Function at 0x40de80
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x4a8f46
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x4e86e0]
xor eax, esp
mov dword [esp + 0x628], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e86e0]
xor eax, esp
push eax
lea eax, [esp + 0x640]
mov dword fs:[0], eax
mov eax, dword [esp + 0x650]
mov ebx, ecx
cmp dword [ebx + 0xec], 0
mov ecx, dword [esp + 0x654]
mov dword [esp + 0x4ac], eax
mov dword [esp + 0x2c], ecx
jne 0x40e379
push 0xffffffffffffffff
call fcn.00438330
mov ecx, eax
call fcn.004370e0
test eax, eax
je 0x40e379
mov ecx, 0x4ea5e0
call fcn.0040bcf0
mov al, 0x37
mov dl, 0x31
mov cl, 0x34
mov byte [esp + 0x4ba], al
mov byte [esp + 0x4c1], al
mov eax, dword [ebx + 0x108]
mov byte [esp + 0x4b4], dl
mov byte [esp + 0x4b5], 0x62
mov byte [esp + 0x4b6], 0x33
mov byte [esp + 0x4b7], 0x30
mov byte [esp + 0x4b8], cl
mov byte [esp + 0x4b9], 0x63
mov byte [esp + 0x4bb], 0x61
mov byte [esp + 0x4bc], 0x32
mov byte [esp + 0x4bd], 0x64
mov byte [esp + 0x4be], 0x30
mov byte [esp + 0x4bf], 0x30
mov byte [esp + 0x4c0], cl
mov byte [esp + 0x4c2], dl
mov byte [esp + 0x4c3], 0x30
mov byte [esp + 0x4c4], 0
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40df94
sub eax, esi
lea edi, [eax + 0x10]
lea ecx, [esp + 0x38]
and edi, 0xfffffff0
call fcn.00416e80
mov edx, dword [0x4dc334]
push 0x10
push 0x10
push edx
lea eax, [esp + 0x4c0]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x658], 0
call fcn.00416ea0
mov eax, dword [ebx + 0x108]
push 0
push edi
push eax
push eax
lea ecx, [esp + 0x48]
call fcn.00417950
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x30], ebp
je 0x40e359
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenA
push ebp
call esi
push str.HttpOpenRequestA
push ebp
mov dword [esp + 0x2c], eax
call esi
push str.InternetConnectA
push ebp
mov dword [esp + 0x1c], eax
call esi
push str.HttpSendRequestA
push ebp
mov dword [esp + 0x28], eax
call esi
push str.InternetCloseHandle
push ebp
mov dword [esp + 0x20], eax
call esi
push str.InternetReadFile
push ebp
mov dword [esp + 0x24], eax
call esi
mov ecx, dword [esp + 0x24]
test ecx, ecx
mov dword [esp + 0x28], eax
je 0x40e352
cmp dword [esp + 0x1c], 0
je 0x40e352
cmp dword [esp + 0x14], 0
je 0x40e352
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40e352
cmp dword [esp + 0x18], 0
je 0x40e352
test eax, eax
je 0x40e352
push 0
push 0
push 0
push 0
push str.CPUZ149
call ecx
test eax, eax
mov dword [esp + 0x34], eax
je 0x40e352
push 1
push 0
push 3
push str.toto
push str.toto
push 0x50
push str.valid.canardpc.com
push eax
call esi
mov esi, eax
test esi, esi
mov dword [esp + 0x24], esi
je 0x40e343
push 1
push SysReAllocString
push 0
push 0
push 0
push str.index.php
push str.POST
push esi
call dword [esp + 0x34]
test eax, eax
mov dword [esp + 0x20], eax
je 0x40e33c
push 0x1000
call fcn.00482392
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x4b0]
push ecx
push edx
push str.user_name_suser_email_sraw_cvf
mov ebp, eax
push 0x1000
push ebp
call fcn.00491baa
add esp, 0x18
xor esi, esi
test edi, edi
jle 0x40e16c
mov edi, edi
mov eax, dword [ebx + 0x108]
movzx ecx, byte [eax + esi]
push ecx
push str._02x
lea edx, [esp + 0x4b4]
push 8
push edx
call fcn.00491baa
lea eax, [esp + 0x4bc]
push eax
push 0x1000
push ebp
call fcn.00491c6c
add esi, 1
add esp, 0x1c
cmp esi, edi
jl 0x40e130
xor ecx, ecx
cmp dword [esp + 0x658], 1
lea edx, [esp + 0x4d4]
sete cl
push ecx
push str.publish_dsendok
push 0x40
push edx
call fcn.00491baa
lea eax, [esp + 0x4e4]
push eax
push 0x1000
push ebp
call fcn.00491c6c
mov eax, ebp
add esp, 0x1c
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40e1b0
mov edi, dword [esp + 0x20]
sub eax, edx
push eax
push ebp
push 0xffffffffffffffff
push str.Content_Type:application_x_www_form_urlencoded
push edi
call dword [esp + 0x2c]
test eax, eax
je 0x40e320
push pe_nt_image_headers32
lea ecx, [esp + 0x540]
push 0
push ecx
call fcn.00491b30
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 0x80
lea eax, [esp + 0x544]
push eax
push edi
mov dword [esp + 0x28], 0
call dword [esp + 0x38]
test eax, eax
je 0x40e326
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x40e326
lea ecx, [esp + 0x4ac]
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esp + eax + 0x544], 0
lea eax, [esp + 0x544]
push str._d__d
push eax
mov dword [esp + 0x24], 0x63
call fcn.00491c4d
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x10
test eax, eax
mov eax, dword [esp + 0x14]
je 0x40e2e7
test eax, eax
je 0x40e27e
cmp eax, 8
jne 0x40e2e7
push 0x30
push str.Validation_Error
push str.Your_CPU_Z_version_is_outdated__please_update_if_you_need_to_submit_a_validation
push 0
call esi
jmp 0x40e2e3
mov eax, dword [esp + 0x4ac]
push eax
push str.http:__valid.canardpc.com_show_oc.php_id_d
lea ecx, [esp + 0x544]
push pe_nt_image_headers32
push ecx
mov dword [0x4ea6e4], eax
call fcn.00491baa
add esp, 0x10
lea ecx, [esp + 0x4d4]
call fcn.00410030
push 5
lea edx, [esp + 0x540]
push edx
lea ecx, [esp + 0x4dc]
mov byte [esp + 0x650], 1
call fcn.0040fee0
lea ecx, [esp + 0x4d4]
mov byte [esp + 0x648], 0
call fcn.00410090
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e326
cmp eax, 8
je 0x40e326
push eax
push str.Error__d
lea eax, [esp + 0x544]
push pe_nt_image_headers32
push eax
call fcn.00437120
add esp, 0x10
push 0x30
push str.CPU_Z_Error
lea ecx, [esp + 0x544]
push ecx
push 0
call esi
jmp 0x40e326
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
call fcn.00482397
add esp, 4
push edi
call dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
push esi
call dword [esp + 0x20]
jmp 0x40e349
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x34]
push edx
call dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00438330
mov ecx, eax
call fcn.00436c70
lea ecx, [esp + 0x38]
mov dword [esp + 0x648], 0xffffffff
call fcn.00416e90
mov ecx, dword [esp + 0x640]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x628]
xor ecx, esp
call fcn.00490dce
add esp, 0x638
ret 0xc