Function at 0x433fb5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa74
mov eax, dword [0x5c2460]
xor eax, esp
mov dword [esp + 0xa70], eax
and dword [esp + 8], 0
lea eax, [esp + 0x1b4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
call fcn.0041fa7f
mov ecx, eax
call fcn.004202a2
lea eax, [esp + 0x140]
mov byte [esp + 0xf], 1
push eax
push ecx
push ecx
lea eax, [esp + 0x1cc]
mov ecx, esp
push eax
call fcn.004050d6
lea ecx, [esp + 0xa4]
call fcn.00458fb0
mov ecx, eax
call fcn.00459820
lea ecx, [esp + 0x98]
call fcn.00459030
cmp dword [edi + 0x10], 0
je 0x4340d0
push ecx
push ecx
mov esi, esp
mov eax, 0x54a910
push eax
mov dword [esi], eax
call fcn.004049e1
mov dword [esi + 4], eax
lea eax, [esp + 0xa4]
pop ecx
push eax
push ecx
push ecx
mov esi, esp
mov eax, str.Installer
push eax
mov dword [esi], eax
call fcn.004049e1
pop ecx
mov dword [esi + 4], eax
lea eax, [esp + 0x124]
push eax
sub esp, 0xc
mov ecx, esp
push edi
call fcn.004050d6
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0x168]
call fcn.00459bb0
pop ecx
mov ecx, eax
call fcn.00459bb0
mov ecx, eax
call fcn.00459bb0
push eax
lea ecx, [esp + 0x144]
call fcn.00459060
lea ecx, [esp + 0x98]
call fcn.00459030
lea ecx, [esp + 0x110]
call fcn.00459030
lea ecx, [esp + 0xb0]
call fcn.00459030
push ecx
lea ecx, [esp + 0x20]
call fcn.0045e910
call fcn.00404df6
cmp dword [edi + 0x10], 0
je 0x43411b
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43411b
lea ecx, [esp + 0x140]
call fcn.00457b40
test al, al
je 0x43411b
push dword [esp + 0x1c]
lea ecx, [esp + 0x144]
call fcn.0045a5b0
xor edi, edi
mov byte [esp + 0x13], 0
pop ecx
inc edi
jmp 0x43418d
lea eax, [esp + 0x98]
push eax
call fcn.0041fa7f
mov ecx, eax
call fcn.004202a2
push ecx
push ecx
mov ecx, esp
push eax
call fcn.004050d6
lea ecx, [esp + 0xb8]
call fcn.00458fb0
xor edi, edi
lea ecx, [esp + 0x98]
push 0
inc edi
push edi
call fcn.0040536f
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x15c]
call fcn.0045e9b0
push eax
lea ecx, [esp + 0x20]
call fcn.0045eae0
lea ecx, [esp + 0x158]
call fcn.0045eb50
lea ecx, [esp + 0xb0]
call fcn.00459030
mov esi, dword [0x768cd0]
xor eax, eax
push 0x81e
push eax
mov word [esp + 0x260], ax
lea eax, [esp + 0x262]
push eax
call fcn.005091d0
add esp, 0xc
xor eax, eax
cmp byte [ebx], al
setne al
xor ebx, ebx
push eax
push ebx
push ebx
push str._d__d__d
push 0xffffffffffffffff
lea eax, [esp + 0x26c]
push 0x410
push eax
call fcn.005038e8
add esp, 0x1c
lea ecx, [esp + 0xc8]
push str.do_shortcut
call fcn.0040503c
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x9c]
call fcn.004058f0
push eax
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f2d0
push ebx
push edi
lea ecx, [esp + 0xa0]
call fcn.0040536f
push ebx
push edi
lea ecx, [esp + 0xd0]
call fcn.00405320
call fcn.004213c1
push eax
lea ecx, [esp + 0xe4]
call fcn.00409846
cmp byte [0x768a08], bl
je 0x4343d5
cmp dword [esp + 0xf0], ebx
je 0x4343d5
mov esi, 0x54cf48
push esi
call fcn.004049e1
pop ecx
push eax
push ebx
push esi
lea ecx, [esp + 0xec]
call fcn.00407878
lea ecx, [esp + 0xb0]
cmp eax, 0xffffffff
je 0x4343f5
push 7
pop esi
xor eax, eax
mov dword [esp + 0xc4], esi
push 5
mov word [esp + 0xb4], ax
lea eax, [esp + 0xe4]
push ebx
push eax
mov dword [esp + 0xcc], ebx
call fcn.004059ba
mov edx, str.http:
lea ecx, [esp + 0xb0]
call fcn.004153e9
push 0
push edi
lea ecx, [esp + 0xb8]
mov bl, al
call fcn.0040536f
test bl, bl
je 0x4342f9
mov esi, str.https:
push esi
call fcn.004049e1
pop ecx
push eax
push esi
push 5
xor ebx, ebx
lea ecx, [esp + 0xec]
push ebx
call fcn.004090f1
jmp 0x43438e
and dword [esp + 0xc0], 0
lea ecx, [esp + 0xb0]
xor eax, eax
mov dword [esp + 0xc4], esi
push 6
push eax
mov word [esp + 0xb8], ax
lea eax, [esp + 0xe8]
push eax
call fcn.004059ba
mov edx, str.https:
lea ecx, [esp + 0xb0]
call fcn.004153e9
mov bl, al
lea ecx, [esp + 0xb0]
push 0
neg bl
push edi
sbb bl, bl
call fcn.0040536f
inc bl
je 0x43438c
lea eax, [esp + 0xe0]
mov edx, str.https:__
push eax
lea ecx, [esp + 0x9c]
call fcn.00415489
pop ecx
push eax
lea ecx, [esp + 0xe4]
call fcn.004075c9
xor ebx, ebx
lea ecx, [esp + 0x98]
push ebx
push edi
call fcn.0040536f
jmp 0x43438e
xor ebx, ebx
push str.set_homepage_overwrite
lea ecx, [esp + 0xb4]
call fcn.0040503c
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x20]
call fcn.0045f270
push ebx
push edi
lea ecx, [esp + 0xb8]
call fcn.00405320
sub esp, 0x18
lea eax, [esp + 0xf8]
mov ecx, esp
push eax
call fcn.00409846
jmp 0x43464d
push 0x54cfb4
mov ecx, esi
call fcn.0045f070
test al, al
je 0x43441a
cmp dword [esp + 0xf0], ebx
je 0x43441a
lea ecx, [esp + 0xb0]
push str.set_homepage_overwrite
call fcn.0040503c
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f2d0
jmp 0x4343b0
cmp byte [0x5c38da], bl
je 0x4345e7
call fcn.004332be
cmp byte [eax + 0x19], bl
je 0x43460e
mov eax, str.exe_path
push eax
mov dword [esp + 0x18], eax
call fcn.00404a2a
pop ecx
mov ecx, dword [0x768cd0]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x114]
push eax
call fcn.0045f170
push ecx
push ecx
mov ecx, esp
push eax
call fcn.004050d6
lea ecx, [esp + 0xa0]
call fcn.00458fb0
push ebx
push edi
lea ecx, [esp + 0x118]
call fcn.0040536f
lea eax, [esp + 0x110]
push eax
push ecx
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0xa4]
call fcn.004599a0
pop ecx
mov ecx, eax
call fcn.00459ae0
push eax
lea ecx, [esp + 0xfc]
call fcn.00409846
lea ecx, [esp + 0x110]
call fcn.00459030
lea ecx, [esp + 0x158]
call fcn.00459030
push 0x53fc30
lea ecx, [esp + 0xcc]
call fcn.004058f0
push edi
push 0xffffffffffffffff
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x2b
push eax
lea ecx, [esp + 0x104]
call fcn.00435d43
test eax, eax
je 0x434532
push 0xffffffffffffffff
inc eax
lea ecx, [esp + 0xfc]
push eax
lea eax, [esp + 0x160]
push eax
call fcn.004075ee
push eax
lea ecx, [esp + 0xcc]
call fcn.004075c9
push ebx
push edi
lea ecx, [esp + 0x160]
call fcn.0040536f
push str.https:__hao.360.cn__srclmls
lea ecx, [esp + 0xb4]
call fcn.004058f0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0xbc]
call fcn.00415344
push str.set_homepage_overwrite
lea ecx, [esp + 0x114]
call fcn.0040503c
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f2d0
push ebx
push edi
lea ecx, [esp + 0x118]
call fcn.00405320
sub esp, 0x18
lea eax, [esp + 0xc8]
mov ecx, esp
push eax
call fcn.00409846
push 4
pop ecx
call fcn.00430d84
add esp, 0x18
lea ecx, [esp + 0xb0]
push ebx
push edi
call fcn.0040536f
push ebx
push edi
lea ecx, [esp + 0xd0]
call fcn.0040536f
push ebx
push edi
lea ecx, [esp + 0x100]
call fcn.0040536f
lea ecx, [esp + 0x98]
call fcn.00459030
jmp 0x434658
call fcn.00420cd4
mov esi, eax
mov ecx, esi
call fcn.00420cf2
cmp dword [esi], edi
jne 0x434658
mov edx, 0x53fc30
lea ecx, [esp + 0xe0]
call fcn.004153e9
test al, al
je 0x434658
push str.set_homepage_overwrite
lea ecx, [esp + 0x9c]
call fcn.0040503c
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x20]
call fcn.0045f270
push ebx
push edi
lea ecx, [esp + 0xa0]
call fcn.00405320
sub esp, 0x18
mov ecx, esp
push str.https:__hao.360.cn
call fcn.004058f0
push 4
pop ecx
call fcn.00430d84
add esp, 0x18
call fcn.00420cd4
mov esi, eax
mov ecx, esi
call fcn.00420cf2
cmp dword [esi], edi
je 0x434959
call fcn.004332be
cmp byte [eax + 0x19], 0
jne 0x434959
push str.hao.360.cn
call fcn.00433cc7
push str.so.com
call fcn.00433cc7
xor eax, eax
mov dword [esp + 0xdc], 7
lea ecx, [esp + 0xc8]
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], ax
call fcn.0043111b
test al, al
je 0x43494a
mov esi, 0x541184
push esi
call fcn.004049e1
pop ecx
push eax
push ebx
push esi
lea ecx, [esp + 0xd4]
call fcn.00407878
mov esi, eax
mov dword [esp + 0x10], ebx
cmp esi, 0xffffffff
je 0x43472e
push esi
push ebx
lea eax, [esp + 0x100]
push eax
lea ecx, [esp + 0xd4]
call fcn.004075ee
cmp dword [esp + 0x10c], 8
mov eax, dword [esp + 0xf8]
jae 0x434715
lea eax, [esp + 0xf8]
push eax
call fcn.005046d1
pop ecx
push ebx
push edi
lea ecx, [esp + 0x100]
mov dword [esp + 0x18], eax
call fcn.0040536f
push 0xffffffffffffffff
lea ecx, [esi + 1]
push ecx
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0xd4]
call fcn.004075ee
push eax
lea ecx, [esp + 0xcc]
call fcn.004075c9
push ebx
push edi
lea ecx, [esp + 0x160]
call fcn.0040536f
push 0x54bc00
lea ecx, [esp + 0x9c]
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
call fcn.004058f0
lea eax, [esp + 0xf8]
push eax
lea edx, [esp + 0x9c]
lea ecx, [esp + 0xcc]
call fcn.004675b0
pop ecx
push ebx
push edi
lea ecx, [esp + 0xa0]
call fcn.0040536f
mov esi, dword [esp + 0xf8]
xor eax, eax
mov word [esp + 0xb0], ax
mov eax, dword [esp + 0xfc]
sub eax, esi
mov dword [esp + 0xc0], ebx
push 0x18
cdq
pop ecx
idiv ecx
mov byte [esp + 0xe], bl
xor ebx, ebx
mov dword [esp + 0xc4], 7
mov edi, ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x43492f
dec eax
mov dword [esp + 0x3c], eax
jmp 0x434802
xor ebx, ebx
push esi
lea ecx, [esp + 0x1dc]
call fcn.00480141
push 0xa
push str.haosou.com
lea ecx, [esp + 0x1e0]
call fcn.004802d1
test al, al
je 0x4348b9
push 0x54cfcc
call fcn.004049e1
pop ecx
push eax
push ebx
push 0x54cfcc
mov ecx, esi
call fcn.00407878
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4348b9
push 0x54cffc
call fcn.004049e1
pop ecx
push eax
push 0x54cffc
push 6
push ebx
mov ecx, esi
call fcn.004090f1
mov bl, 1
lea ecx, [esp + 0x1d8]
push 0x54cf1c
mov byte [esp + 0x12], bl
call fcn.0048025a
test al, al
je 0x4348bd
mov ebx, 0x541160
push ebx
call fcn.004049e1
pop ecx
push eax
push 0
push ebx
mov ecx, esi
call fcn.00407878
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4348b9
push 0x54183c
call fcn.004049e1
pop ecx
push eax
push 0x54183c
push 4
push ebx
mov ecx, esi
call fcn.004090f1
mov bl, byte [esp + 0xe]
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esp + 0xbc]
call fcn.00415344
cmp edi, dword [esp + 0x3c]
jae 0x4348f1
push 0x54bc00
call fcn.004049e1
pop ecx
push eax
push 0x54bc00
lea ecx, [esp + 0xb8]
call fcn.004152a1
lea ecx, [esp + 0x1d8]
call fcn.00480218
inc edi
add esi, 0x18
cmp edi, dword [esp + 0x14]
jb 0x434800
test bl, bl
je 0x43492d
sub esp, 0x18
lea eax, [esp + 0xc8]
mov ecx, esp
push eax
call fcn.00409846
mov ecx, dword [esp + 0x28]
call fcn.00430d84
add esp, 0x18
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0xb8]
call fcn.0040536f
lea ecx, [esp + 0xf8]
call fcn.00407966
push ebx
push 1
lea ecx, [esp + 0xd0]
call fcn.0040536f
cmp byte [0x768c24], 0
je 0x434993
push str.restore_4_overwrite
lea ecx, [esp + 0x9c]
call fcn.0040503c
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x20]
call fcn.0045f270
push ebx
push 1
lea ecx, [esp + 0xa0]
call fcn.00405320
push 7
pop edi
xor eax, eax
mov dword [esp + 0x13c], edi
mov dword [esp + 0x138], ebx
mov word [esp + 0x128], ax
call fcn.004211f0
push 0x53fc30
mov esi, eax
call fcn.004049e1
pop ecx
push eax
push 0x53fc30
lea ecx, [esp + 0x130]
call fcn.00405941
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x134]
call fcn.00415344
cmp dword [esi + 0x1c], ebx
jbe 0x434a23
push str.silent_install
lea ecx, [esp + 0x9c]
call fcn.0040503c
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f2d0
push ebx
push 1
lea ecx, [esp + 0xa0]
call fcn.00405320
call fcn.004213c1
cmp byte [eax + 0x31], 0
je 0x434a5f
push str.no_welcome_page
lea ecx, [esp + 0x9c]
call fcn.0040503c
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x20]
call fcn.0045f270
push ebx
push 1
lea ecx, [esp + 0xa0]
call fcn.00405320
call fcn.004213c1
add eax, 0x4c
lea ecx, [esp + 0x1a8]
push eax
call fcn.00409846
cmp dword [esp + 0x1b8], 0
je 0x434ab7
push str.set_adfilter_mode
lea ecx, [esp + 0x9c]
call fcn.0040503c
lea eax, [esp + 0x1a8]
push eax
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f2d0
push ebx
push 1
lea ecx, [esp + 0xa0]
call fcn.00405320
cmp dword [0x765d74], 0
je 0x434af6
push 0x54ac44
lea ecx, [esp + 0x9c]
call fcn.0040503c
push 0x765d64
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f2d0
push ebx
push 1
lea ecx, [esp + 0xa0]
call fcn.00405320
xor eax, eax
mov dword [esp + 0x1a4], edi
mov dword [esp + 0x1a0], ebx
mov word [esp + 0x190], ax
call fcn.0041fa7f
lea eax, [esp + 0x190]
push eax
call fcn.00420137
call fcn.0041fa7f
mov ecx, eax
call fcn.004206b3
test al, al
je 0x434b89
push str.true
lea ecx, [esp + 0x114]
call fcn.004058f0
push str.have_user_data_dir
lea ecx, [esp + 0x9c]
call fcn.0040503c
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f2d0
push ebx
push 1
lea ecx, [esp + 0xa0]
call fcn.00405320
push ebx
push 1
lea ecx, [esp + 0x118]
call fcn.0040536f
push ecx
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x24]
call fcn.0045f720
push 0x40
lea eax, [esp + 0x58]
push ebx
push eax
call fcn.005091d0
add esp, 0xc
mov dword [esp + 0x50], 0x44
cmp byte [esp + 0xf], 0
je 0x434bca
push 5
mov dword [esp + 0x80], 1
pop eax
jmp 0x434bcc
xor eax, eax
cmp dword [esp + 0x18c], 8
mov word [esp + 0x80], ax
mov eax, dword [esp + 0x178]
jae 0x434bec
lea eax, [esp + 0x178]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x434c1c
push dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x40]
call esi
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x180]
call fcn.0040536f
push 0
push 1
lea ecx, [esp + 0x198]
call fcn.0040536f
push 0
push 1
lea ecx, [esp + 0x1b0]
call fcn.0040536f
push 0
push 1
lea ecx, [esp + 0x130]
call fcn.0040536f
push 0
push 1
lea ecx, [esp + 0xe8]
call fcn.0040536f
lea ecx, [esp + 0x1c]
call fcn.0045eb50
lea ecx, [esp + 0x140]
call fcn.00459030
push 0
push 1
lea ecx, [esp + 0x1c8]
call fcn.0040536f
mov ecx, dword [esp + 0xa7c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00501d03
mov esp, ebp
pop ebp
ret 4