Function at 0x406f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x490e08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4ed394]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4ed394]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
cmp dword [edi + 0x1e0], eax
je 0x406fd9
mov ecx, dword [edi + 0x124]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], eax
je 0x406fd9
push 0xe
mov eax, str.__Send360SetUp
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x1e8], 0
je 0x40700d
mov eax, dword [edi + 0x12c]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x40700d
push 0x88
mov eax, str.__DownloadSoft_http:__download.taobaocdn.com_client_browser_download.php_pidn4951_0003silents__taobrowser_1.2.0.56__pn4951_0003_s.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x1e4], 0
je 0x40703e
mov edx, dword [edi + 0x128]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x40703e
push 0x5c
mov eax, str.__DownloadSoft_http:__codown.youdao.com_cidian_YoudaoDict_sohu.yy.exe_YoudaoDict_sohu.yy.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x1ec], 0
je 0x40706f
mov ecx, dword [edi + 0x130]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x40706f
push 0x51
mov eax, str.__DownloadSoft_http:__download.iciba.com_pc_PowerWord.2800.exe_PowerWord.2800.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x1f4], 0
je 0x4070a0
mov eax, dword [edi + 0x134]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x4070a0
push 0x48
mov eax, str.__DownloadSoft_http:__mk.maxthon.cn_sujing_mx_4sohutv.exe_mx_4sohutv.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x1f0], 0
je 0x4070d1
mov edx, dword [edi + 0x138]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x4070d1
push 0x45
mov eax, str.__DownloadSoft_http:__down.kuwo.cn_mbox_kuwo_jm328.exe_kuwo_jm328.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x1fc], 0
je 0x407102
mov ecx, dword [edi + 0x140]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x407102
push 0x54
mov eax, str.___DownloadSoft_http:__file1.updrv.com_soft_rili_calendar_2178.exe_calendar_2178.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x1f8], 0
je 0x407133
mov eax, dword [edi + 0x13c]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x407133
push 0x54
mov eax, str.__DownloadSoft_http:__kad.k.wps.cn_kuaipan_channel_kuaipan.17_3.exe_kuaipan.17_3.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x200], 0
je 0x407164
mov edx, dword [edi + 0x144]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x407164
push 0x59
mov eax, str.__DownloadSoft_http:__dl.client.baidu.com_union_getbdbrowser.php_tnsohu_baidubrowser.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x204], 0
je 0x407195
mov ecx, dword [edi + 0x148]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x407195
push 0x78
mov eax, str.__DownloadSoft_http:__dl.client.baidu.com_download.php_source_ime_77030089_sp_BaiduPinyinSetup.exe_BaiduPinyinSetup.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x208], 0
je 0x4071c6
mov eax, dword [edi + 0x14c]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x4071c6
push 0x58
mov eax, str.__DownloadSoft_http:__download.jj.cn_Cooperation_JJmatch_4500428.exe_JJmatch_4500428.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x20c], 0
je 0x4071fa
mov edx, dword [edi + 0x150]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x4071fa
push 0x8f
mov eax, str.__DownloadSoft_http:__cdn.client.baidu.com_bizhi_repository_2_0_0_913_bizhi_setup_shbdxiyou_2_0_0_913_169.exe_bizhi_setup_shyy_1_0_3_602_96.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x210], 0
je 0x40722e
mov ecx, dword [edi + 0x154]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x40722e
push 0x83
mov eax, str.__DownloadSoft_http:__download.sj.qq.com_upload_QQphonemanger_2_0_704_QQPhoneManager_700001.3090.exe_QQPhoneManager_700001.3090.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x218], 0
je 0x40725f
mov eax, dword [edi + 0x158]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x40725f
push 0x4c
mov eax, str.__DownloadSoft_http:__down.yinyue.fm_open_sohu_setup_3017.exe_setup_3017.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x21c], 0
je 0x407290
mov edx, dword [edi + 0x160]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x407290
push 0x4a
mov eax, str.__DownloadSoft_http:__down.guangsu.cn_qdn_setup_qd222.exe__setup_qd222.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x220], 0
je 0x4072c1
mov ecx, dword [edi + 0x164]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x4072c1
push 0x4a
mov eax, str.__DownloadSoft_http:__down.guangsu.cn_qdn_setup_qd115.exe__setup_qd115.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x224], 0
je 0x4072f2
mov eax, dword [edi + 0x168]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x4072f2
push 0x5a
mov eax, str.__DownloadSoft_http:__www.yunduan.cn_update_bfc_bfcsetup_liwo_00.exe__bfcsetup_liwo_00.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x22c], 0
je 0x407323
mov edx, dword [edi + 0x170]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x407323
push 0x66
mov eax, str.__DownloadSoft_http:__d.zjx20.com_download_20131009_9377LieYan_N_l1009sh.exe__9377LieYan_N_l1009sh.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x234], 0
je 0x407354
mov ecx, dword [edi + 0x178]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x407354
push 0x55
mov eax, str.__DownloadSoft__http:__download.cntv.cn_sports_5plus_sohu.html_fmk1z_cntv_sports.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x23c], 0
je 0x407373
push 0x67
mov eax, str.__DownloadSoft_http:__data.vod.itc.cn_foxd_gz_filear.exenew_138_96_nuKsBRQxFwSznqUSAmfoj2.exe_ar.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x238], 0
je 0x4073a4
mov eax, dword [edi + 0x17c]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x4073a4
push 0x59
mov eax, str.___DownloadSoft__http:__static.5bo.com_silentstopover_wobo_1008_888.exe_wobo_1008_888.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x240], 0
je 0x4073d5
mov edx, dword [edi + 0x180]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x4073d5
push 0x45
mov eax, str.___DownloadSoft__http:__down.djcc.com_client_instsp6.exe__instsp6.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x230], 0
je 0x407406
mov ecx, dword [edi + 0x174]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x407406
push 0x70
mov eax, str.__DownloadSoft_http:__dl.wandoujia.com_files_third_WanDouJiaSetup_capher3_kb.exe__WanDouJiaSetup_capher15_kb.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x228], 0
je 0x407437
mov eax, dword [edi + 0x16c]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x407437
push 0x3f
mov eax, str.__DownloadSoft_http:__www.sj88.com_hezi_jm_xiaoa.exe__xiaoa.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [edi + 0x214], 0
je 0x407468
mov edx, dword [edi + 0x15c]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x407468
push 0x6a
mov eax, str.__DownloadSoft_http:__dl.wandoujia.com_files_third_WanDouJiaSetup_souhu_kb.exe_WanDouJiaSetup_souhu_kb.exe
lea esi, [esp + 0xc]
call fcn.0040c300
push edi
call fcn.00408a60
cmp dword [esp + 0x20], 8
jb 0x40747c
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00479461
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0047946c
add esp, 0x2c
ret