Function at 0x4502eb
Capabilities:
Check if file exists
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
call fcn.0047960b
test eax, eax
je 0x4503bf
push 0x3c
mov dword [esp + 0x1c], 0x2bf20
mov dword [esp + 0x24], 0x6ddd00
mov dword [esp + 0x28], 1
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
je 0x450380
lea eax, [esp + 0x14]
push str.synctm.exe
push eax
mov dword [esp + 0x14], 3
call fcn.0047821a
pop ecx
lea ecx, [esp + 0x14]
call fcn.0042a029
mov eax, dword [eax]
pop ecx
push eax
lea ecx, [esi + 4]
mov dword [esi], vtable.KExecute.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str._autocheck
lea ecx, [esi + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [esp + 0x2c], esi
jmp 0x450384
mov dword [esp + 0x2c], ebx
test byte [esp + 0xc], 2
je 0x45039c
mov eax, dword [esp + 0x10]
and dword [esp + 0xc], 0xfffffffd
add eax, 0xfffffff0
call fcn.00401239
test byte [esp + 0xc], 1
je 0x4503af
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
add esi, 0x10
call fcn.004559a3
or dword [esp + 0x24], 0xffffffff
mov eax, 0xea60
push 0x10
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
cmp edi, ebx
pop ecx
je 0x45040a
lea esi, [edi + 4]
mov ecx, 0x5438cc
mov dword [edi], vtable.KCloudProxySettingExe.0
call fcn.0040121e
mov dword [esi + 4], ebx
mov dword [esi + 8], 1
mov dword [esp + 0x2c], edi
jmp 0x45040e
mov dword [esp + 0x2c], ebx
mov esi, dword [ebp + 8]
lea eax, [esp + 0x18]
add esi, 0x10
push eax
mov dword [esp + 0x10], esi
call fcn.004559a3
xor edi, edi
inc edi
push 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x1b7740
mov dword [esp + 0x24], 0x36ee80
mov dword [esp + 0x28], edi
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x450459
mov dword [eax], vtable.KPhoneRecmomendExcute.0
mov dword [esp + 0x2c], eax
jmp 0x45045d
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x24], 0xffffffff
push 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x2710
mov dword [esp + 0x24], 0x493e0
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x45049c
mov dword [eax], vtable.KEmptyWorkSet.0
mov dword [esp + 0x2c], eax
jmp 0x4504a0
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x24], 0xffffffff
push 0x10
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0xdbba0
mov dword [esp + 0x24], 0x6ddd00
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x4504e8
mov dword [eax], vtable.KFixKisliveExcute.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [esp + 0x2c], eax
jmp 0x4504ec
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
call fcn.004418e2
test eax, eax
je 0x450538
or dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
call fcn.004419ab
imul eax, eax, 0x3e8
push 0x441a00
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
mov eax, dword [0x5438cc]
mov ecx, 0x5438cc
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
call fcn.004782f6
lea edi, [esp + 0x10]
call fcn.0042a0a0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [esp + 0x10]
push 0x51ed78
push esi
call dword [sym.imp.MSVCR80.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
lea eax, [esi - 0x10]
jne 0x4505bd
call fcn.00401239
or dword [esp + 0x24], 0xffffffff
push 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], 0x6ddd00
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x4505c4
mov dword [eax], vtable.KFreeExcute.0
mov dword [esp + 0x2c], eax
jmp 0x4505c8
call fcn.00401239
jmp 0x450619
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x24], 0xffffffff
push 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x2710
mov dword [esp + 0x24], 0x7530
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x45060b
mov dword [eax], vtable.KFreePopExcute.0
mov dword [esp + 0x2c], eax
jmp 0x45060f
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
cmp dword [0x5452f0], ebx
je 0x450672
call fcn.00449b26
test eax, eax
je 0x450672
or dword [esp + 0x20], 0xffffffff
xor edi, edi
inc edi
push 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x1388
mov dword [esp + 0x28], edi
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x45065e
mov dword [eax], vtable.KNetBuyRebootTipExcute.0
mov dword [esp + 0x2c], eax
jmp 0x450662
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
jmp 0x450675
xor edi, edi
inc edi
lea eax, [esp + 0x10]
push eax
xor esi, esi
call fcn.0047821a
lea eax, [esp + 0x14]
mov dword [esp], str.cloudctrl.config
push eax
call fcn.00407371
push dword [esp + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4506bd
push dword [esp + 0x10]
push ebx
push str.Enable
push str.IE8RecommendPop
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401239
cmp esi, ebx
je 0x45073f
call fcn.00478632
test eax, eax
jne 0x45073f
call fcn.00436019
test eax, eax
je 0x4506e4
call fcn.00436108
call fcn.00435c30
test eax, eax
jne 0x45073f
call fcn.0043609c
test eax, eax
jne 0x45073f
or dword [esp + 0x20], 0xffffffff
push 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x927c0
mov dword [esp + 0x28], edi
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x45072d
mov ebx, eax
call fcn.0044caa0
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x2c], eax
inc edi
jmp 0x450731
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
lea eax, [esp + 0x10]
push eax
push str.DaoHangTimes
mov dword [esp + 0x18], ebx
call fcn.00435b2d
cmp dword [esp + 0x18], 3
pop ecx
pop ecx
jge 0x450791
or dword [esp + 0x20], 0xffffffff
push 0x43632e
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x7530
mov dword [esp + 0x28], edi
call fcn.0045647c
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
call fcn.004a7bc4
test eax, eax
je 0x4507e0
call fcn.0044bcad
test eax, eax
je 0x4507e0
push 0x44bd35
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 2
mov dword [esp + 0x1c], 0x927c0
mov dword [esp + 0x24], 0x401640
call fcn.0045645f
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
call fcn.0042e955
test eax, eax
je 0x45081e
push 0x42ea1e
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], ebx
call fcn.0045645f
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
call fcn.0042a1b8
test eax, eax
je 0x45085c
push 0x42a2ca
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], ebx
call fcn.0045645f
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push 0x468481
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x927c0
mov dword [esp + 0x24], ebx
call fcn.0045647c
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
call fcn.004794d8
test eax, eax
je 0x4508cf
push 0x4796a5
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], 0x3e8
mov dword [esp + 0x28], edi
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
cmp dword [0x5452f0], ebx
je 0x450910
push 0x430caa
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x1d4c0
mov dword [esp + 0x24], 0x2710
mov dword [esp + 0x28], edi
call fcn.0045645f
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
call fcn.00436520
test eax, eax
je 0x45094f
or dword [esp + 0x20], 0xffffffff
push 0x4365ba
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x927c0
mov dword [esp + 0x28], edi
call fcn.0045645f
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x24], 0xffffffff
push 0x44eeea
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0x493e0
mov dword [esp + 0x1c], 0x927c0
call fcn.0045647c
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x20], 0xffffffff
push 0x459393
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x28], edi
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x20], 0xffffffff
push 0x44fb57
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x927c0
mov dword [esp + 0x28], edi
call fcn.0045647c
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x24], 0xffffffff
push 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], 0x36ee80
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x450a22
mov dword [eax], vtable.KServiceDetectExe.0
mov dword [esp + 0x2c], eax
jmp 0x450a26
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
lea edi, [esp + 0x30]
call fcn.004982a2
call fcn.00498310
or dword [esp + 0x20], 0xffffffff
xor edi, edi
inc edi
push 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x28], edi
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x450a75
mov dword [eax], vtable.KProcessStatisticExe.0
mov dword [eax + 4], ebx
mov dword [esp + 0x2c], eax
jmp 0x450a79
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
lea ecx, [esp + 0x30]
call fcn.004982ff
or dword [esp + 0x24], 0xffffffff
push 0x46d5e2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], 0x927c0
call fcn.0045647c
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x24], 0xffffffff
push 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x1f40
mov dword [esp + 0x24], 0x4e20
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
mov dword [esp + 0x14], esi
je 0x450b2c
push str.Global6F876062_C6AD_4a84_AA08_64C31C3D9A74
push ebx
push ebx
push ebx
mov dword [esi], vtable.KScrcapExcute.0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x450b26
push str.kxetray::scrcap_control_event_create_fail
mov esi, 0x545440
call fcn.0049280d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x2c], esi
jmp 0x450b30
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
call fcn.0044cd03
test eax, eax
je 0x450b7c
push 0x44cd77
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], 0x6ddd00
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push 0x44d2ca
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x4e20
mov dword [esp + 0x24], 0xea60
call fcn.0045645f
mov esi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push esi
call fcn.0044ed2d
pop ecx
push esi
call fcn.0044ede5
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], 0x36ee80
mov dword [esp], 0x44e20d
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push 0x44df8c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x3a980
mov dword [esp + 0x24], 0x36ee80
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push 0x44e80c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x57e40
mov dword [esp + 0x24], 0x36ee80
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push 0x44e6d6
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x668a0
mov dword [esp + 0x24], 0x36ee80
call fcn.00456499
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push 0x4305d7
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0xafc80
mov dword [esp + 0x24], 0x36ee80
call fcn.00456499
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edi
push 0x4c95f2
mov dword [esp + 0x1c], 0x493e0
mov dword [esp + 0x24], 0x36ee80
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push esi
call fcn.0044ee58
or dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], ebx
mov dword [esp], 0x4c8d58
call fcn.0045647c
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x20], 0xffffffff
push 0x4c9a9e
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0xdbba0
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
or dword [esp + 0x20], 0xffffffff
push 0x44ea45
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0x493e0
call fcn.0045645f
mov dword [esp + 0x30], eax
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.004559a3
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
jne 0x450dac
xor eax, eax
jmp 0x450dce
mov ecx, dword [ebp + 8]
push ebx
push ebx
push eax
push 0x45681e
push ebx
push ebx
mov dword [eax], ecx
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x450e74
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx + 0xc], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8