Function at 0x417ca0
Capabilities:
Create process on windows

Disassembly:
cmp dword [esp + 0x18], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
jne 0x4182ac
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push ebp
push ebx
lea eax, [edi + 0x24]
push eax
mov eax, dword [esp + 0x20]
mov edx, esi
call fcn.00455730
test eax, eax
jne 0x417d04
cmp esi, 0x111
jne 0x4181b5
mov ecx, 0x8006
cmp cx, bx
jne 0x417d10
mov edx, ebx
shr edx, 0x10
cmp ax, dx
jne 0x41823d
mov ebx, edi
call fcn.00421d70
mov dword [ebp], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov ecx, 0x803e
cmp cx, bx
jne 0x417d40
mov edx, ebx
shr edx, 0x10
xor eax, eax
cmp ax, dx
jne 0x41823d
mov ecx, edi
call fcn.00421e80
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov ecx, 0x8004
cmp cx, bx
jne 0x417d70
mov edx, ebx
shr edx, 0x10
xor eax, eax
cmp ax, dx
jne 0x41823d
mov eax, edi
call fcn.00422160
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov ecx, 0x800e
cmp cx, bx
jne 0x417da0
mov eax, ebx
shr eax, 0x10
xor edx, edx
cmp dx, ax
jne 0x417f2a
mov eax, edi
call fcn.00422740
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x800f
cmp ax, bx
jne 0x417dd0
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
mov esi, edi
call fcn.004228c0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x8011
cmp ax, bx
jne 0x417e00
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
mov esi, edi
call fcn.00422a00
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x802b
cmp ax, bx
jne 0x417e2f
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
push edi
call fcn.00422190
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x802c
cmp ax, bx
jne 0x417e5e
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
push edi
call fcn.00422200
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x802e
cmp ax, bx
jne 0x417e8e
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
mov ebx, edi
call fcn.004223a0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x802f
cmp ax, bx
jne 0x417ebe
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
mov eax, edi
call fcn.00422700
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x8040
cmp ax, bx
jne 0x417efc
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
push 1
push edx
push edx
push str.http:__bbs.360.cn_3451604.html
push edx
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov dword [ebp], 0
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x803f
cmp ax, bx
jne 0x417f52
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
call fcn.004221c0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
xor ecx, ecx
cmp cx, ax
jne 0x41823d
mov ecx, 5
call fcn.0041b0a0
mov dword [ebp], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x801c
cmp dx, bx
jne 0x417f81
mov eax, ebx
shr eax, 0x10
xor ecx, ecx
cmp cx, ax
jne 0x41823d
push edi
call fcn.00422450
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x8009
cmp dx, bx
jne 0x417fb1
mov eax, ebx
shr eax, 0x10
xor ecx, ecx
cmp cx, ax
jne 0x41823d
mov eax, edi
call fcn.00422490
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x8030
cmp dx, bx
jne 0x417fe4
mov eax, ebx
shr eax, 0x10
mov ecx, 0x1001
cmp cx, ax
jne 0x41823d
mov esi, edi
call fcn.004224f0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x8037
cmp dx, bx
jne 0x418017
mov eax, ebx
shr eax, 0x10
mov ecx, 0x1001
cmp cx, ax
jne 0x41823d
mov esi, edi
call fcn.00422540
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x8031
cmp dx, bx
jne 0x41804a
mov eax, ebx
shr eax, 0x10
mov ecx, 0x1001
cmp cx, ax
jne 0x41823d
mov esi, edi
call fcn.00422590
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x8032
cmp dx, bx
jne 0x41807d
mov eax, ebx
shr eax, 0x10
mov ecx, 0x1001
cmp cx, ax
jne 0x41823d
mov esi, edi
call fcn.004225e0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x803d
cmp dx, bx
jne 0x4180bf
mov eax, ebx
shr eax, 0x10
xor ecx, ecx
cmp cx, ax
jne 0x41823d
call fcn.00422f70
mov edx, dword [edi + 4]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov dword [ebp], 0
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x8034
cmp ax, bx
jne 0x4180ee
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
push edi
call fcn.00422630
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x8035
cmp ax, bx
jne 0x418110
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
lea ecx, [edx + 7]
jmp 0x417f3a
mov eax, 0x803b
cmp ax, bx
jne 0x418152
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
push 1
push edx
push edx
push str.http:__bbs.360.cn_3451604_38985513.html
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov dword [ebp], 0
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x803c
cmp ax, bx
jne 0x418181
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
push edi
call fcn.00422670
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov eax, 0x8010
cmp ax, bx
jne 0x41823d
mov ecx, ebx
shr ecx, 0x10
xor edx, edx
cmp dx, cx
jne 0x41823d
mov eax, edi
call fcn.004226d0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp esi, 0x8001
jne 0x4181d5
mov ecx, ebx
mov edx, edi
call fcn.0041ff90
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp esi, 0x8002
jne 0x4181fa
mov eax, dword [esp + 0x20]
push eax
mov ecx, ebx
mov esi, edi
call fcn.004205a0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp esi, 0x4f6
jne 0x41821e
xor eax, eax
mov esi, edi
call fcn.004189c0
pop edi
pop esi
mov dword [ebp], 0
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp esi, 0x4fc
jne 0x41823d
push ebx
mov eax, edi
call fcn.00418b10
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
mov dword [esp + 0x2c], 1
call fcn.00454e20
cmp dword [esp + 0x28], 0
mov dword [ebp], eax
jne 0x417d04
mov eax, dword [esp + 0x18]
cmp eax, 1
jne 0x418285
push edi
call fcn.00419200
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp eax, 2
jne 0x4182b5
lea edx, [esp + 0x28]
push edx
mov ebx, edi
mov dword [esp + 0x2c], 1
call fcn.0041aa30
cmp dword [esp + 0x28], 0
mov dword [ebp], eax
jne 0x417f46
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
cmp eax, 5
jne 0x4182f6
cmp ebx, 1
je 0x4182e6
mov eax, dword [esp + 0x20]
mov ecx, eax
shr ecx, 0x10
push ecx
movzx eax, ax
mov ecx, edi
call fcn.0041ac90
mov edx, dword [edi + 4]
push 0x105
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
mov dword [ebp], 1
pop ebp
xor eax, eax
pop ebx
ret 0x18
cmp eax, 0x113
jne 0x418314
push ebx
mov ecx, edi
call fcn.00418c50
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp eax, 0x201
jne 0x4182ac
mov eax, dword [edi + 4]
push 0
push 0xf012
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov dword [ebp], 0
pop ebp
mov eax, 1
pop ebx
ret 0x18