Function at 0x464ef4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
mov eax, dword [esi + 4]
cmp eax, 0x10
jg 0x465422
je 0x465194
sub eax, 0xa
je 0x46519e
sub eax, 1
je 0x465185
sub eax, 1
je 0x465178
sub eax, 3
jne 0x4655ee
push 1
push ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push 0x69dcb4
call fcn.004177e7
mov ecx, 0x736918
call fcn.004ef41e
mov eax, dword [esi + 0x10]
xor ebx, ebx
mov dword [ebp - 0x38], eax
sub eax, dword [edi + 0x1d0]
cdq
idiv dword [edi + 0x254]
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x34], ecx
mov esi, eax
sub ecx, dword [edi + 0x1d4]
mov eax, ecx
mov dword [ebp - 0x28], esi
cdq
lea ecx, [ebp - 0x1c]
idiv dword [edi + 0x250]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push eax
push esi
mov ecx, edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0049ddc5
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [0x735a38], eax
mov eax, dword [ebp - 0x2c]
mov dword [0x735a3c], eax
mov dword [0x735a40], esi
cmp dword [0x736914], ebx
je 0x4650bb
mov eax, dword [0x735fe8]
add eax, 0xfffffff0
push eax
call fcn.00418dea
mov ecx, dword [0x735fec]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], eax
push ecx
call fcn.00418dea
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [0x735a40], esi
jne 0x4650ac
push dword [0x735ff0]
push ecx
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
mov dword [esi], eax
mov esi, esp
push dword [ebp - 0x3c]
call fcn.00418dea
pop ecx
push dword [ebp - 0x1c]
add eax, 0x10
lea ecx, [edi + 0x200]
push dword [ebp - 0x2c]
mov dword [esi], eax
push dword [ebp - 0x18]
call fcn.004a8efb
test al, al
je 0x4650a9
mov edx, dword [edi + 0x254]
imul edx, dword [ebp - 0x28]
mov ecx, dword [edi + 0x250]
imul ecx, dword [ebp - 0x30]
push dword [ebp - 0x34]
add edx, dword [edi + 0x1d0]
push dword [ebp - 0x38]
add ecx, dword [edi + 0x1d4]
mov dword [ebp - 0x14], edx
lea eax, [edx + 0xf]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
lea eax, [ecx + 0xf]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4650a9
push 5
push ebx
push ebx
push str.http:__www.12306.cn_mormhweb_
push ebx
push dword [edi + 0x1c8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x24]
mov ecx, eax
call fcn.00419521
mov ecx, dword [ebp - 0x3c]
call fcn.00419521
mov ecx, dword [0x73df68]
push ebx
push 0x150
mov eax, dword [ecx]
call dword [eax + 0x40]
mov ecx, dword [0x73df68]
push ebx
push 0xae
mov dword [ebp - 0x28], eax
mov edx, dword [ecx]
call dword [edx + 0x40]
mov ecx, dword [edi + 0x1c0]
mov esi, eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4650f9
push ebx
push ebx
jmp 0x465169
mov ecx, dword [edi + 0x248]
lea eax, [esi + 0xa]
mov edx, dword [ebp - 0x34]
sub ecx, edx
cmp ecx, eax
jge 0x465114
push 0xfffffffffffffffa
pop eax
sub eax, esi
add edx, eax
jmp 0x465117
add edx, 0xf
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], edx
push eax
push dword [edi + 0x1c8]
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [edi + 0x1c0]
push 0x10
push esi
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0xffffffffffffffff
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
imul eax, dword [ebp - 0x2c], 0x64
add eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
mov eax, dword [edi + 0x1c0]
push 0x531
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push 4
mov ecx, dword [edi + 0x1c0]
call fcn.005c254d
mov ecx, edi
jmp 0x465194
mov eax, dword [edi]
call dword [eax + 0x188]
jmp 0x4655ee
push 0xffffffffffffff9c
pop eax
mov dword [edi + 0x1d8], eax
mov dword [edi + 0x1dc], eax
call fcn.005d874d
jmp 0x4655ee
xor ebx, ebx
cmp dword [edi + 0x1c0], ebx
jne 0x4651f7
push 0x378
call fcn.00609934
pop ecx
test eax, eax
je 0x4651c2
mov ecx, eax
call fcn.0043f548
mov ecx, eax
jmp 0x4651c4
mov ecx, ebx
push ebx
mov eax, SysReAllocString
mov dword [edi + 0x1c0], ecx
push eax
push eax
push eax
push eax
push 0x8000088
push ebx
push 0x69dc88
push dword [edi + 0x1c8]
call fcn.005c122f
mov ecx, dword [edi + 0x1c0]
push ebx
push ebx
call fcn.005c254d
push dword [edi + 0x1c8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x465219
mov ecx, dword [edi + 0x1c0]
push ebx
push ebx
call fcn.005c254d
jmp 0x4655ee
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x17c]
test al, al
je 0x4655ee
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov ecx, dword [edi + 0x1d0]
mov dword [ebp - 0x18], eax
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x24], edx
cdq
idiv dword [edi + 0x254]
mov esi, eax
mov eax, dword [ebp - 0x18]
sub eax, dword [edi + 0x1d4]
cdq
idiv dword [edi + 0x250]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], ecx
jl 0x465291
mov ecx, dword [edi + 0x1d4]
cmp dword [ebp - 0x18], ecx
jl 0x465291
cmp esi, dword [edi + 0x1e0]
jge 0x465280
cmp eax, dword [edi + 0x1e4]
jle 0x465291
cmp esi, 6
jg 0x465291
mov byte [ebp - 0x1d], 1
cmp eax, dword [edi + 0x1ec]
jle 0x465294
mov byte [ebp - 0x1d], bl
lea ecx, [ebp - 0x3c]
mov dword [ebp - 8], ebx
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 0x3c], ebx
push ecx
push eax
push esi
mov ecx, edi
call fcn.0049ddc5
cmp byte [ebp - 0x1d], bl
je 0x46539a
cmp dword [0x736914], ebx
je 0x46539a
mov eax, dword [0x735fe8]
add eax, 0xfffffff0
push eax
call fcn.00418dea
mov ecx, dword [0x735fec]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], eax
push ecx
call fcn.00418dea
pop ecx
pop ecx
push dword [0x735ff0]
mov dword [ebp - 0x34], eax
push ecx
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
mov dword [esi], eax
mov esi, esp
push dword [ebp - 0x28]
call fcn.00418dea
pop ecx
push dword [ebp - 0x3c]
add eax, 0x10
lea ecx, [edi + 0x200]
push dword [ebp - 0x2c]
mov dword [esi], eax
push dword [ebp - 8]
call fcn.004a8efb
mov esi, dword [ebp - 0x30]
test al, al
je 0x46538a
mov edx, dword [edi + 0x254]
mov ecx, dword [edi + 0x250]
imul ecx, dword [ebp - 0x1c]
push dword [ebp - 0x18]
imul edx, esi
push dword [ebp - 0x24]
add ecx, dword [edi + 0x1d4]
mov dword [ebp - 0x10], ecx
add edx, dword [edi + 0x1d0]
mov dword [ebp - 0x14], edx
lea eax, [edx + 0xf]
mov dword [ebp - 0xc], eax
lea eax, [ecx + 0x19]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x465377
push 0x7f89
jmp 0x46537c
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 0x34]
call fcn.00419521
mov ecx, dword [ebp - 0x28]
call fcn.00419521
mov edx, dword [ebp - 0x24]
cmp edx, dword [edi + 0x1d0]
jl 0x465401
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [edi + 0x1d4]
jl 0x465401
imul eax, dword [edi + 0x254], 7
add eax, dword [edi + 0x1d0]
cmp edx, eax
jg 0x465401
cmp ecx, dword [edi + 0x248]
jg 0x465401
cmp dword [edi + 0x1d8], esi
jne 0x4653e0
mov eax, dword [ebp - 0x1c]
cmp dword [edi + 0x1dc], eax
je 0x4655ee
mov ecx, dword [edi + 0x1c0]
push ebx
push ebx
call fcn.005c254d
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x1d8], esi
mov dword [edi + 0x1dc], eax
jmp 0x465174
mov ecx, dword [edi + 0x1c0]
push ebx
push ebx
call fcn.005c254d
push 0xffffffffffffff9c
pop eax
mov dword [edi + 0x1d8], eax
mov dword [edi + 0x1dc], eax
jmp 0x4655ee
cmp eax, 0x11
je 0x46544b
cmp eax, 0x18
jne 0x4655ee
push 0
push dword [esi + 0x1c]
push 0x7e9
push dword [0x735624]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4655ee
push 1
push ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push 0x69dc9c
call fcn.004177e7
mov ecx, 0x736918
call fcn.004ef41e
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
sub eax, dword [edi + 0x1d0]
cdq
idiv dword [edi + 0x254]
mov ecx, dword [ebp - 0x24]
mov ebx, dword [esi + 0x14]
mov edi, dword [edi + 0x1d4]
mov dword [ebp - 0x34], eax
mov eax, ebx
mov esi, dword [ecx + 0x250]
sub eax, edi
mov ecx, dword [ecx + 0x258]
imul ecx, esi
cdq
idiv esi
add ecx, edi
mov dword [ebp - 8], ebx
cmp ebx, ecx
jg 0x4655ee
mov ebx, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
xor esi, esi
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push ecx
push eax
push dword [ebp - 0x34]
mov ecx, ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call fcn.0049ddc5
lea edi, [ebx + 0x1c4]
cmp dword [edi], esi
jne 0x465507
push 0x2d0
call fcn.00609934
pop ecx
test eax, eax
je 0x4654fd
mov ecx, eax
call fcn.00441846
jmp 0x4654ff
mov eax, esi
push eax
mov ecx, edi
call fcn.005139d2
mov eax, dword [edi]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x465534
mov ecx, dword [edi]
mov eax, SysReAllocString
push esi
push eax
push eax
push eax
push eax
push esi
push 0x6cf0000
push esi
push dword [ebx + 0x1c8]
call fcn.005c122f
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x1c8]
call dword [sym.imp.USER32.dll_ClientToScreen]
add dword [ebp - 0xc], 2
call fcn.00418f81
push eax
lea ecx, [ebp - 0x30]
call fcn.0041775d
push dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x30]
push dword [ebp - 0x18]
push ebx
push str._d__02d__02d
push eax
call fcn.0041a1e9
mov edi, dword [ebp - 0x30]
add esp, 0x10
add edi, 0xfffffff0
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
push ecx
mov eax, esp
push 0
mov dword [eax], ecx
mov dword [eax + 4], edx
push dword [esi + 0x1c8]
mov ecx, dword [esi + 0x1c4]
call fcn.004a1c20
mov ecx, dword [esi + 0x1c4]
push 0
push 5
call fcn.005c254d
mov eax, dword [esi + 0x1c4]
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x18]
mov ecx, esi
mov dword [0x735a3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x735a38], ebx
mov dword [0x735a40], eax
call fcn.005d874d
mov ecx, edi
call fcn.00419521
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 4