Function at 0x402a10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46eec9
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x487550]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487550]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xcc]
mov eax, dword [ebp + 0x1c]
sub eax, dword [ebp + 0x18]
mov esi, dword [esp + 0xd4]
sar eax, 2
mov dword [esp + 0x4c], ebp
cmp esi, eax
jb 0x402a6f
call fcn.0044cae8
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx + esi*4]
mov eax, dword [eax + 8]
cmp eax, 2
jne 0x402b78
push 4
xor ebx, ebx
mov esi, 0xf
push str.0001
lea ecx, [esp + 0x84]
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
call fcn.00403b10
mov dword [esp + 0xc4], ebx
push 4
push 0x477e2c
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00403b10
call fcn.0041fe10
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x80]
push ecx
mov byte [esp + 0xcc], 2
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x38]
push ecx
push eax
call edx
mov edi, 0x10
cmp dword [esp + 0x2c], edi
jb 0x402b1d
mov eax, dword [esp + 0x18]
push eax
call fcn.0044caf8
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], edi
jb 0x402b3c
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0044caf8
add esp, 4
mov dword [esp + 0xc4], 0xffffffff
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
cmp dword [esp + 0x94], edi
jb 0x402b6c
mov edx, dword [esp + 0x80]
push edx
call fcn.0044caf8
add esp, 4
mov edi, ebp
call fcn.004030d0
jmp 0x403060
cmp eax, 3
jne 0x402da9
call fcn.0041fe10
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
xor eax, eax
mov word [esp + 0x80], ax
xor ebx, ebx
push 4
mov eax, 0x477f0c
lea esi, [esp + 0x80]
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], ebx
call fcn.00403ee0
mov dword [esp + 0xc4], 3
call fcn.0041fe10
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0042c040
add esp, 4
mov edi, 0x10
mov byte [esp + 0xc4], 4
cmp dword [eax + 0x18], edi
jb 0x402bf9
mov eax, dword [eax + 4]
jmp 0x402bfc
add eax, 4
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
push str.confirm_entrance
push esi
call eax
cmp dword [esp + 0x2c], edi
jb 0x402c1d
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0044caf8
add esp, 4
or ebp, 0xffffffff
mov esi, 0xf
mov dword [esp + 0xc4], ebp
cmp dword [esp + 0x94], 8
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jb 0x402c52
mov edx, dword [esp + 0x80]
push edx
call fcn.0044caf8
add esp, 4
push esi
push str.pConfirmInstall
lea ecx, [esp + 0x84]
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
call fcn.00403b10
mov dword [esp + 0xc4], 5
call fcn.0041fe10
mov ecx, dword [eax]
lea edx, [esp + 0x7c]
push edx
push eax
mov eax, dword [ecx + 8]
call eax
mov dword [esp + 0xc4], ebp
cmp dword [esp + 0x94], edi
jb 0x402cb6
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0044caf8
add esp, 4
push 4
push str.0002
lea ecx, [esp + 0x84]
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
call fcn.00403b10
mov dword [esp + 0xc4], 6
push 4
push 0x477e2c
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00403b10
call fcn.0041fe10
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x80]
push ecx
mov byte [esp + 0xcc], 8
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x38]
push ecx
push eax
call edx
cmp dword [esp + 0x2c], edi
jb 0x402d4a
mov eax, dword [esp + 0x18]
push eax
call fcn.0044caf8
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], edi
jb 0x402d69
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0044caf8
add esp, 4
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
cmp dword [esp + 0x94], edi
jb 0x402d8e
mov edx, dword [esp + 0x80]
push edx
call fcn.0044caf8
add esp, 4
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 4]
push ebx
push 3
push 0x806a
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40305c
cmp eax, 4
jne 0x402e91
push str.0005
lea ecx, [esp + 0x34]
call fcn.00403740
push 0x477e2c
lea ecx, [esp + 0x80]
mov dword [esp + 0xc8], 9
call fcn.00403740
call fcn.0041fe10
xor ebx, ebx
mov esi, 0xf
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0xcc], 0xb
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x84]
push ecx
push eax
call edx
mov edi, 0x10
cmp dword [esp + 0x2c], edi
jb 0x402e2d
mov eax, dword [esp + 0x18]
push eax
call fcn.0044caf8
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x94], edi
jb 0x402e52
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0044caf8
add esp, 4
mov dword [esp + 0x94], esi
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
cmp dword [esp + 0x48], edi
jb 0x402e7a
mov edx, dword [esp + 0x34]
push edx
call fcn.0044caf8
add esp, 4
mov eax, dword [ebp + 4]
push ebx
push 2
push 0x806a
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x403060
cmp eax, 6
jne 0x402f1f
push str.0003
lea ecx, [esp + 0x34]
call fcn.00403740
push 0x477e2c
lea ecx, [esp + 0x18]
mov dword [esp + 0xc8], 0xc
call fcn.00403740
call fcn.0041fe10
xor ecx, ecx
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], ecx
mov byte [esp + 0x80], cl
lea edx, [esp + 0x7c]
push edx
lea edx, [esp + 0x34]
push edx
lea edx, [esp + 0x1c]
mov byte [esp + 0xcc], 0xe
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx]
call eax
lea ecx, [esp + 0x7c]
call fcn.004037b0
lea ecx, [esp + 0x14]
call fcn.004037b0
lea ecx, [esp + 0x30]
call fcn.004037b0
jmp 0x403060
cmp eax, 5
jne 0x403060
push str.0004
lea ecx, [esp + 0x54]
call fcn.00403740
mov esi, 0xf
push 0x477e2c
lea ecx, [esp + 0x34]
mov dword [esp + 0xc8], esi
call fcn.00403740
call fcn.0041fe10
xor ecx, ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov byte [esp + 0x18], cl
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x54]
push edx
lea edx, [esp + 0x38]
mov byte [esp + 0xcc], 0x11
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx]
call eax
lea ecx, [esp + 0x14]
call fcn.004037b0
lea ecx, [esp + 0x30]
call fcn.004037b0
or ebp, 0xffffffff
lea ecx, [esp + 0x50]
mov dword [esp + 0xc4], ebp
call fcn.004037b0
mov eax, str.https:__www.zhixi.com_user_agreement_
lea ecx, [esp + 0x7c]
call fcn.004037f0
lea ecx, [esp + 0x7c]
push ecx
mov eax, str.__mid
mov dword [esp + 0xc8], 0x12
call fcn.00403860
call fcn.0041fe10
mov edx, dword [eax]
mov edx, dword [edx + 0x28]
lea ecx, [esp + 0x98]
push ecx
push eax
call edx
lea ecx, [esp + 0x98]
lea ebx, [esp + 0x50]
mov byte [esp + 0xc4], 0x13
call fcn.0042be40
push 0
push eax
mov eax, ebp
lea esi, [esp + 0x84]
mov byte [esp + 0xcc], 0x14
call fcn.00403d40
mov esi, ebx
call fcn.00418c90
cmp dword [esp + 0x94], 8
mov eax, dword [esp + 0x80]
jae 0x403033
lea eax, [esp + 0x80]
push 1
push 0
push 0
push eax
push 0x47812c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x98]
call fcn.004037b0
lea esi, [esp + 0x7c]
call fcn.00418c90
mov ebp, dword [esp + 0x4c]
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xd4]
push eax
push ecx
mov esi, ebp
call fcn.00403420
test al, al
je 0x40309b
mov eax, dword [ebp + 4]
lea edx, [esp + 0x6c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp + 4]
push 1
lea ecx, [esp + 0x70]
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0044c790
add esp, 0xb4
ret 0xc