Function at 0x4015ba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x436e5c
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x45a6d0]
xor eax, esp
mov dword [esp + 0x2d8], eax
push ebx
push esi
push edi
mov eax, dword [0x45a6d0]
xor eax, esp
push eax
lea eax, [esp + 0x2f0]
mov dword fs:[0], eax
lea esi, [esp + 0x18]
call fcn.00401e89
lea eax, [esp + 0x1ac]
push eax
call fcn.00401030
lea eax, [esp + 0x1ac]
xor ebx, ebx
push eax
mov dword [esp + 0x2fc], ebx
call sym.jsService.exe_public:_static_class_AppSetting____cdecl_AppSetting::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_int___thiscall_AppSetting::loadSetting_struct_AppSetting::_SettingInfo__
push 0xf
pop edi
push ebx
mov esi, 0x43b1ec
push esi
lea ecx, [esp + 0xb8]
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
call fcn.004028b2
mov byte [esp + 0x2f8], 1
push ebx
push esi
lea ecx, [esp + 0xd4]
mov dword [esp + 0xe8], edi
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
call fcn.004028b2
mov byte [esp + 0x2f8], 2
lea eax, [esp + 0x190]
cmp dword [esp + 0x1d8], ebx
jne 0x4016e7
push eax
call sym.jsService.exe_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_KpBase::GetMacAddress_void_
pop ecx
push eax
lea eax, [esp + 0x178]
push str.amsgmchmsgmac
push eax
mov byte [esp + 0x304], 3
call fcn.00402e15
add esp, 0xc
mov esi, eax
lea edi, [esp + 0xcc]
mov byte [esp + 0x2f8], 4
call fcn.00402500
push ebx
push 1
lea ecx, [esp + 0x17c]
call fcn.00402667
jmp 0x401711
push str.amsgmchmsgusername
push eax
lea edi, [esp + 0x1d0]
call fcn.00402e4c
pop ecx
pop ecx
mov esi, eax
lea edi, [esp + 0xcc]
mov byte [esp + 0x2f8], 5
call fcn.00402500
push ebx
push 1
lea ecx, [esp + 0x198]
mov byte [esp + 0x300], 2
call fcn.00402667
cmp dword [0x4637f4], ebx
je 0x401742
push str.verexmini
lea eax, [esp + 0xd0]
push eax
call fcn.0040243f
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x194]
push eax
call sym.jsService.exe_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_AyDecrypt::Encrypt_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____
push eax
lea eax, [esp + 0x110]
push str.http:__pc.xinyijiasuqi.com__cdata
push eax
mov byte [esp + 0x30c], 6
call fcn.00402e15
add esp, 0x14
push ebx
push 1
lea ecx, [esp + 0x198]
mov byte [esp + 0x300], 8
call fcn.00402667
lea eax, [esp + 0xb0]
push eax
lea edx, [esp + 0x108]
call fcn.0040b3e0
pop ecx
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x178]
push eax
call sym.jsService.exe_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_AyDecrypt::UrlDecrypt_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____
pop ecx
pop ecx
mov esi, eax
lea edi, [esp + 0xb0]
mov byte [esp + 0x2f8], 9
call fcn.00402500
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x17c]
call fcn.00402667
xor eax, eax
lea edi, [esp + 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [esp + 0x82], ax
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], 0x400
mov byte [esp + 0x2f8], 0xb
push 0x14
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.0041c0fb
pop ecx
cmp eax, ebx
je 0x401865
mov dword [eax], ebx
mov dword [eax + 4], 0x10000
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
jmp 0x401867
xor eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov byte [esp + 0x2f8], 0xc
cmp dword [esp + 0xc4], 0x10
mov eax, dword [esp + 0xb0]
jae 0x401895
lea eax, [esp + 0xb0]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x74]
push eax
lea edx, [esp + 0x14]
call fcn.004032e5
cmp word [esp + 0x82], 3
jne 0x401ccb
mov esi, dword [esp + 0x74]
shl esi, 5
add esi, dword [esp + 0x7c]
lea ebx, [esp + 0x10]
lea edx, [esp + 0x74]
call fcn.00402a04
mov eax, dword [eax]
mov edi, 0x43bd18
cmp eax, esi
je 0x401912
mov ecx, edi
lea esi, [esp + 0x74]
call fcn.00402eaa
mov ax, word [eax + 0xe]
shr ax, 0xa
test al, 1
je 0x401912
mov ecx, edi
call fcn.00402eaa
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x401909
mov eax, dword [eax + 8]
push eax
call fcn.0041bdc3
pop ecx
jmp 0x401954
mov esi, dword [esp + 0x74]
shl esi, 5
add esi, dword [esp + 0x7c]
lea ebx, [esp + 0x10]
lea edx, [esp + 0x74]
call fcn.00402a04
cmp dword [eax], esi
je 0x401d47
mov ecx, edi
lea esi, [esp + 0x74]
call fcn.00402eaa
mov al, byte [eax + 0xe]
shr al, 5
test al, 1
je 0x401d47
mov ecx, edi
call fcn.00402eaa
mov eax, dword [eax]
xor ebx, ebx
cmp eax, ebx
jne 0x401d49
cmp dword [0x4637f0], ebx
jne 0x401973
call fcn.0040227c
test eax, eax
jne 0x401d49
mov ecx, str.data
lea esi, [esp + 0x74]
call fcn.00402eaa
mov esi, eax
mov ecx, 0x43bd24
call fcn.00402eaa
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x40199b
mov eax, dword [eax + 8]
push 0xf
pop edi
push eax
lea ecx, [esp + 0x140]
mov dword [esp + 0x154], edi
mov dword [esp + 0x150], ebx
mov byte [esp + 0x140], bl
call fcn.00402544
mov ecx, 0x43bd28
mov byte [esp + 0x2f8], 0xd
call fcn.00402eaa
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x4019e0
mov eax, dword [eax + 8]
push eax
lea ecx, [esp + 0x15c]
mov dword [esp + 0x170], edi
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x15c], bl
call fcn.00402544
mov ecx, 0x43bd2c
mov byte [esp + 0x2f8], 0xe
call fcn.00402eaa
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x401a22
mov eax, dword [eax + 8]
push eax
lea ecx, [esp + 0x124]
mov dword [esp + 0x138], edi
mov dword [esp + 0x134], ebx
mov byte [esp + 0x124], bl
call fcn.00402544
mov ecx, str.time
mov byte [esp + 0x2f8], 0xf
call fcn.00402eaa
mov edx, dword [eax]
push 7
pop ecx
xor eax, eax
mov byte [esp + 0x2c8], bl
lea edi, [esp + 0x2c9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x2cc]
push 0x43bd38
push eax
call fcn.0041b6ac
add esp, 0xc
lea eax, [esp + 0x220]
push str.openurl
push eax
lea edi, [esp + 0x128]
call fcn.00402e4c
mov esi, 0x43bd3c
push esi
push eax
lea eax, [esp + 0x268]
push eax
mov byte [esp + 0x30c], 0x10
call fcn.00402f2a
add esp, 0x14
lea ecx, [esp + 0x2c8]
push ecx
push eax
lea eax, [esp + 0x2b4]
push eax
mov byte [esp + 0x304], 0x11
call fcn.00402f2a
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x27c]
push eax
mov byte [esp + 0x304], 0x12
call fcn.00402f2a
add esp, 0xc
lea ecx, [esp + 0x13c]
push ecx
lea ecx, [esp + 0x240]
push ecx
mov ecx, eax
mov byte [esp + 0x300], 0x13
call fcn.00402f61
push esi
push eax
lea eax, [esp + 0x184]
push eax
mov byte [esp + 0x30c], 0x14
call fcn.00402f2a
add esp, 0x14
lea ecx, [esp + 0x158]
push ecx
lea ecx, [esp + 0x208]
push ecx
mov ecx, eax
mov byte [esp + 0x300], 0x15
call fcn.00402f61
pop ecx
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x17c]
call fcn.00402667
push ebx
push edi
lea ecx, [esp + 0x244]
call fcn.00402667
push ebx
push edi
lea ecx, [esp + 0x27c]
call fcn.00402667
push ebx
push edi
lea ecx, [esp + 0x2b4]
call fcn.00402667
push ebx
push edi
lea ecx, [esp + 0x260]
call fcn.00402667
push ebx
push edi
lea ecx, [esp + 0x228]
mov byte [esp + 0x300], 0x1c
call fcn.00402667
lea eax, [esp + 0x290]
push esi
push eax
mov edi, 0x461eac
call fcn.00402f89
lea ecx, [esp + 0x20c]
push ecx
lea ecx, [esp + 0xf4]
push ecx
mov ecx, eax
mov byte [esp + 0x308], 0x1d
call fcn.00402f61
add esp, 0x10
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x298]
mov byte [esp + 0x300], 0x1f
call fcn.00402667
cmp dword [esp + 0xfc], 0x10
mov eax, dword [esp + 0xe8]
jae 0x401c18
lea eax, [esp + 0xe8]
push eax
call fcn.004012a1
pop ecx
test eax, eax
jne 0x401c85
push 0x44
pop edi
push edi
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.00426cd0
mov dword [esp + 0x38], edi
mov eax, esi
mov word [esp + 0x68], ax
xor eax, eax
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [esp + 0xfc], 0x10
stosd dword es:[edi], eax
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x58], esi
jae 0x401c66
lea eax, [esp + 0xe8]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x30]
push ecx
push ebx
push ebx
push 0x30
push ebx
push ebx
push ebx
push eax
push ebx
push dword [0x4637f0]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
push ebx
push esi
lea ecx, [esp + 0xf0]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0x20c]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0x128]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0x160]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0x144]
call fcn.00402667
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x2fc], 8
call fcn.0040249b
push ebx
push esi
lea ecx, [esp + 0x10c]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0xd4]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0xb8]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0x1ec]
call fcn.00402667
push ebx
push esi
lea ecx, [esp + 0x1d0]
call fcn.00402667
mov ecx, dword [esp + 0x2f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.0041b4d6
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x2fc], 8
call fcn.0040249b
xor esi, esi
inc esi
jmp 0x401cdd