Function at 0x404790
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x4372c0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esp + 0x34]
push eax
mov dword [0x43a348], esi
or ebx, 0xffffffff
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x404809
cmp dword [esp + 0x34], 2
jl 0x404809
mov ecx, dword [edi + 4]
push str.avast01
push ecx
call fcn.00418242
add esp, 8
test eax, eax
jne 0x4048d0
call fcn.00401000
test eax, eax
je 0x404820
push 0x7d0
call fcn.00401050
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041752a
mov esp, ebp
pop ebp
ret 0x10
push 0x91
push esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x8e
mov dword [esp + 0x18], 0x8f
mov dword [esp + 0x1c], 0x90
mov dword [esp + 0x20], 0x8b
mov dword [esp + 0x24], 0x8c
mov dword [esp + 0x28], 0x8d
mov dword [esp + 0x2c], 0x14
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x34], 0xfa
mov dword [esp + 0x38], 0x96
call fcn.00405b40
mov ebx, eax
add esp, 8
cmp ebx, 0x2710
jne 0x404f2f
call fcn.00401150
mov esi, eax
test esi, esi
jne 0x4048b1
call fcn.00401000
test eax, eax
jne 0x4048b1
mov esi, 0x7d2
push esi
call fcn.00401050
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041752a
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [edi + 4]
push str.avast02
push edx
call fcn.00418242
add esp, 8
test eax, eax
jne 0x4049a3
call fcn.00401000
test eax, eax
jne 0x4047fc
mov eax, 0x96
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], eax
push 0x98
push esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0x92
mov dword [esp + 0x24], 0x93
mov dword [esp + 0x28], 0x94
mov dword [esp + 0x14], 0x95
mov dword [esp + 0x1c], 0x97
mov dword [esp + 0x2c], 0x19
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x34], 0x193
call fcn.00405b40
mov ebx, eax
add esp, 8
cmp ebx, 0x2710
jne 0x404f2f
call fcn.00401150
mov esi, eax
test esi, esi
jne 0x404984
call fcn.00401000
test eax, eax
jne 0x404984
mov esi, 0x7d2
push esi
call fcn.00401050
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041752a
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edi + 4]
push str.avast03
push eax
call fcn.00418242
add esp, 8
test eax, eax
jne 0x404a79
call fcn.00401000
test eax, eax
jne 0x4047fc
push 0x9f
push esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0x99
mov dword [esp + 0x24], 0x9a
mov dword [esp + 0x28], 0x9b
mov dword [esp + 0x14], 0x9c
mov dword [esp + 0x18], 0x9d
mov dword [esp + 0x1c], 0x9e
mov dword [esp + 0x2c], 0x19
mov dword [esp + 0x30], 0xa
mov dword [esp + 0x34], 0xfa
mov dword [esp + 0x38], 0x92
call fcn.00405b40
mov ebx, eax
add esp, 8
cmp ebx, 0x2710
jne 0x404f2f
call fcn.00401150
mov esi, eax
test esi, esi
jne 0x404a5a
call fcn.00401000
test eax, eax
jne 0x404a5a
mov esi, 0x7d2
push esi
call fcn.00401050
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041752a
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [edi + 4]
push str.avast04
push ecx
call fcn.00418242
add esp, 8
test eax, eax
jne 0x404b4f
call fcn.00401000
test eax, eax
jne 0x4047fc
push 0xa6
push esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0xa0
mov dword [esp + 0x24], 0xa1
mov dword [esp + 0x28], 0xa2
mov dword [esp + 0x14], 0xa3
mov dword [esp + 0x18], 0xa4
mov dword [esp + 0x1c], 0xa5
mov dword [esp + 0x2c], 0x19
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x34], 0xfa
mov dword [esp + 0x38], 0x96
call fcn.00405b40
mov ebx, eax
add esp, 8
cmp ebx, 0x2710
jne 0x404f2f
call fcn.00401150
mov esi, eax
test esi, esi
jne 0x404b30
call fcn.00401000
test eax, eax
jne 0x404b30
mov esi, 0x7d2
push esi
call fcn.00401050
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041752a
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [edi + 4]
push str.christ
push edx
call fcn.00418242
add esp, 8
test eax, eax
jne 0x404bf8
push 0xa7
push esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0xab
mov dword [esp + 0x24], 0xac
mov dword [esp + 0x28], 0xad
mov dword [esp + 0x14], 0xa8
mov dword [esp + 0x18], 0xa9
mov dword [esp + 0x1c], 0xaa
mov dword [esp + 0x2c], 0x19
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x34], 0x19c
mov dword [esp + 0x38], 0xb4
call fcn.00405b40
mov ebx, eax
add esp, 8
cmp ebx, 0x2710
jne 0x404f2f
lea eax, [esp + 0x38]
call fcn.00405570
lea eax, [esp + 0x38]
push eax
mov eax, str.tp:__ime.baidu.jp_type_lp_2013_Xmas_Campaign_
jmp 0x404eab
mov ecx, dword [edi + 4]
push str.weather
push ecx
call fcn.00418242
add esp, 8
test eax, eax
jne 0x404c67
mov dword [esp + 0x18], 0xaf
mov dword [esp + 0x1c], 0xb0
mov dword [esp + 0x20], 0xb1
mov dword [esp + 0xc], 0xb2
mov dword [esp + 0x10], 0xb3
mov dword [esp + 0x14], 0xb4
mov dword [esp + 0x24], 0x19
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x2c], 0x9a
mov dword [esp + 0x30], 0xd0
push 0xae
jmp 0x404e75
mov eax, dword [edi + 4]
push str.star01
push eax
call fcn.00418242
add esp, 8
test eax, eax
jne 0x404d10
push 0xb9
push esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0xba
mov dword [esp + 0x24], 0xbb
mov dword [esp + 0x28], 0xbc
mov dword [esp + 0x14], 0xb6
mov dword [esp + 0x18], 0xb7
mov dword [esp + 0x1c], 0xb8
mov dword [esp + 0x2c], 0xd
mov dword [esp + 0x30], 5
mov dword [esp + 0x34], 0xc7
mov dword [esp + 0x38], 0xd0
call fcn.00405b40
mov ebx, eax
add esp, 8
cmp ebx, 0x2710
jne 0x404f2f
lea eax, [esp + 0x38]
call fcn.00405570
lea ecx, [esp + 0x38]
push ecx
mov eax, str.tp:__jp.hao123.com_destiny_tnime_inner_destinypop2_03_hao123_jp
jmp 0x404eab
mov edx, dword [edi + 4]
push str.star02
push edx
call fcn.00418242
add esp, 8
test eax, eax
jne 0x404e07
mov eax, 0xbd
mov dword [esp + 0x18], eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
lea ecx, [esp + 0x30]
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 0xc0
mov dword [esp + 0x1c], 0xc1
mov dword [esp + 0x20], 0xc2
mov dword [esp + 0x28], 0xbe
mov dword [esp + 0x2c], 0xbf
mov dword [esp + 0x30], 0xc3
mov dword [esp + 0x34], 0xc4
mov dword [esp + 0x38], 0xc5
mov dword [esp + 0x3c], 0xc6
mov dword [esp + 0x44], 0xd
mov dword [esp + 0x48], 5
mov dword [esp + 0x4c], 0xc7
mov dword [esp + 0x50], 0xc8
mov dword [esp + 0x58], 0xfb
call fcn.004034f0
mov ebx, eax
add esp, 0xc
cmp ebx, 0x2710
jne 0x404de3
call fcn.00401320
lea eax, [esp + 0x38]
call fcn.00405570
mov eax, str.tp:__jp.hao123.com_destiny_tnime_inner_destinypop2_03_hao123_jp
jmp 0x404ea6
cmp ebx, 0x2716
jne 0x404f2f
lea eax, [esp + 0x38]
call fcn.00405570
lea eax, [esp + 0x38]
push eax
mov eax, str.tp:__jp.hao123.com_destiny_tnime_inner_destinypop2_03_hao123_jp
jmp 0x404eab
mov ecx, dword [edi + 4]
push str.weather02
push ecx
call fcn.00418242
add esp, 8
test eax, eax
jne 0x404f2f
mov dword [esp + 0x18], 0xcb
mov dword [esp + 0x1c], 0xcc
mov dword [esp + 0x20], 0xcd
mov dword [esp + 0xc], 0xce
mov dword [esp + 0x10], 0xcf
mov dword [esp + 0x14], 0xd0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], 0xaa
mov dword [esp + 0x30], 0xca
push 0xca
push esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
call fcn.00405b40
mov ebx, eax
add esp, 8
cmp ebx, 0x2710
jne 0x404f2f
lea eax, [esp + 0x38]
call fcn.00405570
mov eax, str.tp:__jp.hao123.com__tnime_inner_pop2_01_hao123_jp
lea edx, [esp + 0x38]
push edx
call fcn.00404f50
mov eax, dword [esp + 0x3c]
mov edi, 8
cmp dword [esp + 0x50], edi
jae 0x404ec3
lea eax, [esp + 0x3c]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push eax
push str.open
push 0
call esi
cmp eax, 0x20
jge 0x404f26
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x50], edi
jae 0x404eec
lea eax, [esp + 0x3c]
push 1
push 0
push eax
push 0x42c04c
push str.open
push 0
call esi
cmp eax, 0x20
jge 0x404f26
lea esi, [esp + 0x38]
call fcn.00405120
mov eax, 0x2714
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041752a
mov esp, ebp
pop ebp
ret 0x10
lea esi, [esp + 0x38]
call fcn.00405120
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0041752a
mov esp, ebp
pop ebp
ret 0x10