Function at 0x4260f0
Capabilities:
Allocate or change rwx memory
Create directory
Create thread
Execute shellcode via indirect call
Get common file path
Get file attributes
Get graphical window text
Read .ini file
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x4c3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x834], ebx
jmp 0x426138
call dword [sym.imp.mfc140u.dll_CDialog::OnInitDialog]
push 0x4232f0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.mfc140u.dll_CMenu::FromHandle]
mov edi, eax
test edi, edi
je 0x4261c4
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x65
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
mov eax, dword [ebp - 0x818]
cmp dword [eax - 0xc], 0
je 0x4261b1
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
push 0x800
push dword [edi + 4]
call esi
push dword [ebp - 0x818]
push 0x10
push 0
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
call fcn.00426050
push dword [ebx + 0xd0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xd0]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
push 0
push 0
push 0x1037
push dword [ebx + 0xf4]
call esi
or eax, 0x20
push eax
push 0
push 0x1036
push dword [ebx + 0xf4]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CListCtrl::InsertColumn]
lea edi, [ebx + 0xd4]
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b87c4
push 0
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b87cc
push 1
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x14
push 0
push 0x4b87d4
push 2
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push str.:S_rg
push 3
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b87e4
push 4
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b87ec
push 5
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b87f4
push 6
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b87fc
push 7
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b8804
push 8
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b880c
push 9
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b8814
push 0xa
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b881c
push 0xb
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b8824
push 0xc
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b882c
push 0xd
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x50
push 2
push str._m
push 0xe
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b8848
push 0xf
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x19
push 0
push 0x4b8860
push 0x10
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x64
push 0
push 0x4b8874
push 0x11
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x78
push 0
push 0x4b8880
push 0x12
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x78
push 0
push 0x4b888c
push 0x13
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b8898
push 0x14
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b88a0
push 0x15
mov ecx, edi
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea ecx, [ebx + 0x1d4]
push 0x4b88ac
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x4b88ac
push 0
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b88b4
push 1
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b88bc
push 2
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b88c4
lea ecx, [ebx + 0x2e2c]
call edi
push 0x4b88c4
push 0
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b88cc
push 1
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b88d4
push 2
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b88dc
push 3
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b88e4
push 4
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b88ec
push 5
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0
push 0
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 1
push 1
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 2
push 2
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 3
push 3
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 4
push 4
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 5
push 5
push 0x151
push dword [ebx + 0x2e4c]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 0
call esi
lea ecx, [ebx + 0xaa4]
push 0
call esi
lea ecx, [ebx + 0xba4]
push 0
call esi
lea ecx, [ebx + 0x6a4]
push 0
call esi
lea ecx, [ebx + 0xa24]
push 0
call esi
lea ecx, [ebx + 0xca4]
push 0
call esi
lea ecx, [ebx + 0x172c]
push 0
call esi
lea ecx, [ebx + 0x1c2c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1bac]
call esi
lea ecx, [ebx + 0x1b2c]
push 0
call esi
lea ecx, [ebx + 0x112c]
push 0
call esi
lea ecx, [ebx + 0x142c]
push 0
call esi
lea ecx, [ebx + 0xea4]
push 0
call esi
lea ecx, [ebx + 0xf24]
push 0
call esi
lea ecx, [ebx + 0x1dac]
push 0
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
lea ecx, [ebx + 0x1bac]
push 0
call edi
lea ecx, [ebx + 0x24ac]
push 0
call esi
lea ecx, [ebx + 0x282c]
push 0
call esi
lea ecx, [ebx + 0x122c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1dac]
call esi
lea ecx, [ebx + 0x1eac]
push 0
call esi
push 0
lea ecx, [ebx + 0x122c]
call edi
mov eax, dword [ebx + 0x254]
add ebx, 0x254
mov esi, dword [ebp - 0x834]
mov ecx, ebx
push 0xe801
push 0x50008200
push 0
push esi
call dword [eax + 0x1b0]
lea eax, [ebp - 0x830]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x824]
mov ecx, ebx
push 1
push 0x19
push dword [ebp - 0x828]
add eax, 0xffffffe2
push eax
push 0
call dword [sym.imp.mfc140u.dll_CWnd::MoveWindow]
push 5
push str.efghi
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CStatusBar::SetIndicators]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::GetDlgCtrlID]
mov ecx, ebx
push 0x64
push 0x8000000
call edi
mov esi, dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneInfo]
mov ecx, ebx
push eax
push 0
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 1
mov ecx, ebx
call esi
push 0x1e
push 0x8000000
mov ecx, ebx
call edi
push eax
push 2
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 3
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 4
mov ecx, ebx
call esi
push 1
push 0
push 0
push 0
push 0
push 0xe8ff
push 0xe800
mov ecx, dword [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_CWnd::RepositionBars]
push 1
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
push str.D:LogInfo
mov dword [0x4c60c8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x4266d8
push 0
push str.D:LogInfo
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x200
lea eax, [ebp - 0x410]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x820]
mov dword [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x200
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 2
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x814]
push str._sIPsET.ini
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0xc
push dword [ebp - 0x814]
push 0
push 0x4b8928
push 0x4b8934
call edi
mov ebx, dword [ebp - 0x834]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c58], eax
push 0
push 0x4b893c
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x4c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x4c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60c4], eax
push 0
push 0x4b8944
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x544]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x544]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c64], eax
push 0
push str.Rf
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x744]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x744]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c50], eax
push 0
push 0x4b895c
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x7c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x7c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6114], eax
push 0
push 0x4b8968
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x844]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x844]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60c0], eax
push 0
push str.0R
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xb44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xb44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60bc], eax
push 0
push str.S__Y
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6110], eax
push 0
push 0x4b8990
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5b60], eax
push 0
push 0x4b8998
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52b0], eax
push 0
push 0x4b89a0
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xc44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xc44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c74], eax
push 0
push 0x4b89a8
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xe44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xe44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52c4], eax
push 0
push 0x4b70c8
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x134c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x134c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60ac], eax
push 0
push 0x4b89b4
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x13cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x13cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60d0], eax
push 0
push 0x4b89c4
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x14cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52bc], eax
push 0
push 0x4b89d0
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x15cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x15cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5b74], eax
push 0
push 0x4b89dc
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x374c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x374c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52c0], eax
push 0
push 0x4b89e8
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x27cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x27cc]
call esi
mov dword [0x4c5b7c], eax
push dword [ebp - 0x814]
push 0
push 0x4b89f4
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x16cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x16cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6124], eax
push 0
push 0x4b8a00
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x8c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x8c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c6c], eax
push 0
push str.R7R
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x264c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x264c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c60], eax
push 0
push 0x4b8a1c
push 0x4b8934
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x17cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x17cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52b4], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b8a28
push 0x4b8a34
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x162c]
call edi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b8a40
push 0x4b8a48
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2f2c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c41d0], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8a58
push 0x4b8a5c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x302c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c582c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8a68
push 0x4b8a6c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x312c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c5828], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8a78
push 0x4b8a80
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x31ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4250], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8a68
push 0x4b8a8c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x33ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c41cc], eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b8a68
push 0x4b8a9c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x352c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3734], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8a78
push 0x4b8aa8
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x36ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3730], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8ab4
push str._g0W
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x37ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3738], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8a68
push 0x4b8ac4
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x32ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c418c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8ad0
push 0x4b8ad4
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4c5ba0], al
push 0
movzx eax, al
push eax
push 0x14e
push dword [ebx + 0x2e4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b8ae4
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x18cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x18cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5b5c], eax
push 1
push 0x4b8af0
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1a4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b8afc
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x28cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x28cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60e8], eax
push 0
push 0x4b8b08
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x294c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x294c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60e0], eax
push 0
push 0x4b8b14
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2a4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2a4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6104], eax
push 0
push 0x4b8b20
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6100], eax
push 0
push 0x4b8b2c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2c4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2c4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60fc], eax
push 0
push 0x4b8b38
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6098], eax
push 0
push str.sQN
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60a0], eax
push 0
push 0x4b8b50
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2dcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2dcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5b9c], eax
push 0
push str.AwardOpt
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ecc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ecc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6118], eax
push 0
push 0x4b8b74
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c52c8], eax
push 0
push 0x4b8b80
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x30cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x30cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5b6c], eax
push 0
push 0x4b8b88
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x324c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x324c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6108], eax
push 0
push 0x4b8b94
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6138], eax
push 0
push 0x4b8ba0
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x334c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x334c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c6094], eax
push 0
push str.R_Rd
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x384c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x384c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5824], eax
push 0
push 0x4b8bbc
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5b50], eax
push 0
push 0x4b8bc8
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5b64], eax
push 0
push 0x4b8bd4
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x38cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x38cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5820], eax
push 0
push 0x4b8be0
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c4c], eax
push 0
push 0x4b8bf0
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3c4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3c4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5c5c], eax
push 0
push 0x4b8bf8
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c609c], eax
push 0
push 0x4b8c04
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x39cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x39cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c60cc], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b8a58
push 0x4b8c10
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x392c]
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
push 0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x818]
push 0
push 0
push 0
push dword [eax - 0xc]
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0
push 0
call edi
mov ecx, dword [ebp - 0x818]
mov esi, eax
push 0
push 0
push esi
push 0x4c580c
push dword [ecx - 0xc]
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
push 0
call edi
lea ecx, [ebp - 0x818]
mov byte [esi + 0x4c580c], 0
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x814]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b8ab4
push 0x4b8c1c
push 0x4b8934
call edi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4190], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push str.750000
push 0x4b8c3c
push 0x4b8934
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3aac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
mov dword [0x4c4254], eax
push 0
push 0
push 0xf0
push dword [ebx + 0x1a4c]
call edi
push dword [ebp - 0x814]
neg eax
push 0
sbb al, al
push 0x4b8c48
add al, 2
push 0x4b8934
mov byte [0x4c34cf], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x64
jne 0x4276f8
push 0
push 1
push 0xf1
push dword [ebx + 0x104c]
call edi
mov dword [0x4c41d4], 0x64
jmp 0x42773c
cmp eax, 0x12c
jne 0x42771c
push 0
push 1
push 0xf1
push dword [ebx + 0x10cc]
call edi
mov dword [0x4c41d4], 0x12c
jmp 0x42773c
cmp eax, 0xa
jne 0x42773c
push 0
push 1
push 0xf1
push dword [ebx + 0xfcc]
call edi
mov dword [0x4c41d4], 0xa
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7d98
push 0x4b8c54
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x427776
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b8c60
push 0x4b8c64
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4277c5
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x272c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c425c], eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.20000
push 0x4b8c7c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0xda4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b8c88
push 0x4b8c90
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x21ac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c6090], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8c60
push 0x4b8c9c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x152c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3724], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8cac
push 0x4b8cb4
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x9a4]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c5b8c], eax
mov dword [0x4c5830], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8a68
push 0x4b8cbc
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1e2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4c34ce], al
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.1000
push 0x4b8cd4
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x182c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c5808], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8cac
push 0x4b8ce0
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2b2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
add esp, 4
lea eax, [ebp - 0x210]
fstp qword [0x4c41d8]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b8cec
push 0x4b8cf4
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x192c]
call esi
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
lea eax, [ebp - 0x210]
push eax
call esi
add esp, 4
mov dword [0x4c5800], eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x81c], 0
push eax
push 0x40
push 0x563
push dword [0x4c373c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0042dd40
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 3
mov byte [ebp - 4], 4
call dword [sym.imp.plfl32.dll_P_GetDataValue]
push eax
lea eax, [ebp - 0x818]
push 0x4b7a7c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push dword [ebp - 0x818]
call esi
add esp, 0x10
mov dword [0x4c611c], eax
push 0
call dword [sym.imp.plfl32.dll_P_GetInfo]
push eax
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x818]
push 0x4b721c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 1
call esi
push dword [ebp - 0x814]
push 0
push 0x4b8d00
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x644]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x644]
call edi
push 1
lea ecx, [ebx + 0xa24]
mov dword [0x4c6130], eax
call esi
push 1
lea ecx, [ebx + 0xca4]
call esi
push 1
lea ecx, [ebx + 0x142c]
call esi
push dword [ebp - 0x814]
push 0
push str._rN9e
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x144c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x144c]
call edi
push dword [ebp - 0x814]
mov dword [0x4c5c7c], eax
push 0
push 0x4b8d18
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xa44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xa44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c5c84], eax
push 0
push 0x4b8d24
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xcc4]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xcc4]
call edi
mov dword [0x4c5c80], eax
mov eax, dword [0x4c611c]
cmp eax, 2
jl 0x427c49
push 1
lea ecx, [ebx + 0x1bac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1bac]
call esi
push 1
lea ecx, [ebx + 0x122c]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1dac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1eac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x122c]
call esi
push 1
lea ecx, [ebx + 0x1dac]
call esi
push 1
lea ecx, [ebx + 0x1eac]
call esi
mov eax, dword [0x4c611c]
cmp eax, 5
jne 0x427cb4
push 1
lea ecx, [ebx + 0x1c2c]
call esi
push 1
lea ecx, [ebx + 0x6a4]
call esi
push 1
lea ecx, [ebx + 0x172c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b8d2c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x174c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x174c]
call edi
mov dword [0x4c52b8], eax
mov eax, dword [0x4c611c]
cmp eax, 5
je 0x427cc7
cmp eax, 3
je 0x427cc7
cmp eax, 4
je 0x427cc7
cmp eax, 6
jne 0x427e34
push 1
lea ecx, [ebx + 0x1b2c]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.80000
push 0x4b8d44
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1b2c]
call dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4290], eax
lea ecx, [ebx + 0xd24]
push 1
call esi
push 1
lea ecx, [ebx + 0x112c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b8d4c
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xd44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xd44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c5c44], eax
push 0
push 0x4b8d58
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x114c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x114c]
call edi
push 1
lea ecx, [ebx + 0xea4]
mov dword [0x4c610c], eax
call esi
push 1
lea ecx, [ebx + 0xf24]
call esi
push 1
lea ecx, [ebx + 0x24ac]
call esi
push 1
lea ecx, [ebx + 0x282c]
call esi
push 1
lea ecx, [ebx + 0xea4]
call esi
push 1
lea ecx, [ebx + 0x202c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b8d64
push 0x4b8934
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x204c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x204c]
call edi
mov dword [0x4c5b90], eax
mov eax, dword [0x4c611c]
cmp eax, 6
je 0x427e39
cmp eax, 5
jne 0x427e63
push 1
lea ecx, [ebx + 0xaa4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xac4]
call edi
push 1
lea ecx, [ebx + 0xba4]
mov dword [0x4c60b8], eax
call esi
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
push 0
push 0x4c5c88
push 0
call esi
call fcn.004254b0
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x427efa
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x810]
push 0
push 0x10
push eax
push 0
call esi
lea eax, [ebp - 0x810]
push eax
push 0x4b8d70
push 0x4c52e8
call fcn.004203f0
push 0
push 0
push 0
push 0x42a470
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x427f27
push 0x42c790
push 0x2710
push 0x2767
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x425ff0
push 0xfffffffffffffffc
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 0x4c5c0c
mov dword [0x4c52e4], eax
mov ecx, str.dxdir1.speed.qq.com
call fcn.004234c0
mov edx, 0x4c5bd8
mov ecx, str.wtdir1.speed.qq.com
call fcn.004234c0
mov edx, 0x4c5ba4
mov ecx, str.dx2dir1.speed.qq.com
call fcn.004234c0
mov ecx, 0x4c5c0c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427f71
sub ecx, edx
je 0x427fa2
mov ecx, 0x4c5bd8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427f84
sub ecx, edx
je 0x427fa2
mov ecx, 0x4c5ba4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427f97
sub ecx, edx
jne 0x427fb6
push 0
push str.speed.qq.com
push 0x4b8dd0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x427fc6
lea ecx, [ebp - 0x820]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044627d
mov esp, ebp
pop ebp
ret