Function at 0x40cc51
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x487c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
mov eax, dword [0x4b20c8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x43c]
xor ebx, ebx
cmp eax, 9
mov dword [esp + 0x434], ebx
ja case.default.0x40cc71
jmp dword [eax*4 + 0x40d094]
mov ecx, dword [esi + 0x1c]
push 5
push ebx
push str.http:__www.pcclear.co.kr
push str.IEXPLORE.EXE
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x40cc71
push str.http:__www.pcclear.co.kr_app_link.php_mode
lea edx, [esp + 0xc]
push 0x4adc38
push edx
call fcn.0047617b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x1c]
add esp, 0xc
push 5
push ebx
push eax
push str.IEXPLORE.EXE
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x40cc71
mov edx, dword [esi + 0x1c]
push 5
push ebx
push str.http:__pcclear.co.kr__mode4
push str.IEXPLORE.EXE
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x40cc71
cmp dword [esi + 0x1bf4], ebx
je 0x40cd39
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4adbf0
call fcn.0047c161
push ecx
mov byte [esp + 0x43c], 1
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4adbdc
call fcn.0047c161
push 1
mov ecx, esi
mov byte [esp + 0x440], bl
call fcn.00411d00
jmp case.default.0x40cc71
mov ecx, esi
call fcn.0040a570
cmp eax, ebx
jle 0x40ced3
cmp eax, 2
push ebx
jne 0x40cd6c
mov ecx, esi
call fcn.0047b807
mov eax, dword [esi + 0x1c]
push ebx
push 0xa
push 0x193
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp case.default.0x40cc71
lea ecx, [esp + 0x28]
call fcn.00417370
lea ecx, [esp + 0x24]
mov byte [esp + 0x434], 2
call fcn.0047cce0
cmp eax, 1
jne 0x40ce4c
push ebx
mov ecx, esi
call fcn.0047b807
mov ecx, dword [esi + 0x1c]
push ebx
push 0xa
push 0x193
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esp + 0x424]
mov byte [esp + 0x434], 8
mov dword [esp + 0x424], 0x4991e4
call fcn.004015b0
lea ecx, [esp + 0x3dc]
mov byte [esp + 0x434], 7
mov dword [esp + method.CBrush.virtual_0], vtable.CBrush.0
call fcn.004015b0
lea ecx, [esp + 0x3d4]
mov byte [esp + 0x434], 6
call fcn.0040d0e0
lea ecx, [esp + 0x368]
mov byte [esp + 0x434], 5
call fcn.00456a90
lea ecx, [esp + 0x1f4]
mov byte [esp + 0x434], 4
call fcn.00459040
mov byte [esp + 0x434], 3
lea ecx, [esp + 0x80]
call fcn.00459040
lea ecx, [esp + 0x24]
mov byte [esp + 0x434], bl
call fcn.0047c921
jmp case.default.0x40cc71
lea ecx, [esp + 0x424]
mov byte [esp + 0x434], 0xe
mov dword [esp + 0x424], 0x4991e4
call fcn.004015b0
lea ecx, [esp + 0x3dc]
mov byte [esp + 0x434], 0xd
mov dword [esp + method.CBrush.virtual_0], vtable.CBrush.0
call fcn.004015b0
lea ecx, [esp + 0x3d4]
mov byte [esp + 0x434], 0xc
call fcn.0040d0e0
lea ecx, [esp + 0x368]
mov byte [esp + 0x434], 0xb
call fcn.00456a90
lea ecx, [esp + 0x1f4]
mov byte [esp + 0x434], 0xa
call fcn.00459040
mov byte [esp + 0x434], 9
jmp 0x40ce2b
push ebx
lea ecx, [esp + 0x28]
call fcn.00417370
lea ecx, [esp + 0x24]
mov byte [esp + 0x434], 0xf
mov dword [esp + 0x3e4], 1
call fcn.0047cce0
lea ecx, [esp + 0x424]
mov byte [esp + 0x434], 0x15
mov dword [esp + 0x424], 0x4991e4
call fcn.004015b0
lea ecx, [esp + 0x3dc]
mov byte [esp + 0x434], 0x14
call fcn.0040d0e0
lea ecx, [esp + 0x3d4]
mov byte [esp + 0x434], 0x13
call fcn.0040d0e0
lea ecx, [esp + 0x368]
mov byte [esp + 0x434], 0x12
call fcn.00456a90
lea ecx, [esp + 0x1f4]
mov byte [esp + 0x434], 0x11
call fcn.00459040
lea ecx, [esp + 0x80]
mov byte [esp + 0x434], 0x10
call fcn.00459040
lea ecx, [esp + 0x24]
mov byte [esp + 0x434], bl
call fcn.0047c921
jmp case.default.0x40cc71
push str.http:__www.pcclear.co.kr_app_link.php_mode
lea edx, [esp + 0xc]
push 0x4adbd8
push edx
call fcn.0047617b
mov eax, dword [esi + 0x1c]
add esp, 0xc
push 5
push ebx
push str.http:__www.pcclear.co.kr_home2_sub06.html_page06_01
push str.IEXPLORE.EXE
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x40cc71
mov ecx, esi
call fcn.0040d1f0
jmp case.default.0x40cc71
mov ecx, dword [esi + 0x1c]
push ebx
push 0xf020
push 0x112
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40cc71
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_IsZoomed]
cmp eax, ebx
jne case.default.0x40cc71
mov eax, dword [esi + 0x1c]
push ebx
push 0xf030
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0xc]
push ebx
push ecx
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sub edx, eax
push 1
push edx
mov edx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, esi
call fcn.0047b777
jmp case.default.0x40cc71
mov eax, dword [esi + 0x1c]
push ebx
push 0xf120
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40cc71
mov ecx, dword [esi + 0x1c]
push ebx
push ebx
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 8]
mov dword [esp + 0x434], 0xffffffff
call fcn.0047c0f3
mov ecx, dword [esp + 0x42c]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x430
ret 4