Function at 0x417490
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x43e040
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x94]
push 0xffffffffffffffff
xor ebp, ebp
push ebp
call fcn.00401da0
push 5
mov ebx, 7
push 0x443640
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], bp
call fcn.00401d00
mov dword [esp + 0x8c], ebp
push 0xc
push str.IEXPLORE.EXE
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], bp
call fcn.00401d00
lea eax, [esp + 0x4c]
push eax
mov ecx, esi
push ecx
mov byte [esp + 0x94], 1
call fcn.00417380
mov esi, 8
add esp, 8
cmp dword [esp + 0x2c], esi
jb 0x417543
mov edx, dword [esp + 0x18]
push edx
call fcn.004250ac
add esp, 4
mov dword [esp + 0x8c], 0xffffffff
cmp dword [esp + 0x64], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jb 0x41756e
mov eax, dword [esp + 0x50]
push eax
call fcn.004250ac
add esp, 4
push 5
push 0x443640
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], bp
call fcn.00401d00
mov dword [esp + 0x8c], 2
push 0xc
push str.IEXPLORE.exe
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], bp
call fcn.00401d00
lea ecx, [esp + 0x4c]
push ecx
mov edx, esi
push edx
mov byte [esp + 0x94], 3
call fcn.00417380
mov esi, 8
add esp, 8
cmp dword [esp + 0x2c], esi
jb 0x4175e3
mov eax, dword [esp + 0x18]
push eax
call fcn.004250ac
add esp, 4
mov dword [esp + 0x8c], 0xffffffff
cmp dword [esp + 0x64], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jb 0x41760e
mov ecx, dword [esp + 0x50]
push ecx
call fcn.004250ac
add esp, 4
push 5
push 0x443640
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], bp
call fcn.00401d00
mov dword [esp + 0x8c], 4
push 0xc
push str.iexplore.exe
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], bp
call fcn.00401d00
lea edx, [esp + 0x4c]
push edx
mov eax, esi
push eax
mov byte [esp + 0x94], 5
call fcn.00417380
mov esi, 8
add esp, 8
cmp dword [esp + 0x2c], esi
jb 0x417683
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004250ac
add esp, 4
mov dword [esp + 0x8c], 0xffffffff
cmp dword [esp + 0x64], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jb 0x4176ae
mov edx, dword [esp + 0x50]
push edx
call fcn.004250ac
add esp, 4
push 5
push 0x4436a0
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], bp
call fcn.00401d00
mov dword [esp + 0x8c], 6
push 0xd
push str.TTraveler.exe
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], bp
call fcn.00401d00
lea eax, [esp + 0x4c]
push eax
mov ecx, esi
push ecx
mov byte [esp + 0x94], bl
call fcn.00417380
mov esi, 8
add esp, 8
cmp dword [esp + 0x2c], esi
jb 0x417722
mov edx, dword [esp + 0x18]
push edx
call fcn.004250ac
add esp, 4
mov dword [esp + 0x8c], 0xffffffff
cmp dword [esp + 0x64], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jb 0x41774d
mov eax, dword [esp + 0x50]
push eax
call fcn.004250ac
add esp, 4
push 5
push 0x4436a0
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], bp
call fcn.00401d00
mov dword [esp + 0x8c], 8
push 0xd
push str.TTraveler.EXE
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], bp
call fcn.00401d00
lea ecx, [esp + 0x4c]
push ecx
mov edx, esi
push edx
mov byte [esp + 0x94], 9
call fcn.00417380
mov esi, 8
add esp, 8
cmp dword [esp + 0x2c], esi
jb 0x4177c2
mov eax, dword [esp + 0x18]
push eax
call fcn.004250ac
add esp, 4
mov dword [esp + 0x8c], 0xffffffff
cmp dword [esp + 0x64], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jb 0x4177ed
mov ecx, dword [esp + 0x50]
push ecx
call fcn.004250ac
add esp, 4
push 5
push str.QQCRM
lea esi, [esp + 0x70]
mov dword [esp + 0x88], ebx
mov dword [esp + 0x84], ebp
mov word [esp + 0x74], bp
call fcn.00401d00
mov dword [esp + 0x8c], 0xa
push 9
push str.QQCRM.exe
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebp
mov word [esp + 0x3c], bp
call fcn.00401d00
lea edx, [esp + 0x68]
push edx
mov eax, esi
push eax
mov byte [esp + 0x94], 0xb
call fcn.00417380
mov edi, 8
add esp, 8
cmp dword [esp + 0x48], edi
mov esi, eax
jb 0x41786a
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004250ac
add esp, 4
cmp dword [esp + 0x80], edi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebp
mov word [esp + 0x34], bp
jb 0x41788d
mov edx, dword [esp + 0x6c]
push edx
call fcn.004250ac
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret