Function at 0x401870
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
sub esp, 0x138
mov eax, dword [0x40f1f4]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push ebp
mov ebp, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x148]
push edi
push 0xff
lea eax, [esp + 0x49]
push 0
push eax
mov byte [esp + 0x50], 0
call sub.MSVCR110.dll_memset
xor ebx, ebx
add esp, 0xc
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
call fcn.004080f0
test eax, eax
je 0x4018cc
push 1
call dword [sym.imp.MSVCR110.dll_exit]
push 0
push 0
push 1
push 1
push ebp
push esi
push 0
call sub.libav.dll_Ordinal_44284
add esp, 0x1c
mov dword [0x40fd48], eax
test eax, eax
jne 0x401900
push str._Cant_parse_command_line_options_n
call fcn.00408a80
add esp, 4
mov eax, 1
jmp 0x401e99
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0x23
push 0
call fcn.00407c10
mov esi, dword [sym.imp.MSVCR110.dll_strcat_s]
push 0x40b0e4
lea eax, [esp + 0x5c]
push 0x100
push eax
call esi
call fcn.00401000
push eax
lea eax, [esp + 0x68]
push 0x100
push eax
call esi
lea eax, [esp + 0x70]
push eax
push 0x100
push 0x40fc20
call dword [sym.imp.MSVCR110.dll_strcpy_s]
push 0x40b0e8
push 0x100
push 0x40fc20
call esi
add esp, 0x44
call fcn.00401000
push eax
push 0x100
push 0x40fc20
call esi
push str..conf
push 0x100
push 0x40fc20
call esi
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x40]
push eax
push 0xffffffffffffffff
push 0x100
push 0x40fb20
mov dword [esp + 0x52], 0x7461645c
mov word [esp + 0x5a], 0x65
mov word [esp + 0x57], 0x6162
mov word [esp + 0x50], 0x7325
mov byte [esp + 0x59], 0x73
mov byte [esp + 0x56], 0x61
call dword [sym.imp.MSVCR110.dll__snprintf_s]
push str.help
push dword [0x40fd48]
call fcn.00408060
add esp, 0x34
cmp dword [eax + 0x18], ebx
je 0x4019fc
call fcn.00401090
push dword [0x40fd48]
call fcn.00407ff0
add esp, 4
xor eax, eax
jmp 0x401e99
push str.debug
push dword [0x40fd48]
call fcn.00408060
add esp, 8
mov ebp, 1
cmp dword [eax + 0x18], ebx
je 0x401a20
mov word [0x40f220], bp
push 0x40fc20
call dword [sym.imp.MSVCR110.dll__strdup]
push dword [0x40fd48]
mov esi, eax
push 0
push 1
push 1
push 0
push 0
push 0x40fc20
call sub.libav.dll_Ordinal_44284
add esp, 0x20
mov dword [0x40fd48], eax
push esi
test eax, eax
jne 0x401a7a
push str.ERROR:_Cant_open_parse_the_config_file__s_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
push esi
call dword [sym.imp.MSVCR110.dll_free]
add esp, 0x10
mov eax, ebp
jmp 0x401e99
call dword [sym.imp.MSVCR110.dll_free]
push str.version
push dword [0x40fd48]
call fcn.00408060
add esp, 0xc
cmp dword [eax + 0x18], ebx
je 0x401aff
lea eax, [esp + 0x30]
push eax
push dword [0x40fd48]
mov dword [esp + 0x39], 0x62617461
mov word [esp + 0x3e], 0x6573
mov dword [esp + 0x41], 0x63657269
mov word [esp + 0x45], 0x6f74
mov word [esp + 0x48], 0x79
mov byte [esp + 0x38], 0x44
mov byte [esp + 0x40], 0x44
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x47], 0x72
call fcn.00408060
mov eax, dword [eax + 8]
push eax
call fcn.004084e0
push dword [0x40fd48]
call fcn.00407ff0
add esp, 0x10
xor eax, eax
jmp 0x401e99
push str.LogFileUnlock
push dword [0x40fd48]
call fcn.00408060
xor ecx, ecx
cmp dword [eax + 0x18], ecx
push str.LogTime
push dword [0x40fd48]
sete cl
mov word [0x40f1ec], cx
call fcn.00408060
movzx eax, word [eax + 0x18]
push str.LogClean
push dword [0x40fd48]
mov word [0x40f7a0], ax
call fcn.00408060
push str.LogFileMaxSize
movzx eax, word [eax + 0x18]
push dword [0x40fd48]
mov word [0x40f224], ax
call fcn.00408060
push str.LogVerbose
mov eax, dword [eax + 0x10]
push dword [0x40fd48]
mov dword [0x40f7ac], eax
call fcn.00408060
add esp, 0x28
mov ax, word [eax + 0x18]
mov word [0x40f7b8], ax
mov word [0x40f798], ax
cmp dword [0x40f7ac], ebx
je 0x401bb2
push str.LogRotate
push dword [0x40fd48]
call fcn.00408060
mov ax, word [eax + 0x18]
add esp, 8
mov word [0x40f7a8], ax
push str.SendBufTimeout
push dword [0x40fd48]
call fcn.00408060
mov ax, word [eax + 0x10]
push str.LogFile
push dword [0x40fd48]
mov word [0x40f1f0], ax
call fcn.00408060
add esp, 0x10
cmp dword [eax + 0x18], ebx
je 0x401c28
mov eax, dword [eax + 8]
push eax
mov dword [0x40f7b0], eax
call fcn.00408130
add esp, 4
test eax, eax
jne 0x401c18
push str.ERROR:_LogFile_requires_full_path._n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
mov esi, ebp
jmp 0x401e4d
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.MSVCR110.dll__time64]
add esp, 4
jmp 0x401c2e
mov dword [0x40f7b0], ebx
push str.DevLiblog
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], ebx
je 0x401c53
push 0x402c80
call sub.libav.dll_Ordinal_33
add esp, 4
push 0
call sub.libav.dll_Ordinal_17
add esp, 4
test eax, eax
je 0x401c68
mov esi, ebp
jmp 0x401e4d
push str.Debug
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], ebx
je 0x401c90
call sub.libav.dll_Ordinal_6
mov eax, 2
mov word [0x40f798], ax
push str.TCPSocket
push dword [0x40fd48]
call fcn.00408060
cmp dword [eax + 0x18], ebx
mov ebp, ebx
mov esi, 1
push str.LocalSocket
push dword [0x40fd48]
cmovne ebp, esi
mov dword [esp + 0x24], ebp
call fcn.00408060
add esp, 0x10
cmp dword [eax + 0x18], ebx
cmovne ebx, esi
test ebp, ebp
jne 0x401cd6
test ebx, ebx
je 0x401e4d
push str.StreamMinPort
push dword [0x40fd48]
call fcn.00408060
mov esi, dword [eax + 0x10]
push str.StreamMaxPort
push dword [0x40fd48]
call fcn.00408060
mov eax, dword [eax + 0x10]
add esp, 0x10
cmp esi, 0x400
jl 0x401e48
cmp esi, eax
jg 0x401e48
cmp eax, 0xffff
jg 0x401e48
call sub.libav.dll_Ordinal_11
mov dword [0x40f228], eax
test eax, eax
je 0x401e48
push str.disable_cache
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], edi
je 0x401d5c
push 0
push 1
push 0x18
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push 0x1770
call fcn.00407d70
push str.DetectPUA
push dword [0x40fd48]
call fcn.00408060
add esp, 0xc
cmp dword [eax + 0x18], edi
je 0x401f45
or dword [0x40f22c], 0x10
push str.ExcludePUA
push dword [0x40fd48]
call fcn.00408060
mov ebp, dword [sym.imp.MSVCR110.dll_sprintf]
mov esi, eax
add esp, 8
cmp dword [esi + 0x18], edi
je 0x401e00
or dword [0x40f22c], 0x200
xor ebx, ebx
push dword [esi + 8]
call sub.MSVCR110.dll_strlen
add eax, 3
add eax, ebx
push eax
push edi
call dword [sym.imp.MSVCR110.dll_realloc]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x401e3a
push dword [esi + 8]
lea ecx, [ebx + edi]
push 0x40b234
push ecx
call ebp
push dword [esi + 8]
call sub.MSVCR110.dll_strlen
inc ebx
add ebx, eax
add esp, 0x10
mov byte [ebx + edi], 0
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x401db5
mov word [ebx + edi], 0x2e
push str.IncludePUA
push dword [0x40fd48]
call fcn.00408060
mov esi, eax
add esp, 8
cmp dword [esi + 0x18], 0
je 0x401f0f
test edi, edi
je 0x401eb2
mov ebx, dword [sym.imp.MSVCR110.dll_free]
push edi
call ebx
add esp, 4
mov esi, 1
jmp 0x401e53
push dword [0x40f228]
call sub.libav.dll_Ordinal_9
add esp, 4
mov esi, 1
mov ebx, dword [sym.imp.MSVCR110.dll_free]
xor edi, edi
cmp dword [esp + 0x10], edi
jbe 0x401e77
jmp 0x401e60
mov eax, dword [0x40f338]
push dword [eax + edi*4]
call sub.libav.dll_Ordinal_44331
inc edi
add esp, 4
cmp edi, dword [esp + 0x10]
jb 0x401e60
push dword [0x40f338]
call ebx
call fcn.004087d0
push dword [0x40fd48]
call fcn.00407ff0
add esp, 8
call sub.libav.dll_Ordinal_49
mov eax, esi
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408f44
add esp, 0x138
ret
or dword [0x40f22c], 0x100
xor ebx, ebx
mov edi, edi
push dword [esi + 8]
call sub.MSVCR110.dll_strlen
add eax, 3
add eax, ebx
push eax
push edi
call dword [sym.imp.MSVCR110.dll_realloc]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x401e48
push dword [esi + 8]
lea eax, [ebx + edi]
push 0x40b234
push eax
call ebp
push dword [esi + 8]
call sub.MSVCR110.dll_strlen
inc ebx
add ebx, eax
add esp, 0x10
mov byte [ebx + edi], 0
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x401ec0
mov word [ebx + edi], 0x2e
test edi, edi
je 0x401f4d
push edi
push 6
push dword [0x40f228]
call sub.libav.dll_Ordinal_13
mov ebx, dword [sym.imp.MSVCR110.dll_free]
add esp, 0xc
push edi
test eax, eax
je 0x401f3e
call ebx
add esp, 4
mov esi, 1
jmp 0x401e53
call ebx
add esp, 4
jmp 0x401f53
mov ebx, dword [sym.imp.MSVCR110.dll_free]
jmp 0x401f57
mov ebx, dword [sym.imp.MSVCR110.dll_free]
mov ebp, dword [esp + 0x14]
push str.StatsEnabled
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401f7e
push dword [0x40f228]
call sub.libav.dll_Ordinal_70
add esp, 4
push str.StatsPEDisabled
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401fab
push 0
push 1
push 0x19
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.StatsTimeout
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x401fea
push str.StatsTimeout
push dword [0x40fd48]
call fcn.00408060
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1a
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x18
push str.StatsHostID
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x4020bd
push str.StatsHostID
push dword [0x40fd48]
call fcn.00408060
mov esi, dword [eax + 8]
push str.default
push esi
call sub.MSVCR110.dll_strcmp
add esp, 0x10
test eax, eax
je 0x4020bd
push str.none
push esi
call sub.MSVCR110.dll_strcmp
add esp, 8
test eax, eax
jne 0x402050
push eax
push dword [0x40f228]
call sub.libav.dll_Ordinal_46
jmp 0x4020a7
push str.anonymous
push esi
call sub.MSVCR110.dll_strcmp
add esp, 8
test eax, eax
jne 0x402069
push str.5b585e8f_3be5_11e3_bf0b_18037319526c
jmp 0x40209d
push esi
call sub.MSVCR110.dll_strlen
add esp, 4
cmp eax, 0x24
jbe 0x40209c
push 0
push dword [0x40f228]
call sub.libav.dll_Ordinal_42
push dword [0x40f228]
call sub.libav.dll_Ordinal_9
add esp, 0xc
mov esi, 1
jmp 0x401e53
push esi
push 0x40fd20
call sub.MSVCR110.dll_strcpy
add esp, 8
push 0x401050
push dword [0x40f228]
call sub.libav.dll_Ordinal_46
add esp, 8
push str.OfficialDatabaseOnly
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x4020e0
or dword [0x40f22c], 0x1000
push str.TemporaryDirectory
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x40211a
push dword [eax + 8]
push 0xd
push dword [0x40f228]
call sub.libav.dll_Ordinal_13
add esp, 0xc
test eax, eax
je 0x40211a
mov esi, 1
jmp 0x401e53
push 0x402c50
push dword [0x40f228]
call sub.libav.dll_Ordinal_34
push str.LeaveTemporaryFiles
push dword [0x40fd48]
call fcn.00408060
add esp, 0x10
cmp dword [eax + 0x18], 0
je 0x402157
push 0
push 1
push 0xe
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.ForceToDisk
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x402184
push 0
push 1
push 0x17
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.PhishingSignatures
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x4021a4
or dword [0x40f22c], 2
push str.Bytecode
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x40230f
or dword [0x40f22c], 0x2000
push str.BytecodeSecurity
push dword [0x40fd48]
call fcn.00408060
mov esi, eax
add esp, 8
cmp dword [esi + 0x18], 0
je 0x40223f
push str.TrustSigned
push dword [esi + 8]
call sub.MSVCR110.dll_strcmp
add esp, 8
test eax, eax
jne 0x402201
mov eax, 1
jmp 0x40221e
push str.Paranoid
push dword [esi + 8]
call sub.MSVCR110.dll_strcmp
add esp, 8
test eax, eax
jne 0x401e33
mov eax, 2
cdq
push edx
push eax
push 0xf
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
test eax, eax
je 0x40223f
mov esi, 1
jmp 0x401e53
push str.BytecodeUnsigned
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x402262
or dword [0x40f22c], 0x8000
push str.BytecodeMode
push dword [0x40fd48]
call fcn.00408060
mov esi, eax
add esp, 8
cmp dword [esi + 0x18], 0
je 0x4022e0
push str.ForceJIT
push dword [esi + 8]
call sub.MSVCR110.dll_strcmp
add esp, 8
test eax, eax
jne 0x402298
mov eax, 1
jmp 0x4022cd
push str.ForceInterpreter
push dword [esi + 8]
call sub.MSVCR110.dll_strcmp
add esp, 8
test eax, eax
jne 0x4022b3
mov eax, 2
jmp 0x4022cd
push str.Test
push dword [esi + 8]
call sub.MSVCR110.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
cdq
push edx
push eax
push 0x11
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.BytecodeTimeout
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x40230f
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.PhishingScanURLs
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x40232f
or dword [0x40f22c], 8
push str.DevACOnly
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x40235c
push 0
push 1
push 0xa
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push str.DevACDepth
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x40238b
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
push dword [0x40f228]
call sub.libav.dll_Ordinal_12
add esp, 0x10
push dword [0x40f22c]
lea eax, [esp + 0x1c]
push eax
push dword [0x40f228]
push 0x40fb20
call sub.libav.dll_Ordinal_18
add esp, 0x10
test eax, eax
je 0x4023b7
mov esi, 1
jmp 0x401e53
push str.DisableCertCheck
push dword [0x40fd48]
call fcn.00408060
add esp, 8
cmp dword [eax + 0x18], 0
je 0x4023de
mov eax, dword [0x40f228]
mov eax, dword [eax + 0x70]
or dword [eax], 0x20000
push dword [0x40f228]
call sub.libav.dll_Ordinal_8
add esp, 4
test eax, eax
je 0x4023fa
mov esi, 1
jmp 0x401e53
test ebp, ebp
je 0x402465
push str.TCPAddr
push dword [0x40fd48]
call fcn.00408060
mov esi, eax
add esp, 8
cmp dword [esi + 0x18], 0
je 0x402476
lea esp, [esp]
mov eax, dword [esi + 8]
test eax, eax
je 0x402465
push 0x40b400
push eax
call sub.MSVCR110.dll_strcmp
add esp, 8
test eax, eax
je 0x40243c
mov eax, dword [esi + 8]
push dword [0x40fd48]
push eax
lea eax, [esp + 0x18]
push eax
push 0x40f338
call fcn.00406570
add esp, 0x10
cmp eax, 0xffffffff
je 0x401e33
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x402420
cmp dword [esp + 0x10], 0
jne 0x40249d
mov esi, 1
jmp 0x401e53
push dword [0x40fd48]
lea eax, [esp + 0x14]
push 0
push eax
push 0x40f338
call fcn.00406570
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402465
lea esi, [eax + 2]
jmp 0x401e53
push dword [0x40fd48]
push dword [0x40f22c]
push dword [0x40f228]
push dword [esp + 0x1c]
push dword [0x40f338]
call fcn.00404510
add esp, 0x14
mov esi, eax
jmp 0x401e53