Function at 0x41b9ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c74d7
mov eax, dword fs:[0]
push eax
mov eax, 0x159c
call fcn.0044db00
mov eax, dword [0x502ae0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x125c]
push edi
call fcn.00414cab
mov ebx, eax
mov dword [esp], 0x4d0e8c
push ebx
push ebx
push 8
mov ecx, esi
mov dword [ebp - 0x1538], ebx
mov dword [ebp - 0x1534], edx
call fcn.00415b89
lea eax, [esi + 0x8204]
push eax
call fcn.0044c78e
pop ecx
test eax, eax
je 0x41ba8c
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x1518], ax
lea eax, [ebp - 0x1516]
push eax
call fcn.0044d1b0
push 0x1108
lea eax, [ebp - 0x1118]
push 0
push eax
call fcn.0044d1b0
lea eax, [ebp - 0x1518]
push eax
push edi
call fcn.004154f6
add esp, 0x20
test eax, eax
je 0x41ba76
lea eax, [esi + 0x8204]
push eax
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41ba8c
push edi
call fcn.00414ce4
mov dword [esp], 0x4d0e6c
push ebx
push ebx
push 0x20
jmp 0x41bdc9
mov ecx, esi
call fcn.00415b7d
test eax, eax
je 0x41bdd0
push str.ck_W
push ebx
push ebx
push 9
call fcn.00415b89
cmp dword [esi + 0x6c00], 3
jne 0x41bd1a
lea ecx, [ebp - 0x1550]
call fcn.00410878
and dword [ebp - 4], 0
call fcn.0041a060
push ecx
cmp eax, 0x13
mov eax, esp
mov dword [ebp - 0x1520], esp
lea ecx, [ebp - 0x1550]
push eax
jl 0x41baea
call fcn.004183c4
mov byte [ebp - 4], 1
jmp 0x41baf3
call fcn.00418346
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x151c], esp
push edi
call fcn.0041217e
mov byte [ebp - 4], 0
call fcn.00418934
pop ecx
pop ecx
lea edi, [esi + 0x69e4]
push edi
lea ecx, [ebp - 0x152c]
call fcn.0041217e
push 0x4d0f64
push 0x4d0f60
lea ecx, [ebp - 0x152c]
mov byte [ebp - 4], 3
call fcn.00411249
push 0x502868
lea ecx, [ebp - 0x1524]
call fcn.0040fd3c
push dword [ebp - 0x152c]
lea eax, [ebp - 0x1524]
push str.__class12___procid90682043_o2_hao____param_s
push eax
mov byte [ebp - 4], 4
call fcn.0041182d
pop ecx
pop ecx
mov ecx, esp
mov dword [ebp - 0x1520], esp
push str.hao123JuziBrowser
call fcn.0041217e
push ecx
mov eax, esp
mov dword [ebp - 0x151c], esp
push eax
lea ecx, [ebp - 0x1550]
mov byte [ebp - 4], 5
call fcn.004183c4
lea eax, [ebp - 0x1528]
push eax
lea ecx, [ebp - 0x1550]
mov byte [ebp - 4], 4
call fcn.00418668
lea ecx, [ebp - 0x156c]
mov byte [ebp - 4], 6
call fcn.00417344
push ecx
mov ebx, esp
mov dword [ebp - 0x1558], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1520], esp
push str.Installerie.ico
mov byte [ebp - 4], 7
call fcn.0041217e
mov eax, dword [ebp - 0x1528]
push ecx
mov dword [ebp - 0x151c], esp
add eax, 0xfffffff0
mov dword [ebp - 0x151c], esp
push eax
mov byte [ebp - 4], 8
call fcn.0040f61d
pop ecx
mov ecx, dword [ebp - 0x151c]
add eax, 0x10
mov dword [ecx], eax
push ebx
lea ecx, [ebp - 0x1550]
mov byte [ebp - 4], 7
call fcn.00418668
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1524]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x1554], esp
mov ebx, esp
push eax
mov dword [ebp - 0x1520], eax
call fcn.0040f61d
add eax, 0x10
mov dword [ebx], eax
mov ebx, esp
mov dword [ebp - 0x155c], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1530], esp
push str.hao123Juzi.exe
mov byte [ebp - 4], 0xa
call fcn.0041217e
mov eax, dword [ebp - 0x1528]
push ecx
mov dword [ebp - 0x151c], esp
add eax, 0xfffffff0
mov dword [ebp - 0x151c], esp
push eax
mov byte [ebp - 4], 0xb
call fcn.0040f61d
pop ecx
mov ecx, dword [ebp - 0x151c]
add eax, 0x10
mov dword [ecx], eax
push ebx
lea ecx, [ebp - 0x1550]
mov byte [ebp - 4], 0xa
call fcn.00418668
push ecx
mov ecx, esp
mov dword [ebp - 0x1530], esp
push edi
mov byte [ebp - 4], 0xc
call fcn.0041217e
lea ecx, [ebp - 0x156c]
mov byte [ebp - 4], 7
call fcn.00417c02
lea ecx, [ebp - 0x156c]
call fcn.0041879e
lea ecx, [ebp - 0x156c]
call fcn.00417373
mov ecx, dword [ebp - 0x1528]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0x1520]
call fcn.0040f083
mov ecx, dword [ebp - 0x152c]
add ecx, 0xfffffff0
call fcn.0040f083
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1550]
call fcn.00410276
mov ecx, dword [ebp - 0x1540]
add ecx, 0xfffffff0
call fcn.0040f083
mov ebx, dword [ebp - 0x1538]
jmp 0x41bdc0
push ecx
mov ecx, esp
mov dword [ebp - 0x1530], esp
push edi
call fcn.0041217e
lea eax, [ebp - 0x1524]
push eax
mov ecx, esi
call fcn.0041b42f
push 0x3c
lea eax, [ebp - 0x15a8]
push 0
push eax
call fcn.0044d1b0
mov eax, dword [ebp - 0x1524]
and dword [ebp - 0x15a0], 0
mov dword [ebp - 0x1598], edi
lea edi, [esi + 0x7e04]
push edi
mov dword [ebp - 0x15a8], 0x3c
mov dword [ebp - 0x159c], eax
call fcn.0044c78e
add esp, 0x10
test eax, eax
je 0x41bd83
mov dword [ebp - 0x1594], edi
lea eax, [ebp - 0x15a8]
push eax
mov dword [ebp - 0x158c], 1
mov dword [ebp - 0x15a4], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x1570]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x1524]
add ecx, 0xfffffff0
call fcn.0040f083
push 0x4d0e54
push ebx
push ebx
push 0x10
mov ecx, esi
call fcn.00415b89
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044d74d
leave
ret