Function at 0x40bd70
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x436641
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x443284]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x443284]
xor eax, esp
push eax
lea eax, [esp + 0x19c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1ac]
mov edi, ecx
lea ecx, [edi + 0x1ec]
push ecx
mov ebx, str.drcom.tcd
lea esi, [esp + 0x17c]
mov dword [esp + 0x48], eax
mov dword [esp + 0x20], 0
call fcn.00402310
add esp, 4
xor ebx, ebx
mov dword [esp + 0x1a4], ebx
push ebx
mov esi, 0xf
push 0x43a36a
lea ecx, [esp + 0xd8]
mov dword [esp + 0xf0], esi
mov dword [esp + 0xec], ebx
mov byte [esp + 0xdc], bl
call fcn.00401b50
mov byte [esp + 0x1a4], 1
push 4
push str.0000
lea ecx, [esp + 0xa0]
mov dword [esp + 0xb8], esi
mov dword [esp + 0xb4], ebx
mov byte [esp + 0xa4], bl
call fcn.00401b50
mov byte [esp + 0x1a4], 2
push ebx
push 0x43a36a
lea ecx, [esp + 0xf4]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
call fcn.00401b50
mov byte [esp + 0x1a4], 3
push ebx
push 0x43a36a
lea ecx, [esp + 0x110]
mov dword [esp + 0x128], esi
mov dword [esp + 0x124], ebx
mov byte [esp + 0x114], bl
call fcn.00401b50
mov byte [esp + 0x1a4], 4
push ebx
push 0x43a36a
lea ecx, [esp + 0x12c]
mov dword [esp + 0x144], esi
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
call fcn.00401b50
mov byte [esp + 0x1a4], 5
push ebx
push 0x43a36a
lea ecx, [esp + 0xbc]
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
call fcn.00401b50
mov byte [esp + 0x1a4], 6
push ebx
push 0x43a36a
lea ecx, [esp + 0x148]
mov dword [esp + 0x160], esi
mov dword [esp + 0x15c], ebx
mov byte [esp + 0x14c], bl
call fcn.00401b50
mov byte [esp + 0x1a4], 7
mov dword [esp + 0x174], esi
mov dword [esp + 0x170], ebx
mov byte [esp + 0x160], bl
push ebx
push 0x43a36a
lea ecx, [esp + 0x164]
call fcn.00401b50
lea ebp, [ebx + 8]
mov byte [esp + 0x1a4], 8
call fcn.00411b50
cmp dword [edi + 0x1cc], ebp
mov esi, eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
jb 0x40bf90
mov ecx, dword [edi + 0x1b8]
jmp 0x40bf96
lea ecx, [edi + 0x1b8]
lea edx, [esp + 0x20]
push edx
call fcn.00404cf0
test al, al
je 0x40bff5
cmp word [esp + 0x20], bx
je 0x40bff5
call fcn.00414fa0
push eax
push str.___s__
push 0x104
push 0x104
push 0x445be0
call fcn.0041f84a
add esp, 0x14
cmp dword [edi + 0x1cc], ebp
jb 0x40bfe5
mov eax, dword [edi + 0x1b8]
push 0x7b
push eax
push str.UpdateCtrl::GrantUrl:_get_ntptime_success___s:_d_.
jmp 0x40c040
push 0x7b
lea eax, [edi + 0x1b8]
push eax
push str.UpdateCtrl::GrantUrl:_get_ntptime_success___s:_d_.
jmp 0x40c040
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00414fa0
push eax
push str.___s__
push 0x104
push 0x104
push 0x445be0
call fcn.0041f84a
add esp, 0x14
cmp dword [edi + 0x1cc], ebp
jb 0x40c032
mov eax, dword [edi + 0x1b8]
jmp 0x40c038
lea eax, [edi + 0x1b8]
push 0x7b
push eax
push str.UpdateCtrl::GrantUrl:_get_ntptime_fail___s:_d_.
push 4
call fcn.004154c0
movzx ecx, word [esp + 0x3c]
movzx edx, word [esp + 0x3a]
movzx eax, word [esp + 0x38]
add esp, 0x10
push ecx
movzx ecx, word [esp + 0x2a]
push edx
movzx edx, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push ecx
mov ecx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 8]
push eax
push str._04d_02d_02d_02d_02d_02d
push ecx
push edx
call fcn.0041f9fa
mov edx, dword [esi + 8]
mov eax, edx
add esp, 0x24
lea esi, [eax + 1]
jmp 0x40c090
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40c090
sub eax, esi
push eax
push edx
lea ecx, [esp + 0xd8]
call fcn.00401b50
push ebx
call fcn.0041f2ed
cdq
mov ecx, 3
idiv ecx
add esp, 4
sub edx, ebx
je 0x40c0da
sub edx, 1
je 0x40c0d1
sub edx, 1
jne 0x40c0ed
push 4
push str.0006
jmp 0x40c0e1
push 4
push str.0003
jmp 0x40c0e1
push 4
push str.0000
lea ecx, [esp + 0xa0]
call fcn.00401b50
cmp dword [edi + 0x220], ebp
jb 0x40c0fd
mov eax, dword [edi + 0x20c]
jmp 0x40c103
lea eax, [edi + 0x20c]
push ebx
push eax
call fcn.00420560
add esp, 8
test eax, eax
jne 0x40c1df
cmp dword [esp + 0x190], ebp
mov eax, dword [esp + 0x17c]
jae 0x40c12c
lea eax, [esp + 0x17c]
lea edx, [esp + 0x64]
push edx
push eax
call fcn.004201a2
add esp, 8
test eax, eax
jne 0x40c1df
cmp dword [esp + 0x78], ebx
jle 0x40c1df
cmp dword [esp + 0x190], ebp
mov eax, dword [esp + 0x17c]
jae 0x40c163
lea eax, [esp + 0x17c]
push 0x43b0f4
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041f92f
add esp, 0xc
test eax, eax
jne 0x40c1df
mov ecx, dword [esp + 0x78]
add ecx, 1
push ecx
call fcn.0041ee32
mov edx, dword [esp + 0x7c]
add esp, 4
add edx, 1
push edx
mov esi, eax
push ebx
push esi
call fcn.00424a50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x84]
add esp, 0xc
push eax
push ecx
push 1
push esi
call fcn.004208ab
add esp, 0x10
cmp eax, dword [esp + 0x78]
jne 0x40c1c9
push esi
lea ecx, [esp + 0xf0]
call fcn.0040f930
push esi
call fcn.004200a0
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call fcn.00420024
add esp, 4
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x128]
mov edx, edi
call fcn.0040a950
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x114]
mov byte [esp + 0x1b0], 9
call fcn.00401960
mov ebp, 0x10
mov byte [esp + 0x1a4], 8
cmp dword [esp + 0x60], ebp
jb 0x40c22a
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0041f829
add esp, 4
call fcn.0041f150
cdq
mov ecx, 0xf4240
idiv ecx
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 8]
push edx
mov edx, dword [esi + 0x10]
push str._06d
push edx
push eax
call fcn.0041f9fa
mov esi, dword [esi + 8]
mov eax, esi
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40c260
sub eax, edx
push eax
push esi
lea ecx, [esp + 0xbc]
call fcn.00401b50
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0xf0]
push edx
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0xdc]
push ecx
lea edx, [esp + 0x58]
push edx
lea edx, [esp + 0x138]
lea ecx, [esp + 0x11c]
call fcn.0040b960
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x14c]
mov byte [esp + 0x1b0], 0xa
call fcn.00401960
mov byte [esp + 0x1a4], 8
cmp dword [esp + 0x60], ebp
jb 0x40c2e4
mov eax, dword [esp + 0x4c]
push eax
call fcn.0041f829
add esp, 4
push 0x11
push str.00:00:00:00:00:00
lea esi, [esp + 0x180]
call fcn.00401d80
call fcn.004103d0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x1a8], 0xb
call fcn.00404f60
add esp, 4
cmp dword [esp + 0x40], ebx
jbe 0x40c340
mov eax, dword [esp + 0x3c]
mov esi, dword [eax]
cmp esi, eax
jne 0x40c32e
call fcn.0041fb40
push 0xffffffffffffffff
lea eax, [esi + 0x40]
push ebx
lea ecx, [esp + 0x180]
call fcn.00401a50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0x19c]
mov word [ecx + 4], bx
call fcn.00401a50
lea esi, [esp + 0x80]
call fcn.00412070
add esp, 0x1c
mov byte [esp + 0x1a4], 0xc
cmp dword [eax + 0x18], ebp
jb 0x40c387
mov eax, dword [eax + 4]
jmp 0x40c38a
add eax, 4
mov ecx, eax
lea ebx, [esp + 0x48]
call fcn.004138e0
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
lea ecx, [esp + 0x168]
mov byte [esp + 0x1b0], 0xd
call fcn.00401960
cmp dword [esp + 0x60], ebp
jb 0x40c3c2
mov edx, dword [esp + 0x4c]
push edx
call fcn.0041f829
add esp, 4
mov byte [esp + 0x1a4], 0xb
cmp dword [esp + 0x7c], ebp
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x40c3ed
mov eax, dword [esp + 0x68]
push eax
call fcn.0041f829
add esp, 4
movzx ecx, word [edi + 0x1b2]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
lea eax, [edi + 0x196]
push ebx
mov word [ecx + 4], bx
call fcn.00401a50
lea esi, [esp + 0x84]
call fcn.00412070
add esp, 0x1c
cmp dword [eax + 0x18], ebp
jb 0x40c433
mov eax, dword [eax + 4]
jmp 0x40c436
add eax, 4
cmp dword [esp + 0x178], ebp
jb 0x40c44c
mov edx, dword [esp + 0x164]
mov dword [esp + 0x18], edx
jmp 0x40c457
lea ecx, [esp + 0x164]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x15c], ebp
jb 0x40c46d
mov edx, dword [esp + 0x148]
mov dword [esp + 0x38], edx
jmp 0x40c478
lea ecx, [esp + 0x148]
mov dword [esp + 0x38], ecx
cmp dword [esp + 0xd0], ebp
jb 0x40c48e
mov edx, dword [esp + 0xbc]
mov dword [esp + 0x34], edx
jmp 0x40c499
lea ecx, [esp + 0xbc]
mov dword [esp + 0x34], ecx
cmp dword [esp + 0x140], ebp
jb 0x40c4af
mov edx, dword [esp + 0x12c]
mov dword [esp + 0x1c], edx
jmp 0x40c4ba
lea ecx, [esp + 0x12c]
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x124], ebp
mov edi, dword [esp + 0x110]
jae 0x40c4d1
lea edi, [esp + 0x110]
cmp dword [esp + 0x108], ebp
mov esi, dword [esp + 0xf4]
jae 0x40c4e8
lea esi, [esp + 0xf4]
cmp dword [esp + 0xb4], ebp
mov edx, dword [esp + 0xa0]
jae 0x40c4ff
lea edx, [esp + 0xa0]
cmp dword [esp + 0xec], ebp
mov ecx, dword [esp + 0xd8]
jae 0x40c516
lea ecx, [esp + 0xd8]
push eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
push esi
mov esi, dword [esp + 0x3c]
push edx
mov edx, dword [esi + 8]
push ecx
mov ecx, dword [esi + 0x10]
push str.GET__DRCLIENT_UPDATE_TIME_sTYPE_sKEY_sHASH_sVER_sRND_sCHK_sM_s_HTTP_1.0_r_nHost:__s:_d_r_nUser_Agent:_Dr.COM_VER_CLIENT_r_n_r_n
push ecx
push edx
call fcn.0041f9fa
add esp, 0x34
cmp dword [esp + 0x7c], ebp
jb 0x40c55b
mov eax, dword [esp + 0x68]
push eax
call fcn.0041f829
add esp, 4
mov esi, dword [esi + 8]
mov edi, dword [esp + 0x44]
mov eax, esi
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40c574
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00401b50
lea ecx, [esp + 0x38]
push ecx
call fcn.0040fbc0
mov edx, dword [esp + 0x3c]
push edx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x174], ebp
mov dword [esp + 0x3c], ebx
jb 0x40c5bc
mov eax, dword [esp + 0x160]
push eax
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x158], ebp
mov esi, 0xf
mov dword [esp + 0x174], esi
mov dword [esp + 0x170], ebx
mov byte [esp + 0x160], bl
jb 0x40c5ef
mov ecx, dword [esp + 0x144]
push ecx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0xcc], ebp
mov dword [esp + 0x158], esi
mov dword [esp + 0x154], ebx
mov byte [esp + 0x144], bl
jb 0x40c61d
mov edx, dword [esp + 0xb8]
push edx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x13c], ebp
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
jb 0x40c64b
mov eax, dword [esp + 0x128]
push eax
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x120], ebp
mov dword [esp + 0x13c], esi
mov dword [esp + 0x138], ebx
mov byte [esp + 0x128], bl
jb 0x40c679
mov ecx, dword [esp + 0x10c]
push ecx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x104], ebp
mov dword [esp + 0x120], esi
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
jb 0x40c6a7
mov edx, dword [esp + 0xf0]
push edx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0xb0], ebp
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov byte [esp + 0xf0], bl
jb 0x40c6d5
mov eax, dword [esp + 0x9c]
push eax
call fcn.0041f829
add esp, 4
cmp dword [esp + 0xe8], ebp
mov dword [esp + 0xb0], esi
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
jb 0x40c703
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x190], 8
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
jb 0x40c732
mov edx, dword [esp + 0x17c]
push edx
call fcn.0041f829
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0041f134
add esp, 0x194
ret 4