Function at 0x402e50
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9f15
mov eax, dword fs:[0]
push eax
mov eax, 0x120c
call fcn.004a9260
mov eax, dword [0x4ebfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x11b0], ecx
mov dword [ebp - 0x11ac], 0
push 0x4df0f8
mov eax, dword [ebp + 8]
push eax
call fcn.0040c4b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x402eba
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.00403cd0
jmp 0x403a9d
push 0x4df110
mov edx, dword [ebp + 8]
push edx
call fcn.0040c4b0
add esp, 8
movzx eax, al
test eax, eax
je 0x40361d
lea ecx, [ebp - 0x954]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11b4], eax
mov ecx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b8], ecx
mov dword [ebp - 4], 0
push 0x4df11c
mov edx, dword [ebp - 0x11b8]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0x8cd], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x954]
call fcn.00427f60
movzx eax, byte [ebp - 0x8cd]
test eax, eax
je 0x4030a3
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x564]
call fcn.004292a0
cmp eax, 3
jne 0x402f7b
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.004045a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.00406580
push 0x4df130
lea ecx, [ebp - 0x974]
call fcn.00401840
mov dword [ebp - 4], 1
push 0x4df138
lea ecx, [ebp - 0x990]
call fcn.00401840
mov byte [ebp - 4], 2
push 0x4df140
lea ecx, [ebp - 0x9ac]
call fcn.00401840
mov byte [ebp - 4], 3
push 0x4df15c
lea ecx, [ebp - 0x9c8]
call fcn.00401840
mov byte [ebp - 4], 4
push 0xb4
push 0x12c
lea edx, [ebp - 0x974]
push edx
lea eax, [ebp - 0x990]
push eax
push 2
push 1
lea ecx, [ebp - 0x9ac]
push ecx
lea edx, [ebp - 0x9c8]
push edx
mov ecx, dword [0x4f09b0]
call fcn.00426c90
push eax
call fcn.0040da20
add esp, 0x24
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x955], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9c8]
call fcn.004018c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9ac]
call fcn.004018c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x990]
call fcn.004018c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x974]
call fcn.004018c0
movzx eax, byte [ebp - 0x955]
test eax, eax
je 0x403088
push 0
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.00406580
jmp 0x403a9d
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.004045a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0xa50]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11bc], eax
mov ecx, dword [ebp - 0x11bc]
mov dword [ebp - 0x11c0], ecx
mov dword [ebp - 4], 5
push str.min_btn
mov edx, dword [ebp - 0x11c0]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0x9c9], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa50]
call fcn.00427f60
movzx eax, byte [ebp - 0x9c9]
test eax, eax
je 0x40312a
push 6
mov ecx, dword [ebp - 0x11b0]
mov edx, dword [ecx - 0x10]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x403618
lea eax, [ebp - 0xad8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11c4], eax
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x11c8], ecx
mov dword [ebp - 4], 6
push str.selected_path_btn
mov edx, dword [ebp - 0x11c8]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0xa51], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad8]
call fcn.00427f60
movzx eax, byte [ebp - 0xa51]
test eax, eax
je 0x4031d8
xor ecx, ecx
mov word [ebp - 0x814], cx
push 0x7fe
push 0
lea edx, [ebp - 0x812]
push edx
call fcn.004a8470
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.00405040
jmp 0x403618
lea ecx, [ebp - 0xb60]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11cc], eax
mov ecx, dword [ebp - 0x11cc]
mov dword [ebp - 0x11d0], ecx
mov dword [ebp - 4], 7
push str.self_install_btn
mov edx, dword [ebp - 0x11d0]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0xad9], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb60]
call fcn.00427f60
movzx eax, byte [ebp - 0xad9]
test eax, eax
je 0x403288
push 1
push 1
mov ecx, dword [ebp - 0x11b0]
mov edx, dword [ecx + 0x550]
mov eax, dword [ebp - 0x11b0]
mov ecx, dword [eax + 0x550]
mov edx, dword [edx]
mov eax, dword [edx + 0x168]
call eax
push 0
push 1
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x564]
call fcn.004292c0
jmp 0x403618
lea edx, [ebp - 0xbe8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11d4], eax
mov ecx, dword [ebp - 0x11d4]
mov dword [ebp - 0x11d8], ecx
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x11ac]
or edx, 1
mov dword [ebp - 0x11ac], edx
push 0x4df1c0
mov eax, dword [ebp - 0x11d8]
push eax
call fcn.0040c4b0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x40335e
lea edx, [ebp - 0xc6c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11dc], eax
mov ecx, dword [ebp - 0x11dc]
mov dword [ebp - 0x11e0], ecx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x11ac]
or edx, 2
mov dword [ebp - 0x11ac], edx
push 0x4df1ec
mov eax, dword [ebp - 0x11e0]
push eax
call fcn.0040c4b0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x40335e
mov dword [ebp - 0x11e4], 0
jmp 0x403368
mov dword [ebp - 0x11e4], 1
mov dl, byte [ebp - 0x11e4]
mov byte [ebp - 0xb61], dl
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x11ac]
and eax, 2
je 0x403398
and dword [ebp - 0x11ac], 0xfffffffd
lea ecx, [ebp - 0xc6c]
call fcn.00427f60
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x11ac]
and ecx, 1
je 0x4033bc
and dword [ebp - 0x11ac], 0xfffffffe
lea ecx, [ebp - 0xbe8]
call fcn.00427f60
movzx edx, byte [ebp - 0xb61]
test edx, edx
je 0x4033da
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.004065b0
jmp 0x403618
lea eax, [ebp - 0xcf4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11e8], eax
mov ecx, dword [ebp - 0x11e8]
mov dword [ebp - 0x11ec], ecx
mov dword [ebp - 4], 0xa
push str.show_policy_btn
mov edx, dword [ebp - 0x11ec]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0xc6d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf4]
call fcn.00427f60
movzx eax, byte [ebp - 0xc6d]
test eax, eax
je 0x40348f
push str.www.baidu.com
lea ecx, [ebp - 0x830]
call fcn.00401840
push 1
push 0x4df258
push 0x4df25c
lea ecx, [ebp - 0x830]
call fcn.00402c10
push eax
push 0x4df260
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x830]
call fcn.004018c0
jmp 0x403618
lea ecx, [ebp - 0xd7c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11f0], eax
mov ecx, dword [ebp - 0x11f0]
mov dword [ebp - 0x11f4], ecx
mov dword [ebp - 4], 0xb
push str.return_btn
mov edx, dword [ebp - 0x11f4]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0xcf5], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd7c]
call fcn.00427f60
movzx eax, byte [ebp - 0xcf5]
test eax, eax
je 0x403519
push 0
push 0
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x564]
call fcn.004292c0
jmp 0x403618
lea edx, [ebp - 0xe04]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x11f8], eax
mov ecx, dword [ebp - 0x11f8]
mov dword [ebp - 0x11fc], ecx
mov dword [ebp - 4], 0xc
push str.immediate_startup_btn
mov edx, dword [ebp - 0x11fc]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0xd7d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe04]
call fcn.00427f60
movzx eax, byte [ebp - 0xd7d]
test eax, eax
je 0x403618
mov ecx, dword [ebp - 0x11b0]
add ecx, 0x28
push ecx
lea ecx, [ebp - 0x84c]
call fcn.00401880
mov dword [ebp - 4], 0xd
push 0x4df2b0
lea ecx, [ebp - 0x84c]
call fcn.00401920
push 0x4df2b4
lea ecx, [ebp - 0x84c]
call fcn.00401920
push 1
push 0x4df2c4
push 0x4df2c8
lea ecx, [ebp - 0x84c]
call fcn.00402c10
push eax
push 0x4df2dc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x11b0]
sub ecx, 0x14
call fcn.004045a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x403a9d
push str.selectchanged
mov edx, dword [ebp + 8]
push edx
call fcn.0040c4b0
add esp, 8
movzx eax, al
test eax, eax
je 0x4037bf
lea ecx, [ebp - 0xe8c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1200], eax
mov ecx, dword [ebp - 0x1200]
mov dword [ebp - 0x1204], ecx
mov dword [ebp - 4], 0xe
push 0x4df304
mov edx, dword [ebp - 0x1204]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0xe05], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8c]
call fcn.00427f60
movzx eax, byte [ebp - 0xe05]
test eax, eax
je 0x4037ba
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x550]
call fcn.00429dd0
movzx edx, al
cmp edx, 1
jne 0x403742
push 1
mov eax, dword [ebp - 0x11b0]
mov ecx, dword [eax + 0x55c]
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x55c]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0xec]
call eax
push 0xffffffffffffffff
push 0x4df318
lea ecx, [ebp - 0xf10]
call fcn.00427ee0
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xf10]
push ecx
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x55c]
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x55c]
mov edx, dword [eax]
mov eax, dword [edx + 0xb0]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.00427f60
jmp 0x4037ba
push 0
mov ecx, dword [ebp - 0x11b0]
mov edx, dword [ecx + 0x55c]
mov eax, dword [ebp - 0x11b0]
mov ecx, dword [eax + 0x55c]
mov edx, dword [edx]
mov eax, dword [edx + 0xec]
call eax
push 0xffffffffffffffff
push 0x4df31c
lea ecx, [ebp - 0xf94]
call fcn.00427ee0
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0xf94]
push ecx
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x55c]
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x55c]
mov edx, dword [eax]
mov eax, dword [edx + 0xb0]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf94]
call fcn.00427f60
jmp 0x403a9d
push str.textchanged
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040c4b0
add esp, 8
movzx edx, al
test edx, edx
je 0x4038fc
lea eax, [ebp - 0x101c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x1208], eax
mov ecx, dword [ebp - 0x1208]
mov dword [ebp - 0x120c], ecx
mov dword [ebp - 4], 0x11
push 0x4df354
mov edx, dword [ebp - 0x120c]
push edx
call fcn.0040c4b0
add esp, 8
mov byte [ebp - 0xf95], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.00427f60
movzx eax, byte [ebp - 0xf95]
test eax, eax
je 0x4038f7
lea ecx, [ebp - 0x1124]
push ecx
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x548]
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x548]
mov edx, dword [eax]
mov eax, dword [edx + 0x38]
call eax
mov dword [ebp - 0x1210], eax
mov ecx, dword [ebp - 0x1210]
mov dword [ebp - 0x1214], ecx
mov dword [ebp - 4], 0x12
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1214]
call fcn.004281e0
push eax
lea ecx, [ebp - 0x10a0]
call fcn.00427ee0
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x10a0]
push edx
mov eax, dword [ebp - 0x11b0]
mov ecx, dword [eax + 0x548]
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x548]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0xb0]
call eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x10a0]
call fcn.00427f60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1124]
call fcn.00427f60
jmp 0x403a9d
push str.timer
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040c4b0
add esp, 8
movzx edx, al
test edx, edx
je 0x403a9d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x118], 0x64
jne 0x403a9d
mov ecx, dword [ebp - 0x11b0]
mov edx, dword [ecx + 0x578]
mov dword [ebp - 0x1218], edx
cmp dword [ebp - 0x1218], 0
je 0x40394e
cmp dword [ebp - 0x1218], 1
je 0x40398a
jmp 0x4039a5
mov eax, dword [ebp - 0x11b0]
mov ecx, dword [eax + 0x574]
add ecx, 1
mov edx, dword [ebp - 0x11b0]
mov dword [edx + 0x574], ecx
mov eax, dword [ebp - 0x11b0]
cmp dword [eax + 0x574], 0x50
jl 0x403988
mov ecx, dword [ebp - 0x11b0]
mov dword [ecx + 0x578], 1
jmp 0x4039a5
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x574]
add eax, 1
mov ecx, dword [ebp - 0x11b0]
mov dword [ecx + 0x574], eax
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x574]
push eax
mov ecx, dword [ebp - 0x11b0]
mov ecx, dword [ecx + 0x568]
call fcn.0042b510
xor edx, edx
mov word [ebp - 0x8cc], dx
push 0x7e
push 0
lea eax, [ebp - 0x8ca]
push eax
call fcn.004a8470
add esp, 0xc
mov ecx, dword [ebp - 0x11b0]
mov edx, dword [ecx + 0x574]
push edx
push str.ck_W
push 0x40
lea eax, [ebp - 0x8cc]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x8cc]
push ecx
lea ecx, [ebp - 0x11a8]
call fcn.00427ee0
mov dword [ebp - 4], 0x14
lea edx, [ebp - 0x11a8]
push edx
mov eax, dword [ebp - 0x11b0]
mov ecx, dword [eax + 0x56c]
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x56c]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x3c]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11a8]
call fcn.00427f60
mov ecx, dword [ebp - 0x11b0]
cmp dword [ecx + 0x574], 0x64
jl 0x403a9d
push 0x64
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx + 0x568]
push eax
mov ecx, dword [ebp - 0x11b0]
add ecx, 0x64
call fcn.00422800
push 0
push 0
push 0x7ea
mov ecx, dword [ebp - 0x11b0]
mov edx, dword [ecx - 0x10]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4ea6
mov esp, ebp
pop ebp
ret 4