Function at 0x442380
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47731d
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], 0
call fcn.00402290
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5cb7a0
mov dword [ebp - 4], 1
xor edi, edi
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x4424a4
push str.InternetGetConnectedStateExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x98], eax
test eax, eax
je 0x442498
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x442426
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x442415
sub ecx, edx
sar ecx, 1
jmp 0x442430
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x442430
shr ecx, 1
dec ecx
lea eax, [ecx + 1]
xor ebx, ebx
mov ecx, 2
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.0046a068
push ebx
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x30]
add esp, 0x10
test ecx, ecx
jne 0x44246a
cmp dword [ebp - 0x18], edi
mov ecx, 0x5ca534
cmovne ecx, dword [ebp - 0x20]
mov edx, esi
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x442470
push 0
push 0
push esi
push 0
call dword [ebp - 0x98]
push esi
mov edi, eax
call fcn.0046a071
add esp, 4
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401f80
test edi, edi
jne 0x44250f
push 0x5cb7a8
lea ecx, [ebp - 0x94]
call fcn.0040dc20
mov esi, eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x68]
push 0x5cb7b0
call fcn.0040dc20
mov byte [ebp - 4], 4
push ecx
push esi
mov ecx, eax
call fcn.0044a960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
call fcn.0040d970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0040d970
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x5e5228]
mov dword [0x5e5218], 0
test eax, eax
je 0x442530
push eax
mov eax, dword [0x5e521c]
mov ecx, 0x5e521c
call dword [eax + 0xc]
push str.http:__api.88090.cn_wxpay_cx.php_
mov ecx, 0x5e521c
mov dword [0x5e5228], 0
mov dword [0x5e5230], 0
mov dword [0x5e522c], 0
call fcn.004633c0
lea ecx, [ebp - 0x68]
call fcn.00443950
mov esi, eax
mov dword [ebp - 4], 5
mov ecx, 0x5e5028
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5e502c], ecx
mov ecx, dword [esi + 8]
mov dword [0x5e5030], ecx
mov ecx, 0x5e5038
mov eax, dword [esi + 0xc]
mov dword [0x5e5034], eax
mov eax, dword [0x5e5038]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5e5038
push eax
call fcn.004026a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401f80
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x68]
call fcn.00402290
lea edx, [ebp - 0x68]
mov dword [ebp - 0x10], 1
call fcn.00460320
push str.config.ini
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x94]
call fcn.00465b10
add esp, 4
mov esi, eax
mov byte [ebp - 4], 7
mov ecx, 0x5e5238
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5e523c], ecx
mov ecx, dword [esi + 8]
mov dword [0x5e5240], ecx
mov ecx, 0x5e5248
mov eax, dword [esi + 0xc]
mov dword [0x5e5244], eax
mov eax, dword [0x5e5248]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5e5248
push eax
call fcn.004026a0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x94]
call fcn.00401f80
mov eax, 1
mov dword [ebp - 0x10], eax
and eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401f80
lea ecx, [ebp - 0x68]
call fcn.00402290
mov dword [ebp - 4], 8
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5ca534
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x94]
call fcn.00402290
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], str.appid
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3c]
call fcn.00402290
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5cabbc
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0044a700
mov esi, eax
mov byte [ebp - 4], 0xe
mov ecx, 0x5e50ac
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5e50b0], ecx
mov ecx, dword [esi + 8]
mov dword [0x5e50b4], ecx
mov ecx, 0x5e50bc
mov eax, dword [esi + 0xc]
mov dword [0x5e50b8], eax
mov eax, dword [0x5e50bc]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5e50bc
push eax
call fcn.004026a0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc8]
call fcn.00401f80
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3c]
call fcn.00401f80
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x94]
call fcn.00401f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401f80
lea ecx, [ebp - 0x3c]
call fcn.00402290
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5ca534
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x94]
call fcn.00402290
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], str.cnname
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x68]
call fcn.00402290
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5cabbc
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0044a700
mov esi, eax
mov byte [ebp - 4], 0x18
mov ecx, 0x5e5080
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5e5084], ecx
mov ecx, dword [esi + 8]
mov dword [0x5e5088], ecx
mov ecx, 0x5e5090
mov eax, dword [esi + 0xc]
mov dword [0x5e508c], eax
mov eax, dword [0x5e5090]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5e5090
push eax
call fcn.004026a0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xc8]
call fcn.00401f80
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x68]
call fcn.00401f80
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x94]
call fcn.00401f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401f80
lea ecx, [ebp - 0x3c]
call fcn.00402290
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5ca534
mov dword [ebp - 4], 0x1d
lea ecx, [ebp - 0x94]
call fcn.00402290
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], str.openid
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x68]
call fcn.00402290
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5cabbc
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0044a700
mov esi, eax
mov byte [ebp - 4], 0x22
mov ecx, 0x5e5054
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5e5058], ecx
mov ecx, dword [esi + 8]
mov dword [0x5e505c], ecx
mov ecx, 0x5e5064
mov eax, dword [esi + 0xc]
mov dword [0x5e5060], eax
mov eax, dword [0x5e5064]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5e5064
push eax
call fcn.004026a0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xc8]
call fcn.00401f80
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x68]
call fcn.00401f80
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x94]
call fcn.00401f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401f80
mov eax, dword [vtable.CVolCommonBaseWithMemManager.0]
mov ecx, 0x5e515c
call dword [eax + 0x44]
mov eax, dword [0x5e5084]
mov ecx, 0x5e516c
mov dword [0x5e5160], eax
mov eax, dword [0x5e5088]
mov dword [0x5e5164], eax
mov eax, dword [0x5e508c]
mov dword [0x5e5168], eax
mov eax, dword [0x5e516c]
call dword [eax + 0x44]
push 0x5e5090
mov ecx, 0x5e516c
call fcn.004026a0
lea ecx, [ebp - 0x3c]
call fcn.00402290
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5ca534
mov dword [ebp - 4], 0x27
lea ecx, [ebp - 0x94]
call fcn.00402290
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], 0x5cb850
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x68]
call fcn.00402290
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5cabbc
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0044a700
mov esi, eax
mov byte [ebp - 4], 0x2c
mov ecx, 0x5e5130
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5e5134], ecx
mov ecx, dword [esi + 8]
mov dword [0x5e5138], ecx
mov ecx, 0x5e5140
mov eax, dword [esi + 0xc]
mov dword [0x5e513c], eax
mov eax, dword [0x5e5140]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5e5140
push eax
call fcn.004026a0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xc8]
call fcn.00401f80
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x68]
call fcn.00401f80
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x94]
call fcn.00401f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401f80
lea ecx, [ebp - 0x3c]
call fcn.00402290
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5cba50
mov dword [ebp - 4], 0x31
lea ecx, [ebp - 0x94]
call fcn.00402290
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], 0x5cabb8
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x68]
call fcn.00402290
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5cabbc
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
push eax
lea edx, [ebp - 0x68]
call fcn.0044a8d0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x68]
call fcn.00401f80
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x94]
call fcn.00401f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401f80
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret