Function at 0x42126e
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0x1c
call fcn.004b898e
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebx], 0x56785f
push ebx
add ebx, 4
push ebx
push 8
call fcn.004b898e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
pop ebx
push ebx
mov eax, esp
push eax
call fcn.0040bb38
pop ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push 0x24
call fcn.004b898e
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 9
rep stosd dword es:[edi], eax
mov dword [ebx], 0x568c95
push ebx
add ebx, 8
push ebx
push 0x70
call fcn.004b898e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x1c
rep stosd dword es:[edi], eax
mov dword [ebx], 0x567c02
push ebx
add ebx, 4
push ebx
push 8
call fcn.004b898e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
add ebx, 0x30
push ebx
push 0xc
call fcn.004b898e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx], 0x567ce6
pop ebx
pop ebx
pop ebx
pop ebx
push ebx
mov eax, esp
push eax
call fcn.004227b9
pop ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
push 8
call fcn.004b898e
add esp, 4
mov dword [ebp - 0x48], eax
mov edi, eax
mov esi, 0x5668dd
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
push 0
mov ebx, 0x4b8ee0
call fcn.004b8994
add esp, 4
mov dword [ebp - 0x60], eax
push str._Config.dat
push dword [ebp - 0x60]
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x64], eax
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421460
push ebx
call fcn.004b899a
add esp, 4
push 0
push 0
push 0
push getpeername
push 0
push str.Cookie_567pan
push getpeername
push 0
push str.Cookie
push getpeername
push 0
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x421491
mov eax, 0x560a3f
push eax
push 4
mov ebx, 0x4bc640
call fcn.004b8994
add esp, 0x34
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x4214b7
push ebx
call fcn.004b899a
add esp, 4
mov eax, dword [ebp - 0x68]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4214cb
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, str.Mozilla_5.0__Windows_NT_10.0__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_86.0.4240.198_Safari_537.36
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4214e5
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, str.https:__www.567site.com_ajax.php
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4214ff
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push str..html
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.https:__www.567site.com_file_
mov ecx, 3
call fcn.00401211
add esp, 0xc
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x421536
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.actionget_vip_flfile_id
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x421568
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
push 1
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, 0x5668ce
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x54]
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x4215a3
push ebx
call fcn.004b899a
add esp, 4
push 0x7530
push 0x7530
push 0x7530
push 0x7530
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x48]
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x94]
push 1
mov eax, str.application_x_www_form_urlencoded
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x98]
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x42160b
push ebx
call fcn.004b899a
add esp, 4
mov eax, str.XMLHttpRequest
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
mov eax, str.X_Requested_With
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x60]
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x421641
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421651
push ebx
call fcn.004b899a
add esp, 4
mov eax, str.https:__www.567site.com_
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
mov eax, str.Origin
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x60]
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x421687
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421697
push ebx
call fcn.004b899a
add esp, 4
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x8c]
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x58]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x34]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4216fe
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x421715
mov eax, 0x5668dd
push eax
push 1
mov ebx, 0x4bad00
call fcn.004b8994
add esp, 0x10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x42173f
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ce29
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x421763
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
push 0x560a3f
push dword [ebp - 0x20]
call fcn.004022ad
add esp, 8
cmp eax, 0
je 0x42179d
push str.trueNOT_VIP
push dword [ebp - 0x20]
call fcn.004022ad
add esp, 8
cmp eax, 0
je 0x42179d
xor eax, eax
jmp 0x4217a2
mov eax, 1
test eax, eax
je 0x421be9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4217ec
mov eax, 0x567a35
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4217e1
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x42263e
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x14]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x42182e
mov eax, 0x567a5e
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x421823
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x42263e
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x421841
mov eax, 0x5668dd
push eax
push 1
mov ebx, 0x4b8ec0
call fcn.004b8994
add esp, 0x10
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], esp
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x421867
add eax, 8
push eax
mov eax, 0x15
call fcn.004b89a6
cmp dword [ebp - 0x64], esp
je 0x42188e
push 0x7bd
push 0x403afcd
push 6
call fcn.004b89a0
add esp, 0xc
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x4218ad
push eax
mov ebx, eax
call fcn.004011a6
inc eax
push eax
call fcn.004b898e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x4218be
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x34], eax
push getpeername
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4218d5
mov eax, 0x560a3f
push eax
push 1
mov ebx, 0x4b8ea0
call fcn.004b8994
add esp, 0x10
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x421918
mov eax, 0x567a8a
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x42190d
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x42263e
push 0
mov ebx, 0x4b8ee0
call fcn.004b8994
add esp, 4
mov dword [ebp - 0x60], eax
push str._login.dat
push dword [ebp - 0x60]
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x64], eax
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421955
push ebx
call fcn.004b899a
add esp, 4
push 0
push 0
push 0
push getpeername
push 0
push 0x568bcf
push getpeername
push 0
push 0x567acf
push getpeername
push 0
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x421986
mov eax, 0x560a3f
push eax
push 4
mov ebx, 0x4bc640
call fcn.004b8994
add esp, 0x34
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x4219ac
push ebx
call fcn.004b899a
add esp, 4
mov eax, dword [ebp - 0x68]
push eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x4219c0
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x38], eax
push 0
mov ebx, 0x4b8ee0
call fcn.004b8994
add esp, 4
mov dword [ebp - 0x60], eax
push str._login.dat
push dword [ebp - 0x60]
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x64], eax
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421a01
push ebx
call fcn.004b899a
add esp, 4
push 0
push 0
push 0
push getpeername
push 0
push 0x568bd9
push getpeername
push 0
push 0x567acf
push getpeername
push 0
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x421a32
mov eax, 0x560a3f
push eax
push 4
mov ebx, 0x4bc640
call fcn.004b8994
add esp, 0x34
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x421a58
push ebx
call fcn.004b899a
add esp, 4
mov eax, dword [ebp - 0x68]
push eax
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x421a6c
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jne 0x421b86
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x421ac0
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0
mov ebx, 0x4b8ee0
call fcn.004b8994
add esp, 4
mov dword [ebp - 0x60], eax
push str._Config.dat
push dword [ebp - 0x60]
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x64], eax
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421b01
push ebx
call fcn.004b899a
add esp, 4
push getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x421b14
mov eax, 0x560a3f
push eax
push getpeername
push 0
push str.Cookie_567pan
push getpeername
push 0
push str.Cookie
push getpeername
push 0
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x421b40
mov eax, 0x560a3f
push eax
push 4
mov ebx, 0x4bc740
call fcn.004b8994
add esp, 0x34
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x421b63
push ebx
call fcn.004b899a
add esp, 4
mov eax, 0x567ae6
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x421b7b
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x421be4
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x421bab
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x421bcb
push eax
mov ebx, eax
call fcn.004011a6
inc eax
push eax
call fcn.004b898e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x421bde
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x42263e
push 0x568be3
push dword [ebp - 0x20]
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], 0
push 0
push dword [ebp - 0x64]
mov dword [ebp - 0x68], 0
push 0
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x6c], 0
push 0
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], 0
push 0
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x74], 0
push 0
push dword [ebp - 0x74]
mov eax, 0x568be3
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
mov eax, str.dl.php_
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0040d13a
mov dword [ebp - 0x80], eax
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421c76
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x7c]
test ebx, ebx
je 0x421c86
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x78]
test ebx, ebx
je 0x421c96
push ebx
call fcn.004b899a
add esp, 4
mov eax, dword [ebp - 0x80]
push eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x421cad
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
push str.https:__vip2.567site.com_dl.php_
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x421cdd
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x44], eax
push 0x560a40
push dword [ebp - 0x44]
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x60], eax
push getpeername
push 0
mov eax, dword [ebp - 0x60]
test eax, eax
jne 0x421d0c
mov eax, 0x560a3f
push eax
push 0x10005
push 0x1603afc8
push 0x52010001
push 2
mov ebx, 0x4bc590
call fcn.004b8994
add esp, 0x1c
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421d3e
push ebx
call fcn.004b899a
add esp, 4
push str..html
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.https:__www.567site.com_down2_
mov ecx, 3
call fcn.00401211
add esp, 0xc
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x421d71
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push str..html
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.https:__www.567site.com_down_
mov ecx, 3
call fcn.00401211
add esp, 0xc
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x421da8
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 1
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, 0x5668bd
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x54]
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421de3
push ebx
call fcn.004b899a
add esp, 4
push 1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x80]
push 0x3a98
push 0x3a98
push 0x3a98
push 0x3a98
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x48]
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x94]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x8c]
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x58]
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x421e8b
push ebx
call fcn.004b899a
add esp, 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x34]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x421eb0
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x421ec7
mov eax, 0x5668dd
push eax
push 1
mov ebx, 0x4bad00
call fcn.004b8994
add esp, 0x10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x421ef1
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ce29
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x421f15
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
mov dword [ebp - 0x64], 0
push 0
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x68], 0
push 0
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], 0
push 0
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x70], 0
push 0
push dword [ebp - 0x70]
mov eax, 0x56695d
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x74]
push eax
mov eax, str.data_:_
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040d13a
mov dword [ebp - 0x7c], eax
mov ebx, dword [ebp - 0x78]
test ebx, ebx
je 0x421f8b
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x74]
test ebx, ebx
je 0x421f9b
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 0x7c]
mov ecx, 2
call fcn.00401211
add esp, 8
mov dword [ebp - 0x80], eax
mov ebx, dword [ebp - 0x7c]
test ebx, ebx
je 0x421fc6
push ebx
call fcn.004b899a
add esp, 4
mov eax, dword [ebp - 0x80]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x421fdd
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
mov eax, str.https:__www.567site.com_ajax.php
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x421ff7
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push str..html
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.https:__www.567site.com_down_
mov ecx, 3
call fcn.00401211
add esp, 0xc
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42202e
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push 1
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, 0x5668ce
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x54]
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x422069
push ebx
call fcn.004b899a
add esp, 4
push 0x7530
push 0x7530
push 0x7530
push 0x7530
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x48]
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x94]
push 1
mov eax, str.application_x_www_form_urlencoded
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x98]
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x4220d1
push ebx
call fcn.004b899a
add esp, 4
mov eax, str.XMLHttpRequest
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
mov eax, str.X_Requested_With
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x60]
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x422107
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x422117
push ebx
call fcn.004b899a
add esp, 4
mov eax, str.https:__www.567site.com_
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
mov eax, str.Origin
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x60]
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x42214d
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x42215d
push ebx
call fcn.004b899a
add esp, 4
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x8c]
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x58]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x34]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4221c4
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4221db
mov eax, 0x5668dd
push eax
push 1
mov ebx, 0x4bad00
call fcn.004b8994
add esp, 0x10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x422205
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ce29
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x422229
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
push 0x560a3f
push dword [ebp - 0x20]
call fcn.004022ad
add esp, 8
cmp eax, 0
jne 0x422269
mov eax, 0x568304
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x42225e
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x42263e
push 0x567b19
push dword [ebp - 0x20]
call fcn.004022ad
add esp, 8
cmp eax, 0
jne 0x4222a5
mov eax, 0x568c57
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x42229a
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x42263e
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x60]
push eax
push 1
lea eax, [ebp - 0x48]
push eax
mov eax, 0x567b1f
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
mov eax, str._a_href_
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041a058
mov ebx, dword [ebp - 0x68]
test ebx, ebx
je 0x4222e9
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x4222f9
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x422309
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x48]
call fcn.0040b35c
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jle 0x42261b
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
push eax
lea eax, [ebp - 0x50]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x4224fe
mov ebx, dword [ebp - 0x48]
call fcn.0040228d
push ebx
push ecx
mov eax, dword [ebp - 0x50]
dec eax
jns 0x42235f
push 0x1981
push 0x403afcd
push 4
call fcn.004b89a0
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x42237c
push 0x1981
push 0x403afcd
push 1
call fcn.004b89a0
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], 0
push 0
push dword [ebp - 0x64]
mov dword [ebp - 0x68], 0
push 0
push dword [ebp - 0x68]
push dword [ebp - 0x60]
call fcn.00415c1f
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
push eax
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x4223bb
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x54], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push getpeername
push 0
push 0x568c91
push getpeername
push 0
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x4223f0
mov eax, 0x560a3f
push eax
push 4
mov ebx, 0x4b94a0
call fcn.004b8994
add esp, 0x34
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jle 0x4224f6
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
mov dword [ebp - 0x64], 0
push 0
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x68], 0
push 0
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], 0
push 0
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x70], 0
push 0
push dword [ebp - 0x70]
mov eax, 0x56836e
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x74]
push eax
mov eax, 0x568c91
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0040d13a
mov dword [ebp - 0x7c], eax
mov ebx, dword [ebp - 0x78]
test ebx, ebx
je 0x422482
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x74]
test ebx, ebx
je 0x422492
push ebx
call fcn.004b899a
add esp, 4
mov eax, dword [ebp - 0x7c]
push eax
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x4224a6
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x58], eax
push 0x560a3f
push dword [ebp - 0x58]
call fcn.004022ad
add esp, 8
cmp eax, 0
je 0x4224f6
push dword [ebp - 0x58]
push 0x560a49
push dword [ebp - 0x5c]
mov ecx, 3
call fcn.00401211
add esp, 0xc
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x4224f2
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x5c], eax
pop eax
pop ebx
pop ecx
jmp 0x42232a
add esp, 0xc
push getpeername
push 0
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x422514
mov eax, 0x560a3f
push eax
push 1
mov ebx, 0x4b8ea0
call fcn.004b8994
add esp, 0x10
mov dword [ebp - 0x68], eax
fild dword [ebp - 0x68]
fstp qword [ebp - 0x68]
fld qword [ebp - 0x68]
fsub qword [0x566e1c]
fstp qword [ebp - 0x70]
fld qword [ebp - 0x70]
call fcn.00402352
push 0x80000301
push 0
push eax
push getpeername
push 0
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x42255f
mov eax, 0x560a3f
push eax
push 2
mov ebx, 0x4b91f0
call fcn.004b8994
add esp, 0x1c
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
push eax
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x422589
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov dword [ebp - 0x5c], eax
mov ebx, dword [ebp - 0x48]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4225ab
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4225a7
imul eax, dword [ebx]
jmp 0x42259c
mov ecx, eax
test ecx, ecx
je 0x4225ca
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4225c3
push ebx
push eax
call fcn.004b899a
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4225b1
call fcn.004b899a
add esp, 4
mov eax, 0x5668dd
mov dword [ebp - 0x48], eax
push dword [ebp - 0x5c]
push 0x567f00
push dword [ebp - 0x44]
push 0x567b19
mov ecx, 4
call fcn.00401211
add esp, 0x10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x422610
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x422639
mov eax, 0x567baf
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x422633
push ebx
call fcn.004b899a
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
jmp 0x42263e
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42264e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42265e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x42266e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42267e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x42268e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4226ae
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x4226be
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x28]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x4226de
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x4226ee
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x4226fe
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x42270e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x42271e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x42272e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x42273e
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x48]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x42275c
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x422758
imul eax, dword [ebx]
jmp 0x42274d
mov ecx, eax
test ecx, ecx
je 0x42277b
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x422774
push ebx
push eax
call fcn.004b899a
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x422762
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x422793
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x4227a3
push ebx
call fcn.004b899a
add esp, 4
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x4227b3
push ebx
call fcn.004b899a
add esp, 4
mov esp, ebp
pop ebp
ret 8