Function at 0x411110
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1480
call fcn.004140b0
mov eax, dword [0x42a95c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x13e8]
call fcn.004062c0
lea ecx, [ebp - 0xeb8]
push ecx
call fcn.0040e520
add esp, 4
push str.HKBTokendftxHKB_DFTX_105Tokenlib.dll
lea edx, [ebp - 0xeb8]
push edx
call fcn.004118b0
add esp, 8
lea eax, [ebp - 0xeb8]
push eax
lea ecx, [ebp - 0x13e8]
call fcn.00406330
mov dword [ebp - 0xecc], eax
cmp dword [ebp - 0xecc], 0
je 0x4111b1
push 0
push 0xb
call fcn.004129f0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
call fcn.00407e30
mov dword [ebp - 0x146c], 1
lea ecx, [ebp - 0x13e8]
call fcn.004062f0
mov eax, dword [ebp - 0x146c]
jmp 0x411682
mov dword [ebp - 0x21c], 0x800
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0xca8]
push edx
lea ecx, [ebp - 0x13e8]
call fcn.00406c80
mov dword [ebp - 0xecc], eax
cmp dword [ebp - 0xecc], 0
je 0x411236
mov eax, dword [ebp - 0xecc]
push eax
push 0xf
call fcn.004129f0
add esp, 4
push eax
lea ecx, [ebp - 0x10d8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea edx, [ebp - 0x10d8]
push edx
mov ecx, dword [ebp - 8]
call fcn.00407e30
mov dword [ebp - 0x1470], 2
lea ecx, [ebp - 0x13e8]
call fcn.004062f0
mov eax, dword [ebp - 0x1470]
jmp 0x411682
cmp dword [ebp - 0x21c], 0
jne 0x4113cd
push 0
push 0x10
call fcn.004129f0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
call fcn.00407e30
push 1
mov ecx, dword [ebp - 8]
call fcn.00407ec0
lea eax, [ebp - 0xeb8]
push eax
call fcn.0040e520
add esp, 4
lea ecx, [ebp - 0xeb8]
push ecx
push str.__sInternet_Exploreriexplore.exe___https:__www.hkbchina.com_pweb_CertDownloadPre.do_UserIdhkbBankId9999_
lea edx, [ebp - 0x10d8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x1468], 0x44
push 0x40
push 0
lea eax, [ebp - 0x1464]
push eax
call fcn.00413440
add esp, 0xc
mov dword [ebp - 0x143c], 1
mov ecx, 1
mov word [ebp - 0x1438], cx
lea edx, [ebp - 0x1410]
push edx
lea eax, [ebp - 0x1468]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x10d8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1420], eax
push 1
lea edx, [ebp - 0x13fc]
push edx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x13fc]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x141c], 0xc
mov dword [ebp - 0x1414], 1
lea ecx, [ebp - 0x13fc]
mov dword [ebp - 0x1418], ecx
push str.GlobalEVENT_CERT_CHANGE_DFTX_HKB
push 0
push 1
lea edx, [ebp - 0x141c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x1400], eax
push 6
mov eax, dword [ebp - 0x1400]
push eax
call fcn.0040e480
add esp, 8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1400]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4113b3
mov edx, dword [ebp - 0x1400]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x11
call fcn.004129f0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
call fcn.00407e30
mov dword [ebp - 0x1474], 1
lea ecx, [ebp - 0x13e8]
call fcn.004062f0
mov eax, dword [ebp - 0x1474]
jmp 0x411682
mov eax, dword [ebp - 0x1400]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x12
call fcn.004129f0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
call fcn.00407e30
push 0
mov ecx, dword [ebp - 8]
call fcn.00407ec0
mov dword [ebp - 0x21c], 0x800
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xca8]
push ecx
lea ecx, [ebp - 0x13e8]
call fcn.00406c80
mov dword [ebp - 0xecc], eax
cmp dword [ebp - 0xecc], 0
je 0x411453
push 0
push 0xc
call fcn.004129f0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
call fcn.00407e30
mov dword [ebp - 0x1478], 2
lea ecx, [ebp - 0x13e8]
call fcn.004062f0
mov eax, dword [ebp - 0x1478]
jmp 0x411682
mov dword [ebp - 4], 0
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00413440
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x4a8], cx
push 0x206
push 0
lea edx, [ebp - 0x4a6]
push edx
call fcn.00413440
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2a0], ax
push 0x7e
push 0
lea ecx, [ebp - 0x29e]
push ecx
call fcn.00413440
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1158], dx
push 0x7e
push 0
lea eax, [ebp - 0x1156]
push eax
call fcn.00413440
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
push ecx
lea edx, [ebp - 0xca8]
push edx
push 0x10001
call dword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x411527
push 0
push 0x13
call fcn.004129f0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
call fcn.00407e30
mov dword [ebp - 0x147c], 2
lea ecx, [ebp - 0x13e8]
call fcn.004062f0
mov eax, dword [ebp - 0x147c]
jmp 0x411682
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x4229b0
push 0
push 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
push 0x104
lea edx, [ebp - 0x4a8]
push edx
push str.2.5.4.3
push 1
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
lea ecx, [ebp - 0xcb0]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0xec8]
push ecx
lea edx, [ebp - 0xcb0]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0xec2]
push eax
movzx ecx, word [ebp - 0xec6]
push ecx
movzx edx, word [ebp - 0xec8]
push edx
push 0x4229c0
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0xcb0]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, 0x28
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0xec8]
push ecx
lea edx, [ebp - 0xcb0]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0xec2]
push eax
movzx ecx, word [ebp - 0xec6]
push ecx
movzx edx, word [ebp - 0xec8]
push edx
push str._d__02d__02d
lea eax, [ebp - 0x1158]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x1158]
push ecx
lea edx, [ebp - 0x2a0]
push edx
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0x14
call fcn.004129f0
add esp, 4
push eax
lea edx, [ebp - 0x10d8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
push 0
lea ecx, [ebp - 0x10d8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00407e30
mov dword [ebp - 0x1480], 0
lea ecx, [ebp - 0x13e8]
call fcn.004062f0
mov eax, dword [ebp - 0x1480]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00413653
mov esp, ebp
pop ebp
ret 4