Function at 0x401005
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
sub esp, 0x230
mov eax, dword [0x432480]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [esp + 0x238]
push ebx
push esi
push edi
mov edi, dword [esp + 0x240]
xor ebx, ebx
push 0xff
mov dword [esp + 0x10], eax
lea eax, [esp + 0x13d]
push ebx
push eax
mov byte [esp + 0x144], bl
call fcn.0040c490
add esp, 0xc
mov esi, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
call fcn.00407838
test eax, eax
jne 0x401f61
push ebp
push ebx
push ebx
xor ebp, ebp
inc ebp
push ebp
push ebp
push dword [esp + 0x20]
push edi
push ebx
call sub.libav.dll_Ordinal_44284
add esp, 0x1c
mov dword [0x434d00], eax
test eax, eax
jne 0x401124
lea eax, [esp + 0xe8]
push eax
mov dword [esp + 0xf2], 0x72617020
mov dword [esp + 0xf6], 0x63206573
mov dword [esp + 0xff], 0x696c2064
mov dword [esp + 0x10a], 0x5c736e6f
mov word [esp + 0x106], 0x706f
mov dword [esp + 0xed], 0x276e6143
mov word [esp + 0x103], 0x656e
mov dword [esp + 0xfb], 0x6e616d6d
mov byte [esp + 0xec], 0x21
mov word [esp + 0x10e], 0x6e
mov byte [esp + 0xfa], 0x6f
mov word [esp + 0x108], 0x6974
mov byte [esp + 0x105], 0x20
mov byte [esp + 0xf1], 0x74
call fcn.00407d98
pop ecx
jmp 0x401f46
lea eax, [esp + 0x13c]
push eax
push ebx
push ebx
push 0x23
push ebx
call fcn.00406e1e
push 0x42912c
mov edi, 0x100
lea eax, [esp + 0x154]
push edi
push eax
call fcn.0040840b
call fcn.00401f69
push eax
lea eax, [esp + 0x160]
push edi
push eax
call fcn.0040840b
lea eax, [esp + 0x168]
push eax
push edi
mov edi, 0x434b00
push edi
call fcn.004083b6
push 0x429130
push 0x100
push edi
call fcn.0040840b
add esp, 0x44
call fcn.00401f69
push eax
push 0x100
push edi
call fcn.0040840b
lea eax, [esp + 0x4c]
push eax
push 0x100
push edi
mov word [esp + 0x5b], 0x666e
mov word [esp + 0x58], 0x632e
mov byte [esp + 0x5d], bl
mov byte [esp + 0x5a], 0x6f
call fcn.0040840b
lea eax, [esp + 0x154]
push eax
push 0x100
push 0x434900
call fcn.004083b6
lea eax, [esp + 0x94]
push eax
push 0x100
push 0x434900
mov word [esp + 0xa8], 0x6573
mov dword [esp + 0xa3], 0x62617461
mov word [esp + 0xa1], 0x645c
mov byte [esp + 0xa0], 0x5c
mov byte [esp + 0xaa], bl
mov byte [esp + 0xa7], 0x61
call fcn.0040840b
lea eax, [esp + 0x60]
push eax
push dword [0x434d00]
mov dword [esp + 0x69], 0x706c65
mov byte [esp + 0x68], 0x68
call sub.libav.dll_Ordinal_44283
add esp, 0x38
cmp dword [eax + 0x18], ebx
je 0x401260
call fcn.0040203c
push dword [0x434d00]
call sub.libav.dll_Ordinal_44285
pop ecx
jmp 0x401437
lea eax, [esp + 0x38]
push eax
push dword [0x434d00]
mov dword [esp + 0x42], 0x677562
mov word [esp + 0x40], 0x6564
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x40128d
mov word [0x4335f0], bp
push edi
call fcn.00426b40
push dword [0x434d00]
mov edi, eax
push ebx
push ebp
push ebp
push ebx
push ebx
push 0x434b00
call sub.libav.dll_Ordinal_44284
add esp, 0x20
mov dword [0x434d00], eax
push edi
test eax, eax
jne 0x401396
lea eax, [esp + 0x110]
push eax
mov dword [esp + 0x131], 0x69666e6f
mov word [esp + 0x120], 0x6f20
mov dword [esp + 0x13d], 0x6e5c73
mov dword [esp + 0x12d], 0x63206568
mov dword [esp + 0x128], 0x20657372
mov word [esp + 0x123], 0x6e65
mov dword [esp + 0x11b], 0x276e6143
mov dword [esp + 0x114], 0x4f525245
mov byte [esp + 0x12c], 0x74
mov dword [esp + 0x136], 0x6c696620
mov word [esp + 0x119], 0x203a
mov word [esp + 0x126], 0x6170
mov word [esp + 0x13a], 0x2065
mov byte [esp + 0x118], 0x52
mov byte [esp + 0x122], 0x70
mov byte [esp + 0x125], 0x2f
mov byte [esp + 0x13c], 0x25
mov byte [esp + 0x11f], 0x74
mov byte [esp + 0x135], 0x67
call fcn.00408641
add eax, 0x40
push eax
call fcn.004087a8
push edi
call fcn.004090de
add esp, 0x10
jmp 0x401f46
call fcn.004090de
lea eax, [esp + 0x4c]
push eax
push dword [0x434d00]
mov dword [esp + 0x56], 0x6f697372
mov word [esp + 0x54], 0x6576
mov word [esp + 0x5a], 0x6e
call sub.libav.dll_Ordinal_44283
add esp, 0xc
cmp dword [eax + 0x18], ebx
je 0x40143e
lea eax, [esp + 0xac]
push eax
push dword [0x434d00]
mov word [esp + 0xc4], 0x79
mov dword [esp + 0xb8], 0x65736162
mov dword [esp + 0xb4], 0x61746144
mov word [esp + 0xc1], 0x6f74
mov dword [esp + 0xbc], 0x65726944
mov byte [esp + 0xc0], 0x63
mov byte [esp + 0xc3], 0x72
call sub.libav.dll_Ordinal_44283
push dword [eax + 8]
call fcn.004076f8
push dword [0x434d00]
call sub.libav.dll_Ordinal_44285
add esp, 0x10
xor eax, eax
jmp 0x401f48
lea eax, [esp + 0x7c]
push eax
push dword [0x434d00]
mov dword [esp + 0x8d], 0x6b636f6c
mov word [esp + 0x85], 0x676f
mov word [esp + 0x8b], 0x6e55
mov word [esp + 0x88], 0x6c69
mov byte [esp + 0x91], bl
mov byte [esp + 0x87], 0x46
mov byte [esp + 0x84], 0x4c
mov byte [esp + 0x8a], 0x65
mov dword [esp + 0x30], 0x54676f4c
mov dword [esp + 0x34], 0x656d69
mov dword [esp + 0x9f], 0x657a69
mov word [esp + 0x94], 0x6f4c
mov word [esp + 0x9c], 0x7861
mov dword [esp + 0x97], 0x656c6946
mov byte [esp + 0x9b], 0x4d
mov byte [esp + 0x96], 0x67
mov byte [esp + 0x9e], 0x53
mov word [esp + 0x6f], 0x6556
mov dword [esp + 0x72], 0x65736f62
mov word [esp + 0x6c], 0x6f4c
mov byte [esp + 0x76], bl
mov byte [esp + 0x6e], 0x67
mov byte [esp + 0x71], 0x72
mov dword [esp + 0x60], 0x52676f4c
mov dword [esp + 0x64], 0x7461746f
mov word [esp + 0x68], 0x65
mov word [esp + 0xae], 0x6f65
mov word [esp + 0xb1], 0x74
mov dword [esp + 0xaa], 0x6d695466
mov dword [esp + 0xa4], 0x646e6553
mov byte [esp + 0xb0], 0x75
mov word [esp + 0xa8], 0x7542
mov word [esp + 0x5d], 0x656c
mov dword [esp + 0x58], 0x46676f4c
mov byte [esp + 0x5c], 0x69
mov byte [esp + 0x5f], bl
mov dword [esp + 0xe0], 0x6c6c7566
mov dword [esp + 0xc9], 0x524f5252
mov dword [esp + 0xd0], 0x6946676f
mov word [esp + 0xd8], 0x7165
mov word [esp + 0xea], 0x6e5c
mov dword [esp + 0xe5], 0x68746170
mov word [esp + 0xd5], 0x2065
mov dword [esp + 0xdc], 0x20736572
mov word [esp + 0xce], 0x4c20
mov byte [esp + 0xe4], 0x20
mov word [esp + 0xda], 0x6975
mov byte [esp + 0xc8], 0x45
mov byte [esp + 0xcd], 0x3a
mov byte [esp + 0xd4], 0x6c
mov byte [esp + 0xec], bl
mov byte [esp + 0xe9], 0x2e
mov byte [esp + 0xd7], 0x72
call sub.libav.dll_Ordinal_44283
xor ecx, ecx
cmp dword [eax + 0x18], ebx
lea eax, [esp + 0x30]
sete cl
push eax
push dword [0x434d00]
mov word [0x4321e8], cx
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x18]
mov word [0x433a5c], ax
lea eax, [esp + 0x38]
push eax
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x18]
mov word [0x4335f4], ax
lea eax, [esp + 0xa4]
push eax
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov eax, dword [eax + 0x10]
mov dword [0x433a68], eax
lea eax, [esp + 0x84]
push eax
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x18]
add esp, 0x28
mov word [0x433a74], ax
mov word [0x433a54], ax
cmp dword [0x433a68], ebx
je 0x4016bf
lea eax, [esp + 0x58]
push eax
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x18]
pop ecx
pop ecx
mov word [0x433a64], ax
lea eax, [esp + 0x9c]
push eax
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov ax, word [eax + 0x10]
mov word [0x4321ec], ax
lea eax, [esp + 0x58]
push eax
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
add esp, 0x10
cmp dword [eax + 0x18], ebx
je 0x401731
mov eax, dword [eax + 8]
push eax
mov dword [0x433a6c], eax
call fcn.00407a7e
pop ecx
test eax, eax
jne 0x401724
lea eax, [esp + 0xc0]
push eax
call fcn.00408641
add eax, 0x40
push eax
call fcn.004087a8
pop ecx
pop ecx
jmp 0x401f09
lea eax, [esp + 0x20]
push eax
call fcn.004093f9
pop ecx
jmp 0x401737
mov dword [0x433a6c], ebx
push str.DevLiblog
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401759
push 0x403672
call sub.libav.dll_Ordinal_33
pop ecx
push ebx
call sub.libav.dll_Ordinal_17
pop ecx
test eax, eax
jne 0x401f09
push str.Debug
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
push 2
pop edi
cmp dword [eax + 0x18], ebx
je 0x40178e
call sub.libav.dll_Ordinal_6
mov word [0x433a54], di
push str.TCPSocket
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
cmp dword [eax + 0x18], ebx
mov edi, ebx
push str.LocalSocket
push dword [0x434d00]
cmovne edi, ebp
mov dword [esp + 0x2c], edi
call sub.libav.dll_Ordinal_44283
add esp, 0x10
cmp dword [eax + 0x18], ebx
mov ecx, ebx
cmovne ecx, ebp
test edi, edi
jne 0x4017d1
test ecx, ecx
je 0x401f09
push str.StreamMinPort
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov edi, dword [eax + 0x10]
push str.StreamMaxPort
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov eax, dword [eax + 0x10]
add esp, 0x10
cmp edi, 0x400
jl 0x401f09
cmp edi, eax
jg 0x401f09
cmp eax, 0xffff
jg 0x401f09
call sub.libav.dll_Ordinal_11
mov dword [0x4335f8], eax
test eax, eax
je 0x401f09
push str.disable_cache
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401854
push ebx
push ebp
push 0x18
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push 0x1770
call fcn.004071d2
mov dword [esp], str.DetectPUA
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x4019f5
or dword [0x4335fc], 0x10
push str.ExcludePUA
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov edx, eax
pop ecx
pop ecx
mov dword [esp + 0x10], edx
cmp dword [edx + 0x18], ebx
je 0x401916
or dword [0x4335fc], 0x200
mov edi, ebx
mov ecx, dword [edx + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4018b1
sub ecx, edx
lea eax, [ecx + 3]
add eax, edi
push eax
push esi
call fcn.00409116
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x401946
mov eax, dword [esp + 0x10]
lea ecx, [edi + esi]
push dword [eax + 8]
push 0x4291a8
push ecx
call fcn.00408b30
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [edx + 8]
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4018f4
sub ecx, dword [esp + 0x10]
inc edi
add edi, ecx
mov byte [edi + esi], bl
mov edx, dword [edx + 0x28]
mov dword [esp + 0x10], edx
test edx, edx
jne 0x4018ab
mov word [edi + esi], 0x2e
push str.IncludePUA
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov edx, eax
pop ecx
pop ecx
mov dword [esp + 0x10], edx
cmp dword [edx + 0x18], ebx
je 0x4019d1
test esi, esi
je 0x401956
push esi
call fcn.004090de
jmp 0x40171e
push dword [0x4335f8]
call sub.libav.dll_Ordinal_9
jmp 0x40171e
or dword [0x4335fc], 0x100
mov edi, ebx
mov ecx, dword [edx + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401968
sub ecx, edx
lea eax, [ecx + 3]
add eax, edi
push eax
push esi
call fcn.00409116
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x401f09
mov eax, dword [esp + 0x10]
push dword [eax + 8]
lea eax, [edi + esi]
push 0x4291a8
push eax
call fcn.00408b30
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [edx + 8]
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4019af
sub ecx, dword [esp + 0x10]
inc edi
add edi, ecx
mov byte [edi + esi], bl
mov edx, dword [edx + 0x28]
mov dword [esp + 0x10], edx
test edx, edx
jne 0x401962
mov word [edi + esi], 0x2e
test esi, esi
je 0x4019f5
push esi
push 6
push dword [0x4335f8]
call sub.libav.dll_Ordinal_13
add esp, 0xc
push esi
test eax, eax
jne 0x40193c
call fcn.004090de
pop ecx
push str.StatsEnabled
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401a18
push dword [0x4335f8]
call sub.libav.dll_Ordinal_70
pop ecx
push str.StatsPEDisabled
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401a41
push ebx
push ebp
push 0x19
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
mov esi, str.StatsTimeout
push esi
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401a7b
push esi
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1a
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x18
mov esi, str.StatsHostID
push esi
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401b5d
push esi
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov esi, dword [eax + 8]
push 8
push str.default
push esi
call fcn.00409574
add esp, 0x14
test eax, eax
je 0x401b5d
push 5
push str.none
push esi
call fcn.00409574
add esp, 0xc
test eax, eax
jne 0x401ae2
push ebx
push dword [0x4335f8]
call sub.libav.dll_Ordinal_46
pop ecx
pop ecx
jmp 0x401b4b
push 0xa
push str.anonymous
push esi
call fcn.00409574
add esp, 0xc
test eax, eax
jne 0x401b08
push 9
pop ecx
mov esi, str.5b585e8f_3be5_11e3_bf0b_18037319526c
mov edi, 0x434d20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x401b4b
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b0d
sub ecx, edx
cmp ecx, 0x24
jbe 0x401b3a
push ebx
push dword [0x4335f8]
call sub.libav.dll_Ordinal_42
push dword [0x4335f8]
call sub.libav.dll_Ordinal_9
add esp, 0xc
jmp 0x401f09
mov ecx, 0x434d20
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
test al, al
jne 0x401b41
push 0x401faf
push dword [0x4335f8]
call sub.libav.dll_Ordinal_46
pop ecx
pop ecx
push str.OfficialDatabaseOnly
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401b7e
or dword [0x4335fc], 0x1000
push str.TemporaryDirectory
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401bb0
push dword [eax + 8]
push 0xd
push dword [0x4335f8]
call sub.libav.dll_Ordinal_13
add esp, 0xc
test eax, eax
jne 0x401f09
push 0x403643
push dword [0x4335f8]
call sub.libav.dll_Ordinal_34
push str.LeaveTemporaryFiles
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
add esp, 0x10
cmp dword [eax + 0x18], ebx
je 0x401bea
push ebx
push ebp
push 0xe
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.ForceToDisk
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401c13
push ebx
push ebp
push 0x17
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.PhishingSignatures
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401c31
or dword [0x4335fc], 2
push str.Bytecode
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401d8b
or dword [0x4335fc], 0x2000
push str.BytecodeSecurity
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401cbe
mov esi, dword [eax + 8]
push 0xc
push str.TrustSigned
push esi
call fcn.00409574
add esp, 0xc
test eax, eax
jne 0x401c88
mov eax, ebp
jmp 0x401ca3
push 9
push str.Paranoid
push esi
call fcn.00409574
add esp, 0xc
test eax, eax
jne 0x401f09
push 2
pop eax
cdq
push edx
push eax
push 0xf
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
test eax, eax
jne 0x401f09
push str.BytecodeUnsigned
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401cdf
or dword [0x4335fc], 0x8000
push str.BytecodeMode
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov esi, eax
pop ecx
pop ecx
cmp dword [esi + 0x18], ebx
je 0x401d5e
push 9
push str.ForceJIT
push dword [esi + 8]
call fcn.00409574
add esp, 0xc
test eax, eax
jne 0x401d12
mov ecx, ebp
jmp 0x401d49
push 0x11
push str.ForceInterpreter
push dword [esi + 8]
call fcn.00409574
add esp, 0xc
test eax, eax
jne 0x401d2d
push 2
pop ecx
jmp 0x401d49
push 5
push str.Test
push dword [esi + 8]
call fcn.00409574
add esp, 0xc
xor ecx, ecx
push 3
pop edx
test eax, eax
cmove ecx, edx
mov eax, ecx
cdq
push edx
push eax
push 0x11
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.BytecodeTimeout
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401d8b
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.PhishingScanURLs
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401da9
or dword [0x4335fc], 8
push str.DevACOnly
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401dd2
push ebx
push ebp
push 0xa
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.DevACDepth
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401dff
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
push dword [0x4335f8]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push dword [0x4335fc]
lea eax, [esp + 0x1c]
push eax
push dword [0x4335f8]
push 0x434900
call sub.libav.dll_Ordinal_18
add esp, 0x10
test eax, eax
jne 0x401f09
push str.DisableCertCheck
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], ebx
je 0x401e4a
mov eax, dword [0x4335f8]
mov eax, dword [eax + 0x70]
or dword [eax], 0x20000
push dword [0x4335f8]
call sub.libav.dll_Ordinal_8
pop ecx
test eax, eax
jne 0x401f09
cmp dword [esp + 0x1c], ebx
je 0x401edd
push str.TCPAddr
push dword [0x434d00]
call sub.libav.dll_Ordinal_44283
mov esi, eax
pop ecx
pop ecx
cmp dword [esi + 0x18], ebx
je 0x401ebf
mov edi, dword [esi + 8]
test edi, edi
je 0x401edd
push 4
push 0x429374
push edi
call fcn.00409574
push dword [0x434d00]
xor ecx, ecx
test eax, eax
cmove edi, ecx
push edi
lea eax, [esp + 0x28]
push eax
push 0x4335e8
call fcn.00405b06
add esp, 0x1c
cmp eax, 0xffffffff
je 0x401f09
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x401e7d
jmp 0x401edd
push dword [0x434d00]
lea eax, [esp + 0x18]
push ebx
push eax
push 0x4335e8
call fcn.00405b06
add esp, 0x10
cmp eax, 0xffffffff
je 0x401f09
cmp dword [esp + 0x14], ebx
je 0x401f24
push dword [0x434d00]
push dword [0x4335fc]
push dword [0x4335f8]
push dword [esp + 0x20]
push dword [0x4335e8]
call fcn.00403678
add esp, 0x14
mov ebp, eax
cmp dword [esp + 0x14], ebx
jbe 0x401f24
mov eax, dword [0x4335e8]
push dword [eax + ebx*4]
call sub.libav.dll_Ordinal_44331
inc ebx
pop ecx
cmp ebx, dword [esp + 0x14]
jb 0x401f0f
push dword [0x4335e8]
call fcn.004090de
call fcn.00407d6b
push dword [0x434d00]
call sub.libav.dll_Ordinal_44285
pop ecx
pop ecx
call sub.libav.dll_Ordinal_49
mov eax, ebp
mov ecx, dword [esp + 0x23c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409448
add esp, 0x230
ret
push 1
call fcn.004090ca
int3