Function at 0x40c000
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Hide graphical window
Inject thread
Packed with generic packer
Spawn thread to rwx shellcode
Terminate process
Terminate process by name

Disassembly:
mov ebx, 0x400000
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x411218], eax
add eax, dword [eax + 0x3c]
mov eax, dword [eax + 0x50]
mov dword [0x411230], eax
push 0x500
push 0x450873
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov dword [0x411070], 0x128
push 0
push 2
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov dword [0x41121c], eax
push 0x411070
push dword [0x41121c]
call dword [sym.imp.kernel32.dll_Process32First]
jmp 0x40c088
push dword [0x411220]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x411070
push dword [0x41121c]
call dword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
je 0x40c2f4
push 0x411234
push 0x411094
call dword [sym.imp.shell32.dll_StrStrIA]
test eax, eax
je 0x40c063
push dword [0x411078]
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [0x411220], eax
push 0x451c4d
push 0x451c4d
push 0x451c4d
push 0x411010
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_GetProcessTimes]
push section..data
push 0x411010
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
movzx ecx, word [0x411006]
movzx edx, word [0x411008]
movzx esi, word [0x41100a]
movzx edi, word [0x41100c]
pushal
push 0x451c4d
push 0x451c4d
push 0x451c4d
push 0x411010
push dword [0x411220]
call dword [sym.imp.kernel32.dll_GetProcessTimes]
push section..data
push 0x411010
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
popal
movzx eax, word [0x411006]
cmp eax, ecx
jne 0x40c063
movzx eax, word [0x411008]
cmp eax, edx
jne 0x40c063
movzx eax, word [0x41100a]
cmp eax, esi
jne 0x40c063
movzx esi, word [0x41100c]
sub edi, esi
cmp edi, 7
ja 0x40c063
push 0x40
push 0x3000
push dword [0x411230]
push 0
push dword [0x411220]
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
mov dword [0x411224], eax
test eax, eax
je 0x40c2f4
push 0x40
push 0x3000
push dword [0x411230]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [0x41122c], eax
test eax, eax
je 0x40c2f4
push dword [0x411230]
push dword [0x411218]
push dword [0x41122c]
call dword [sym.imp.kernel32.dll_RtlMoveMemory]
push dword [0x411224]
push dword [0x41122c]
push dword [0x411218]
call fcn.00404203
mov eax, dword [0x41122c]
push 0x451c4d
push dword [0x411230]
push eax
push dword [0x411224]
push dword [0x411220]
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
lea eax, [0x40c249]
sub eax, dword [0x411218]
mov ecx, dword [0x411224]
add eax, ecx
push 0
push 0
push dword [0x411224]
push eax
push 0
push 0
push dword [0x411220]
call dword [sym.imp.kernel32.dll_CreateRemoteThread]
push dword [0x411220]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x40c2f4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0x110
je 0x40c484
cmp dword [ebp + 0xc], 0x111
je 0x40d54c
cmp dword [ebp + 0xc], 0x10
je 0x40d660
cmp dword [ebp + 0xc], 0x4e
je 0x40c351
cmp dword [ebp + 0xc], 0xa3
je 0x40d8ad
cmp dword [ebp + 0xc], 0x405
je 0x40d923
xor eax, eax
jmp 0x40d66b
xor eax, eax
mov esi, dword [ebp + 0x14]
mov ebx, dword [0x411c73]
cmp dword [esi], ebx
je 0x40c393
mov ebx, dword [0x411c7b]
cmp dword [esi], ebx
jne 0x40d652
cmp dword [esi + 8], 0xffffff9b
je 0x40d7f0
cmp word [esi + 0xc], 0x26
je 0x40d879
cmp word [esi + 0xc], 0x28
je 0x40d893
jmp 0x40d652
cmp dword [esi + 8], 0xfffffffb
je 0x40d84f
cmp dword [esi + 8], 0xfffffffe
je 0x40d832
cmp dword [esi + 8], 0xfffffff4
jne 0x40d652
cmp dword [esi + 0xc], 1
jne 0x40c3c9
push 0x20
push 0
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetWindowLongA]
jmp 0x40d652
cmp dword [esi + 0xc], 0x10001
jne 0x40d652
push dword [esi + 0x24]
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
cmp dword [esi + 0x24], 0
je 0x40d652
cmp byte [edi + 0xe8], 0
je 0x40c406
mov dword [esi + 0x30], 0x5e47f0
jmp 0x40d652
cmp byte [edi + 0x209], 0
jne 0x40c44e
mov ecx, dword [edi + 4]
or ecx, ecx
je 0x40d652
mov ecx, dword [ecx + 0x8170]
or ecx, ecx
je 0x40d652
movzx eax, byte [ecx + 0x63]
cmp eax, 4
je 0x40c442
cmp eax, 0xc
jne 0x40c45a
mov dword [esi + 0x30], 0xe0d365
jmp 0x40d652
mov dword [esi + 0x30], 0x864c9f
jmp 0x40d652
mov dword [esi + 0x30], 0x3fc18
jmp 0x40d652
movzx ecx, byte [ecx + 0x44]
cmp ecx, 1
jne 0x40c46f
mov dword [esi + 0x30], 0x3ea960
jmp 0x40d652
cmp ecx, 2
jne 0x40d652
mov dword [esi + 0x30], 0xf2071f
jmp 0x40d652
mov eax, dword [ebp + 8]
mov dword [0x411c6b], eax
push 0x11
push dword [0x411218]
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x411c6f], eax
push dword [0x411c6f]
push 0
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SendMessageA]
push 0x451a54
push str._Team_stalker.ucoz.com___s_
push 0x451c4d
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
push 0x451c4d
push 0
push 0xc
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SendMessageA]
push 0x3eb
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x411c73], eax
push 0x303b
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x411c7b], eax
push 0x3ec
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x411c7f], eax
push 0x3ed
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x411c83], eax
push 0x303f
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x411c8b], eax
push 0x3025
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x411c87], eax
push 0xd903
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [0x411c97], eax
push 0
push dword [0x411c7b]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c8b]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c7f]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c83]
call dword [sym.imp.user32.dll_ShowWindow]
push 0x24
push 0
push 0x1036
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov dword [0x4111d8], 0xf
mov dword [0x4111dc], 0
mov dword [0x4111e0], 0xb4
push 0x4111d8
push 0
push 0x101b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov dword [0x4111f0], 9
mov dword [0x411200], 0xf000
mov esi, 0x44
mov eax, dword [esi*4 + 0x411241]
mov dword [0x411204], eax
push 0x4111f0
push 0
push 0x1007
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
xor eax, eax
mov eax, 2
shl eax, 0xc
mov dword [0x4111fc], eax
cmp esi, 0x14
jne 0x40c65b
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x1f
jne 0x40c683
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x20
jne 0x40c6ab
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x24
jne 0x40c6d3
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x25
jne 0x40c6fb
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x39
jne 0x40c723
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x3a
jne 0x40c74b
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x3d
jne 0x40c773
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x3e
jne 0x40c79b
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
cmp esi, 0x2d
jne 0x40c7c3
push 0x4111f0
push 0
push 0x102b
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi*4 + 0x411241]
mov byte [eax - 2], 1
dec esi
cmp esi, 0xffffffff
jne 0x40c600
push 0x28
push 0x4111f0
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 1
push 0
push 0x4032f1
push 0x1000000
push 0x3e8
call dword [sym.imp.Winmm.dll_timeSetEvent]
push 1
push 0
push 0x4032bf
push 0x1000000
push 0x927c0
call dword [sym.imp.Winmm.dll_timeSetEvent]
push 0x23
push 0x41
push 0x3c
push 0x2d
push 0x5f
push 0x4b
push str.info
push str.time
push str.frags
push str.ping
push 0x411c53
push str.name
push dword [0x411c73]
call fcn.00403d1d
push 0x4111bc
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
call fcn.00403ee0
push 0
push 0x40dd01
push 0
push dword [0x450e1b]
call fcn.004040f1
push 0
push dword [0x450e1b]
push 5
push 0x40dd4c
call fcn.004040f1
push 0
push 0x40dcb1
push 0
push dword [0x450e17]
call fcn.004040f1
push 0
push dword [0x450e17]
push 5
push 0x40dcfc
call fcn.004040f1
push 1
push sym.xray.exe_AddClientClass
push 0xad84
push dword [0x450e23]
call fcn.004040f1
push 1
push sym.xray.exe_DelClientClass
push 0xada7
push dword [0x450e23]
call fcn.004040f1
push 0
push 0xadad
push dword [0x450e23]
push 0x401164
call fcn.004040f1
push 0
push 0x401169
push 0xae45
push dword [0x450e23]
call fcn.004040f1
push 0
push 0x402d1a
push 0x8100
push dword [0x450e23]
call fcn.004040f1
push 0
push 0x810d
push dword [0x450e23]
push 0x402d34
call fcn.004040f1
push 0
push 0x8124
push dword [0x450e23]
push 0x402d39
call fcn.004040f1
push 0
push 0x40df67
push 0xae6f
push dword [0x450e23]
call fcn.004040f1
push 0
push 0xae8d
push dword [0x450e23]
push 0x40dfbc
call fcn.004040f1
push 0
push 0xae74
push dword [0x450e23]
push 0x40df95
call fcn.004040f1
push 1
push 0x406094
push 0x31858c
push dword [0x450e27]
call fcn.004040f1
push 1
push 0x40480b
push 0x3a252f
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a2538
push dword [0x450e27]
push 0x40480d
call fcn.004040f1
push 1
push 0x4046d9
push 0x3a33fd
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a340e
push dword [0x450e27]
push 0x40479f
call fcn.004040f1
push 1
push 0x4047a4
push 0x31ce6a
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x31ce96
push dword [0x450e27]
push 0x4047d2
call fcn.004040f1
push 1
push 0x40468b
push 0x2de087
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2de091
push dword [0x450e27]
push 0x4046d4
call fcn.004040f1
push 1
push 0x404624
push 0x338007
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x33800e
push dword [0x450e27]
push 0x404659
call fcn.004040f1
push 1
push 0x4045e8
push 0x33813b
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x338144
push dword [0x450e27]
push 0x40461f
call fcn.004040f1
push 1
push 0x402d82
push 0x3a2a41
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a2a4e
push dword [0x450e27]
push 0x402dc9
call fcn.004040f1
push 1
push 0x40465e
push 0x337f71
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x337f77
push dword [0x450e27]
push 0x404686
call fcn.004040f1
push 1
push 0x402e06
push 0x3a324a
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a3250
push dword [0x450e27]
push 0x402e6f
call fcn.004040f1
push 1
push 0x4047d7
push 0x3a05a9
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a05d7
push dword [0x450e27]
push 0x4047d7
call fcn.004040f1
push 1
push 0x4047dc
push 0x337fae
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x337fb4
push dword [0x450e27]
push 0x4047eb
call fcn.004040f1
push 1
push 0x404812
push 0x22a735
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x22a742
push dword [0x450e27]
push 0x404823
call fcn.004040f1
push 0
push 0x22a88c
push dword [0x450e27]
push 0x404828
call fcn.004040f1
push 1
push 0x40482d
push 0x28ee3b
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x28ee43
push dword [0x450e27]
push 0x404839
call fcn.004040f1
push 0
push 0x28ee53
push dword [0x450e27]
push 0x40483e
call fcn.004040f1
push 0
push 0x4047f0
push 0x3380ba
push dword [0x450e27]
call fcn.004040f1
push 2
push 0x402bb4
push 0x3212ae
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3212b8
push dword [0x450e27]
push 0x402bc6
call fcn.004040f1
push 0
push 0x321449
push dword [0x450e27]
push 0x402bcb
call fcn.004040f1
push 2
push 0x40496f
push 0x3a0a55
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a0a5e
push dword [0x450e27]
push 0x404981
call fcn.004040f1
push 0
push 0x3a0ab6
push dword [0x450e27]
push 0x40497c
call fcn.004040f1
push 1
push 0x406385
push 0x275a3d
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x275a51
push dword [0x450e27]
push 0x4063a8
call fcn.004040f1
push 1
push 0x40dfc1
push 0x318e41
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x318e4a
push dword [0x450e27]
push 0x40dfd1
call fcn.004040f1
push 1
push 0x404a32
push 0x3a3216
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a321d
push dword [0x450e27]
push 0x404a92
call fcn.004040f1
push 1
push 0x404ab9
push 0x2c5c2b
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2c5c38
push dword [0x450e27]
push 0x404acc
call fcn.004040f1
push 1
push 0x404ad1
push 0x3a60de
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a60f3
push dword [0x450e27]
push 0x404af2
call fcn.004040f1
push 0
push 0x3a617b
push dword [0x450e27]
push 0x404af7
call fcn.004040f1
push 1
push 0x404a97
push 0x338706
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x338711
push dword [0x450e27]
push 0x404aa8
call fcn.004040f1
push 0
push 0x338838
push dword [0x450e27]
push 0x404aad
call fcn.004040f1
push 1
push 0x404b02
push 0x3a211d
push dword [0x450e27]
call fcn.004040f1
push 1
push 0x404b99
push 0x2c69f5
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2c6a00
push dword [0x450e27]
push 0x404bad
call fcn.004040f1
push 0
push 0x404c2a
push 0x2df7b9
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2df7c2
push dword [0x450e27]
push 0x404c3c
call fcn.004040f1
push 0
push 0x2df7d2
push dword [0x450e27]
push 0x404c41
call fcn.004040f1
push 1
push 0x40dfd6
push 0x254966
push dword [0x450e27]
call fcn.004040f1
push 1
push 0x40dff2
push 0x29021b
push dword [0x450e27]
call fcn.004040f1
push 1
push 0x40e000
push 0x1fdbe7
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x404c25
push 0x3a10e5
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a1107
push dword [0x450e27]
push 0x404c25
call fcn.004040f1
push 1
push 0x402b81
push 0x3180bd
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3180c9
push dword [0x450e27]
push 0x402baa
call fcn.004040f1
push 0
push 0x3182d4
push dword [0x450e27]
push 0x402baf
call fcn.004040f1
push 2
push 0x402acf
push 0x320b87
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x320b93
push dword [0x450e27]
push 0x402ae5
call fcn.004040f1
push 0
push 0x320bd5
push dword [0x450e27]
push 0x402aea
call fcn.004040f1
push 1
push 0x402bd9
push 0x337f37
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x402d0a
push 0x3a0c49
push dword [0x450e27]
call fcn.004040f1
push 2
push 0x408aba
push 0x3127b6
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3127be
push dword [0x450e27]
push 0x408ad3
call fcn.004040f1
push 1
push 0x408ad8
push 0x3134e0
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3134ee
push dword [0x450e27]
push 0x408b05
call fcn.004040f1
push 0
push 0x3134f0
push dword [0x450e27]
push 0x408b0a
call fcn.004040f1
push 1
push 0x408b0f
push 0x31293d
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x312946
push dword [0x450e27]
push 0x408b21
call fcn.004040f1
push 0
push 0x3129d7
push dword [0x450e27]
push 0x408b26
call fcn.004040f1
push 1
push 0x402bfb
push 0x314454
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x31445b
push dword [0x450e27]
push 0x402c11
call fcn.004040f1
push 1
push 0x402ec9
push 0x201af2
push dword [0x450e27]
call fcn.004040f1
push 1
push 0x402ed2
push 0x3547dd
push dword [0x450e27]
call fcn.004040f1
push 3
push 0x402de8
push 0x31d7b1
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x31d7b9
push dword [0x450e27]
push 0x402e01
call fcn.004040f1
push 1
push 0x404843
push 0x4162f
push dword [0x450e1f]
call fcn.004040f1
push 0
push 0x41645
push dword [0x450e1f]
push 0x404850
call fcn.004040f1
push 1
push 0x402d3e
push 0x2f668b
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2f6693
push dword [0x450e27]
push 0x402d4a
call fcn.004040f1
push 0
push 0x2f6a43
push dword [0x450e27]
push 0x402d4f
call fcn.004040f1
push 1
push 0x402f1d
push 0x31f348
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x31f48f
push dword [0x450e27]
push 0x402f9e
call fcn.004040f1
push 0
push 0x402fc4
push 0x2c5db7
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2c5dce
push dword [0x450e27]
push 0x403004
call fcn.004040f1
push 1
push 0x402fa3
push 0x322b55
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x322b63
push dword [0x450e27]
push 0x402fba
call fcn.004040f1
push 0
push 0x322b80
push dword [0x450e27]
push 0x402fbf
call fcn.004040f1
push 1
push 0x402dce
push 0x3a224c
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a22cd
push dword [0x450e27]
push 0x402de3
call fcn.004040f1
push 2
push 0x408ddf
push 0x3a06a8
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3a06b8
push dword [0x450e27]
push 0x408e05
call fcn.004040f1
push 0
push 0x3a0ca7
push dword [0x450e27]
push 0x408e0a
call fcn.004040f1
push 1
push 0x404c7a
push 0xbf153
push dword [0x450e27]
call fcn.004040f1
push 0
push 0xbf1cf
push dword [0x450e27]
push 0x404ca3
call fcn.004040f1
push 0
push 0xbf38a
push dword [0x450e27]
push 0x404ca8
call fcn.004040f1
push 1
push 0x404cad
push 0x20552c
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x205553
push dword [0x450e27]
push 0x404cad
call fcn.004040f1
push 1
push 0x402e74
push 0x2e004c
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2e006c
push dword [0x450e27]
push 0x402e95
call fcn.004040f1
push 1
push 0x402cb7
push 0x31c9bc
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x31c9ce
push dword [0x450e27]
push 0x402cd3
call fcn.004040f1
push 0
push 0x31caa3
push dword [0x450e27]
push 0x402cd8
call fcn.004040f1
push 1
push 0x402cac
push 0x2dc18b
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x2dc1fa
push dword [0x450e27]
push 0x402cb2
call fcn.004040f1
push 1
push 0x402cdd
push 0x316e52
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x316e5c
push dword [0x450e27]
push 0x402cf2
call fcn.004040f1
push 0
push 0x316e96
push dword [0x450e27]
push 0x402d05
call fcn.004040f1
push 1
push 0x40b78d
push 0x32371c
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x323723
push dword [0x450e27]
push 0x40b79a
call fcn.004040f1
push 1
push 0x402edf
push 0xf37d7
push dword [0x450e27]
call fcn.004040f1
push 0
push 0xf37dd
push dword [0x450e27]
push 0x402eee
call fcn.004040f1
push 0
push 0xf3898
push dword [0x450e27]
push 0x402ee9
call fcn.004040f1
push 1
push 0x402e9a
push 0x3070b7
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3070c7
push dword [0x450e27]
push 0x402eb1
call fcn.004040f1
push 0
push 0x30710c
push dword [0x450e27]
push 0x402ec4
call fcn.004040f1
push 1
push 0x402ef3
push 0x30759e
push dword [0x450e27]
call fcn.004040f1
push 0
push 0x3075a8
push dword [0x450e27]
push 0x402f18
call fcn.004040f1
push 0
push 0x40c2f4
push 0x8d50
push dword [0x450e1f]
call fcn.004040f1
mov esi, dword [0x450e2b]
add esi, 0x1b944
push 0x451c4d
push 0x40
push 1
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
push 0x90
push 1
push esi
call dword [sym.imp.kernel32.dll_RtlFillMemory]
mov ecx, dword [0x4909f4]
push 0x411ac3
call dword [0x411a9d]
mov ecx, dword [0x4909f4]
push 0x411ae2
call dword [0x411a9d]
mov ecx, dword [0x4909f4]
push 0x411b01
call dword [0x411a9d]
mov ecx, dword [0x4909f4]
push 0x411b34
call dword [0x411a9d]
jmp 0x40d652
cmp dword [ebp + 0x10], 0x3039
je 0x40d682
cmp dword [ebp + 0x10], 0x3042
je 0x40d7b7
cmp dword [ebp + 0x10], 0x3ed
je 0x40d96c
cmp dword [ebp + 0x10], 0xd903
je 0x40d672
cmp dword [ebp + 0x10], 0x700
je 0x40d9cd
cmp dword [ebp + 0x10], 0x701
je 0x40da35
cmp dword [ebp + 0x10], 0x702
je 0x40dac4
cmp dword [ebp + 0x10], 0x703
je 0x40db13
cmp dword [ebp + 0x10], 0x704
je 0x40dbda
cmp dword [ebp + 0x10], 0x705
je 0x40dc3c
cmp dword [ebp + 0x10], 0x706
je 0x40db84
cmp dword [ebp + 0x10], 0x400
jb 0x40d601
cmp dword [ebp + 0x10], 0x409
ja 0x40d601
mov eax, dword [ebp + 0x10]
movzx eax, al
mov eax, dword [eax*4 + 0x450ebf]
push eax
call dword [0x450e33]
cmp dword [ebp + 0x10], 0x500
jb 0x40d627
cmp dword [ebp + 0x10], 0x508
ja 0x40d627
mov eax, dword [ebp + 0x10]
movzx eax, al
mov eax, dword [eax*4 + 0x450ee7]
push eax
call dword [0x450e33]
cmp dword [ebp + 0x10], 0x600
jb 0x40d652
cmp dword [ebp + 0x10], 0x606
ja 0x40d652
mov eax, dword [ebp + 0x10]
movzx eax, al
mov dword [0x411db7], eax
mov eax, dword [eax*4 + 0x450f0b]
push eax
call dword [0x450e2f]
mov eax, 1
jmp 0x40d66b
push 0
push dword [ebp + 8]
call dword [sym.imp.user32.dll_EndDialog]
pop edi
pop esi
pop ebx
leave
ret 0x10
push 0x411beb
call dword [0x450e53]
add esp, 4
jmp 0x40d652
cmp dword [0x411c77], 5
je 0x40d71c
push 5
push dword [0x411c73]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c7f]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c87]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c97]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c7b]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c8b]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c8f]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c7f]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c83]
call dword [sym.imp.user32.dll_ShowWindow]
mov dword [0x411c77], 5
jmp 0x40d652
push 0
push dword [0x411c73]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c7f]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c83]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c87]
call dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [0x411c97]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c7b]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c8b]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c8f]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c7f]
call dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [0x411c83]
call dword [sym.imp.user32.dll_ShowWindow]
mov dword [0x411c77], 0
jmp 0x40d652
call fcn.0040426b
test eax, eax
je 0x40d7d8
push str.UPDATE_OK
push 0x3042
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
jmp 0x40d652
push str.UPDATE_BAG
push 0x3042
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
jmp 0x40d652
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
cmp ecx, 0x41
ja 0x40d652
mov eax, dword [eax + 0x14]
shr eax, 0xc
test eax, eax
je 0x40d652
cmp eax, 2
je 0x40d822
mov eax, dword [ecx*4 + 0x411241]
mov byte [eax - 2], 0
jmp 0x40d652
mov eax, dword [ecx*4 + 0x411241]
mov byte [eax - 2], 1
jmp 0x40d652
push 0
push 0x10001
push 0x128
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
jmp 0x40d652
push 0
push 0
push 0x1032
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
test eax, eax
je 0x40d652
push dword [ebp + 8]
call fcn.00403912
jmp 0x40d652
push 0
push 0
push 0x115
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
jmp 0x40d652
push 0
push 1
push 0x115
push dword [0x411c7b]
call dword [sym.imp.user32.dll_SendMessageA]
jmp 0x40d652
mov dword [0x411b94], 1
mov dword [0x411018], 0x58
mov eax, dword [ebp + 8]
mov dword [0x41101c], eax
mov dword [0x411020], 0
mov dword [0x411024], 7
mov dword [0x411028], 0x405
mov eax, dword [0x411c6f]
mov dword [0x41102c], eax
push 0x411018
push 0
call dword [sym.imp.shell32.dll_Shell_NotifyIconA]
push 0
push 0xf020
push 0x112
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SendMessageA]
push 0
push dword [ebp + 8]
call dword [sym.imp.user32.dll_ShowWindow]
jmp 0x40d652
cmp dword [ebp + 0x14], 0x203
jne 0x40d652
mov dword [0x411b94], 0
push 0
push 0xf120
push 0x112
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SendMessageA]
push 5
push dword [ebp + 8]
call dword [sym.imp.user32.dll_ShowWindow]
push 0x411018
push 2
call dword [sym.imp.shell32.dll_Shell_NotifyIconA]
jmp 0x40d652
push 0
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
lea esi, [edi + 0x469]
push 0x4ff
push esi
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 0xc8
push esi
push 0x3ec
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItemTextA]
or eax, eax
je 0x40d9c8
push esi
call dword [0x450e47]
push esi
call fcn.00404539
push 0
push 0x3ec
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetDlgItemTextA]
jmp 0x40d652
jmp 0x40d652
push 0
push 0
push 0x1042
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x40d652
or eax, eax
je 0x40d652
push eax
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
lea esi, [edi + 0x469]
push 0x4ff
push esi
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 0xc8
push esi
push 0x3025
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItemTextA]
push esi
push dword [edi]
call fcn.0040313c
jmp 0x40d652
push 0
push 0
push 0x1042
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x40d652
or eax, eax
je 0x40d652
push eax
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
lea esi, [edi + 0x469]
push 0x4ff
push esi
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 0xc8
push esi
push 0x3025
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItemTextA]
push dword [0x45112a]
push dword [edi + 0x40]
push str._s__d
push 0x451c4d
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
push esi
push dword [edi]
call fcn.00403109
push 0x451c4d
call dword [0x450e7f]
jmp 0x40d652
push 0
push 0
push 0x1042
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x40d652
or eax, eax
je 0x40d652
push eax
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
lea esi, [edi + 0x469]
mov word [esi], 0x32
push dword [edi]
push 2
push esi
call fcn.00404183
jmp 0x40d652
push 0
push 0
push 0x1042
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x40d652
or eax, eax
je 0x40d652
push eax
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
lea esi, [edi + 0x469]
push 0x4ff
push esi
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 0xc8
push esi
push 0x3025
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetDlgItemTextA]
push 0
push esi
call fcn.004043df
push dword [edi]
push eax
push esi
call fcn.00404183
jmp 0x40d652
push 0
push 0
push 0x1042
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x40d652
or eax, eax
je 0x40d652
push eax
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
cmp byte [edi + 0x209], 0
jne 0x40dbce
mov byte [edi + 0x209], 1
jmp 0x40d652
mov byte [edi + 0x209], 0
jmp 0x40d652
push 0
push 0
push 0x1042
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x40d652
or eax, eax
je 0x40d652
push eax
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 0x8170]
movzx eax, byte [ecx + 0x61]
cmp eax, 4
jae 0x40dc9e
inc eax
mov byte [ecx + 0x61], al
push eax
push dword [edi + 0x3c]
push str.___XRAY__Player:__s__set_new_rank___d_
call dword [0x450e53]
add esp, 0xc
jmp 0x40d652
push 0
push 0
push 0x1042
push dword [0x411c73]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x40d652
or eax, eax
je 0x40d652
push eax
call sym.xray.exe_GetClientByNum
or eax, eax
je 0x40d652
xchg edi, eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 0x8170]
movzx eax, byte [ecx + 0x61]
cmp eax, 0
je 0x40dc9e
dec eax
mov byte [ecx + 0x61], al
push eax
push dword [edi + 0x3c]
push str.___XRAY__Player:__s__set_new_rank___d_
call dword [0x450e53]
add esp, 0xc
jmp 0x40d652
push str.___XRAY__Arrive_Maximum_Minimum_Value_Rank_
call dword [0x450e53]
add esp, 4
jmp 0x40d652