Function at 0x40fe60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x408
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, eax
mov eax, dword [0x48d144]
mov ebx, 1
push 0x47f0ac
cmp eax, ebx
push 5
jne 0x40fe8a
push 0
jmp 0x40fe8b
push ebx
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push esi
call edi
cmp dword [0x48d144], ebx
je 0x40febb
mov eax, dword [0x48d14c]
test eax, eax
jne 0x40feb0
push 0x47f0a4
push 6
push 0
jmp 0x40feb8
push 0x47f098
push 6
push ebx
push esi
call edi
push ebp
push 0x47f088
push 2
push 0
push esi
call edi
push 0x47f084
push 3
push 0x800
push esi
call edi
push 0x47f07c
push ebx
push 0
push esi
call edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push ebx
mov ebp, eax
call edi
mov edi, dword [esp + 0x41c]
mov ebx, eax
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esp + 0x10]
mov eax, ebp
cdq
mov ebp, dword [esp + 0x14]
sub eax, edx
sar eax, 1
cmp ecx, eax
jl 0x40ff3b
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
cmp ebp, eax
jl 0x40ff3b
push 0
push edi
add ebx, 0xfffffff6
push 0
push ebx
push ecx
push 0x128
jmp 0x40ff5b
mov eax, ebx
push 0
cdq
sub eax, edx
push edi
sar eax, 1
cmp ebp, eax
push 0
jge 0x40ff54
push ebp
push ecx
push 0x108
jmp 0x40ff5b
push ebx
push ecx
push 0x120
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp ebx, 1
pop ebp
jne 0x40ff8b
push edi
call fcn.0042c220
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x408
ret
cmp ebx, 2
jne 0x40ffd8
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x14]
push str.1.1.1.20
rep stosd dword es:[edi], eax
push 0x480288
lea ecx, [esp + 0x1c]
push str.http:__www.researchchina.cn
push ecx
call fcn.0044186a
add esp, 0x10
lea edx, [esp + 0x14]
push 1
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
add esp, 0x408
ret
cmp ebx, 6
jne 0x410005
mov eax, dword [0x48d14c]
test eax, eax
jne 0x410025
mov eax, dword [0x48c388]
push 0
push 0
push 0x47c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
add esp, 0x408
ret
cmp ebx, 5
jne 0x410025
mov ecx, dword [0x48caf8]
push 0
push 0x4108b0
push 0
push 0x98
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebx
add esp, 0x408
ret

Function at 0x411e80
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x467f6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0x487008
call dword [0x46c22c]
mov eax, dword [esi + 4]
test eax, eax
jne 0x411ee2
push 0x50
call fcn.00460f0e
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x411ece
mov ecx, eax
call fcn.0040b860
jmp 0x411ed0
xor eax, eax
mov ecx, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 4], eax
call fcn.0040bc00
push 0
push 0
push esi
push 0x412050
push 0
push 0
call fcn.00442f8e
mov ecx, dword [esp + 0x20]
add esp, 0x18
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret