Function at 0x428860
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x474f53
push eax
mov dword fs:[0], esp
sub esp, 0x84
cmp dword [ebp + 8], 0x111
push ebx
push esi
push edi
mov edi, ecx
jne 0x428bcf
mov eax, dword [ebp + 0xc]
movzx esi, ax
lea eax, [esi - 0x407]
cmp eax, 0x20
ja 0x428b84
lea ebx, [esi - 0x407]
cmp esi, 0x408
je 0x428b6b
cmp esi, 0x407
je 0x428b6b
cmp esi, 0x41d
je 0x428b6b
cmp esi, 0x41e
je 0x428b6b
cmp esi, 0x420
je 0x428b6b
cmp esi, 0x421
je 0x428b6b
cmp esi, 0x422
je 0x428b6b
cmp esi, 0x423
je 0x428b6b
mov eax, dword [0x4a3eb4]
cmp esi, 0x424
je 0x428920
cmp esi, 0x426
jne 0x428963
test eax, eax
je 0x428963
push 1
push str._fTMR
push 0x483bc8
call fcn.0043124c
cmp eax, 1
jne 0x42894e
push eax
push 0
push 0
push str.http:__bbs.cfxy.me_thread_427_1_1.html
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x425
jne 0x428992
test eax, eax
je 0x428992
push 0
push 0
push str.QQ2013_betaqq
call fcn.0042d0b3
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0
push ebx
lea ecx, [ebp - 0x90]
mov dword [0x49e9bc], ebx
call fcn.0041b0b0
lea ecx, [ebp - 0x90]
mov dword [ebp - 4], 0
call fcn.0043adc4
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x90]
mov dword [ebp - 4], 0xffffffff
call fcn.0041b0e0
test esi, esi
js 0x428bcf
je 0x428b6b
cmp esi, 1
jne 0x428b28
lea ecx, [ebp - 0x10]
call fcn.00401760
push dword [edi + ebx*4 + 0x85bc]
lea eax, [ebp - 0x10]
push str._s.png
push eax
mov dword [ebp - 4], esi
call fcn.00405230
push 0
push dword [ebp - 0x10]
call fcn.004651e0
add esp, 0x14
lea ecx, [ebp - 0x14]
push eax
call fcn.004016a0
mov byte [ebp - 4], 2
cmp ebx, 0xc
jne 0x428a29
push 0x1e
push 0x3c
jmp 0x428a38
cmp ebx, 0x11
jne 0x428a34
push 0x28
push 0x28
jmp 0x428a38
push 0x14
push 0x14
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0041cba0
call fcn.00405020
test eax, eax
je 0x428af6
push 1
push str._fT:_6R
push 0x4836e8
mov ecx, edi
call fcn.0043124c
cmp eax, 1
jne 0x428a79
call fcn.00405020
test eax, eax
jle 0x428a79
push eax
call fcn.00408160
add esp, 4
call fcn.00405020
test eax, eax
je 0x428af6
push 1
push str._fT:_6R
push 0x4836e8
mov ecx, edi
call fcn.0043124c
cmp eax, 1
jne 0x428aac
call fcn.00405020
test eax, eax
jle 0x428aac
push eax
call fcn.00408160
add esp, 4
call fcn.00405020
test eax, eax
je 0x428ac8
push 0
push 0x4837d0
push 0x483800
mov ecx, edi
call fcn.0043124c
call fcn.00405020
test eax, eax
je 0x428af6
lea ecx, [ebp - 0x14]
call fcn.00419ae0
lea ecx, [ebp - 0x10]
call fcn.00419ae0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp - 0x14]
call fcn.00407270
add esp, 4
mov ecx, edi
push 0
push 2
call fcn.00428180
lea ecx, [ebp - 0x14]
call fcn.00419ae0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00419ae0
jmp 0x428bcf
cmp esi, 2
jne 0x428bcf
lea ecx, [ebp - 0x10]
call fcn.00401760
push ebx
lea eax, [ebp - 0x10]
push str.http:__www.wnr123.com_jumpto.php_sourceid_d
push eax
mov dword [ebp - 4], 3
call fcn.00405230
push dword [ebp - 0x10]
call fcn.00427750
add esp, 0x10
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00419ae0
jmp 0x428bcf
push 0
push dword [edi + ebx*4 + 0x8538]
push 0x111
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x428bcf
lea eax, [esi - 0x805d]
cmp eax, 0xc
ja 0x428bb1
lea eax, [esi - 0x805d]
push 0
shl eax, 9
add eax, str.http:__qq.cfxy.me_checked_8.zip
push eax
push 0x4f5
push dword [0x4a7fc8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, 0x806a
jne 0x428bcf
mov ecx, dword [0x4a4850]
call fcn.0041a280
mov ecx, dword [0x4a4850]
call fcn.0041aaf0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046cd40
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc