ebp - 0x2e4], 7
mov dword [ebp - 0x2e8], 0
mov word [ebp - 0x2f8], ax
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x100d591d
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.10042120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret