Function at 0x424742
Capabilities:
Check if file exists
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7dc
mov eax, dword [0x498d74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.0042394f
pop ecx
push ebx
push edi
push ebx
mov ecx, 0x49b054
call fcn.00423a12
cmp dword [0x49b194], 4
mov esi, dword [0x49b19c]
push dword [esi + 4]
lea ecx, [ebp - 0x7d0]
jne 0x4248cf
call fcn.00409bbf
push str.player
mov ecx, eax
call fcn.0042058f
mov ecx, dword [ebp - 0x7d0]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x7c5], al
call fcn.0040125c
cmp byte [ebp - 0x7c5], bl
je 0x424940
push dword [esi + 8]
lea ecx, [ebp - 0x7d8]
call fcn.00409bbf
push dword [esi + 0xc]
lea ecx, [ebp - 0x7d0]
call fcn.00409bbf
mov eax, dword [ebp - 0x7d8]
push dword [eax - 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
cmp eax, ebx
jne 0x42480b
call fcn.00401b41
push eax
call fcn.0044a354
pop ecx
mov edi, eax
lea eax, [ebp - 0x7cc]
push eax
push 0x423924
mov dword [ebp - 0x7cc], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x7cc], ebx
je 0x424890
push edi
push ebx
push 0x1a3d
push dword [ebp - 0x7cc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [ebp - 0x7cc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x7cc]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp - 0x7cc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x7d0]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x7d8]
add ecx, 0xfffffff0
call fcn.0040125c
mov eax, ebx
jmp 0x424dbc
push ecx
mov ecx, esp
mov dword [ebp - 0x7d4], esp
push dword [esi + 0xc]
call fcn.00409bbf
lea ecx, [ebp - 0x710]
call fcn.0040ae69
push edi
push ebx
lea ecx, [ebp - 0x710]
call fcn.00423ba7
lea ecx, [ebp - 0x710]
mov dword [ebp - 0x70c], ebx
call fcn.004033d2
xor ebx, ebx
inc ebx
jmp 0x42486d
call fcn.00409bbf
push str._resource
mov ecx, eax
call fcn.0042058f
mov ecx, dword [ebp - 0x7d0]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x7c5], al
call fcn.0040125c
cmp byte [ebp - 0x7c5], bl
je 0x424940
lea ecx, [ebp - 0x7c5]
call fcn.00441db1
mov eax, dword [0x49b194]
cmp eax, 2
jne 0x424925
push edi
lea ecx, [ebp - 0x7c5]
call fcn.0040ed75
jmp 0x424938
cmp eax, 3
jne 0x424938
push dword [esi + 8]
lea ecx, [ebp - 0x7c5]
call fcn.0040b48c
xor eax, eax
inc eax
jmp 0x424dbc
call fcn.00422abe
test eax, eax
setne al
mov byte [0x49b019], al
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov byte [0x49b01a], bl
call fcn.004424b0
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00423762
add esp, 0x14
mov byte [0x49b018], al
cmp byte [0x49b019], bl
je 0x424997
call fcn.00424499
call fcn.004238d2
test al, al
je 0x4249cb
call fcn.00424366
cmp eax, ebx
sete cl
mov byte [0x49b01a], cl
cmp cl, bl
jne 0x4249cb
push eax
call fcn.004243a0
pop ecx
call fcn.00424366
neg eax
sbb al, al
inc al
mov byte [0x49b01a], al
or eax, 0xffffffff
cmp dword [0x49b194], 2
mov dword [ebp - 0x7d8], eax
jle 0x4249f5
push dword [esi + 4]
call fcn.0044a354
push dword [esi + 8]
mov dword [ebp - 0x7d8], eax
call fcn.0044a354
pop ecx
pop ecx
push eax
push dword [ebp - 0x7d8]
lea ecx, [ebp - 0x7c4]
call fcn.00409e11
mov esi, dword [sym.imp.USER32.dll_GetActiveWindow]
push ebx
call esi
push eax
lea ecx, [ebp - 0x7c4]
call fcn.004041eb
mov dword [ebp - 0x7d8], eax
push ebx
lea eax, [ebp - 0x7dc]
push eax
push str.HKCUSoftwarePPTAssistCommonSettingHasTried
mov dword [ebp - 0x7c0], ebx
mov dword [ebp - 0x7dc], ebx
call fcn.00421260
add esp, 0xc
cmp dword [ebp - 0x7d8], 0x65
jne 0x424a66
push 5
push ebx
push ebx
push str.http:__www.meihuappt.com
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x424d9b
cmp dword [ebp - 0x7d8], 0x67
jne 0x424a9f
lea ecx, [ebp - 0x700]
call fcn.00409f11
push ebx
call esi
push eax
lea ecx, [ebp - 0x700]
call fcn.004041eb
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x6fc], ebx
call fcn.00403324
jmp 0x424d9b
xor eax, eax
push 0x206
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push ebx
push eax
call fcn.004424b0
add esp, 0xc
push edi
lea eax, [ebp - 0x61c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 0x7d8], 0x64
jne 0x424c71
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.004424b0
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004238f3
add esp, 0x14
test al, al
je 0x424bd0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x7cc]
call fcn.00409bbf
mov esi, str.POWERPNT.EXE
push esi
call fcn.0044252a
pop ecx
push eax
push esi
lea ecx, [ebp - 0x7cc]
call fcn.00404a2c
lea ecx, [ebp - 0x7cc]
call fcn.00421e66
push eax
lea ecx, [ebp - 0x7cc]
call fcn.00414d17
push dword [ebp - 0x7cc]
call fcn.00424529
pop ecx
test eax, eax
jne 0x424b76
push ebx
push 0xa
push ebx
push ebx
push 0x481484
push dword [ebp - 0x7cc]
call fcn.004015ca
add esp, 0x18
push 0x47f938
lea ecx, [ebp - 0x7d0]
call fcn.00409bbf
mov esi, str.open
push esi
lea ecx, [ebp - 0x7d4]
call fcn.00409bbf
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x7d4]
push eax
call fcn.00409c28
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7d4]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x7d0]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x7cc]
jmp 0x424c2f
push 0x40
push 0x48147c
push 0x481430
call esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x47f930
lea ecx, [ebp - 0x7d4]
call fcn.00409bbf
mov esi, str.open
push esi
lea ecx, [ebp - 0x7d0]
call fcn.00409bbf
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x7d0]
push eax
call fcn.00409c28
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7d0]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x7d4]
add ecx, 0xfffffff0
call fcn.0040125c
cmp dword [ebp - 0x7dc], ebx
jne 0x424d9b
push 3
push ebx
push ebx
push str.http:__www.meihuappt.com_experience.php
push esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
inc edi
push ebx
push edi
push str.HKCUSoftwarePPTAssistCommonSettingHasTried
mov dword [ebp - 0x7dc], edi
call fcn.0042133d
add esp, 0xc
jmp 0x424d9b
cmp dword [ebp - 0x7d8], 0x66
jne 0x424d9b
cmp byte [0x49b018], bl
jne 0x424c95
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00423762
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x7cc]
call fcn.00409bbf
mov esi, str.office6wpp.exe
push esi
call fcn.0044252a
pop ecx
push eax
push esi
lea ecx, [ebp - 0x7cc]
call fcn.00404a2c
push dword [ebp - 0x7cc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x424d8d
push dword [ebp - 0x7cc]
call fcn.00424529
xor edi, edi
inc edi
pop ecx
test eax, eax
jne 0x424cfe
push ebx
push edi
push ebx
push ebx
push 0x481654
push dword [ebp - 0x7cc]
call fcn.004015ca
add esp, 0x18
mov esi, str.open
cmp dword [ebp - 0x7dc], ebx
jne 0x424d31
push 3
push ebx
push ebx
push str.http:__www.meihuappt.com_experience.php
push esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push edi
push str.HKCUSoftwarePPTAssistCommonSettingHasTried
mov dword [ebp - 0x7dc], edi
call fcn.0042133d
add esp, 0xc
lea ecx, [ebp - 0x7d4]
cmp byte [0x49b018], bl
jne 0x424d46
push 0x47f934
jmp 0x424d4b
push 0x47db94
call fcn.00409bbf
push esi
lea ecx, [ebp - 0x7d0]
call fcn.00409bbf
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x7d0]
push eax
call fcn.00409c28
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7d0]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x7d4]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x7cc]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, 0x49b054
call fcn.00423bf7
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x7c4]
call fcn.004030e7
mov eax, dword [ebp - 0x7d8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044249e
leave
ret 0x10