Function at 0x4030a0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40601b
push eax
mov dword fs:[0], esp
sub esp, 0x86c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x888]
xor ebp, ebp
cmp esi, ebp
jne 0x4030d2
xor eax, eax
jmp 0x404080
mov eax, dword [0x409cec]
lea ecx, [esp + 0x14]
push eax
xor ebx, ebx
call fcn.00401740
lea ecx, [esp + 0x14]
mov dword [esp + 0x880], ebp
call fcn.004017f0
test eax, eax
jne 0x403112
lea ecx, [esp + 0x14]
mov dword [esp + 0x880], 0xffffffff
call fcn.00401800
xor eax, eax
jmp 0x404080
push edi
push esi
call fcn.00402ef0
add esp, 4
cmp eax, ebp
jne 0x403140
mov dword [esi + 4], 1
add esi, 0xc
push 0x409afc
push esi
lea ecx, [esp + 0x20]
call fcn.004020c0
mov ebx, eax
jmp 0x404069
cmp eax, 0xc
je 0x404069
cmp eax, 4
jne 0x404069
mov edi, 5
push esi
mov dword [esi + 4], edi
call fcn.00402f00
add esp, 4
cmp eax, 0xbb8
jg 0x403ac0
je 0x4039f9
cmp eax, 0x21
ja case.0x403ace.3007
jmp dword [eax*4 + 0x404098]
cmp dword [esi + 0xc], 1
je 0x4031a6
push 0x1e9
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_RegisterDll___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
add esi, 0x14
lea ecx, [esp + 0x18]
push esi
call fcn.004018d0
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 1
jne 0x404069
add esi, 0x14
push esi
push str.UnregisterDll_path:_s
call fcn.004016e0
add esp, 8
lea ecx, [esp + 0x18]
push esi
call fcn.00401900
push str.ProxyIE.dll
push esi
mov ebx, eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x404069
mov ecx, dword [0x409c20]
push ebp
push ecx
call fcn.00404e30
add esp, 8
push eax
push 0x4093d0
call fcn.004016e0
add esp, 8
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x403228
push 0x20d
jmp 0x403fb9
lea edi, [esi + 0x14]
mov esi, dword [esi + 0x10]
lea esi, [esi + edi + 4]
push esi
push edi
push str.InstallClientInetComCAB_url:_s_filename:_s
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push esi
push edi
call fcn.00401960
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x403275
push 0x220
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_InstallClientInetCom___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea edi, [esi + 0x14]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + edi + 4]
push esi
push edi
push str.InstallClientInetCom_url:_s_pHideWnd:_d
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push esi
push edi
call fcn.00401920
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x4032c1
push 0x231
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_certInputOff___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
call fcn.004045d0
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 4
je 0x4032ef
push 0x23f
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_RegValueOf___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
add esi, 0x14
mov edi, dword [0x408878]
mov ecx, dword [esi + eax]
lea eax, [esi + eax + 4]
cmp edi, 1
mov edx, dword [eax + ecx]
lea ecx, [eax + ecx + 4]
lea edx, [ecx + edx + 4]
push edx
push ecx
push eax
push esi
jne 0x403326
lea ecx, [esp + 0x28]
call fcn.00401ca0
mov ebx, eax
jmp 0x404069
call fcn.00404510
add esp, 0x10
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], edi
je 0x403356
push 0x25e
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_TypeRegValueOf___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x14]
mov ecx, dword [edi + eax]
lea ebx, [edi + eax + 4]
mov eax, dword [ebx + ecx]
lea esi, [ebx + ecx + 4]
mov ebp, dword [esi + eax + 4]
mov edx, dword [esi + eax + 8]
lea eax, [esi + eax + 0xc]
mov dword [esp + 0x14], edx
push eax
push ebp
push esi
push ebx
push edi
push str.TypeRegValueOf_pRoot:_s_pKey:_s_pItem:_s_lValueType:_d_pNewVal:_s
mov dword [esp + 0x28], eax
call fcn.004016e0
mov eax, dword [0x408878]
add esp, 0x18
cmp eax, 1
jne 0x4033b7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebp
push esi
push ebx
push edi
call fcn.004042e0
add esp, 0x18
mov ebx, eax
jmp 0x404069
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push ebp
push esi
push ebx
push edi
call fcn.004042e0
add esp, 0x18
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], edi
je 0x4033f5
push 0x281
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_browseNewProcess___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
add esi, 0x14
mov ecx, dword [esi + eax]
lea edi, [esi + eax + 4]
mov eax, dword [edi + ecx]
lea ebx, [edi + ecx + 4]
mov ebp, dword [ebx + eax + 4]
lea eax, [ebx + eax + 0xc]
push eax
push ebp
push ebx
push edi
push esi
push str.browseNewProcess_pRoot:_s_pKey:_s_pItem:_s_lValueType:_d_pNewVal:_s
mov dword [esp + 0x2c], eax
call fcn.004016e0
mov ecx, dword [esp + 0x2c]
add esp, 0x18
push ecx
push ebp
push ebx
push edi
push esi
lea ecx, [esp + 0x2c]
call fcn.00401d10
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x403461
push 0x298
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_InitIPTunnel___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00401d20
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x403493
push 0x2a6
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_ConfigIPTunnel___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
add esi, 0x14
mov dl, byte [esi + eax + 4]
mov byte [esp + 0x14], dl
mov edi, dword [esp + 0x14]
and edi, 0xff
push edi
push esi
push str.ConfigIPTunnel_pStr:_s_bEncode:_d
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push edi
push esi
call fcn.00401d60
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x4034ee
push 0x2b8
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_UpdateIPTunnel___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
add esi, 0x14
lea edi, [esi + eax + 4]
push edi
push esi
push str.UpdateIPTunnel_pUrl:_s_pParam:_s
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push edi
push esi
call fcn.00401dc0
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x40353b
push 0x2ca
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_UpdateVNIC___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
add esi, 0x14
lea edi, [esi + eax + 4]
push edi
push esi
push str.UpdateVNIC_pUrl:_s_pParam:_s
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push edi
push esi
call fcn.00401eb0
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 1
je 0x403588
push 0x2dc
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_UninstallIPTunnel___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
add esi, 0x14
push esi
push str.UninstallIPTunnel_pParam:_s
call fcn.004016e0
add esp, 8
lea ecx, [esp + 0x18]
push esi
call fcn.00401e20
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 1
je 0x4035cc
push 0x2ec
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_UninstallVNIC___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
add esi, 0x14
push esi
push str.UninstallVNIC_pParam:_s
call fcn.004016e0
add esp, 8
lea ecx, [esp + 0x18]
push esi
call fcn.00401f10
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x40360f
push 0x2fc
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_IPTunnelRunningState___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00401e70
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x403640
push 0x30a
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_stopSSLService___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00402410
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x403671
push 0x318
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_SVPNMonitorRunningState___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00402090
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x4036a2
push 0x326
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_InitSVPNMonitor___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00401f60
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 1
je 0x4036d4
push 0x334
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_ConfigSVPNMonitor___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
add esi, 0x14
push esi
push str.ConfigSVPNMonitor_pStr:_s
call fcn.004016e0
add esp, 8
lea ecx, [esp + 0x18]
push esi
call fcn.00401f90
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x403717
push 0x344
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_UnistallSVPNMonitor___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00402030
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x403748
push 0x352
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_InstallSVPNMonitor___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00402060
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x40377a
push 0x360
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_UpdateSVPNMonitor___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
add esi, 0x14
lea edi, [esi + eax + 4]
push edi
push esi
push str.UpdateSVPNMonitor_pUrl:_s_pParam:_s
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push edi
push esi
call fcn.00401fe0
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x4037b2
push 0x372
jmp 0x4037e8
mov eax, dword [esi + 0x10]
add esi, 0x14
lea edi, [esi + eax + 4]
push edi
push esi
push str.RunUntilExit_pFile:_s_pParam:_s
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push edi
push esi
call fcn.004023c0
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x4037ff
push 0x384
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_RunUntilExit___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov eax, dword [esi + 0x10]
add esi, 0x14
lea edi, [esi + eax + 4]
push edi
push esi
push str.get_UpdateUCP_pUrl:_s_pParam:_s
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push edi
push esi
call fcn.00402540
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 1
jne 0x404069
add esi, 0x14
lea ecx, [esp + 0x18]
push esi
call fcn.00402500
mov ebx, eax
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00402460
mov ebx, eax
jmp 0x404069
push str.AutoPrint
call fcn.004016e0
mov eax, dword [esi + 0xc]
add esp, 4
cmp eax, 3
jne 0x404069
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
mov esi, dword [esi + 0x24]
push esi
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00401890
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 4
jne 0x404069
mov eax, dword [esi + 0x24]
mov edx, dword [esi + 0x28]
mov dword [esp + 0x14], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x7e]
mov word [esp + 0x7c], 0
mov ebx, dword [esi + 0x14]
rep stosd dword es:[edi], eax
mov ebp, dword [esi + 0x1c]
mov ecx, edx
stosw word es:[edi], ax
mov eax, ecx
add esi, 0x2c
lea edi, [esp + 0x7c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x7c]
push ecx
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push edx
push ebp
push ebx
call fcn.00401830
mov ebx, eax
jmp 0x404069
lea ecx, [esp + 0x18]
call fcn.00402490
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 1
jne 0x404069
add esi, 0x14
push esi
call fcn.00404150
add esp, 4
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], ebp
je 0x40393f
push 0x408
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_GETID___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x14], ebp
call fcn.00402590
mov ebx, eax
cmp ebx, ebp
je 0x404069
mov edi, dword [esp + 0x10]
cmp edi, ebp
je 0x404069
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [esp + 0x894]
not ecx
lea eax, [ecx + 8]
push eax
mov dword [esi], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x894]
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [edx], edi
je 0x4039d8
mov ecx, dword [esi]
xor eax, eax
mov ebp, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [edx]
mov dword [ecx], 1
mov eax, dword [edx]
mov ecx, dword [esi]
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x10]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [edx]
not ecx
dec ecx
add edi, 8
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
push str.hardid__s
call fcn.004016e0
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
jmp 0x404069
push str.
call fcn.004016e0
add esp, 4
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], ebp
push edx
call fcn.00402620
mov ebx, eax
cmp ebx, ebp
je 0x404069
mov edi, dword [esp + 0x10]
cmp edi, ebp
je 0x404069
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [esp + 0x894]
not ecx
lea eax, [ecx + 8]
push eax
mov dword [esi], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x894]
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [edx], edi
je 0x403a9f
mov ecx, dword [esi]
xor eax, eax
mov ebp, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [edx]
mov dword [eax], 1
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [ecx + 4], eax
mov esi, dword [esp + 0x10]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [edx]
not ecx
dec ecx
add edi, 8
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
push str.AllHardId__s
call fcn.004016e0
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
jmp 0x404069
add eax, 0xfffff447
cmp eax, 0xb
ja case.0x403ace.3007
jmp dword [eax*4 + 0x404120]
add esi, 0x14
push esi
push str._wyy___s
call fcn.004016e0
add esp, 8
cmp esi, ebp
je 0x404069
push esi
lea ecx, [esp + 0x1c]
call fcn.00402a60
mov ebx, eax
jmp 0x404069
movsx ecx, byte [esi + 0x10]
lea ebp, [esi + 0x14]
lea edi, [esp + 0x3c]
mov eax, dword [ecx + ebp]
lea esi, [ecx + ebp + 4]
mov edx, dword [esi + eax + 4]
mov ecx, dword [esi + eax + 0xc]
mov dword [esp + 0x34], edx
mov edx, dword [esi + eax + 0x14]
mov eax, dword [esi + eax + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edi, [esp + 0x38]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
test edx, edx
mov dword [esp + 0x30], eax
je 0x403b93
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403b93
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403b93
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 0x80]
mov ecx, dword [sym.imp.MSVCP60.dll_struct_std::nothrow_t_const_std::nothrow]
push ecx
push eax
call fcn.00405fa6
mov edi, eax
add esp, 8
test edi, edi
je 0x404069
push esi
push ebp
push str.__s___s
push edi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x24]
lea eax, [esp + 0x38]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edi
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
test esi, esi
jne 0x403c21
call ebp
push eax
push str._bbs__CreatePrcess_Error__u
call fcn.004016e0
add esp, 8
push str._bbs__CreatePrcess_Succ
call fcn.004016e0
mov edi, dword [esp + 0x38]
add esp, 4
push edi
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x403c6d
mov ecx, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x24]
push edx
call esi
push edi
call ebp
push eax
push str._bbs__OpenProcess_error__u_dwID___u
call fcn.004016e0
add esp, 0xc
jmp 0x404069
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [esp + 0x24]
push 0
push 0
lea ecx, [esp + 0x18]
push 0x1f0fff
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [esp + 0x10]
push eax
push str._bbs__hTargetHandle___x
call fcn.004016e0
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
push ecx
call edi
mov edx, dword [esp + 0x24]
push edx
call edi
push esi
call edi
mov ebx, dword [esp + 0x10]
jmp 0x404069
add esi, 0x14
xor ebx, ebx
cmp esi, ebp
je 0x404069
mov ecx, 0x41
xor eax, eax
mov edi, 0x409b00
mov ebx, 1
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x409b00
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x404069
push 0x408c58
call fcn.004016e0
mov eax, dword [esi]
add esp, 4
cmp eax, 0x18
jb 0x403d34
cmp dword [esi + 0xc], 1
je 0x403d2e
xor ebx, ebx
jmp 0x404069
cmp dword [esi + 0x10], 4
je 0x403d3b
xor ebx, ebx
jmp 0x404069
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.00402820
and eax, 0xff
mov ebx, eax
je 0x404069
cmp dword [esp + 0x10], ebp
je 0x404069
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x894]
add eax, 8
push eax
mov dword [esi], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x894]
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [edx], edi
je 0x403dd5
mov ecx, dword [esi]
xor eax, eax
mov ebp, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [edx]
mov dword [ecx], 1
mov eax, dword [edx]
mov ecx, dword [esi]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [edx]
mov esi, dword [esp + 0x10]
mov edx, ecx
add edi, 8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
push 0x408c48
call fcn.004016e0
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
jmp 0x404069
push str._UB_
call fcn.004016e0
mov eax, dword [esi + 0xc]
add esp, 4
cmp eax, 2
je 0x403e19
push eax
push str._UB__UBCHECKDLL
call fcn.004016e0
add esp, 8
lea edi, [esi + 0x14]
mov esi, dword [esi + 0x10]
lea esi, [esi + edi + 4]
push esi
push edi
push 0x408bd0
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push esi
push edi
call fcn.00402910
mov ebx, eax
jmp 0x404069
push 0x408ba4
call fcn.004016e0
mov eax, dword [esi + 0xc]
add esp, 4
cmp eax, 3
je 0x403e6c
cmp eax, 2
je 0x403e6c
push eax
push str._UB__UBINSTALLDLL
call fcn.004016e0
add esp, 8
lea edi, [esi + 0x14]
mov esi, dword [esi + 0x10]
mov eax, dword [esi + edi]
lea ebx, [esi + edi + 4]
add eax, esi
lea esi, [eax + edi + 8]
push esi
push ebx
push edi
push str._UB__URL___s
call fcn.004016e0
add esp, 0x10
lea ecx, [esp + 0x18]
push esi
push ebx
push edi
call fcn.00402960
mov ebx, eax
jmp 0x404069
push 0x408b30
call fcn.004016e0
mov eax, dword [esi + 0xc]
add esp, 4
cmp eax, edi
je 0x403ec9
push eax
push 0x408b04
call fcn.004016e0
add esp, 8
jmp 0x404069
lea ebx, [esi + 0x14]
mov esi, dword [esi + 0x10]
mov eax, dword [esi + ebx]
lea edi, [esi + ebx + 4]
mov ecx, dword [eax + edi + 4]
mov esi, dword [eax + edi + 0xc]
cmp ecx, 0x4a
mov dword [esp + 0x14], ecx
jne 0x403f26
mov ecx, dword [eax + edi + 0x10]
lea eax, [eax + edi + 0x14]
push eax
push ecx
xor edx, edx
push esi
push str.WM_COPYDATA
mov dword [esp + 0x38], edx
push edi
push ebx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x44], edx
push str.pClassName___s__pWindowName___s__msg___s__wparam___02x__data.cbData___d___data.lpData___s
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
lea ebp, [esp + 0x40]
call fcn.004016e0
mov ecx, dword [esp + 0x30]
add esp, 0x1c
jmp 0x403f2a
mov ebp, dword [eax + edi + 0x14]
push ebp
push esi
push ecx
push edi
push ebx
push str.pClassName___s__pWindowName___s__msg___02x__wparam___02x__lparam___02x
call fcn.004016e0
mov eax, dword [esp + 0x2c]
add esp, 0x18
lea ecx, [esp + 0x18]
push ebp
push esi
push eax
push edi
push ebx
call fcn.004029b0
mov ebx, eax
jmp 0x404069
push 0x408a28
call fcn.004016e0
mov eax, dword [esi + 0xc]
add esp, 4
cmp eax, 4
je 0x403f7d
push eax
push str._SinforPromote__POSTMESSAGE
call fcn.004016e0
add esp, 8
jmp 0x404069
mov edi, dword [esi + 0x14]
mov ebx, dword [esi + 0x1c]
mov ebp, dword [esi + 0x24]
mov esi, dword [esi + 0x2c]
push esi
push ebp
push ebx
push edi
push str._SinforPromote__HWND___02x__msg___02x__wparam___02x__lparam___02x
call fcn.004016e0
add esp, 0x14
lea ecx, [esp + 0x18]
push esi
push ebp
push ebx
push edi
call fcn.00402a00
mov ebx, eax
jmp 0x404069
cmp dword [esi + 0xc], 2
je 0x403fd0
push 0x4db
push str.E:M4.2M4.21_srcwindowsSINFORPROMOTESinforPromote.cpp
push str.__s__d_InstallClientInetComCAB___The_count_of_Param_is_Wrong_
call fcn.004016e0
add esp, 0xc
jmp 0x404069
lea edi, [esi + 0x14]
mov esi, dword [esi + 0x10]
lea esi, [esi + edi + 4]
push esi
push edi
push str.copyfile_sourcepath:_s_despath:_s
call fcn.004016e0
add esp, 0xc
lea ecx, [esp + 0x18]
push esi
push edi
call fcn.00402a20
mov ebx, eax
jmp 0x404069
mov edx, dword [esi + 0xc]
xor eax, eax
xor ecx, ecx
xor edi, edi
cmp edx, 2
jne 0x404012
mov ecx, dword [esi + 0x10]
lea eax, [esi + 0x14]
lea ecx, [ecx + eax + 4]
jmp 0x404025
cmp edx, 3
jne 0x404025
mov edx, dword [esi + 0x10]
lea eax, [esi + 0x14]
lea ecx, [edx + eax + 4]
lea edi, [edx + ecx + 4]
push edi
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.004017a0
mov ebx, eax
jmp 0x404069
push str._SinforPromote__CSCM
call fcn.004016e0
add esp, 4
push ebp
push 0x408874
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [0x409d20]
push ebp
push ebp
push 0x464
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, eax
jmp 0x404069
or ebx, 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x884], 0xffffffff
call fcn.00401800
mov eax, ebx
pop edi
mov ecx, dword [esp + 0x878]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x878
ret