Function at 0x405098
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push 0x20
mov eax, 0x45b396
call fcn.00445165
mov dword [ebp - 0x10], ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call esi
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
call esi
call fcn.00406034
mov ebx, eax
mov dword [0x47f8a8], edi
mov dword [0x47f8ac], edi
mov dword [ebp - 0x1c], edi
call fcn.00402c56
mov dword [esp], str.SCRIPT_DEBUGGER
call fcn.00402d3b
mov dword [esp], str.SCRIPT_DEBUGGER_IE
call fcn.00402d3b
pop ecx
call fcn.004043c6
test eax, eax
jne 0x405113
push 0x464afc
push str.C:WINDOWS_system32driversetchosts
call fcn.00441986
pop ecx
pop ecx
cmp eax, edi
je 0x405113
push eax
call fcn.00441a14
pop ecx
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x28], 0x604
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00404a7a
cmp dword [0x47f588], edi
jne 0x405159
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push 0x40442a
push edi
push edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x405159
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call fcn.004058cf
mov ecx, dword [ebp - 0x10]
call fcn.0042230e
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
xor edi, edi
inc edi
test eax, eax
jne 0x405473
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jne 0x405473
push esi
call fcn.00423304
mov dword [esp], pe_nt_image_headers32
call fcn.0041558a
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x4051b1
push eax
call fcn.004101a8
mov esi, eax
or dword [ebp - 4], 0xffffffff
xor eax, eax
cmp esi, eax
jne 0x4051c2
xor eax, eax
jmp 0x405475
mov edx, dword [esi]
push eax
push eax
push eax
push eax
push 0x476afc
push 0xcf0000
push eax
push eax
mov ecx, esi
call dword [edx + 0x13c]
test eax, eax
je 0x405473
mov eax, dword [ebp - 0x10]
push 0
mov ecx, esi
mov dword [eax + 0x20], esi
call fcn.0041b86e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x20]
mov dword [0x47f8a4], eax
mov eax, dword [ebp - 0x14]
cmp eax, edi
mov dword [ebp - 0x18], edi
jle 0x405323
mov eax, dword [ebp - 0x18]
lea esi, [ebx + eax*4]
mov eax, dword [esi]
cmp byte [eax], 0x2d
jne 0x40523c
inc eax
push 0x4656fc
push eax
call fcn.004576d0
pop ecx
pop ecx
test eax, eax
jne 0x40523c
mov dword [0x47f8a8], edi
jmp 0x405314
mov eax, dword [esi]
cmp byte [eax], 0x2d
jne 0x405260
inc eax
push str.timer
push eax
call fcn.004576d0
pop ecx
pop ecx
test eax, eax
jne 0x405260
mov dword [0x47f8ac], edi
jmp 0x405314
mov eax, dword [esi]
cmp byte [eax], 0x2d
jne 0x405281
inc eax
push str.desknav
push eax
call fcn.004576d0
pop ecx
pop ecx
test eax, eax
jne 0x405281
mov dword [ebp - 0x1c], edi
jmp 0x405314
mov eax, dword [esi]
cmp byte [eax], 0x2d
jne 0x4052a2
inc eax
push str.preload
push eax
call fcn.004576d0
pop ecx
pop ecx
test eax, eax
jne 0x4052a2
mov dword [0x47f16c], edi
jmp 0x405314
mov eax, dword [esi]
cmp byte [eax], 0x2d
jne 0x4052c6
inc eax
push str.exit
push eax
call fcn.004576d0
pop ecx
pop ecx
test eax, eax
jne 0x4052c6
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xa4], edi
jmp 0x405314
mov eax, dword [esi]
cmp byte [eax], 0x2d
jne 0x4052e7
inc eax
push str.delf
push eax
call fcn.004576d0
pop ecx
pop ecx
test eax, eax
jne 0x4052e7
mov dword [0x47f570], edi
jmp 0x405314
mov esi, dword [esi]
cmp byte [esi], 0x2d
jne 0x405300
push str.http:__www.google.com.hk_
inc esi
push esi
call fcn.004576d0
pop ecx
pop ecx
test eax, eax
je 0x405314
mov esi, edi
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x40547b
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x405302
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jl 0x405212
mov edx, dword [ebp - 0x10]
xor ecx, ecx
cmp dword [edx + 0xa4], ecx
jne 0x4051bb
cmp dword [ebp - 0x1c], ecx
jne 0x405341
cmp dword [0x47f16c], ecx
je 0x405358
cmp eax, edi
mov esi, edi
jle 0x405358
mov edx, dword [ebx + esi*4]
cmp byte [edx], 0x2d
jne 0x40549b
inc esi
cmp esi, eax
jl 0x405347
cmp dword [0x47f8a8], ecx
je 0x4053e4
cmp eax, edi
mov esi, edi
jle 0x4053e4
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
je 0x4053de
call fcn.0041e760
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040237a
mov dword [ebp - 4], 3
call fcn.0041e760
push eax
lea ecx, [ebp - 0x18]
call fcn.0040237a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 4
push dword [ebx + esi*4]
call fcn.00426f9d
test eax, eax
je 0x4053c4
cmp dword [ebp - 0x20], edi
jb 0x4053c4
cmp dword [ebp - 0x20], 0xb
jbe 0x4054ba
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023bd
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004023bd
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x40536a
call fcn.00402752
call fcn.00402752
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4053f1
sub eax, edx
cmp eax, 4
jbe 0x405437
push str.http:__
call fcn.00402752
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
jne 0x40541b
mov dword [0x47f694], edi
push str.123.sogou
call fcn.00402752
push eax
call fcn.00441780
pop ecx
pop ecx
test eax, eax
je 0x405437
mov dword [0x47f898], edi
push edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x464857
mov dword [0x47f8b0], edi
call fcn.0040230f
mov dword [ebp - 4], 6
call fcn.00402752
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0040230f
or dword [ebp - 4], 0xffffffff
call fcn.004045ca
add esp, 0x10
mov eax, edi
call fcn.0044523d
ret
push edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x464857
call fcn.0040230f
push ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], esp
mov ecx, esp
push dword [ebx + esi*4]
jmp 0x405462
push edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x464857
call fcn.0040230f
push ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x14], esp
jmp 0x405494
push edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x464857
call fcn.0040230f
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [ebx + esi*4]
call fcn.0040230f
mov byte [ebp - 4], 4
call fcn.004045ca
mov ecx, dword [ebp - 0x18]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004023bd
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004023bd
jmp 0x405473