Function at 0x415790
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469b52
mov eax, dword fs:[0]
push eax
sub esp, 0x39c
mov eax, dword [0x487244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
mov esi, dword [ebp + 0xc]
jg 0x4157d1
mov eax, 1
jmp 0x4159c4
push 0
lea ecx, [ebp - 0x27a]
call fcn.00412290
push eax
lea ecx, [ebp - 0x27a]
call fcn.004097e0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 8
push eax
mov dword [ebp - 0x280], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
mov ecx, 0x48a2c8
call fcn.00413630
mov dword [ebp - 0x2e0], 1
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d4], 0
call fcn.00413480
mov ecx, eax
call fcn.00422450
push 0
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x298]
push eax
call sub.gdiplus.dll_GdiplusStartup
test eax, eax
je 0x415896
mov esi, 1
jmp 0x4159b7
mov edx, dword [esi + 4]
mov ecx, edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4158b0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00409480
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 1
call fcn.00411e40
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0xe8]
push eax
mov byte [ebp - 4], 2
call fcn.00413210
push str.host_type
lea ecx, [ebp - 0xe8]
call fcn.00413540
test eax, eax
jne 0x41590a
xor edx, edx
jmp 0x41590d
lea edx, [eax + 0x3a]
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415924
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00409480
push str.header
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 3
call fcn.00413540
test eax, eax
je 0x415997
add eax, 0x3a
je 0x415997
cmp dword [eax], 0x10080
jne 0x415997
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 7
cmovae eax, dword [ebp - 0x28]
push str.pendant
push dword [ebp - 0x18]
push eax
call fcn.00411c80
add esp, 0x10
test al, al
je 0x4159e0
sub esp, 0x68
lea eax, [ebp - 0xe8]
mov ecx, esp
push eax
call fcn.00411cf0
call fcn.004149e0
add esp, 0x68
mov esi, 1
lea ecx, [ebp - 0x28]
call fcn.00407de0
lea ecx, [ebp - 0xe8]
call fcn.00412110
lea ecx, [ebp - 0x40]
call fcn.00407de0
lea ecx, [ebp - 0x27a]
call fcn.00409910
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429ded
mov esp, ebp
pop ebp
ret
push str.Process_started.
call fcn.0040d270
add esp, 4
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0xe8]
push 0x46f378
push eax
call fcn.00413420
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmovae eax, dword [ebp - 0x70]
push eax
push 0
push 0x100001
call edi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 0x279], 0
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 5
push eax
call fcn.0041713e
lea eax, [ebp - 0x284]
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x279]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x294]
push eax
push 0x4119a0
push 0x48a314
call fcn.00417824
add esp, 0x10
test eax, eax
je 0x415e0e
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 7
push eax
call fcn.00417178
mov esi, dword [0x48a310]
lea ecx, [ebp - 0x289]
add esp, 4
mov byte [ebp - 4], 4
call fcn.004121b0
push eax
mov ecx, esi
call fcn.0040be20
lea eax, [ebp - 0x278]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov byte [ebp - 0x279], 0
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 0xa
push eax
call fcn.0041713e
lea eax, [ebp - 0x284]
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x279]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x294]
push eax
push 0x40e500
push 0x48a1f0
call fcn.00417824
add esp, 0x10
test eax, eax
je 0x415df1
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 0xc
push eax
call fcn.00417178
mov ecx, dword [0x48a1ec]
add esp, 4
mov byte [ebp - 4], 4
push str.http:__ss.shanhutech.cn_bizhi_pidpidmidmidmid2mid2appverappvermodvermodvertypetypeactionaction
push str.bizhi
push 0
call fcn.0041b440
push 0x46f480
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00413420
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xf
cmovae eax, dword [ebp - 0x58]
push eax
push 0
push 0x100001
call edi
push str.Process_connection_ready.
mov dword [ebp - 0x288], eax
call fcn.0040d270
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0x46f294
add esp, 4
mov dword [ebp - 0x2bc], 0
movups xmmword [ebp - 0x2cc], xmm0
mov dword [ebp - 0x2b8], 0
mov ebx, dword [0x4897c4]
add ebx, 0x10
mov byte [ebp - 4], 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x48a2fc]
mov edi, eax
push 4
mov eax, dword [esi + 8]
inc eax
push eax
push dword [esi]
call fcn.00436444
add esp, 0xc
test eax, eax
je 0x415c17
mov dword [esi], eax
mov eax, dword [esi + 8]
push 4
inc eax
push eax
push dword [esi + 4]
call fcn.00436444
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x415c17
mov eax, dword [esi + 8]
mov dword [esi + 4], ecx
lea edx, [eax*4]
mov eax, dword [esi]
add eax, edx
je 0x415c05
mov dword [eax], edi
mov ecx, dword [esi + 4]
lea eax, [ecx + edx]
test eax, eax
je 0x415c14
lea ecx, [ebp - 0x2d0]
mov dword [eax], ecx
inc dword [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x288]
lea ecx, [ebp - 0x3a8]
call fcn.00415eb0
push dword [ebp - 0x298]
movaps xmm0, xmmword [0x46f4e0]
lea eax, [ebp - 0x388]
push eax
push 0x487118
push 0x487028
push 0x48a368
mov byte [ebp - 4], 0x11
movups xmmword [ebp - 0x80], xmm0
call fcn.0040a020
add esp, 0x14
movzx eax, ax
lea ecx, [ebp - 0x3a8]
push 0
push eax
push 0
push 0x40000
push 0xcf0000
push 0x46d6bc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.0040ae30
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, 1
xor esi, esi
test ebx, ebx
je 0x415ccc
nop dword [eax + eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2b4]
push eax
call edi
test eax, eax
jne 0x415ccc
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
push esi
call dword [eax + 4]
inc esi
test eax, eax
jne 0x415ca0
xor ebx, ebx
push 0
push 0
push 0
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x415c97
test eax, eax
je 0x415d62
lea eax, [ebp - 0x2b4]
push eax
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
call dword [eax]
test eax, eax
jne 0x415d1b
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x2b0]
cmp eax, 0x118
ja 0x415d36
je 0x415d52
cmp eax, 0xf
je 0x415d52
cmp eax, 0xa0
jmp 0x415d3b
cmp eax, 0x200
je 0x415d52
mov ecx, 1
xor eax, eax
test ecx, ecx
mov ebx, ecx
cmove eax, esi
mov esi, eax
jmp 0x415c97
xor ecx, ecx
xor eax, eax
test ecx, ecx
cmove eax, esi
mov esi, eax
jmp 0x415c97
mov ecx, 0x48a2c8
call fcn.00414cf0
call fcn.00413480
mov ecx, eax
call fcn.00422620
push str.Process_gone.
call fcn.0040d270
add esp, 4
lea ecx, [ebp - 0x3a8]
xor esi, esi
call fcn.00415fa0
mov eax, dword [ebp - 0x2c0]
test eax, eax
je 0x415dab
push eax
call fcn.0043643f
add esp, 4
mov dword [ebp - 0x2c0], esi
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2bc], esi
mov dword [ebp - 0x2b8], esi
test eax, eax
je 0x415dd0
push eax
call fcn.0043643f
add esp, 4
mov dword [ebp - 0x2cc], esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x2c8], esi
mov dword [ebp - 0x2c4], esi
call fcn.00407e30
lea ecx, [ebp - 0x70]
call fcn.00407e30
jmp 0x41599c
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 0xd
push eax
call fcn.00417199
add esp, 4
mov byte [ebp - 4], 0xb
test al, al
je 0x415e3d
jmp 0x415e27
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 8
push eax
call fcn.00417199
add esp, 4
mov byte [ebp - 4], 6
jmp 0x415e08
sub esp, 8
lea eax, [ebp - 0x284]
mov ecx, esp
push eax
call fcn.00407d50
call fcn.004096b0
call fcn.004178d3
int3