Function at 0x404700
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488fc1
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x4b0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x108]
cmp eax, dword [ebx + 0x2bc]
jne 0x404747
push ecx
jmp 0x404be0
cmp eax, dword [ebx + 0x2c0]
jne 0x404764
push ecx
push 0xf020
push 0x112
call fcn.00421580
jmp 0x404be5
mov ecx, dword [ebx + 0x2e4]
cmp eax, ecx
jne 0x4047d3
call fcn.004235e0
test al, al
je 0x40478c
mov ecx, dword [ebx + 0x2c4]
push 0
mov eax, dword [ecx]
call dword [eax + 0xd8]
jmp 0x404be5
cmp dword [ebx + 0x310], 0
jne 0x4047bd
cmp dword [ebx + 0x314], 0
je 0x4047bd
call fcn.004235e0
test al, al
je 0x4047bd
mov ecx, dword [ebx + 0x2c4]
mov dl, 1
push edx
mov eax, dword [ecx]
call dword [eax + 0xd8]
jmp 0x404be5
mov ecx, dword [ebx + 0x2c4]
xor dl, dl
push edx
mov eax, dword [ecx]
call dword [eax + 0xd8]
jmp 0x404be5
cmp eax, dword [ebx + 0x2cc]
jne 0x4047f5
push 1
push 0
push 0
push str.http:__web.4399.com_local_cjwt_201006_14_25269.html
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x404be5
cmp eax, dword [ebx + 0x2d0]
jne 0x404847
mov ecx, dword [ebx + 0x2b4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc8]
call eax
test al, al
jne 0x404be5
mov ecx, dword [ebx + 0x2b0]
push 0x20
mov eax, dword [ecx]
call dword [eax + 0x64]
mov ecx, dword [ebx + 0x2b4]
push 1
mov eax, dword [ecx]
call dword [eax + 0xcc]
mov ecx, dword [ebx + 0x2b8]
push 0
mov eax, dword [ecx]
call dword [eax + 0xcc]
jmp 0x404be5
cmp eax, dword [ebx + 0x2c8]
jne 0x404996
push 0x20a
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00469580
mov eax, dword [ebx + 4]
add esp, 0xc
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x248], 0
push eax
mov dword [ebp - 0x240], 0x49a050
mov dword [ebp - 0x23c], 0x42
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
je 0x40498a
lea ecx, [ebp - 0x220]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40498a
mov ecx, 0x105
lea eax, [ebp - 0x220]
cmp word [eax], 0
je 0x4048fe
add eax, 2
sub ecx, 1
jne 0x4048f0
mov edx, 0x105
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x404956
lea ecx, [ebp - 0x220]
lea ecx, [ecx + esi*2]
sub edx, esi
je 0x404949
mov edi, str.4399GameHall
mov eax, SysReAllocString
sub edi, ecx
nop dword [eax]
test eax, eax
je 0x404949
movzx esi, word [ecx + edi]
test si, si
je 0x404949
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x404930
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebx + 0x2ec]
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
xor edx, edx
cmp dword [ebx + 0x310], edx
jne 0x40497b
cmp dword [ebx + 0x314], edx
setne dl
mov ecx, dword [ebx + 0x2c4]
push edx
mov eax, dword [ecx]
call dword [eax + 0xd8]
mov ecx, ebx
call fcn.00404ef0
jmp 0x404be5
cmp eax, dword [ebx + 0x2c4]
jne 0x4049aa
mov ecx, ebx
call fcn.00405160
jmp 0x404be5
cmp eax, dword [ebx + 0x2d4]
jne 0x404be5
mov ecx, dword [ebx + 0x2e8]
call fcn.004235e0
or edi, 0xffffffff
test al, al
je 0x404ae9
call fcn.00401cf0
mov ecx, eax
test ecx, ecx
je 0x404c03
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
push str.http:__web.4399.com
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], 0
call fcn.00401f70
test al, al
jne 0x404a16
push 0x13
push str.http:__web.4399.com
lea ecx, [ebp - 0x22c]
call fcn.00402220
mov dword [ebp - 4], 1
call fcn.00401cf0
mov ecx, eax
test ecx, ecx
je 0x404c0d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
push str.SoftwareMicrosoftInternet_ExplorerMain
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call fcn.00401f70
test al, al
jne 0x404a64
push 0x29
push str.SoftwareMicrosoftInternet_ExplorerMain
lea ecx, [ebp - 0x228]
call fcn.00402220
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x228]
push eax
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, dword [ebp - 0x22c]
mov eax, dword [edi - 0xc]
add eax, eax
push eax
push edi
push 1
push 0
push str.Start_Page
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404ac7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x404ae6
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or edi, 0xffffffff
call fcn.0040fa80
mov esi, eax
call fcn.00401cf0
mov ecx, eax
test ecx, ecx
je 0x404c17
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
push str.4399GameHall.exe
mov dword [ebp - 4], 3
lea eax, [ebp - 0x224]
push dword [esi + 0x328]
push str.__s_s_
push eax
call fcn.0040c930
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x288]
add esp, 0x10
mov dword [ebp - 0x250], 0
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0x3c
movlpd qword [ebp - 0x284], xmm0
movlpd qword [ebp - 0x268], xmm0
push eax
movlpd qword [ebp - 0x260], xmm0
movlpd qword [ebp - 0x258], xmm0
mov dword [ebp - 0x27c], str.open
mov dword [ebp - 0x278], esi
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
mov dword [ebp - 4], 0xffffffff
sbb eax, eax
add esi, 0xfffffff0
neg eax
mov dword [ebp - 0x224], eax
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x404bd9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x404be5
push ecx
mov ecx, ebx
call fcn.004210d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402200
push 0x80004005
call fcn.00402200
push 0x80004005
call fcn.00402200
int3