Function at 0x411c20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d301
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x30], ebx
test ecx, ecx
je 0x411c6c
mov eax, dword [ecx]
push ebx
push edi
push esi
call dword [eax + 4]
cmp word [ebx], 0
jne 0x411e5f
cmp dword [esi + 0x70], 0
je 0x411e5f
push str.https:__www.googleadservices.com_pagead_aclk_
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
call fcn.00402a70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push str.https:__adclick.g.doubleclick.net_pcs_click_
mov dword [ebp - 0x18], 0
call fcn.00402a70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x14], 0
call fcn.00402a70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
push dword [eax - 0xc]
lea eax, [ebp - 0x2c]
push eax
call fcn.00402640
mov byte [ebp - 4], 3
lea edx, [ebp - 0x1c]
mov ebx, 1
mov ecx, eax
mov dword [ebp - 0x24], ebx
call fcn.00402280
test al, al
jne 0x411d1c
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push dword [eax - 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.00402640
lea edx, [ebp - 0x18]
mov ecx, eax
mov ebx, 3
call fcn.00402280
mov byte [ebp - 0x1d], 0
test al, al
je 0x411d20
mov byte [ebp - 0x1d], 1
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0xffffffff
test bl, 2
je 0x411d63
mov ecx, dword [ebp - 0x28]
and ebx, 0xfffffffd
mov dword [ebp - 0x24], ebx
add ecx, 0xfffffff0
mov eax, esi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x411d63
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411e7d
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov dword [ebp - 4], 2
mov eax, esi
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x411d99
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411e86
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
cmp byte [ebp - 0x1d], 0
je 0x411dcd
mov eax, dword [ebp - 0x30]
mov ecx, 1
push dword [ebp - 0x14]
push str.__rAdsense_popup:_s
mov word [eax], cx
call fcn.004011c0
add esp, 8
push 5
push 0
push 0
push dword [ebp - 0x14]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x411e00
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411e8f
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov byte [ebp - 4], 0
mov eax, esi
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x411e2f
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411e98
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x411e5f
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411e9e
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d9da
mov esp, ebp
pop ebp
ret 8
mov ecx, edx
call ebx
jmp 0x411d63
mov ecx, edx
call ebx
jmp 0x411d99
mov ecx, edx
call ebx
jmp 0x411e00
mov ecx, edx
call ebx
jmp 0x411e2f
mov ecx, edx
call esi
jmp 0x411e5f