Function at 0x4012af
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x49d2b0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
lea ecx, [esp + 0x18]
call fcn.004031a0
xor ebx, ebx
mov dword [esp + 0x94], ebx
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x4010d6
mov eax, dword [eax + 4]
jmp 0x4010d9
add eax, 4
xor ecx, ecx
mov word [esp + 0x54], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x4010f2
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x54]
call fcn.00402880
mov byte [esp + 0x94], 2
cmp dword [esp + 0x30], edi
jb 0x401126
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045f4bb
add esp, 4
mov ecx, dword [esp + 0x64]
xor eax, eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x54]
lea edx, [ecx - 1]
push eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
call fcn.00401ce0
mov ecx, eax
mov byte [esp + 0x94], 3
mov eax, dword [ecx + 0x14]
push 0x4854d8
mov edi, 1
call fcn.004020d0
test eax, eax
setne byte [esp + 0x17]
mov byte [esp + 0x94], 2
mov edi, 8
cmp dword [esp + 0x30], edi
jb 0x40118e
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0045f4bb
add esp, 4
xor edx, edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
cmp byte [esp + 0x17], bl
je 0x4011b3
push 1
push 0x4854d8
lea eax, [esp + 0x58]
call fcn.00401d60
xor eax, eax
mov word [esp + 0x38], ax
push ebx
mov eax, 0x4857f8
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
call fcn.00402880
mov byte [esp + 0x94], 4
xor ecx, ecx
push ebx
mov eax, 0x4857f8
lea esi, [esp + 0x70]
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], ebx
mov word [esp + 0x74], cx
call fcn.00402880
mov byte [esp + 0x94], 5
mov eax, dword [esp + 0x9c]
dec eax
cmp eax, 0xb
ja case.default.0x401216
jmp dword [eax*4 + 0x40148c]
lea edx, [esp + 0x34]
push edx
mov eax, 0x4854dc
call fcn.00402970
cmp dword [esp + 0xa0], 1
jne case.default.0x401216
lea eax, [esp + 0x6c]
push eax
mov eax, str.suspension
jmp 0x4012b9
lea ecx, [esp + 0x34]
push ecx
mov eax, str.MonitorHTTP.exe
jmp 0x4012b9
mov eax, str.UnInstall.exe
jmp 0x4012b4
lea eax, [esp + 0x34]
push eax
mov eax, str.XLXhao3daohang.exe
jmp 0x4012b9
lea ecx, [esp + 0x34]
push ecx
mov eax, str.XLX360Search.exe
jmp 0x4012b9
mov eax, str.XLXHao123.exe
jmp 0x4012b4
lea eax, [esp + 0x34]
push eax
mov eax, str.XLXBaiduSearch.exe
jmp 0x4012b9
lea ecx, [esp + 0x34]
push ecx
mov eax, str.XLXKaiFuBiao.exe
jmp 0x4012b9
mov eax, str.XLXGames.exe
jmp 0x4012b4
lea eax, [esp + 0x34]
push eax
mov eax, str.XLXShoppingRebate.exe
jmp 0x4012b9
lea ecx, [esp + 0x34]
push ecx
mov eax, str.XLXTaobaoRebate.exe
jmp 0x4012b9
mov eax, str.XLXRebateBuy.exe
lea edx, [esp + 0x34]
push edx
call fcn.00402970
or esi, 0xffffffff
cmp dword [esp + 0x48], ebx
je 0x4013df
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00401fd0
add esp, 0xc
mov byte [esp + 0x94], 6
push esi
push ebx
lea ecx, [esp + 0x3c]
call fcn.004023c0
mov byte [esp + 0x94], 5
cmp dword [esp + 0x30], edi
jb 0x401310
mov eax, dword [esp + 0x1c]
push eax
call fcn.0045f4bb
add esp, 4
mov edx, dword [esp + 0x54]
xor ecx, ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
cmp dword [esp + 0x68], edi
jae 0x40132d
lea edx, [esp + 0x54]
mov ecx, dword [esp + 0x70]
cmp dword [esp + 0x84], edi
jae 0x40133e
lea ecx, [esp + 0x70]
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], edi
jae 0x40134c
lea eax, [esp + 0x38]
push 1
push edx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x4013df
mov byte [esp + 0x94], 4
cmp dword [esp + 0x84], edi
jb 0x401380
mov edx, dword [esp + 0x70]
push edx
call fcn.0045f4bb
add esp, 4
xor eax, eax
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], ax
mov byte [esp + 0x94], 2
cmp dword [esp + 0x4c], edi
jb 0x4013b0
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0045f4bb
add esp, 4
xor edx, edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], dx
mov dword [esp + 0x94], esi
cmp dword [esp + 0x68], edi
jb 0x4013d9
mov eax, dword [esp + 0x54]
push eax
call fcn.0045f4bb
add esp, 4
xor ecx, ecx
mov al, 1
jmp 0x40145a
mov byte [esp + 0x94], 4
cmp dword [esp + 0x84], edi
jb 0x4013fd
mov edx, dword [esp + 0x70]
push edx
call fcn.0045f4bb
add esp, 4
xor eax, eax
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], ax
mov byte [esp + 0x94], 2
cmp dword [esp + 0x4c], edi
jb 0x40142d
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0045f4bb
add esp, 4
xor edx, edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], dx
mov dword [esp + 0x94], esi
cmp dword [esp + 0x68], edi
jb 0x401456
mov eax, dword [esp + 0x54]
push eax
call fcn.0045f4bb
add esp, 4
xor ecx, ecx
xor al, al
mov word [esp + 0x54], cx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebp
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0045f4ac
add esp, 0x84
ret