Function at 0x407530
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x416066
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x950
mov eax, dword [0x41b0e0]
push ebx
push esi
push edi
push str.programfiles
mov dword [esp + 0x958], eax
mov esi, ecx
call fcn.0040c78c
mov edx, eax
xor eax, eax
mov byte [esp + 0x4c], 0
mov ecx, 0x40
lea edi, [esp + 0x4d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x50]
push str._sInternet_ExplorerIEXPLORE.EXE
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov al, byte [esi + 0x22bc]
mov bx, word [ebp + 8]
add esp, 0x10
test al, al
je 0x40762b
push 0x3e7
mov ecx, esi
mov byte [esi + 0x1591bf], 0
call fcn.00406680
mov ecx, dword [esi + 0x1934]
push 2
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
push 0x3e7
mov ecx, esi
mov byte [esi + 0x22bc], 0
mov byte [esi + 0x24cc], 0
call fcn.00406680
cmp bx, 0xdc
jbe 0x40762b
cmp bx, 0x113
jae 0x40762b
cmp dword [esi + 0x1950], 0x10
jb 0x407604
mov eax, dword [esi + 0x193c]
jmp 0x40760a
lea eax, [esi + 0x193c]
push 5
push eax
add esi, 0x1db0
push esi
lea edx, [esp + 0x54]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x407767
xor eax, eax
mov byte [esp + 0x150], 0
mov ecx, 0x1ff
lea edi, [esp + 0x151]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x24c4]
imul eax, eax, 0xa34
mov ecx, dword [eax + esi + 0x14c188]
lea edx, [eax + esi]
imul ecx, ecx, 0x37
movzx eax, bx
cmp ecx, eax
jge 0x4077a3
lea edi, [ecx + 0x37]
cmp edi, eax
jle 0x4077a3
lea edi, [ecx + 0x2d]
cmp edi, eax
jge 0x40778a
add ecx, 0x6c
cmp ecx, eax
jle 0x40778a
mov ax, word [ebp + 0xc]
cmp ax, 1
jbe 0x40778a
cmp ax, 8
jae 0x40778a
lea ebx, [esi + 0x1595cc]
xor eax, eax
mov dword [esi + 0x1597cc], 0
mov ecx, 0x80
mov edi, ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
call fcn.0040afd0
push str.User.ini
lea ecx, [esp + 0x10]
mov dword [esp + 0x968], 0
call fcn.004024b0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esi + 0x1954]
push edx
lea ecx, [esp + 0x30]
mov byte [esp + 0x96c], 1
call fcn.0040b040
lea ecx, [esp + 0xc]
mov byte [esp + 0x964], 0
call fcn.00401dd0
push pe_nt_image_headers32
push 0
push str.NAME
push str.SITE
lea ecx, [esp + 0x38]
call fcn.0040afb0
push pe_nt_image_headers32
push 0
push 0x41747c
push ebx
lea ecx, [esp + 0x38]
call fcn.0040afb0
lea ecx, [esp + 0x28]
mov dword [esp + 0x964], 0xffffffff
call fcn.0040aff0
mov ecx, esi
call fcn.00403f70
mov ecx, esi
call fcn.00406910
mov byte [esi + 0x158778], 0
mov ecx, dword [esp + 0x95c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x954]
call fcn.0040c0d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add edx, 0x14bb78
push edx
push 0x417374
lea eax, [esp + 0x158]
push eax
jmp 0x407917
movzx ecx, word [esi + 0x15876e]
imul ecx, ecx, 0xa34
lea edx, [ecx + esi]
mov ecx, dword [edx + 0xd3f8]
imul ecx, ecx, 0x37
cmp ecx, eax
jge 0x407803
lea edi, [ecx + 0x37]
cmp edi, eax
jle 0x407803
lea edi, [ecx + 0x2d]
cmp edi, eax
jge 0x407903
add ecx, 0x6c
cmp ecx, eax
jle 0x407903
mov ax, word [ebp + 0xc]
cmp ax, 1
jbe 0x407903
cmp ax, 8
jae 0x407903
mov word [esi + 0x15876e], 0x63
jmp 0x407752
movzx ecx, word [esi + 0x15876a]
imul ecx, ecx, 0xa34
lea edx, [ecx + esi]
mov ecx, dword [edx + 0xd3f8]
imul ecx, ecx, 0x37
cmp ecx, eax
jge 0x407863
lea edi, [ecx + 0x37]
cmp edi, eax
jle 0x407863
lea edi, [ecx + 0x2d]
cmp edi, eax
jge 0x407903
add ecx, 0x6c
cmp ecx, eax
jle 0x407903
mov ax, word [ebp + 0xc]
cmp ax, 1
jbe 0x407903
cmp ax, 8
jae 0x407903
mov word [esi + 0x15876a], 0x63
jmp 0x407752
movzx ecx, word [esi + 0x15876c]
imul ecx, ecx, 0xa34
lea edx, [ecx + esi]
mov ecx, dword [edx + 0xd3f8]
imul ecx, ecx, 0x37
cmp ecx, eax
jge 0x4078b3
lea edi, [ecx + 0x37]
cmp edi, eax
jle 0x4078b3
lea edi, [ecx + 0x2d]
cmp edi, eax
jge 0x407903
add ecx, 0x6c
cmp ecx, eax
jle 0x407903
mov ax, word [ebp + 0xc]
cmp ax, 1
jbe 0x407903
cmp ax, 8
jae 0x407903
mov word [esi + 0x15876c], 0x63
jmp 0x407752
movzx ecx, word [esi + 0x158768]
imul ecx, ecx, 0xa34
lea edx, [ecx + esi]
mov ecx, dword [edx + 0xd3f8]
imul ecx, ecx, 0x37
cmp ecx, eax
jge 0x407920
lea edi, [ecx + 0x37]
cmp edi, eax
jle 0x407920
lea edi, [ecx + 0x2d]
cmp edi, eax
jge 0x407903
add ecx, 0x6c
cmp ecx, eax
jle 0x407903
mov ax, word [ebp + 0xc]
cmp ax, 1
jbe 0x407903
cmp ax, 8
jae 0x407903
mov word [esi + 0x158768], 0x63
jmp 0x407752
add edx, 0xcde8
push edx
lea edx, [esp + 0x154]
push 0x417374
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [esi + 0x1950], 0x10
jb 0x407931
mov esi, dword [esi + 0x193c]
jmp 0x407937
add esi, 0x193c
push 5
push esi
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x54]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x407767