Function at 0x40c52c
Capabilities:
Create pipe
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x78
mov eax, dword [ecx + 0x3c]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x50], ecx
add eax, 0x2104
mov dword [ebp - 0x60], eax
mov eax, dword [ecx + 4]
push 0x20
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], eax
call fcn.0040c4c6
add esp, 0xc
test eax, eax
jne 0x40c57e
mov eax, dword [ebp - 0x5c]
sub esp, 0xc
push dword [eax + 0x3c]
mov ecx, eax
call fcn.00408afc
or eax, 0xffffffff
add esp, 0xc
jmp 0x40dcae
test byte [0x46d97a], 0x20
mov esi, eax
lea ebx, [ebp - 0x50]
mov eax, dword [0x42e8a0]
je 0x40c5fb
test eax, eax
je 0x40c59a
cmp byte [eax], 0
jne 0x40c5a9
cmp dword [0x46de40], 0
mov edx, 0x440bd5
cmove eax, edx
push str._td__font_size2_classf__b__a_href___admin__conf_Setting__a___b___font___td__td__font_size2_classf__b__a_href___admin__host_Users__Virtual_Hosts__a___b___font___td__td__font_size2_classf__b__a_href___admin__logl_Current_Log__a___b___font___td_
push eax
push str.HTTP_1.1_200_Ok_r_nPragma:_no_cache_r_nContent_Type:_text_html_s_r_n_r_n_html__head__style__nfont_font_size:10pt__font_family:_Times_serif___nfont.ffont_size:9pt__line_height:10pt___font_family:_Times_serif___nfont.f2font_size:9pt__line_height:11pt_nfont.f5font_size:8pt__line_height:12pt_nfont.f3__font.f3a_font_size:8pt__line_height:9pt___nfont.f3a_white_space:_nowrap__ntable__border_collapse:_collapse___border_spacing:_0px___font_size:10pt__line_height:11pt__font_family:_Times_serif___n__style__script_languagejavascript__function_SHTbl_tb__var_tbl_lnk___tbldocument.getElementById_tb____lnkdocument.getElementById_ltb____if_tbl.style.display___none_____tbl.style.display_______if_lnk__lnk.innerHTML__________else__tbl.style.display___none____if_lnk__lnk.innerHTML________n__script__n_title_Administration_of_Small_HTTP_server__title___head__body_bgcolorffffff_text000000__center__h2_Small_HTTP_server__h2__br_Administration_page._br__br__table_cellspacing3_cellpadding8_border0_width90____tr_valigntop_aligncenter__s_td__font_size2_classf__b__a_href___admin__stat_Current_statistics__a_____a_href___admin__stat_t0_pages__a___b___font___td__td__font_size2_classf__b__a_href___admin__stte_Current_state__a___b___font___td__td__font_size2_classf__b__a_href___admin__susr_Summary_statistics__a___b___font___td__td__font_size2_classf__b__a_href___admin__logo_Logout__a___b___font___td___tr___table_
push ebx
call fcn.0042ce14
mov ecx, ebx
call fcn.0040bf28
mov eax, dword [ebp - 0x5c]
add esp, 0x10
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + 0x60]
cmp dword [edx + eax + 0xa], 0x656c6966
jne 0x40c627
sub esp, 0xc
mov ecx, dword [ebp - 0x5c]
push esi
call fcn.004285e0
add esp, 0xc
cmp eax, 0xa2
jne 0x40d785
call fcn.004241df
jmp 0x40d785
test eax, eax
je 0x40c604
cmp byte [eax], 0
jne 0x40c613
cmp dword [0x46de40], 0
mov edx, 0x440bd5
cmove eax, edx
push 0x440bc2
push eax
push str.HTTP_1.1_200_Ok_r_nPragma:_no_cache_r_nContent_Type:_text_html_s_r_n_r_n_html__head__style__nfont_font_size:10pt__font_family:_Times_serif___nfont.ffont_size:9pt__line_height:10pt___font_family:_Times_serif___nfont.f2font_size:9pt__line_height:11pt_nfont.f5font_size:8pt__line_height:12pt_nfont.f3__font.f3a_font_size:8pt__line_height:9pt___nfont.f3a_white_space:_nowrap__ntable__border_collapse:_collapse___border_spacing:_0px___font_size:10pt__line_height:11pt__font_family:_Times_serif___n__style__script_languagejavascript__function_SHTbl_tb__var_tbl_lnk___tbldocument.getElementById_tb____lnkdocument.getElementById_ltb____if_tbl.style.display___none_____tbl.style.display_______if_lnk__lnk.innerHTML__________else__tbl.style.display___none____if_lnk__lnk.innerHTML________n__script__n_title_Administration_of_Small_HTTP_server__title___head__body_bgcolorffffff_text000000__center__h2_Small_HTTP_server__h2__br_Administration_page._br__br__table_cellspacing3_cellpadding8_border0_width90____tr_valigntop_aligncenter__s_td__font_size2_classf__b__a_href___admin__stat_Current_statistics__a_____a_href___admin__stat_t0_pages__a___b___font___td__td__font_size2_classf__b__a_href___admin__stte_Current_state__a___b___font___td__td__font_size2_classf__b__a_href___admin__susr_Summary_statistics__a___b___font___td__td__font_size2_classf__b__a_href___admin__logo_Logout__a___b___font___td___tr___table_
push ebx
call fcn.0042ce14
add esp, 0x10
mov ecx, ebx
call fcn.0040bf28
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c18
push dword [eax + 0x54]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40c6b1
sub esp, 0xc
push eax
call fcn.0041244e
add esp, 0x10
mov esi, eax
test eax, eax
je 0x40c6b1
cmp eax, 0x8000
jle 0x40c695
push ebx
mov ecx, dword [ebp - 0x5c]
push ebx
push dword [ebp - 0x60]
push 0x440c27
call fcn.0042d734
pop esi
pop edi
jmp 0x40d785
push ecx
mov ecx, esi
sub ecx, eax
push ecx
push edx
push edi
call dword [edi + 8]
add esp, 0x10
test eax, eax
jle 0x40d785
mov edi, dword [ebp - 0x5c]
add dword [edi + 0x68], eax
mov eax, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x5c]
mov eax, dword [eax + 0x68]
mov ecx, dword [edi + 0x4c]
lea edx, [ecx + eax]
cmp eax, esi
jl 0x40c679
mov eax, dword [ebp - 0x5c]
mov dword [eax + 0x48], ecx
mov byte [edx], 0
mov ecx, dword [ebp - 0x5c]
call fcn.00406318
mov eax, dword [ebp - 0x5c]
test byte [0x46d97a], 0x20
mov edi, dword [eax + 0x3c]
mov esi, dword [eax + 0x60]
jne 0x40c715
mov eax, dword [edi + esi + 0xa]
cmp eax, 0x74617473
setne cl
cmp eax, 0x72737573
setne dl
test cl, dl
je 0x40c715
cmp eax, 0x65747473
je 0x40c715
push edi
mov ecx, dword [ebp - 0x5c]
push edi
push dword [ebp - 0x60]
push dword [0x433978]
call fcn.0042d734
mov eax, dword [ebp - 0x5c]
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + 0x60]
mov dword [edx + eax + 0xa], 0x74617473
pop eax
pop edx
jmp 0x40d4b3
mov eax, dword [edi + esi + 0xa]
cmp eax, 0x6e646e73
je 0x40cc9c
ja 0x40c77f
cmp eax, 0x656d696d
je 0x40cb95
ja 0x40c759
cmp eax, 0x61657262
je 0x40ce70
cmp eax, 0x656c7061
je 0x40cade
cmp eax, 0x61656c63
je 0x40cd2a
jmp 0x40d751
cmp eax, 0x666e6f63
je 0x40c7ea
cmp eax, 0x6c676f6c
je 0x40d66e
cmp eax, 0x65747473
je 0x40cfc4
jmp 0x40d751
cmp eax, 0x72737573
je 0x40d661
ja 0x40c7b2
cmp eax, 0x70636864
je 0x40cf6b
cmp eax, 0x72657375
je 0x40d024
cmp eax, 0x6f676f6c
je 0x40cf6b
jmp 0x40d751
cmp eax, 0x74736572
je 0x40ccdc
ja 0x40c7da
cmp eax, 0x736e646c
je 0x40cca8
cmp eax, 0x74617473
jne 0x40d751
jmp 0x40d4b3
cmp eax, 0x74736f68
je 0x40d374
jmp 0x40d751
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x58], 0x46dce0
je 0x40ccad
mov dword [ebp - 0x68], 0
mov ebx, 0x4308c0
cmp dword [ebx + 0x10], 0
je 0x40ca05
cmp dword [ebx + 0xc], 0
je 0x40c9bf
mov eax, dword [ebp - 0x5c]
push esi
push esi
push dword [ebx]
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
je 0x40c9fd
cmp dword [ebx + 8], 0
je 0x40c892
sub esp, 0xc
push eax
call fcn.0041244e
add esp, 0x10
mov esi, eax
mov eax, dword [ebx + 0xc]
cmp esi, dword [eax]
je 0x40c9fd
mov ecx, ebx
call fcn.00411d2a
test eax, eax
sete al
movzx eax, al
mov dword [0x42e4a0], eax
mov eax, dword [ebx + 0xc]
cmp esi, dword [eax]
jbe 0x40c888
push ecx
push ecx
push 0x440c38
push dword [ebx]
call fcn.004034b9
add esp, 0x10
cmp eax, 1
sbb dword [ebp - 0x68], 0xffffffff
mov eax, dword [ebx + 0xc]
mov dword [eax], esi
jmp 0x40c9fd
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x40c8a9
push edx
push edx
push eax
push esi
call fcn.004033fb
add esp, 0x10
jmp 0x40c8ac
movsx eax, byte [esi]
test eax, eax
je 0x40c9fd
sub esp, 0xc
push esi
call fcn.0042d5c4
add esp, 0x10
mov dword [ebp - 0x64], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x40c8db
cmp dword [ebp - 0x64], 0
mov eax, dword [ebx + 0xc]
je 0x40c9b7
jmp 0x40c95a
sub esp, 0xc
push eax
call fcn.0042d5c4
add esp, 0x10
cmp dword [ebp - 0x64], eax
jae 0x40c8cc
cmp byte [esi], 0
mov eax, dword [ebx + 0xc]
je 0x40c902
mov eax, dword [eax]
mov edx, esi
call fcn.0040bf51
jmp 0x40c9fd
cmp eax, 0x42e4c0
jne 0x40c918
mov dword [0x42e4c0], 0x440c3c
jmp 0x40c9fd
cmp eax, 0x46dcc4
setne dl
cmp eax, 0x42e670
setne cl
and edx, ecx
cmp eax, 0x42e66c
setne cl
and edx, ecx
cmp eax, 0x42e678
setne cl
test dl, cl
je 0x40c9fd
cmp eax, 0x42e4c4
je 0x40c9fd
mov dword [eax], 0
jmp 0x40c9fd
mov edi, dword [eax]
cmp edi, dword [0x46dcd0]
seta cl
cmp edi, section..rsrc
seta al
test cl, al
je 0x40c982
test edi, edi
je 0x40c982
sub esp, 0xc
push edi
call fcn.0042d4c8
add esp, 0x10
mov eax, dword [ebp - 0x64]
sub esp, 0xc
mov ecx, dword [ebx + 0xc]
add eax, 8
mov dword [ebp - 0x6c], ecx
push eax
call fcn.0042d4e4
mov ecx, dword [ebp - 0x6c]
mov edi, eax
mov dword [ecx], eax
mov eax, dword [ebp - 0x64]
lea ecx, [eax + 1]
jecxz 0x40c9b2
cld
inc ecx
lodsb al, byte [esi]
stosb byte es:[edi], al
or al, al
loopne 0x40c9a8
mov byte [edi - 1], 0
add esp, 0x10
jmp 0x40c9fd
mov dword [eax], 0x46d4ec
jmp 0x40c9fd
cmp dword [ebx + 8], 0
je 0x40c9fd
push eax
push eax
mov eax, dword [ebp - 0x5c]
push dword [ebx]
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
mov eax, dword [ebx + 4]
je 0x40c9f1
mov edx, dword [eax*4 + 0x46d978]
or edx, dword [ebx + 8]
mov dword [eax*4 + 0x46d978], edx
jmp 0x40c9fd
mov edx, dword [ebx + 8]
not edx
and dword [eax*4 + 0x46d978], edx
add ebx, 0x18
jmp 0x40c806
call fcn.004129b0
test byte [0x46d983], 2
je 0x40ca36
cmp dword [0x46d4c8], 0
jg 0x40ca36
push 0x400
push 0x42e458
push 0x46d4c8
push 0x46d4c4
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0xc
push dword [ebp - 0x60]
call fcn.00413602
add esp, 0x10
cmp dword [ebp - 0x68], 0
je 0x40ccad
mov eax, dword [0x42e46c]
add eax, dword [0x42e464]
sub esp, 0xc
add eax, dword [0x42e474]
add eax, dword [0x42e470]
add eax, dword [0x42e468]
add eax, dword [0x42e478]
mov edi, dword [0x46d98c]
mov dword [0x46d98c], eax
lea eax, [eax*8 + 0x14]
push eax
call fcn.0042d4e4
mov esi, dword [0x46d75c]
mov ecx, edi
mov ebx, eax
mov edx, esi
call fcn.0040bf69
mov eax, dword [0x46d98c]
mov edx, dword [0x46d758]
mov ecx, edi
lea eax, [ebx + eax*4]
call fcn.0040bf69
mov eax, dword [0x46d98c]
mov dword [0x46d75c], ebx
add esp, 0x10
lea eax, [ebx + eax*4]
mov dword [0x46d758], eax
test esi, esi
je 0x40ccad
sub esp, 0xc
push esi
call fcn.0042d4c8
jmp 0x40cc97
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c46
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40ccad
sub esp, 0xc
push eax
call fcn.0041244e
add esp, 0x10
mov ebx, eax
cmp eax, 9
jg 0x40ccad
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c48
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
je 0x40ccad
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c4a
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov edx, eax
test eax, eax
jne 0x40cb6b
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c4c
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov edx, eax
test eax, eax
je 0x40ccad
mov eax, dword [ebp - 0x5c]
push edi
push edi
push 0x440c4f
push dword [eax + 0x58]
mov dword [ebp - 0x64], edx
call fcn.00405368
add esp, 0x10
mov edx, dword [ebp - 0x64]
test eax, eax
mov edi, eax
jne 0x40d78c
jmp 0x40ccad
mov eax, dword [ebp - 0x5c]
push edx
push edx
push 0x440c48
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov edi, eax
test eax, eax
je 0x40ccad
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c4a
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
jne 0x40cbee
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c4c
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
je 0x40ccad
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c4f
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov dword [ebp - 0x68], eax
test eax, eax
jne 0x40d8d0
jmp 0x40ccad
cmp byte [edi], 0x2e
je 0x40cc31
cmp byte [eax - 1], 0x2e
je 0x40cc31
inc ebx
push eax
push eax
push edi
push ebx
call fcn.004034b9
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x40cc13
sub esp, 0xc
push dword [0x46d8c8]
call fcn.0042d5c4
add esp, 0x10
mov dword [ebp - 0x64], eax
push eax
push eax
push 0x440c51
push esi
call fcn.004033fb
add esp, 0x10
test eax, eax
jne 0x40d8ec
test ebx, ebx
je 0x40ccad
push edi
push edi
push 0x3b
push ebx
call fcn.004033de
add esp, 0x10
test eax, eax
jne 0x40d8ab
cmp dword [0x46d8c8], ebx
jne 0x40d8e3
mov dword [0x46d8c8], 0
sub esp, 0xc
push dword [ebp - 0x60]
call fcn.00413602
add esp, 0x10
jmp 0x40ccad
mov dword [0x46d9e8], 0x7ff
jmp 0x40ccad
call fcn.004241df
sub esp, 0xc
lea eax, [ebp - 0x50]
mov ecx, dword [ebp - 0x5c]
push eax
call fcn.00415fe2
add esp, 0xc
cmp dword [0x42e4a0], 0
jne 0x40d768
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x48], 0x46d4ec
je 0x40d768
mov eax, dword [ebp - 0x5c]
sub esp, 0xc
push str.__r_n_.4000s
add eax, 0x10
push eax
mov eax, dword [ebp - 0x5c]
push dword [eax]
push dword [0x435800]
push 0x4644a0
call fcn.00403f0e
mov eax, dword [ebp - 0x5c]
add esp, 0x14
push dword [eax]
call fcn.0040bf04
mov eax, dword [0x46dccc]
add esp, 0x10
cmp byte [eax], 0x22
jne 0x40cd1b
inc eax
push esi
push esi
push 1
push eax
call fcn.0040dcb8
jmp 0x40d5ef
mov eax, dword [ebp - 0x5c]
push ebx
push ebx
push 0x440c4a
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40cf6b
mov eax, dword [ebp - 0x5c]
push ecx
push ecx
push 0x440c58
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40cdcf
lea esi, [ebp - 0x40]
push edx
push edx
push eax
push esi
call fcn.0041f307
mov dword [esp], ebx
call fcn.0041244e
add esp, 0x10
cmp eax, 8
jg 0x40cf6b
imul ebx, eax, 0xc
cmp dword [ebx + 0x46e124], 0
je 0x40cf6b
sub esp, 0xc
add ebx, 0x46e0a0
push esi
mov ecx, ebx
call fcn.0041a888
add esp, 0xc
test eax, eax
je 0x40cf6b
mov edi, dword [ebx + 4]
lea edx, [edi - 1]
mov dword [ebx + 4], edx
test edx, edx
je 0x40cf6b
imul edx, edx, 0x18
mov ecx, 0x18
add edx, dword [ebx + 8]
jmp 0x40ce66
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c46
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40cf6b
sub esp, 0xc
push eax
call fcn.0041244e
mov dword [esp], ebx
mov esi, eax
call fcn.0041244e
add esp, 0x10
cmp eax, 8
jg 0x40cf6b
imul eax, eax, 0xc
cmp dword [eax + 0x46e124], 0
lea ebx, [eax + 0x46e120]
je 0x40cf6b
test esi, esi
jne 0x40ce34
mov eax, dword [ebx + 8]
mov dword [eax + 4], 0
jmp 0x40cf6b
sub esp, 0xc
mov ecx, ebx
push esi
call fcn.0041a882
add esp, 0xc
test eax, eax
je 0x40cf6b
mov edi, dword [ebx + 4]
lea edx, [edi - 1]
mov dword [ebx + 4], edx
test edx, edx
je 0x40cf6b
imul edx, edx, 0xc
mov ecx, 0xc
add edx, dword [ebx + 8]
call fcn.0040bf69
jmp 0x40cf6b
mov eax, dword [ebp - 0x5c]
push edi
push edi
push 0x440c46
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40cf6b
mov eax, dword [ebp - 0x5c]
push esi
push esi
push 0x440c4f
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
je 0x40cf6b
sub esp, 0xc
push ebx
call fcn.0041244e
mov dword [esp], esi
mov ebx, eax
call fcn.0041244e
inc dword [0x46dd50]
add esp, 0x10
bt ebx, 0x14
mov edx, eax
jae 0x40ceff
and ebx, 0xffefffff
cmp dword [0x464330], ebx
jle 0x40cf58
mov eax, dword [0x46432c]
test eax, eax
je 0x40cf58
mov eax, dword [eax + ebx*4]
cmp edx, dword [eax + 0x2c]
jne 0x40cf58
sub esp, 0xc
push ebx
call fcn.0040ac8f
add esp, 0x10
jmp 0x40cf58
cmp ebx, 0x2fffff
jne 0x40cf12
mov eax, dword [0x47a938]
test eax, eax
jne 0x40cf45
jmp 0x40cf58
bt ebx, 0x15
jae 0x40cf30
and ebx, 0xffdfffff
cmp dword [0x47a978], ebx
jle 0x40cf58
mov eax, dword [0x47aa88]
mov eax, dword [eax + ebx*4]
jmp 0x40cf45
cmp dword [0x46d98c], ebx
jle 0x40cf58
mov eax, dword [0x46d75c]
mov eax, dword [eax + ebx*4]
cmp eax, 1
jbe 0x40cf58
cmp edx, dword [eax + 0x2c]
jne 0x40cf58
push edx
push edx
push 2
push dword [eax]
call dword [sym.imp.WS2_32.dll_shutdown]
pop ecx
pop ebx
call fcn.0040aaf3
sub esp, 0xc
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c5b
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
je 0x40cfc4
mov eax, dword [ebp - 0x5c]
push ecx
push ecx
push 0x440c4a
push dword [eax + 0x58]
call fcn.00405368
pop ebx
mov edi, eax
pop eax
mov eax, dword [ebp - 0x5c]
push 0x440c5d
push dword [eax + 0x58]
call fcn.00405368
mov dword [esp], esi
mov ebx, eax
call fcn.0041244e
add esp, 0xc
push edi
push ebx
push eax
call fcn.0042539e
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
xor ebx, ebx
call fcn.0040c10e
push dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
call fcn.0040f838
add esp, 0xc
imul eax, ebx, 0xc
cmp dword [eax + 0x46e124], 0
je 0x40cffe
push eax
mov ecx, dword [ebp - 0x5c]
push eax
push ebx
push dword [ebp - 0x60]
call fcn.0041938e
pop eax
pop edx
inc ebx
cmp ebx, 9
jne 0x40cfe2
cmp dword [0x47a7fc], 0
je 0x40d768
sub esp, 0xc
push dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
call fcn.004251d2
jmp 0x40d74c
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x48], 0x46d4ec
je 0x40d48c
push edi
push edi
push 0x440c46
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov dword [ebp - 0x64], eax
test eax, eax
je 0x40d48c
mov eax, dword [ebp - 0x5c]
push esi
push esi
push 0x440c4a
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
jne 0x40d08b
mov eax, dword [ebp - 0x5c]
push ebx
push ebx
push 0x440c4c
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov esi, eax
test eax, eax
je 0x40d48c
push ecx
push ecx
push 0x440c5f
push esi
call fcn.004033fb
add esp, 0x10
test eax, eax
jne 0x40d182
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c63
push dword [eax + 0x58]
call fcn.00405368
mov dword [ebp - 0x68], eax
pop eax
mov eax, dword [ebp - 0x5c]
pop edx
push 0x440c5d
push dword [eax + 0x58]
call fcn.00405368
pop ecx
pop ebx
push dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push eax
mov esi, eax
call fcn.0040c468
pop edi
pop edx
test eax, eax
jne 0x40d48c
sub esp, 0xc
push esi
call fcn.0042d5c4
add esp, 0x10
lea edx, [eax - 1]
mov ebx, eax
lea eax, [esi + edx]
cmp byte [eax], 0x5c
jne 0x40d102
mov byte [eax], 0
mov ebx, edx
sub esp, 0xc
push dword [ebp - 0x68]
call fcn.0042d5c4
mov edi, eax
pop eax
push dword [ebp - 0x64]
call fcn.0042d5c4
lea eax, [edi + eax + 9]
add eax, ebx
mov dword [esp], eax
call fcn.0042d4e4
add esp, 0xc
push dword [ebp - 0x64]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [eax + 5]
push 0x440bf2
mov ebx, eax
push ecx
mov dword [ebp - 0x64], ecx
call edi
mov ecx, dword [ebp - 0x64]
add esp, 0xc
push dword [ebp - 0x68]
lea ecx, [ecx + eax + 1]
push 0x440bf2
push ecx
mov dword [ebp - 0x64], ecx
call edi
mov ecx, dword [ebp - 0x64]
add esp, 0xc
lea eax, [ecx + eax + 1]
push esi
push 0x440bf2
push eax
call edi
mov eax, dword [0x46d888]
add esp, 0x10
mov dword [ebx], eax
mov dword [0x46d888], ebx
jmp 0x40d281
push 0
push 0
push 0xff
push dword [ebp - 0x64]
call fcn.00411ea0
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40d35a
push ecx
push ecx
push 0x440c51
push esi
call fcn.004033fb
add esp, 0x10
test eax, eax
jne 0x40d1bd
mov byte [ebx + 4], 0
jmp 0x40d47e
mov eax, dword [ebp - 0x5c]
push edi
push edi
lea edi, [ebx + 5]
push 0x440c63
push dword [eax + 0x58]
call fcn.00405368
mov ecx, 0x100
mov esi, eax
xor eax, eax
test edi, edi
je 0x40d1e6
jecxz 0x40d1e6
cld
repne scasb al, byte es:[edi]
je 0x40d1eb
mov edi, 1
dec edi
inc edi
pop eax
pop edx
push edi
push esi
call fcn.004033fb
add esp, 0x10
test eax, eax
je 0x40d222
sub esp, 0xc
push edi
call fcn.0042d5c4
mov dword [esp], esi
mov dword [ebp - 0x68], eax
call fcn.0042d5c4
add esp, 0x10
cmp dword [ebp - 0x68], eax
jb 0x40d26f
mov edx, esi
mov eax, edi
call fcn.0040bf51
mov eax, dword [ebp - 0x5c]
push esi
push esi
push 0x440c5d
push dword [eax + 0x58]
call fcn.00405368
mov ecx, ebx
mov dword [esp], edi
mov esi, eax
call fcn.00411322
sub esp, 0xc
mov edi, eax
push eax
push esi
call fcn.004033fb
add esp, 0x20
test eax, eax
je 0x40d281
sub esp, 0xc
push edi
call fcn.0042d5c4
mov dword [esp], esi
mov dword [ebp - 0x68], eax
call fcn.0042d5c4
add esp, 0x10
cmp dword [ebp - 0x68], eax
jae 0x40d278
mov byte [ebx + 4], 0
jmp 0x40d0a3
mov edx, esi
mov eax, edi
call fcn.0040bf51
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c65
push dword [eax + 0x58]
call fcn.00405368
pop edx
pop ecx
push 0x440c69
cmp eax, 1
mov eax, dword [ebp - 0x5c]
sbb esi, esi
push dword [eax + 0x58]
and esi, 0xfffffffc
add esi, 0x84
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40d2bd
or esi, 8
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c6d
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
jne 0x40d2d9
or esi, 0x40
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c71
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40d2f5
or esi, 2
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c76
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40d311
or esi, 0x20
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c7a
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40d32d
or esi, 0x10
mov eax, dword [ebp - 0x5c]
push edi
push edi
push 0x440c7d
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40d349
or esi, 1
mov eax, esi
mov ecx, ebx
mov byte [ebx + 4], al
call fcn.00411ac2
jmp 0x40d47e
push ecx
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [0x433964]
call fcn.0042d734
pop ebx
pop esi
jmp 0x40d48c
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x48], 0x46d4ec
je 0x40d48c
push edx
push edx
push 0x440c81
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov edi, eax
test eax, eax
je 0x40d48c
push eax
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c5d
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov dword [ebp - 0x64], eax
test eax, eax
je 0x40d48c
mov eax, dword [ebp - 0x5c]
push esi
push esi
push 0x440c4a
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
jne 0x40d3f6
mov eax, dword [ebp - 0x5c]
push ebx
push ebx
push 0x440c4c
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40d48c
push edx
push edx
push 0x440c51
push eax
call fcn.004033fb
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40d441
sub esp, 0xc
push dword [ebp - 0x64]
call fcn.0042d5c4
add esp, 0x10
mov esi, eax
mov ebx, eax
mov eax, dword [ebp - 0x64]
cmp dword [eax + 3], 0x2f2f3a70
jne 0x40dafb
mov ecx, dword [ebp - 0x64]
lea eax, [esi - 1]
lea edx, [ecx + eax]
cmp byte [edx], 0x5c
jne 0x40d441
mov byte [edx], 0
mov ebx, eax
mov esi, dword [0x46dcc0]
mov edx, 0x46dcc0
mov dword [ebp - 0x6c], edx
test esi, esi
jne 0x40db1a
test ebx, ebx
jne 0x40db42
mov eax, dword [ebp - 0x5c]
push ebx
push ebx
push 0x440c83
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x40dbed
sub esp, 0xc
push dword [ebp - 0x60]
call fcn.00413602
add esp, 0x10
lea ebx, [ebp - 0x50]
sub esp, 0xc
mov ecx, dword [ebp - 0x5c]
push ebx
call fcn.00415dba
mov ecx, dword [ebp - 0x5c]
push ebx
call fcn.00415d38
mov ecx, ebx
add esp, 0xc
call fcn.0040bf28
jmp 0x40d768
mov eax, dword [ebp - 0x5c]
push esi
push esi
push 0x440c4f
push dword [eax + 0x58]
call fcn.00405368
mov dword [ebp - 0x64], 0xff
add esp, 0x10
test eax, eax
je 0x40d4e2
sub esp, 0xc
push eax
call fcn.0041244e
add esp, 0x10
mov dword [ebp - 0x64], eax
cmp dword [0x46d99c], 0
je 0x40d5f7
mov eax, dword [ebp - 0x5c]
push ebx
push ebx
push 0x440c46
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40d5f7
sub esp, 0xc
push eax
call fcn.0041244e
add esp, 0x10
mov esi, eax
cmp eax, 0xc9f
jle 0x40d9b7
jmp 0x40d5f7
push eax
mov ecx, 0x4644a0
lea edi, [ebp - 0x40]
push eax
push esi
push dword [ebp - 0x60]
call fcn.00403afe
mov eax, dword [ebp - 0x68]
mov ecx, 0x28
test edi, edi
je 0x40d550
jecxz 0x40d550
cld
rep stosb byte es:[edi], al
push eax
push 0x464450
call fcn.0040366a
pop eax
pop edx
push 0
push dword [ebp - 0x60]
call fcn.0040357d
pop ecx
pop edi
mov dword [ebp - 0x40], eax
xor edi, edi
test eax, eax
jle 0x40d595
push edx
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
pop ecx
pop eax
cmp edi, 0x4000000
jg 0x40da62
test edi, edi
jne 0x40da67
xor edx, edx
mov eax, dword [ebp + edx*4 - 0x40]
test eax, eax
jle 0x40d5b2
sub esp, 0xc
mov dword [ebp - 0x60], edx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x60]
add esp, 0xc
inc edx
cmp edx, 0xa
jne 0x40d597
mov dword [0x464450], 0
test ebx, ebx
je 0x40d5f7
xor eax, eax
cmp edi, eax
jg 0x40daeb
mov byte [ebx + edi], 0
push esi
mov eax, dword [ebp - 0x5c]
push dword [ebp - 0x64]
push ebx
push dword [eax + 0x3c]
mov ecx, eax
call fcn.004159c4
sub esp, 0xc
push ebx
call fcn.0042d4c8
add esp, 0x10
jmp 0x40d768
sub esp, 0xc
push 0x40000
call fcn.0042d4e4
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40d768
xor esi, esi
xor edi, edi
lea eax, [esi - 6]
and eax, 0xfffffffd
je 0x40d64d
test esi, esi
je 0x40d62e
cmp dword [esi*4 + 0x464460], 0x4644a0
je 0x40d64d
mov eax, dword [esi*4 + 0x464460]
mov ecx, dword [eax + 4]
lea edx, [eax + 0x1c]
lea eax, [ebx + edi]
sub ecx, edx
mov dword [ebp - 0x60], ecx
call fcn.0040bf69
mov ecx, dword [ebp - 0x60]
add edi, ecx
inc esi
cmp esi, 0xa
jne 0x40d615
mov byte [ebx + edi], 0
push 0xca0
jmp 0x40d5d5
mov ecx, dword [ebp - 0x5c]
call fcn.00415380
jmp 0x40d768
mov eax, dword [0x4644a4]
mov dword [0x42e078], 0x4644bc
mov dword [0x464458], eax
test byte [0x46d983], 0x10
je 0x40d73e
mov eax, dword [ebp - 0x5c]
push ecx
push ecx
push 0x440c4f
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
xor edx, edx
test eax, eax
je 0x40d6d5
sub esp, 0xc
push eax
call fcn.0041244e
add esp, 0x10
mov edx, eax
cmp eax, 0xa
ja 0x40d6d5
mov eax, dword [eax*4 + 0x464460]
lea ecx, [eax + 0x1c]
mov eax, dword [eax + 4]
mov dword [0x42e078], ecx
mov dword [0x464458], eax
mov eax, dword [edx*4 + 0x42e080]
cmp byte [eax], 0x2e
jne 0x40d6e2
inc eax
push edx
mov esi, 1
push eax
push str._h2__s__h2__table_border0_width100____tr_aligncenter__td__a_href__t0__General__a___td_
push ebx
call fcn.0042ce14
add esp, 0x10
cmp dword [esi*4 + 0x464460], 0x4644a0
je 0x40d721
mov eax, dword [esi*4 + 0x42e080]
cmp byte [eax], 0x2e
jne 0x40d721
inc eax
push eax
push esi
push str._td__a_href__t_u___s__a___td_
push ebx
call fcn.0042ce14
add esp, 0x10
inc esi
cmp esi, 0xb
jne 0x40d6f7
push eax
push eax
push str.__tr___table_
push ebx
call fcn.0042ce14
mov ecx, ebx
call fcn.0040bf28
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
call fcn.0040c2fa
add esp, 0xc
jmp 0x40d768
push ebx
mov ecx, dword [ebp - 0x5c]
push ebx
push 0x190
push dword [0x433ca8]
call fcn.0040b1ae
pop esi
pop edi
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x58]
test eax, eax
je 0x40d785
cmp eax, 0x46dce0
je 0x40d785
sub esp, 0xc
push eax
call fcn.0042d4c8
add esp, 0x10
xor eax, eax
jmp 0x40dcae
push ecx
lea eax, [ebx + ebx]
push ecx
mov ebx, eax
push 0x440c51
push edx
mov dword [ebp - 0x64], eax
call fcn.004033fb
add esp, 0x10
test eax, eax
jne 0x40d7c1
mov eax, dword [ebx*4 + 0x46d8e8]
mov dword [ebx*4 + 0x46d8e0], eax
test eax, eax
je 0x40cc8c
inc ebx
jmp 0x40d7a8
push ecx
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ebp - 0x60]
push edi
call fcn.0040c468
pop edx
pop ecx
test eax, eax
jne 0x40ccad
sub esp, 0xc
push esi
call fcn.0042d5c4
add esp, 0x10
cmp byte [esi], 0x2e
mov dword [ebp - 0x6c], eax
je 0x40d7f0
inc dword [ebp - 0x6c]
sub esp, 0xc
push edi
call fcn.0042d5c4
add esp, 0x10
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax*4 + 0x46d8e0]
test eax, eax
je 0x40d859
sub esp, 0xc
push eax
call fcn.0042d5c4
add esp, 0x10
cmp dword [ebp - 0x6c], eax
jle 0x40d828
cmp eax, 3
jg 0x40d828
mov eax, dword [ebp - 0x64]
jmp 0x40d844
mov eax, dword [ebp - 0x64]
sub esp, 0xc
push dword [eax*4 + 0x46d8e4]
call fcn.0042d5c4
add esp, 0x10
cmp dword [ebp - 0x68], eax
jbe 0x40d88a
jmp 0x40d823
mov edx, dword [eax*4 + 0x46d8e8]
mov ebx, eax
mov dword [eax*4 + 0x46d8e0], edx
inc eax
test edx, edx
jne 0x40d844
mov eax, dword [ebp - 0x68]
sub esp, 0xc
add eax, 6
push eax
call fcn.0042d4e4
add esp, 0x10
mov dword [ebx*4 + 0x46d8e0], eax
add eax, 5
mov dword [ebx*4 + 0x46d8e4], eax
mov eax, dword [ebx*4 + 0x46d8e0]
mov dword [eax + 1], 0
cmp byte [esi], 0x2e
mov eax, dword [esi]
je 0x40d897
shl eax, 8
or eax, 0x2e
mov edx, dword [ebx*4 + 0x46d8e0]
mov dword [edx], eax
mov eax, dword [ebx*4 + 0x46d8e4]
mov edx, edi
jmp 0x40d8c6
inc eax
push esi
push esi
push 0x3b
push eax
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x40cc76
lea edx, [eax + 1]
mov eax, ebx
call fcn.0040bf51
jmp 0x40cc8c
mov ebx, dword [0x46d8c8]
test ebx, ebx
jne 0x40cc1f
jmp 0x40d9ab
mov byte [ebx - 1], 0
jmp 0x40cc8c
cmp byte [edi], 0x2e
mov edx, str.._s__s
mov eax, 0x440be5
push dword [ebp - 0x68]
cmovne eax, edx
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push dword [ebp - 0x60]
call edi
mov esi, eax
add esp, 0x10
test ebx, ebx
je 0x40d966
push ecx
push ecx
push 0x3b
push ebx
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x40cc8c
inc eax
push edx
push edx
push 0x3b
push eax
call fcn.004033de
add esp, 0x10
mov ecx, eax
test eax, eax
je 0x40cc8c
sub eax, ebx
cmp eax, esi
jl 0x40d95c
mov edx, dword [ebp - 0x60]
mov eax, ebx
call fcn.0040bf51
lea eax, [ebx + esi]
mov edx, ecx
jmp 0x40d8c6
lea edx, [ecx + 1]
mov eax, ebx
call fcn.0040bf51
cmp dword [ebp - 0x64], 0
mov eax, 0x440bf2
mov ebx, 0x440be5
mov edx, dword [0x46d8c8]
cmovle ebx, eax
mov eax, dword [ebp - 0x64]
sub esp, 0xc
mov dword [ebp - 0x68], edx
lea eax, [eax + esi + 2]
push eax
call fcn.0042d4e4
mov edx, dword [ebp - 0x68]
mov esi, eax
push edx
push dword [ebp - 0x60]
push ebx
push eax
call edi
mov dword [0x46d8c8], esi
add esp, 0x20
jmp 0x40cc8c
mov dword [ebp - 0x64], 0
jmp 0x40cc45
mov eax, dword [0x46d980]
and eax, 0x10000000
mov dword [ebp - 0x68], eax
je 0x40d52c
xor ebx, ebx
xor edi, edi
lea eax, [ebx - 6]
mov dword [ebp + ebx*4 - 0x40], 0
and eax, 0xfffffffd
je 0x40da51
cmp dword [ebp - 0x64], 5
je 0x40da51
test ebx, ebx
je 0x40d9f5
cmp dword [ebx*4 + 0x464460], 0x4644a0
je 0x40da51
cmp dword [ebp - 0x64], 0xff
je 0x40da14
cmp dword [ebp - 0x64], 0
je 0x40da14
mov al, byte [ebx + 0x444ba0]
shr al, 4
movzx eax, al
cmp eax, ebx
jne 0x40da51
cmp edi, 0x3ffffff
jg 0x40da51
push eax
mov ecx, dword [ebx*4 + 0x464460]
push eax
push esi
push dword [ebp - 0x60]
call fcn.00403afe
push 0
push dword [ebp - 0x60]
call fcn.0040357d
pop edx
pop ecx
mov dword [ebp + ebx*4 - 0x40], eax
test eax, eax
jle 0x40da51
push edx
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add edi, eax
pop ecx
pop eax
inc ebx
cmp ebx, 0xa
jne 0x40d9ce
xor ebx, ebx
jmp 0x40d581
mov edi, 0x4000000
sub esp, 0xc
lea eax, [edi + 0x40]
push eax
call fcn.0042d4e4
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x40daa8
mov eax, edi
sar eax, 1
push eax
push edi
push str.No_enought_memory_to_load_log___u__bytes._Try_half___u_
push 0x4644a0
mov dword [ebp - 0x60], eax
call fcn.0040423a
mov eax, dword [ebp - 0x60]
add esp, 0x10
mov edi, eax
cmp eax, 0x3fff
jg 0x40da67
jmp 0x40d595
mov dword [ebp - 0x60], 0
xor edx, edx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x40]
test eax, eax
jle 0x40dadd
push ecx
mov ecx, edi
sub ecx, edx
mov dword [ebp - 0x68], edx
push ecx
lea ecx, [ebx + edx]
push ecx
push eax
call fcn.00403603
mov edx, dword [ebp - 0x68]
add edx, eax
pop eax
cmp edi, edx
jle 0x40d595
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xa
jne 0x40dab1
jmp 0x40d595
cmp byte [ebx + eax], 0
jne 0x40daf5
mov byte [ebx + eax], 0x20
inc eax
jmp 0x40d5c8
push eax
mov ecx, dword [ebp - 0x5c]
push eax
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.0040c468
pop edx
pop ecx
test eax, eax
je 0x40d42e
jmp 0x40d48c
push eax
push eax
lea eax, [esi + 9]
push edi
push eax
call fcn.0040341a
add esp, 0x10
mov edx, dword [ebp - 0x6c]
test eax, eax
mov eax, dword [esi]
jne 0x40db39
mov dword [edx], eax
jmp 0x40d457
mov edx, esi
mov esi, eax
jmp 0x40d44c
push eax
xor esi, esi
push eax
mov eax, dword [ebp - 0x5c]
push 0x440c63
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40db7f
mov eax, dword [ebp - 0x5c]
push esi
push esi
push 0x440c46
push dword [eax + 0x58]
call fcn.00405368
mov dword [esp], eax
mov dword [ebp - 0x68], eax
call fcn.0042d5c4
add esp, 0x10
mov esi, eax
sub esp, 0xc
push edi
call fcn.0042d5c4
lea eax, [ebx + eax + 0xf]
add eax, esi
mov dword [esp], eax
call fcn.0042d4e4
lea edx, [eax + 9]
mov ebx, eax
pop eax
pop ecx
mov ecx, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov dword [ebp - 0x70], edx
push edx
mov dword [ebp - 0x6c], ecx
call ecx
mov edx, dword [ebp - 0x70]
lea eax, [edx + eax + 1]
mov dword [ebx + 4], eax
pop edx
pop ecx
mov ecx, dword [ebp - 0x6c]
push dword [ebp - 0x64]
push eax
call ecx
add esp, 0x10
test esi, esi
je 0x40dbdb
inc eax
mov edx, dword [ebp - 0x68]
mov byte [ebx + 8], al
movsx eax, al
add eax, dword [ebx + 4]
call fcn.0040bf51
mov eax, dword [0x46dcc0]
mov dword [ebx], eax
mov dword [0x46dcc0], ebx
jmp 0x40d45f
mov eax, dword [ebp - 0x5c]
push ecx
push ecx
push 0x440c85
push dword [eax + 0x58]
call fcn.00405368
add esp, 0x10
test eax, eax
je 0x40d47e
cmp byte [edi], 0x2f
je 0x40d47e
cmp dword [0x46d974], 0
mov eax, 0x440bf5
mov edx, str.SYSTEM32DRIVERSETChosts
cmovs edx, eax
push eax
push eax
mov dword [ebp - 0x64], edx
push 0x100
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add eax, dword [ebp - 0x60]
pop edx
mov edx, dword [ebp - 0x64]
pop ecx
call fcn.0040bf51
push esi
push esi
push 1
push dword [ebp - 0x60]
call fcn.0040357d
mov esi, eax
pop eax
pop edx
test esi, esi
jg 0x40dc73
sub esp, 0xc
push dword [ebp - 0x60]
call fcn.004035b1
mov esi, eax
add esp, 0xc
test eax, eax
jle 0x40d47e
push eax
push 2
push 0
push esi
call fcn.0040364f
mov dword [esp], edi
push ebx
push 0x440c87
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push eax
push dword [ebp - 0x60]
push esi
call fcn.00403629
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
jmp 0x40d47e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret