Function at 0x425f70
Capabilities:
Allocate or change rwx memory
Create directory
Create thread
Execute shellcode via indirect call
Get common file path
Get file attributes
Get graphical window text
Read .ini file
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3e68
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x4c2014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x834], ebx
jmp 0x425fb8
call dword [sym.imp.mfc140u.dll_CDialog::OnInitDialog]
push 0x423140
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.mfc140u.dll_CMenu::FromHandle]
mov edi, eax
test edi, edi
je 0x426044
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x65
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
mov eax, dword [ebp - 0x818]
cmp dword [eax - 0xc], 0
je 0x426031
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
push 0x800
push dword [edi + 4]
call esi
push dword [ebp - 0x818]
push 0x10
push 0
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
call fcn.00425ed0
push dword [ebx + 0xd0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xd0]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
push 0
push 0
push 0x1037
push dword [ebx + 0xf4]
call esi
or eax, 0x20
push eax
push 0
push 0x1036
push dword [ebx + 0xf4]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CListCtrl::InsertColumn]
lea edi, [ebx + 0xd4]
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b77e4
push 0
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b77ec
push 1
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x14
push 0
push 0x4b77f4
push 2
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push str.:S_rg
push 3
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b7804
push 4
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b780c
push 5
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b7814
push 6
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b781c
push 7
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b7824
push 8
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b782c
push 9
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b7834
push 0xa
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b783c
push 0xb
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x41
push 0
push 0x4b7844
push 0xc
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x3c
push 0
push 0x4b784c
push 0xd
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x50
push 2
push str._m
push 0xe
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x32
push 0
push 0x4b7868
push 0xf
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x19
push 0
push 0x4b7880
push 0x10
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x64
push 0
push 0x4b7894
push 0x11
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x78
push 0
push 0x4b78a0
push 0x12
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x78
push 0
push 0x4b78ac
push 0x13
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b78b8
push 0x14
mov ecx, edi
call esi
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4b78c0
push 0x15
mov ecx, edi
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea ecx, [ebx + 0x1d4]
push 0x4b78cc
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x4b78cc
push 0
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b78d4
push 1
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b78dc
push 2
push 0x14a
push dword [ebx + 0x1f4]
call esi
push 0x4b78e4
lea ecx, [ebx + 0x2e2c]
call edi
push 0x4b78e4
push 0
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b78ec
push 1
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b78f4
push 2
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b78fc
push 3
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b7904
push 4
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0x4b790c
push 5
push 0x14a
push dword [ebx + 0x2e4c]
call esi
push 0
push 0
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 1
push 1
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 2
push 2
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 3
push 3
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 4
push 4
push 0x151
push dword [ebx + 0x2e4c]
call esi
push 5
push 5
push 0x151
push dword [ebx + 0x2e4c]
call esi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 0
call esi
lea ecx, [ebx + 0xaa4]
push 0
call esi
lea ecx, [ebx + 0xba4]
push 0
call esi
lea ecx, [ebx + 0x6a4]
push 0
call esi
lea ecx, [ebx + 0xa24]
push 0
call esi
lea ecx, [ebx + 0xca4]
push 0
call esi
lea ecx, [ebx + 0x172c]
push 0
call esi
lea ecx, [ebx + 0x1c2c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1bac]
call esi
lea ecx, [ebx + 0x1b2c]
push 0
call esi
lea ecx, [ebx + 0x112c]
push 0
call esi
lea ecx, [ebx + 0x142c]
push 0
call esi
lea ecx, [ebx + 0xea4]
push 0
call esi
lea ecx, [ebx + 0xf24]
push 0
call esi
lea ecx, [ebx + 0x1dac]
push 0
call esi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
lea ecx, [ebx + 0x1bac]
push 0
call edi
lea ecx, [ebx + 0x24ac]
push 0
call esi
lea ecx, [ebx + 0x282c]
push 0
call esi
lea ecx, [ebx + 0x122c]
push 0
call esi
push 0
lea ecx, [ebx + 0x1dac]
call esi
lea ecx, [ebx + 0x1eac]
push 0
call esi
push 0
lea ecx, [ebx + 0x122c]
call edi
mov eax, dword [ebx + 0x254]
add ebx, 0x254
mov esi, dword [ebp - 0x834]
mov ecx, ebx
push 0xe801
push 0x50008200
push 0
push esi
call dword [eax + 0x1b0]
lea eax, [ebp - 0x830]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x824]
mov ecx, ebx
push 1
push 0x19
push dword [ebp - 0x828]
add eax, 0xffffffe2
push eax
push 0
call dword [sym.imp.mfc140u.dll_CWnd::MoveWindow]
push 5
push str.efghi
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CStatusBar::SetIndicators]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::GetDlgCtrlID]
mov ecx, ebx
push 0x64
push 0x8000000
call edi
mov esi, dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneInfo]
mov ecx, ebx
push eax
push 0
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 1
mov ecx, ebx
call esi
push 0x1e
push 0x8000000
mov ecx, ebx
call edi
push eax
push 2
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 3
mov ecx, ebx
call esi
push 0x64
push 0x8000000
mov ecx, ebx
call edi
push eax
push 4
mov ecx, ebx
call esi
push 1
push 0
push 0
push 0
push 0
push 0xe8ff
push 0xe800
mov ecx, dword [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_CWnd::RepositionBars]
push 1
mov ecx, ebx
call dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
push str.D:LogInfo
mov dword [0x4c50cc], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x426558
push 0
push str.D:LogInfo
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x200
lea eax, [ebp - 0x410]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x820]
mov dword [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x200
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 2
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x814]
push str._sIPsET.ini
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0xc
push dword [ebp - 0x814]
push 0
push 0x4b7948
push 0x4b7954
call edi
mov ebx, dword [ebp - 0x834]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c5c], eax
push 0
push 0x4b795c
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x4c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x4c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50c8], eax
push 0
push 0x4b7964
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x544]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x544]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c68], eax
push 0
push str.Rf
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x744]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x744]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c54], eax
push 0
push 0x4b797c
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x7c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x7c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5118], eax
push 0
push 0x4b7988
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x844]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x844]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50c4], eax
push 0
push str.0R
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xb44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xb44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50c0], eax
push 0
push str.S__Y
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5114], eax
push 0
push 0x4b79b0
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4b64], eax
push 0
push 0x4b79b8
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x1d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c42b0], eax
push 0
push 0x4b79c0
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xc44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xc44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c78], eax
push 0
push 0x4b79c8
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0xe44]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xe44]
call esi
push dword [ebp - 0x814]
mov dword [0x4c42c4], eax
push 0
push 0x4b60c8
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x134c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x134c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50b0], eax
push 0
push 0x4b79d4
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x13cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x13cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50d4], eax
push 0
push 0x4b79e4
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x14cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c42bc], eax
push 0
push 0x4b79f0
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x15cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x15cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4b78], eax
push 0
push 0x4b79fc
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x374c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x374c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c42c0], eax
push 0
push 0x4b7a08
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x27cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x27cc]
call esi
mov dword [0x4c4b80], eax
push dword [ebp - 0x814]
push 0
push 0x4b7a14
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x16cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x16cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5128], eax
push 0
push 0x4b7a20
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x8c4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x8c4]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c70], eax
push 0
push str.R7R
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x264c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x264c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c64], eax
push 0
push 0x4b7a3c
push 0x4b7954
call edi
push 0
push eax
push 0xf1
push dword [ebx + 0x17cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x17cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c42b4], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7a48
push 0x4b7a54
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x162c]
call edi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7a60
push 0x4b7a68
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2f2c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c31d0], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7a78
push 0x4b7a7c
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x302c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c482c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7a88
push 0x4b7a8c
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x312c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4828], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7a98
push 0x4b7aa0
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x31ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3250], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7a88
push 0x4b7aac
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x33ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c31cc], eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7a88
push 0x4b7abc
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x352c]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c2734], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7a98
push 0x4b7ac8
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x36ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c2730], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7ad4
push str._g0W
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x37ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c2738], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7a88
push 0x4b7ae4
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x32ac]
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c318c], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7af0
push 0x4b7af4
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4c4ba4], al
push 0
movzx eax, al
push eax
push 0x14e
push dword [ebx + 0x2e4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b7b04
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x18cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x18cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4b60], eax
push 1
push 0x4b7b10
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1a4c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b7b1c
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x28cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x28cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50ec], eax
push 0
push 0x4b7b28
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x294c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x294c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50e4], eax
push 0
push 0x4b7b34
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2a4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2a4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5108], eax
push 0
push 0x4b7b40
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5104], eax
push 0
push 0x4b7b4c
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2c4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2c4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5100], eax
push 0
push 0x4b7b58
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c509c], eax
push 0
push str.sQN
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2d4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2d4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50a4], eax
push 0
push 0x4b7b70
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2dcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2dcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4ba0], eax
push 0
push str.AwardOpt
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2ecc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2ecc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c511c], eax
push 0
push 0x4b7b94
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2fcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2fcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c42c8], eax
push 0
push 0x4b7ba0
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x30cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x30cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4b70], eax
push 0
push 0x4b7ba8
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x324c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x324c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c510c], eax
push 0
push 0x4b7bb4
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x344c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x344c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c513c], eax
push 0
push 0x4b7bc0
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x334c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x334c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c5098], eax
push 0
push str.R_Rd
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x384c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x384c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4824], eax
push 0
push 0x4b7bdc
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x2acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x2acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4b50], eax
push 0
push 0x4b7be8
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x1acc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x1acc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4b68], eax
push 0
push 0x4b7bf4
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x38cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x38cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4820], eax
push 0
push 0x4b7c00
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3bcc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3bcc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c50], eax
push 0
push 0x4b7c10
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3c4c]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3c4c]
call esi
push dword [ebp - 0x814]
mov dword [0x4c4c60], eax
push 0
push 0x4b7c18
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x3ccc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x3ccc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50a0], eax
push 0
push 0x4b7c24
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x39cc]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0x39cc]
call esi
push dword [ebp - 0x814]
mov dword [0x4c50d0], eax
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7a78
push 0x4b7c30
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x392c]
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
push 0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x818]
push 0
push 0
push 0
push dword [eax - 0xc]
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0
push 0
call edi
mov ecx, dword [ebp - 0x818]
mov esi, eax
push 0
push 0
push esi
push 0x4c480c
push dword [ecx - 0xc]
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
push 0
call edi
lea ecx, [ebp - 0x818]
mov byte [esi + 0x4c480c], 0
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x814]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7ad4
push 0x4b7c3c
push 0x4b7954
call edi
mov esi, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3190], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push str.750000
push 0x4b7c5c
push 0x4b7954
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3aac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
mov dword [0x4c3254], eax
push 0
push 0
push 0xf0
push dword [ebx + 0x1a4c]
call edi
push dword [ebp - 0x814]
neg eax
push 0
sbb al, al
push 0x4b7c68
add al, 2
push 0x4b7954
mov byte [0x4c24cf], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x64
jne 0x427578
push 0
push 1
push 0xf1
push dword [ebx + 0x104c]
call edi
mov dword [0x4c31d4], 0x64
jmp 0x4275bc
cmp eax, 0x12c
jne 0x42759c
push 0
push 1
push 0xf1
push dword [ebx + 0x10cc]
call edi
mov dword [0x4c31d4], 0x12c
jmp 0x4275bc
cmp eax, 0xa
jne 0x4275bc
push 0
push 1
push 0xf1
push dword [ebx + 0xfcc]
call edi
mov dword [0x4c31d4], 0xa
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b6db4
push 0x4b7c74
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4275f6
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x3a4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7c80
push 0x4b7c84
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x427645
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x272c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c325c], eax
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.20000
push 0x4b7c9c
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0xda4]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4b7ca8
push 0x4b7cb0
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x21ac]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c5094], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7c80
push 0x4b7cbc
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x152c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c2724], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7ccc
push 0x4b7cd4
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x9a4]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4b90], eax
mov dword [0x4c4830], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7a88
push 0x4b7cdc
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1e2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov byte [0x4c24ce], al
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.1000
push 0x4b7cf4
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x182c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c4808], eax
lea eax, [ebp - 0x210]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7ccc
push 0x4b7d00
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x2b2c]
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
add esp, 4
lea eax, [ebp - 0x210]
fstp qword [0x4c31d8]
push dword [ebp - 0x814]
push 0x100
push eax
push 0x4b7d0c
push 0x4b7d14
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x192c]
call esi
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
lea eax, [ebp - 0x210]
push eax
call esi
add esp, 4
mov dword [0x4c4800], eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x81c], 0
push eax
push 0x40
push 0x563
push dword [0x4c273c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0042dbd0
lea ecx, [ebp - 0x818]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 3
mov byte [ebp - 4], 4
call dword [sym.imp.plfl32.dll_P_GetDataValue]
push eax
lea eax, [ebp - 0x818]
push 0x4b6a7c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push dword [ebp - 0x818]
call esi
add esp, 0x10
mov dword [0x4c5120], eax
push 0
call dword [sym.imp.plfl32.dll_P_GetInfo]
push eax
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x818]
push 0x4b621c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x834]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
lea ecx, [ebx + 0x624]
push 1
call esi
push dword [ebp - 0x814]
push 0
push 0x4b7d20
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x644]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x644]
call edi
push 1
lea ecx, [ebx + 0xa24]
mov dword [0x4c5134], eax
call esi
push 1
lea ecx, [ebx + 0xca4]
call esi
push 1
lea ecx, [ebx + 0x142c]
call esi
push dword [ebp - 0x814]
push 0
push str._rN9e
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x144c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x144c]
call edi
push dword [ebp - 0x814]
mov dword [0x4c4c80], eax
push 0
push 0x4b7d38
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xa44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xa44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c5088], eax
push 0
push 0x4b7d44
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xcc4]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xcc4]
call edi
mov dword [0x4c4c84], eax
mov eax, dword [0x4c5120]
cmp eax, 2
jl 0x427ac9
push 1
lea ecx, [ebx + 0x1bac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1bac]
call esi
push 1
lea ecx, [ebx + 0x122c]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1dac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x1eac]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push 1
lea ecx, [ebx + 0x122c]
call esi
push 1
lea ecx, [ebx + 0x1dac]
call esi
push 1
lea ecx, [ebx + 0x1eac]
call esi
mov eax, dword [0x4c5120]
cmp eax, 5
jne 0x427b34
push 1
lea ecx, [ebx + 0x1c2c]
call esi
push 1
lea ecx, [ebx + 0x6a4]
call esi
push 1
lea ecx, [ebx + 0x172c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b7d4c
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x174c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x174c]
call edi
mov dword [0x4c42b8], eax
mov eax, dword [0x4c5120]
cmp eax, 5
je 0x427b47
cmp eax, 3
je 0x427b47
cmp eax, 4
je 0x427b47
cmp eax, 6
jne 0x427cb4
push 1
lea ecx, [ebx + 0x1b2c]
call esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x210]
push 0x100
push eax
push str.80000
push 0x4b7d64
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebx + 0x1b2c]
call dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoll]
add esp, 4
mov dword [0x4c3290], eax
lea ecx, [ebx + 0xd24]
push 1
call esi
push 1
lea ecx, [ebx + 0x112c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b7d6c
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0xd44]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0xd44]
call edi
push dword [ebp - 0x814]
mov dword [0x4c4c48], eax
push 0
push 0x4b7d78
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x114c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x114c]
call edi
push 1
lea ecx, [ebx + 0xea4]
mov dword [0x4c5110], eax
call esi
push 1
lea ecx, [ebx + 0xf24]
call esi
push 1
lea ecx, [ebx + 0x24ac]
call esi
push 1
lea ecx, [ebx + 0x282c]
call esi
push 1
lea ecx, [ebx + 0xea4]
call esi
push 1
lea ecx, [ebx + 0x202c]
call esi
push dword [ebp - 0x814]
push 0
push 0x4b7d84
push 0x4b7954
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
push 0xf1
push dword [ebx + 0x204c]
call edi
push 0
push 0
push 0xf0
push dword [ebx + 0x204c]
call edi
mov dword [0x4c4b94], eax
mov eax, dword [0x4c5120]
cmp eax, 6
je 0x427cb9
cmp eax, 5
jne 0x427ce3
push 1
lea ecx, [ebx + 0xaa4]
call esi
push 0
push 0
push 0xf0
push dword [ebx + 0xac4]
call edi
push 1
lea ecx, [ebx + 0xba4]
mov dword [0x4c50bc], eax
call esi
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
push 0
push 0x4c4c88
push 0
call esi
call fcn.00425330
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x427d7a
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x810]
push 0
push 0x10
push eax
push 0
call esi
lea eax, [ebp - 0x810]
push eax
push 0x4b7d90
push 0x4c42e8
call fcn.00420240
push 0
push 0
push 0
push 0x42a300
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0xf0
push dword [ebx + 0x14cc]
call edi
test eax, eax
je 0x427da7
push 0x42c620
push 0x2710
push 0x2767
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x425e70
push 0xfffffffffffffffc
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 0x4c4c10
mov dword [0x4c42e4], eax
mov ecx, str.dxdir1.speed.qq.com
call fcn.00423310
mov edx, 0x4c4bdc
mov ecx, str.wtdir1.speed.qq.com
call fcn.00423310
mov edx, 0x4c4ba8
mov ecx, str.dx2dir1.speed.qq.com
call fcn.00423310
mov ecx, 0x4c4c10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427df1
sub ecx, edx
je 0x427e22
mov ecx, 0x4c4bdc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427e04
sub ecx, edx
je 0x427e22
mov ecx, 0x4c4ba8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427e17
sub ecx, edx
jne 0x427e36
push 0
push str.speed.qq.com
push 0x4b7df0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x427e46
lea ecx, [ebp - 0x820]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x814]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044612d
mov esp, ebp
pop ebp
ret