Function at 0x463b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
cmp word [0xe94872], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x463ec4
mov eax, dword [ebp + 8]
cmp eax, 0x200
ja 0x463c6c
je 0x463c10
sub eax, 0x100
je 0x463be3
dec eax
jne case.0x463ed3.3
cmp dword [ebp + 0xc], 0xd
jne case.0x463ed3.3
cmp byte [0xe947d8], 1
jne case.0x463ed3.3
mov ecx, dword [0xe94858]
call fcn.00404d10
mov word [0xe94872], 0xffff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 0xc], 0xd
jne case.0x463ed3.3
cmp byte [0xe947d8], 1
jne case.0x463ed3.3
mov ecx, dword [0xe94858]
call fcn.00404d00
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
movzx esi, ax
shr eax, 0x10
mov edi, eax
movzx eax, byte [0xe947d8]
dec eax
je 0x463c54
dec eax
jne case.0x463ed3.3
mov ecx, dword [0xe94858]
push edi
push esi
call fcn.00405000
mov ecx, dword [0xe94858]
push edi
push esi
add ecx, 0x2c
call fcn.00405000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [0xe94858]
push edi
push esi
call fcn.00405000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub eax, 0x201
je 0x463e68
dec eax
jne case.0x463ed3.3
mov eax, dword [ebp + 0x10]
movzx edi, ax
shr eax, 0x10
mov ebx, eax
movzx eax, byte [0xe947d8]
dec eax
je 0x463e3f
dec eax
jne case.0x463ed3.3
mov ecx, dword [0xe94858]
push ebx
push edi
call fcn.00405090
test eax, eax
je 0x463dfb
mov eax, dword [esi + 0x2dc]
test eax, eax
je 0x463cf6
mov ecx, dword [esi + 0x1e0]
mov al, byte [esi + 0x2e0]
add ecx, 0x18
push ecx
movzx ecx, al
lea edx, [ecx + ecx*4]
xor ecx, ecx
mov cl, byte [esi + edx*8 + 0x2f4]
push ecx
mov ecx, dword [0x652e0c]
push eax
add ecx, 4
call fcn.00428830
mov dword [esi + 0x2d8], 0
mov eax, dword [esi + 0x2d8]
test eax, eax
je 0x463d2f
mov dword [esi + 0x2dc], 1
mov edx, dword [0xec0e0c]
mov eax, dword [edx]
push 2
add eax, 0x1d860
push 0
push eax
call fcn.00463780
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x4cc]
test eax, eax
je 0x463de7
mov ecx, dword [0x653474]
push 0
call fcn.0041d070
mov ecx, dword [0x653474]
push 2
call fcn.0041cdd0
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x118], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
stosb byte es:[edi], al
call fcn.004a7c60
add esp, 4
mov edi, 0x4bb448
lea esi, [esp + 0x10]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x463dbc
lea eax, [esp + 0x10]
push eax
push str.C:Program_FilesInternet_ExplorerIEXPLORE.EXE__s
lea ecx, [esp + 0x120]
push ecx
jmp 0x463dce
push str.http:__bbs.zhao97.com
push str.C:Program_FilesInternet_ExplorerIEXPLORE.EXE__s
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 5
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov word [0xe94872], 0xffff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [0xe94858]
push ebx
push edi
add ecx, 0x2c
call fcn.00405090
test eax, eax
je case.0x463ed3.3
mov word [0xe94872], 0xffff
mov eax, dword [esi + 0x2d8]
test eax, eax
je case.0x463ed3.3
mov dword [esi + 0x2dc], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [0xe94858]
push ebx
push edi
call fcn.00405090
test eax, eax
je case.0x463ed3.3
mov word [0xe94872], 0xffff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
movzx esi, ax
shr eax, 0x10
mov edi, eax
movzx eax, byte [0xe947d8]
dec eax
je 0x463eac
dec eax
jne case.0x463ed3.3
mov ecx, dword [0xe94858]
push edi
push esi
call fcn.00405430
mov ecx, dword [0xe94858]
push edi
add ecx, 0x2c
push esi
call fcn.00405430
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [0xe94858]
push edi
push esi
call fcn.00405430
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x4c8]
cmp eax, 7
ja case.0x463ed3.3
jmp dword [eax*4 + 0x463fa8]
cmp dword [ebp + 8], 0x100
jne case.0x463ed3.3
cmp dword [ebp + 0xc], 0x1b
jmp 0x463f7e
mov eax, dword [ebp + 0x10]
mov edx, dword [esi + 0x190]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x190]
push eax
call dword [edx + 0x14]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x420]
push edi
lea ecx, [esi + 0x420]
push ebx
push eax
call dword [edx + 0x14]
cmp eax, 0xffff
jne case.0x463ed3.3
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1d4]
push edi
lea ecx, [esi + 0x1d4]
push ebx
push eax
call dword [edx + 0x14]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov edx, dword [esi + 0x48c]
push eax
lea ecx, [esi + 0x48c]
mov esi, dword [ebp + 8]
push edi
push esi
call dword [edx + 0x14]
cmp esi, 0x100
jne case.0x463ed3.3
cmp edi, 0x1b
jne case.0x463ed3.3
mov ecx, dword [0x653474]
push 1
call fcn.0041d070
mov ecx, dword [0x653474]
push 2
call fcn.0041cdd0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc