Function at 0x41eb80
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b04e
mov eax, dword fs:[0]
push eax
mov eax, 0x5114
call fcn.00527810
mov eax, dword [0x599690]
xor eax, ebp
mov dword [ebp - 0x54], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50d0], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x50d0]
mov dword [eax + 0xa8], 8
mov ecx, dword [ebp - 0x50d0]
cmp dword [ecx + 0xac], 3
je 0x41edab
mov ecx, dword [ebp - 0x50d0]
add ecx, 0x110
call fcn.00409e50
movzx edx, al
test edx, edx
jne 0x41ecd4
mov eax, dword [ebp - 0x50d0]
mov ecx, dword [eax + 0x12c]
push ecx
mov edx, dword [ebp - 0x50d0]
add edx, 0x110
push ecx
mov ecx, esp
mov dword [ebp - 0x5088], esp
push edx
call fcn.0040a2e0
mov dword [ebp - 0x50d4], eax
mov eax, dword [ebp - 0x50d4]
mov dword [ebp - 0x50d8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x50d0]
mov edx, dword [ecx + 0xac]
push edx
mov eax, dword [ebp - 0x50d0]
add eax, 0x148
push ecx
mov ecx, esp
mov dword [ebp - 0x508c], esp
push eax
call fcn.0040a2e0
mov dword [ebp - 0x50dc], eax
mov ecx, dword [ebp - 0x50dc]
mov dword [ebp - 0x50e0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x50d0]
add edx, 0x14c
push ecx
mov ecx, esp
mov dword [ebp - 0x5090], esp
push edx
call fcn.0040a2e0
mov dword [ebp - 0x50e4], eax
mov eax, dword [ebp - 0x50e4]
mov dword [ebp - 0x50e8], eax
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x5094], esp
push 0x575290
call fcn.00404510
mov dword [ebp - 0x50ec], eax
mov byte [ebp - 4], 0
mov ecx, 0x5a1048
call fcn.0041a550
jmp 0x41edab
mov ecx, dword [ebp - 0x50d0]
mov edx, dword [ecx + 0x12c]
push edx
mov eax, dword [ebp - 0x50d0]
add eax, 0x114
push ecx
mov ecx, esp
mov dword [ebp - 0x5098], esp
push eax
call fcn.0040a2e0
mov dword [ebp - 0x50f0], eax
mov ecx, dword [ebp - 0x50f0]
mov dword [ebp - 0x50f4], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x50d0]
mov eax, dword [edx + 0xac]
push eax
mov ecx, dword [ebp - 0x50d0]
add ecx, 0x148
push ecx
mov edx, esp
mov dword [ebp - 0x509c], esp
push ecx
mov ecx, edx
call fcn.0040a2e0
mov dword [ebp - 0x50f8], eax
mov eax, dword [ebp - 0x50f8]
mov dword [ebp - 0x50fc], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x50d0]
add ecx, 0x14c
push ecx
mov edx, esp
mov dword [ebp - 0x50a0], esp
push ecx
mov ecx, edx
call fcn.0040a2e0
mov dword [ebp - 0x5100], eax
mov eax, dword [ebp - 0x5100]
mov dword [ebp - 0x5104], eax
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x50a4], esp
push str.http:__www.atpanel.com_bluesky.1.1.1.1.11
call fcn.00404510
mov dword [ebp - 0x5108], eax
mov byte [ebp - 4], 0
mov ecx, 0x5a1048
call fcn.0041a550
mov ecx, dword [ebp - 0x50d0]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41edcf
push 0x5752e8
mov ecx, dword [ebp - 0x50d0]
call fcn.00425499
lea ecx, [ebp - 0x4c]
call fcn.0040a300
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x50d0]
add eax, 0x128
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040a1b0
mov ecx, dword [ebp - 0x50d0]
add ecx, 0x148
call fcn.00409e50
movzx ecx, al
test ecx, ecx
jne 0x41ee5c
mov edx, dword [ebp - 0x50d0]
add edx, 0x148
push edx
push str.__installpid
lea eax, [ebp - 0x50a8]
push eax
call fcn.00413040
add esp, 0xc
mov dword [ebp - 0x510c], eax
mov ecx, dword [ebp - 0x510c]
mov dword [ebp - 0x5110], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x5110]
push edx
lea ecx, [ebp - 0x4c]
call fcn.0040a1b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x50a8]
call fcn.004049f0
lea ecx, [ebp - 0x4c]
call fcn.0041b560
mov eax, dword [ebp - 0x50d0]
cmp dword [eax + 0xac], 2
je 0x41ee82
mov ecx, dword [ebp - 0x50d0]
cmp dword [ecx + 0xac], 3
jne 0x41eed7
push 0
push 0x57530c
lea ecx, [ebp - 0x4c]
call fcn.00403d90
cmp eax, 0xffffffff
jne 0x41eed7
push 0
push 0x575310
lea ecx, [ebp - 0x4c]
call fcn.00403d90
cmp eax, 0xffffffff
jne 0x41eed7
push 0
push 0x575318
lea ecx, [ebp - 0x4c]
call fcn.00403d90
mov esi, eax
lea ecx, [ebp - 0x4c]
call fcn.004036a0
sub eax, 3
cmp esi, eax
je 0x41eed7
push str.__S
lea ecx, [ebp - 0x4c]
call fcn.00409ec0
mov edx, dword [ebp - 0x50d0]
cmp dword [edx + 0xc8], 0
je 0x41ef61
mov eax, dword [ebp - 0x50d0]
cmp dword [eax + 0xcc], 0
je 0x41ef2c
push 0
push 0x575324
lea ecx, [ebp - 0x4c]
call fcn.00403d90
cmp eax, 0xffffffff
je 0x41ef1d
push 0x575338
push 0x575350
lea ecx, [ebp - 0x4c]
call fcn.00409110
jmp 0x41ef2a
push str.__SetDefualtBrowser1
lea ecx, [ebp - 0x4c]
call fcn.00409ec0
jmp 0x41ef61
push 0
push str._SetDefualtBrowser
lea ecx, [ebp - 0x4c]
call fcn.00403d90
cmp eax, 0xffffffff
je 0x41ef54
push str._SetDefualtBrowser0
push str._SetDefualtBrowser1
lea ecx, [ebp - 0x4c]
call fcn.00409110
jmp 0x41ef61
push str.__SetDefualtBrowser0
lea ecx, [ebp - 0x4c]
call fcn.00409ec0
mov ecx, dword [ebp - 0x50d0]
cmp dword [ecx + 0xc0], 0
je 0x41efeb
mov edx, dword [ebp - 0x50d0]
cmp dword [edx + 0xc4], 0
je 0x41efb6
push 0
push 0x5753dc
lea ecx, [ebp - 0x4c]
call fcn.00403d90
cmp eax, 0xffffffff
je 0x41efa7
push 0x5753f0
push 0x575408
lea ecx, [ebp - 0x4c]
call fcn.00409110
jmp 0x41efb4
push str.__TaobaoWebShortCut1
lea ecx, [ebp - 0x4c]
call fcn.00409ec0
jmp 0x41efeb
push 0
push str._TaobaoWebShortCut
lea ecx, [ebp - 0x4c]
call fcn.00403d90
cmp eax, 0xffffffff
je 0x41efde
push str._TaobaoWebShortCut0
push str._TaobaoWebShortCut1
lea ecx, [ebp - 0x4c]
call fcn.00409110
jmp 0x41efeb
push str.__TaobaoWebShortCut0
lea ecx, [ebp - 0x4c]
call fcn.00409ec0
mov ecx, dword [ebp - 0x50d0]
add ecx, 0x154
call fcn.00409e50
movzx eax, al
test eax, eax
jne 0x41f09c
mov ecx, dword [ebp - 0x50d0]
add ecx, 0x154
push ecx
push str.__SetPath1__D
lea edx, [ebp - 0x50ac]
push edx
call fcn.00413040
add esp, 0xc
mov dword [ebp - 0x5114], eax
mov eax, dword [ebp - 0x5114]
mov dword [ebp - 0x5118], eax
mov byte [ebp - 4], 9
push 0x574dbb
mov ecx, dword [ebp - 0x5118]
push ecx
lea edx, [ebp - 0x50b0]
push edx
call fcn.00409d80
add esp, 0xc
mov dword [ebp - 0x511c], eax
mov eax, dword [ebp - 0x511c]
mov dword [ebp - 0x5120], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x5120]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.0040a1b0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x50b0]
call fcn.004049f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x50ac]
call fcn.004049f0
mov ecx, dword [ebp - 0x50d0]
call fcn.0041fa00
mov edx, dword [ebp - 0x50d0]
cmp dword [edx + 0xb8], 0
je 0x41f1b7
push 0x2800
push 0
lea eax, [ebp - 0x2854]
push eax
call fcn.00523530
add esp, 0xc
mov ecx, dword [ebp - 0x4c]
push ecx
push 0x5754a4
push 0x27ff
lea edx, [ebp - 0x2854]
push edx
call fcn.0041ba10
add esp, 0x10
lea eax, [ebp - 0x2864]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x2800
push 0
lea ecx, [ebp - 0x5064]
push ecx
call fcn.00523530
add esp, 0xc
lea edx, [ebp - 0x2854]
push edx
movzx eax, word [ebp - 0x2858]
push eax
movzx ecx, word [ebp - 0x285a]
push ecx
movzx edx, word [ebp - 0x285c]
push edx
movzx eax, word [ebp - 0x285e]
push eax
movzx ecx, word [ebp - 0x2862]
push ecx
movzx edx, word [ebp - 0x2864]
push edx
push 0x5754a8
push 0x27ff
lea eax, [ebp - 0x5064]
push eax
call fcn.0041ba10
add esp, 0x28
lea ecx, [ebp - 0x5064]
push ecx
push 0x5754d0
call fcn.00522b8c
add esp, 8
lea edx, [ebp - 0x5064]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x5064]
push eax
lea ecx, [ebp - 0x50cc]
call fcn.00401980
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x50cc]
push ecx
mov ecx, 0x5a0ff8
call fcn.004053d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x50cc]
call fcn.00402110
push 0x3c
push 0
lea edx, [ebp - 0x48]
push edx
call fcn.00523530
add esp, 0xc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], str.open
lea ecx, [ebp + 8]
call fcn.004065e0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x4c]
call fcn.004065e0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50d0]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x158], edx
cmp dword [ebp - 0x50], 0
je 0x41f2b8
mov eax, 1
test eax, eax
je 0x41f2b8
push 0x4ff
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x50d0]
add ecx, 0x158
push ecx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x5068], eax
cmp dword [ebp - 0x5068], 0
jne 0x41f264
jmp 0x41f2b8
cmp dword [ebp - 0x5068], 1
jne 0x41f2a2
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x5084]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x41f2a2
lea eax, [ebp - 0x5084]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x5084]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41f26d
mov edx, dword [ebp - 0x50d0]
cmp dword [edx + 0x158], 0
jne 0x41f2b3
jmp 0x41f2b8
jmp 0x41f226
mov eax, dword [ebp - 0x50d0]
mov ecx, dword [eax + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x50d0]
mov dword [edx + 0x158], 0
mov eax, dword [ebp - 0x50d0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50d0]
mov eax, dword [edx + 0x60]
call eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004049f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004049f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x54]
xor ecx, ebp
call fcn.00520c7a
mov esp, ebp
pop ebp
ret 4