Function at 0x43b132
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x928
mov dword [esp], ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x920], eax
call fcn.004175be
lea esi, [esp + 0xf4]
mov ecx, eax
push esi
call fcn.004181aa
movzx eax, byte [esi + 0xb]
test al, al
jns 0x43b17f
mov esi, dword [esp + 0xf4]
mov eax, dword [esp + 0xf8]
lea edi, [esp + 0x100]
mov ecx, edi
push eax
push esi
call fcn.0046ed80
lea esi, [esp + 0xe8]
mov ecx, edi
push esi
call fcn.0046f6e0
mov ecx, edi
call fcn.0046ee40
movzx ecx, byte [ebx + 0xb]
mov eax, ecx
test cl, cl
jns 0x43b1b2
mov eax, dword [ebx + 4]
test eax, eax
je 0x43b271
mov edx, ebx
test cl, cl
jns 0x43b1c2
mov edx, dword [ebx]
lea esi, [esp + 0xc4]
lea ecx, [esp + 0xe8]
push eax
push edx
push esi
call fcn.0046fbd0
xor esi, esi
cmp word [str.Installer], 0
mov eax, 0
je 0x43b1fb
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x64977c], 0
mov ecx, eax
jne 0x43b1eb
lea edx, [esp + 0x1c]
lea ecx, [esp + 0xc4]
push eax
push str.Installer
push edx
call fcn.0046fbd0
cmp word [0x64981c], 0
je 0x43b22e
xor eax, eax
lea esi, [eax + 1]
cmp word [eax + eax + 0x64981e], 0
mov eax, esi
jne 0x43b21e
lea ebx, [esp + 0x1c]
mov ecx, ebx
push esi
push 0x64981c
push edi
call fcn.0046fbd0
lea ecx, [esp + 0xe8]
push edi
call fcn.0046ee80
mov ecx, edi
call fcn.0046ee40
mov ecx, ebx
call fcn.0046ee40
lea ecx, [esp + 0xc4]
call fcn.0046ee40
mov ebx, dword [ebp + 8]
lea esi, [esp + 0xe8]
lea ecx, [esp + 0xc4]
push 0
call fcn.0046b060
call fcn.0040604b
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x43b28f
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x43b2c2
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43b2c2
push esi
call fcn.00482720
add esp, 4
test al, al
je 0x43b2c2
lea ecx, [esp + 0xc4]
push esi
call fcn.0046b130
mov dword [esp + 4], 0
jmp 0x43b341
call fcn.004175be
mov ecx, eax
push edi
call fcn.004181aa
movzx eax, byte [esp + 0x10b]
mov edx, edi
test al, al
jns 0x43b2eb
mov edx, dword [esp + 0x100]
mov eax, dword [esp + 0x104]
lea ebx, [esp + 0x1c]
mov ecx, ebx
push eax
push edx
call fcn.0046ed80
cmp byte [esp + 0x10b], 0
jns 0x43b311
push dword [esp + 0x100]
call fcn.00517bd6
add esp, 4
lea esi, [esp + 0x100]
mov ecx, esi
push ebx
call fcn.0046b0c0
lea ecx, [esp + 0xc4]
push esi
call fcn.0046b500
mov ecx, esi
call fcn.0046b550
mov ecx, ebx
call fcn.0046ee40
mov al, 1
mov dword [esp + 4], eax
call fcn.0046b890
xor esi, esi
push 0x820
push esi
push edi
call fcn.006030b0
add esp, 0xc
mov eax, dword [esp]
movzx eax, byte [eax]
push eax
push esi
push esi
push str._d__d__d
push 0xffffffffffffffff
push 0x410
push edi
call fcn.00401af6
add esp, 0x1c
lea ebx, [esp + 0x1c]
mov ecx, ebx
push edi
call fcn.00401a6c
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x43b391
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
lea esi, [esp + 8]
mov ecx, esi
push str.do_shortcut
mov edi, eax
call fcn.004115b8
lea ecx, [esp + 0xc4]
push edi
push ebx
mov ebx, esi
push esi
call fcn.0046c090
cmp byte [esi + 0xb], 0
jns 0x43b3c6
push dword [esp + 8]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x27], 0
jns 0x43b3d9
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
call fcn.00419006
lea edi, [esp + 0xb8]
mov ecx, edi
push eax
call fcn.00468aa8
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
je 0x43b4e0
mov cl, byte [esp + 0xc3]
test cl, cl
mov eax, dword [esp + 0xbc]
movzx esi, cl
mov edx, esi
cmovs edx, eax
test edx, edx
je 0x43b4e0
cmp edx, 0xa
jne 0x43b456
lea ecx, [esp + 0xb8]
push 0xa
push str.hao.360.cn
push 0xffffffffffffffff
push 0
call fcn.00469a8a
test eax, eax
je 0x43b731
mov cl, byte [esp + 0xc3]
mov eax, dword [esp + 0xbc]
movzx esi, cl
test cl, cl
mov edx, esi
cmovs edx, eax
cmp edx, 0x11
jne 0x43b492
lea ecx, [esp + 0xb8]
push 0x11
push str.http:__hao.360.cn
push 0xffffffffffffffff
push 0
call fcn.00469a8a
test eax, eax
je 0x43b731
mov cl, byte [esp + 0xc3]
mov eax, dword [esp + 0xbc]
movzx esi, cl
test cl, cl
jns 0x43b49f
mov edi, dword [esp + 0xb8]
mov esi, eax
lea ebx, [esp + 0x1c]
mov ecx, ebx
push str.set_homepage_overwrite
call fcn.004115b8
lea ecx, [esp + 0xc4]
push esi
push edi
push ebx
call fcn.0046c090
cmp byte [ebx + 0xb], 0
jns 0x43b4d0
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
lea eax, [esp + 0xb8]
lea ebx, [esp + 8]
jmp 0x43b767
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
je 0x43b65a
call fcn.0043aa4e
cmp byte [0x899a2d], 0
je 0x43b65a
call fcn.00418bac
cmp byte [0x899a3d], 0
jne 0x43b51c
test al, al
je 0x43b6af
call fcn.0043aa4e
cmp byte [0x899a2d], 0
je 0x43b78b
call fcn.0046b890
mov ebx, eax
mov eax, str.exe_path
lea edi, [esp + 0xa8]
mov dword [edi], eax
push eax
call fcn.0061fdf0
add esp, 4
mov dword [edi + 4], eax
lea esi, [esp + 8]
mov ecx, ebx
push edi
push esi
call fcn.0046bf10
movzx eax, byte [esi + 0xb]
test al, al
jns 0x43b56c
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push esi
call fcn.0046ed80
cmp byte [esp + 0x13], 0
jns 0x43b58a
push dword [esp + 8]
call fcn.00517bd6
add esp, 4
lea ebx, [esp + 0x9c]
lea ecx, [esp + 0x1c]
push ebx
call fcn.0046f820
mov ecx, ebx
push edi
call fcn.00470440
lea ecx, [esp + 8]
push edi
call fcn.00468aa8
mov ecx, edi
call fcn.0046ee40
mov ecx, ebx
call fcn.0046ee40
mov esi, 0x6390a0
lea ecx, [esp + 0xa8]
push esi
call fcn.00401a6c
lea ebx, [esp + 0x9c]
mov ecx, ebx
push esi
call fcn.00401a6c
mov eax, 0x2b
lea esi, [esp + 8]
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.004698fa
mov edi, eax
dec eax
mov ecx, esi
push eax
mov eax, 0x2b
push eax
call fcn.004698fa
cmp edi, 0xffffffff
je 0x43bc60
cmp eax, 0xffffffff
je 0x43bc60
inc edi
lea eax, [esp + 0x14]
lea ebx, [esp + 0x90]
mov ecx, ebx
push eax
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x14]
push eax
call fcn.00468b4c
cmp byte [esp + 0xa7], 0
js 0x43bc6c
mov word [esp + 0x9c], 0
mov byte [esp + 0xa7], 0
lea esi, [esp + 0xa8]
jmp 0x43bcae
cmp byte [0x899a3d], 0
je 0x43b6af
lea edi, [esp + 0x1c]
mov ecx, edi
push str.set_homepage_overwrite
call fcn.004115b8
lea ecx, [esp + 0xc4]
push edi
call fcn.0046c030
cmp byte [edi + 0xb], 0
jns 0x43b692
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
jne 0x43b78b
mov ecx, edi
push str.https:__hao.360.cn_
jmp 0x43b6f9
lea edi, [esp + 0x1c]
mov ecx, edi
push str.set_homepage_overwrite
call fcn.004115b8
lea ecx, [esp + 0xc4]
push edi
call fcn.0046c030
cmp byte [edi + 0xb], 0
jns 0x43b6de
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
je 0x43b78b
mov ecx, edi
push str.chrome:__newtab_
call fcn.00401a6c
cmp byte [esp + 0x27], 0
jns 0x43b709
mov edi, dword [esp + 0x1c]
push str.homepage
push str.Default
push edi
call fcn.00444c44
add esp, 0xc
cmp byte [esp + 0x27], 0
jns 0x43b78b
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
jmp 0x43b78b
lea edi, [esp + 0x1c]
mov ecx, edi
push str.set_homepage_overwrite
call fcn.004115b8
lea ecx, [esp + 0xc4]
push edi
call fcn.0046c030
cmp byte [edi + 0xb], 0
jns 0x43b760
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
lea eax, [esp + 0xb8]
cmp byte [esp + 0xc3], 0
jns 0x43b778
mov eax, dword [esp + 0xb8]
push str.homepage
push str.Default
push eax
call fcn.00444c44
add esp, 0xc
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
je 0x43b7ca
lea edi, [esp + 0x1c]
mov ecx, edi
push str.full_new_install
call fcn.004115b8
lea ecx, [esp + 0xc4]
push edi
call fcn.0046c030
cmp byte [edi + 0xb], 0
jns 0x43b7ca
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
jne 0x43b85e
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
push ebx
call fcn.0043be9e
movzx eax, byte [esp + 0x13]
test al, al
jns 0x43b803
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea edi, [esp + 0x1c]
mov ecx, edi
push eax
push ebx
call fcn.0049d43c
mov ecx, edi
push 0xa
push 0x64aef6
call fcn.0049d6b4
test al, al
je 0x43b842
movzx ebx, byte [esp + 0x13]
test bl, bl
jns 0x43b835
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
jmp 0x43b839
lea eax, [esp + 8]
cmp ebx, 0xa
jge 0x43bbb6
lea ecx, [esp + 0x1c]
call fcn.0049d63e
cmp byte [esp + 0x13], 0
jns 0x43b85e
push dword [esp + 8]
call fcn.00517bd6
add esp, 4
mov eax, dword [0x899a38]
test al, 1
je 0x43be7d
cmp byte [0x899a3e], 0
je 0x43b8a3
lea esi, [esp + 0x1c]
mov ecx, esi
push str.restore_4_overwrite
call fcn.004115b8
lea ecx, [esp + 0xc4]
push esi
call fcn.0046c030
cmp byte [esi + 0xb], 0
jns 0x43b8a3
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
xor eax, eax
lea edi, [esp + 0xa8]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
call fcn.00418dbe
mov ecx, eax
push edi
call fcn.00418fb6
test al, al
je 0x43b910
movzx ebx, byte [esp + 0xb3]
test bl, bl
jns 0x43b8df
mov edi, dword [esp + 0xa8]
mov ebx, dword [esp + 0xac]
lea esi, [esp + 0x1c]
mov ecx, esi
push str.silent_install
call fcn.004115b8
lea ecx, [esp + 0xc4]
push ebx
push edi
push esi
call fcn.0046c090
cmp byte [esi + 0xb], 0
jns 0x43b910
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
call fcn.00419006
cmp byte [eax + 0x25], 0
je 0x43b94a
lea esi, [esp + 0x1c]
mov ecx, esi
push str.no_welcomepage
call fcn.004115b8
lea ecx, [esp + 0xc4]
push esi
call fcn.0046c030
cmp byte [esi + 0xb], 0
jns 0x43b94a
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
call fcn.00419006
add eax, 0x34
lea esi, [esp + 0x9c]
mov ecx, esi
push eax
call fcn.00468aa8
movzx eax, byte [esi + 0xb]
mov ebx, eax
test al, al
jns 0x43b972
mov ebx, dword [esp + 0xa0]
test ebx, ebx
je 0x43b9b2
test al, al
jns 0x43b981
mov esi, dword [esp + 0x9c]
lea edi, [esp + 0x1c]
mov ecx, edi
push str.set_adfilter_mode
call fcn.004115b8
lea ecx, [esp + 0xc4]
push ebx
push esi
push edi
call fcn.0046c090
cmp byte [edi + 0xb], 0
jns 0x43b9b2
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
xor eax, eax
lea esi, [esp + 0x90]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
call fcn.004175be
mov ecx, eax
push esi
call fcn.004179fc
call fcn.004175be
mov ecx, eax
call fcn.00418702
test al, al
je 0x43ba16
lea esi, [esp + 0x1c]
mov ecx, esi
push str.have_user_data_dir
call fcn.004115b8
lea ecx, [esp + 0xc4]
push 4
push str.true
push esi
call fcn.0046c090
cmp byte [esi + 0xb], 0
jns 0x43ba16
push dword [esp + 0x1c]
call fcn.00517bd6
add esp, 4
lea esi, [esp + 0x84]
lea ecx, [esp + 0xc4]
push esi
call fcn.0046cdd0
xorps xmm0, xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], 0x44
cmp byte [esp + 4], 0
je 0x43ba5e
mov dword [esp + 0x48], 1
mov ax, 5
jmp 0x43ba60
xor eax, eax
mov word [esp + 0x4c], ax
push str.CreateProcess
call fcn.00401e20
add esp, 4
cmp byte [esp + 0x8f], 0
mov eax, esi
jns 0x43ba85
mov eax, dword [esp + 0x84]
push eax
call fcn.00401e20
add esp, 4
cmp byte [esp + 0x8f], 0
jns 0x43ba9f
mov esi, dword [esp + 0x84]
sub esp, 0x28
lea eax, [esp + 0x30]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x43bae9
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call edi
push dword [esp + 8]
call edi
cmp byte [esp + 0x8f], 0
jns 0x43bb02
push dword [esp + 0x84]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x9b], 0
jns 0x43bb1b
push dword [esp + 0x90]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xa7], 0
jns 0x43bb34
push dword [esp + 0x9c]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xb3], 0
jns 0x43bb4d
push dword [esp + 0xa8]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xc3], 0
jns 0x43bb66
push dword [esp + 0xb8]
call fcn.00517bd6
add esp, 4
lea ecx, [esp + 0xc4]
call fcn.0046b550
lea ecx, [esp + 0xe8]
call fcn.0046ee40
cmp byte [esp + 0xff], 0
jns 0x43bb97
push dword [esp + 0xf4]
call fcn.00517bd6
add esp, 4
test esi, esi
setne bl
mov ecx, dword [esp + 0x920]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea ecx, [eax + ebx*2]
mov edx, eax
add ebx, 0xfffffff7
je 0x43b842
cmp word [edx], 0x68
je 0x43bbd5
add edx, 2
dec ebx
jne 0x43bbc4
jmp 0x43b842
mov esi, 0xffffffee
test esi, esi
je 0x43bc06
movzx edi, word [edx + esi + 0x14]
lea ebx, [esi + 2]
cmp di, word [esi + 0x64af16]
mov esi, ebx
je 0x43bbda
add edx, 2
mov esi, ecx
sub esi, edx
mov ebx, esi
sar ebx, 1
cmp esi, 0x14
jge 0x43bbbb
jmp 0x43b842
cmp ecx, edx
je 0x43b842
sub edx, eax
cmp edx, 0xfffffffe
je 0x43b842
sar edx, 1
lea esi, [esp + 8]
mov ecx, esi
push 0x64af18
push 6
push edx
call fcn.004697ba
lea ecx, [esp + 0x1c]
push 4
push 0x64af1e
call fcn.0049d67a
test al, al
je 0x43bdea
movzx ebx, byte [esp + 0x13]
test bl, bl
jns 0x43bde1
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
jmp 0x43bde5
lea esi, [esp + 0xa8]
jmp 0x43bd6a
mov eax, dword [esp + 0x9c]
mov word [eax], 0
mov dword [esp + 0xa0], 0
cmp byte [esp + 0xa7], 0
lea esi, [esp + 0xa8]
jns 0x43bcae
push dword [esp + 0x9c]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0xa4], 0
mov eax, dword [esp + 0x98]
mov dword [esp + 0xa4], eax
movsd xmm0, qword [esp + 0x90]
movsd qword [esp + 0x9c], xmm0
call fcn.0043aa4e
mov ecx, 0x899a20
push ebx
call fcn.0043afb4
lea edi, [esp + 0x84]
mov ecx, edi
push str.260142DL
call fcn.00401a6c
push 0
push edi
push ebx
call fcn.0047b160
add esp, 0xc
mov ebx, eax
cmp byte [edi + 0xb], 0
jns 0x43bd14
push dword [esp + 0x84]
call fcn.00517bd6
add esp, 4
mov eax, str.https:__www.hao774.com__k
mov edx, str.https:__hao.360.cn__srclmls
test bl, bl
cmovne edx, eax
lea edi, [esp + 0xa8]
mov ecx, edi
push edx
call fcn.0046930c
lea ebx, [esp + 0x9c]
movzx eax, byte [ebx + 0xb]
test al, al
cmovs eax, dword [ebx + 4]
mov edx, dword [ebx]
cmovns edx, ebx
mov ecx, edi
push eax
push edx
call fcn.00468fc8
cmp byte [esp + 0x9b], 0
jns 0x43bd6a
push dword [esp + 0x90]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xb3], 0
jns 0x43bd7b
mov esi, dword [esp + 0xa8]
push str.homepage
push str.Default
push esi
call fcn.00444c44
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x43bda3
push dword [esp + 0x9c]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0xb3], 0
lea ebx, [esp + 8]
jns 0x43bdc0
push dword [esp + 0xa8]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x43bdd3
push dword [esp + 8]
call fcn.00517bd6
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0046ee40
jmp 0x43b78b
lea eax, [esp + 8]
cmp ebx, 4
jge 0x43be0d
cmp byte [esp + 0x13], 0
jns 0x43bdf5
mov esi, dword [esp + 8]
push str.homepage
push str.Default
push esi
call fcn.00444c44
add esp, 0xc
jmp 0x43b842
lea edi, [eax + ebx*2]
mov edx, eax
add ebx, 0xfffffffd
je 0x43bdea
cmp word [edx], 0x68
je 0x43be25
add edx, 2
dec ebx
jne 0x43be17
jmp 0x43bdea
mov dword [esp], edi
mov edi, 2
cmp edi, 8
je 0x43be59
movzx ebx, word [edx + edi]
lea ecx, [edi + 2]
cmp bx, word [edi + 0x639ed8]
mov edi, ecx
je 0x43be2d
add edx, 2
mov edi, dword [esp]
mov ecx, edi
sub ecx, edx
mov ebx, ecx
sar ebx, 1
cmp ecx, 8
jge 0x43be12
jmp 0x43bdea
cmp dword [esp], edx
je 0x43bdea
sub edx, eax
cmp edx, 0xfffffffe
je 0x43bdea
sar edx, 1
lea ecx, [esp + 8]
push 0x63a69c
push 4
push edx
call fcn.004697ba
jmp 0x43bdea
or eax, 1
mov dword [0x899a38], eax
mov byte [0x899a34], 1
push fcn.00401e20
call fcn.00517f3d
add esp, 4
jmp 0x43b86b