Function at 0x439ca0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4394b0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xdc], esp
push str.red_alert
call fcn.00403ff0
call fcn.00410b30
mov ecx, eax
call fcn.00438ca0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xc8], esp
push str.http:__pay.wg678.cn
call fcn.00403ff0
call fcn.00410b30
mov ecx, eax
call fcn.00421300
call fcn.00410b30
mov ecx, eax
call fcn.004414c0
push 4
lea eax, [ebp - 0x4c]
push eax
call fcn.00421360
add esp, 8
push str.type
lea ecx, [ebp - 0x10c]
call fcn.00403ff0
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x1d8]
call fcn.00420150
call fcn.0046cbd0
push eax
lea ecx, [ebp - 0xf4]
call fcn.00404180
mov eax, dword [str.machineid]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00403ff0
lea ecx, [ebp - 0xf4]
push ecx
lea edx, [ebp - 0x1f0]
push edx
call fcn.00440da0
add esp, 8
push eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.004201c0
lea ecx, [ebp - 0x178]
push ecx
lea edx, [ebp - 0x1d8]
push edx
lea ecx, [ebp - 0x114]
call fcn.00402c40
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd8], esp
push str._helper_statistics
call fcn.00403ff0
call fcn.00410b30
mov ecx, eax
call fcn.00410870
push fcn.00413fc0
push 2
push 0x30
lea eax, [ebp - 0x1d8]
push eax
call fcn.00518dc2
lea ecx, [ebp - 0x12c]
call fcn.004040e0
lea ecx, [ebp - 0xf4]
call fcn.004041c0
lea ecx, [ebp - 0x1d8]
call fcn.00413fc0
lea ecx, [ebp - 0x10c]
call fcn.004040e0
mov dword [ebp - 0x7c], 0
mov byte [ebp - 0x75], 1
mov byte [ebp - 0x67], 0
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x18], 2
jne 0x439ec3
push 0x5918a4
lea ecx, [ebp - 0x144]
call fcn.00404180
push eax
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax + edx]
push ecx
call fcn.00430830
add esp, 8
mov byte [ebp - 0x6d], al
lea ecx, [ebp - 0x144]
call fcn.004041c0
movzx edx, byte [ebp - 0x6d]
test edx, edx
je 0x439e81
mov byte [0x5b88d4], 0
jmp 0x439ec3
push str.promotion
lea ecx, [ebp - 0x174]
call fcn.00404180
push eax
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx + eax]
push edx
call fcn.00430830
add esp, 8
mov byte [ebp - 0x6e], al
lea ecx, [ebp - 0x174]
call fcn.004041c0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x439ec3
mov byte [ebp - 0x67], 1
mov byte [ebp - 0x65], 1
lea ecx, [ebp - 0x14]
push ecx
call fcn.00420010
add esp, 4
push 8
lea ecx, [ebp - 0xc]
call fcn.00403160
push reloc.gdiplus.dll_Ordinal_1
lea ecx, [ebp - 0xc]
call fcn.0046ba40
push 0x2021f
push 0x5918c0
lea ecx, [ebp - 0xc]
call fcn.0046bb10
test eax, eax
je 0x439f3f
push str.SystemCurrentControlSet_
lea ecx, [ebp - 0xc]
call fcn.0046bac0
test eax, eax
jne 0x439f17
mov byte [ebp - 0x65], 0
jmp 0x439f3a
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x591914
lea ecx, [ebp - 0xc]
call fcn.0046bbc0
test eax, eax
jne 0x439f36
mov byte [ebp - 0x65], 0
jmp 0x439f3a
mov byte [ebp - 0x65], 1
jmp 0x43a019
xorpd xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
lea ecx, [ebp - 0x20]
push ecx
push str.InstallTime
lea ecx, [ebp - 0xc]
call fcn.0046bc80
test eax, eax
je 0x43a015
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
sbb eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xa0], 0x1a5e00
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xac], 0x83d600
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0x88]
cmp ecx, dword [ebp - 0x9c]
jl 0x43a013
jg 0x439fbf
mov edx, dword [ebp - 0x8c]
cmp edx, dword [ebp - 0xa0]
jb 0x43a013
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0xa8]
jg 0x43a013
jl 0x439fdd
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [ebp - 0xac]
ja 0x43a013
push 0
call fcn.0042ae60
add esp, 4
movzx edx, al
test edx, edx
je 0x43a013
mov dword [ebp - 0xa4], 0
lea ecx, [ebp - 0xc]
call fcn.0046baa0
lea ecx, [ebp - 0x4c]
call fcn.004040e0
mov eax, dword [ebp - 0xa4]
jmp 0x43a2ee
jmp 0x43a019
mov byte [ebp - 0x65], 0
call fcn.0046bd10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jge 0x43a05a
mov dword [ebp - 0x94], 1
lea ecx, [ebp - 0xc]
call fcn.0046baa0
lea ecx, [ebp - 0x4c]
call fcn.004040e0
mov eax, dword [ebp - 0x94]
jmp 0x43a2ee
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004c6ecf
add esp, 4
call fcn.00438d00
push 0
push str.WINDOW_
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x84], eax
call fcn.00421e60
mov byte [ebp - 0x66], al
cmp dword [ebp - 0x84], 0
je 0x43a0f1
mov ecx, dword [ebp - 0x84]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x43a0f1
movzx edx, byte [ebp - 0x66]
test edx, edx
je 0x43a0f1
push 0
push 0
push 0x470
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xb8], 1
lea ecx, [ebp - 0xc]
call fcn.0046baa0
lea ecx, [ebp - 0x4c]
call fcn.004040e0
mov eax, dword [ebp - 0xb8]
jmp 0x43a2ee
movzx ecx, byte [ebp - 0x66]
test ecx, ecx
jne 0x43a116
push 0x403460
lea ecx, [ebp - 0x28]
call fcn.0043a5f0
lea ecx, [ebp - 0x28]
call fcn.00438bb0
lea ecx, [ebp - 0x28]
call fcn.00438b60
push 0x848
call fcn.0051664e
add esp, 4
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x43a149
push 0x848
mov ecx, dword [ebp - 0x80]
call fcn.00403160
mov ecx, dword [ebp - 0x80]
call fcn.00421820
mov dword [ebp - 0x90], eax
jmp 0x43a153
mov dword [ebp - 0x90], 0
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x6c], eax
movzx ecx, byte [ebp - 0x66]
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.00438c80
lea edx, [ebp - 0x64]
push edx
call fcn.00427d60
add esp, 4
push 0xc
lea ecx, [ebp - 0x34]
call fcn.00403160
push 0x59199c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x15c]
push ecx
call fcn.00430560
add esp, 0xc
push eax
lea edx, [ebp - 0x34]
push edx
call fcn.0046cd60
add esp, 8
lea ecx, [ebp - 0x15c]
call fcn.004041c0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0xd4], esp
lea eax, [ebp - 0x34]
push eax
call fcn.0042ee80
mov ecx, dword [ebp - 0x6c]
call fcn.00438c20
lea ecx, [ebp - 0x34]
call fcn.0042f090
lea ecx, [ebp - 0x64]
call fcn.004041c0
cmp dword [ebp - 0x6c], 0
jne 0x43a212
mov dword [ebp - 0x98], 2
lea ecx, [ebp - 0xc]
call fcn.0046baa0
lea ecx, [ebp - 0x4c]
call fcn.004040e0
mov eax, dword [ebp - 0x98]
jmp 0x43a2ee
movzx ecx, byte [ebp - 0x67]
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.004202c0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.00438bf0
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x10
push 0x96cf0000
call fcn.0046bd10
mov ecx, eax
call fcn.0046c080
push eax
push 0
mov ecx, dword [ebp - 0x6c]
call fcn.004c983d
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0x6c]
call fcn.0042aab0
call fcn.004c5299
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
cmp dword [ebp - 0x74], 0
je 0x43a2a5
push 1
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x74]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0xbc], eax
jmp 0x43a2af
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x6c], 0
call fcn.0043b9c0
mov ecx, eax
call fcn.0043b980
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xc4], 0
lea ecx, [ebp - 0xc]
call fcn.0046baa0
lea ecx, [ebp - 0x4c]
call fcn.004040e0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret 0x10