Function at 0x42af10
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46697d
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], 0
call fcn.004022f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5bf2ac
mov dword [ebp - 4], 1
xor edi, edi
push 0x5be3b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x42b034
push str.InternetGetConnectedStateExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x98], eax
test eax, eax
je 0x42b028
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x42afb6
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42afa5
sub ecx, edx
sar ecx, 1
jmp 0x42afc0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x42afc0
shr ecx, 1
dec ecx
lea eax, [ecx + 1]
xor ebx, ebx
mov ecx, 2
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.0044a7e0
push ebx
mov esi, eax
push 0
push esi
call fcn.0044beb0
mov ecx, dword [ebp - 0x30]
add esp, 0x10
test ecx, ecx
jne 0x42affa
cmp dword [ebp - 0x18], edi
mov ecx, 0x5be34c
cmovne ecx, dword [ebp - 0x20]
mov edx, esi
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x42b000
push 0
push 0
push esi
push 0
call dword [ebp - 0x98]
push esi
mov edi, eax
call fcn.0044a7e9
add esp, 4
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test edi, edi
jne 0x42b09f
push 0x5bf2b4
lea ecx, [ebp - 0x94]
call fcn.0040d470
mov esi, eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x68]
push 0x5bf2bc
call fcn.0040d470
mov byte [ebp - 4], 4
push ecx
push esi
mov ecx, eax
call fcn.00430f10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
call fcn.0040d1c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0040d1c0
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x5d5c94]
mov dword [0x5d5c84], 0
test eax, eax
je 0x42b0c0
push eax
mov eax, dword [0x5d5c88]
mov ecx, 0x5d5c88
call dword [eax + 0xc]
push str.http:__api.88090.cn_wxpay_cx.php_
mov ecx, 0x5d5c88
mov dword [0x5d5c94], 0
mov dword [0x5d5c9c], 0
mov dword [0x5d5c98], 0
call fcn.0043bc70
lea ecx, [ebp - 0x68]
call fcn.0042c450
mov esi, eax
mov dword [ebp - 4], 5
mov ecx, 0x5d5a94
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5d5a98], ecx
mov ecx, dword [esi + 8]
mov dword [0x5d5a9c], ecx
mov ecx, 0x5d5aa4
mov eax, dword [esi + 0xc]
mov dword [0x5d5aa0], eax
mov eax, dword [0x5d5aa4]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5d5aa4
push eax
call fcn.00402720
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401ff0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x68]
call fcn.004022f0
lea edx, [ebp - 0x68]
mov dword [ebp - 0x10], 1
xor ecx, ecx
call fcn.00438a00
push str.config.ini
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x94]
call fcn.0043eb20
add esp, 4
mov esi, eax
mov byte [ebp - 4], 7
mov ecx, 0x5d5ca4
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5d5ca8], ecx
mov ecx, 0x5d5cb4
mov eax, dword [esi + 8]
mov dword [0x5d5cac], eax
mov eax, dword [esi + 0xc]
mov dword [0x5d5cb0], eax
mov eax, dword [0x5d5cb4]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5d5cb4
push eax
call fcn.00402720
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x94]
call fcn.00401ff0
mov eax, 1
mov dword [ebp - 0x10], eax
and eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401ff0
lea ecx, [ebp - 0x68]
call fcn.004022f0
mov dword [ebp - 4], 8
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5be34c
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x94]
call fcn.004022f0
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], str.appid
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3c]
call fcn.004022f0
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5be954
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x94]
mov edx, 0x5d5ca4
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.00430ca0
mov esi, eax
mov byte [ebp - 4], 0xe
mov ecx, 0x5d5b18
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5d5b1c], ecx
mov ecx, dword [esi + 8]
mov dword [0x5d5b20], ecx
mov ecx, 0x5d5b28
mov eax, dword [esi + 0xc]
mov dword [0x5d5b24], eax
mov eax, dword [0x5d5b28]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5d5b28
push eax
call fcn.00402720
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc8]
call fcn.00401ff0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x94]
call fcn.00401ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401ff0
lea ecx, [ebp - 0x3c]
call fcn.004022f0
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5be34c
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x94]
call fcn.004022f0
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], str.cnname
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x68]
call fcn.004022f0
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5be954
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
mov edx, 0x5d5ca4
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0xc8]
call fcn.00430ca0
mov esi, eax
mov byte [ebp - 4], 0x18
mov ecx, 0x5d5aec
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5d5af0], ecx
mov ecx, dword [esi + 8]
mov dword [0x5d5af4], ecx
mov ecx, 0x5d5afc
mov eax, dword [esi + 0xc]
mov dword [0x5d5af8], eax
mov eax, dword [0x5d5afc]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5d5afc
push eax
call fcn.00402720
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xc8]
call fcn.00401ff0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x68]
call fcn.00401ff0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x94]
call fcn.00401ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
lea ecx, [ebp - 0x3c]
call fcn.004022f0
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5be34c
mov dword [ebp - 4], 0x1d
lea ecx, [ebp - 0x94]
call fcn.004022f0
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], str.openid
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x68]
call fcn.004022f0
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5be954
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
mov edx, 0x5d5ca4
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0xc8]
call fcn.00430ca0
mov esi, eax
mov byte [ebp - 4], 0x22
mov ecx, 0x5d5ac0
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5d5ac4], ecx
mov ecx, dword [esi + 8]
mov dword [0x5d5ac8], ecx
mov ecx, 0x5d5ad0
mov eax, dword [esi + 0xc]
mov dword [0x5d5acc], eax
mov eax, dword [0x5d5ad0]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5d5ad0
push eax
call fcn.00402720
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xc8]
call fcn.00401ff0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x68]
call fcn.00401ff0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x94]
call fcn.00401ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
mov eax, dword [vtable.CVolCommonBaseWithMemManager.0]
mov ecx, 0x5d5bc8
call dword [eax + 0x44]
mov eax, dword [0x5d5af0]
mov ecx, 0x5d5bd8
mov dword [0x5d5bcc], eax
mov eax, dword [0x5d5af4]
mov dword [0x5d5bd0], eax
mov eax, dword [0x5d5af8]
mov dword [0x5d5bd4], eax
mov eax, dword [0x5d5bd8]
call dword [eax + 0x44]
push 0x5d5afc
mov ecx, 0x5d5bd8
call fcn.00402720
lea ecx, [ebp - 0x3c]
call fcn.004022f0
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5be34c
mov dword [ebp - 4], 0x27
lea ecx, [ebp - 0x94]
call fcn.004022f0
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], 0x5bf348
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x68]
call fcn.004022f0
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5be954
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
mov edx, 0x5d5ca4
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0xc8]
call fcn.00430ca0
mov esi, eax
mov byte [ebp - 4], 0x2c
mov edx, dword [vtable.CVolCommonBaseWithMemManager.0]
mov ecx, 0x5d5b9c
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [0x5d5ba0], ecx
mov ecx, dword [esi + 8]
mov dword [0x5d5ba4], ecx
mov ecx, 0x5d5bac
mov eax, dword [esi + 0xc]
mov dword [0x5d5ba8], eax
mov eax, dword [0x5d5bac]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
mov ecx, 0x5d5bac
push eax
call fcn.00402720
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xc8]
call fcn.00401ff0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x68]
call fcn.00401ff0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x94]
call fcn.00401ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
lea ecx, [ebp - 0x3c]
call fcn.004022f0
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5bf3f8
mov dword [ebp - 4], 0x31
lea ecx, [ebp - 0x94]
call fcn.004022f0
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x94], vtable.CWConstString.0
mov dword [ebp - 0x88], 0x5be950
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x68]
call fcn.004022f0
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x68], vtable.CWConstString.0
mov dword [ebp - 0x5c], 0x5be954
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
mov ecx, 0x5d5ca4
push eax
lea edx, [ebp - 0x68]
call fcn.00430e80
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x68]
call fcn.00401ff0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x94]
call fcn.00401ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret