Function at 0x417e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593936
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x604654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xb0]
push 0x84
push 0
push eax
call fcn.0053c7b0
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0xb0]
add esp, 0xc
mov eax, dword [ecx]
push edx
call dword [eax + 8]
push str.btn_menu_setting
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0
call fcn.004a5be0
test al, al
je 0x417f10
push 0
push 0
push 0x428
push dword [edi + 0x314]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x41829f
push str.btn_menu_feedback
lea ecx, [ebp - 0xb0]
call fcn.004a5be0
test al, al
je 0x4180e8
mov eax, dword [0x60cfd4]
mov dword [ebp - 0x14], 0
test al, 1
jne 0x417f83
or eax, 1
mov dword [0x60cfd0], 0
xorps xmm0, xmm0
mov dword [0x60cfd4], eax
movq qword [0x60cfc8], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5a87f0
mov dword [0x60cfc8], 0x5aabc8
mov dword [0x60cfcc], eax
mov byte [0x60cfd0], 0
call fcn.004a4076
mov eax, dword [0x60cfd4]
add esp, 4
test al, 2
jne 0x417fdf
or eax, 2
mov dword [0x60cfd8], 0x5aabe0
mov dword [0x60cfd4], eax
xor eax, eax
push 0x5a8820
mov dword [0x60cfdc], 0x60cfc8
mov dword [0x60cfec], 2
mov dword [0x60cfe4], 0
mov dword [0x60cfe8], 0
mov dword [0x60cff0], eax
mov dword [0x60cfe0], 0x60cfd8
call fcn.004a4076
add esp, 4
mov eax, dword [0x60cfd8]
mov ecx, 0x60cfd8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, str.http:__www1.ludashi.com_service_fromdzippidpidmidmidm2mid2appverappverososinstdateinstdate
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x418010
movzx eax, ax
push eax
call fcn.00412300
jmp 0x41801c
push 0x73
push str.http:__www1.ludashi.com_service_fromdzippidpidmidmidm2mid2appverappverososinstdateinstdate
call fcn.0040e8d0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.0040de10
add esp, 8
mov ecx, dword [eax]
or esi, 0xffffffff
mov edi, dword [ebp - 0x14]
add edi, 0xfffffff0
mov byte [ebp - 4], 3
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x418094
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x418088
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x418088
push edx
call fcn.00417940
add esp, 4
mov dword [ebp - 0xb8], eax
mov ecx, esi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x418080
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xb8]
add eax, 0x10
mov dword [ebp - 0x14], eax
jmp 0x418094
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040e8d0
mov edx, dword [ebp - 0xb4]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4180b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0
push 0
push dword [ebp - 0x14]
push 0x5ab858
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x41829f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41829f
push str.btn_recover_default
lea ecx, [ebp - 0xb0]
call fcn.004a5be0
test al, al
je 0x4181c0
call fcn.00461c40
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.004179e0
push str.LinkType
push 0x5ab71c
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0
push ecx
mov ecx, eax
call fcn.0040f6e0
mov esi, dword [0x60fb4c]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x4181a5
mov dword [ebp - 0xb4], 0
add eax, 0x10
lea ecx, [ebp - 0x2c]
push eax
call fcn.00417630
mov byte [ebp - 4], 4
call fcn.004179e0
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
push str.LinkType
cmovae ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.0040f6e0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040c130
lea ecx, [ebp - 0x14]
call fcn.0040c1d0
mov eax, dword [ebp - 0x14]
cmp eax, esi
jne 0x418156
mov ecx, dword [edi + 0x318]
push 0
mov eax, dword [ecx]
call dword [eax + 0x114]
mov ecx, dword [edi + 0x31c]
jmp 0x418295
push str.btn_take_over
lea ecx, [ebp - 0xb0]
call fcn.004a5be0
test al, al
je 0x41829f
call fcn.004613c0
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.004179e0
push str.LinkType
push 0x5ab71c
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb4], 1
push ecx
mov ecx, eax
call fcn.0040f6e0
mov esi, dword [0x60fb4c]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x41827f
mov dword [ebp - 0xb4], 1
nop
add eax, 0x10
lea ecx, [ebp - 0x2c]
push eax
call fcn.00417630
mov byte [ebp - 4], 5
call fcn.004179e0
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
push str.LinkType
cmovae ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.0040f6e0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040c130
lea ecx, [ebp - 0x14]
call fcn.0040c1d0
mov eax, dword [ebp - 0x14]
cmp eax, esi
jne 0x418230
mov ecx, dword [edi + 0x31c]
push 0
mov eax, dword [ecx]
call dword [eax + 0x114]
mov ecx, dword [edi + 0x318]
mov eax, dword [ecx]
push 1
call dword [eax + 0x114]
lea ecx, [ebp - 0xb0]
call fcn.00462810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a408b
mov esp, ebp
pop ebp
ret 4