Function at 0x40ec00
Capabilities:
Contain obfuscated stackstrings
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e54ad
mov eax, dword fs:[0]
push eax
sub esp, 0x378
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
push edi
push 0x66
mov ecx, ebx
mov dword [ebp - 0x380], ebx
call fcn.00462334
mov dword [ebp - 4], edi
mov dword [ebx], vtable.CLinLauncherDlg.0
mov esi, vtable.CBitmap.0
mov dword [ebx + 0x8c], edi
mov dword [ebx + 0x88], esi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x90], esi
mov dword [ebx + 0x9c], edi
mov dword [ebx + 0x98], esi
mov dword [ebx + 0xa4], edi
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xac], edi
mov dword [ebx + 0xa8], esi
mov dword [ebx + 0xb4], edi
mov dword [ebx + 0xb0], esi
mov dword [ebx + 0xbc], edi
mov dword [ebx + 0xb8], esi
mov dword [ebx + 0xc4], edi
mov dword [ebx + 0xc0], esi
mov dword [ebx + 0xcc], edi
mov dword [ebx + 0xc8], esi
push 0x446760
push 0x446980
push 8
push 8
lea eax, [ebx + 0xd0]
push eax
mov byte [ebp - 4], 9
call fcn.0047074d
mov dword [ebx + 0x114], edi
mov dword [ebx + 0x110], esi
mov dword [ebx + 0x11c], edi
mov dword [ebx + 0x118], esi
mov dword [ebx + 0x124], edi
mov dword [ebx + 0x120], esi
mov dword [ebx + 0x12c], edi
mov dword [ebx + 0x128], esi
mov dword [ebx + 0x134], edi
mov dword [ebx + 0x130], esi
mov dword [ebx + 0x13c], edi
mov dword [ebx + 0x138], esi
mov dword [ebx + 0x144], edi
mov dword [ebx + 0x140], esi
mov dword [ebx + 0x14c], edi
mov dword [ebx + 0x148], esi
mov dword [ebx + 0x154], edi
mov dword [ebx + 0x150], esi
mov dword [ebx + 0x15c], edi
mov dword [ebx + 0x158], esi
mov dword [ebx + 0x164], edi
mov dword [ebx + 0x160], esi
mov dword [ebx + 0x180], edi
mov dword [ebx + method.CFont.virtual_0], vtable.CFont.0
lea esi, [ebx + 0x19c]
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.0045b20c
mov dword [esi], vtable.CUpdateEdit.0
lea esi, [ebx + 0x1f0]
mov ecx, esi
mov byte [ebp - 4], 0x17
call fcn.0045b20c
mov dword [esi], vtable.CExplorer1.0
mov byte [ebp - 4], 0x18
call fcn.0045782b
call fcn.0045782b
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebx + 0x74], eax
call fcn.0043fc80
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0x28]
push edx
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x2e
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0xb4], 0x49
mov byte [ebp - 0xb3], 0x6e
mov byte [ebp - 0xb2], 0x74
mov byte [ebp - 0xb1], 0x65
mov byte [ebp - 0xb0], 0x72
mov byte [ebp - 0xaf], 0x6e
mov byte [ebp - 0xae], 0x65
mov byte [ebp - 0xad], 0x74
mov byte [ebp - 0xac], 0x4f
mov byte [ebp - 0xab], 0x70
mov byte [ebp - 0xaa], 0x65
mov byte [ebp - 0xa9], 0x6e
mov byte [ebp - 0xa8], 0x57
mov byte [ebp - 0xa7], 0
call fcn.00486440
mov dword [0x529d90], eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov byte [ebp - 0x68], 0x49
mov byte [ebp - 0x67], 0x6e
mov byte [ebp - 0x66], 0x74
mov byte [ebp - 0x65], 0x65
mov byte [ebp - 0x64], 0x72
mov byte [ebp - 0x63], 0x6e
mov byte [ebp - 0x62], 0x65
mov byte [ebp - 0x61], 0x74
mov byte [ebp - 0x60], 0x4f
mov byte [ebp - 0x5f], 0x70
mov byte [ebp - 0x5e], 0x65
mov byte [ebp - 0x5d], 0x6e
mov byte [ebp - 0x5c], 0x55
mov byte [ebp - 0x5b], 0x72
mov byte [ebp - 0x5a], 0x6c
mov byte [ebp - 0x59], 0x57
mov byte [ebp - 0x58], 0
call fcn.00486440
lea edx, [ebp - 0x68]
mov dword [0x529d94], eax
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00486440
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x28]
push edx
mov dword [0x529d98], eax
mov byte [ebp - 0x7c], 0x49
mov byte [ebp - 0x7b], 0x6e
mov byte [ebp - 0x7a], 0x74
mov byte [ebp - 0x79], 0x65
mov byte [ebp - 0x78], 0x72
mov byte [ebp - 0x77], 0x6e
mov byte [ebp - 0x76], 0x65
mov byte [ebp - 0x75], 0x74
mov byte [ebp - 0x74], 0x4f
mov byte [ebp - 0x73], 0x70
mov byte [ebp - 0x72], 0x65
mov byte [ebp - 0x71], 0x6e
mov byte [ebp - 0x70], 0x55
mov byte [ebp - 0x6f], 0x72
mov byte [ebp - 0x6e], 0x6c
mov byte [ebp - 0x6d], 0x41
mov byte [ebp - 0x6c], 0
call fcn.00486440
mov dword [0x529dac], eax
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.00486440
lea edx, [ebp - 0xc4]
mov dword [0x529db0], eax
push edx
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0xc4], 0x48
mov byte [ebp - 0xc3], 0x74
mov byte [ebp - 0xc2], 0x74
mov byte [ebp - 0xc1], 0x70
mov byte [ebp - 0xc0], 0x51
mov byte [ebp - 0xbf], 0x75
mov byte [ebp - 0xbe], 0x65
mov byte [ebp - 0xbd], 0x72
mov byte [ebp - 0xbc], 0x79
mov byte [ebp - 0xbb], 0x49
mov byte [ebp - 0xba], 0x6e
mov byte [ebp - 0xb9], 0x66
mov byte [ebp - 0xb8], 0x6f
mov byte [ebp - 0xb7], 0x57
mov byte [ebp - 0xb6], 0
call fcn.00486440
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x28]
push edx
mov dword [0x529d9c], eax
mov byte [ebp - 0x10c], 0x49
mov byte [ebp - 0x10b], 0x6e
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x72
mov byte [ebp - 0x107], 0x6e
mov byte [ebp - 0x106], 0x65
mov byte [ebp - 0x105], 0x74
mov byte [ebp - 0x104], 0x43
mov byte [ebp - 0x103], 0x6c
mov byte [ebp - 0x102], 0x6f
mov byte [ebp - 0x101], 0x73
mov byte [ebp - 0x100], 0x65
mov byte [ebp - 0xff], 0x48
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x6e
mov byte [ebp - 0xfc], 0x64
mov byte [ebp - 0xfb], 0x6c
mov byte [ebp - 0xfa], 0x65
mov byte [ebp - 0xf9], 0
call fcn.00486440
mov dword [0x529da0], eax
mov byte [ebp - 0xf8], 0x49
mov byte [ebp - 0xf7], 0x6e
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov byte [ebp - 0xf6], 0x74
mov byte [ebp - 0xf5], 0x65
mov byte [ebp - 0xf4], 0x72
mov byte [ebp - 0xf3], 0x6e
mov byte [ebp - 0xf2], 0x65
mov byte [ebp - 0xf1], 0x74
mov byte [ebp - 0xf0], 0x52
mov byte [ebp - 0xef], 0x65
mov byte [ebp - 0xee], 0x61
mov byte [ebp - 0xed], 0x64
mov byte [ebp - 0xec], 0x46
mov byte [ebp - 0xeb], 0x69
mov byte [ebp - 0xea], 0x6c
mov byte [ebp - 0xe9], 0x65
mov byte [ebp - 0xe8], 0
call fcn.00486440
lea edx, [ebp - 0xa4]
mov dword [0x529da4], eax
push edx
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0xa4], 0x49
mov byte [ebp - 0xa3], 0x6e
mov byte [ebp - 0xa2], 0x74
mov byte [ebp - 0xa1], 0x65
mov byte [ebp - 0xa0], 0x72
mov byte [ebp - 0x9f], 0x6e
mov byte [ebp - 0x9e], 0x65
mov byte [ebp - 0x9d], 0x74
mov byte [ebp - 0x9c], 0x43
mov byte [ebp - 0x9b], 0x6f
mov byte [ebp - 0x9a], 0x6e
mov byte [ebp - 0x99], 0x6e
mov byte [ebp - 0x98], 0x65
mov byte [ebp - 0x97], 0x63
mov byte [ebp - 0x96], 0x74
mov byte [ebp - 0x95], 0x57
mov byte [ebp - 0x94], 0
call fcn.00486440
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x28]
push edx
mov dword [0x529db4], eax
call fcn.00486440
mov dword [0x529db8], eax
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov byte [ebp - 0x90], 0x49
mov byte [ebp - 0x8f], 0x6e
mov byte [ebp - 0x8e], 0x74
mov byte [ebp - 0x8d], 0x65
mov byte [ebp - 0x8c], 0x72
mov byte [ebp - 0x8b], 0x6e
mov byte [ebp - 0x8a], 0x65
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0x43
mov byte [ebp - 0x87], 0x6f
mov byte [ebp - 0x86], 0x6e
mov byte [ebp - 0x85], 0x6e
mov byte [ebp - 0x84], 0x65
mov byte [ebp - 0x83], 0x63
mov byte [ebp - 0x82], 0x74
mov byte [ebp - 0x81], 0x41
mov byte [ebp - 0x80], 0
call fcn.00486440
lea edx, [ebp - 0x90]
mov dword [0x529dbc], eax
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00486440
mov dword [0x529dc0], eax
mov al, 0x8b
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x19], al
mov ecx, 0x59
mov word [ebp - 0x1e4], cx
mov eax, 0x75
mov word [ebp - 0x1e0], ax
mov edx, 0x6f
mov word [ebp - 0x1e2], dx
mov ecx, 0x72
mov word [ebp - 0x1de], cx
mov edx, 0x20
mov word [ebp - 0x1dc], dx
mov word [ebp - 0x1d6], dx
mov eax, 0x50
mov word [ebp - 0x1da], ax
mov ecx, 0x43
mov word [ebp - 0x1d8], cx
mov eax, 0x6d
mov word [ebp - 0x1d4], ax
mov edx, 0x79
mov word [ebp - 0x1d0], dx
mov ecx, 0x61
mov word [ebp - 0x1d2], cx
mov eax, 0x20
mov word [ebp - 0x1ce], ax
mov edx, 0x61
mov word [ebp - 0x1ca], dx
mov ecx, 0x68
mov word [ebp - 0x1cc], cx
mov eax, 0x76
mov word [ebp - 0x1c8], ax
mov ecx, 0x65
mov edx, 0x20
mov word [ebp - 0x1c4], dx
mov edx, ecx
mov word [ebp - 0x1c6], cx
mov word [ebp - 0x1c0], cx
mov word [ebp - 0x1be], dx
mov eax, 0x62
mov word [ebp - 0x1c2], ax
mov eax, 0x6e
mov word [ebp - 0x1bc], ax
mov word [ebp - 0x1b6], ax
mov ecx, 0x20
mov word [ebp - 0x1ba], cx
mov edx, 0x69
mov word [ebp - 0x1b8], dx
mov edx, 0x65
mov eax, 0x63
mov word [ebp - 0x1b0], ax
mov ecx, 0x66
mov word [ebp - 0x1b4], cx
mov word [ebp - 0x1b2], dx
mov word [ebp - 0x1ac], dx
mov eax, 0x64
mov ecx, 0x74
mov word [ebp - 0x1aa], ax
mov edx, 0x62
mov word [ebp - 0x1ae], cx
mov ecx, 0x20
mov word [ebp - 0x1a6], dx
mov eax, 0x79
mov edx, 0x61
mov word [ebp - 0x1a4], ax
mov eax, ecx
mov word [ebp - 0x1a8], cx
mov word [ebp - 0x1a2], cx
mov word [ebp - 0x1a0], dx
mov ecx, 0x76
mov edx, 0x69
mov word [ebp - 0x19e], ax
mov word [ebp - 0x19c], cx
mov word [ebp - 0x19a], dx
mov eax, 0x72
mov ecx, 0x75
mov edx, 0x73
mov byte [ebp - 0x1b], 0xff
mov byte [ebp - 0x1a], 0x55
mov byte [ebp - 0x18], 0xec
mov word [ebp - 0x198], ax
mov word [ebp - 0x196], cx
mov word [ebp - 0x194], dx
mov edx, 0xa
mov word [ebp - 0x18e], dx
mov eax, 0x2e
mov word [ebp - 0x192], ax
mov ecx, 0xd
mov word [ebp - 0x190], cx
mov edx, 0x75
mov word [ebp - 0x188], dx
mov eax, 0x43
mov word [ebp - 0x18c], ax
mov ecx, 0x61
mov word [ebp - 0x18a], cx
mov edx, 0x64
mov word [ebp - 0x182], dx
mov eax, 0x73
mov word [ebp - 0x186], ax
mov ecx, 0x65
mov word [ebp - 0x184], cx
mov edx, 0x6e
mov word [ebp - 0x17c], dx
mov eax, 0x20
mov word [ebp - 0x180], ax
mov word [ebp - 0x17a], ax
mov ecx, 0x61
mov word [ebp - 0x17e], cx
mov edx, 0x63
mov eax, edx
mov word [ebp - 0x176], dx
mov word [ebp - 0x174], ax
mov ecx, 0x41
mov word [ebp - 0x178], cx
mov edx, 0x73
mov eax, edx
mov word [ebp - 0x170], dx
mov word [ebp - 0x16e], ax
mov ecx, 0x65
mov word [ebp - 0x172], cx
mov ecx, 0x20
mov word [ebp - 0x16c], cx
mov edx, 0x56
mov word [ebp - 0x16a], dx
mov eax, 0x69
mov word [ebp - 0x168], ax
mov ecx, 0x6f
mov word [ebp - 0x166], cx
mov edx, 0x6c
mov word [ebp - 0x164], dx
mov eax, 0x61
mov word [ebp - 0x162], ax
mov ecx, 0x74
mov word [ebp - 0x160], cx
mov edx, 0x69
mov word [ebp - 0x15e], dx
mov eax, 0x6f
mov word [ebp - 0x15c], ax
mov ecx, 0x6e
mov edx, 0x20
mov eax, 0x69
mov word [ebp - 0x15a], cx
mov word [ebp - 0x158], dx
mov word [ebp - 0x156], ax
mov word [ebp - 0x154], cx
mov word [ebp - 0x152], dx
mov eax, 0x6d
mov ecx, 0x6f
mov edx, 0x64
mov word [ebp - 0x150], ax
mov word [ebp - 0x14e], cx
mov word [ebp - 0x14c], dx
mov eax, 0x75
mov ecx, 0x6c
mov edx, 0x65
mov word [ebp - 0x14a], ax
mov word [ebp - 0x148], cx
mov word [ebp - 0x146], dx
mov eax, 0x20
mov ecx, 0x61
mov edx, 0x74
mov word [ebp - 0x144], ax
mov word [ebp - 0x142], cx
mov word [ebp - 0x140], dx
mov word [ebp - 0x13e], ax
mov ecx, 0x30
mov edx, ecx
mov word [ebp - 0x13c], cx
mov word [ebp - 0x13a], dx
mov eax, 0x32
mov word [ebp - 0x138], ax
mov ecx, 0x33
mov word [ebp - 0x136], cx
mov edx, 0x3a
mov word [ebp - 0x134], dx
mov eax, 0x25
mov word [ebp - 0x132], ax
mov ecx, 0x30
mov word [ebp - 0x130], cx
mov edx, 0x38
mov word [ebp - 0x12e], dx
xor edx, edx
mov eax, 0x58
mov word [ebp - 0x12c], ax
mov ecx, 0x2e
mov word [ebp - 0x12a], cx
mov word [ebp - 0x128], dx
mov ecx, 0x69
mov eax, 0x57
mov edx, 0x6e
mov word [ebp - 0x124], ax
mov word [ebp - 0x122], cx
mov word [ebp - 0x120], dx
mov word [ebp - 0x11c], cx
mov eax, 0x4c
mov edx, 0x63
mov ecx, 0x6e
mov word [ebp - 0x11e], ax
mov word [ebp - 0x11a], dx
mov eax, 0x65
mov word [ebp - 0x116], cx
mov edx, 0x73
xor ecx, ecx
mov word [ebp - 0x118], ax
mov word [ebp - 0x114], dx
mov word [ebp - 0x112], ax
mov word [ebp - 0x110], cx
call fcn.004030c0
mov eax, dword [0x529d90]
mov ecx, dword [ebp - 0x1c]
cmp dword [eax], ecx
jne 0x41012f
add eax, 4
cmp byte [eax], 0xec
jne 0x41012f
mov eax, dword [0x529d94]
cmp dword [eax], ecx
jne 0x410100
add eax, 4
cmp byte [eax], 0xec
jne 0x410100
mov edx, dword [0x529dac]
mov eax, edx
cmp dword [eax], ecx
jne 0x40f731
add eax, 4
cmp byte [eax], 0xec
je 0x40f74e
cmp byte [edx], 0x6a
jne 0x4100cd
cmp byte [edx + 1], 0x24
jne 0x4100cd
cmp byte [edx + 2], 0x68
jne 0x4100cd
mov eax, dword [0x529d9c]
cmp dword [eax], ecx
jne 0x4100af
add eax, 4
cmp byte [eax], 0xec
jne 0x4100af
mov eax, dword [0x529da4]
cmp dword [eax], ecx
jne 0x410079
add eax, 4
cmp byte [eax], 0xec
jne 0x410079
mov eax, dword [0x529db4]
cmp dword [eax], ecx
jne 0x410043
add eax, 4
cmp byte [eax], 0xec
jne 0x410043
mov eax, dword [0x529dbc]
cmp dword [eax], ecx
jne 0x410022
add eax, 4
cmp byte [eax], 0xec
jne 0x410022
call fcn.00486d90
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004875c0
push 0x40df70
push 0x529d98
call fcn.00487680
push 0x40e520
push 0x529dac
call fcn.00487680
push 0x40e8b0
push 0x529db4
call fcn.00487680
push 0x40e8f0
push 0x529dbc
call fcn.00487680
call fcn.00487000
test eax, eax
je 0x40f815
mov eax, ebx
call fcn.0042c8f0
push edi
call fcn.0047002e
push 0x80000
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
call fcn.004018e0
mov edi, dword [0x529da4]
add esp, 4
push 0x20000
call fcn.00401240
push eax
mov ecx, edi
call fcn.00401750
push 0xc
call fcn.00450212
add esp, 0xc
push 0xc
mov dword [0x529dc4], eax
call fcn.00450212
add esp, 4
push 0xc
mov dword [0x529dc8], eax
call fcn.00450212
add esp, 4
push 0xc
mov dword [0x529dcc], eax
call fcn.00450212
add esp, 4
push 0xc
mov dword [0x529dd0], eax
call fcn.00450212
add esp, 4
push 0xc
mov dword [0x529dd4], eax
call fcn.00450212
add esp, 4
push 0xc
mov dword [0x529dd8], eax
call fcn.00450212
add esp, 4
push 0xc
mov dword [0x529ddc], eax
call fcn.00450212
mov esi, dword [0x529dc4]
add esp, 4
mov dword [0x529de0], eax
call fcn.00449ef0
mov esi, dword [0x529dc8]
call fcn.00449ef0
mov esi, dword [0x529dcc]
call fcn.00449ef0
mov esi, dword [0x529dd0]
call fcn.00449ef0
mov esi, dword [0x529dd4]
call fcn.00449ef0
mov esi, dword [0x529dd8]
call fcn.00449ef0
mov esi, dword [0x529ddc]
call fcn.00449ef0
mov esi, dword [0x529de0]
call fcn.00449ef0
mov esi, dword [0x529dc4]
push 0
call fcn.00449e70
mov esi, dword [0x529dc8]
add esp, 4
push 0
call fcn.00449e70
mov esi, dword [0x529dcc]
add esp, 4
push 0
call fcn.00449e70
mov esi, dword [0x529dd0]
add esp, 4
push 0
call fcn.00449e70
mov esi, dword [0x529dd4]
add esp, 4
push 0
call fcn.00449e70
add esp, 4
mov esi, dword [0x529dd8]
push 0
call fcn.00449e70
mov esi, dword [0x529ddc]
add esp, 4
push 0
call fcn.00449e70
mov esi, dword [0x529de0]
add esp, 4
push 0
call fcn.00449e70
add esp, 4
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov byte [ebp - 0x30], 0x77
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x32
mov byte [ebp - 0x2d], 0x5f
mov byte [ebp - 0x2c], 0x33
mov byte [ebp - 0x2b], 0x32
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x65
mov byte [ebp - 0x3e], 0x63
mov byte [ebp - 0x3d], 0x76
mov byte [ebp - 0x3c], 0
mov byte [ebp - 0x48], 0x63
mov byte [ebp - 0x47], 0x6f
mov byte [ebp - 0x46], 0x6e
mov byte [ebp - 0x45], 0x6e
mov byte [ebp - 0x44], 0x65
mov byte [ebp - 0x43], 0x63
mov byte [ebp - 0x42], 0x74
mov byte [ebp - 0x41], 0
mov byte [ebp - 0x38], 0x73
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0
call fcn.00486440
lea edx, [ebp - 0x38]
mov dword [0x529df0], eax
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.00486440
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x30]
push edx
mov dword [0x529df4], eax
call fcn.00486440
mov dword [0x529de8], eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00486440
lea edx, [ebp - 0x40]
mov dword [0x529dec], eax
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.00486440
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x30]
push edx
mov dword [0x529df8], eax
call fcn.00486440
mov dword [0x529dfc], eax
mov eax, dword [0x529df4]
mov ecx, dword [eax]
mov dword [0x529da8], 1
cmp ecx, dword [ebp - 0x1c]
jne 0x40fa88
add eax, 4
cmp byte [eax], 0xec
je 0x40fb2b
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
test esi, esi
je 0x40fae2
lea edx, [ebp - 0x1e4]
push 0x750f4248
push edx
mov edx, esi
call fcn.00407090
lea eax, [ebp - 0x124]
push eax
lea edx, [esi + 0x400]
call fcn.004070b0
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0xc
push 0
push 0
push esi
push 0x401190
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fae8
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x529df4]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, 5
call fcn.00446990
mov eax, dword [0x529df4]
mov edx, dword [ebp - 0x1c]
add esp, 4
cmp dword [eax], edx
jne 0x40fb15
mov cl, byte [ebp - 0x18]
add eax, 4
cmp cl, byte [eax]
je 0x40fb31
push 0
push 0
push 0
push 0x40ebe0
push 0
push 0
call edi
jmp 0x410191
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x529dec]
mov edx, dword [ebp - 0x1c]
cmp dword [eax], edx
jne 0x40fb4b
mov cl, byte [ebp - 0x18]
add eax, 4
cmp cl, byte [eax]
je 0x40fbd2
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
test esi, esi
je 0x40fb9d
lea edx, [ebp - 0x1e4]
push 0x750f4249
push edx
mov edx, esi
call fcn.00407090
lea eax, [ebp - 0x124]
push eax
lea edx, [esi + 0x400]
call fcn.004070b0
add esp, 0xc
push 0
push 0
push esi
push 0x401190
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x529dec]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, 5
call fcn.00446990
mov eax, dword [0x529dec]
mov edx, dword [ebp - 0x1c]
add esp, 4
cmp dword [eax], edx
jne 0x40fb15
mov cl, byte [ebp - 0x18]
add eax, 4
cmp cl, byte [eax]
jne 0x40fb15
mov eax, dword [0x529dfc]
mov edx, dword [ebp - 0x1c]
cmp dword [eax], edx
jne 0x40fbec
mov cl, byte [ebp - 0x18]
add eax, 4
cmp cl, byte [eax]
je 0x40fc73
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
test esi, esi
je 0x40fc3e
lea edx, [ebp - 0x1e4]
push 0x750f424a
push edx
mov edx, esi
call fcn.00407090
lea eax, [ebp - 0x124]
push eax
lea edx, [esi + 0x400]
call fcn.004070b0
add esp, 0xc
push 0
push 0
push esi
push 0x401190
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x529dfc]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, 5
call fcn.00446990
mov eax, dword [0x529dfc]
mov edx, dword [eax]
add esp, 4
cmp edx, dword [ebp - 0x1c]
jne 0x40fb15
mov cl, byte [ebp - 0x18]
add eax, 4
cmp cl, byte [eax]
jne 0x40fb15
call fcn.00486d90
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004875c0
push 0x40e930
push 0x529df8
call fcn.00487680
push 0x40eaa0
push 0x529df0
call fcn.00487680
push 0x40e960
push 0x529de8
call fcn.00487680
call fcn.00487000
mov edi, dword [0x529dfc]
push 0x40000
call fcn.00401240
push eax
mov ecx, edi
call fcn.00401750
add esp, 8
push 0x100000
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
call fcn.004018e0
add esp, 4
call fcn.004030c0
call fcn.004030c0
xor esi, esi
push esi
push esi
push esi
push 0x401940
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x800
mov edi, 0x40d8a0
call fcn.00401240
push eax
mov ecx, 0x40d8a0
call fcn.00401750
add esp, 8
mov byte [ebp - 0x54], 0x6e
mov byte [ebp - 0x53], 0x74
mov byte [ebp - 0x52], 0x64
mov byte [ebp - 0x51], 0x6c
mov byte [ebp - 0x50], 0x6c
mov byte [ebp - 0x4f], 0x2e
mov byte [ebp - 0x4e], 0x64
mov byte [ebp - 0x4d], 0x6c
mov byte [ebp - 0x4c], 0x6c
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0xe4], 0x52
mov byte [ebp - 0xe3], 0x74
mov byte [ebp - 0xe2], 0x6c
mov byte [ebp - 0xe1], 0x41
mov byte [ebp - 0xe0], 0x64
mov byte [ebp - 0xdf], 0x64
mov byte [ebp - 0xde], 0x56
mov byte [ebp - 0xdd], 0x65
mov byte [ebp - 0xdc], 0x63
mov byte [ebp - 0xdb], 0x74
mov byte [ebp - 0xda], 0x6f
mov byte [ebp - 0xd9], 0x72
mov byte [ebp - 0xd8], 0x65
mov byte [ebp - 0xd7], 0x64
mov byte [ebp - 0xd6], 0x45
mov byte [ebp - 0xd5], 0x78
mov byte [ebp - 0xd4], 0x63
mov byte [ebp - 0xd3], 0x65
mov byte [ebp - 0xd2], 0x70
mov byte [ebp - 0xd1], 0x74
mov byte [ebp - 0xd0], 0x69
mov byte [ebp - 0xcf], 0x6f
mov byte [ebp - 0xce], 0x6e
mov byte [ebp - 0xcd], 0x48
mov byte [ebp - 0xcc], 0x61
mov byte [ebp - 0xcb], 0x6e
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x54]
push ecx
mov byte [ebp - 0xca], 0x64
mov byte [ebp - 0xc9], 0x6c
mov byte [ebp - 0xc8], 0x65
mov byte [ebp - 0xc7], 0x72
mov byte [ebp - 0xc6], 0
call fcn.00486440
lea edx, [ebp - 0xe4]
mov dword [0x529e00], eax
push edx
lea eax, [ebp - 0x54]
push eax
call fcn.00486440
mov edi, eax
cmp dword [0x529e00], esi
je 0x40fe78
call fcn.00486d90
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004875c0
push 0x40de80
push 0x529e00
call fcn.00487680
call fcn.00487000
push 0x200000
call fcn.00401240
push eax
mov ecx, edi
call fcn.00401750
add esp, 8
call fcn.00402340
call fcn.00401fe0
mov eax, 0x52af34
call fcn.0040cc40
mov eax, 0x52af4c
call fcn.0040cd40
mov dword [ebx + 0x78], esi
mov dword [ebx + 0x7c], esi
mov dword [ebx + 0x80], esi
mov dword [ebx + 0x84], esi
mov dword [ebx + 0x168], esi
mov dword [ebx + 0x16c], esi
mov dword [ebx + 0x170], esi
mov dword [ebx + 0x174], esi
mov dword [ebx + 0x178], esi
mov byte [ebx + 0x184], 0
mov byte [ebx + 0x185], 1
mov dword [ebx + 0x188], esi
mov dword [ebx + 0x18c], 0xffffffff
mov dword [ebx + 0x268], esi
mov dword [ebx + 0x26c], esi
mov dword [ebx + 0x270], esi
mov dword [ebx + 0x274], esi
mov dword [ebx + 0x278], esi
mov dword [0x5294f4], esi
mov dword [ebx + 0x27c], esi
mov dword [ebx + 0x280], esi
mov dword [ebx + 0x284], esi
call fcn.004400e0
mov byte [ebp - 0x375], 0
call fcn.00448840
test eax, eax
jne 0x40ff5e
push 0x10
push 0x5114d4
push 0x5114e0
mov ecx, ebx
mov byte [ebp - 0x375], 1
call fcn.0045b477
call fcn.00491420
lea ecx, [ebp - 0x37c]
push 4
push ecx
call fcn.00491cd0
add esp, 8
cmp eax, 1
je 0x40ff93
push 0x10
push 0x5114d4
push 0x5114fc
mov ecx, ebx
mov byte [ebp - 0x375], 1
call fcn.0045b477
mov edi, dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xc
xor edi, eax
call fcn.00450212
add esp, 4
mov esi, eax
mov dword [0x529de4], eax
call fcn.00449ef0
mov esi, dword [0x529de4]
push edi
call fcn.00449e70
add esp, 4
lea edx, [ebp - 0x374]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40fff8
push 0x10
push 0x5114d4
push 0x511518
mov ecx, ebx
mov byte [ebp - 0x375], 1
call fcn.0045b477
jmp 0x410002
mov dword [0x529d7c], 1
call fcn.0040ead0
cmp byte [ebp - 0x375], 0
je 0x410191
mov eax, ebx
call fcn.0042c8f0
push 0
call fcn.0047002e
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
cmp esi, edi
je 0x410181
push 0x750f4247
jmp 0x410147
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
cmp esi, edi
je 0x410181
lea edx, [ebp - 0x1e4]
push 0x750f4246
push edx
mov edx, esi
call fcn.00407090
lea eax, [ebp - 0x124]
push eax
jmp 0x41015c
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
cmp esi, edi
je 0x410181
lea ecx, [ebp - 0x1e4]
push 0x750f4245
push ecx
mov edx, esi
call fcn.00407090
lea edx, [ebp - 0x124]
push edx
jmp 0x41015c
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
cmp esi, edi
je 0x410181
push 0x750f4244
jmp 0x410147
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
cmp esi, edi
je 0x410181
lea edx, [ebp - 0x1e4]
push 0x750f4243
push edx
mov edx, esi
call fcn.00407090
lea eax, [ebp - 0x124]
push eax
jmp 0x41015c
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
cmp esi, edi
je 0x410181
lea ecx, [ebp - 0x1e4]
push 0x750f4242
push ecx
mov edx, esi
call fcn.00407090
lea edx, [ebp - 0x124]
push edx
jmp 0x41015c
push 0x600
call fcn.00450212
mov esi, eax
add esp, 4
cmp esi, edi
je 0x410181
push 0x750f4241
lea eax, [ebp - 0x1e4]
push eax
mov edx, esi
call fcn.00407090
lea ecx, [ebp - 0x124]
push ecx
lea edx, [esi + 0x400]
call fcn.004070b0
add esp, 0xc
push edi
push edi
push esi
push 0x401190
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push edi
push edi
push 0x40ebe0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046d9d8
mov esp, ebp
pop ebp
ret 4