Function at 0x402e5e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53681b
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58be10]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
movzx esi, word [0x593df0]
movzx eax, word [0x593d9c]
mov ecx, dword [0x594810]
mov edx, dword [0x593d70]
neg esi
sbb esi, esi
and esi, 0x593de0
neg eax
sbb eax, eax
xor edi, edi
and eax, 0x593d74
cmp dword [0x59574c], edi
je 0x402edf
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push 0x564d38
push eax
call fcn.0040167d
call fcn.0040727e
jmp 0x4030ee
cmp dword [0x595754], 1
jne 0x402ef7
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push 0x564d80
jmp 0x402ecf
cmp esi, edi
jne 0x402f10
mov eax, dword [0x593c9c]
mov ecx, dword [eax + 0x4ec]
call fcn.00401d52
jmp 0x4030ee
cmp eax, edi
jne 0x402f24
cmp ecx, edi
jne 0x402f24
mov ecx, ebx
call fcn.0040314c
jmp 0x4030ee
cmp dword [esi + 4], 1
jne 0x402f39
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push 0x564da4
jmp 0x402ecf
cmp edx, 2
je 0x402f43
cmp edx, 3
jne 0x402f63
push 0x593ccc
call fcn.00408c7d
test eax, eax
jne 0x402f63
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.dk_j
jmp 0x402ecf
mov eax, dword [esi + 0xd0]
cmp eax, dword [esi + 0xd4]
mov eax, dword [0x595748]
jle 0x402f8d
cmp eax, 0x1d
jne 0x402fe8
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push 0x564e18
jmp 0x402ecf
cmp eax, 0x1d
jne 0x402fe8
cmp dword [esi], edi
je 0x403038
push 0x194
call fcn.0040cedf
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x402fb9
push eax
call fcn.00401a40
jmp 0x402fbb
xor eax, eax
or dword [esp + 0x20], 0xffffffff
push edi
mov dword [ebx + 0xe4], eax
mov edx, dword [eax]
push 0x10c
mov ecx, eax
call dword [edx + 0x160]
mov ecx, dword [ebx + 0xe4]
push 5
call fcn.0040d965
jmp 0x4030ee
cmp eax, 0x27
jne 0x403012
mov eax, dword [esi]
cmp eax, 2
je 0x402ff9
cmp eax, 3
jne 0x403038
push 0x194
call fcn.0040cedf
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 1
jmp 0x402fad
cmp eax, 0x2d
jne 0x403038
cmp dword [esi], 3
jne 0x403038
push 0x194
call fcn.0040cedf
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 2
jmp 0x402fad
push edi
push 0x3f3
mov ecx, ebx
call fcn.0040d75a
mov ecx, eax
call fcn.0040d9a7
push edi
push 0xa971
mov ecx, ebx
call fcn.0040d75a
mov ecx, eax
call fcn.0040d965
push edi
push 0x451
mov ecx, ebx
call fcn.0040d75a
mov ecx, eax
call fcn.0040d965
mov eax, dword [0x593c9c]
mov ecx, dword [eax + 0x4ec]
push edi
push 0x44e
call fcn.0040d75a
mov ecx, eax
call fcn.0040d965
push edi
push 0x46c
mov ecx, ebx
call fcn.0040d75a
mov ecx, eax
call fcn.0040d9a7
mov eax, dword [0x593d70]
cmp eax, 2
je 0x4030d5
cmp eax, 3
je 0x4030d5
push edi
push edi
push str.3.4.0.0
push eax
push dword [esi + 8]
push edi
push 0x595548
push 0x5954c8
call dword [sym.imp.vpncore.dll_VPNLogin]
add esp, 0x20
jmp 0x4030ee
push edi
push edi
push dword [ebx + 0x20]
push 0x402507
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret