Function at 0x422030
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4b9430]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
cmp eax, 0xfac
jg 0x42224b
je 0x4221f5
add eax, 0xfffff060
cmp eax, 7
ja case.default.0x422331
jmp dword [eax*4 + 0x422398]
xor eax, eax
cmp dword [0x4c1cbc], eax
sete al
push eax
mov dword [0x4c1cbc], eax
call fcn.00421f20
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4c7128]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4c5a9c]
push 0x4ab595
push 0
push 0xc
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
xor edx, edx
cmp dword [0x4c5ca0], edx
sete dl
mov dword [0x4c5ca0], edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x4c1cd0], eax
sete al
mov dword [0x4c1cd0], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
xor ecx, ecx
cmp dword [0x4c1cd4], ecx
sete cl
mov dword [0x4c1cd4], ecx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
push 0x104
lea edx, [ebp - 0x10f]
push 0
push edx
mov byte [ebp - 0x110], 0
call fcn.00463ac0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x110]
push 0x5c
push ecx
call fcn.0045e830
mov byte [eax], 0
lea eax, [ebp - 0x110]
add esp, 8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422186
mov edx, dword [str._adhook.ini]
mov ecx, dword [0x4ab8f8]
mov dword [eax], edx
mov edx, dword [0x4ab8fc]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
xor eax, eax
cmp dword [0x4c1cb8], eax
sete al
mov dword [0x4c1cb8], eax
test eax, eax
je 0x4221ca
lea eax, [ebp - 0x110]
push eax
push 0x4b1ea8
jmp 0x4221d6
lea ecx, [ebp - 0x110]
push ecx
push 0x4ab9e0
push str.ShowAnimation
push 0x4ab9f4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x4c1f14], eax
mov ecx, 0x4b1eac
sete al
mov dword [0x4c1f14], eax
test eax, eax
jne 0x422213
mov ecx, 0x4b1ebc
call fcn.00423920
push 0
push 0
push 0x4042a0
call fcn.0045dd34
mov edx, dword [0x4c7128]
add esp, 0xc
push 0
push 0xa
push 2
push edx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
cmp eax, 0x9c50
jg 0x422327
je 0x42231a
cmp eax, 0x9c47
jg 0x4222d7
je 0x4222c3
cmp eax, 0x7530
je 0x42229e
cmp eax, 0x9c46
jne case.default.0x422331
xor eax, eax
cmp dword [0x4c1cc0], eax
sete al
mov edi, eax
mov dword [0x4c1cc0], edi
call fcn.004228e0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4c5a9c]
push 0
push 0
push 0x301
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
call fcn.004035f0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
cmp eax, 0x9c4b
jne case.default.0x422331
mov eax, dword [0x4c5c8c]
test eax, eax
je 0x422301
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
call fcn.0041b000
mov dword [0x4c5c8c], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
push 5
push 0
push 0
push str.http:__shang.qq.com_wpa_qunwpa_idkey0bf3d07951fb47dd8c6b18c418582dea95c8a56c78c2cd2ac9c7080d81468525
jmp 0x42237c
add eax, 0xffff63af
cmp eax, 3
ja case.default.0x422331
jmp dword [eax*4 + 0x4223b8]
push 0
call fcn.00421f20
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x4045e0
call fcn.0045dd34
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret
push 5
push 0
push 0
push 0x4c5b95
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret