Function at 0x404920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x240
mov eax, dword [0x4860f0]
xor eax, esp
mov dword [esp + 0x23c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x108]
push esi
push edi
mov edi, ecx
cmp eax, dword [edi + 0x2bc]
je 0x404bef
cmp eax, dword [edi + 0x2c0]
jne 0x404982
mov eax, 0xf020
mov ecx, 0x112
mov edx, edi
call fcn.0041f2f0
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x2e4]
cmp eax, ecx
jne 0x404a09
mov eax, ecx
call fcn.00421240
test al, al
je 0x4049bf
mov ecx, dword [edi + 0x2c4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
push 0
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x310], 0
jne 0x4049e0
cmp dword [edi + 0x314], 0
je 0x4049e0
mov eax, ecx
call fcn.00421240
test al, al
je 0x4049e0
mov al, 1
jmp 0x4049e2
xor al, al
mov ecx, dword [edi + 0x2c4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0xd8]
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4
cmp eax, dword [edi + 0x2cc]
jne 0x404a3c
push 1
push 0
push 0
push str.http:__web.4399.com_local_cjwt_201006_14_25269.html
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4
cmp eax, dword [edi + 0x2d0]
jne 0x404aa5
mov ecx, dword [edi + 0x2b4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc8]
call eax
test al, al
jne 0x404bf6
mov ecx, dword [edi + 0x2b0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x64]
push 0x20
call eax
mov ecx, dword [edi + 0x2b4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xcc]
push 1
call eax
mov ecx, dword [edi + 0x2b8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xcc]
push 0
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4
cmp eax, dword [edi + 0x2c8]
jne 0x404ba1
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x3a]
push edx
mov word [esp + 0x3c], cx
call fcn.00459a90
mov eax, dword [edi + 4]
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 0x30]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0x470cc0
mov dword [esp + 0x24], 0x42
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
je 0x404b84
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x404b84
lea esi, [esp + 0xc]
lea edx, [esp + 0x30]
call fcn.00404200
test eax, eax
jl 0x404b4e
mov eax, dword [esp + 0xc]
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax*2 + 0x30]
call fcn.00404240
mov ecx, dword [edi + 0x2ec]
mov edx, dword [ecx]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 0x30]
push eax
call edx
xor eax, eax
cmp dword [edi + 0x310], eax
jne 0x404b73
cmp dword [edi + 0x314], eax
setne al
mov ecx, dword [edi + 0x2c4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0xd8]
call eax
mov ecx, edi
call fcn.00404ed0
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4
cmp eax, dword [edi + 0x2c4]
jne 0x404bc5
push edi
call fcn.00405060
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4
cmp eax, dword [edi + 0x2d4]
jne 0x404bf6
mov eax, dword [edi + 0x2e8]
call fcn.00421240
test al, al
je 0x404be1
call fcn.00405710
call fcn.00406bd0
call fcn.00409900
test eax, eax
je 0x404bf6
mov esi, edi
call fcn.0041edd0
mov ecx, dword [esp + 0x244]
pop edi
pop esi
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 4