Function at 0x40a150
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e30fc
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x515854]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x515854]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
cmp dword [0x518568], 0
je 0x40a1d9
cmp byte [0x518570], 0
mov eax, dword [0x518558]
je 0x40a1b4
cmp dword [0x51856c], 8
jae 0x40a1b0
mov eax, 0x518558
push 3
jmp 0x40a1c4
cmp dword [0x51856c], 8
jae 0x40a1c2
mov eax, 0x518558
push 6
push 0
push eax
push str.iexplore.exe
push 0x4ec958
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [0x51bf98], 0
je 0x40a2ab
cmp byte [0x51c390], 0
je 0x40a2ab
mov eax, dword [0x51c618]
lea ecx, [esp + 0x18]
push ecx
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 2
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
lea ecx, [esp + 0x14]
push ecx
mov byte [eax], 1
mov eax, dword [0x51c618]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 3
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov esi, 0x51c358
mov byte [eax], 1
call fcn.0041f780
cmp dword [0x51c388], 0
je 0x40a263
call fcn.00429050
cmp byte [0x51c391], 0
je 0x40a276
mov esi, 0x51c3cc
call fcn.0040c8d0
call fcn.00429530
test al, al
je 0x40a2ab
mov eax, dword [0x51c618]
lea ecx, [esp + 0x14]
push ecx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 4
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
xor ebx, ebx
xor ebp, ebp
nop
mov esi, dword [0x51bfa0]
mov ecx, dword [esi + 4]
xor edi, edi
cmp ecx, edi
je 0x40a47f
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 4
cmp ebx, eax
jae 0x40a47f
mov esi, dword [esi + 4]
add esi, ebp
cmp byte [esi + 4], 0
je 0x40a385
cmp byte [esi + 0xc], 0
je 0x40a474
mov eax, dword [0x51c618]
lea ecx, [esp + 0x14]
push ecx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 2
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
lea ecx, [esp + 0x14]
push ecx
mov byte [eax], 1
mov eax, dword [0x51c618]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 3
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov esi, 0x51c358
mov byte [eax], 1
call fcn.0041f780
cmp dword [0x51c388], edi
je 0x40a35b
call fcn.00429050
cmp byte [0x51c391], 0
je 0x40a36e
mov esi, 0x51c3cc
call fcn.0040c8d0
call fcn.00429530
test al, al
je 0x40a474
mov eax, dword [0x51c618]
jmp 0x40a44d
cmp byte [esi + 0xc], 0
je 0x40a474
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 2
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
lea eax, [esp + 0x2c]
call fcn.00430484
mov dword [esp + 0xac], edi
mov ecx, dword [esi + 8]
push ecx
push eax
call fcn.0042b0f0
add esp, 8
mov dword [esp + 0xac], 0xffffffff
cmp dword [esp + 0x44], 8
mov edi, eax
jb 0x40a3f7
mov edx, dword [esp + 0x30]
push edx
call fcn.004b6eae
add esp, 4
xor eax, eax
sub edi, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], eax
mov word [esp + 0x30], ax
je 0x40a420
sub edi, 2
jne 0x40a474
mov eax, dword [esi + 8]
mov dword [esp + 0x18], 3
jmp 0x40a455
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 3
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
mov eax, dword [esi + 8]
mov dword [esp + 0x18], 4
lea ecx, [esp + 0x14]
push ecx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
add ebx, 1
add ebp, 0x10
jmp 0x40a2b0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0xac], 1
mov eax, dword [0x51c330]
cmp eax, edi
je 0x40a615
mov ecx, dword [0x51c334]
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40a615
push 0x51c32c
lea ecx, [esp + 0x20]
push ecx
call fcn.0042b760
xor ebx, ebx
xor ebp, ebp
mov esi, dword [esp + 0x20]
xor edi, edi
cmp esi, edi
je 0x40a615
mov ecx, dword [esp + 0x24]
sub ecx, esi
mov eax, 0x38e38e39
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x40a615
mov edx, dword [esi + ebp + 0x11c]
lea eax, [esp + 0x14]
push eax
push ecx
add esi, ebp
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 1
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
mov edx, dword [esi + 0x11c]
lea eax, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 2
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
lea eax, [esp + 0x2c]
call fcn.00430484
push esi
mov ecx, eax
mov byte [esp + 0xb0], 2
call fcn.0042aa80
add esp, 4
mov byte [esp + 0xac], 1
cmp dword [esp + 0x44], 8
mov edi, eax
jb 0x40a599
mov edx, dword [esp + 0x30]
push edx
call fcn.004b6eae
add esp, 4
sub edi, 0
je 0x40a5ad
sub edi, 2
jne 0x40a607
mov dword [esp + 0x18], 3
jmp 0x40a5e2
mov eax, dword [esi + 0x11c]
lea ecx, [esp + 0x14]
push ecx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 3
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
mov dword [esp + 0x18], 4
mov eax, dword [esi + 0x11c]
lea ecx, [esp + 0x14]
push ecx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], eax
call fcn.0042bbf0
add esp, 4
call fcn.0042bd10
mov byte [eax], 1
add ebx, 1
add ebp, 0x120
jmp 0x40a4d5
xor esi, esi
xor eax, eax
mov ebx, 7
mov dword [esp + 0x98], ebx
mov dword [esp + 0x94], eax
mov word [esp + 0x84], ax
lea edi, [esi + 1]
push edi
lea eax, [esp + 0x30]
push esi
push eax
mov byte [esp + 0xb8], 3
call fcn.0042b150
add esp, 0xc
mov byte [esp + 0xac], 4
mov ecx, dword [0x5184f8]
mov ebp, 8
cmp dword [0x51850c], ebp
jae 0x40a66e
mov ecx, 0x5184f8
cmp dword [eax + 0x18], ebp
jb 0x40a678
mov eax, dword [eax + 4]
jmp 0x40a67b
add eax, 4
push ecx
mov ecx, dword [esp + 0xb8]
push eax
push esi
push ecx
push str.http:__css.jipinfeiche.cn_advert_v4_setup_stat.php_type_dstep_d_s_s
lea ecx, [esp + 0x94]
call fcn.0042f79a
add esp, 0x14
mov byte [esp + 0xac], 3
cmp dword [esp + 0x44], ebp
jb 0x40a6b5
mov edx, dword [esp + 0x30]
push edx
call fcn.004b6eae
add esp, 4
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x68]
push ecx
call fcn.00441a17
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x70]
mov byte [esp + 0xb8], 5
call fcn.00442c8d
add esp, 0xc
push eax
call fcn.004424b2
add esp, 4
cmp dword [esp + 0x60], 0x10
jb 0x40a6fd
mov eax, dword [esp + 0x4c]
push eax
call fcn.004b6eae
add esp, 4
cmp dword [esp + 0x7c], ebp
jb 0x40a710
mov ecx, dword [esp + 0x68]
push ecx
call fcn.004b6eae
add esp, 4
xor eax, eax
mov byte [esp + 0xac], 1
cmp dword [esp + 0x98], ebp
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x78], eax
mov word [esp + 0x68], ax
jb 0x40a740
mov edx, dword [esp + 0x84]
push edx
call fcn.004b6eae
add esp, 4
mov esi, edi
cmp esi, 4
jl 0x40a617
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40a77c
mov edi, dword [esp + 0x24]
cmp esi, edi
je 0x40a773
jmp 0x40a760
call fcn.00409f20
add esi, 0x120
cmp esi, edi
jne 0x40a760
mov esi, dword [esp + 0x20]
push esi
call fcn.004b6eae
add esp, 4
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.004b6e9f
add esp, 0x9c
ret