Function at 0x426e80
Capabilities:
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46933e
mov eax, dword fs:[0]
push eax
sub esp, 0x978
mov eax, dword [0x48fac0]
xor eax, esp
mov dword [esp + 0x974], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48fac0]
xor eax, esp
push eax
lea eax, [esp + 0x98c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x99c]
mov esi, dword [esp + 0x9a0]
xor edi, edi
push 0x800
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x18a]
push edi
push ecx
mov dword [esp + 0x104], eax
mov dword [esp + 0xf0], esi
mov word [esp + 0x190], di
call fcn.004481f0
push str.COLShadow::ReportSampleItem
push str._____s__IN
mov dword [esp + 0x34], edi
call fcn.00409e70
mov eax, dword [esi + 4]
add esp, 0x14
cmp eax, edi
jne 0x426f19
xor ecx, ecx
jmp 0x426f21
mov ecx, dword [esi + 8]
sub ecx, eax
sar ecx, 2
push ecx
push str.vecEntry.size:__d
call fcn.00409e70
add esp, 8
mov ecx, esi
mov dword [esp + 0x78], edi
call fcn.00417ac0
test eax, eax
jbe 0x428930
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
or ebx, 0xffffffff
mov dword [esp + 0x2c], eax
mov ecx, dword [esi + 4]
cmp ecx, eax
mov dword [esp + 0x994], eax
je 0x426f6b
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x426f70
call fcn.004489e1
mov edx, dword [esi + 4]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
lea eax, [edx + edi*4]
mov edx, dword [esp + 0xfc]
push eax
push edx
call fcn.0041f490
test al, al
jne 0x426faa
push str.xxx_Can_not_get_item_from_a_folder
call fcn.00409e70
add esp, 4
mov dword [esp + 0x994], ebx
jmp 0x4288ff
mov ecx, dword [esp + 0x2c]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x64], eax
je 0x426fd1
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [esp + 0x64]
push edx
push 0x46f014
push ecx
call eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x64]
test eax, eax
mov byte [esp + 0x994], 1
jne 0x426ff9
test ecx, ecx
mov dword [esp + 0x994], ebx
je 0x42890f
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
jmp 0x42890f
mov dword [esp + 0x14], eax
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
cmp dword [esp + 0x20], 0
mov byte [esp + 0x994], 2
jne 0x42761f
call fcn.00437eea
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42896c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x994], 3
call fcn.00437eea
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42896c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x994], 4
call fcn.00437eea
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42896c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x9a4]
sub eax, 0
mov byte [esp + 0x994], 5
je 0x427344
sub eax, 1
je 0x427202
sub eax, 1
jne 0x4274b3
push str.ReportPhish
lea ecx, [esp + 0x20]
call fcn.00404b20
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.IDS_CAPTION_REPORTPHISH
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [esp + 0xec]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x998], 0xa
call fcn.004037f0
mov eax, dword [esp + 0xec]
add eax, 0xfffffff0
mov byte [esp + 0x994], 5
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427137
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.TMAS_OL.ini
lea ecx, [esp + 0xf8]
push 0x4910c0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x400
lea edx, [esp + 0x18c]
push edx
push 0x46d9f4
push str.ReportPhishingHint
push 0x472128
call ebp
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427194
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x184]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4271a0
sub eax, edx
sar eax, 1
jne 0x4274a2
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.IDS_MSG_REPORTPHISH
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [esp + 0xe8]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x998], 0xb
call fcn.004037f0
mov eax, dword [esp + 0xe8]
jmp 0x42747d
push str.ReportFP
lea ecx, [esp + 0x20]
call fcn.00404b20
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.IDS_CAPTION_REPORTFP
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea edx, [esp + 0x98]
push edx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x998], 8
call fcn.004037f0
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
mov byte [esp + 0x994], 5
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42727b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.TMAS_OL.ini
lea ecx, [esp + 0xd4]
push 0x4910c0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x400
lea edx, [esp + 0x18c]
push edx
push 0x46d9f4
push str.ReportNotSpamHint
push 0x472128
call ebp
mov eax, dword [esp + 0xd0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4272d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x184]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4272e2
sub eax, edx
sar eax, 1
jne 0x4274a2
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.IDS_MSG_REPORTFP
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [esp + 0xa0]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x998], 9
call fcn.004037f0
mov eax, dword [esp + 0xa0]
jmp 0x42747d
push str.ReportSpam
lea ecx, [esp + 0x20]
call fcn.00404b20
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.IDS_CAPTION_REPORTSPAM
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea edx, [esp + 0x8c]
push edx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x998], 6
call fcn.004037f0
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
mov byte [esp + 0x994], 5
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4273bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.TMAS_OL.ini
lea ecx, [esp + 0xac]
push 0x4910c0
push ecx
call fcn.0040bb70
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x400
lea edx, [esp + 0x18c]
push edx
push 0x46d9f4
push str.ReportSpamHint
push 0x472128
call ebp
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42741a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x184]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427424
sub eax, edx
sar eax, 1
jne 0x4274a2
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.IDS_MSG_REPORTSPAM
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [esp + 0xd8]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x998], 7
call fcn.004037f0
mov eax, dword [esp + 0xd8]
add eax, 0xfffffff0
mov byte [esp + 0x994], 5
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4274b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4274b3
lea ecx, [esp + 0x184]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00404b20
mov edx, dword [0x4910bc]
mov ebp, dword [esp + 0x1c]
push edx
push 0
push str.DontBother
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x4275a8
call fcn.00417990
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
push eax
push edi
push esi
lea ecx, [esp + 0x10c]
call fcn.0040d8f0
lea ecx, [esp + 0x100]
mov byte [esp + 0x994], 0xc
call fcn.004396c0
cmp eax, 1
jne 0x428976
call fcn.00437eea
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42896c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
xor ecx, ecx
cmp dword [esp + 0x174], ecx
lea edx, [esp + 0x20]
setne cl
mov byte [esp + 0x994], 0xd
push ecx
push 0x46dd50
push edx
call fcn.00408b90
mov eax, dword [0x4910bc]
mov esi, dword [esp + 0x2c]
add esp, 0xc
push eax
push esi
push str.DontBother
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esi - 0x10]
mov byte [esp + 0x994], 0xc
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427592
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x100]
mov byte [esp + 0x994], 5
call fcn.0040daa0
jmp 0x4275ac
mov edi, dword [esp + 0x18]
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 1
mov byte [esp + 0x994], 4
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4275d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x994], 3
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4275fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x994], 2
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x42761f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
call fcn.00412c90
mov edi, dword [esp + 0x28]
push 0x88
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
mov byte [esp + 0x9a0], 0xe
call fcn.0041f5b0
mov edx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x9a4]
push eax
lea ecx, [esp + 0x3c]
push ecx
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x28], esp
je 0x427676
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov ecx, edi
call fcn.004261a0
test al, al
jne 0x42768e
push str.Failed_to_send_report_data__continue_to_move_without_sending_report_data
call fcn.00409e70
add esp, 4
push str.____Success_to_SendReportData__
call fcn.00409e70
xor ebp, ebp
add esp, 4
mov dword [esp + 0x18], ebp
mov byte [esp + 0x994], 0xf
call fcn.00437eea
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42896c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x24], ebx
test esi, esi
mov byte [esp + 0x994], 0x10
jl 0x4276e6
mov ecx, dword [esp + 0x54]
cmp dword [ecx - 0xc], ebp
jne 0x427f3a
call fcn.00437eea
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42896c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x68], eax
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x998], 0x11
call fcn.0041fc70
mov eax, dword [esp + 0x9a8]
add esp, 4
sub eax, 0
je 0x427c82
sub eax, 1
je 0x427ab2
sub eax, 1
jne 0x427f31
push 0x491248
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [0x491110]
push 1
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00434490
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x38], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427790
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x427837
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
jmp 0x4277d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4277d0
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xb4]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x18
call fcn.004037f0
mov eax, dword [esp + 0xb0]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427837
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.IDS_SPAMBUSTER_INI_DEF_PHISHPREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427861
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x427907
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4278a0
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xf4]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x19
call fcn.004037f0
mov eax, dword [esp + 0xf0]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427907
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xb8]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x9a0], 0x1a
call fcn.00403920
add esp, 0xc
mov eax, dword [esp + 0xb8]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x1c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42795f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x6c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00417fc0
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
push ebp
push eax
mov eax, dword [edx + 0xb0]
call eax
mov edx, dword [0x491178]
mov ecx, dword [edx - 8]
mov esi, dword [edx - 0xc]
mov edi, dword [esp + 0x44]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4279af
push 0
mov ecx, 0x491178
call fcn.00402010
mov edx, dword [0x491178]
push esi
push edi
push edx
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x427a23
push str.www_Already_is_a_phishing
call fcn.00409e70
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4279f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427a1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
jmp 0x428893
push 0x46d9f4
lea ecx, [esp + 0x8c]
call fcn.00406140
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x99c], 0x1d
call fcn.00420150
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x1c
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427a7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x68]
jmp 0x4282d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427ae0
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x427b87
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
jmp 0x427b20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427b20
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xe4]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x16
call fcn.004037f0
mov eax, dword [esp + 0xe0]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427b87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.IDS_SPAMBUSTER_INI_DEF_PHISHPREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427bb1
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x427c57
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427bf0
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xc4]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x17
call fcn.004037f0
mov eax, dword [esp + 0xc0]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427c57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x44]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00417fc0
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
push ebp
push eax
mov eax, dword [edx + 0xb0]
call eax
mov eax, dword [esp + 0x68]
jmp 0x4282d0
push 0x491248
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x491110]
push 1
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00434490
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x38], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427cd0
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x427d77
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
jmp 0x427d10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427d10
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0x100]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x12
call fcn.004037f0
mov eax, dword [esp + 0xfc]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427d77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.IDS_SPAMBUSTER_INI_DEF_PHISHPREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427da1
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x427e47
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427de0
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xcc]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x13
call fcn.004037f0
mov eax, dword [esp + 0xc8]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427e47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [esp + 0x94]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x9a0], 0x14
call fcn.00403920
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x998], 0x15
call fcn.004037f0
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427ed1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427efc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00417fc0
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
push ebp
push eax
mov eax, dword [edx + 0xb0]
call eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x18]
push edx
call fcn.00420150
mov eax, dword [esp + 0x68]
jmp 0x4282d0
mov ecx, dword [0x49110c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00432fa0
add esp, 8
mov bl, al
lea eax, [esp + 0x33]
push eax
lea ecx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x5c]
push edx
call fcn.00422c50
mov eax, dword [0x491110]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00432fa0
add esp, 8
test al, al
jne 0x427f9f
mov edx, dword [0x491114]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00432fa0
add esp, 8
test al, al
mov dword [esp + 0x1c], 1
je 0x427fa7
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x9a4]
sub eax, 0
je 0x428560
sub eax, 1
je 0x4282fd
sub eax, 1
jne 0x42888c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427ff3
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x428097
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428030
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xa0]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x26
call fcn.004037f0
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428097
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.IDS_SPAMBUSTER_INI_DEF_PHISHPREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4280c1
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x428167
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428100
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xa8]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x27
call fcn.004037f0
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428167
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xac]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x88]
push eax
mov byte [esp + 0x9a0], 0x28
call fcn.00403920
add esp, 0xc
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x2a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x80]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00417fc0
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
push ebp
push eax
mov eax, dword [edx + 0xb0]
call eax
mov edx, dword [0x491178]
mov ecx, dword [edx - 8]
mov esi, dword [edx - 0xc]
mov edi, dword [esp + 0x44]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x428215
push 0
mov ecx, 0x491178
call fcn.00402010
mov edx, dword [0x491178]
push esi
push edi
push edx
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x428231
push str.www_Already_is_a_phishing
call fcn.00409e70
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x428259
push 0x491248
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x491110]
push 1
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00434490
add esp, 0xc
push 0x46d9f4
lea ecx, [esp + 0x88]
call fcn.00406140
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x99c], 0x2b
call fcn.00420150
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x2a
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4282b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x70]
push 1
push 5
push ecx
push edx
call fcn.00421800
mov eax, dword [esp + 0x90]
add esp, 0x10
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42888c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42888c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428327
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x4283c9
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428362
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x23
call fcn.004037f0
mov eax, dword [esp + 0xb4]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4283c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.IDS_SPAMBUSTER_INI_DEF_PHISHPREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4283f3
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x428497
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428430
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xc0]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x24
call fcn.004037f0
mov eax, dword [esp + 0xbc]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428497
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x44]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00417fc0
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
push ebp
push eax
mov eax, dword [edx + 0xb0]
call eax
test bl, bl
jne 0x4284ca
push str.www_TMAS_did_not_treat_it_as_SPAM
call fcn.00409e70
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x428513
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x70]
xor ecx, ecx
cmp byte [esp + 0x33], cl
push 0
setne cl
add ecx, 3
push ecx
push edx
push eax
call fcn.00421800
add esp, 0x10
push 0x49124c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x491114]
push 1
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00434490
add esp, 0xc
push 0x46d9f4
lea ecx, [esp + 0x80]
call fcn.00406140
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x99c], 0x25
call fcn.004201a0
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4282e8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428590
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x428637
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
jmp 0x4285d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4285d0
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xc8]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x1e
call fcn.004037f0
mov eax, dword [esp + 0xc4]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428637
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.IDS_SPAMBUSTER_INI_DEF_PHISHPREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428661
mov edi, dword [esp + 0x44]
sub eax, edx
sar eax, 1
mov ecx, 0x4912d8
mov esi, eax
call fcn.0042dc60
push esi
push edi
push eax
call fcn.0044c644
add esp, 0xc
test eax, eax
jne 0x428707
mov ecx, 0x4912d8
call fcn.0042dc60
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4286a0
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx - 0xc]
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xd0]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040ba70
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x998], 0x1f
call fcn.004037f0
mov eax, dword [esp + 0xcc]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428707
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.IDS_SPAMBUSTER_INI_DEF_SPAM_PREFIX
call fcn.00406890
mov ecx, 0x4912d8
call fcn.0042e1a0
lea ecx, [esp + 0xdc]
push ecx
mov ecx, 0x4912d8
call fcn.0042e3b0
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0xdc]
push eax
mov byte [esp + 0x9a0], 0x20
call fcn.00403920
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x998], 0x21
call fcn.004037f0
mov eax, dword [esp + 0xd4]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428791
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xdc]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4287bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x24]
push esi
lea ecx, [esp + 0x1c]
call fcn.00417fc0
push esi
push str.subject:__s
call fcn.00409e70
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xb0]
add esp, 8
push ebp
push eax
call edx
cmp dword [esp + 0x1c], 0
je 0x42882a
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x70]
push 0
push 6
push eax
push ecx
call fcn.00421800
add esp, 0x10
push 0x491248
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [0x491110]
push 1
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00434490
add esp, 0xc
push 0x46d9f4
lea ecx, [esp + 0x78]
call fcn.00406140
lea ecx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x99c], 0x22
call fcn.00420150
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
mov byte [esp + 0x994], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42887b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42888c
push str.www_TMAS_OL_has_already_treated_it_as_SPAM
call fcn.00409e70
add esp, 4
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x994], 0xf
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4288b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [esp + 0x38]
call fcn.00412dd0
mov eax, dword [esp + 0x14]
test eax, eax
mov byte [esp + 0x994], 1
je 0x4288dc
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x64]
test eax, eax
mov byte [esp + 0x994], 0
je 0x4288f4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x994], 0xffffffff
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x42890f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [esp + 0x78]
mov esi, dword [esp + 0xe4]
add edi, 1
mov ecx, esi
mov dword [esp + 0x78], edi
call fcn.00417ac0
cmp edi, eax
jb 0x426f42
push str.COLShadow::ReportSampleItem
push str._____s__OUT
call fcn.00409e70
add esp, 8
mov ecx, dword [esp + 0x98c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x974]
xor ecx, esp
call fcn.00448e02
add esp, 0x984
ret 0xc
push 0x80004005
call fcn.00401210
push str.COLShadow::ReportSampleItem
push str._____s__OUT
call fcn.00409e70
add esp, 8
lea ecx, [esp + 0x100]
mov byte [esp + 0x994], 5
call fcn.0040daa0
lea eax, [edi - 0x10]
mov byte [esp + 0x994], 4
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4289bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x994], 3
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4289e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x994], 2
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428a05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
test eax, eax
mov byte [esp + 0x994], 1
je 0x428a1d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x64]
test eax, eax
mov byte [esp + 0x994], 0
je 0x428a35
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x2c]
test eax, eax
mov dword [esp + 0x994], ebx
je 0x428942
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x428942