Function at 0x4128d0
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0xb4
push 0xffffffffffffffff
push 0x4fa24b
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x591430]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [0x595ca4]
test edi, edi
jne 0x412947
push 0xf0
call fcn.00445790
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x412938
mov ecx, eax
call fcn.0043c8e0
mov edi, eax
jmp 0x41293a
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [0x595ca4], edi
push 0x88
call fcn.00445790
mov esi, eax
mov dword [ebp - 0x24], eax
add esp, 4
test esi, esi
je 0x412a3c
mov dword [esi + 0x10], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x14], 0xf
lea ecx, [esi + 0x38]
mov byte [esi], 0
lea eax, [esi + 0x54]
mov dword [edx + 0x10], 0
mov ebx, esi
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], 0xa
mov dword [esi + 0x78], 0xa
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x4129d4
mov ebx, dword [esi]
mov byte [ebx], 0
mov dword [esi + 0x18], 0xffffffff
cmp dword [edx + 0x14], 0x10
mov dword [edx + 0x10], 0
jb 0x4129ed
mov edx, dword [edx]
mov byte [edx], 0
mov dword [esi + 0x34], 0xffffffff
mov byte [esi + 0x50], 0
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x412a0a
mov ecx, dword [ecx]
mov byte [ecx], 0
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x412a1c
mov eax, dword [eax]
mov byte [eax], 0
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x80], 0x32
mov dword [esi + 0x84], 0x2f
jmp 0x412a41
xor esi, esi
mov dword [ebp - 0x24], esi
push 9
push str.127.0.0.1
mov ecx, esi
call fcn.004047b0
mov dword [ebp + 0x14], 0xf
mov dword [ebp + 0x10], 0
mov byte [ebp], 0
mov dword [ebp + 0x18], 0xffffffff
mov dword [ebp - 4], 1
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0xf
mov byte [ebp + 0x38], 0
push str.OBMEN_SERVER_IP
mov byte [ebp - 4], 2
call fcn.00447890
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x412abc
push fcn.00409500
push 0x505210
push 0x59a578
call fcn.00405e80
add esp, 8
mov ecx, eax
call fcn.0040f730
push ebx
call fcn.004d5c66
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412ac1
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp + 0x38]
call fcn.004047b0
cmp dword [ebp + 0x4c], 0x10
lea eax, [ebp + 0x38]
push dword [ebp + 0x48]
cmovae eax, dword [ebp + 0x38]
lea ecx, [ebp]
push eax
call fcn.004047b0
lea eax, [ebp]
mov dword [ebp + 0x18], 0x50
push eax
lea ecx, [edi + 0x10]
call fcn.00407ff0
mov dword [ebp + 0x30], 0xf
mov dword [ebp + 0x2c], 0
mov byte [ebp + 0x1c], 0
mov dword [ebp + 0x34], 0xffffffff
mov ecx, ebx
mov byte [ebp - 4], 3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412b20
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp + 0x38]
call fcn.004047b0
cmp dword [ebp + 0x4c], 0x10
lea eax, [ebp + 0x38]
push dword [ebp + 0x48]
cmovae eax, dword [ebp + 0x38]
lea ecx, [ebp + 0x1c]
push eax
call fcn.004047b0
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x34], 0x1bb
push eax
lea ecx, [edi + 0x10]
call fcn.00407ff0
mov dword [esi + 0x80], 0x1e
mov dword [esi + 0x84], 5
mov byte [esi + 0x50], 1
mov dword [ebp + 0x90], 0
mov dword [ebp + 0x94], 0xf
mov byte [ebp + 0x80], 0
mov dword [ebp + 0x78], 0
mov dword [ebp + 0x7c], 0xf
mov byte [ebp + 0x68], 0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
xor ebx, ebx
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpGetDefaultProxyConfiguration]
test eax, eax
je 0x412bde
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x412bde
push ebx
push eax
lea eax, [ebp + 0x80]
push eax
call fcn.00416380
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0xc
push dword [ebp - 0x40]
call edi
jmp 0x412be4
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp + 0x90], 1
jae 0x412c19
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x412c19
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x412c19
push 0
push eax
lea eax, [ebp + 0x80]
push eax
call fcn.00416380
add esp, 0xc
push dword [ebp - 0x2c]
call edi
cmp dword [ebp + 0x90], ebx
jbe 0x412e87
mov ecx, dword [0x56b18c]
test ecx, ecx
jne 0x412e91
push ecx
push 0x3d
lea ecx, [ebp + 0x80]
call fcn.00418200
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x412e64
nop
mov eax, dword [ebp + 0x90]
mov dword [ebp + 0xa8], 0
mov dword [ebp + 0xac], 0xf
mov byte [ebp + 0x98], 0
cmp eax, ebx
jb 0x412e5f
sub eax, ebx
mov ecx, edi
sub ecx, ebx
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp + 0x94], 0x10
lea eax, [ebp + 0x80]
cmovae eax, dword [ebp + 0x80]
push ecx
add eax, ebx
lea ecx, [ebp + 0x98]
push eax
call fcn.004047b0
lea eax, [ebp + 0x98]
mov byte [ebp - 4], 6
push eax
call fcn.0042b7d0
mov edx, dword [ebp + 0xac]
lea eax, [ebp + 0x98]
mov ebx, dword [ebp + 0x98]
lea ecx, [ebp + 0x98]
add esp, 4
cmp edx, 0x10
cmovae eax, ebx
cmovae ecx, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xa8]
add eax, ecx
cmp edx, 0x10
lea ecx, [ebp + 0x98]
cmovae ecx, ebx
mov ebx, eax
sub ebx, ecx
xor edx, edx
xor esi, esi
cmp ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x412d20
mov edi, ecx
movsx eax, byte [edi + esi]
push eax
call fcn.004d9b4c
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov byte [ecx + esi], al
inc esi
cmp esi, ebx
jne 0x412d05
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 0x94], 0x10
lea ebx, [edi + 1]
mov ecx, dword [ebp + 0x90]
lea edi, [ebp + 0x80]
cmovae edi, dword [ebp + 0x80]
mov dword [ebp - 0x18], ebx
cmp ebx, ecx
jae 0x412d65
sub ecx, ebx
lea eax, [edi + ebx]
push ecx
push 0x3b
push eax
call fcn.004d1d00
mov ecx, dword [ebp + 0x90]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x412d65
sub esi, edi
jmp 0x412d68
or esi, 0xffffffff
cmp esi, 0xffffffff
lea edx, [ebp + 0x98]
cmove esi, ecx
cmp dword [ebp + 0xac], 0x10
cmovae edx, dword [ebp + 0x98]
cmp dword [ebp + 0xa8], 4
jne 0x412dc3
mov eax, dword [edx]
mov edi, str.http
cmp eax, dword [edi]
je 0x412db2
cmp al, byte [edi]
jne 0x412db6
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x412db6
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x412db6
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
jne 0x412db6
xor eax, eax
jmp 0x412dbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412dc3
mov al, 1
jmp 0x412dc5
xor al, al
test al, al
jne 0x412e27
cmp dword [ebp + 0x94], 0x10
lea ebx, [esi + 1]
lea esi, [ebp + 0x80]
mov dword [ebp - 0x18], ebx
cmovae esi, dword [ebp + 0x80]
lea eax, [ebx + 1]
cmp eax, ecx
jae 0x412e04
sub ecx, eax
add eax, esi
push ecx
push 0x3d
push eax
call fcn.004d1d00
mov edi, eax
add esp, 0xc
test edi, edi
je 0x412e04
sub edi, esi
jmp 0x412e07
or edi, 0xffffffff
lea ecx, [ebp + 0x98]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 5
call fcn.00403970
cmp edi, 0xffffffff
jne 0x412c50
mov esi, dword [ebp - 0x24]
jmp 0x412e87
sub esi, ebx
lea eax, [ebp + 0x50]
push esi
push ebx
push eax
lea ecx, [ebp + 0x80]
call fcn.0041db30
push eax
lea ecx, [ebp + 0x68]
call fcn.00425810
lea ecx, [ebp + 0x50]
call fcn.00403970
lea ecx, [ebp + 0x98]
mov byte [ebp - 4], 5
call fcn.00403970
mov esi, dword [ebp - 0x24]
jmp 0x412e87
call fcn.004143c0
cmp dword [ebp + 0x94], 0x10
lea eax, [ebp + 0x80]
push dword [ebp + 0x90]
cmovae eax, dword [ebp + 0x80]
lea ecx, [ebp + 0x68]
push eax
call fcn.004047b0
mov ecx, dword [0x56b18c]
test ecx, ecx
je 0x412eae
cmp dword [0x56b190], 0x10
mov eax, 0x56b17c
push ecx
cmovae eax, dword [0x56b17c]
lea ecx, [ebp + 0x68]
push eax
call fcn.004047b0
lea eax, [ebp + 0x68]
push eax
call fcn.0042b7d0
mov edi, dword [ebp + 0x7c]
lea eax, [ebp + 0x68]
add esp, 4
lea edx, [ebp + 0x68]
cmp edi, 0x10
cmovae eax, dword [ebp + 0x68]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x68]
cmovae eax, dword [ebp + 0x68]
add eax, dword [ebp + 0x78]
cmp edi, 0x10
mov ecx, eax
cmovae edx, dword [ebp + 0x68]
xor edi, edi
sub ecx, edx
cmp edx, eax
cmova ecx, edi
test ecx, ecx
je 0x412f0f
mov esi, ecx
mov ebx, edx
movsx eax, byte [ebx + edi]
push eax
call fcn.004d9b4c
mov ecx, dword [ebp - 0x20]
add esp, 4
mov byte [ecx + edi], al
inc edi
cmp edi, esi
jne 0x412ef1
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
cmp dword [ebp + 0x7c], 0x10
lea ecx, [ebp + 0x68]
mov eax, dword [ebp + 0x78]
cmovae ecx, dword [ebp + 0x68]
mov dword [ebp - 0x20], ecx
cmp ebx, eax
jae 0x413164
sub eax, ebx
push eax
lea eax, [ecx + ebx]
push 0x3a
push eax
call fcn.004d1d00
mov edi, eax
add esp, 0xc
test edi, edi
je 0x413164
sub edi, dword [ebp - 0x20]
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x413164
cmp dword [ebp + 0x78], edi
lea eax, [ebp + 0x68]
mov ecx, edi
mov dword [ebp + 0xa8], 0
cmovb ecx, dword [ebp + 0x78]
cmp dword [ebp + 0x7c], 0x10
push ecx
cmovae eax, dword [ebp + 0x68]
lea ecx, [ebp + 0x98]
push eax
mov dword [ebp + 0xac], 0xf
mov byte [ebp + 0x98], 0
call fcn.004047b0
lea eax, [ebp + 0x98]
mov byte [ebp - 4], 7
push eax
call fcn.0042b7d0
mov edx, dword [ebp + 0xac]
lea eax, [ebp + 0x98]
mov ecx, dword [ebp + 0x98]
add esp, 4
cmp edx, 0x10
cmovae eax, ecx
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x98]
cmovae eax, ecx
add eax, dword [ebp + 0xa8]
cmp edx, 0x10
lea edx, [ebp + 0x98]
mov ebx, eax
cmovae edx, ecx
xor ecx, ecx
sub ebx, edx
xor esi, esi
cmp edx, eax
cmova ebx, ecx
test ebx, ebx
je 0x41300b
mov edi, edx
nop word [eax + eax]
movsx eax, byte [edi + esi]
push eax
call fcn.004d9b4c
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov byte [ecx + esi], al
inc esi
cmp esi, ebx
jne 0x412ff0
mov edi, dword [ebp - 0x18]
cmp dword [ebp + 0xa8], 0
jne 0x41301e
push 0x505258
call fcn.004143d0
mov eax, dword [ebp + 0x78]
lea ecx, [ebp + 0x68]
sub eax, edi
dec eax
push eax
lea eax, [edi + 1]
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.0041db30
lea eax, [ebp + 0x50]
mov byte [ebp - 4], 8
push eax
call fcn.0042b7d0
mov esi, dword [ebp + 0x64]
lea ecx, [ebp + 0x50]
mov edx, dword [ebp + 0x50]
lea edi, [ebp + 0x50]
mov eax, dword [ebp + 0x60]
cmp esi, 0x10
push fcn.004d9b4c
cmovae ecx, edx
cmovae edi, edx
add eax, ecx
lea ecx, [ebp + 0x50]
push edi
cmp esi, 0x10
push eax
cmovae ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
call fcn.0040a3a0
add esp, 0x18
cmp dword [ebp + 0x60], 0
jne 0x413089
push 0x5052a0
call fcn.004143d0
cmp dword [ebp + 0x64], 0x10
lea ecx, [ebp + 0x50]
mov eax, dword [ebp + 0x60]
cmovae ecx, dword [ebp + 0x50]
add eax, ecx
mov byte [ebp - 4], 9
cmp ecx, eax
je 0x4131c4
mov bl, byte [ecx]
mov dword [ebp - 0x14], 0
cmp bl, 0x2d
je 0x4130b8
cmp bl, 0x2b
jne 0x4130b9
inc ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], eax
call fcn.004161c0
mov edi, dword [ebp - 0x14]
cmp bl, 0x2d
jne 0x4130f8
test al, al
je 0x4130f2
cmp edi, 0x80000000
ja 0x4130f2
mov al, 1
neg edi
jmp 0x41310a
xor al, al
neg edi
jmp 0x41310a
test al, al
je 0x413108
cmp edi, 0x7fffffff
ja 0x413108
mov al, 1
jmp 0x41310a
xor al, al
test al, al
je 0x4131c4
mov esi, dword [ebp - 0x24]
cmp edi, 1
mov eax, 0x50
mov dword [ebp - 4], 8
cmovl edi, eax
lea eax, [ebp + 0x98]
lea ecx, [esi + 0x54]
cmp ecx, eax
je 0x41314e
cmp dword [ebp + 0xac], 0x10
push dword [ebp + 0xa8]
cmovae eax, dword [ebp + 0x98]
push eax
call fcn.004047b0
lea ecx, [ebp + 0x50]
mov dword [esi + 0x6c], edi
call fcn.00403970
lea ecx, [ebp + 0x98]
call fcn.00403970
cmp dword [esi + 0x64], 1
jae 0x413174
cmp dword [esi + 0x6c], 1
jge 0x413174
mov byte [esi + 0x50], 0
lea ecx, [ebp + 0x68]
call fcn.00403970
lea ecx, [ebp + 0x80]
call fcn.00403970
lea ecx, [ebp + 0x1c]
call fcn.00403970
lea ecx, [ebp + 0x38]
call fcn.00403970
lea ecx, [ebp]
call fcn.00403970
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb0]
xor ecx, ebp
call fcn.004b7be0
lea esp, [ebp + 0xb4]
pop ebp
ret
call fcn.00409e70
int3