Function at 0x405400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41d56b
mov eax, dword fs:[0]
push eax
sub esp, 0x1e8
mov eax, dword [0x427020]
xor eax, esp
mov dword [esp + 0x1e0], eax
push ebx
push esi
push edi
mov eax, dword [0x427020]
xor eax, esp
push eax
lea eax, [esp + 0x1f8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x1f4
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x204], 1
mov ecx, str._GetNewVersion.php
mov dword [esp + 0x24], 0x50
call fcn.00403710
lea edx, [esp + 0x1c]
push edx
mov ecx, str.service2.itools.hk
mov byte [esp + 0x204], 2
call fcn.00403710
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
lea ebx, [esp + 0x18]
mov byte [esp + 0x204], 3
call fcn.00404fd0
fldz
xor edi, edi
fstp qword [esp + 0x24]
mov dword [esp + 0x2c], edi
mov byte [esp + 0x200], 4
call fcn.00404e00
push 0xfde9
lea ecx, [esp + 0x48]
push ecx
call fcn.00403150
mov esi, eax
cmp esi, edi
mov dword [esp + 0x6c], 6
je 0x40551d
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4054f8
sub eax, edx
lea ebx, [eax + 1]
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
push ebx
mov edi, eax
push esi
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov dword [esp + 0x64], edi
push str.ivpl
lea ecx, [esp + 0x28]
mov byte [esp + 0x204], 5
call fcn.0040f030
mov esi, eax
lea edx, [esp + 0x64]
cmp esi, edx
je 0x405550
call fcn.0040eca0
push esi
lea ecx, [esp + 0x68]
call fcn.0040eb90
lea esi, [esp + 0x64]
mov byte [esp + 0x200], 4
call fcn.0040eca0
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x30]
cdq
mov ebx, 1
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
push 0x422168
lea ecx, [esp + 0x28]
mov byte [esp + 0x204], 6
call fcn.0040f030
mov esi, eax
lea eax, [esp + 0x64]
cmp esi, eax
je 0x4055a9
call fcn.0040eca0
push esi
lea ecx, [esp + 0x68]
call fcn.0040eb90
lea esi, [esp + 0x64]
mov byte [esp + 0x200], 4
call fcn.0040eca0
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x64], 0xa
mov dword [esp + 0x68], 0
push 0x42216c
lea ecx, [esp + 0x28]
mov byte [esp + 0x204], 7
call fcn.0040f030
mov esi, eax
lea ecx, [esp + 0x64]
cmp esi, ecx
je 0x4055fd
call fcn.0040eca0
push esi
lea ecx, [esp + 0x68]
call fcn.0040eb90
lea esi, [esp + 0x64]
mov byte [esp + 0x200], 4
call fcn.0040eca0
mov eax, dword [edi + 0x18]
cdq
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
push 0x422170
lea ecx, [esp + 0x28]
mov byte [esp + 0x204], 8
call fcn.0040f030
mov esi, eax
lea edx, [esp + 0x64]
cmp esi, edx
je 0x40564d
call fcn.0040eca0
push esi
lea ecx, [esp + 0x68]
call fcn.0040eb90
lea esi, [esp + 0x64]
mov byte [esp + 0x200], 4
call fcn.0040eca0
lea ecx, [esp + 0x84]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea esi, [esp + 0x64]
lea edi, [esp + 0x24]
mov byte [esp + 0x200], 9
call fcn.0040f510
lea ebx, [esp + 0x84]
mov byte [esp + 0x200], 0xa
call fcn.00404920
mov bl, 9
mov ecx, esi
mov byte [esp + 0x200], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
fldz
fstp qword [esp + 0x34]
mov dword [esp + 0x3c], 0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x200], 0xb
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea esi, [esp + 0xbc]
mov byte [esp + 0x200], 0xc
call fcn.00409840
push 0
lea eax, [esp + 0xa4]
push eax
mov byte [esp + 0x208], 0xd
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x8c]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0040ca30
test eax, eax
je 0x405761
lea ecx, [esp + 0x64]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea edx, [esp + 0x64]
push edx
lea esi, [esp + 0xa4]
mov byte [esp + 0x204], 0xe
call fcn.00404870
test eax, eax
je 0x40574f
cmp dword [esp + 0x7c], 0x10
mov esi, dword [esp + 0x68]
jae 0x405746
lea esi, [esp + 0x68]
lea edi, [esp + 0x34]
call fcn.0040f600
lea ecx, [esp + 0x64]
mov byte [esp + 0x200], 0xd
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 0x422174
lea ecx, [esp + 0x38]
call fcn.0040f360
test al, al
jne 0x4057be
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
push 0x422178
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea edx, [esp + 0xbc]
push edx
mov byte [esp + 0x204], 0xc
call fcn.00409a00
lea ecx, [esp + 0xa0]
mov byte [esp + 0x200], 0xb
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [esp + 0x200], bl
jmp 0x40586e
push 0x422174
lea ecx, [esp + 0x38]
call fcn.0040f030
cmp dword [eax + 8], 6
jne 0x4057d8
mov eax, dword [eax]
test eax, eax
jne 0x4057dd
mov eax, 0x421cc9
push 0xfde9
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.004030c0
mov edi, dword [esp + 0x18]
add edi, 0x1c
test eax, eax
jne 0x4057fc
xor ecx, ecx
jmp 0x405810
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x405801
sub ecx, esi
sar ecx, 1
push eax
mov ebx, ecx
mov eax, edi
call fcn.004039c0
mov ecx, dword [esp + 0x18]
call fcn.00405920
test eax, eax
jne 0x40583c
push 5
push eax
push eax
push str.http:__www.itools.hk
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea edx, [esp + 0xbc]
push edx
mov byte [esp + 0x204], 0xc
call fcn.00409a00
lea ecx, [esp + 0xa0]
mov byte [esp + 0x200], 0xb
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [esp + 0x200], 9
lea esi, [esp + 0x34]
call fcn.0040eca0
lea ecx, [esp + 0x84]
mov byte [esp + 0x200], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea esi, [esp + 0x24]
mov byte [esp + 0x200], 3
call fcn.0040eca0
mov byte [esp + 0x200], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4058c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x200], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4058ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x44]
call fcn.00402f30
mov ecx, dword [esp + 0x1f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1e0]
xor ecx, esp
call fcn.00413588
mov esp, ebp
pop ebp
ret 4