Function at 0x41ef40
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5a9426
mov eax, dword fs:[0]
push eax
sub esp, 0xe7c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0xe78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0xe90]
mov dword fs:[0], eax
mov eax, dword [esp + 0xea4]
mov ebx, ecx
push ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [0x5fdb9c]
push 0xffffffffffffffeb
push ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x130b
push edx
call esi
cmp eax, 8
ja 0x41fb3e
mov eax, dword [0x5fdb9c]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 3
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov eax, dword [esp + 0xea0]
add eax, 0xfffffc15
cmp eax, 0xe3
ja case.0x41effc.1004
movzx ecx, byte [eax + 0x41fba8]
jmp dword [ecx*4 + 0x41fb6c]
push 0x24
push 0x5bdca0
push 0x5bdca8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x41effc.1004
cmp dword [0x6035e0], 0
jne 0x41f06c
mov edx, dword [0x5fdb9c]
push 0xffffffffffffffeb
push edx
mov dword [0x6035e0], 1
call dword [sym.imp.USER32.dll_GetWindowLongW]
lea edi, [eax + 0x3c]
mov dword [esp + 0x24], 9
lea esp, [esp]
mov eax, dword [edi]
test eax, eax
je 0x41f062
push 0
push 0
push 0xbd2
push eax
call esi
add edi, 4
sub dword [esp + 0x24], 1
jne 0x41f050
lea eax, [esp + 0x74]
call fcn.0040c700
lea eax, [esp + 0x74]
push eax
call fcn.0041e030
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
jmp case.0x41effc.1004
push 1
push 0x3fe
push ebx
call ebp
push eax
call edi
push 0
push 0x4a3
push ebx
call ebp
push eax
call edi
push 0
push 0x401
push ebx
call ebp
push eax
call edi
push 0
push 0x400
push ebx
call ebp
push eax
call edi
push 0
push 0x578
push ebx
call ebp
push eax
call edi
push 1
push 0x401
push ebx
call ebp
push eax
call edi
jmp case.0x41effc.1004
push 0
push 0x3fe
push ebx
call ebp
push eax
call edi
push 1
push 0x4a3
push ebx
call ebp
push eax
call edi
push 1
push 0x401
push ebx
call ebp
push eax
call edi
push 1
push 0x400
push ebx
call ebp
push eax
call edi
push 0
push 0x405
push ebx
call ebp
push eax
call edi
push 1
push 0x578
push ebx
call ebp
push eax
call edi
push 0
push 0x401
push ebx
call ebp
push eax
call edi
jmp case.0x41effc.1004
push 0
push 0
push 0xf0
push 0x4c5
push ebx
call ebp
push eax
call esi
test eax, eax
je 0x41f16f
push 1
push 0x4c6
push ebx
call ebp
push eax
call edi
push 1
jmp 0x41f17e
push 0
push 0x4c6
push ebx
call ebp
push eax
call edi
push 0
push 0x4c7
push ebx
call ebp
push eax
call edi
mov dword [0x5fe5c8], 1
jmp case.0x41effc.1004
push 0
push 0
push 0xf0
push 0x402
push ebx
call ebp
push eax
call esi
test eax, eax
je 0x41f23d
push 1
push 0x403
push ebx
call ebp
push eax
call edi
push 1
push 0x4c8
push ebx
call ebp
push eax
call edi
cmp dword [0x5ff77c], 0
jne 0x41f1ed
lea eax, [esp + 0x74]
call fcn.0040c700
mov ecx, dword [esp + 0x4c8]
mov dword [0x5ff77c], ecx
push 0
push 0
push 0x147
push 0x4c6
push ebx
call ebp
push eax
call esi
cmp eax, 1
jne case.0x41effc.1004
push 0
push 0
push 0xf1
push 0x4c5
push ebx
call ebp
push eax
call esi
push 0
push 0x4c6
push ebx
call ebp
push eax
call edi
push 0
push 0x4c7
push ebx
call ebp
push eax
call edi
jmp case.0x41effc.1004
push 0
push 0x403
push ebx
call ebp
push eax
call edi
push 0
push 0x4c8
push ebx
call ebp
push eax
call edi
push 0
push 0
push 0x147
push 0x4c6
push ebx
call ebp
push eax
call esi
cmp eax, 1
jne case.0x41effc.1004
push 0
push eax
push 0xf1
push 0x4c5
push ebx
call ebp
push eax
call esi
push 1
push 0x4c6
push ebx
call ebp
push eax
call edi
push 1
push 0x4c7
push ebx
call ebp
push eax
call edi
jmp case.0x41effc.1004
mov edx, dword [esp + 0x28]
mov eax, dword [0x5fe658]
push 0
push 0x42a8e0
push edx
push 0x7d
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x41effc.1004
push 1
push 0x4ad
push ebx
call ebp
push eax
call edi
jmp case.0x41effc.1004
push 0
push 0x4ad
push ebx
call ebp
push eax
call edi
jmp case.0x41effc.1004
push 0
push 1
push 0xf1
push 0x4f3
push ebx
call ebp
push eax
call esi
push 0
push 0
push 0xf1
push 0x4f4
push ebx
call ebp
push eax
call esi
push 1
push 0x4f3
push ebx
call ebp
push eax
call edi
push 1
push 0x4f4
push ebx
call ebp
push eax
call edi
jmp case.0x41effc.1004
push 0
push 0
push 0xf1
push 0x4f3
push ebx
call ebp
push eax
call esi
push 0
push 1
push 0xf1
push 0x4f4
push ebx
call ebp
push eax
call esi
push 0
jmp 0x41f313
push 0
push 0
push 0x147
push 0x4c6
push ebx
call ebp
push eax
call esi
lea ecx, [esp + 0xc84]
push ecx
push eax
push 0x148
push 0x4c6
push ebx
call ebp
push eax
call esi
lea esi, [esp + 0x2c]
call fcn.0041fc90
lea edx, [esp + 0xc84]
push edx
mov dword [esp + 0xe9c], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov edi, esi
call fcn.00420350
cmp eax, 1
jne 0x41f3f0
call fcn.0040cbf0
mov esi, dword [0x5fe584]
mov dword [0x5fe580], 1
mov byte [esi + 0x99d], 1
call fcn.0040cbf0
call fcn.00486380
test eax, eax
jne 0x41f3e9
push eax
push esi
call fcn.0040cc60
mov byte [0x5fdb97], 1
lea eax, [esp + 0x2c]
mov dword [esp + 0xe98], 0xffffffff
call fcn.0041fcf0
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x41effc.1004
lea ebx, [esp + 0x1c]
call fcn.004747c0
mov eax, ebx
mov dword [esp + 0xe98], 1
call fcn.0047aca0
mov edx, str.QQPYWizard.exe
mov edi, ebx
call fcn.00412930
mov eax, dword [esp + 0x1c]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, ebx
mov dword [esp + 0xe98], 0xffffffff
call fcn.00404510
mov ebx, dword [esp + 0x18]
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x41effc.1004
push 0
push 0
push 0xf0
push 0x4ce
push ebx
call ebp
push eax
call esi
mov dword [0x602068], eax
jmp case.0x41effc.1004
push 0
push 0
push 0xf0
push 0x4cc
push ebx
call ebp
push eax
call esi
mov dword [0x602070], eax
mov ecx, dword [esp + 0xea0]
mov eax, ecx
shr eax, 0x10
cmp ax, 7
jne 0x41f527
cmp cx, 0x4c3
jne 0x41fb37
cmp dword [0x6035e4], 0
jne 0x41fb37
mov ecx, dword [0x5fdb9c]
push 0xffffffffffffffeb
push ecx
mov dword [0x6035e4], 1
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
lea esi, [eax + 0x3c]
mov edi, 9
mov eax, dword [esi]
test eax, eax
je 0x41f517
push 0
push 0
push 0xbd2
push eax
call ebx
add esi, 4
sub edi, 1
jne 0x41f505
lea eax, [edi + 1]
jmp 0x41fb40
cmp ax, 1
jne 0x41fb37
cmp cx, 0x4c3
jne 0x41fb26
mov eax, dword [esp + 0x20]
mov edx, dword [0x5f912c]
push 0
push 0
push 0x147
push eax
mov dword [esp + 0x38], edx
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x24], eax
je 0x41fb3e
test eax, eax
jne 0x41f725
cmp dword [0x5f912c], eax
je 0x41fb08
push eax
push eax
push 0xf1
push 0x4ac
push ebx
mov dword [0x5f912c], eax
call ebp
push eax
call esi
push 1
push 0x4ab
push ebx
call ebp
push eax
call edi
push 1
push 0x4ac
push ebx
call ebp
push eax
call edi
push 0
push 1
push 0xf1
push 0x4ab
push ebx
call ebp
push eax
call esi
push 0
push 0x4ad
push ebx
call ebp
push eax
call edi
push 0
push 0
push 0xf1
push 0x4ad
push ebx
call ebp
push eax
call esi
push 0
push 3
push 0x14e
push 0x48b
push ebx
call ebp
push eax
call esi
push 0
push 0
push 0x14e
push 0x4c6
push ebx
call ebp
push eax
call esi
mov ecx, dword [0x5fdb9c]
push 0xffffffffffffffeb
push ecx
mov dword [0x5fe5c8], 1
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 1
push 0xf1
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 0x44]
push 0x489
push eax
mov dword [esp + 0x30], eax
call ebp
push eax
call esi
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0xf1
push 0x48a
push edx
call ebp
push eax
call esi
mov eax, dword [esp + 0x1c]
push 0
push 0x4a0
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0xf1
push 0x4a0
push ecx
call ebp
push eax
call esi
mov edx, dword [esp + 0x1c]
push 0
push 0x489
push 0x111
push edx
call esi
mov eax, dword [esp + 0x20]
xor ecx, ecx
push ecx
push ecx
push 0xf0
mov dword [0x601d5c], ecx
mov dword [0x601d60], ecx
mov eax, dword [eax + 0x40]
push 0x479
push eax
mov dword [esp + 0x34], eax
call ebp
push eax
call esi
test eax, eax
jne 0x41f6db
mov ecx, dword [esp + 0x20]
push eax
push 1
push 0xf1
push 0x44d
push ecx
call ebp
push eax
call esi
push 0
push 0x4cb
push ebx
call ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x4ce
push ebx
call ebp
push eax
call edi
push 1
push 0x4cc
push ebx
call ebp
push eax
call edi
push 0
mov edi, 1
push edi
push 0xf1
push 0x4ce
push ebx
call ebp
push eax
call esi
push 0
jmp 0x41fae7
mov ecx, 1
cmp eax, ecx
jne 0x41f949
cmp dword [0x5f912c], ecx
je 0x41fb0f
push 0
push ecx
push 0xf1
push 0x4ac
push ebx
mov dword [0x5f912c], ecx
call ebp
push eax
call esi
push 1
push 0x4ab
push ebx
call ebp
push eax
call edi
push 1
push 0x4ac
push ebx
call ebp
push eax
call edi
push 0
push 0
push 0xf1
push 0x4ab
push ebx
call ebp
push eax
call esi
push 1
push 0x4ad
push ebx
call ebp
push eax
call edi
push 0
push 0
push 0xf1
push 0x4ad
push ebx
call ebp
push eax
call esi
push 0
push 7
push 0x14e
push 0x48b
push ebx
call ebp
push eax
call esi
push 0x4c5
push ebx
call ebp
push 0
push 1
push 0xf1
push eax
call esi
push 0x4c6
push ebx
call ebp
push 1
push eax
call edi
push 0x4c7
push ebx
call ebp
push 1
push eax
call edi
push 0
push 1
push 0x14e
push 0x4c6
push ebx
call ebp
push eax
call esi
mov dword [0x5fe5c8], 1
push 0xffffffffffffffeb
mov edx, dword [0x5fdb9c]
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 1
mov dword [esp + 0x24], eax
mov eax, dword [eax + 0x44]
push 0x4a0
push eax
mov dword [esp + 0x24], eax
call ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x18]
push 0
push 1
push 0xf1
push 0x4a0
push eax
call ebp
push eax
call esi
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0xf1
push 0x489
push ecx
call ebp
push eax
call esi
mov edx, dword [esp + 0x18]
push 0
push 1
push 0xf1
push 0x48a
push edx
call ebp
push eax
call esi
mov eax, dword [esp + 0x18]
push 0
push 0x48a
push 0x111
push eax
call esi
mov ecx, dword [esp + 0x20]
push 0
push 0
mov eax, 1
push 0xf1
mov dword [0x601d5c], eax
mov dword [0x601d60], eax
mov eax, dword [ecx + 0x40]
push 0x44d
push eax
call ebp
push eax
call esi
push 5
push 0x4cb
push ebx
call ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040cbf0
mov eax, dword [0x5fe584]
mov edx, dword [eax + 0x440]
push 0
push edx
push 0xf1
push 0x4cb
push ebx
mov dword [0x5fe580], 1
call ebp
push eax
call esi
push 1
push 0x4ce
push ebx
call ebp
push eax
call edi
push 1
push 0x4cc
push ebx
call ebp
push eax
call edi
xor edi, edi
push edi
push edi
push 0xf1
push 0x4ce
push ebx
call ebp
push eax
call esi
push edi
push edi
push 0xf1
push 0x4cc
push ebx
call ebp
push eax
call esi
mov eax, dword [esp + 0x24]
mov dword [0x602070], edi
mov dword [0x602068], edi
jmp 0x41fb0f
mov ecx, 2
cmp eax, ecx
jne 0x41fb08
cmp dword [0x5f912c], ecx
je 0x41fb08
push 0
push 0
push 0xf1
push 0x4ac
push ebx
mov dword [0x5f912c], ecx
call ebp
push eax
call esi
push 1
push 0x4ab
push ebx
call ebp
push eax
call edi
push 0
push 0x4ac
push ebx
call ebp
push eax
call edi
push 0
push 1
push 0xf1
push 0x4ab
push ebx
call ebp
push eax
call esi
push 0
push 0x4ad
push ebx
call ebp
push eax
call edi
push 0
push 0
push 0xf1
push 0x4ad
push ebx
call ebp
push eax
call esi
push 0
push 7
push 0x14e
push 0x48b
push ebx
call ebp
push eax
call esi
mov eax, dword [0x5fdb9c]
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 1
push 0xf1
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 0x44]
push 0x489
push eax
mov dword [esp + 0x2c], eax
call ebp
push eax
call esi
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0xf1
push 0x48a
push ecx
call ebp
push eax
call esi
mov edx, dword [esp + 0x18]
push 0
push 0x4a0
push edx
call ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x18]
push 0
push 0
push 0xf1
push 0x4a0
push eax
call ebp
push eax
call esi
mov ecx, dword [esp + 0x18]
push 0
push 0x489
push 0x111
push ecx
call esi
xor eax, eax
push eax
push eax
push 0x14e
push 0x4c6
push ebx
mov dword [0x601d5c], eax
mov dword [0x601d60], eax
call ebp
push eax
call esi
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x40]
push 0
push 0
push 0xf1
push 0x44d
push eax
mov dword [0x5fe5c8], 1
call ebp
push eax
call esi
push 0
push 0x4cb
push ebx
call ebp
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x4ce
push ebx
call ebp
push eax
call edi
push 0
push 0x4cc
push ebx
call ebp
push eax
call edi
xor edi, edi
push edi
push edi
push 0xf1
push 0x4ce
push ebx
call ebp
push eax
call esi
push edi
push edi
push 0xf1
push 0x4cc
push ebx
call ebp
push eax
call esi
mov eax, dword [esp + 0x24]
mov dword [0x602068], edi
mov dword [0x602070], edi
cmp dword [esp + 0x28], 1
jne 0x41fb37
cmp eax, dword [esp + 0x28]
je 0x41fb37
mov dword [0x5fe5c8], 1
mov eax, 1
jmp 0x41fb40
cmp cx, 0x4c6
jne 0x41fb37
mov dword [0x5fe5c8], 1
mov eax, 1
jmp 0x41fb40
xor eax, eax
mov ecx, dword [esp + 0xe90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe78]
xor ecx, esp
call fcn.005787fd
add esp, 0xe88
ret 8