Function at 0x437ae0
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56914d
mov eax, dword fs:[0]
push eax
sub esp, 0x638
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x624], ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x34]
mov esi, dword [ebp + 0x3c]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5f8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp + 0x38]
xor ebx, ebx
mov dword [ebp - 0x618], edi
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x5fc], esi
mov dword [ebp - 0x5e8], ebx
call fcn.00411680
mov ecx, eax
call fcn.004127d0
test al, al
je 0x437ba7
lea ecx, [esi + 0x410]
call fcn.00432280
mov al, 1
jmp 0x43aa2a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x628]
cmp ecx, eax
jne 0x437c0e
push str.CLocalRelay::NewConnection___Inside_traffic_loop
lea ecx, [ebp - 0x40]
call fcn.00405090
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004453e0
mov ecx, eax
call fcn.00448360
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 0x10
jb 0x437bf5
push dword [ebp - 0x40]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
xor al, al
jmp 0x43aa2a
push ecx
mov ecx, esi
call fcn.00431890
lea ecx, [ebp - 0x304]
call fcn.0040f2f0
mov dword [ebp - 4], 1
push dword [ebp - 0x628]
lea eax, [ebp - 0x274]
push eax
call fcn.004594b0
mov ecx, eax
call fcn.004594c0
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x304]
call fcn.0040f980
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x274]
call fcn.0040f730
cmp dword [ebp - 0x2bc], 0
je 0x437d02
push 0x5876d8
lea ecx, [ebp - 0x40]
call fcn.00405090
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00461ee0
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.004453e0
mov ecx, eax
call fcn.004468f0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 0x10
jb 0x437cc9
push dword [ebp - 0x28]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2c], 0x10
jb 0x437cf0
push dword [ebp - 0x40]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.0040bbc0
movzx eax, ax
cmp word [ebp + 0xc], ax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x634], eax
sete byte [ebp - 0x5e1]
mov dword [ebp - 0x104], 0xf
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x118], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x61c]
push 1
mov eax, dword [ecx]
push dword [ebp - 0x628]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x160]
push eax
call fcn.004594b0
mov ecx, eax
call fcn.00459590
mov byte [ebp - 4], 6
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045edf0
add esp, 8
mov byte [ebp - 4], 7
push 0xc
push str.iexplore.exe
push dword [eax + 0x10]
mov ecx, eax
push 0
call fcn.0040c860
test eax, eax
sete al
mov byte [ebp - 0x5ea], al
mov byte [ebp - 4], 6
cmp dword [ebp - 0x14], 8
jb 0x437dc8
push dword [ebp - 0x28]
call fcn.004ad196
mov al, byte [ebp - 0x5ea]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
test al, al
je 0x437de7
mov ecx, esi
call fcn.0048a270
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
mov byte [ebp - 4], 8
call fcn.0040c180
test al, al
jne 0x437e23
push 0x26
push str._Warning__Redirector_is_disabled_
lea ecx, [ebp - 0x70]
call fcn.00405750
cmp dword [ebp - 0x150], 0
je 0x437e9e
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00461ee0
add esp, 8
mov byte [ebp - 4], 9
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x70]
call fcn.00405650
mov byte [ebp - 4], 8
cmp dword [ebp - 0x14], 0x10
jb 0x437e65
push dword [ebp - 0x28]
call fcn.004ad196
add esp, 4
push 2
push 0x582f94
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00405750
push dword [ebp - 0x628]
lea eax, [ebp - 0x28]
push eax
call fcn.00425090
add esp, 8
mov byte [ebp - 4], 0xa
jmp 0x437ec3
push 5
push str.PID:
lea ecx, [ebp - 0x70]
call fcn.00405750
push dword [ebp - 0x628]
lea eax, [ebp - 0x28]
push eax
call fcn.00425090
add esp, 8
mov byte [ebp - 4], 0xb
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x70]
call fcn.00405650
mov byte [ebp - 4], 8
cmp dword [ebp - 0x14], 0x10
jb 0x437ee5
push dword [ebp - 0x28]
call fcn.004ad196
add esp, 4
push 1
push 0x582f98
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
call fcn.00405750
mov eax, dword [ebp - 0x5f8]
mov ecx, 0x7b6b
cmp word [eax], cx
jne 0x437f36
mov ecx, 0x50
mov word [eax], cx
push 1
mov ecx, esi
call fcn.004318f0
push 7
push str._Panda
lea ecx, [ebp - 0x70]
call fcn.00405750
push 3
push 0x582fac
lea ecx, [ebp - 0x70]
call fcn.00405750
push 4
push str.New
lea ecx, [ebp - 0x70]
call fcn.00405750
cmp byte [ebp - 0x5e1], 0
je 0x437f6c
push 0xe
push str.decrypted_SSL
lea ecx, [ebp - 0x70]
call fcn.00405750
mov eax, dword [ebp - 0x60c]
push dword [eax]
lea eax, [ebp - 0x40]
push eax
call fcn.00478fa0
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x28]
push str.connection_to:
push eax
call fcn.00407110
add esp, 0x14
mov byte [ebp - 4], 0xd
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x70]
call fcn.00405650
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x14], 0x10
jb 0x437fb9
push dword [ebp - 0x28]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 8
cmp dword [ebp - 0x2c], 0x10
jb 0x437fe0
push dword [ebp - 0x40]
call fcn.004ad196
add esp, 4
cmp dword [ebp - 0x108], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
je 0x438026
push 0x28
push 1
lea ecx, [ebp - 0x70]
call fcn.0040c7b0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x70]
call fcn.00405650
push 0x29
push 1
lea ecx, [ebp - 0x70]
call fcn.0040c7b0
push 0x3a
push 1
lea ecx, [ebp - 0x70]
call fcn.0040c7b0
mov ecx, dword [ebp - 0x5f8]
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00425090
add esp, 8
mov byte [ebp - 4], 0xe
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x70]
call fcn.00405650
mov byte [ebp - 4], 8
cmp dword [ebp - 0x14], 0x10
jb 0x43806e
push dword [ebp - 0x28]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00425090
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x28]
push str._at
push eax
call fcn.00407110
add esp, 0x14
mov byte [ebp - 4], 0x10
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x70]
call fcn.00405650
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x14], 0x10
jb 0x4380cc
push dword [ebp - 0x28]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 8
cmp dword [ebp - 0x2c], 0x10
jb 0x4380f3
push dword [ebp - 0x40]
call fcn.004ad196
add esp, 4
push 2
push 0x58228c
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.00405750
cmp dword [ebp - 0x5c], 0x10
push 0
push 0
push 1
push 0
push dword [ebp - 0x60]
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
lea ecx, [esi + 0x410]
push eax
mov dword [ebp - 0x600], ecx
call fcn.00432290
call fcn.0040c180
test al, al
jne 0x438157
mov ecx, dword [ebp - 0x600]
call fcn.00432280
mov bl, 1
jmp 0x43a981
cmp byte [ebp + 8], 0
je 0x438164
mov ecx, esi
call fcn.00431940
lea ecx, [ebp - 0x45c]
call fcn.0040f2f0
mov byte [ebp - 4], 0x11
push dword [ebp - 0x628]
lea eax, [ebp - 0x274]
push eax
call fcn.004594b0
mov ecx, eax
call fcn.004594c0
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x45c]
call fcn.0040f980
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x274]
call fcn.0040f730
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x13
push str.iexplore.exe
push eax
call fcn.00409df0
add esp, 0x10
mov byte [ebp - 0x644], al
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x14], 8
jb 0x4381e8
push dword [ebp - 0x28]
call fcn.004ad196
add esp, 4
xor eax, eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x604], eax
mov dword [ebp - 0xbc], 0xf
mov dword [ebp - 0xc0], eax
mov byte [ebp - 0xd0], al
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x130], al
mov byte [ebp - 4], 0x15
mov byte [ebp - 0x5e9], al
lea eax, [ebp - 0x5f0]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x608]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x600], esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x2fc]
push eax
call fcn.00403fc0
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x15
call fcn.0040b620
add esp, 0x2c
mov byte [ebp - 0x5e9], al
test al, al
jne 0x4382f5
lea eax, [ebp - 0x5f0]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x608]
push eax
call fcn.0040b250
add esp, 0x14
mov byte [ebp - 0x5e9], al
mov ecx, esi
call fcn.004316c0
test al, al
je 0x4384b5
cmp byte [ebp - 0x5e9], 0
jne 0x4384b5
mov ecx, dword [edi]
mov eax, dword [ebp - 0x620]
cmp ecx, dword [edi + 4]
jne 0x438337
cmp dword [eax], 0
je 0x43832a
xor bl, bl
jmp 0x43a954
mov dword [eax], 0x64
mov bl, 1
jmp 0x43a954
cmp dword [eax], 0
je 0x438343
xor bl, bl
jmp 0x43a954
push 7
push str.connect
push ecx
call fcn.004b04d5
add esp, 0xc
test eax, eax
je 0x43836c
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
push eax
push ecx
call fcn.00423d60
add esp, 8
test al, al
jne 0x438373
xor bl, bl
jmp 0x43a954
push 0
push 1
lea ecx, [ebp - 0x568]
call fcn.0042c080
mov byte [ebp - 4], 0x17
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x568]
call fcn.0042e4e0
test al, al
jne 0x4383c0
mov eax, dword [ebp - 0x620]
mov bl, 1
mov dword [eax], 0x1f4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x568]
call fcn.0042c2d0
jmp 0x43a954
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
mov byte [ebp - 4], 0x18
push str.host
lea ecx, [ebp - 0x28]
call fcn.00405090
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x568]
call fcn.0042e990
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0xa0]
call fcn.00405120
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x88]
call fcn.004050f0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x28]
call fcn.004050f0
cmp dword [ebp - 0x90], 0
jne 0x438473
xor bl, bl
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa0]
call fcn.004050f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x568]
call fcn.0042c2d0
jmp 0x43a954
push 0
mov ecx, esi
call fcn.004318f0
lea eax, [ebp - 0xa0]
push eax
call fcn.00420b40
mov ecx, eax
call fcn.00420b50
mov ecx, dword [ebp - 0x60c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa0]
call fcn.004050f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x568]
call fcn.0042c2d0
mov byte [ebp - 0x5f1], 0
call fcn.00421970
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x38]
call eax
test al, al
je 0x438690
mov ecx, esi
call fcn.004313c0
test al, al
jne 0x438690
lea ecx, [ebp - 0x1fc]
call fcn.00436ae0
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x1fc], eax
mov ax, word [ebp - 0x604]
push 0xffffffffffffffff
mov word [ebp - 0x1f8], ax
push 0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x1f0]
call fcn.00405880
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00405880
mov byte [ebp - 0x5e2], 1
call fcn.00421970
lea ecx, [ebp - 0x5e2]
push ecx
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0xd0]
push ecx
lea ecx, [ebp - 0x604]
push ecx
lea ecx, [ebp - 0x608]
push ecx
lea ecx, [ebp - 0x5f0]
push ecx
lea ecx, [ebp - 0x5e9]
push ecx
mov edx, dword [eax]
lea ecx, [ebp - 0x118]
push ecx
push esi
push dword [ebp - 0x620]
mov ecx, eax
push edi
push dword [ebp - 0x610]
mov eax, dword [edx + 0x14]
push dword [ebp - 0x62c]
push dword [ebp - 0x630]
push dword [ebp - 0x628]
push dword [ebp - 0x5f8]
push dword [ebp - 0x60c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test al, al
jne 0x4385db
xor bl, bl
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1fc]
call fcn.00436eb0
jmp 0x43a954
mov eax, dword [ebp - 0x620]
cmp dword [eax], 0
je 0x4385fc
mov bl, 1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1fc]
call fcn.00436eb0
jmp 0x43a954
cmp byte [ebp - 0x5e2], 0
je 0x43867c
mov ecx, esi
call fcn.00431950
cmp byte [ebp - 0x5e2], 0
je 0x43867c
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x5f0]
jne 0x438675
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x608]
jne 0x438675
mov ax, word [ebp - 0x1f8]
cmp ax, word [ebp - 0x604]
jne 0x438675
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.00435e00
add esp, 8
test al, al
jne 0x438675
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.00435e00
add esp, 8
test al, al
je 0x43867c
mov byte [ebp - 0x5f1], 1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1fc]
call fcn.00436eb0
jmp 0x438776
call fcn.00421970
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x38]
call eax
test al, al
je 0x438776
mov ecx, esi
call fcn.004313c0
test al, al
je 0x438776
mov edi, dword [ebp - 0x624]
push 1
push dword [edi + 0xd0]
lea ecx, [ebp - 0x4c]
call fcn.0049bd60
mov byte [ebp - 4], 0x1c
mov ecx, esi
call fcn.00488e60
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x600]
push eax
lea ecx, [edi + 0xc8]
call fcn.00420410
mov esi, dword [eax]
cmp esi, dword [edi + 0xc8]
je 0x43875e
cmp dword [ebp - 0x5f0], 0xd
lea ecx, [ebp - 0xd0]
setne byte [ebp - 0x5e9]
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x608], eax
movzx eax, word [esi + 0x18]
mov dword [ebp - 0x604], eax
lea eax, [esi + 0x20]
cmp ecx, eax
je 0x438737
push 0xffffffffffffffff
push 0
push eax
call fcn.00405880
lea eax, [esi + 0x38]
lea ecx, [ebp - 0x130]
cmp ecx, eax
je 0x43874e
push 0xffffffffffffffff
push 0
push eax
call fcn.00405880
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x5f0], eax
mov byte [ebp - 0x5f1], 1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x4c]
call fcn.0049bd90
mov edi, dword [ebp - 0x618]
mov esi, dword [ebp - 0x5fc]
cmp byte [ebp + 8], 0
je 0x43878c
mov eax, dword [ebp - 0x630]
mov ecx, esi
mov byte [eax], 1
call fcn.0048c4f0
cmp byte [ebp - 0x5e9], 0
je 0x43964e
mov eax, dword [ebp - 0x5f8]
movzx eax, word [eax]
push eax
call fcn.00431740
add esp, 4
test al, al
mov eax, dword [ebp - 0x5f0]
je 0x4387d9
cmp eax, 1
je 0x43964e
cmp eax, 2
je 0x43964e
cmp eax, 3
je 0x43964e
cmp eax, 4
je 0x43964e
cmp eax, 0xd
je 0x43964e
cmp eax, 0xb
je 0x43964e
cmp eax, 0xc
je 0x43964e
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x5f8]
movzx eax, word [eax]
push eax
call fcn.00431740
add esp, 4
test al, al
je 0x438889
mov eax, dword [ebp - 0x5f0]
cmp eax, 1
je 0x438857
cmp eax, 2
je 0x438857
cmp eax, 3
je 0x438857
cmp eax, 4
jne 0x438889
push str.proxysni
lea ecx, [ebp - 0x28]
call fcn.004038b0
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x28]
mov ebx, 1
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.0040af50
add esp, 4
mov byte [ebp - 0x5e2], bl
cmp eax, ebx
je 0x438890
mov byte [ebp - 0x5e2], 0
mov dword [ebp - 4], 0x1d
test bl, 1
je 0x4388ad
and ebx, 0xfffffffe
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5e2], 0
je 0x4388fd
mov eax, dword [edi + 4]
mov ecx, dword [edi]
cmp ecx, eax
je 0x43893c
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x88]
push eax
call fcn.00437440
add esp, 0xc
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x148]
call fcn.00405120
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x88]
call fcn.004050f0
mov eax, dword [ebp - 0x620]
mov dword [eax], 0
mov eax, dword [ebp - 0x5f0]
cmp eax, 9
jne 0x438963
mov eax, dword [ebp - 0x608]
mov ecx, dword [ebp - 0x60c]
mov bl, 1
mov dword [ecx], eax
mov ax, word [ebp - 0x604]
mov ecx, dword [ebp - 0x5f8]
mov word [ecx], ax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x148]
call fcn.004050f0
jmp 0x43a954
mov eax, dword [ebp - 0x620]
cmp dword [eax], 0
jne 0x4388f7
mov dword [eax], 0xbb8
mov bl, 1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x148]
call fcn.004050f0
jmp 0x43a954
cmp eax, 0xa
jne 0x43897e
xor bl, bl
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x148]
call fcn.004050f0
jmp 0x43a954
mov byte [ebp - 0x600], 0
mov byte [ebp - 0x618], 0
cmp eax, 4
je 0x4389a3
cmp eax, 3
je 0x4389a3
test eax, eax
je 0x4389a3
cmp eax, 7
jne 0x438f83
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x20
push str.iexplore.exe
or ebx, 2
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
test al, al
jne 0x438a0e
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0045edf0
mov dword [ebp - 4], 0x21
push str.chrome.exe
or ebx, 4
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
mov byte [ebp - 0x5e2], 0
test al, al
je 0x438a15
mov byte [ebp - 0x5e2], 1
mov dword [ebp - 4], 0x20
test bl, 4
je 0x438a35
and ebx, 0xfffffffb
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
mov dword [ebp - 4], 0x1d
test bl, 2
je 0x438a52
and ebx, 0xfffffffd
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5e2], 0
je 0x438b09
mov eax, dword [ebp - 0x60c]
mov esi, dword [ebp - 0x624]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x5f8]
push 1
mov ax, word [eax]
push dword [esi + 0xd0]
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x44], 0
mov word [ebp - 0x48], ax
call fcn.0049bd60
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x634]
push eax
lea ecx, [esi + 0xd4]
call fcn.00420410
mov eax, dword [eax]
cmp eax, dword [esi + 0xd4]
je 0x438aed
mov esi, dword [eax + 0x14]
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x62c]
push ecx
lea ecx, [eax + 0x14]
call fcn.0043b7c0
mov ecx, dword [ebp - 0x600]
cmp dword [eax], esi
movzx ecx, cl
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x600], ecx
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xac]
call fcn.0049bd90
cmp byte [ebp - 0x600], 0
jne 0x438f7d
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jne 0x438c5e
mov ebx, dword [ebp - 0x620]
cmp dword [ebx], 0
je 0x438b70
mov eax, dword [ebp - 0x5f0]
mov dword [ebx], 0
test eax, eax
je 0x438b54
cmp eax, 7
je 0x438b54
cmp eax, 3
je 0x438b42
cmp eax, 4
jne 0x438f7d
mov esi, dword [ebp - 0x5fc]
mov ecx, esi
call fcn.00431830
jmp 0x438f83
mov esi, dword [ebp - 0x5fc]
mov ecx, esi
mov dword [ebp - 0x5f0], 0xd
call fcn.00431830
jmp 0x438f83
cmp byte [ebp - 0x5f1], 0
je 0x438c42
lea ecx, [ebp - 0x238]
call fcn.00436ae0
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x238], eax
mov ax, word [ebp - 0x604]
mov word [ebp - 0x234], ax
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040a140
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x214]
call fcn.0040a140
mov esi, dword [ebp - 0x624]
push 1
push dword [esi + 0xd0]
lea ecx, [ebp - 0xac]
call fcn.0049bd60
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x5fc]
call fcn.00488e60
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x62c]
push eax
lea ecx, [esi + 0xc8]
call fcn.00436f90
mov ecx, eax
call fcn.00436f40
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xac]
call fcn.0049bd90
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x238]
call fcn.00436eb0
mov dword [ebx], 0x64
mov bl, 1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x148]
call fcn.004050f0
jmp 0x43a954
mov eax, dword [ebp - 0x620]
mov byte [ebp - 0x5e2], 0
cmp dword [eax], 0
je 0x438c7d
mov byte [ebp - 0x5e2], 1
mov dword [eax], 0
push 7
push str.connect
push dword [edi]
call fcn.004b04d5
add esp, 0xc
test eax, eax
je 0x438f76
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
push eax
push ecx
call fcn.00423d60
mov cl, al
add esp, 8
mov dword [ebp - 0x600], ecx
test cl, cl
je 0x438f7d
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x25
push str.iexplore.exe
or ebx, 8
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
test al, al
jne 0x438d1b
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0045edf0
mov dword [ebp - 4], 0x26
push str.chrome.exe
or ebx, 0x10
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
test al, al
je 0x438d49
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp - 0x60c]
mov esi, dword [ebp - 0x5f8]
cmp dword [ecx], eax
je 0x438d4f
mov eax, 0x303e
cmp word [esi], ax
je 0x438d4f
mov byte [ebp - 0x5ea], 1
jmp 0x438d56
mov esi, dword [ebp - 0x5f8]
mov byte [ebp - 0x5ea], 0
mov dword [ebp - 4], 0x25
test bl, 0x10
je 0x438d76
and ebx, 0xffffffef
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
mov dword [ebp - 4], 0x1d
test bl, 8
je 0x438d93
and ebx, 0xfffffff7
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5ea], 0
je 0x438e07
mov eax, dword [ebp - 0x60c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ax, word [esi]
mov word [ebp - 0x48], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp - 0x624]
push 1
push dword [ebx + 0xd0]
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x44], eax
call fcn.0049bd60
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebx + 0xd4]
call fcn.00437100
mov ecx, eax
call fcn.0043b810
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xac]
call fcn.0049bd90
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov esi, dword [ebp - 0x5fc]
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.004313b0
mov ecx, eax
call fcn.0042e4e0
test al, al
jne 0x438e52
cmp byte [ebp - 0x5e2], al
jne 0x438e5b
mov eax, dword [ebp - 0x620]
mov bl, 1
mov dword [eax], 0x1f4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x148]
call fcn.004050f0
jmp 0x43a954
cmp byte [ebp - 0x5e2], 0
je 0x438e62
xor bl, bl
jmp 0x438f89
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xb8], 0
mov byte [ebp - 4], 0x28
push str.host
lea ecx, [ebp - 0x28]
call fcn.00405090
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
mov ecx, esi
call fcn.004313b0
mov ecx, eax
call fcn.0042e990
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0xb8]
call fcn.00405120
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x88]
call fcn.004050f0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x28]
call fcn.004050f0
cmp dword [ebp - 0xa8], 0
jne 0x438f09
xor bl, bl
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xb8]
call fcn.004050f0
jmp 0x438f89
lea eax, [ebp - 0xb8]
push eax
mov ecx, esi
call fcn.00431870
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x88]
push str.http:__
push eax
call fcn.0040ccc0
add esp, 0xc
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0xb8]
call fcn.00405120
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x88]
call fcn.004050f0
lea eax, [ebp - 0xb8]
push eax
mov ecx, esi
call fcn.00431840
mov ebx, dword [ebp - 0x600]
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xb8]
call fcn.004050f0
jmp 0x438f89
mov byte [ebp - 0x618], 1
mov esi, dword [ebp - 0x5fc]
mov ebx, dword [ebp - 0x600]
cmp byte [ebp - 0x5f1], 0
je 0x438fe3
mov eax, dword [ebp - 0x624]
push 1
push dword [eax + 0xd0]
lea ecx, [ebp - 0xac]
call fcn.0049bd60
mov byte [ebp - 4], 0x2c
mov ecx, esi
call fcn.00488e60
mov ecx, dword [ebp - 0x624]
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ecx + 0xc8]
call fcn.0043b770
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xac]
call fcn.0049bd90
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xec], 0xf
mov dword [ebp - 0xf0], 0
mov byte [ebp - 0x100], 0
mov byte [ebp - 4], 0x2e
cmp dword [ebp - 0xc0], 0
je 0x4390d2
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040a1f0
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0x88]
push str.Basic
push eax
call fcn.00407110
add esp, 0x18
mov byte [ebp - 4], 0x30
push eax
lea ecx, [ebp - 0x40]
call fcn.00405120
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x88]
call fcn.004050f0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x28]
call fcn.004050f0
push str.Proxy_Authorization:
lea ecx, [ebp - 0x100]
call fcn.0040a160
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x100]
call fcn.00405650
push 0x58228c
lea ecx, [ebp - 0x100]
call fcn.00405180
mov eax, dword [ebp - 0x5f0]
cmp eax, 2
je 0x4390e7
cmp eax, 4
je 0x4390e7
cmp eax, 7
jne 0x4390f6
call fcn.004a6ea0
test al, al
mov eax, dword [ebp - 0x5f0]
je 0x439173
cmp eax, 1
je 0x4391e6
cmp eax, 2
je 0x4391e6
cmp eax, 3
je 0x439112
cmp eax, 4
jne 0x43911a
test bl, bl
je 0x4391e6
test eax, eax
je 0x43912d
cmp eax, 3
je 0x43912d
cmp eax, 4
je 0x43912d
cmp eax, 7
jne 0x439173
test bl, bl
je 0x439173
mov eax, dword [ebp - 0x608]
mov ecx, dword [ebp - 0x60c]
mov dword [ecx], eax
mov ax, word [ebp - 0x604]
mov ecx, dword [ebp - 0x5f8]
mov word [ecx], ax
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.00431800
mov eax, dword [ebp - 0x5f0]
cmp eax, 4
je 0x43916a
cmp eax, 7
jne 0x439173
mov ecx, dword [ebp - 0x630]
mov byte [ecx], 1
mov edi, dword [ebp - 0x61c]
cmp eax, 5
je 0x43918c
cmp eax, 8
je 0x43918c
cmp eax, 6
jne 0x43961f
mov dword [ebp - 0x610], 0
call fcn.00421970
lea ecx, [eax + 4]
push esi
mov eax, dword [ecx]
push edi
lea edx, [ebp - 0x610]
push edx
call dword [eax + 0xc]
cmp dword [ebp - 0x5f0], 5
jne 0x43959a
push 0x88
call fcn.004ad19b
add esp, 4
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 0x3c
test eax, eax
je 0x4395c0
mov ecx, eax
call fcn.00498c60
mov edi, eax
jmp 0x4395c2
push 0xa
lea eax, [ebp - 0xac]
push eax
mov eax, dword [ebp - 0x5f8]
movzx eax, word [eax]
push eax
call fcn.0055d640
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
add esp, 0xc
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
mov byte [ebp - 4], 0x31
cmp dword [ebp - 0x108], 0
je 0x439251
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040a140
jmp 0x4392a4
cmp dword [ebp - 0x138], 0
je 0x43926e
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040a140
jmp 0x4392a4
mov eax, dword [ebp - 0x60c]
push dword [eax]
lea eax, [ebp - 0x88]
push eax
call fcn.00478fa0
add esp, 8
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0xa0]
call fcn.00405120
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x88]
call fcn.004050f0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
mov byte [ebp - 4], 0x33
mov bl, byte [ebp - 0x618]
test bl, bl
jne 0x43943e
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00405090
mov esi, eax
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x190]
push str.CONNECT
push eax
call fcn.0040ccc0
mov byte [ebp - 4], 0x35
push 0x581ac4
push eax
lea eax, [ebp - 0x28c]
push eax
call fcn.00407080
mov byte [ebp - 4], 0x36
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00406fc0
mov byte [ebp - 4], 0x37
push str._HTTP_1.1_r_n
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00407080
add esp, 0x30
mov byte [ebp - 4], 0x38
push eax
lea ecx, [ebp - 0x58]
call fcn.00405120
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x88]
call fcn.004050f0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x28]
call fcn.004050f0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x28c]
call fcn.004050f0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x190]
call fcn.004050f0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xe8]
call fcn.004050f0
push str.User_Agent:_Mozilla_5.0__compatible_MSIE_7.0_Windows_NT_6.0__r_n
lea ecx, [ebp - 0x58]
call fcn.00405180
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x190]
push str.Host:
push eax
call fcn.0040ccc0
mov byte [ebp - 4], 0x39
push 0x58228c
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00407080
add esp, 0x18
mov byte [ebp - 4], 0x3a
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x58]
call fcn.00405650
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xe8]
call fcn.004050f0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x190]
call fcn.004050f0
push str.Proxy_Connection:_Keep_Alive_r_n
lea ecx, [ebp - 0x58]
call fcn.00405180
cmp dword [ebp - 0xf0], 0
je 0x43942f
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x58]
call fcn.00405650
push 0x58228c
lea ecx, [ebp - 0x58]
call fcn.00405180
jmp 0x4394b0
mov eax, dword [ebp - 0x614]
mov byte [eax], 1
mov ebx, dword [edi + 4]
mov eax, dword [ebp - 0xf0]
sub ebx, dword [edi]
test eax, eax
je 0x439459
sub ebx, 2
xor esi, esi
test ebx, ebx
jle 0x439486
nop
mov eax, dword [edi]
lea ecx, [ebp - 0x58]
mov al, byte [esi + eax]
mov byte [ebp - 0x614], al
push dword [ebp - 0x614]
push 1
call fcn.0040c7b0
inc esi
cmp esi, ebx
jl 0x439460
mov eax, dword [ebp - 0xf0]
test eax, eax
je 0x4394aa
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x58]
call fcn.00405650
push 0x58228c
lea ecx, [ebp - 0x58]
call fcn.00405180
mov bl, byte [ebp - 0x618]
call fcn.00421970
mov ecx, dword [ebp - 0x5fc]
mov esi, eax
mov edi, dword [esi]
call fcn.00488e60
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xe8]
push eax
mov ecx, esi
call dword [edi + 0x20]
mov byte [ebp - 4], 0x3b
push eax
lea ecx, [ebp - 0x58]
call fcn.00405120
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xe8]
call fcn.004050f0
mov ecx, dword [ebp - 0x60c]
mov eax, dword [ebp - 0x608]
mov edi, dword [ebp - 0x61c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x5f8]
mov ax, word [ebp - 0x604]
xor esi, esi
mov word [ecx], ax
cmp dword [ebp - 0x48], esi
jbe 0x43953b
lea esp, [esp]
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
add eax, esi
push eax
mov ecx, edi
call fcn.00405b70
inc esi
cmp esi, dword [ebp - 0x48]
jb 0x439520
test bl, bl
jne 0x439548
mov eax, dword [ebp - 0x610]
mov byte [eax], 1
mov esi, dword [ebp - 0x5fc]
push dword [ebp - 0x618]
mov ecx, esi
call fcn.00431920
mov eax, dword [ebp - 0x5f0]
cmp eax, 2
je 0x43956b
cmp eax, 4
jne 0x439574
mov eax, dword [ebp - 0x630]
mov byte [eax], 1
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x58]
call fcn.004050f0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xa0]
call fcn.004050f0
mov eax, dword [ebp - 0x5f0]
jmp 0x439179
push 0x9c
call fcn.004ad19b
add esp, 4
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 0x3d
test eax, eax
je 0x4395c0
mov ecx, eax
call fcn.004999a0
mov edi, eax
jmp 0x4395c2
xor edi, edi
mov byte [ebp - 4], 0x2e
push dword [ebp - 0x604]
mov eax, dword [edi]
push dword [ebp - 0x608]
mov ecx, edi
call dword [eax + 0x34]
cmp dword [ebp - 0xc0], 0
je 0x4395f7
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
mov ecx, edi
call fcn.004986c0
call fcn.0040b8f0
push 0
mov byte [ebp - 0x614], al
push dword [ebp - 0x614]
lea eax, [ebp - 0x118]
push dword [ebp - 0x610]
mov ecx, esi
push eax
push edi
call fcn.0048c3e0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x100]
call fcn.004050f0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x40]
call fcn.004050f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x148]
call fcn.004050f0
jmp 0x43a78b
cmp dword [ebp - 0x150], 0
je 0x43968d
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x3e
mov ebx, 0x20
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.0040bdb0
add esp, 0xc
mov byte [ebp - 0x5ea], 1
test al, al
jne 0x439694
mov byte [ebp - 0x5ea], 0
mov dword [ebp - 4], 0x15
test bl, 0x20
je 0x4396b4
and ebx, 0xffffffdf
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5ea], 0
jne 0x43a78b
cmp byte [ebp - 0x5e1], 0
jne 0x43a604
call fcn.004453e0
mov ecx, eax
call fcn.0047a1d0
test eax, eax
je 0x43a78b
call fcn.004453e0
mov ecx, eax
call fcn.0047a1d0
mov ecx, eax
call fcn.00488c70
test al, al
je 0x43a78b
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xec], 0xf
mov dword [ebp - 0xf0], 0
mov byte [ebp - 0x100], 0
mov byte [ebp - 4], 0x3f
push 0x5876d8
lea ecx, [ebp - 0x28]
call fcn.00405090
mov byte [ebp - 4], 0x40
mov eax, dword [ebp - 0x60c]
push dword [eax]
lea eax, [ebp - 0xe8]
push eax
call fcn.00478fa0
add esp, 8
mov byte [ebp - 4], 0x41
push 0
lea ecx, [ebp - 0x100]
push ecx
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x5f8]
movzx ecx, word [ecx]
push ecx
push eax
call fcn.004aa510
mov ecx, eax
call fcn.004aa2d0
mov bl, al
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0xe8]
call fcn.004050f0
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x28]
call fcn.004050f0
test bl, bl
je 0x439842
cmp dword [ebp - 0xec], 0x10
lea eax, [ebp - 0x100]
cmovae eax, dword [ebp - 0x100]
push str..logmein.com
push eax
call fcn.0048eec0
add esp, 8
test eax, eax
jne 0x439806
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00462010
mov byte [ebp - 4], 0x42
mov ebx, dword [ebp - 0x5e8]
or ebx, 0x40
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.0040bfd0
add esp, 0xc
test al, al
jne 0x43980c
mov byte [ebp - 0x5e1], al
jmp 0x439813
mov ebx, dword [ebp - 0x5e8]
mov byte [ebp - 0x5e1], 1
mov dword [ebp - 4], 0x3f
test bl, 0x40
je 0x439833
and ebx, 0xffffffbf
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5e1], 0
jne 0x43a5cb
jmp 0x439848
mov ebx, dword [ebp - 0x5e8]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jne 0x439a59
mov edi, dword [ebp - 0x620]
cmp dword [edi], 0
je 0x439934
cmp dword [ebp - 0x5f0], 6
mov dword [edi], 0
jne 0x43a5f0
mov dword [ebp - 0x610], 0
call fcn.00421970
mov edi, dword [ebp - 0x61c]
lea ecx, [eax + 4]
push esi
mov eax, dword [ecx]
push edi
lea edx, [ebp - 0x610]
push edx
call dword [eax + 0xc]
push 0x9c
call fcn.004ad19b
add esp, 4
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 0x43
test eax, eax
je 0x4398c1
mov ecx, eax
call fcn.004999a0
mov edi, eax
jmp 0x4398c3
xor edi, edi
mov byte [ebp - 4], 0x3f
push dword [ebp - 0x604]
mov eax, dword [edi]
push dword [ebp - 0x608]
mov ecx, edi
call dword [eax + 0x34]
cmp dword [ebp - 0xc0], 0
je 0x4398f8
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
mov ecx, edi
call fcn.004986c0
call fcn.0040b8f0
push 0
mov byte [ebp - 0x614], al
push dword [ebp - 0x614]
lea eax, [ebp - 0x118]
push dword [ebp - 0x610]
mov ecx, esi
push eax
push edi
call fcn.0048c3e0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x100]
call fcn.004050f0
jmp 0x43a78b
mov eax, dword [ebp - 0x5f8]
movzx eax, word [eax]
push eax
call fcn.00431740
add esp, 4
test al, al
je 0x439a3d
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x44
push str.chrome.exe
or ebx, 0x80
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
test al, al
jne 0x4399c2
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0045edf0
mov dword [ebp - 4], 0x45
push str.iexplore.exe
or ebx, 0x100
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
mov byte [ebp - 0x5e1], 0
test al, al
je 0x4399c9
mov byte [ebp - 0x5e1], 1
mov dword [ebp - 4], 0x44
test ebx, 0x100
je 0x4399ef
and ebx, 0xfffffeff
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
mov dword [ebp - 4], 0x3f
test bl, bl
jns 0x439a11
and ebx, 0xffffff7f
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5e1], 0
mov eax, 0xbb8
mov ecx, 0x2710
cmovne eax, ecx
mov dword [edi], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x100]
call fcn.004050f0
mov bl, 1
jmp 0x43a954
mov dword [edi], 0x1f4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x100]
call fcn.004050f0
mov bl, 1
jmp 0x43a954
mov ecx, esi
call fcn.004313a0
test al, al
jne 0x439c1d
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
cmp eax, 0x11
jbe 0x439c1d
push 7
push str.connect
push ecx
call fcn.004b04d5
add esp, 0xc
test eax, eax
jne 0x439c1d
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
dec eax
add eax, ecx
push eax
push str.http_1.
push ecx
call fcn.0042f900
add esp, 0xc
test eax, eax
je 0x439c1d
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
dec eax
add eax, ecx
push eax
push str.:443
push ecx
call fcn.0042f900
add esp, 0xc
test eax, eax
jne 0x439b46
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
dec eax
add eax, ecx
push eax
push str.:465
push ecx
call fcn.0042f900
add esp, 0xc
test eax, eax
jne 0x439b46
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
dec eax
add eax, ecx
push eax
push str.:995
push ecx
call fcn.0042f900
add esp, 0xc
test eax, eax
jne 0x439b46
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
dec eax
add eax, ecx
push eax
push str.:993
push ecx
call fcn.0042f900
add esp, 0xc
test eax, eax
jne 0x439b46
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
dec eax
add eax, ecx
push eax
push str.:585
push ecx
call fcn.0042f900
add esp, 0xc
test eax, eax
je 0x439c1d
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 0x46
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov ebx, 7
sub eax, ecx
cmp eax, ebx
jbe 0x439b8b
lea ebx, [ebx]
cmp byte [ebx + ecx], 0x20
jne 0x439b8b
inc ebx
cmp eax, ebx
ja 0x439b80
cmp eax, ebx
jbe 0x439bbd
nop
mov al, byte [ebx + ecx]
cmp al, 0x3a
je 0x439bbd
cmp al, 0x20
je 0x439bbd
mov byte [ebp - 0x614], al
push dword [ebp - 0x614]
lea ecx, [ebp - 0x40]
push 1
call fcn.0040c7b0
mov ecx, dword [edi]
mov eax, dword [edi + 4]
inc ebx
sub eax, ecx
cmp eax, ebx
ja 0x439b90
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00462010
mov byte [ebp - 4], 0x47
push eax
call fcn.0040bfd0
add esp, 0xc
mov bl, al
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0xe8]
call fcn.00403930
test bl, bl
je 0x439bfb
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x40]
jmp 0x43a5c6
push 1
mov ecx, esi
call fcn.004317a0
mov eax, dword [edi + 4]
sub eax, dword [edi]
mov ecx, esi
push eax
call fcn.00431790
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x40]
call fcn.004050f0
mov ecx, esi
call fcn.004313a0
test al, al
jne 0x439d5b
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
cmp eax, 4
jbe 0x439c4a
push eax
push ecx
call fcn.004316e0
add esp, 8
test al, al
jne 0x439d5b
cmp dword [ebp - 0x5f0], 6
jne 0x439d16
mov dword [ebp - 0x610], 0
call fcn.00421970
mov edi, dword [ebp - 0x61c]
lea ecx, [eax + 4]
push esi
mov eax, dword [ecx]
push edi
lea edx, [ebp - 0x610]
push edx
call dword [eax + 0xc]
push 0x9c
call fcn.004ad19b
add esp, 4
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 0x67
test eax, eax
je 0x439ca3
mov ecx, eax
call fcn.004999a0
mov edi, eax
jmp 0x439ca5
xor edi, edi
mov byte [ebp - 4], 0x3f
push dword [ebp - 0x604]
mov eax, dword [edi]
push dword [ebp - 0x608]
mov ecx, edi
call dword [eax + 0x34]
cmp dword [ebp - 0xc0], 0
je 0x439cda
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
mov ecx, edi
call fcn.004986c0
call fcn.0040b8f0
push 0
mov byte [ebp - 0x614], al
push dword [ebp - 0x614]
lea eax, [ebp - 0x118]
push dword [ebp - 0x610]
mov ecx, esi
push eax
push edi
call fcn.0048c3e0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x100]
call fcn.004050f0
jmp 0x43a78b
mov ecx, esi
call fcn.004313a0
test al, al
jne 0x43a5f0
mov eax, dword [ebp - 0x5f8]
movzx edi, word [eax]
push edi
call fcn.00431740
add esp, 4
test al, al
je 0x43a5f0
push edi
mov ecx, esi
call fcn.00431900
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x100]
call fcn.004050f0
jmp 0x43a78b
lea ecx, [ebp - 0x148]
call fcn.004071b0
mov byte [ebp - 4], 0x48
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0xe8]
push eax
call fcn.00437440
add esp, 0xc
mov byte [ebp - 4], 0x49
push eax
lea ecx, [ebp - 0x148]
call fcn.00405120
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xe8]
call fcn.004050f0
cmp dword [ebp - 0x138], 0
je 0x439de9
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00462010
mov byte [ebp - 4], 0x4a
mov ebx, dword [ebp - 0x5e8]
or ebx, 0x200
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.0040bfd0
add esp, 0xc
test al, al
je 0x439def
mov byte [ebp - 0x5e1], 0
jmp 0x439df6
mov ebx, dword [ebp - 0x5e8]
mov byte [ebp - 0x5e1], 1
mov dword [ebp - 4], 0x48
test ebx, 0x200
je 0x439e1c
and ebx, 0xfffffdff
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5e1], 0
je 0x43a5e1
cmp dword [ebp - 0x138], 0
je 0x439e40
lea eax, [ebp - 0x148]
push eax
mov ecx, esi
call fcn.0048c500
push 0
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.00488fb0
mov byte [ebp - 4], 0x4b
push 1
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
call fcn.00488fb0
mov byte [ebp - 4], 0x4c
push eax
lea ecx, [ebp - 0x4c]
call fcn.00424980
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0xac]
call fcn.00482920
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
sub eax, ecx
je 0x439eb4
mov esi, dword [ebp - 0x61c]
xor edi, edi
nop
lea eax, [edi + ecx]
push eax
mov ecx, esi
call fcn.00405b70
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
inc edi
sub eax, ecx
cmp edi, eax
jb 0x439e90
mov edi, dword [ebp - 0x618]
mov esi, dword [ebp - 0x5fc]
mov ecx, esi
call fcn.004313a0
test al, al
je 0x439f36
lea ecx, [ebp - 0x28]
call fcn.004071b0
mov byte [ebp - 4], 0x4d
mov eax, dword [edi]
xor esi, esi
cmp byte [eax], 0x20
je 0x439edb
inc esi
cmp byte [esi + eax], 0x20
jne 0x439ed4
cmp byte [esi + eax], 0x20
jne 0x439ee8
inc esi
cmp byte [esi + eax], 0x20
je 0x439ee1
mov al, byte [esi + eax]
cmp al, 0x3a
je 0x439f14
nop
cmp al, 0x20
je 0x439f14
mov byte [ebp - 0x614], al
push dword [ebp - 0x614]
lea ecx, [ebp - 0x28]
push 1
call fcn.0040c7b0
mov eax, dword [edi]
inc esi
mov al, byte [esi + eax]
cmp al, 0x3a
jne 0x439ef0
mov esi, dword [ebp - 0x5fc]
push 0x1bb
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.0048c450
mov ecx, esi
call fcn.0048df90
jmp 0x43a2a6
cmp byte [ebp - 0x5e9], 0
je 0x43a2b2
mov eax, dword [ebp - 0x5f0]
cmp eax, 1
je 0x439f61
cmp eax, 2
je 0x439f61
cmp eax, 3
je 0x439f61
cmp eax, 4
jne 0x43a2b2
push 0xa
lea eax, [ebp - 0xac]
push eax
mov eax, dword [ebp - 0x5f8]
movzx eax, word [eax]
push eax
call fcn.0055d640
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004071b0
mov byte [ebp - 4], 0x4e
cmp dword [ebp - 0x108], 0
je 0x439fa2
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a140
jmp 0x439fd5
mov eax, dword [ebp - 0x60c]
push dword [eax]
lea eax, [ebp - 0xe8]
push eax
call fcn.00478fa0
add esp, 8
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0x28]
call fcn.00405120
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xe8]
call fcn.004050f0
cmp dword [ebp - 0x138], 0
je 0x439fed
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a140
lea ecx, [ebp - 0xa0]
call fcn.004071b0
mov byte [ebp - 4], 0x50
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00405090
mov esi, eax
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push str.CONNECT
push eax
call fcn.0040ccc0
mov byte [ebp - 4], 0x52
push 0x581ac4
push eax
lea eax, [ebp - 0x28c]
push eax
call fcn.00407080
mov byte [ebp - 4], 0x53
push esi
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00406fc0
mov byte [ebp - 4], 0x54
push str._HTTP_1.1_r_n
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00407080
add esp, 0x30
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0xa0]
call fcn.00405120
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0xe8]
call fcn.004050f0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x190]
call fcn.004050f0
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x28c]
call fcn.004050f0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x88]
call fcn.004050f0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x1a8]
call fcn.004050f0
push str.User_Agent:_Mozilla_5.0__compatible_MSIE_7.0_Windows_NT_6.0__r_n
lea ecx, [ebp - 0xa0]
call fcn.00405180
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x178]
push str.Host:
push eax
call fcn.0040ccc0
mov byte [ebp - 4], 0x56
push 0x58228c
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00407080
add esp, 0x18
mov byte [ebp - 4], 0x57
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0xa0]
call fcn.00405650
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x1a8]
call fcn.004050f0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x178]
call fcn.004050f0
push str.Proxy_Connection:_Keep_Alive_r_n
lea ecx, [ebp - 0xa0]
call fcn.00405180
lea ecx, [ebp - 0x40]
call fcn.004071b0
mov byte [ebp - 4], 0x58
cmp dword [ebp - 0xc0], 0
je 0x43a1d8
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.0040a1f0
mov byte [ebp - 4], 0x59
push eax
lea eax, [ebp - 0x88]
push str.Basic
push eax
call fcn.00407110
add esp, 0x18
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x178]
call fcn.004050f0
push str.Proxy_Authorization:
lea ecx, [ebp - 0x40]
call fcn.0040a160
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x40]
call fcn.00405650
push 0x58228c
lea ecx, [ebp - 0x40]
call fcn.00405180
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x88]
call fcn.004050f0
cmp dword [ebp - 0x30], 0
je 0x43a1f1
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00405650
push 0x58228c
lea ecx, [ebp - 0xa0]
call fcn.00405180
call fcn.00421970
mov ecx, dword [ebp - 0x5fc]
mov esi, eax
mov edi, dword [esi]
call fcn.00488e60
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x178]
push eax
mov ecx, esi
call dword [edi + 0x20]
mov byte [ebp - 4], 0x5c
push eax
lea ecx, [ebp - 0xa0]
call fcn.00405120
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x178]
call fcn.004050f0
push dword [ebp - 0x608]
lea eax, [ebp - 0x1a8]
push eax
call fcn.00478fa0
add esp, 8
mov byte [ebp - 4], 0x5d
push dword [ebp - 0x604]
mov esi, dword [ebp - 0x5fc]
push eax
lea eax, [ebp - 0xa0]
push eax
mov ecx, esi
call fcn.0048c490
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x1a8]
call fcn.004050f0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x40]
call fcn.004050f0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xa0]
call fcn.004050f0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x28]
call fcn.004050f0
mov ecx, esi
call fcn.00488c30
mov ecx, esi
call fcn.0048c2b0
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp - 0x60c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5f8]
mov ecx, dword [ebp - 0x634]
mov word [eax], cx
lea ecx, [ebp - 0x274]
call fcn.0040f2f0
mov byte [ebp - 4], 0x5e
push dword [ebp - 0x628]
lea eax, [ebp - 0x5e0]
push eax
call fcn.004594b0
mov ecx, eax
call fcn.004594c0
mov byte [ebp - 4], 0x5f
push eax
lea ecx, [ebp - 0x274]
call fcn.0040f980
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x5e0]
call fcn.0040f730
cmp dword [ebp - 0x25c], 0
je 0x43a558
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x60
push str.iexplore.exe
or ebx, 0x400
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
test al, al
jne 0x43a41e
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0045edf0
mov dword [ebp - 4], 0x61
push str.chrome.exe
or ebx, 0x800
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
test al, al
jne 0x43a41e
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.0045edf0
mov dword [ebp - 4], 0x62
push str.safari.exe
or ebx, 0x1000
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
test al, al
jne 0x43a41e
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.0045edf0
mov dword [ebp - 4], 0x63
push str.webkit2webprocess.exe
or ebx, 0x2000
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00409df0
add esp, 0x10
mov byte [ebp - 0x5e1], 0
test al, al
je 0x43a425
mov byte [ebp - 0x5e1], 1
mov dword [ebp - 4], 0x62
test ebx, 0x2000
je 0x43a44b
and ebx, 0xffffdfff
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
mov dword [ebp - 4], 0x61
test ebx, 0x1000
je 0x43a471
and ebx, 0xffffefff
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
mov dword [ebp - 4], 0x60
test ebx, 0x800
je 0x43a497
and ebx, 0xfffff7ff
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
mov dword [ebp - 4], 0x5e
test ebx, 0x400
je 0x43a4bd
and ebx, 0xfffffbff
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x5e8], ebx
call fcn.00403930
cmp byte [ebp - 0x5e1], 0
je 0x43a4cd
xor eax, eax
jmp 0x43a550
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x64
push 0x583128
push eax
call fcn.00409df0
add esp, 0x10
mov bl, al
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x178]
call fcn.00403930
test bl, bl
je 0x43a50e
mov eax, 1
jmp 0x43a550
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.0045edf0
mov byte [ebp - 4], 0x65
push 0x583140
push eax
call fcn.00409df0
add esp, 0x10
mov bl, al
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x178]
call fcn.00403930
xor eax, eax
mov ecx, 2
test bl, bl
cmovne eax, ecx
push eax
mov ecx, esi
call fcn.0048bf20
push str.ssluploadlimit
lea ecx, [ebp - 0x88]
call fcn.004038b0
mov byte [ebp - 4], 0x66
lea eax, [ebp - 0x88]
push eax
call fcn.0040af50
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x88]
call fcn.00403930
test edi, edi
je 0x43a5a1
push edi
mov ecx, esi
call fcn.0048c430
push 0
mov ecx, esi
call fcn.0048bf30
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x274]
call fcn.0040f730
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x4c]
call fcn.00482920
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x148]
call fcn.004050f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x100]
call fcn.004050f0
mov bl, 1
jmp 0x43a954
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x148]
call fcn.004050f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x100]
call fcn.004050f0
jmp 0x43a78b
cmp dword [ebp - 0x5f0], 6
jne 0x43a6c3
mov dword [ebp - 0x610], 0
call fcn.00421970
mov edi, dword [ebp - 0x61c]
lea ecx, [eax + 4]
push esi
mov eax, dword [ecx]
push edi
lea edx, [ebp - 0x610]
push edx
call dword [eax + 0xc]
push 0x9c
call fcn.004ad19b
add esp, 4
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 0x68
test eax, eax
je 0x43a65d
mov ecx, eax
call fcn.004999a0
mov edi, eax
jmp 0x43a65f
xor edi, edi
mov byte [ebp - 4], 0x15
push dword [ebp - 0x604]
mov eax, dword [edi]
push dword [ebp - 0x608]
mov ecx, edi
call dword [eax + 0x34]
cmp dword [ebp - 0xc0], 0
je 0x43a694
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xd0]
push eax
mov ecx, edi
call fcn.004986c0
call fcn.0040b8f0
push 1
mov byte [ebp - 0x634], al
push dword [ebp - 0x634]
lea eax, [ebp - 0x118]
push dword [ebp - 0x610]
mov ecx, esi
push eax
push edi
call fcn.0048c3e0
mov ecx, edi
call fcn.00499ea0
mov ecx, esi
call fcn.0048a170
test al, al
je 0x43a782
lea ecx, [ebp - 0x28]
call fcn.004071b0
mov byte [ebp - 4], 0x69
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov dword [ebp - 0x618], 0
mov dword [ebp - 0x624], 0
call fcn.00489160
cmp dword [ebp - 0x18], 0
je 0x43a776
cmp dword [ebp - 0x618], 0
je 0x43a776
cmp word [ebp - 0x624], 0
je 0x43a776
mov edi, dword [ebp - 0x60c]
lea eax, [ebp - 0x178]
push dword [edi]
push eax
call fcn.00478fa0
add esp, 8
mov byte [ebp - 4], 0x6a
mov ebx, dword [ebp - 0x5f8]
movzx ecx, word [ebx]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.0048c490
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x178]
call fcn.004050f0
mov eax, dword [ebp - 0x618]
mov dword [edi], eax
mov ax, word [ebp - 0x624]
mov word [ebx], ax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x28]
call fcn.004050f0
mov eax, dword [ebp - 0x630]
mov byte [eax], 1
lea ecx, [ebp - 0x374]
call fcn.00428ab0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3e4]
call fcn.00428ab0
mov byte [ebp - 4], 0x6c
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1ac], 0xf
mov dword [ebp - 0x1b0], 0
mov byte [ebp - 0x1c0], 0
mov byte [ebp - 4], 0x6d
push 0
push dword [ebp - 0x628]
lea eax, [ebp - 0x1a8]
push eax
call fcn.004594b0
mov ecx, eax
call fcn.00459590
mov byte [ebp - 4], 0x6e
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.00461ee0
add esp, 8
mov byte [ebp - 4], 0x6f
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00405120
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x178]
call fcn.004050f0
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x1a8]
call fcn.00403930
push dword [ebp - 0x644]
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x3e4]
push eax
sub esp, 0x18
lea eax, [ebp - 0x1c0]
mov ecx, esp
mov dword [ebp - 0x644], esp
push eax
mov byte [ebp - 0x640], 0
call fcn.00405060
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x6d
call fcn.0040a7e0
add esp, 0x28
test al, al
je 0x43a8a1
push dword [ebp - 0x640]
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x3e4]
push eax
mov ecx, esi
call fcn.004317b0
push str.nocontent
lea ecx, [ebp - 0x88]
call fcn.004038b0
mov byte [ebp - 4], 0x71
lea eax, [ebp - 0x88]
push eax
call fcn.0040af50
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x88]
call fcn.00403930
mov ebx, dword [ebp - 0x5fc]
test esi, esi
je 0x43a8e6
mov ecx, ebx
call fcn.00431860
push str.nonagle
lea ecx, [ebp - 0x88]
call fcn.004038b0
mov byte [ebp - 4], 0x72
lea eax, [ebp - 0x88]
push eax
call fcn.0040af50
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x88]
call fcn.00403930
test esi, esi
je 0x43a925
mov ecx, ebx
call fcn.0048c270
mov bl, 1
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x1c0]
call fcn.004050f0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3e4]
call fcn.00428cc0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x374]
call fcn.00428cc0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x130]
call fcn.004050f0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xd0]
call fcn.004050f0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x45c]
call fcn.0040f730
mov byte [ebp - 4], 6
cmp dword [ebp - 0x5c], 0x10
jb 0x43a996
push dword [ebp - 0x70]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14c], 8
jb 0x43a9c3
push dword [ebp - 0x160]
call fcn.004ad196
add esp, 4
xor eax, eax
mov dword [ebp - 0x14c], 7
mov dword [ebp - 0x150], 0
mov word [ebp - 0x160], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x104], 0x10
jb 0x43a9fb
push dword [ebp - 0x118]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x104], 0xf
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x118], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x304]
call fcn.0040f730
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret 0x38