Function at 0x41a960
Capabilities:
Create process on windows
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f527b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x52a6ec]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
mov eax, dword [0x52a6ec]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x14]
mov dword [edi + 4], 0x47
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x30], edi
test ecx, ecx
jne 0x41aa86
lea eax, [esp + 0x18]
push eax
mov ecx, str.webhp_clientaff_ime
call fcn.00405cc0
mov dword [esp + 0x158], 0
mov ecx, dword [edi + 0x24]
cmp dword [ecx - 0xc], 0
je 0x41a9ee
mov eax, ecx
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ebx, [esp + 0x20]
call fcn.004057e0
movzx edx, byte [edi + 0x10]
movzx eax, byte [edi + 0xf]
mov edi, dword [esp + 0x18]
push edx
push eax
call fcn.00448d40
mov dword [esp + 0x158], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aa2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.0041ee70
add esp, 4
mov esi, 1
mov dword [esp + 0x158], esi
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x41abbf
mov ecx, str.1.2.33.79
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41aa9a
test dx, dx
je 0x41aa82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41aa9a
add eax, 4
add ecx, 4
test dx, dx
jne 0x41aa60
xor eax, eax
jmp 0x41aa9f
movzx ecx, byte [edi + 0x10]
movzx edx, byte [edi + 0xf]
push eax
push ecx
push edx
xor esi, esi
call fcn.00448e00
jmp 0x41aa30
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x41abbf
cmp byte [edi + 0xe], 0
je 0x41abbf
add dword [edi + 4], esi
mov byte [esp + 0x1f], 1
lea ecx, [esp + 0x40]
push ecx
call fcn.0041f0a0
lea edx, [esp + 0x18]
push edx
mov ecx, 0x506c24
mov byte [esp + 0x15c], 2
call fcn.00405cc0
mov byte [esp + 0x158], 3
mov ecx, dword [edi]
test ecx, ecx
je 0x41aafb
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x18]
push edx
push 0
call eax
mov byte [esp + 0x158], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ab23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x5080d4
call fcn.00405cc0
push 0x66
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x160], 4
call fcn.0041f320
test al, al
mov byte [esp + 0x158], 2
mov eax, dword [esp + 0x18]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ab77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x41abc9
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x15c], 1
call fcn.0041f220
mov dword [esp + 0x158], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41abb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x41b4b3
mov byte [esp + 0x1f], 0
jmp 0x41aabe
mov ecx, dword [edi]
test ecx, ecx
je 0x41abe4
add dword [edi + 8], esi
mov eax, dword [edi + 8]
imul eax, eax, 0x64
cdq
idiv dword [edi + 4]
mov esi, dword [ecx]
mov edx, dword [esi + 8]
push eax
call edx
xor eax, eax
mov word [esp + 0x68], ax
mov ebx, 7
push 0x16
mov eax, 0x50606c
lea esi, [esp + 0x6c]
mov dword [esp + 0x80], ebx
mov dword [esp + 0x7c], 0
call fcn.00404e70
mov edi, esi
lea esi, [esp + 0xf4]
mov byte [esp + 0x158], 5
call fcn.00415570
mov byte [esp + 0x158], 6
cmp dword [eax + 0x14], 8
jb 0x41ac35
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
call fcn.00405cc0
mov esi, 8
mov byte [esp + 0x158], 8
cmp dword [esp + 0x108], esi
jb 0x41ac67
mov edx, dword [esp + 0xf4]
push edx
call fcn.004c9387
add esp, 4
xor eax, eax
mov dword [esp + 0x108], ebx
mov dword [esp + 0x104], 0
mov word [esp + 0xf4], ax
mov byte [esp + 0x158], 9
cmp dword [esp + 0x7c], esi
jb 0x41ac9e
mov ecx, dword [esp + 0x68]
push ecx
call fcn.004c9387
add esp, 4
lea eax, [esp + 0x2c]
xor edx, edx
xor esi, esi
push eax
mov dword [esp + 0x80], ebx
mov dword [esp + 0x7c], esi
mov word [esp + 0x6c], dx
call fcn.00413ba0
add esp, 4
mov dword [esp + 0xb0], esi
xor ecx, ecx
push 0x19
mov eax, 0x506004
lea esi, [esp + 0xa4]
mov dword [esp + 0xb8], ebx
mov word [esp + 0xa4], cx
call fcn.00404e70
mov edi, esi
lea esi, [esp + 0x110]
mov byte [esp + 0x158], 0xa
call fcn.00415570
mov byte [esp + 0x158], 0xb
cmp dword [eax + 0x14], 8
jb 0x41ad10
mov eax, dword [eax]
lea edx, [esp + 0x28]
push edx
mov ecx, eax
call fcn.00405cc0
mov esi, 8
mov byte [esp + 0x158], 0xd
cmp dword [esp + 0x124], esi
jb 0x41ad42
mov eax, dword [esp + 0x110]
push eax
call fcn.004c9387
add esp, 4
xor ecx, ecx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x120], 0
mov word [esp + 0x110], cx
mov byte [esp + 0x158], 0xe
cmp dword [esp + 0xb4], esi
jb 0x41ad7f
mov edx, dword [esp + 0xa0]
push edx
call fcn.004c9387
add esp, 4
lea ecx, [esp + 0x28]
xor eax, eax
xor esi, esi
push ecx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xb4], esi
mov word [esp + 0xa4], ax
call fcn.00413ba0
add esp, 4
mov dword [esp + 0x94], esi
xor edx, edx
push 0x17
mov eax, 0x506524
lea esi, [esp + 0x88]
mov dword [esp + 0x9c], ebx
mov word [esp + 0x88], dx
call fcn.00404e70
mov edi, esi
lea esi, [esp + 0xd8]
mov byte [esp + 0x158], 0xf
call fcn.00415570
mov byte [esp + 0x158], 0x10
cmp dword [eax + 0x14], 8
jb 0x41adf7
mov eax, dword [eax]
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call fcn.00405cc0
mov edi, 8
mov byte [esp + 0x158], 0x12
cmp dword [esp + 0xec], edi
jb 0x41ae29
mov edx, dword [esp + 0xd8]
push edx
call fcn.004c9387
add esp, 4
xor esi, esi
xor eax, eax
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], esi
mov word [esp + 0xd8], ax
mov byte [esp + 0x158], 0x13
cmp dword [esp + 0x98], edi
jb 0x41ae64
mov ecx, dword [esp + 0x84]
push ecx
call fcn.004c9387
add esp, 4
lea eax, [esp + 0x24]
xor edx, edx
push eax
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x98], esi
mov word [esp + 0x88], dx
call fcn.00413ba0
mov edx, dword [0x52a1ec]
mov eax, dword [edx + 0xc]
add esp, 4
mov ecx, 0x52a1ec
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x158], 0x14
call fcn.00419c20
test al, al
je 0x41b087
push 1
call fcn.00415d10
mov esi, eax
add esp, 4
mov dword [esp + 0x38], esi
mov byte [esp + 0x158], 0x15
test esi, esi
je 0x41afa2
xor ecx, ecx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xcc], 0
mov word [esp + 0xbc], cx
mov eax, str.PATH
lea ecx, [esp + 0x12c]
mov byte [esp + 0x158], 0x16
call fcn.00404f90
lea edx, [esp + 0xbc]
push edx
lea ecx, [esp + 0x130]
mov edx, esi
mov byte [esp + 0x15c], 0x17
call fcn.004173d0
test eax, eax
mov esi, 8
sete bl
mov byte [esp + 0x158], 0x16
cmp dword [esp + 0x140], esi
jb 0x41af53
mov eax, dword [esp + 0x12c]
push eax
call fcn.004c9387
add esp, 4
test bl, bl
je 0x41af81
mov edx, dword [esp + 0xbc]
cmp dword [esp + 0xd0], esi
jae 0x41af6e
lea edx, [esp + 0xbc]
lea edi, [esp + 0x14]
call fcn.0045ebf0
call fcn.0041da50
call fcn.00403900
mov byte [esp + 0x158], 0x15
cmp dword [esp + 0xd0], esi
jb 0x41afa2
mov ecx, dword [esp + 0xbc]
push ecx
call fcn.004c9387
add esp, 4
push 0
lea esi, [esp + 0x38]
call fcn.00417aa0
add esp, 4
mov byte [esp + 0x158], 0x18
mov eax, dword [eax]
sub eax, 0x10
call fcn.00406260
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x158], 0x1a
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41aff1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [esp + 0x18]
call fcn.0041da50
call fcn.00403900
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x41b049
js 0x41b049
push str.GoogleGoogle_Pinyin_2
push ecx
call fcn.004c9b16
add esp, 8
test eax, eax
je 0x41b049
sub eax, dword [esp + 0x14]
sar eax, 1
cmp eax, 0xffffffff
je 0x41b049
lea ecx, [esp + 0x14]
push ecx
mov eax, edi
call fcn.0041dab0
add esp, 4
test al, al
je 0x41b049
lea edx, [esp + 0x14]
push edx
call fcn.00412db0
add esp, 4
mov byte [esp + 0x158], 0x15
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b071
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x158], 0x14
mov eax, dword [esp + 0x38]
test eax, eax
je 0x41b087
push eax
call fcn.00416bf0
mov esi, dword [esp + 0x30]
push esi
call fcn.0041b9f0
mov edi, eax
test edi, edi
je 0x41b17f
mov byte [esp + 0x158], 0x13
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b0c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x158], 0xe
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b0eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x158], 9
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x158], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b13b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x15c], 1
call fcn.0041f220
mov dword [esp + 0x158], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b178
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
jmp 0x41b4b3
mov dword [esp + 0x3c], 0
call fcn.00419c20
test al, al
je 0x41b290
lea ecx, [esp + 0x3c]
push ecx
call fcn.00419ce0
add esp, 4
test al, al
jne 0x41b290
mov byte [esp + 0x158], 0x13
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b1d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x158], 0xe
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b1f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x158], 9
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b221
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x158], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b249
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x15c], 1
call fcn.0041f220
mov dword [esp + 0x158], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b286
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 5
jmp 0x41b4b3
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
call fcn.0041c820
mov edi, eax
test edi, edi
je 0x41b2c3
mov byte [esp + 0x158], 0x13
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x41b0b7
call fcn.00419c20
test al, al
je 0x41b2d9
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00419d20
add esp, 4
push esi
call fcn.0041c980
mov edi, eax
call fcn.004199a0
cmp eax, 4
jne 0x41b2f9
call fcn.00426c40
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x50]
call eax
test edi, edi
je 0x41b343
lea eax, [esp + 0x14]
call fcn.0041f720
lea eax, [esp + 0x24]
call fcn.0041f720
lea eax, [esp + 0x28]
call fcn.0041f720
lea eax, [esp + 0x2c]
call fcn.0041f720
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x15c], 1
call fcn.0041f220
lea eax, [esp + 0x20]
call fcn.0041f720
mov eax, edi
jmp 0x41b4b3
mov ecx, esi
call fcn.0041b6d0
mov edi, eax
test edi, edi
je 0x41b396
lea eax, [esp + 0x14]
call fcn.0041f720
lea eax, [esp + 0x24]
call fcn.0041f720
lea eax, [esp + 0x28]
call fcn.0041f720
lea eax, [esp + 0x2c]
call fcn.0041f720
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x15c], 1
call fcn.0041f220
lea eax, [esp + 0x20]
call fcn.0041f720
mov eax, edi
jmp 0x41b4b3
push esi
call fcn.0041d1c0
mov edi, eax
test edi, edi
je 0x41b3e8
lea eax, [esp + 0x14]
call fcn.0041f720
lea eax, [esp + 0x24]
call fcn.0041f720
lea eax, [esp + 0x28]
call fcn.0041f720
lea eax, [esp + 0x2c]
call fcn.0041f720
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x15c], 1
call fcn.0041f220
lea eax, [esp + 0x20]
call fcn.0041f720
mov eax, edi
jmp 0x41b4b3
call fcn.00418880
test al, al
jne 0x41b3f6
call fcn.00418c70
cmp byte [esp + 0x1f], 0
je 0x41b402
call fcn.0041d990
lea ecx, [esp + 0x30]
push ecx
mov ecx, 0x50606c
call fcn.00405cc0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push 0
push eax
mov byte [esp + 0x164], 0x1b
call fcn.00417ef0
add esp, 0xc
mov byte [esp + 0x158], 0x1c
mov eax, dword [eax]
sub eax, 0x10
call fcn.00406260
lea esi, [eax + 0x10]
lea eax, [esp + 0x38]
mov dword [esp + 0x34], esi
call fcn.0041f720
lea eax, [esp + 0x30]
call fcn.0041f720
push 0
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0x34]
call fcn.0041f720
lea eax, [esp + 0x14]
call fcn.0041f720
lea eax, [esp + 0x24]
call fcn.0041f720
lea eax, [esp + 0x28]
call fcn.0041f720
lea eax, [esp + 0x2c]
call fcn.0041f720
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x15c], 1
call fcn.0041f220
lea eax, [esp + 0x20]
call fcn.0041f720
xor eax, eax
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.004c9392
mov esp, ebp
pop ebp
ret