Function at 0x446ed0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b8f76
mov eax, dword fs:[0]
push eax
mov eax, 0x18fc
call fcn.00571300
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x4474e2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x18fc], eax
add eax, 0x10
mov dword [ebp - 0x1900], eax
mov dword [ebp - 4], 0
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x4474ec
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x18f8], eax
add eax, 0x10
mov dword [ebp - 0x1904], eax
mov byte [ebp - 4], 1
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x4474f6
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x18f4], eax
add eax, 0x10
mov dword [ebp - 0x1908], eax
mov byte [ebp - 4], 2
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x447500
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x18f0], eax
add eax, 0x10
mov dword [ebp - 0x18e4], eax
mov byte [ebp - 4], 3
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x446fba
push 5
jmp 0x446fe0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x446fde
push 0
push 0xf120
push 0x112
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x446fe5
push 1
push dword [ebx + 4]
call edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [0x77ced0], 0
jne 0x44744a
lea ecx, [ebx + 0x798]
mov dword [0x77ced0], 1
call fcn.00447e30
push 0
lea ecx, [ebp - 0x1078]
call fcn.00438e30
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1058]
push dword [ebp - 0x18e4]
mov esi, dword [ebx + 4]
push eax
push 0x773098
call fcn.00428980
add esp, 8
movzx eax, ax
lea ecx, [ebp - 0x1078]
push eax
push 0
push 0
push 0x96c80000
push 0
push 0
push esi
call fcn.00428810
push dword [ebx + 4]
lea ecx, [ebp - 0x1074]
call fcn.00428df0
lea ecx, [ebp - 0x8e4]
call fcn.004273c0
mov eax, dword [ebp - 0x8a4]
mov esi, dword [ebp - 0x898]
mov dword [ebp - 0x18e0], eax
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x18dc], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x18d8], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x18e8], eax
mov dword [0x77ced0], 0
call fcn.00431fb0
add eax, 0x24
lea ecx, [ebp - 0x28]
push eax
call fcn.00403020
cmp dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
sete al
mov byte [ebp - 0x18d1], al
cmp edx, 8
jb 0x447112
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x447102
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44750a
push edx
push ecx
call fcn.00468d54
mov al, byte [ebp - 0x18d1]
add esp, 8
test al, al
je 0x44712f
push 0
push dword [ebx + 0x79c]
mov dword [ebx + 0xf20], 0
call edi
jmp 0x44743f
cmp dword [ebp - 0x88c], 0
jne 0x4471f7
cmp dword [ebp - 0x888], 0
jne 0x4471f7
push 1
lea ecx, [ebp - 0x828]
mov dword [0x77ced0], 1
call fcn.00438e30
mov byte [ebp - 4], 5
lea eax, [ebp - 0x808]
push dword [ebp - 0x18e4]
mov esi, dword [ebx + 4]
push eax
push 0x773098
call fcn.00428980
add esp, 8
movzx eax, ax
lea ecx, [ebp - 0x828]
push eax
push 0
push 0
push 0x96c80000
push 0
push 0
push esi
call fcn.00428810
push dword [ebx + 4]
lea ecx, [ebp - 0x824]
call fcn.00428df0
lea ecx, [ebp - 0x94]
call fcn.004273c0
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x828]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x18e0], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18dc], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18d8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18e8], eax
mov dword [0x77ced0], 0
mov byte [ebp - 4], 4
call fcn.00439020
mov ecx, dword [ebp - 0x18e8]
mov eax, esi
or eax, ecx
je 0x447228
push ecx
push esi
push dword [ebp - 0x18d8]
push dword [ebp - 0x18dc]
push dword [ebp - 0x18e0]
call fcn.00431fb0
mov ecx, eax
call fcn.00437400
jmp 0x447424
call fcn.00431fb0
mov ecx, dword [eax + 0x60]
mov eax, dword [eax + 0x64]
mov dword [ebp - 0x18dc], ecx
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x18d8], eax
call fcn.00426f10
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb0]
mov esi, dword [ebx + 4]
call fcn.00470490
push 0x749204
lea ecx, [ebp - 0xb0]
call fcn.0046ff00
push dword [ebp - 0x18e4]
lea eax, [ebp - 0x860]
push eax
push 0x7729c8
call fcn.00428980
add esp, 8
movzx eax, ax
lea ecx, [ebp - 0x880]
push eax
push 0
push 0x80
push 0x96400000
push 0
push 0
push esi
call fcn.00428810
push 0
lea ecx, [ebp - 0x87c]
call fcn.00428df0
mov esi, dword [ebp - 0x87c]
push 8
call fcn.00468d62
mov edi, eax
add esp, 4
mov dword [ebp - 0x18e0], edi
mov dword [edi], esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 8
call fcn.00423ea0
mov dword [ebp - 0x24], 0x7484f0
mov dword [ebp - 0x18e0], 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18ec]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x24]
call fcn.00423f50
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x447312
push 8
push eax
call fcn.00468d54
add esp, 8
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
push esi
call fcn.0046ace4
add esp, 4
test eax, eax
je 0x447332
push eax
call fcn.0046ad77
add esp, 4
push esi
call fcn.0046ac28
add esp, 4
push edi
call fcn.0046bbef
add esp, 4
lea ecx, [ebp - 0x18ec]
mov byte [ebp - 4], 0xb
call fcn.00449370
lea ecx, [ebp - 0xec]
call fcn.004273c0
cmp dword [ebp - 0xb4], 2
jne 0x4473d1
push str.getuifailed
push ecx
call fcn.00436350
mov ecx, eax
call fcn.0040dc60
mov esi, dword [ebx + 4]
lea ecx, [ebp - 0x18d0]
call fcn.00426f10
push 0x749244
push esi
lea ecx, [ebp - 0x18d0]
mov byte [ebp - 4], 0xc
call fcn.00426de0
lea ecx, [ebp - 0x18d0]
mov byte [ebp - 4], 0xb
mov esi, eax
call fcn.00427000
cmp esi, 2
jne 0x4473fe
push 5
push 0
push 0
push str.http:__win.55kantu.com_kf.html
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.userclickfeedback
jmp 0x4473f1
call fcn.00431fb0
mov ecx, dword [ebp - 0x18dc]
cmp dword [eax + 0x60], ecx
jne 0x4473ec
mov ecx, dword [ebp - 0x18d8]
cmp dword [eax + 0x64], ecx
je 0x4473fe
push str.websetvipfailed
push ecx
call fcn.00436350
mov ecx, eax
call fcn.0040dc60
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18e8], 0
jne 0x44750f
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 4
call fcn.00427000
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x79c]
mov dword [ebx + 0xf20], 0
call edi
mov ecx, ebx
call fcn.00447bf0
lea ecx, [ebp - 0x1078]
call fcn.00439020
mov edx, dword [ebp - 0x18f0]
or esi, 0xffffffff
mov byte [ebp - 4], 2
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44746b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18f4]
mov eax, esi
mov byte [ebp - 4], 1
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447489
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18f8]
mov eax, esi
mov byte [ebp - 4], 0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4474a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18fc]
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4474c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004222a0
push 0x80004005
call fcn.004222a0
push 0x80004005
call fcn.004222a0
push 0x80004005
call fcn.004222a0
call fcn.00533dd1
call fcn.0053983e
int3