Function at 0x40622e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45035b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x463140]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00428e70
xor esi, esi
mov dword [esp + 0x20], eax
movzx eax, word [ebp + 8]
cmp dword [ebx + 0x17dc], esi
je 0x40655b
sub eax, 0x3e8
je 0x406529
dec eax
je 0x40638a
dec eax
je 0x40636e
sub eax, 3
je 0x4062dc
sub eax, 4
je 0x4062c1
dec eax
jne 0x406542
push 1
push esi
push esi
push str.http:__www.itools.cn_agreement_cn.html
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x406542
mov eax, dword [ebx + 0x1878]
xor ecx, ecx
cmp byte [eax + 0x15], cl
mov edi, ebx
sete cl
push ecx
call fcn.004067ae
jmp 0x406542
lea esi, [ebx + 0x17d8]
mov eax, dword [esi]
sub eax, 0x10
call fcn.00404e00
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], 2
mov ecx, dword [ebx + 4]
call fcn.0041d8e0
test eax, eax
je 0x406352
mov eax, esi
call fcn.004068ee
mov eax, dword [esi]
push 0x5c
push eax
call fcn.0043a11a
pop ecx
pop ecx
test eax, eax
jne 0x406323
or eax, 0xffffffff
jmp 0x406327
sub eax, dword [esi]
sar eax, 1
mov ecx, dword [esi]
mov ecx, dword [ecx - 0xc]
dec ecx
cmp eax, ecx
jne 0x406338
push 0x456684
jmp 0x40633d
push 0x4567d0
push esi
call fcn.00406d0a
push dword [esi]
mov eax, dword [ebx + 0x1878]
call fcn.0041705e
jmp 0x40635d
lea eax, [esp + 0x14]
mov edi, esi
call fcn.004068ad
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.0040507e
jmp 0x406542
mov eax, dword [ebx + 0x1860]
push dword [eax + 0x2ac]
mov ecx, dword [ebx + 0x1850]
call fcn.004285b0
jmp 0x406542
mov ecx, dword [ebx + 0x1878]
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push edx
call dword [eax + 0x15c]
lea edi, [ebx + 0x17d8]
mov dword [esp + 0x30], esi
call fcn.004068ad
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.0040507e
mov eax, dword [edi]
mov dword [esp + 0x18], esi
cmp dword [eax - 0xc], esi
je 0x406437
add eax, 0xfffffff0
call fcn.00404e00
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
cmp dword [edi - 4], eax
jle 0x4063f4
push dword [edi - 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.00404f5f
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea esi, [esp + 0x14]
call fcn.00406c56
cmp dword [edi - 0xc], 2
jl 0x406421
mov eax, dword [ebx + 0x17d8]
call fcn.0041dd50
test eax, eax
je 0x406421
mov dword [esp + 0x18], 1
or dword [esp + 0x30], 0xffffffff
lea eax, [edi - 0x10]
call fcn.0040507e
cmp dword [esp + 0x18], 0
jne 0x40644f
xor esi, esi
push 0x10
push esi
push 0x45694c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x406546
mov dl, 0xfe
mov eax, ebx
mov byte [esp + 0x13], 0xfe
call fcn.004297d0
add byte [esp + 0x13], 0xe7
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dl, byte [esp + 0x13]
mov eax, ebx
call fcn.004297d0
cmp byte [esp + 0x13], 0x19
ja 0x40645d
push 1
push 1
mov esi, ebx
call fcn.00421730
mov eax, dword [ebx]
push 1
xor edi, edi
push edi
mov ecx, ebx
call dword [eax + 0xf8]
push 5
push dword [ebx + 0x44c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [ebx + 0x44c]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea edi, [ebx + 0x8b8]
lea eax, [ebx + 0x17d8]
call fcn.004068ad
mov eax, dword [ebx + 0x17d8]
push ecx
sub eax, 0x10
mov dword [esp + 0x1c], esp
mov edi, esp
call fcn.00404e00
add eax, 0x10
lea ecx, [ebx + 0x930]
mov dword [edi], eax
call fcn.0040df17
mov eax, dword [ebx + 0x1864]
mov eax, dword [eax + 0x2ac]
mov dword [ebx + 0x8a0], eax
mov eax, dword [ebx + 0x1868]
mov eax, dword [eax + 0x2ac]
mov dword [ebx + 0x8a4], eax
mov eax, dword [ebx + 0x186c]
mov eax, dword [eax + 0x2ac]
mov dword [ebx + 0x8a8], eax
jmp 0x4065d3
call fcn.00416945
push esi
push 0xf060
push 0x112
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub eax, 0x3e8
je 0x40652e
dec eax
je 0x40656a
dec eax
jne 0x406542
jmp 0x40652e
mov dl, 0xfe
mov eax, ebx
mov byte [esp + 0x13], 0xfe
call fcn.004297d0
add byte [esp + 0x13], 0xe7
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dl, byte [esp + 0x13]
mov eax, ebx
call fcn.004297d0
cmp byte [esp + 0x13], 0x19
ja 0x406578
push 1
push 1
mov esi, ebx
call fcn.00421730
mov eax, dword [ebx]
push 1
xor edi, edi
push edi
mov ecx, ebx
call dword [eax + 0xf8]
push 5
push dword [ebx + 0x44c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [ebx + 0x44c]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [ebx + 0x448]
call fcn.00407f53
jmp 0x406542