Function at 0x4463b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f02b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x639354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x643da0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x641c04]
cmp eax, dword [ecx + 4]
jg 0x447b14
mov eax, dword [0x641bf8]
cmp eax, dword [0x641bfc]
jne 0x447a91
lea ecx, [ebp - 0x60]
call fcn.00444860
push 7
push str.360safe
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0
call fcn.0042a060
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5b8734
mov byte [ebp - 4], 1
shr eax, 0x10
mov ecx, 0x5b8734
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x44646a
movzx eax, cx
lea ecx, [ebp - 0x18]
push eax
call fcn.00429d90
jmp 0x446479
push 0
push 0x5b8734
lea ecx, [ebp - 0x18]
call fcn.0042a060
mov byte [ebp - 4], 2
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, str.InstallLocation
mov byte [ebp - 4], 3
shr eax, 0x10
mov ecx, str.InstallLocation
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4464bd
movzx eax, cx
lea ecx, [ebp - 0x14]
push eax
call fcn.00429d90
jmp 0x4464cc
push 0xf
push str.InstallLocation
lea ecx, [ebp - 0x14]
call fcn.0042a060
mov byte [ebp - 4], 4
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b54
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446508
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446514
push 0x3b
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360
call fcn.0042a060
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
push eax
mov dword [ebp - 0x34], 0x80000002
mov dword [ebp - 0x20], eax
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xfffffff0
mov byte [ebp - 4], 7
push ebx
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x18]
add esi, 0xfffffff0
mov byte [ebp - 4], 8
push esi
call fcn.00429b80
add eax, 0x10
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x80000002
call fcn.004297a0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x54]
call fcn.004297a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x50]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x20]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4465b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4465c8
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4465e0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.360Safe.exe
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446618
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446624
push 0xb
push str.360Safe.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0xb
cmp ebx, dword [ebp - 0x44]
je 0x44664a
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x44665a
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446675
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.deepscanzhudongfangyu.exe
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x4466ad
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4466b9
push 0x1a
push str.deepscanzhudongfangyu.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0xd
cmp ebx, dword [ebp - 0x44]
je 0x4466df
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x4466ef
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44670a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.EfiMon.sys
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446742
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x44674e
push 0xa
push str.EfiMon.sys
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0xf
cmp ebx, dword [ebp - 0x44]
je 0x446774
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x446784
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44679f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.360SelfProtection
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x4467d7
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4467e3
push 0x11
push str.360SelfProtection
call fcn.0042a060
mov ebx, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x11
cmp ebx, dword [ebp - 0x38]
je 0x446809
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x3c], 4
jmp 0x446819
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446834
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.360netmon
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x44686c
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446878
push 9
push str.360netmon
call fcn.0042a060
mov ebx, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x13
cmp ebx, dword [ebp - 0x38]
je 0x44689e
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x3c], 4
jmp 0x4468ae
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4468c9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
lea ecx, [ebp - 0x60]
push ecx
cmp eax, dword [0x641c00]
je 0x4468ea
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x4468f5
push eax
mov ecx, 0x641bf8
call fcn.00443c90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00429720
lea ecx, [ebp - 0x4c]
call fcn.00429720
lea ecx, [ebp - 0x5c]
call fcn.00445220
mov edx, dword [ebp - 0x60]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44692e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x60]
call fcn.00444860
push 5
push str.360sd
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0x14
call fcn.0042a060
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x15
jne 0x446983
mov eax, 0x5b8734
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x44698f
push 0
push 0x5b8734
call fcn.0042a060
mov byte [ebp - 4], 0x16
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b5e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x17
jne 0x4469ca
mov eax, str.InstallLocation
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4469d6
push 0xf
push str.InstallLocation
call fcn.0042a060
mov byte [ebp - 4], 0x18
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b68
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360SD
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x446a12
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446a1e
push 0x39
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360SD
call fcn.0042a060
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1a
push eax
mov dword [ebp - 0x34], 0x80000002
mov dword [ebp - 0x24], eax
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xfffffff0
mov byte [ebp - 4], 0x1b
push ebx
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x1c
push esi
call fcn.00429b80
add eax, 0x10
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x80000002
call fcn.004297a0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x54]
call fcn.004297a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x50]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x24]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446abb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x446acf
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446ae7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.360sd.exe
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446b1f
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446b2b
push 9
push str.360sd.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x1f
cmp ebx, dword [ebp - 0x44]
je 0x446b51
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x446b61
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0x14
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446b7c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.360rps.exe
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446bb4
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446bc0
push 0xa
push str.360rps.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x21
cmp ebx, dword [ebp - 0x44]
je 0x446be6
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x446bf6
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0x14
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446c11
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.360rp
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446c49
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446c55
push 5
push str.360rp
call fcn.0042a060
mov ebx, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x23
cmp ebx, dword [ebp - 0x38]
je 0x446c7b
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x3c], 4
jmp 0x446c8b
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0x14
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446ca6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
lea ecx, [ebp - 0x60]
push ecx
cmp eax, dword [0x641c00]
je 0x446cc7
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x446cd2
push eax
mov ecx, 0x641bf8
call fcn.00443c90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00429720
lea ecx, [ebp - 0x4c]
call fcn.00429720
lea ecx, [ebp - 0x5c]
call fcn.00445220
mov edx, dword [ebp - 0x60]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446d0b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x60]
call fcn.00444860
push 7
push str.baidusd
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0x24
call fcn.0042a060
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x25
jne 0x446d60
mov eax, 0x5b8734
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446d6c
push 0
push 0x5b8734
call fcn.0042a060
mov byte [ebp - 4], 0x26
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b72
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, str.UninstallString
mov byte [ebp - 4], 0x27
shr eax, 0x10
mov ecx, str.UninstallString
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x446db0
movzx eax, cx
lea ecx, [ebp - 0x14]
push eax
call fcn.00429d90
jmp 0x446dbf
push 0xf
push str.UninstallString
lea ecx, [ebp - 0x14]
call fcn.0042a060
mov byte [ebp - 4], 0x28
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b7c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, 0x5bd880
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x18]
test eax, 0xffff0000
jne 0x446dfb
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446e07
push 0x38
push 0x5bd880
call fcn.0042a060
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x2a
push eax
mov dword [ebp - 0x34], 0x80000002
mov dword [ebp - 0x24], eax
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xfffffff0
mov byte [ebp - 4], 0x2b
push ebx
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x2c
push esi
call fcn.00429b80
add eax, 0x10
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x80000002
call fcn.004297a0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x54]
call fcn.004297a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x50]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x24]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446ea4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x446eb8
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x24
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446ed0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.baidusdSvc.exe
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446f08
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446f14
push 0xe
push str.baidusdSvc.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x2f
cmp ebx, dword [ebp - 0x44]
je 0x446f3a
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x446f4a
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0x24
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446f65
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.baidusd.exe
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x446f9d
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x446fa9
push 0xb
push str.baidusd.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x31
cmp ebx, dword [ebp - 0x44]
je 0x446fcf
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x446fdf
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0x24
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446ffa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
lea ecx, [ebp - 0x60]
push ecx
cmp eax, dword [0x641c00]
je 0x44701b
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x447026
push eax
mov ecx, 0x641bf8
call fcn.00443c90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00429720
lea ecx, [ebp - 0x4c]
call fcn.00429720
lea ecx, [ebp - 0x5c]
call fcn.00445220
mov edx, dword [ebp - 0x60]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44705f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x60]
call fcn.00444860
push 9
push str.baidusafe
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0x32
call fcn.0042a060
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b86
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x33
jne 0x4470b4
mov eax, 0x5b8734
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4470c0
push 0
push 0x5b8734
call fcn.0042a060
mov byte [ebp - 4], 0x34
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b90
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x20], 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x35
jne 0x4470fb
mov eax, str.UninstallString
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x447107
push 0xf
push str.UninstallString
call fcn.0042a060
mov byte [ebp - 4], 0x36
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b9a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x1c]
test eax, 0xffff0000
jne 0x447143
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x44714f
push 0x38
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
call fcn.0042a060
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x38
push eax
mov dword [ebp - 0x34], 0x80000002
mov dword [ebp - 0x24], eax
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x18]
add ebx, 0xfffffff0
mov byte [ebp - 4], 0x39
push ebx
call fcn.00429b80
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x3a
push esi
call fcn.00429b80
add eax, 0x10
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x3b
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x80000002
call fcn.004297a0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x54]
call fcn.004297a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x50]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x24]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4471ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x447200
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x32
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x447218
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.BaiduAn.exe
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x447250
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x44725c
push 0xb
push str.BaiduAn.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x3d
cmp ebx, dword [ebp - 0x44]
je 0x447282
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x447292
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0x32
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4472ad
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00429250
mov ecx, eax
test ecx, ecx
je 0x447b4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.BaiduAnTray.exe
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x4472e5
movzx eax, ax
push eax
call fcn.00429d90
jmp 0x4472f1
push 0xf
push str.BaiduAnTray.exe
call fcn.0042a060
mov ebx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x3f
cmp ebx, dword [ebp - 0x44]
je 0x447317
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x48], 4
jmp 0x447327
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004293a0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0x32
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x447342
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
lea ecx, [ebp - 0x60]
push ecx
cmp eax, dword [0x641c00]
je 0x447363
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x44736e
push eax
mov ecx, 0x641bf8
call fcn.00443c90
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.00445280
lea ecx, [ebp - 0x8c]
call fcn.00444860
push 6
push str.rising
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0x40
call fcn.0042a060
push 0x5b8734
lea ecx, [ebp - 0x14]
call fcn.004445b0
push str.installpath
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x41
call fcn.004445b0
push str.SOFTWARE_risingRAV
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x42
call fcn.004445b0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x43
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x80000002
lea ecx, [ebp - 0x34]
call fcn.00444700
mov esi, eax
mov ecx, dword [esi]
mov dword [ebp - 0x88], ecx
lea ecx, [esi + 4]
push ecx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x44
call fcn.004297a0
lea ecx, [esi + 8]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004297a0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447444
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44745e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, edi
mov byte [ebp - 4], 0x40
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44747c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.rstray.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
mov esi, dword [ebp - 0x74]
mov byte [ebp - 4], 0x45
cmp esi, dword [ebp - 0x70]
je 0x4474af
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
push eax
call fcn.00429b80
add eax, 0x10
add esp, 4
mov dword [esi], eax
add dword [ebp - 0x74], 4
jmp 0x4474bc
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp - 0x78]
call fcn.004293a0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x40
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4474da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.rsmain.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x46
push eax
lea ecx, [ebp - 0x78]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x40
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447515
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.ravmond.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x47
push eax
lea ecx, [ebp - 0x78]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x40
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447550
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.rsravmon
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x48
push eax
lea ecx, [ebp - 0x6c]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x40
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44758b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
lea ecx, [ebp - 0x8c]
push ecx
cmp eax, dword [0x641c00]
je 0x4475af
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x4475ba
push eax
mov ecx, 0x641bf8
call fcn.00443c90
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
call fcn.00445280
lea ecx, [ebp - 0x60]
call fcn.00444860
push 4
push str.duba
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0x49
call fcn.0042a060
push 0x5b8734
lea ecx, [ebp - 0x14]
call fcn.004445b0
push str.ProgramPath
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x4a
call fcn.004445b0
push str.softwarekingsoft_antivirus
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x4b
call fcn.004445b0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x4c
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x80000002
lea ecx, [ebp - 0x34]
call fcn.00444700
mov esi, eax
mov ecx, dword [esi]
mov dword [ebp - 0x5c], ecx
lea ecx, [esi + 4]
push ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x4d
call fcn.004297a0
lea ecx, [esi + 8]
push ecx
lea ecx, [ebp - 0x54]
call fcn.004297a0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x50]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447687
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4476a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, edi
mov byte [ebp - 4], 0x49
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4476bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.kxetray.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x4e
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x49
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4476fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.kislive.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x49
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447735
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.kismain.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x50
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x49
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447770
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
lea ecx, [ebp - 0x60]
push ecx
cmp eax, dword [0x641c00]
je 0x447791
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x44779c
push eax
mov ecx, 0x641bf8
call fcn.00443c90
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.00445280
lea ecx, [ebp - 0x8c]
call fcn.00444860
push 7
push str.QQPCMgr
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0x51
call fcn.0042a060
push 0x5b8734
lea ecx, [ebp - 0x14]
call fcn.004445b0
push str.InstallDir
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x52
call fcn.004445b0
push str.SOFTWARETencentQQPCMgr
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x53
call fcn.004445b0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x54
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x80000002
lea ecx, [ebp - 0x34]
call fcn.00444700
mov esi, eax
mov ecx, dword [esi]
mov dword [ebp - 0x88], ecx
lea ecx, [esi + 4]
push ecx
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x55
call fcn.004297a0
lea ecx, [esi + 8]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004297a0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447872
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44788c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, edi
mov byte [ebp - 4], 0x51
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4478aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.QQPCMgr.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x56
push eax
lea ecx, [ebp - 0x78]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x51
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4478e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.QQPCRTP.exe
lea ecx, [ebp - 0x1c]
call fcn.004445b0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x57
push eax
lea ecx, [ebp - 0x78]
call fcn.0044a5c0
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov byte [ebp - 4], 0x51
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447920
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
lea ecx, [ebp - 0x8c]
push ecx
cmp eax, dword [0x641c00]
je 0x447944
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x44794f
push eax
mov ecx, 0x641bf8
call fcn.00443c90
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
call fcn.00445280
lea ecx, [ebp - 0x60]
call fcn.00444860
push 7
push str.huorong
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0x58
call fcn.0042a060
push 0x5b8734
lea ecx, [ebp - 0x14]
call fcn.004445b0
push str.UninstallString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x59
call fcn.004445b0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHuorongSysdiag
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x5a
call fcn.004445b0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x5b
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x80000002
lea ecx, [ebp - 0x34]
call fcn.00444700
mov esi, eax
mov ecx, dword [esi]
mov dword [ebp - 0x5c], ecx
lea ecx, [esi + 4]
push ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x5c
call fcn.004297a0
lea ecx, [esi + 8]
push ecx
lea ecx, [ebp - 0x54]
call fcn.004297a0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x50]
call fcn.004297a0
lea ecx, [ebp - 0x34]
call fcn.00445220
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447a1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447a36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x58
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x447a52
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x641bfc]
cmp eax, dword [0x641c00]
je 0x447a73
lea ecx, [ebp - 0x60]
push ecx
mov ecx, eax
call fcn.00444790
add dword [0x641bfc], 0x2c
jmp 0x447a82
lea edx, [ebp - 0x60]
mov ecx, 0x641bf8
push edx
push eax
call fcn.00443c90
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.00445280
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [0x641bfc]
mov ebx, dword [0x641bf8]
mov dword [ebp - 0x24], eax
cmp ebx, eax
je 0x447b00
mov ecx, eax
mov eax, 0x2e8ba2e9
sub ecx, ebx
imul ecx
mov ecx, edi
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
push esi
call fcn.00449b30
imul ecx, esi, 0x2c
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp - 0x20], edi
add ecx, eax
mov dword [edi + 8], ecx
push edi
push dword [edi]
mov dword [ebp - 4], 0x5d
push dword [ebp - 0x24]
push ebx
call fcn.00444210
add esp, 0x10
mov dword [edi + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x641c04
call fcn.0055c868
add esp, 4
cmp dword [0x641c04], 0xffffffff
jne 0x4463fb
push 0x5b4500
call fcn.0055cb7a
push 0x641c04
call fcn.0055c81e
add esp, 8
jmp 0x4463fb
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
push 0x80004005
call fcn.00429b60
int3