Function at 0x43cef0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ad6d4
mov eax, dword fs:[0]
push eax
sub esp, 0x9dc
mov eax, dword [0x4d1644]
xor eax, esp
mov dword [esp + 0x9d8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d1644]
xor eax, esp
push eax
lea eax, [esp + 0x9f0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa00]
mov ebp, dword [esp + 0xa04]
xor ebx, ebx
lea ecx, [esp + 0x124]
push ebx
push ecx
mov dword [esp + 0x4c], eax
call fcn.004440e0
add esp, 8
cmp dword [esp + 0x138], ebx
mov dword [esp + 0x9f8], ebx
jne 0x43cf83
cmp dword [esp + 0x13c], 8
jb 0x43d8d4
mov edx, dword [esp + 0x128]
push edx
call fcn.00479e49
add esp, 4
jmp 0x43d8d4
lea eax, [esp + 0xec]
push ebx
push eax
call fcn.00444030
add esp, 8
cmp dword [esp + 0x100], ebx
mov byte [esp + 0x9f8], 1
jne 0x43cfe6
mov esi, 8
cmp dword [esp + 0x104], esi
jb 0x43cfc3
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x13c], esi
mov dword [esp + 0x104], 7
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], bx
jmp 0x43cf68
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
push 0x4b8590
lea ecx, [esp + 0xd4]
mov byte [esp + 0x9fc], 2
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd8]
mov esi, 7
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 3
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], 1
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 4
call fcn.0043ce60
mov edi, 8
cmp dword [esp + 0x2c], edi
jb 0x43d06c
mov edx, dword [esp + 0x18]
push edx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d09a
mov eax, dword [esp + 0xd4]
push eax
call fcn.00479e49
add esp, 4
push str.Tencentdl.exe
lea ecx, [esp + 0xd4]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 5
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], 1
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 6
call fcn.0043ce60
cmp dword [esp + 0x2c], edi
jb 0x43d102
mov eax, dword [esp + 0x18]
push eax
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d130
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00479e49
add esp, 4
push str.tnproxy.dll
lea ecx, [esp + 0xd4]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xd8]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 7
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], bl
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 8
call fcn.0043ce60
cmp dword [esp + 0x2c], edi
jb 0x43d197
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d1c5
mov edx, dword [esp + 0xd4]
push edx
call fcn.00479e49
add esp, 4
push 0x4b8dec
lea ecx, [esp + 0xd4]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 9
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0xa
call fcn.0043ce60
cmp dword [esp + 0x2c], edi
jb 0x43d22c
mov edx, dword [esp + 0x18]
push edx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d25a
mov eax, dword [esp + 0xd4]
push eax
call fcn.00479e49
add esp, 4
push 0x4b8dc4
lea ecx, [esp + 0xd4]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0xb
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], 1
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0xc
call fcn.0043ce60
cmp dword [esp + 0x2c], edi
jb 0x43d2c2
mov eax, dword [esp + 0x18]
push eax
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d2f0
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00479e49
add esp, 4
push str.tinyxml.dll
lea ecx, [esp + 0xd4]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xd8]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0xd
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], bl
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0xe
call fcn.0043ce60
cmp dword [esp + 0x2c], edi
jb 0x43d357
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d385
mov edx, dword [esp + 0xd4]
push edx
call fcn.00479e49
add esp, 4
push str.bugreport_xf.exe
lea ecx, [esp + 0xd4]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0xf
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0x10
call fcn.0043ce60
cmp dword [esp + 0x2c], edi
jb 0x43d3ec
mov edx, dword [esp + 0x18]
push edx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d41a
mov eax, dword [esp + 0xd4]
push eax
call fcn.00479e49
add esp, 4
push str.MiniDownload.dll
lea ecx, [esp + 0xd4]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0x11
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00402186
mov byte [esp + 0x30], 1
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0x12
call fcn.0043ce60
cmp dword [esp + 0x2c], edi
jb 0x43d482
mov eax, dword [esp + 0x18]
push eax
call fcn.00479e49
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43d4b0
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00479e49
add esp, 4
cmp dword [ebp + 0x14], ebx
je 0x43d50e
push ebp
call fcn.00443310
add esp, 4
test al, al
je 0x43d50e
push str.TencentDL
lea edx, [esp + 0xd4]
push ebp
push edx
call fcn.0040cbf0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x134]
push ecx
lea edx, [esp + 0xe4]
push edx
mov byte [esp + 0xa10], 0x13
call fcn.00436ca0
add esp, 0x18
lea ecx, [esp + 0xd0]
mov byte [esp + 0x9f8], 2
call fcn.00402055
push 0x4be620
lea ecx, [esp + 0xd4]
call fcn.004042bd
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x10c]
push ecx
mov byte [esp + 0xa00], 0x14
call fcn.00443930
add esp, 8
cmp dword [esp + 0xe8], edi
mov byte [esp + 0x9f8], 0x16
jb 0x43d560
mov edx, dword [esp + 0xd4]
push edx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x11c], ebx
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], bx
jne 0x43d5f2
cmp dword [esp + 0x120], edi
jb 0x43d598
mov eax, dword [esp + 0x10c]
push eax
call fcn.00479e49
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x120], esi
mov dword [esp + 0x11c], ebx
mov word [esp + 0x10c], bx
call fcn.0043aaa0
cmp dword [esp + 0x104], edi
jb 0x43d5d0
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x13c], edi
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], bx
jmp 0x43cf68
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x43d609
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x198]
call fcn.0043f730
lea eax, [esp + 0x9e4]
push eax
lea ecx, [esp + 0x198]
mov byte [esp + 0x9fc], 0x17
mov word [esp + 0x9e8], bx
mov dword [esp + 0x9ea], ebx
mov word [esp + 0x9ee], bx
call fcn.0043f340
movzx esi, word [esp + 0x9e8]
lea ecx, [esp + 0x108]
push esi
push ecx
call fcn.0043cb30
add esp, 8
cmp al, bl
je 0x43d893
push 1
push 3
lea ecx, [esp + 0x50]
call fcn.0043aae0
push esi
push 0x4b775c
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0xa08], 0x18
call fcn.0043a2f0
add esp, 8
push eax
call fcn.0043a580
add esp, 8
mov ecx, eax
call fcn.0043a7d0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00435c30
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x114]
mov byte [esp + 0xa04], 0x19
call fcn.00402186
lea ecx, [esp + 0x14]
mov byte [esp + 0x9f8], 0x18
call fcn.00402055
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x110]
push ecx
call fcn.00436ca0
add esp, 0xc
test al, al
je 0x43d882
mov ecx, dword [esp + 0x44]
cmp ecx, ebx
je 0x43d713
call fcn.00457890
lea edx, [esp + 0x15c]
push edx
call fcn.00435a20
push 0x4b8d04
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x14c]
push ecx
mov byte [esp + 0xa08], 0x1a
call fcn.0040cbf0
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0xa10], 0x1b
call fcn.00442ef0
add esp, 0x18
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x14c]
mov byte [esp + 0xa04], 0x1c
call fcn.00402186
lea ecx, [esp + 0x14]
mov byte [esp + 0x9f8], 0x1b
call fcn.00402055
cmp dword [esp + 0x170], ebx
je 0x43d7f6
cmp dword [esp + 0x174], edi
mov eax, dword [esp + 0x160]
jae 0x43d7a8
lea eax, [esp + 0x160]
push eax
call fcn.00416990
add esp, 4
test al, al
je 0x43d7f6
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x160]
push edx
call fcn.00417220
add esp, 8
test al, al
je 0x43d7f6
cmp dword [esp + 0x174], edi
mov eax, dword [esp + 0x160]
jae 0x43d7e8
lea eax, [esp + 0x160]
push 0x4b8d5c
push eax
call fcn.0043fa60
add esp, 8
cmp dword [esp + 0x158], edi
mov eax, dword [esp + 0x144]
jae 0x43d80d
lea eax, [esp + 0x144]
push eax
call fcn.00416990
add esp, 4
test al, al
je 0x43d841
cmp dword [esp + 0x158], edi
mov eax, dword [esp + 0x144]
jae 0x43d831
lea eax, [esp + 0x144]
push ebx
push ebx
push str.__RegServer
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x180]
push ecx
call fcn.0040cbf0
add esp, 0xc
lea ecx, [esp + 0x178]
call fcn.00402055
lea ecx, [esp + 0x140]
call fcn.00402055
lea ecx, [esp + 0x15c]
call fcn.00402055
lea ecx, [esp + 0x48]
mov byte [esp + 0x9f8], 0x17
call fcn.00434a80
lea ecx, [esp + 0x194]
mov byte [esp + 0x9f8], 0x16
call fcn.0043f3b0
lea ecx, [esp + 0x108]
call fcn.00402055
lea ecx, [esp + 0x34]
call fcn.0043aaa0
lea ecx, [esp + 0xec]
call fcn.00402055
lea ecx, [esp + 0x124]
call fcn.00402055
mov ecx, dword [esp + 0x9f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9d8]
xor ecx, esp
call fcn.00479e10
add esp, 0x9e8
ret