Function at 0x40de30
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x449c98
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464a38]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0041a00e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40de73
push 0x80004005
call fcn.00401410
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x1c], ebp
mov ecx, dword [sym.imp.StrokeMBHandle.dll_struct__tagImeG__sImeG]
mov eax, dword [ecx]
mov edx, dword [ebx + 0x108]
mov dword [esp + 0x4c], 0
add eax, 0x8d0
mov edi, edi
mov cl, byte [edx]
mov byte [eax], cl
add edx, 1
add eax, 1
test cl, cl
jne 0x40dea0
mov eax, dword [sym.imp.StrokeMBHandle.dll_struct__tagImeG__sImeG]
mov ecx, dword [eax]
mov edx, dword [ebx + 0x10c]
add ecx, 0x9d4
mov al, byte [edx]
mov byte [ecx], al
add edx, 1
add ecx, 1
test al, al
jne 0x40dec1
mov ecx, dword [sym.imp.StrokeMBHandle.dll_struct__tagImeG__sImeG]
mov ecx, dword [ecx]
mov edx, dword [ebx + 0x110]
add ecx, 0xad8
mov al, byte [edx]
mov byte [ecx], al
add edx, 1
add ecx, 1
test al, al
jne 0x40dee3
mov edx, dword [sym.imp.StrokeMBHandle.dll_struct__tagImeG__sImeG]
mov eax, dword [edx]
mov edi, 0x44dd6d
lea esi, [eax + 0x8d0]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40e26f
mov edi, 0x44dd6d
lea esi, [eax + 0x9d4]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40e26f
lea esi, [eax + 0xad8]
mov edi, 0x44dd6d
mov ecx, 1
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40e26f
call dword [sym.imp.StrokeMBHandle.dll_int___cdecl_CompareActivationNum_void_]
test eax, eax
je 0x40e208
call dword [sym.imp.StrokeMBHandle.dll_int___cdecl_WriteSoftwareInfo_void_]
test eax, eax
mov ecx, ebx
je 0x40e1fa
call fcn.00401160
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x40dfa2
push 0x40
push 0x44fd78
push 0x44fd58
mov ecx, ebx
call fcn.00412ca0
lea ecx, [esp + 0x1c]
call fcn.004018e0
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov ecx, dword [sym.imp.StrokeMBHandle.dll_struct__tagImeG__sImeG]
mov edx, dword [ecx]
mov dword [edx + 0x4bc], ebp
mov eax, dword [sym.imp.StrokeMBHandle.dll_struct_tagImeL_sImeL]
mov dword [eax + 0xa8], ebp
mov ecx, dword [sym.imp.StrokeMBHandle.dll_struct__tagImeG__sImeG]
mov edx, dword [ecx]
push ebp
mov ecx, esi
mov dword [edx + 0x4c0], ebp
call fcn.00403cb0
push 2
mov ecx, esi
mov edi, eax
call fcn.00403cb0
cmp edi, ebp
jne 0x40dfe6
mov dword [esp + 0x14], ebp
jmp 0x40dfed
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, ebp
je 0x40dff4
mov ebp, dword [eax + 0x20]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x3fa
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov eax, dword [esp + 0x14]
push 1
push 0x3e8
push eax
call esi
push eax
call edi
mov ecx, dword [esp + 0x14]
push 1
push 0x40d
push ecx
call esi
push eax
call edi
mov edx, dword [esp + 0x14]
push 1
push 0x410
push edx
call esi
push eax
call edi
mov eax, dword [esp + 0x14]
push 1
push 0x3f6
push eax
call esi
push eax
call edi
mov ecx, dword [esp + 0x14]
push 1
push 0x427
push ecx
call esi
push eax
call edi
mov edx, dword [esp + 0x14]
push 1
push 0x430
push edx
call esi
push eax
call edi
push 1
push 0x3ec
push ebp
call esi
push eax
call edi
push 1
push 0x40d
push ebp
call esi
push eax
call edi
push 1
push 0x40e
push ebp
call esi
push eax
call edi
push 1
push 0x424
push ebp
call esi
push eax
call edi
push 1
push 0x417
push ebp
call esi
push eax
call edi
push 1
push 0x423
push ebp
call esi
push eax
call edi
push 1
push 0x425
push ebp
call esi
push eax
call edi
push 1
push 0x40b
push ebp
call esi
push eax
call edi
push 1
push 0x418
push ebp
call esi
push eax
call edi
push 1
push 0x41a
push ebp
call esi
push eax
call edi
mov eax, dword [ebx + 0x118]
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x44fd28
push 0x3fa
push eax
call ebp
mov ecx, dword [ebx + 0x118]
push 0x44fd20
push 1
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebp
mov edx, dword [ebx + 0x118]
push 0
push 0x41f
push edx
call esi
push eax
call edi
mov eax, dword [ebx + 0x118]
push 0
push 0x3f7
push eax
call esi
push eax
call edi
mov ecx, dword [ebx + 0x118]
push 0
push 0x3f8
push ecx
call esi
push eax
call edi
mov edx, dword [ebx + 0x118]
push 0
push 0x3f9
push edx
call esi
push eax
call edi
mov eax, dword [ebx + 0x118]
push 5
push 0x3fa
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41
push 0x44fd78
push 0x44fcc0
mov ecx, ebx
call fcn.00412ca0
cmp eax, 1
jne 0x40e1d3
push str.Http:__www.szwb.com_home_urlcenter.asp
lea ecx, [esp + 0x20]
push str._s_typereg
push ecx
call fcn.00409770
mov edx, dword [esp + 0x28]
add esp, 0xc
push 5
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x1c]
mov dword [ebx + 0x114], 1
call fcn.004018e0
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push 0x10
push 0x44fd78
push 0x44fc84
jmp 0x40e27d
push 0
call fcn.00436a12
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call fcn.00436a12
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00436746
add esp, 0x10
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push eax
call fcn.0040d980
push eax
lea ecx, [esp + 0x1c]
call fcn.0040d950
push eax
lea edx, [esp + 0x28]
push 0x44fc18
push edx
call fcn.00409770
mov ebp, dword [esp + 0x30]
add esp, 0x14
push 0x10
push 0x44fd78
push ebp
jmp 0x40e27b
push 0x10
push 0x44fd78
push 0x44fbf4
mov ecx, ebx
call fcn.00412ca0
lea eax, [ebp - 0x10]
mov dword [ebx + 0x114], 0
mov dword [esp + 0x4c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e2b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret