Function at 0x404479
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d20f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x45e0a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417030
xor esi, esi
cmp dword [ebx + 0xe84], esi
mov dword [esp + 0x20], eax
movzx eax, word [ebp + 8]
je 0x404740
sub eax, 0x3e8
je 0x40474d
dec eax
je 0x4045c9
dec eax
je 0x4045ad
sub eax, 3
je 0x404527
sub eax, 4
je 0x40450c
dec eax
jne 0x404761
push 1
push esi
push esi
push str.http:__www.itools.cn_agreement_cn.html
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x404761
mov eax, dword [ebx + 0xf10]
xor ecx, ecx
cmp byte [eax + 0x15], cl
push ebx
sete cl
mov eax, ecx
call fcn.00404973
jmp 0x404761
lea esi, [ebx + 0xe80]
mov eax, dword [esi]
sub eax, 0x10
call fcn.00402e21
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], 2
mov ecx, dword [ebx + 4]
call fcn.00426290
test eax, eax
je 0x404591
mov eax, esi
call fcn.00404ac3
mov eax, dword [esi]
mov edi, dword [eax - 0xc]
call fcn.00404aaa
dec edi
cmp eax, edi
mov edi, 0x4530dc
je 0x404572
mov edi, 0x452f54
push edi
call fcn.00434f36
pop ecx
push eax
push edi
mov eax, esi
call fcn.00404ed9
push dword [esi]
mov eax, dword [ebx + 0xf10]
call fcn.004131a6
jmp 0x40459c
lea eax, [esp + 0x14]
mov edi, esi
call fcn.00404a69
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00402f9a
jmp 0x404761
mov eax, dword [ebx + 0xef8]
push dword [eax + 0x2a8]
mov ecx, dword [ebx + 0xee8]
call fcn.00416720
jmp 0x404761
mov ecx, dword [ebx + 0xf10]
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push edx
call dword [eax + 0x15c]
lea edi, [ebx + 0xe80]
mov dword [esp + 0x30], esi
call fcn.00404a69
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.00402f9a
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
mov dword [esp + 0x18], esi
je 0x404678
add eax, 0xfffffff0
call fcn.00402e21
add eax, 0x10
mov dword [esp + 0x14], eax
xor edi, edi
inc edi
lea esi, [esp + 0x14]
mov dword [esp + 0x30], edi
call fcn.00404b5e
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x404639
xor eax, eax
jmp 0x404640
push esi
call fcn.00434f36
pop ecx
lea edx, [esp + 0x14]
call fcn.00402f31
cmp dword [esi - 0xc], 2
jl 0x404662
mov eax, dword [ebx + 0xe80]
call fcn.00426660
test eax, eax
je 0x404662
mov dword [esp + 0x18], edi
or dword [esp + 0x30], 0xffffffff
lea eax, [esi - 0x10]
call fcn.00402f9a
cmp dword [esp + 0x18], 0
jne 0x404690
xor esi, esi
push 0x10
push esi
push 0x4530bc
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x404765
mov dl, 0xfe
mov eax, ebx
mov byte [esp + 0x13], 0xfe
call fcn.00417970
add byte [esp + 0x13], 0xe7
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dl, byte [esp + 0x13]
mov eax, ebx
call fcn.00417970
cmp byte [esp + 0x13], 0x19
ja 0x40469e
push edi
push edi
mov esi, ebx
call fcn.00414da0
mov eax, dword [ebx]
push edi
xor edi, edi
push edi
mov ecx, ebx
call dword [eax + 0xf8]
push 5
lea esi, [ebx + 0x444]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea edi, [ebx + 0x8a4]
lea eax, [ebx + 0xe80]
call fcn.00404a69
mov eax, dword [ebx + 0xefc]
mov eax, dword [eax + 0x2a8]
mov dword [ebx + 0x890], eax
mov eax, dword [ebx + 0xf00]
mov eax, dword [eax + 0x2a8]
mov dword [ebx + 0x894], eax
mov eax, dword [ebx + 0xf04]
mov eax, dword [eax + 0x2a8]
mov dword [ebx + 0x898], eax
jmp 0x4047e1
sub eax, 0x3e8
je 0x40474d
dec eax
je 0x40477a
dec eax
jne 0x404761
push esi
push 0xf060
push 0x112
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dl, 0xfe
mov eax, ebx
mov byte [esp + 0x13], 0xfe
call fcn.00417970
add byte [esp + 0x13], 0xe7
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dl, byte [esp + 0x13]
mov eax, ebx
call fcn.00417970
cmp byte [esp + 0x13], 0x19
ja 0x404788
xor edi, edi
inc edi
push edi
push edi
mov esi, ebx
call fcn.00414da0
mov eax, dword [ebx]
push edi
xor edi, edi
push edi
mov ecx, ebx
call dword [eax + 0xf8]
push 5
lea esi, [ebx + 0x444]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea esi, [ebx + 0x440]
call fcn.00405fc0
jmp 0x404761