Function at 0x420730
Capabilities:
Create process on windows
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x60cf8a
mov eax, dword fs:[0]
push eax
mov eax, 0x158c
call fcn.005ef960
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x1588], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x15a0]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x6784cc]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 3
mov ebx, edx
push eax
mov dword [esp + 0x2c], ebx
call ebp
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
cmp esi, 0x4ca
jne 0x4207e5
push 0
push 0
push 0xf0
push esi
push ebx
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
push esi
push 0x4cb
push ebx
call ebp
push eax
call edi
push esi
push 0x4e2
push ebx
call ebp
push eax
call edi
push esi
push 0x4c9
push ebx
call ebp
push eax
call edi
push esi
push 0x4cd
push ebx
call ebp
push eax
call edi
jmp 0x4214e3
cmp esi, 0x3eb
jne 0x420828
push 0x24
push 0x625d30
push 0x625b70
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4214e3
lea eax, [esp + 0x3dc]
call fcn.004059d0
lea edi, [esp + 0x3dc]
mov esi, ebx
call fcn.004202b0
jmp 0x4214e3
cmp esi, 0x4c5
jne 0x42087c
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x24
push 0x625d30
push 0x626880
push ebx
call esi
cmp eax, 6
jne 0x4214e3
push 0
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xaf
call fcn.00487410
call fcn.0044cae0
push 0x40
push 0x625d30
push 0x6268b0
push ebx
call esi
jmp 0x4214e3
cmp esi, 0x4d3
jne 0x42090a
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, str.RTX.exe
call fcn.00426330
call fcn.004204c0
add esp, 4
test eax, eax
je 0x4208b9
push 0x18
push 0
push 0x1a
call fcn.004c7890
add esp, 0xc
mov dword [0x678f20], eax
call fcn.004062c0
mov esi, dword [0x678ec4]
mov edi, 1
push edi
mov edx, str.EnableRTXName
mov ecx, str.SOFTWARETencentQQPinyin
mov dword [0x678ec0], edi
mov dword [esi + 0xd98], edi
call fcn.00479d80
add esp, 4
push 0
push edi
push 0xf1
push 0x4c3
push ebx
mov dword [esi + 0xd9c], edi
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4214e3
cmp esi, 0x4d2
jne 0x420a9f
push 0x24
push 0x6268d0
push 0x6268ec
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4214e3
lea edi, [esp + 0x18]
call fcn.0047ac70
mov eax, edi
mov dword [esp + 0x15a8], 0
call fcn.00576f50
mov edx, edi
push edx
lea eax, [esp + 0x30]
push eax
mov ebx, str.cdict_
call fcn.0040aab0
add esp, 8
mov edx, str.R1.qpyd
lea edi, [esp + 0x2c]
mov byte [esp + 0x15a8], 1
call fcn.0040ae60
mov ecx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call esi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
mov ebx, str.nick.dat
call fcn.0040aab0
add esp, 8
mov byte [esp + 0x15a8], 2
call fcn.0040ab90
lea ecx, [esp + 0x24]
mov byte [esp + 0x15a8], 1
call fcn.00403870
mov ecx, dword [esp + 0x2c]
push ecx
call esi
push 0x62685c
call fcn.00513990
add esp, 4
lea ebx, [esp + 0x1c]
call fcn.0047a980
mov eax, ebx
mov byte [esp + 0x15a8], 3
call fcn.00576f50
mov edx, 0x626838
mov edi, ebx
call fcn.0040ae60
mov edx, dword [esp + 0x1c]
xor ebx, ebx
push ebx
push ebx
push ebx
push edx
push 0x625c98
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004062c0
mov edi, dword [0x678ec4]
push ebx
mov edx, str.EnableRTXName
mov ecx, str.SOFTWARETencentQQPinyin
mov dword [0x678ec0], 1
mov dword [edi + 0xd98], ebx
call fcn.00479d80
mov esi, dword [esp + 0x24]
add esp, 4
push ebx
push ebx
push 0xf1
push 0x4c3
push esi
mov dword [edi + 0xd9c], ebx
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x62693c
mov edx, 0x626940
mov ecx, str.SOFTWARETencentQQPinyin
call fcn.004798b0
add esp, 4
push ebx
push 0x625d30
push 0x62695c
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x1c]
call fcn.00403870
lea ecx, [esp + 0x2c]
call fcn.00403870
lea ecx, [esp + 0x18]
call fcn.00403870
jmp 0x4214e3
cmp esi, 0x4c6
jne 0x420c8e
push 0x58
xor ebp, ebp
lea eax, [esp + 0x68]
push ebp
push eax
call fcn.005da970
add esp, 0xc
push 0x208
lea ecx, [esp + 0x1182]
push ebp
push ecx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], 0x58
mov word [esp + 0x1188], bp
call fcn.005da970
add esp, 0xc
push 0x208
lea edx, [esp + 0x1392]
push ebp
push edx
mov word [esp + 0x1398], bp
call fcn.005da970
add esp, 0xc
lea esi, [esp + 0x117c]
mov ecx, str.QQPinyin_
call fcn.0040a710
mov eax, esi
mov dword [esp + 0x80], eax
mov eax, 0x104
lea edx, [esp + 0x64]
lea ecx, [esp + 0x138c]
push edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x9c], 0x802
mov dword [esp + 0xa4], 0x625778
mov dword [esp + 0x74], 0x62698c
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
je 0x4214e3
push ebp
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0xb1
call fcn.00487410
call fcn.0044c9c0
cmp eax, ebp
je 0x420be8
mov eax, dword [eax + 8]
cmp eax, ebp
je 0x420be8
cmp dword [eax + 8], 0x8000
jbe 0x420be8
mov eax, esi
push eax
push ebp
lea ecx, [esp + 0xec]
push ecx
call fcn.0041ef80
mov dword [esp + 0x15a8], 4
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea edi, [esp + 0xe8]
call fcn.004226d0
mov esi, dword [esp + 0x120]
mov eax, edi
mov dword [esp + 0x15a8], 0xffffffff
call fcn.0041f020
jmp 0x420bf6
lea ecx, [esp + 0x117c]
call fcn.0044f710
mov esi, eax
lea ecx, [esp + 0x18]
call fcn.00403890
cmp esi, ebp
mov ebx, 5
mov dword [esp + 0x15a8], ebx
lea edi, [esp + 0x18]
jbe 0x420c23
push esi
push 0x6269c8
call fcn.0040ac80
add esp, 8
jmp 0x420c2d
mov edx, 0x6269e4
call fcn.00403760
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.0040f370
mov byte [esp + 0x15a8], 6
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea edi, [esp + 0x38]
call fcn.004114b0
cmp eax, 1
jne 0x420c70
push ebx
push ebp
push ebp
lea ecx, [esp + 0x1188]
push ecx
push 0x625c98
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea esi, [esp + 0x34]
mov byte [esp + 0x15a8], bl
call fcn.0040f470
lea ecx, [esp + 0x18]
call fcn.00403870
jmp 0x4214e3
cmp esi, 0x4c7
jne 0x420fb4
xor ebp, ebp
push 0x208
lea edx, [esp + 0x1182]
push ebp
push edx
mov word [esp + 0x1188], bp
call fcn.005da970
add esp, 0xc
push 0x208
lea eax, [esp + 0x1392]
push ebp
push eax
mov word [esp + 0x1398], bp
call fcn.005da970
add esp, 0xc
push 0x58
lea ecx, [esp + 0x68]
push ebp
push ecx
call fcn.005da970
lea eax, [esp + 0x1398]
add esp, 0xc
mov dword [esp + 0x88], eax
mov eax, 0x104
lea ecx, [esp + 0x64]
lea edx, [esp + 0x117c]
push ecx
mov dword [esp + 0x68], 0x58
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x84], edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x9c], 0x802
mov dword [esp + 0xa4], 0x625778
mov dword [esp + 0x74], 0x62698c
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
test eax, eax
je 0x4214e3
push ebp
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0xb0
call fcn.00487410
lea edx, [esp + 0x18c]
push edx
lea eax, [esp + 0x1180]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x420e18
mov ecx, dword [esp + 0x1a8]
cmp ecx, ebp
mov edx, dword [esp + 0x1ac]
jl 0x420daa
jg 0x420da3
cmp edx, 0x200000
jbe 0x420daa
mov esi, 1
jmp 0x420dac
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, ebp
je 0x420e18
lea ecx, [esp + 0x117c]
push ecx
push 1
lea edx, [esp + 0xec]
push edx
call fcn.0041ef80
mov dword [esp + 0x15a8], 7
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea edi, [esp + 0xe8]
call fcn.004226d0
mov edi, dword [esp + 0x120]
mov esi, eax
sub esi, 1
neg esi
sbb esi, esi
lea eax, [esp + 0xe4]
add esi, 1
mov dword [esp + 0x15a8], 0xffffffff
call fcn.0041f020
jmp 0x420e2b
lea ecx, [esp + 0x117c]
call fcn.0044cb30
mov edi, eax
mov esi, 1
cmp edi, ebp
jle 0x420f19
lea eax, [esp + 0xe4]
push eax
call fcn.00401f10
push str.N_h
push ecx
push edi
push ecx
lea ecx, [esp + 0xf4]
push 0x626a20
mov ebp, 8
push ecx
mov dword [esp + 0x15c0], ebp
call fcn.00413340
add esp, 0xc
push eax
call fcn.00411200
add esp, 4
push eax
call fcn.00413340
add esp, 8
test esi, esi
jne 0x420ec8
push 0xa
lea ecx, [esp + 0xe8]
call fcn.00422420
lea ecx, [esp + 0xe4]
call fcn.00411350
push 0xa
lea ecx, [esp + 0xe8]
call fcn.00422420
lea ecx, [esp + 0xe4]
call fcn.00411350
lea edx, [esp + 0xe4]
push 0x626a2c
push edx
call fcn.00413340
add esp, 8
lea ecx, [esp + 0x34]
lea eax, [esp + 0xe4]
call fcn.00411530
cmp dword [eax + 0x18], ebp
jb 0x420ee2
mov eax, dword [eax + 4]
jmp 0x420ee5
add eax, 4
push 0x40
push 0x625d30
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esi, [esp + 0x34]
call fcn.00404670
lea eax, [esp + 0xe4]
mov dword [esp + 0x15a8], 0xffffffff
call fcn.00401c80
jmp 0x4214e3
jne 0x420f33
push 0x30
push 0x625d30
push 0x6257f4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4214e3
push 0x24
push 0x625d30
push 0x626a60
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4214e3
lea esi, [esp + 0x34]
call fcn.0041df60
lea eax, [esp + 0x117c]
push eax
mov dword [esp + 0x15ac], 9
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov edi, esi
call fcn.00422550
cmp eax, 1
jne 0x420f9a
push ebx
call fcn.0041ff20
add esp, 4
push ebx
mov dword [0x678f0c], 1
call fcn.00420100
add esp, 4
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x15ac], 0xffffffff
call fcn.0041dfc0
jmp 0x4214e3
cmp esi, 0x4c9
jne 0x4210e4
mov edx, ebx
push edx
call fcn.00420100
add esp, 4
lea ebx, [esp + 0x18]
call fcn.0047a980
mov eax, ebx
mov dword [esp + 0x15a8], 0xa
call fcn.00576f50
mov edx, str.QQPYLiveUp.exe
mov edi, ebx
call fcn.0040ae60
lea eax, [esp + 0x64]
push eax
call fcn.00401f10
push 2
push ecx
push str.__UpdateDictType_
push ecx
push 1
push ecx
push str.__UpdateImeType_
push ecx
push 2
push ecx
lea ecx, [esp + 0x8c]
push str._Mode_
push ecx
mov byte [esp + 0x15d8], 0xb
call fcn.00413340
add esp, 0xc
push eax
call fcn.00411200
add esp, 4
push eax
call fcn.00413340
add esp, 0xc
push eax
call fcn.00411200
add esp, 4
push eax
call fcn.00413340
add esp, 0xc
push eax
call fcn.00411200
lea ecx, [esp + 0x34]
lea eax, [esp + 0x64]
call fcn.00411530
cmp dword [eax + 0x18], 8
jb 0x421070
mov eax, dword [eax + 4]
jmp 0x421073
add eax, 4
mov edx, dword [esp + 0x18]
push 1
push 0
push eax
push edx
push 0x625c98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea esi, [esp + 0x34]
call fcn.00404670
mov eax, dword [esp + 0x20]
push 0
push 0x4cc
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
call fcn.005d2e37
add esp, 4
push eax
mov edx, str.LastDictUpdateTime
mov ecx, str.SOFTWARETencentQQPinyin
call fcn.00479d80
add esp, 4
lea eax, [esp + 0x64]
mov byte [esp + 0x15a8], 0xa
call fcn.00401c80
lea ecx, [esp + 0x18]
call fcn.00403870
jmp 0x4214e3
cmp esi, 0x4c8
jne 0x42114b
lea esi, [esp + 0x34]
call fcn.0041df60
push 0
mov dword [esp + 0x15ac], 0xc
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov edi, esi
call fcn.00422550
cmp eax, 1
jne 0x421131
push ebx
call fcn.0041ff20
add esp, 4
push ebx
mov dword [0x678f0c], 1
call fcn.00420100
add esp, 4
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x15ac], 0xffffffff
call fcn.0041dfc0
jmp 0x4214e3
cmp esi, 0x4cc
jne 0x42131e
push 0x24
push 0x625b68
push str._fT_Rd
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4214e3
push 0x4e2
mov edx, ebx
push edx
mov dword [esp + 0x24], 0
call ebp
push 2
push 0xffffffffffffffff
push 0x100c
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4214e3
call fcn.00422880
cmp ebx, eax
jae 0x4214e3
lea esi, [esp + 0x24]
call fcn.00422850
xor ebp, ebp
test ebx, ebx
jl 0x4214e3
cmp ebp, ebx
lea esi, [esp + 0x24]
je 0x4211e1
lea edi, [esp + 0x2c]
call fcn.00422920
add ebp, 1
cmp ebp, ebx
jle 0x4211c4
jmp 0x4214e3
call fcn.005ca800
mov eax, dword [eax + 4]
cmp eax, dword [0x67ba18]
jae 0x421314
imul eax, eax, 0x2c
add eax, dword [0x67ba14]
mov esi, eax
je 0x4214e3
cmp dword [esi + 0x28], 0
jne 0x4212ba
mov edi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 4]
lea edi, [esi + 4]
push ecx
call fcn.00513990
mov eax, dword [0x67ba18]
add esp, 4
xor esi, esi
test eax, eax
jbe 0x421280
xor ebp, ebp
cmp esi, eax
jae 0x421314
mov edx, dword [0x67ba14]
lea eax, [edx + ebp + 4]
push edi
call fcn.00422300
add esp, 4
test al, al
jne 0x421279
mov eax, dword [0x67ba18]
add esi, 1
add ebp, 0x2c
cmp esi, eax
jb 0x421251
jmp 0x421280
mov eax, esi
call fcn.00423b40
mov eax, ebx
lea ecx, [esp + 0x18]
call fcn.00403720
test eax, eax
je 0x421297
mov dword [esp + 0x1c], 1
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push ebx
push 0x1008
push esi
call edi
push 2
push 0xffffffffffffffff
push 0x100c
push esi
call edi
jmp 0x4212cd
mov eax, dword [esp + 0x18]
push 2
push ebx
push 0x100c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x670292]
mov esi, dword [esp + 0x20]
push ecx
push 0
push 0xffffffffffffffff
push esi
mov ebx, eax
call fcn.00421510
add esp, 0x10
cmp ebx, 0xffffffff
jne 0x4211a4
cmp dword [esp + 0x1c], 0
je 0x4214e3
push esi
mov dword [0x678f0c], 1
call fcn.00420100
add esp, 4
jmp 0x4214e3
push 0x80070057
call fcn.00403650
cmp esi, 0x567
jne 0x421368
lea edx, [esp + 0xe4]
push edx
call fcn.004177c0
mov dword [esp + 0x15a8], 0xd
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea edi, [esp + 0xe8]
call fcn.00422650
mov ecx, edi
mov dword [esp + 0x15a8], 0xffffffff
call fcn.004178c0
jmp 0x4214e3
cmp esi, 0x4d1
jne 0x4213a7
lea esi, [esp + 0x34]
call fcn.00410870
mov dword [esp + 0x15a8], 0xe
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov edi, esi
call fcn.00411430
mov dword [esp + 0x15a8], 0xffffffff
call fcn.004108a0
jmp 0x4214e3
cmp esi, 0x4ce
jne 0x4213eb
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x24
push 0x625d30
push 0x625d3c
push ebx
call esi
cmp eax, 6
jne 0x4214e3
call fcn.004506b0
call fcn.0040a360
push 0x40
push 0x625d30
push 0x625d6c
push ebx
call esi
jmp 0x4214e3
cmp esi, 0x4cf
jne 0x4214d4
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
call fcn.0040a600
add esp, 4
mov dword [esp + 0x15a8], 0xf
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], 0
je 0x4214c9
lea ecx, [esp + 0x18]
call fcn.00403890
mov bl, 0x10
mov byte [esp + 0x15a8], bl
mov eax, dword [esp + 0x1c]
test eax, eax
lea edi, [esp + 0x18]
jbe 0x421459
push eax
push 0x625d84
call fcn.0040ac80
add esp, 8
jmp 0x421463
mov edx, 0x625da4
call fcn.00403760
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x16c]
push eax
call fcn.0040f370
mov byte [esp + 0x15a8], 0x11
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea edi, [esp + 0x16c]
call fcn.004114b0
cmp eax, 1
jne 0x4214ad
mov ecx, dword [esp + 0x20]
push 5
push 0
push 0
push ecx
push 0x625c98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea esi, [esp + 0x168]
mov byte [esp + 0x15a8], bl
call fcn.0040f470
lea ecx, [esp + 0x18]
call fcn.00403870
lea ecx, [esp + 0x20]
call fcn.00403870
jmp 0x4214e3
cmp esi, 0x4d0
jne 0x4214e3
mov esi, ebx
call fcn.0040a910
mov ecx, dword [esp + 0x15a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1588]
xor ecx, esp
call fcn.005d28b3
add esp, 0x1598
ret