Function at 0x401fa0
Capabilities:
Enumerate processes
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42983a
mov eax, dword fs:[0]
push eax
sub esp, 0x520
mov eax, dword [0x43a14c]
xor eax, esp
mov dword [esp + 0x518], eax
push ebx
push esi
push edi
mov eax, dword [0x43a14c]
xor eax, esp
push eax
lea eax, [esp + 0x530]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00401780
call fcn.00401830
push 0x4018e0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, dword [0x44030c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44030c
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x538], 0
test esi, esi
jne 0x402020
xor eax, eax
jmp 0x402034
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402025
sub eax, edx
sar eax, 1
mov ebx, eax
push esi
lea eax, [esp + 0x24]
call fcn.00401450
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], 0
jmp 0x40205a
mov edi, dword [esp + 0x24]
push 0
push 2
mov dword [esp + 0x48], 0
mov dword [esp + 0xf4], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0xec]
push eax
push esi
mov dword [esp + 0x44], esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x402295
lea ecx, [esp + 0xec]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x402271
jmp 0x4020b0
mov ebx, dword [esp + 0xf4]
cmp edi, ebx
je 0x4020d2
lea edx, [esp + 0xec]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4020b0
jmp 0x402271
mov eax, dword [0x44030c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44030c
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x38], esi
mov byte [esp + 0x538], 1
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x402116
mov ecx, 0x104
lea eax, [esp + 0x38]
call fcn.004015c0
mov esi, dword [esp + 0x38]
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x402136
call fcn.00401f30
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00418fdc
add esp, 8
test eax, eax
jl 0x4022ac
cmp eax, dword [esi - 8]
jg 0x4022ac
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov byte [esp + 0x53c], 2
call fcn.00403430
mov byte [esp + 0x538], 3
mov edx, dword [eax]
mov eax, dword [esp + 0x104]
push edx
push eax
push ebx
push str.pid__d__ppid__d___s
lea edi, [esp + 0x34]
call fcn.00404e00
mov byte [esp + 0x548], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4021d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x42bf8c
push 0x4410d8
mov edx, 1
call fcn.00404420
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x4021f5
xor eax, eax
jmp 0x402209
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402200
sub eax, edx
push edi
push 0x4410d8
mov edx, eax
call fcn.00404420
mov ecx, dword [esp + 0x104]
lea eax, [edi - 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x40], 1
mov byte [esp + 0x538], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40224d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
mov byte [esp + 0x538], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402271
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x40], 0
je 0x402295
mov eax, dword [esp + 0x30]
inc eax
cmp eax, 0xa
mov dword [esp + 0x30], eax
jl 0x402056
call fcn.004177a0
call fcn.0040a8c0
xor esi, esi
cmp eax, esi
je 0x4022b6
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x80070057
call fcn.00401760
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x42c0e4
call fcn.00403570
mov byte [esp + 0x538], 4
push esi
mov edi, 0xf
push 0x42c0e4
lea ecx, [esp + 0x7c]
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], esi
mov byte [esp + 0x80], 0
call fcn.004056d0
lea edx, [esp + 0x74]
push edx
mov byte [esp + 0x53c], 5
call fcn.0040f660
xor eax, eax
add esp, 4
cmp dword [esp + 0x88], esi
setne al
cmp eax, esi
je 0x40261b
push 4
call fcn.00418ae9
add esp, 4
cmp eax, esi
je 0x402339
lea ecx, [esp + 0x98]
mov dword [eax], ecx
jmp 0x40233b
xor eax, eax
mov dword [esp + 0x98], eax
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
mov dword [esp + 0xac], esi
mov dword [esp + 0xc8], edi
mov dword [esp + 0xc4], esi
mov byte [esp + 0xb4], 0
push 4
mov byte [esp + 0x53c], 8
call fcn.00418ae9
add esp, 4
cmp eax, esi
je 0x40238e
lea edx, [esp + 0xd4]
mov dword [eax], edx
jmp 0x402390
xor eax, eax
mov dword [esp + 0xd4], eax
fldz
fstp qword [esp + 0xcc]
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe8], esi
mov dword [esp + 0x94], 5
mov byte [esp + 0x538], 0xa
cmp dword [esp + 0x8c], 0x10
mov edi, dword [esp + 0x78]
jae 0x4023da
lea edi, [esp + 0x78]
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x94]
call fcn.00406940
test eax, eax
je 0x402605
push str.username
lea esi, [esp + 0x98]
call fcn.004069c0
cmp dword [eax], 3
mov ebx, 0x10
jne 0x40241f
cmp dword [eax + 0x34], ebx
jb 0x40241a
mov ecx, dword [eax + 0x20]
jmp 0x402421
lea ecx, [eax + 0x20]
jmp 0x402421
xor ecx, ecx
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402426
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x7c]
call fcn.004056d0
push str.channelid
lea esi, [esp + 0x98]
call fcn.004069c0
cmp dword [eax], 3
jne 0x4024c3
cmp dword [eax + 0x34], ebx
jb 0x40245a
mov edi, dword [eax + 0x20]
jmp 0x40245d
lea edi, [eax + 0x20]
test edi, edi
je 0x4024c3
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
dec esi
test esi, esi
jle 0x4024c3
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40249d
mov ecx, esi
lea eax, [esp + 0x20]
call fcn.004015c0
mov ebx, dword [esp + 0x20]
push esi
push ebx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, dword [ebx - 8]
jg 0x4022ac
xor eax, eax
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], ax
lea ebx, [eax + 0x10]
jmp 0x40251e
mov eax, dword [esp + 0x20]
mov esi, dword [eax - 0x10]
add eax, 0xfffffff0
cmp dword [eax + 4], 0
je 0x40251e
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x4024f8
mov eax, dword [esp + 0x20]
cmp dword [eax - 8], 0
jl 0x4022ac
xor ecx, ecx
mov dword [eax - 0xc], 0
mov word [eax], cx
jmp 0x40251e
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40250e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
cmp dword [esp + 0x8c], ebx
jb 0x40259a
mov edi, dword [esp + 0x78]
test edi, edi
je 0x4025a0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
dec esi
test esi, esi
jle 0x4025a0
mov edx, dword [esp + 0x18]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40256b
mov ecx, esi
lea eax, [esp + 0x18]
call fcn.004015c0
mov edx, dword [esp + 0x18]
push esi
push edx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x18]
cmp esi, dword [eax - 8]
jg 0x4022ac
mov dword [eax - 0xc], esi
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [edx + esi*2], cx
mov ecx, dword [esp + 0x18]
jmp 0x4025ff
lea edi, [esp + 0x78]
jmp 0x40252f
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
mov esi, dword [ecx - 0x10]
lea eax, [ecx - 0x10]
je 0x4025ff
cmp dword [eax + 0xc], 0
lea edx, [eax + 0xc]
jge 0x4025d9
cmp dword [ecx - 8], 0
jl 0x4022ac
mov dword [ecx - 0xc], 0
mov ecx, dword [esp + 0x18]
xor eax, eax
mov word [ecx], ax
mov ecx, dword [esp + 0x18]
jmp 0x4025ff
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4025ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ecx, [eax + 0x10]
mov dword [esp + 0x18], ecx
cmp dword [ecx - 0xc], 0
jg 0x40264e
lea ecx, [esp + 0x94]
mov byte [esp + 0x538], 5
call fcn.00401e40
xor esi, esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x538], 4
cmp dword [esp + 0x8c], 0x10
jb 0x4022cd
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00418149
add esp, 4
jmp 0x4022cd
lea ecx, [esp + 0x94]
mov byte [esp + 0x538], 5
call fcn.00401e40
mov byte [esp + 0x538], 4
cmp dword [esp + 0x8c], ebx
jb 0x402680
mov edx, dword [esp + 0x78]
push edx
call fcn.00418149
add esp, 4
mov eax, dword [0x44030c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44030c
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x28], edi
mov byte [esp + 0x538], 0xb
mov eax, dword [0x44030c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44030c
call edx
add eax, 0x10
mov dword [esp + 0x38], eax
mov byte [esp + 0x538], 0xc
mov ecx, dword [esp + 0x18]
mov ebx, dword [ecx - 0xc]
test ebx, ebx
jle 0x402709
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x402734
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x402706
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x402706
call fcn.004014f0
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4026fd
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x28], ebx
jmp 0x402730
push ecx
jmp 0x402727
mov eax, str.D2A45CB4_0498_A741_3EA5_9403317DB859
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402711
sub eax, edx
sar eax, 1
push str.D2A45CB4_0498_A741_3EA5_9403317DB859
mov ebx, eax
lea eax, [esp + 0x2c]
call fcn.00401450
mov edi, dword [esp + 0x28]
mov eax, 0x440048
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402740
sub eax, edx
sar eax, 1
mov ebx, eax
push 0x440048
lea eax, [esp + 0x3c]
call fcn.00401450
lea esi, [esp + 0x1c]
call fcn.00416ff0
mov byte [esp + 0x538], 0xd
mov esi, dword [eax]
mov ebx, dword [esp + 0x38]
push esi
push ebx
push edi
call fcn.00401020
add esp, 0xc
test eax, eax
jne 0x402794
push esi
push ebx
push edi
call fcn.00401130
add esp, 0xc
test eax, eax
je 0x402799
mov eax, 1
cmp eax, 1
mov byte [esp + 0x538], 0xc
mov eax, dword [esp + 0x1c]
sete byte [esp + 0x37]
add eax, 0xfffffff0
or esi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4027cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x37], 0
je 0x40288b
lea eax, [ebx - 0x10]
mov edx, esi
lea ecx, [eax + 0xc]
mov byte [esp + 0x538], 0xb
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4027f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov edx, esi
lea ecx, [eax + 0xc]
mov byte [esp + 0x538], 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40281c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402843
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x538], esi
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x402867
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x530]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x518]
xor ecx, esp
call fcn.00418154
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.004019b0
test eax, eax
jne 0x4027d6
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov byte [esp + 0x538], 0xe
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x40]
mov byte [esp + 0x53c], 0xf
mov eax, dword [esp + 0x24]
push edx
push eax
mov ecx, ebx
mov edx, edi
call fcn.0040c5b0
add esp, 0xc
call fcn.004177a0
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x40], edi
mov byte [esp + 0x538], 0x10
test byte [0x441254], 1
jne 0x402943
or dword [0x441254], 1
push 0x1c
lea ecx, [esp + 0x78]
push ecx
push fcn.004095b0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [esp + 0x78]
mov dword [0x441250], edx
mov ecx, dword [0x441250]
push 0x104
lea eax, [esp + 0x320]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x402983
mov ecx, 0x104
lea eax, [esp + 0x40]
call fcn.004015c0
mov edi, dword [esp + 0x40]
push edi
lea ebx, [esp + 0x320]
call fcn.0040f7e0
mov eax, dword [edi - 8]
add esp, 4
push eax
push edi
call fcn.00418fdc
add esp, 8
test eax, eax
jl 0x4022ac
cmp eax, dword [edi - 8]
jg 0x4022ac
mov dword [edi - 0xc], eax
xor edx, edx
mov word [edi + eax*2], dx
lea eax, [esp + 0x50]
push eax
mov ecx, 0x42c39c
call fcn.004034c0
mov byte [esp + 0x538], 0x11
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x538], 0x12
push ecx
mov ecx, dword [0x4410d8]
call fcn.00403570
mov ebx, eax
lea esi, [esp + 0x1c]
mov byte [esp + 0x538], 0x13
call fcn.00416ff0
push edi
push 4
mov byte [esp + 0x540], 0x14
mov edx, dword [ebx]
mov ecx, dword [esp + 0x58]
push 2
push edx
mov edx, dword [eax]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
push str.username_s__mac_s__error_s_s__worktype_d_d__version_s
lea edi, [esp + 0x6c]
call fcn.004016c0
mov byte [esp + 0x558], 0x13
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0x12
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x538], 0x15
mov edx, dword [esp + 0x4c]
push 1
lea ecx, [esp + 0x20]
call fcn.00415d90
add esp, 4
mov byte [esp + 0x538], 0x16
mov ecx, dword [eax]
push ecx
push str._report.php_typeclientdata_s
lea edi, [esp + 0x38]
call fcn.004016c0
mov byte [esp + 0x540], 0x15
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402b06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x3c]
xor esi, esi
cmp dword [edi - 0xc], esi
jle 0x402cd3
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
lea ecx, [eax + 0x10]
mov dword [esp + 0x2c], ecx
lea eax, [edi - 0x10]
lea edi, [ecx - 0x10]
mov byte [esp + 0x538], 0x17
cmp eax, edi
je 0x402b83
cmp dword [edi + 0xc], esi
lea ebx, [edi + 0xc]
jl 0x402b72
mov ecx, dword [eax]
cmp ecx, dword [edi]
jne 0x402b72
call fcn.004014f0
mov esi, eax
or edx, 0xffffffff
lock xadd dword [ebx], edx
dec edx
test edx, edx
jg 0x402b69
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
add esi, 0x10
mov dword [esp + 0x2c], esi
jmp 0x402b83
mov eax, dword [esp + 0x3c]
mov ebx, dword [eax - 0xc]
push eax
lea eax, [esp + 0x30]
call fcn.00401450
lea eax, [esp + 0x2c]
push eax
call fcn.00403680
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov bl, 0x18
mov byte [esp + 0x538], bl
mov edx, dword [esp + 0x4c]
push 1
lea ecx, [esp + 0x4c]
call fcn.00415d90
add esp, 4
mov byte [esp + 0x538], 0x19
mov ecx, dword [eax]
mov edx, dword [esp + 0x24]
push ecx
push edx
push str.https:___s_report.php_typeclientdata_s
lea edi, [esp + 0x28]
call fcn.004016c0
mov byte [esp + 0x544], bl
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402c07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
push str.Host:
push ecx
lea ecx, [esp + 0x34]
call fcn.00401270
mov byte [esp + 0x540], 0x1a
mov eax, dword [eax]
mov esi, dword [esp + 0x24]
push eax
mov edx, esi
lea ecx, [esp + 0x54]
call fcn.00401bb0
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402c57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], bl
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402c7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x538], 0x17
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ca2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0x15
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e8d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x402e8d
lea ecx, [esp + 0x54]
push ecx
call fcn.00403dd0
mov dword [esp + 0x74], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov byte [esp + 0x538], 0x1c
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x538], 0x1d
mov edx, dword [0x44030c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44030c
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov bl, 0x1e
mov edx, str.035eebbf588b9c839b68bd177d4d70ac5e3e9fdc3632b43a617d75452128e81c4e033423e2abd7becedc34bdf3c5ffd9
lea ecx, [esp + 0x44]
mov byte [esp + 0x538], bl
call fcn.00415f70
lea edi, [esp + 0x1c]
mov byte [esp + 0x538], 0x1f
call fcn.00401360
mov byte [esp + 0x538], bl
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
push ecx
mov ecx, edi
call fcn.00403430
mov byte [esp + 0x538], 0x20
mov eax, dword [eax]
push eax
lea edx, [esp + 0x48]
push edx
call fcn.00405d30
add esp, 8
mov byte [esp + 0x538], 0x21
mov ebx, dword [eax]
lea eax, [esp + 0x2c]
call fcn.00403600
mov byte [esp + 0x538], 0x20
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ddc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0x1e
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x58]
push edx
push eax
push edi
mov ecx, ebx
call fcn.00405f80
lea eax, [ebx - 0x10]
add esp, 0x10
mov byte [esp + 0x538], 0x1d
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x538], 0x1c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x74]
test eax, eax
je 0x402e7b
push eax
call fcn.00418163
add esp, 4
lea ecx, [esp + 0x54]
push ecx
mov byte [esp + 0x53c], 0x15
call fcn.00403020
mov byte [esp + 0x538], 0x12
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402eb5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0x11
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402edd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0x10
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0xf
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0xe
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f55
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0xc
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0xb
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402fa5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 4
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402fcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x538], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ff5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x538], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40285b