Function at 0x4080b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4177cf
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x4275b4]
xor eax, esp
mov dword [esp + 0x4ac], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4275b4]
xor eax, esp
push eax
lea eax, [esp + 0x4c4]
mov dword fs:[0], eax
mov edi, dword [0x419350]
mov ebp, dword [esp + 0x4d4]
mov esi, ecx
push esi
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend_enter
push str.QMApiCli.txt
call edi
xor ebx, ebx
add esp, 0xc
cmp ebp, ebx
je 0x408661
lea ecx, [esp + 0x78]
call dword [0x419200]
mov dword [esp + 0x4cc], ebx
call fcn.00401630
cmp eax, ebx
je 0x40813b
lea eax, [esp + 0x78]
push eax
call fcn.00401e30
add esp, 4
lea ecx, [esp + 0x78]
call dword [0x4191fc]
test eax, eax
jne 0x408154
lea ebx, [esp + 0x78]
call fcn.00407340
xor ebx, ebx
lea ecx, [esp + 0x78]
call dword [0x4191fc]
test eax, eax
jbe case.0x4081a3.3
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00403070
test al, al
je case.0x4081a3.3
mov eax, dword [esp + 0x20]
cmp eax, ebx
je case.0x4081a3.3
mov ecx, dword [esp + 0x1c]
add ecx, 0xffffffff
cmp ecx, 4
ja case.0x4081a3.3
jmp dword [ecx*4 + 0x408690]
push esi
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_QQ_PULL___begin
push str.QMApiCli.txt
mov ebp, eax
call edi
push 0x44
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.00416322
push 0x40e
lea ecx, [esp + 0xce]
push ebx
push ecx
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x74], 1
mov word [esp + 0x78], bx
mov word [esp + 0xd4], bx
call fcn.00416322
add esp, 0x24
lea ecx, [ebp + 4]
call dword [0x419228]
mov edx, dword [ebp]
push eax
push edx
lea ecx, [esp + 0x80]
call dword [0x419228]
push eax
push str._s__uin__u___key__s
lea eax, [esp + 0xc0]
push 0x104
push eax
call dword [0x41930c]
add esp, 0x18
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [esp + 0xd0]
push eax
push ebx
call dword [0x4190d0]
push 0x3e8
call dword [0x4190cc]
push esi
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_QQ_PULL___end
push str.QMApiCli.txt
call edi
add esp, 0xc
jmp 0x408623
push esi
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_TENCENT_URL___begin
push str.QMApiCli.txt
mov dword [esp + 0x20], eax
call edi
add esp, 0xc
lea ecx, [esp + 0x94]
call dword [0x419200]
lea ecx, [esp + 0x94]
push ecx
mov byte [esp + 0x4d0], 1
call fcn.004019b0
add esp, 4
push ebx
push 0x80
push 2
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0xac]
call dword [0x419228]
push eax
call dword [0x419088]
push 0x40e
lea edx, [esp + 0xb6]
push ebx
push edx
mov ebp, eax
mov word [esp + 0xbc], bx
call fcn.00416322
add esp, 0xc
cmp ebp, 0xffffffff
je 0x408358
mov ecx, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ebx
call dword [0x4191fc]
mov ecx, dword [esp + 0x1c]
add eax, eax
push eax
call dword [0x419228]
push eax
push ebp
call dword [0x41908c]
push ebp
call dword [0x419078]
lea ecx, [esp + 0x94]
call dword [0x419228]
push eax
lea ecx, [esp + 0x7c]
call dword [0x419228]
push eax
push str._s__TencentProtocolFile__s
lea ecx, [esp + 0xbc]
push 0x104
push ecx
call dword [0x41930c]
add esp, 0x14
jmp 0x40837e
lea ecx, [esp + 0x78]
call dword [0x419228]
push eax
push 0x41a048
lea edx, [esp + 0xb8]
push 0x104
push edx
call dword [0x41930c]
add esp, 0x10
call dword [0x41934c]
test eax, eax
push esi
je 0x40843a
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_TENCENT_URL___UACEnabled__ShellExecuteEx
push str.QMApiCli.txt
call edi
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00407480
lea ecx, [esp + 0x94]
mov byte [esp + 0x4cc], 2
call dword [0x419228]
push eax
lea eax, [esp + 0x18]
push str._TencentProtocolFile__s
push eax
call fcn.00407fd0
push 0x3c
lea ecx, [esp + 0x34]
push ebx
push ecx
call fcn.00416322
add esp, 0x18
lea ecx, [esp + 0x78]
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], str.runas
call dword [0x419228]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 0x419f30
mov dword [esp + 0x44], 1
call dword [0x41935c]
lea ecx, [esp + 0x14]
mov byte [esp + 0x4cc], 1
call fcn.004074a0
jmp 0x40848b
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_TENCENT_URL___UACDisabled__CreateProcess
push str.QMApiCli.txt
call edi
push 0x44
lea ecx, [esp + 0x34]
push ebx
push ecx
call fcn.00416322
add esp, 0x18
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea ecx, [esp + 0xd0]
push ecx
push ebx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], bx
call dword [0x4190d0]
push 0x3e8
call dword [0x4190cc]
push esi
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_TENCENT_URL___end
jmp 0x408605
push esi
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_XML_CMD___begin
push str.QMApiCli.txt
mov dword [esp + 0x20], eax
call edi
add esp, 0xc
lea ecx, [esp + 0x94]
call dword [0x419200]
lea edx, [esp + 0x94]
push edx
mov byte [esp + 0x4d0], 3
call fcn.004019b0
add esp, 4
push ebx
push 0x80
push 2
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0xac]
call dword [0x419228]
push eax
call dword [0x419088]
push 0x40e
mov ebp, eax
lea eax, [esp + 0xb6]
push ebx
push eax
mov word [esp + 0xbc], bx
call fcn.00416322
add esp, 0xc
cmp ebp, 0xffffffff
je 0x408589
push ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ebx
call dword [0x4191fc]
mov ecx, dword [esp + 0x1c]
add eax, eax
push eax
call dword [0x419228]
push eax
push ebp
call dword [0x41908c]
push ebp
call dword [0x419078]
lea ecx, [esp + 0x94]
call dword [0x419228]
push eax
lea ecx, [esp + 0x7c]
call dword [0x419228]
push eax
push str._s__ParseXMLFile__s
lea edx, [esp + 0xbc]
push 0x104
push edx
call dword [0x41930c]
add esp, 0x14
jmp 0x4085af
lea ecx, [esp + 0x78]
call dword [0x419228]
push eax
push 0x41a048
lea eax, [esp + 0xb8]
push 0x104
push eax
call dword [0x41930c]
add esp, 0x10
push 0x44
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00416322
add esp, 0xc
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea ecx, [esp + 0xd0]
push ecx
push ebx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], bx
call dword [0x4190d0]
push 0x3e8
call dword [0x4190cc]
push esi
push str.CQMApiDataSendScheme:0x_.08x___ShellCmdSend___EM_QM_API_PROTO_XML_CMD___end
push str.QMApiCli.txt
call edi
add esp, 0xc
lea ecx, [esp + 0x94]
mov byte [esp + 0x4cc], bl
call dword [0x419218]
push esi
push 0x419bf8
push str.QMApiCli.txt
call edi
add esp, 0xc
lea ecx, [esp + 0x78]
mov dword [esp + 0x4cc], 0xffffffff
call dword [0x419218]
mov al, 1
jmp 0x408663
lea ecx, [esp + 0x78]
mov dword [esp + 0x4cc], 0xffffffff
call dword [0x419218]
xor al, al
mov ecx, dword [esp + 0x4c4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4ac]
xor ecx, esp
call fcn.0041632e
add esp, 0x4bc
ret 4