Function at 0x495eb0
Capabilities:
Check if file exists
Create process on windows
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x19c], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9c41
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x17
ja case.0x495f05.1
mov ecx, dword [ebp - 0x1a0]
jmp dword [ecx*4 + 0x496b2c]
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x484], 0
jne 0x495fcc
mov ecx, dword [ebp - 0x19c]
call fcn.004a3200
push 0x1ae
push 0x20d
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.004652b0
push 0x2f8
call fcn.0053e4e7
add esp, 4
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x495f6f
mov ecx, dword [ebp - 0x88]
call fcn.00496b90
mov dword [ebp - 0x1a4], eax
jmp 0x495f79
mov dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x1a4]
mov dword [eax + 0x484], ecx
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x484], 0
je 0x495fcc
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x58e630
push 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x484]
call fcn.004fad42
push 1
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.004a0fe0
mov edx, dword [ebp - 0x19c]
add edx, 0x3e8
sub esp, 0x10
mov ecx, esp
push edx
call fcn.004a2bf0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x484]
call fcn.004a1cd0
push 0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.004fa305
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x484]
call fcn.004a1170
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e618
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
lea eax, [ebp - 0x1c]
push eax
call fcn.00444780
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4960b4
push 5
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e5fc
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
lea ecx, [ebp - 0x1c]
call fcn.0040f740
jmp case.0x495f05.1
push 0x4a4f70
push 0
push 0x44cd40
call fcn.00547a7d
add esp, 0xc
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e5e0
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
push 1
push 0
push str.Shell32.dll_Control_RunDLL_timedate.cpl
push str.Rundll32.exe
push 0x58e568
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e544
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
push 0x582b94
lea ecx, [ebp - 0x24]
call fcn.0041c8a0
push 0x104
push 0x105
lea ecx, [ebp - 0x24]
call fcn.004773d0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20]
call fcn.0040ee90
mov eax, dword [ebp - 0x24]
push eax
push str._select__s
lea ecx, [ebp - 0x20]
push ecx
call fcn.004ea900
add esp, 0xc
push 5
push 0x582b94
lea ecx, [ebp - 0x20]
call fcn.0041cb20
push eax
push str.explorer.exe
push 0x58e568
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e4f0
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
lea ecx, [ebp - 0x20]
call fcn.0040f740
lea ecx, [ebp - 0x24]
call fcn.0040f740
jmp case.0x495f05.1
lea ecx, [ebp - 0x40]
call fcn.00451e90
push 1
push ecx
mov ecx, esp
push 0x588ed8
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x40]
call fcn.00451fe0
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x588d80
call fcn.0041c8a0
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x40]
call fcn.00452240
push 5
push 0x582b94
push 0
lea ecx, [ebp - 0x28]
call fcn.0041cb20
push eax
push 0x58e568
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e4d0
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
lea ecx, [ebp - 0x28]
call fcn.0040f740
lea ecx, [ebp - 0x40]
call fcn.00451f50
jmp case.0x495f05.1
push 1
push ecx
mov ecx, esp
push str.http:__xzs.ithome.com
call fcn.0041c8a0
call fcn.004458d0
add esp, 8
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e48c
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
push 1
push ecx
mov ecx, esp
push str.http:__go.ruanmei.com_url.aspx_linkid155
call fcn.0041c8a0
call fcn.004458d0
add esp, 8
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e418
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x48c], 0
jne 0x4963b7
push 0x2d8
call fcn.0053e4e7
add esp, 4
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x49635a
mov ecx, dword [ebp - 0xe4]
call fcn.0047c000
mov dword [ebp - 0x1a8], eax
jmp 0x496364
mov dword [ebp - 0x1a8], 0
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x1a8]
mov dword [ecx + 0x48c], edx
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x48c], 0
je 0x4963b7
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x588d2c
push 0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x48c]
call fcn.004fad42
push 0
push 5
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x48c]
call fcn.004fa2b2
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e400
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004956d0
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e3e4
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x484], 0
jne 0x4964ed
mov ecx, dword [ebp - 0x19c]
call fcn.004a3200
push 0x1ae
push 0x20d
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.004652b0
push 0x2f8
call fcn.0053e4e7
add esp, 4
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x496490
mov ecx, dword [ebp - 0xf8]
call fcn.00496b90
mov dword [ebp - 0x1ac], eax
jmp 0x49649a
mov dword [ebp - 0x1ac], 0
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x1ac]
mov dword [ecx + 0x484], edx
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x484], 0
je 0x4964ed
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x58e630
push 0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.004fad42
push 2
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x484]
call fcn.004a0fe0
mov eax, dword [ebp - 0x19c]
add eax, 0x3e8
sub esp, 0x10
mov ecx, esp
push eax
call fcn.004a2bf0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.004a1cd0
push 0
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x484]
call fcn.004fa305
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x484]
call fcn.004a1170
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e3c0
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
push 1
push 0
push 0
push str.taskmgr.exe
push 0x58e568
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e388
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
cmp dword [ecx + 0x49c], 0
jne 0x496658
push 0x2e0
call fcn.0053e4e7
add esp, 4
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x4965fb
mov ecx, dword [ebp - 0x110]
call fcn.004a2c40
mov dword [ebp - 0x1b0], eax
jmp 0x496605
mov dword [ebp - 0x1b0], 0
mov edx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x1b0]
mov dword [edx + 0x49c], eax
mov ecx, dword [ebp - 0x19c]
cmp dword [ecx + 0x49c], 0
je 0x496658
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x588d2c
push 0
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x49c]
call fcn.004fad42
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x49c], 0
je 0x4966b7
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0x49c]
movzx eax, byte [edx + 0x2d8]
test eax, eax
je 0x496688
mov eax, 1
jmp 0x496b19
push ecx
mov ecx, esp
push 0x58e374
call fcn.0041c8a0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x49c]
call fcn.00486050
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x49c]
call fcn.004a3000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00445390
add esp, 4
test eax, eax
jne 0x496752
push 0
push ecx
mov ecx, esp
push str._checktime
call fcn.0041c8a0
push ecx
mov eax, esp
push 0x58ab5c
push 0x5c2724
push eax
call fcn.0041ca60
add esp, 0xc
call fcn.00446290
add esp, 0xc
test eax, eax
je 0x496701
jmp 0x496750
push str._checktime
lea ecx, [ebp - 0x120]
call fcn.0041c8a0
lea ecx, [ebp - 0x120]
push ecx
push 0x58ab5c
push 0x5c2724
lea edx, [ebp - 0x124]
push edx
call fcn.0041ca60
add esp, 0xc
push eax
call fcn.00445410
add esp, 8
lea ecx, [ebp - 0x124]
call fcn.0040f740
lea ecx, [ebp - 0x120]
call fcn.0040f740
jmp 0x496791
push 5
push 0
push str._checktime
push 0x58ab5c
push 0x5c2724
lea eax, [ebp - 0x128]
push eax
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x128]
call fcn.0040f740
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e358
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a41b0
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e338
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a41e0
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e320
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a43a0
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e304
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a4580
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e2e4
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a4300
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e2cc
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a4260
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e2b4
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a45a0
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e29c
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
mov ecx, dword [ebp - 0x19c]
call fcn.004a4620
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e284
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp case.0x495f05.1
lea ecx, [ebp - 0x6c]
call fcn.00451e90
push 0
push ecx
mov ecx, esp
push 0x588ed8
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x6c]
call fcn.00451fe0
push 1
push ecx
mov ecx, esp
push 0x58c0ec
call fcn.0041c8a0
lea ecx, [ebp - 0x6c]
call fcn.00452d70
test eax, eax
setne cl
mov byte [ebp - 0x51], cl
movzx edx, byte [ebp - 0x51]
test edx, edx
je 0x4969ea
mov ecx, dword [ebp - 0x19c]
call fcn.00486f70
push 1
push ecx
mov ecx, esp
push 0x587230
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e270
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
jmp 0x496a37
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x4a0], 0
je 0x496a11
push 0
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0x4a0]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push ecx
mov ecx, esp
push 0x587238
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58cdc0
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
lea ecx, [ebp - 0x6c]
call fcn.00451f50
jmp case.0x495f05.1
lea ecx, [ebp - 0x84]
call fcn.00451e90
push 0
push ecx
mov ecx, esp
push 0x588ed8
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x84]
call fcn.00451fe0
push 1
push ecx
mov ecx, esp
push 0x58af34
call fcn.0041c8a0
lea ecx, [ebp - 0x84]
call fcn.00452d70
test eax, eax
setne cl
mov byte [0x5c245e], cl
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x4a0], 0
je 0x496ab3
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x4a0]
call fcn.0048c870
movzx ecx, byte [0x5c245e]
test ecx, ecx
je 0x496aca
mov dword [ebp - 0x1b4], 0x587230
jmp 0x496ad4
mov dword [ebp - 0x1b4], 0x587238
push 1
push ecx
mov ecx, esp
mov edx, dword [ebp - 0x1b4]
push edx
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58e260
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
lea ecx, [ebp - 0x84]
call fcn.00451f50
mov eax, dword [ebp - 0x19c]
mov byte [eax + 0x4a8], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 0x10