Function at 0x43c460
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ac504
mov eax, dword fs:[0]
push eax
sub esp, 0x9dc
mov eax, dword [0x4cf640]
xor eax, esp
mov dword [esp + 0x9d8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cf640]
xor eax, esp
push eax
lea eax, [esp + 0x9f0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa00]
mov ebp, dword [esp + 0xa04]
xor ebx, ebx
lea ecx, [esp + 0x124]
push ebx
push ecx
mov dword [esp + 0x4c], eax
call fcn.00443860
add esp, 8
cmp dword [esp + 0x138], ebx
mov dword [esp + 0x9f8], ebx
jne 0x43c4f3
cmp dword [esp + 0x13c], 8
jb 0x43ce44
mov edx, dword [esp + 0x128]
push edx
call fcn.00478d09
add esp, 4
jmp 0x43ce44
lea eax, [esp + 0xec]
push ebx
push eax
call fcn.004437b0
add esp, 8
cmp dword [esp + 0x100], ebx
mov byte [esp + 0x9f8], 1
jne 0x43c556
mov esi, 8
cmp dword [esp + 0x104], esi
jb 0x43c533
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x13c], esi
mov dword [esp + 0x104], 7
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], bx
jmp 0x43c4d8
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
push 0x4b6570
lea ecx, [esp + 0xd4]
mov byte [esp + 0x9fc], 2
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd8]
mov esi, 7
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 3
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], 1
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 4
call fcn.0043c3d0
mov edi, 8
cmp dword [esp + 0x2c], edi
jb 0x43c5dc
mov edx, dword [esp + 0x18]
push edx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43c60a
mov eax, dword [esp + 0xd4]
push eax
call fcn.00478d09
add esp, 4
push str.Tencentdl.exe
lea ecx, [esp + 0xd4]
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 5
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], 1
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 6
call fcn.0043c3d0
cmp dword [esp + 0x2c], edi
jb 0x43c672
mov eax, dword [esp + 0x18]
push eax
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43c6a0
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00478d09
add esp, 4
push str.tnproxy.dll
lea ecx, [esp + 0xd4]
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xd8]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 7
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], bl
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 8
call fcn.0043c3d0
cmp dword [esp + 0x2c], edi
jb 0x43c707
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43c735
mov edx, dword [esp + 0xd4]
push edx
call fcn.00478d09
add esp, 4
push 0x4b6dd8
lea ecx, [esp + 0xd4]
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 9
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0xa
call fcn.0043c3d0
cmp dword [esp + 0x2c], edi
jb 0x43c79c
mov edx, dword [esp + 0x18]
push edx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43c7ca
mov eax, dword [esp + 0xd4]
push eax
call fcn.00478d09
add esp, 4
push 0x4b6db0
lea ecx, [esp + 0xd4]
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0xb
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], 1
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0xc
call fcn.0043c3d0
cmp dword [esp + 0x2c], edi
jb 0x43c832
mov eax, dword [esp + 0x18]
push eax
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43c860
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00478d09
add esp, 4
push str.tinyxml.dll
lea ecx, [esp + 0xd4]
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xd8]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0xd
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], bl
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0xe
call fcn.0043c3d0
cmp dword [esp + 0x2c], edi
jb 0x43c8c7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43c8f5
mov edx, dword [esp + 0xd4]
push edx
call fcn.00478d09
add esp, 4
push str.bugreport_xf.exe
lea ecx, [esp + 0xd4]
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0xf
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0x10
call fcn.0043c3d0
cmp dword [esp + 0x2c], edi
jb 0x43c95c
mov edx, dword [esp + 0x18]
push edx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43c98a
mov eax, dword [esp + 0xd4]
push eax
call fcn.00478d09
add esp, 4
push str.MiniDownload.dll
lea ecx, [esp + 0xd4]
call fcn.00404256
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xa04], 0x11
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.0040216a
mov byte [esp + 0x30], 1
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x9fc], 0x12
call fcn.0043c3d0
cmp dword [esp + 0x2c], edi
jb 0x43c9f2
mov eax, dword [esp + 0x18]
push eax
call fcn.00478d09
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov byte [esp + 0x9f8], 2
jb 0x43ca20
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00478d09
add esp, 4
cmp dword [ebp + 0x14], ebx
je 0x43ca7e
push ebp
call fcn.00442a90
add esp, 4
test al, al
je 0x43ca7e
push str.TencentDL
lea edx, [esp + 0xd4]
push ebp
push edx
call fcn.0040cba0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x134]
push ecx
lea edx, [esp + 0xe4]
push edx
mov byte [esp + 0xa10], 0x13
call fcn.00436360
add esp, 0x18
lea ecx, [esp + 0xd0]
mov byte [esp + 0x9f8], 2
call fcn.00402039
push 0x4bc578
lea ecx, [esp + 0xd4]
call fcn.00404256
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x10c]
push ecx
mov byte [esp + 0xa00], 0x14
call fcn.004430b0
add esp, 8
cmp dword [esp + 0xe8], edi
mov byte [esp + 0x9f8], 0x16
jb 0x43cad0
mov edx, dword [esp + 0xd4]
push edx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x11c], ebx
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], bx
jne 0x43cb62
cmp dword [esp + 0x120], edi
jb 0x43cb08
mov eax, dword [esp + 0x10c]
push eax
call fcn.00478d09
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x120], esi
mov dword [esp + 0x11c], ebx
mov word [esp + 0x10c], bx
call fcn.0043a010
cmp dword [esp + 0x104], edi
jb 0x43cb40
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x13c], edi
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], bx
jmp 0x43c4d8
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x43cb79
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x198]
call fcn.0043ecf0
lea eax, [esp + 0x9e4]
push eax
lea ecx, [esp + 0x198]
mov byte [esp + 0x9fc], 0x17
mov word [esp + 0x9e8], bx
mov dword [esp + 0x9ea], ebx
mov word [esp + 0x9ee], bx
call fcn.0043e900
movzx esi, word [esp + 0x9e8]
lea ecx, [esp + 0x108]
push esi
push ecx
call fcn.0043c0a0
add esp, 8
cmp al, bl
je 0x43ce03
push 1
push 3
lea ecx, [esp + 0x50]
call fcn.0043a050
push esi
push 0x4b5754
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0xa08], 0x18
call fcn.00439860
add esp, 8
push eax
call fcn.00439af0
add esp, 8
mov ecx, eax
call fcn.00439d40
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00435260
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x114]
mov byte [esp + 0xa04], 0x19
call fcn.0040216a
lea ecx, [esp + 0x14]
mov byte [esp + 0x9f8], 0x18
call fcn.00402039
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x110]
push ecx
call fcn.00436360
add esp, 0xc
test al, al
je 0x43cdf2
mov ecx, dword [esp + 0x44]
cmp ecx, ebx
je 0x43cc83
call fcn.004574c0
lea edx, [esp + 0x15c]
push edx
call fcn.00435050
push 0x4b6cf0
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x14c]
push ecx
mov byte [esp + 0xa08], 0x1a
call fcn.0040cba0
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0xa10], 0x1b
call fcn.00442480
add esp, 0x18
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x14c]
mov byte [esp + 0xa04], 0x1c
call fcn.0040216a
lea ecx, [esp + 0x14]
mov byte [esp + 0x9f8], 0x1b
call fcn.00402039
cmp dword [esp + 0x170], ebx
je 0x43cd66
cmp dword [esp + 0x174], edi
mov eax, dword [esp + 0x160]
jae 0x43cd18
lea eax, [esp + 0x160]
push eax
call fcn.00416690
add esp, 4
test al, al
je 0x43cd66
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x160]
push edx
call fcn.00417090
add esp, 8
test al, al
je 0x43cd66
cmp dword [esp + 0x174], edi
mov eax, dword [esp + 0x160]
jae 0x43cd58
lea eax, [esp + 0x160]
push 0x4b6d48
push eax
call fcn.0043f020
add esp, 8
cmp dword [esp + 0x158], edi
mov eax, dword [esp + 0x144]
jae 0x43cd7d
lea eax, [esp + 0x144]
push eax
call fcn.00416690
add esp, 4
test al, al
je 0x43cdb1
cmp dword [esp + 0x158], edi
mov eax, dword [esp + 0x144]
jae 0x43cda1
lea eax, [esp + 0x144]
push ebx
push ebx
push str.__RegServer
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x180]
push ecx
call fcn.0040cba0
add esp, 0xc
lea ecx, [esp + 0x178]
call fcn.00402039
lea ecx, [esp + 0x140]
call fcn.00402039
lea ecx, [esp + 0x15c]
call fcn.00402039
lea ecx, [esp + 0x48]
mov byte [esp + 0x9f8], 0x17
call fcn.00434080
lea ecx, [esp + 0x194]
mov byte [esp + 0x9f8], 0x16
call fcn.0043e970
lea ecx, [esp + 0x108]
call fcn.00402039
lea ecx, [esp + 0x34]
call fcn.0043a010
lea ecx, [esp + 0xec]
call fcn.00402039
lea ecx, [esp + 0x124]
call fcn.00402039
mov ecx, dword [esp + 0x9f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9d8]
xor ecx, esp
call fcn.00478cd0
add esp, 0x9e8
ret