Function at 0x4c7320
Capabilities:
Check for time delay via gettickcount
Create thread
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x4c7320
push 0xffffffffffffffff
push 0x7861c2
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x29c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x2b4]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x3c], edi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebp
push ebp
mov dword [0x868ec8], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebp
jge 0x4c741c
push eax
lea eax, [esp + 0xd0]
push eax
call fcn.004083af
push eax
lea ecx, [esp + 0xf4]
push str.Failed_to_init_COM_with_error:
push ecx
mov dword [esp + 0x2d0], ebp
call fcn.00404cfa
add esp, 0x14
push 1
push eax
mov ecx, 0x868edc
mov byte [esp + 0x2c4], 1
call fcn.0054c860
mov esi, 0x10
cmp dword [esp + 0x100], esi
jb 0x4c73e0
mov edx, dword [esp + 0xec]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0x100], 0xf
mov dword [esp + 0xfc], ebp
mov byte [esp + 0xec], 0
cmp dword [esp + 0xe4], esi
jb 0x4c8c8c
mov eax, dword [esp + 0xd0]
push eax
call fcn.00564155
add esp, 4
jmp 0x4c8c8c
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
push 1
push ebp
lea ecx, [esp + 0x4c]
mov dword [esp + 0x2c4], 2
call fcn.00403dd7
mov esi, dword [esp + 0x44]
push ebp
push ebp
push ebp
push 3
push 4
push ebp
push ebp
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebp
jge 0x4c752d
push eax
lea ecx, [esp + 0xd0]
push ecx
call fcn.004083af
push eax
lea edx, [esp + 0xf4]
push str.Failed_to_init_security_with_error:
push edx
mov byte [esp + 0x2d0], 3
call fcn.00404cfa
add esp, 0x14
push 1
push eax
mov ecx, 0x868edc
mov byte [esp + 0x2c4], 4
call fcn.0054c860
mov edi, 0x10
cmp dword [esp + 0x100], edi
jb 0x4c74c4
mov eax, dword [esp + 0xec]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x100], 0xf
mov dword [esp + 0xfc], ebp
mov byte [esp + 0xec], 0
cmp dword [esp + 0xe4], edi
jb 0x4c74f7
mov ecx, dword [esp + 0xd0]
push ecx
call fcn.00564155
add esp, 4
push esi
call fcn.00564155
mov edx, dword [esp + 0x4c]
push edx
call fcn.00565e48
mov eax, dword [esp + 0x54]
push eax
call fcn.00565e48
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00565e48
mov edx, dword [esp + 0x64]
push edx
call fcn.00565e48
add esp, 0x14
jmp 0x4c8c8c
push ebp
push ebp
push ebp
push 0x402059
push ebp
push ebp
mov byte [esp + 0x37], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x74], eax
mov esi, 0x258
cmp eax, ebp
je 0x4c7569
cmp esi, ebp
je 0x4c7569
cmp byte [0x868b74], 0
jne 0x4c7569
push 0x32
call ebx
dec esi
jmp 0x4c7555
push ebp
call fcn.0054ea60
add esp, 4
cmp dword [edi + 0x354], ebp
je 0x4c7586
call fcn.00408a76
mov ecx, eax
call fcn.00406113
push 0x1c0
call fcn.005645f4
add esp, 4
mov dword [esp + 0x40], eax
mov byte [esp + 0x2bc], 6
cmp eax, ebp
je 0x4c75ac
mov ecx, eax
call fcn.00407743
jmp 0x4c75ae
xor eax, eax
push 0x1234350
push 0xab03421
mov byte [esp + 0x2c4], 2
mov dword [edi + 0x35c], eax
call fcn.0055d940
add esp, 8
push ebp
call fcn.004024eb
mov ecx, eax
call fcn.00406cda
xor eax, eax
mov dword [esp + 0x154], 7
mov dword [esp + 0x150], ebp
mov word [esp + 0x140], ax
push 1
push ebp
lea ecx, [esp + 0x28]
push ebp
push ecx
mov byte [esp + 0x2cc], 7
call fcn.00408a76
mov ecx, eax
call fcn.004040bb
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x148]
mov byte [esp + 0x2c8], 8
call fcn.00406f1e
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 7
call fcn.00403a26
cmp dword [esp + 0x150], ebp
je 0x4c768e
call fcn.004043ea
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x60], esp
push str.First_save
call fcn.004062df
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x2e0], 9
call fcn.00408a76
mov ecx, eax
mov byte [esp + 0x2e0], 7
call fcn.00406cd5
lea ecx, [esp + 0x20]
call fcn.00403a26
call fcn.00407f95
push 1
push 0x14
mov ecx, 0x868b78
call fcn.0040268a
cmp eax, ebp
jge 0x4c770d
push eax
lea eax, [esp + 0xd0]
push eax
call fcn.004083af
push eax
lea ecx, [esp + 0x2c]
push str.Failed_to_init_interface_with_error:
push ecx
mov byte [esp + 0x2d0], 0xa
call fcn.00404cfa
add esp, 0x14
push 1
push eax
mov ecx, 0x868edc
mov byte [esp + 0x2c4], 0xb
call fcn.0054c860
lea ecx, [esp + 0x20]
call fcn.00402ed7
lea ecx, [esp + 0xcc]
call fcn.00402ed7
lea ecx, [esp + 0x13c]
call fcn.00403a26
lea ecx, [esp + 0x44]
call fcn.00403d32
jmp 0x4c8c8c
lea ecx, [esp + 0xcc]
cmp dword [esp + 0x150], ebp
jne 0x4c7746
push str.Data_loaded_successfuly
call fcn.004062df
lea edx, [esp + 0xcc]
push ebp
push edx
mov byte [esp + 0x2c4], 0xc
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
jmp 0x4c778e
lea eax, [esp + 0x13c]
push eax
push ecx
call fcn.00407662
push eax
lea edx, [esp + 0x2c]
push str.Failed_to_load_data_with_error:
push edx
mov byte [esp + 0x2d0], 0xd
call fcn.00404cfa
add esp, 0x14
push ebp
push eax
mov byte [esp + 0x2c4], 0xe
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x20]
call fcn.00402ed7
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
push 0x1e
push 1
call fcn.0051a730
add esp, 8
test eax, eax
jne 0x4c77f9
push str.Failed_to_initialize_winsock_
lea ecx, [esp + 0xd0]
call fcn.004062df
lea eax, [esp + 0xcc]
push ebp
push eax
mov byte [esp + 0x2c4], 0xf
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
jmp 0x4c845f
call fcn.00522b00
call fcn.00408a76
lea ecx, [esp + 0x20]
push ecx
call fcn.00406492
add esp, 4
push eax
mov byte [esp + 0x2c0], 0x10
call fcn.00596ac0
mov ecx, eax
call fcn.00599450
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
push str.pcs2012
lea ecx, [esp + 0xd0]
call fcn.004062df
push ebp
lea edx, [esp + 0xd0]
push ebp
push edx
mov byte [esp + 0x2c8], 0x11
call fcn.00596ac0
mov ecx, eax
call fcn.0059a730
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
push str.Initialized_Komodias_category_server
lea ecx, [esp + 0xd0]
call fcn.004062df
lea eax, [esp + 0xcc]
push ebp
push eax
mov byte [esp + 0x2c4], 0x12
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.004074d7
cmp eax, 0xb
je 0x4c78ce
cmp eax, 0xc
jne 0x4c7d61
call fcn.00408a76
mov ecx, eax
call fcn.00406479
push str.Windows_8_mode
lea ecx, [esp + 0xd0]
call fcn.004062df
lea ecx, [esp + 0xcc]
push ebp
push ecx
mov byte [esp + 0x2c4], 0x13
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
push str.avastsvc.exe
lea ecx, [esp + 0x124]
call fcn.004062df
lea edx, [esp + 0x120]
mov ebx, 1
push edx
mov byte [esp + 0x2c0], 0x14
mov dword [esp + 0x1c], ebx
call fcn.00405d3f
mov ecx, eax
call fcn.00401a69
test al, al
je 0x4c79e1
push 0x7b71b4
lea ecx, [esp + 0x108]
call fcn.00403706
lea eax, [esp + 0x104]
push eax
mov dword [esp + 0x2c0], 0x15
mov dword [esp + 0x1c], 3
call fcn.004079af
mov ecx, eax
call fcn.004045b6
test al, al
je 0x4c79dd
push 0x7b71e0
lea ecx, [esp + 0xd0]
call fcn.00403706
lea ecx, [esp + 0xcc]
push ebp
push ecx
mov dword [esp + 0x2c4], 0x16
mov dword [esp + 0x20], 7
call fcn.004079af
mov ecx, eax
call fcn.00405d53
test al, al
je 0x4c79dd
mov byte [esp + 0x17], bl
mov ebx, dword [esp + 0x18]
jmp 0x4c79e6
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x17], 0
test bl, 4
je 0x4c79fe
and ebx, 0xfffffffb
lea ecx, [esp + 0xcc]
mov dword [esp + 0x18], ebx
call fcn.00403a26
test bl, 2
je 0x4c7a16
and ebx, 0xfffffffd
lea ecx, [esp + 0x104]
mov dword [esp + 0x18], ebx
call fcn.00403a26
mov dword [esp + 0x2bc], 7
test bl, 1
je 0x4c7a39
and ebx, 0xfffffffe
lea ecx, [esp + 0x120]
mov dword [esp + 0x18], ebx
call fcn.00402ed7
cmp byte [esp + 0x17], 0
je 0x4c7d61
push str.Stopping_WFP_because_of_Avast_on_Windows_8
lea ecx, [esp + 0xd0]
call fcn.004062df
lea edx, [esp + 0xcc]
push ebp
push edx
mov byte [esp + 0x2c4], 0x17
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
push 0x7b7238
lea ecx, [esp + 0xd0]
call fcn.00403706
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0xec]
push ecx
mov byte [esp + 0x2c4], 0x18
call fcn.004079af
mov ecx, eax
call fcn.00401208
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 0x1a
call fcn.00403a26
cmp dword [esp + 0xfc], ebp
je 0x4c7b2b
push str.Failed_stopping_WFP__
lea ecx, [esp + 0x108]
call fcn.004062df
lea edx, [esp + 0xe8]
push edx
push eax
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x2c8], 0x1b
call fcn.00402fd1
add esp, 0xc
mov byte [esp + 0x2bc], 0x1c
push ebp
push eax
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x20]
call fcn.00402ed7
jmp 0x4c7d41
push str.Checking_if_WFP_is_running
lea ecx, [esp + 0x24]
call fcn.004062df
push ebp
push eax
mov byte [esp + 0x2c4], 0x1d
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 0x1a
call fcn.00402ed7
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x4c7b70
push 0x7b7298
lea ecx, [esp + 0x108]
mov byte [esp + 0x1b], 0
call fcn.00403706
or dword [esp + 0x18], 8
lea ecx, [esp + 0x17]
push ecx
lea edx, [esp + 0x108]
push edx
mov byte [esp + 0x2c4], 0x1e
call fcn.004079af
mov ecx, eax
call fcn.00405d53
test al, al
jne 0x4c7bba
cmp byte [esp + 0x17], al
je 0x4c7bba
mov bl, 1
jmp 0x4c7bbc
xor bl, bl
test byte [esp + 0x18], 8
mov dword [esp + 0x2bc], 0x1a
je 0x4c7bdf
and dword [esp + 0x18], 0xfffffff7
lea ecx, [esp + 0x104]
call fcn.00403a26
test bl, bl
jne 0x4c7bf2
push 0x1f4
call edi
inc esi
cmp esi, 0xa
jb 0x4c7b70
jmp 0x4c7c27
push str.WFP_stopped
lea ecx, [esp + 0x24]
call fcn.004062df
push ebp
push eax
mov byte [esp + 0x2c4], 0x1f
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 0x1a
call fcn.00402ed7
push str.Starting_the_WFP
lea ecx, [esp + 0x108]
call fcn.004062df
lea eax, [esp + 0x104]
push ebp
push eax
mov byte [esp + 0x2c4], 0x20
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x104]
mov byte [esp + 0x2bc], 0x1a
call fcn.00402ed7
push 0x7b72e4
lea ecx, [esp + 0x108]
call fcn.00403706
push 0x9c4
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x2c8], 0x21
call fcn.004079af
mov ecx, eax
call fcn.00408ac6
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x2c8], 0x22
call fcn.00403fb2
lea ecx, [esp + 0x20]
call fcn.00402ed7
lea ecx, [esp + 0x104]
mov byte [esp + 0x2bc], 0x1a
call fcn.00403a26
lea ecx, [esp + 0x104]
cmp dword [esp + 0xfc], ebp
je 0x4c7d1a
push str.Failed_starting_WFP__
call fcn.004062df
lea ecx, [esp + 0xe8]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x2c8], 0x23
call fcn.00402fd1
add esp, 0xc
mov byte [esp + 0x2bc], 0x24
jmp 0x4c7b0f
push str.WFP_Started
call fcn.004062df
lea eax, [esp + 0x104]
push ebp
push eax
mov byte [esp + 0x2c4], 0x25
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x104]
call fcn.00402ed7
lea ecx, [esp + 0xe8]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.00408832
lea ecx, [esp + 0x190]
push ecx
call fcn.00408db9
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x2c4], 0x26
call fcn.00406492
add esp, 8
push eax
lea eax, [esp + 0x194]
push eax
lea ecx, [esp + 0xd4]
push ecx
mov byte [esp + 0x2c8], 0x27
call fcn.005bc480
mov ecx, eax
call fcn.005c6520
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 0x29
call fcn.00402ed7
cmp dword [esp + 0xe0], ebp
jne 0x4c7e06
lea edx, [esp + 0x190]
push edx
lea eax, [esp + 0x108]
push str.DB_Initialized_successfuly:
push eax
call fcn.00404cfa
add esp, 0xc
push ebp
push eax
mov byte [esp + 0x2c4], 0x2a
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x104]
jmp 0x4c7e91
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x98]
push str.Failed_to_create_db:
push edx
call fcn.00404cfa
push 0x7b7354
push eax
lea eax, [esp + 0x134]
push eax
mov byte [esp + 0x2d4], 0x2b
call fcn.00405939
lea ecx, [esp + 0xe4]
push ecx
push eax
lea edx, [esp + 0x124]
push edx
mov byte [esp + 0x2e0], 0x2c
call fcn.00402fd1
add esp, 0x24
push ebp
push eax
mov byte [esp + 0x2c4], 0x2d
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x104]
call fcn.00402ed7
lea ecx, [esp + 0x120]
call fcn.00402ed7
lea ecx, [esp + 0x94]
call fcn.00402ed7
push 0x104
lea eax, [esp + 0x1b0]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, 0xf
mov dword [esp + 0x100], eax
mov dword [esp + 0xfc], ebp
mov byte [esp + 0xec], 0
mov dword [esp + 0x18c], eax
mov dword [esp + 0x188], ebp
mov byte [esp + 0x178], 0
lea ecx, [esp + 0x1ac]
push ecx
lea ecx, [esp + 0x108]
mov byte [esp + 0x2c0], 0x2f
call fcn.004062df
or dword [esp + 0x18], 0x10
lea edx, [esp + 0x174]
push edx
lea eax, [esp + 0xec]
push eax
lea ecx, [esp + 0x10c]
push ecx
push 0x5c
mov byte [esp + 0x2cc], 0x30
call fcn.00402126
add esp, 0x10
test al, al
je 0x4c7f37
cmp dword [esp + 0xfc], ebp
je 0x4c7f37
xor bl, bl
jmp 0x4c7f39
mov bl, 1
test byte [esp + 0x18], 0x10
mov dword [esp + 0x2bc], 0x2f
je 0x4c7f57
lea ecx, [esp + 0x104]
call fcn.00402ed7
lea ecx, [esp + 0x104]
test bl, bl
je 0x4c7f8e
push str.Failed_building_the_path
call fcn.004062df
lea edx, [esp + 0x104]
push ebp
push edx
mov byte [esp + 0x2c4], 0x31
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
jmp 0x4c811d
lea eax, [esp + 0xe8]
push eax
call fcn.0040521d
push str.phpphp_cgi.exe
lea ecx, [esp + 0x108]
mov byte [esp + 0x2c0], 0x32
call fcn.00403eae
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0x124]
call fcn.0040521d
push str.web
lea ecx, [esp + 0x124]
mov byte [esp + 0x2c0], 0x33
call fcn.00403eae
push str.KeepMyFamilySecureWeb.log
lea ecx, [esp + 0x24]
call fcn.004062df
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0x2c4], 0x34
call fcn.004050bf
push eax
lea ecx, [esp + 0x84]
push ecx
mov byte [esp + 0x2cc], 0x35
call fcn.00406bef
mov esi, eax
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x2d4], 0x36
call fcn.00406bef
mov edi, eax
lea ecx, [esp + 0x138]
push ecx
lea edx, [esp + 0xb0]
push edx
mov byte [esp + 0x2dc], 0x37
call fcn.00406bef
add esp, 0x20
push esi
push edi
push eax
push 0x3040
mov byte [esp + 0x2cc], 0x38
call fcn.005bc480
mov ecx, eax
call fcn.005be420
lea ecx, [esp + 0x94]
mov bl, al
call fcn.00403a26
lea ecx, [esp + 0xb0]
call fcn.00403a26
lea ecx, [esp + 0x78]
call fcn.00403a26
lea ecx, [esp + 0x58]
call fcn.00402ed7
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 0x33
call fcn.00402ed7
lea ecx, [esp + 0x20]
test bl, bl
je 0x4c80e4
push str.Web_server_started
call fcn.004062df
lea eax, [esp + 0x20]
push ebp
push eax
mov byte [esp + 0x2c4], 0x39
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
jmp 0x4c8108
push str.Failed_to_start_web_server
call fcn.004062df
lea ecx, [esp + 0x20]
push ebp
push ecx
mov byte [esp + 0x2c4], 0x3a
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x20]
call fcn.00402ed7
lea ecx, [esp + 0x120]
call fcn.00402ed7
lea ecx, [esp + 0x104]
mov byte [esp + 0x2bc], 0x2f
call fcn.00402ed7
call fcn.0040589e
lea ecx, [esp + 0x174]
call fcn.00402ed7
lea ecx, [esp + 0xe8]
call fcn.00402ed7
lea ecx, [esp + 0xcc]
call fcn.00402ed7
lea ecx, [esp + 0x190]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.0052c930
xor edx, edx
mov dword [esp + 0x170], 7
mov dword [esp + 0x16c], ebp
mov word [esp + 0x15c], dx
lea eax, [esp + 0x58]
mov bl, 0x3b
push eax
mov byte [esp + 0x2c0], bl
call fcn.0040427d
add esp, 4
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x164]
mov byte [esp + 0x2c8], 0x3c
call fcn.00406f1e
lea ecx, [esp + 0x58]
mov byte [esp + 0x2bc], bl
call fcn.00403a26
lea ecx, [esp + 0x20]
cmp dword [esp + 0x16c], ebp
je 0x4c8211
push str.DLL_set_but_not_supported_in_full_parental_control_mode
call fcn.004062df
lea ecx, [esp + 0x20]
push 1
push ecx
mov byte [esp + 0x2c4], 0x3d
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
jmp 0x4c824a
push str.No_DLL_set_to_be_loaded__will_init_COM
call fcn.004062df
lea edx, [esp + 0x20]
push ebp
push edx
mov byte [esp + 0x2c4], 0x3e
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
call fcn.0040713a
call fcn.004066ea
push str.Trying_to_start_UDP_channel
lea ecx, [esp + 0x24]
movzx esi, ax
call fcn.004062df
lea eax, [esp + 0x20]
push ebp
push eax
mov byte [esp + 0x2c4], 0x3f
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
lea ecx, [esp + 0x78]
push esi
push ecx
call fcn.004083af
push eax
lea edx, [esp + 0x64]
push str.Starting_relay_on_port:
push edx
mov byte [esp + 0x2d0], 0x40
call fcn.00404cfa
add esp, 0x14
push ebp
push eax
mov byte [esp + 0x2c4], 0x41
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x58]
call fcn.00402ed7
lea ecx, [esp + 0x78]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
call fcn.00408a76
mov ecx, eax
call fcn.00403972
mov edi, dword [esp + 0x3c]
test al, al
je 0x4c8302
mov ecx, dword [edi + 0x35c]
lea eax, [esi - 2]
push eax
call fcn.0052c8f0
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x60], esp
push str.16CB9635_CCEA_4184_A4A4_E450754EF940
call fcn.004062df
mov ecx, dword [edi + 0x35c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
push 0x303a
push esi
call eax
lea ecx, [esp + 0x20]
test al, al
jne 0x4c8363
push str.Failed_to_start_the_relay
call fcn.004062df
lea ecx, [esp + 0x20]
push ebp
push ecx
mov byte [esp + 0x2c4], 0x42
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x20]
call fcn.00402ed7
jmp 0x4c8447
push str.Relay_started_successfuly
call fcn.004062df
lea edx, [esp + 0x20]
push ebp
push edx
mov byte [esp + 0x2c4], 0x43
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
push 0x7b67d7
lea ecx, [esp + 0xd0]
call fcn.004062df
push 0x7b6805
lea ecx, [esp + 0x24]
mov byte [esp + 0x2c0], 0x44
call fcn.004062df
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x2c4], 0x45
call fcn.00404ca0
mov ecx, dword [edi + 0x35c]
movzx edx, ax
push edx
call fcn.005366b0
test al, al
lea ecx, [esp + 0x20]
sete byte [esp + 0x1f]
call fcn.00402ed7
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
cmp byte [esp + 0x1f], 0
je 0x4c8442
push str.Failed_to_start_the_SSL_server
lea ecx, [esp + 0x24]
call fcn.004062df
lea eax, [esp + 0x20]
push ebp
push eax
mov byte [esp + 0x2c4], 0x46
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x20]
call fcn.00402ed7
mov byte [esp + 0x1f], 1
lea ecx, [esp + 0x158]
mov byte [esp + 0x2bc], 7
call fcn.00403a26
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x58]
push ecx
call fcn.00408a76
mov ecx, eax
call fcn.00402b21
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x148]
mov byte [esp + 0x2c8], 0x47
call fcn.00406f1e
lea ecx, [esp + 0x58]
mov byte [esp + 0x2bc], 7
call fcn.00403a26
cmp dword [esp + 0x150], ebp
jne 0x4c84d0
push str.Statistics_data_loaded_successfuly
lea ecx, [esp + 0x24]
call fcn.004062df
lea edx, [esp + 0x20]
push ebp
push edx
mov byte [esp + 0x2c4], 0x48
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
jmp 0x4c8520
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.00407662
push eax
lea edx, [esp + 0x64]
push str.Failed_to_load_statistics_data_with_error:
push edx
mov byte [esp + 0x2d0], 0x49
call fcn.00404cfa
add esp, 0x14
push ebp
push eax
mov byte [esp + 0x2c4], 0x4a
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x58]
call fcn.00402ed7
lea ecx, [esp + 0x78]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.004024eb
mov ecx, eax
call fcn.00405c09
cmp byte [esp + 0x1f], 0
je 0x4c8c57
cmp dword [edi + 0x354], ebp
je 0x4c8573
push 4
mov ecx, edi
call fcn.004086b1
push str.Started_as_a_service
lea ecx, [esp + 0x24]
call fcn.004062df
push ebp
lea eax, [esp + 0x24]
mov byte [esp + 0x2c0], 0x4b
push eax
jmp 0x4c858f
push str.Started_as_a_normal_process
lea ecx, [esp + 0x24]
call fcn.004062df
push ebp
lea ecx, [esp + 0x24]
mov byte [esp + 0x2c0], 0x4c
push ecx
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.004024eb
mov ecx, eax
call fcn.00408d50
call fcn.00405d3f
mov ecx, eax
call fcn.004068a2
push 0x405dbc
call fcn.0053ee50
mov edx, dword [edi + 0x35c]
add esp, 4
push edx
call fcn.004024eb
mov ecx, eax
call fcn.00403c1f
push str.Started_main_message_loop
lea ecx, [esp + 0x24]
call fcn.004062df
lea eax, [esp + 0x20]
push ebp
push eax
mov byte [esp + 0x2c4], 0x4d
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
xor edi, edi
call fcn.00408a76
mov ecx, eax
call fcn.00403972
test al, al
je 0x4c872e
push str.redirectport
lea ecx, [esp + 0x24]
call fcn.00403706
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x2c0], 0x4e
call fcn.00407e1e
add esp, 4
lea ecx, [esp + 0x20]
movzx esi, ax
call fcn.00403a26
mov dword [esp + 0x100], 0xf
mov dword [esp + 0xfc], ebp
mov byte [esp + 0xec], 0
mov bl, 0x4f
mov byte [esp + 0x2bc], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
add esi, 0xfffffffe
push esi
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
push edx
lea eax, [esp + 0x60]
push 0x7f000001
push eax
call fcn.004079af
mov ecx, eax
call fcn.004088a0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x2c8], 0x50
call fcn.00403fb2
lea ecx, [esp + 0x58]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
cmp dword [esp + 0xfc], ebp
je 0x4c871a
lea ecx, [esp + 0xe8]
push ecx
lea edx, [esp + 0x5c]
push str.Failed_to_set_PID_for_WFP:
push edx
call fcn.00404cfa
add esp, 0xc
push ebp
push eax
mov byte [esp + 0x2c4], 0x51
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x58]
call fcn.00402ed7
lea ecx, [esp + 0xe8]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
mov byte [0x868b73], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.004024eb
mov ecx, eax
call fcn.00401d3e
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x7b6806
call fcn.004062df
push 1
push ebp
call fcn.0040574a
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
add esp, 0x28
cmp byte [0x868b70], 0
jne 0x4c87dd
call fcn.00408a76
mov ecx, eax
call fcn.004022c5
test al, al
jne 0x4c87dd
push 1
push ebp
push ebp
push ebp
lea eax, [esp + 0xdc]
push eax
call esi
test eax, eax
je 0x4c87d1
mov edi, edi
cmp dword [esp + 0xd0], 0x464
jne 0x4c87b4
mov edi, 1
jmp 0x4c87be
lea ecx, [esp + 0xcc]
push ecx
call ebx
push 1
push ebp
push ebp
push ebp
lea edx, [esp + 0xdc]
push edx
call esi
test eax, eax
jne 0x4c87a0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebp
je 0x4c8772
mov eax, dword [esp + 0x3c]
cmp dword [eax + 0x354], ebp
je 0x4c87f2
push 3
mov ecx, eax
call fcn.004086b1
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x7b6807
call fcn.004062df
push 1
push 1
call fcn.0040574a
add esp, 0x28
call fcn.004024eb
mov ecx, eax
call fcn.00404ca5
push str.Starting_shutdown_process
lea ecx, [esp + 0x24]
mov byte [0x868b71], 1
call fcn.004062df
lea ecx, [esp + 0x20]
push ebp
push ecx
mov byte [esp + 0x2c4], 0x52
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.00408a76
mov ecx, eax
call fcn.00403972
test al, al
je 0x4c8927
mov dword [esp + 0x100], 0xf
mov dword [esp + 0xfc], ebp
mov byte [esp + 0xec], 0
push ebp
push ebp
lea edx, [esp + 0x60]
push ebp
mov bl, 0x53
push edx
mov byte [esp + 0x2cc], bl
call fcn.004079af
mov ecx, eax
call fcn.004088a0
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x2c8], 0x54
call fcn.00403fb2
lea ecx, [esp + 0x58]
mov byte [esp + 0x2bc], bl
call fcn.00402ed7
cmp dword [esp + 0xfc], ebp
je 0x4c8913
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0x5c]
push str.Failed_to_set_PID_on_shutdown_for_WFP:
push ecx
call fcn.00404cfa
add esp, 0xc
push ebp
push eax
mov byte [esp + 0x2c4], 0x55
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x58]
call fcn.00402ed7
lea ecx, [esp + 0xe8]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.00408a76
mov ecx, eax
call fcn.0040764e
mov ecx, 0x868b78
call fcn.0040729d
push str.quickstop
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.00403706
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x2c0], 0x56
call fcn.00407e1e
add esp, 4
cmp eax, 1
lea ecx, [esp + 0x20]
sete bl
mov byte [esp + 0x2bc], 7
call fcn.00403a26
test bl, bl
je 0x4c8985
mov byte [esp + 0x18], 0
call fcn.00405d3f
mov ecx, eax
call fcn.004023f1
call fcn.0040854e
push str.Clearing_sockets
lea ecx, [esp + 0x24]
call fcn.004062df
lea eax, [esp + 0x20]
push ebp
push eax
mov byte [esp + 0x2c4], 0x57
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
mov edi, dword [esp + 0x3c]
mov ecx, dword [edi + 0x35c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov edx, dword [edx + 0x28]
push eax
call edx
push str.Sockets_cleared
lea ecx, [esp + 0xd0]
call fcn.004062df
lea eax, [esp + 0xcc]
push ebp
push eax
mov byte [esp + 0x2c4], 0x58
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
push str.Shutting_down_SSL_and_relay
lea ecx, [esp + 0x108]
call fcn.004062df
lea ecx, [esp + 0x104]
push ebp
push ecx
mov byte [esp + 0x2c4], 0x59
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x104]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.0052c960
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, eax
call fcn.004024eb
mov ecx, eax
call fcn.004022a7
call ebx
sub eax, esi
cmp eax, 0x251c
jbe 0x4c8a98
push ebp
call fcn.00407ac7
add esp, 4
push str.Shutting_down_Async_winsock
lea ecx, [esp + 0x24]
call fcn.004062df
lea edx, [esp + 0x20]
push ebp
push edx
mov byte [esp + 0x2c4], 0x5a
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.00520d10
push str.Shutting_down_Winsock
lea ecx, [esp + 0xd0]
call fcn.004062df
lea eax, [esp + 0xcc]
push ebp
push eax
mov byte [esp + 0x2c4], 0x5b
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.0051b3f0
push str.Winsock_cleared
lea ecx, [esp + 0x108]
call fcn.004062df
lea ecx, [esp + 0x104]
push ebp
push ecx
mov byte [esp + 0x2c4], 0x5c
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x104]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
push str.Clearing_extensions
lea ecx, [esp + 0x124]
call fcn.004062df
lea edx, [esp + 0x120]
push ebp
push edx
mov byte [esp + 0x2c4], 0x5d
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x120]
mov byte [esp + 0x2bc], 7
call fcn.00402ed7
call fcn.004056d2
mov ecx, eax
call fcn.0040241e
call fcn.004055e2
mov ecx, dword [edi + 0x35c]
cmp ecx, ebp
je 0x4c8bc4
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [edi + 0x35c], ebp
call fcn.00408193
call fcn.004024eb
mov ecx, eax
call fcn.00406f64
push ebp
call fcn.00549890
add esp, 4
push ebp
call fcn.00596ac0
mov ecx, eax
call fcn.00596ad0
call fcn.005bc480
mov ecx, eax
call fcn.005c6800
call fcn.00408a76
mov ecx, eax
call fcn.004063a2
call fcn.00408a76
mov ecx, eax
call fcn.00403e04
call fcn.0054e970
call fcn.00550a50
mov ecx, eax
call fcn.005509d0
push str.Shutdown_complete
lea ecx, [esp + 0x24]
call fcn.004062df
lea eax, [esp + 0x20]
push ebp
push eax
mov byte [esp + 0x2c4], 0x5e
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x20]
call fcn.00402ed7
lea ecx, [esp + 0x13c]
call fcn.00403a26
lea ecx, [esp + 0x44]
call fcn.00403d32
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x40
mov byte [0x868b72], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2b4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.00564b24
add esp, 0x2ac
ret