Function at 0x42b310
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523f1f
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10c], ecx
push 1
push 0
mov ecx, dword [ebp - 0x10c]
call fcn.00444580
lea ecx, [ebp - 0x7c]
call fcn.004032e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x770]
push ecx
lea edx, [ebp - 0x94]
push edx
call fcn.0042a9e0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x94]
call fcn.004093c0
movzx eax, al
test eax, eax
jne 0x42b46b
push 0x74
lea ecx, [ebp - 0x108]
call fcn.00408cf0
lea ecx, [ebp - 0x108]
call fcn.00418fd0
mov byte [ebp - 4], 2
push 0x18
lea ecx, [ebp - 0x64]
call fcn.00408cf0
push 0
lea ecx, [ebp - 0x64]
call fcn.004234a0
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x94]
push edx
lea ecx, [ebp - 0x108]
call fcn.0041ee30
push 0x52e7c0
push 0x52e7b8
lea ecx, [ebp - 0x64]
call fcn.00423ed0
mov ecx, eax
call fcn.00423ed0
mov ecx, eax
call fcn.00426cc0
movzx eax, al
test eax, eax
jne 0x42b450
lea ecx, [ebp - 0x214]
push ecx
push 0x52e7d0
push str.INSINFO
lea ecx, [ebp - 0x64]
call fcn.00423ed0
mov ecx, eax
call fcn.00423ed0
mov ecx, eax
call fcn.004259f0
mov dword [ebp - 0x1b0], eax
mov edx, dword [ebp - 0x1b0]
push edx
lea ecx, [ebp - 0x7c]
call fcn.00406730
lea ecx, [ebp - 0x214]
call fcn.00403390
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.00423860
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x108]
call fcn.00406440
push 4
lea ecx, [ebp - 0x18]
call fcn.00408cf0
lea ecx, [ebp - 0x18]
call fcn.0040c260
mov byte [ebp - 4], 4
push 4
lea ecx, [ebp - 0x14]
call fcn.00408cf0
lea ecx, [ebp - 0x14]
call fcn.0040c260
mov byte [ebp - 4], 5
push 4
lea ecx, [ebp - 0x24]
call fcn.00408cf0
lea ecx, [ebp - 0x24]
call fcn.0040c260
mov byte [ebp - 4], 6
push 4
lea ecx, [ebp - 0x1c]
call fcn.00408cf0
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d2a0
add esp, 4
mov byte [ebp - 4], 7
push 4
lea ecx, [ebp - 0x4c]
call fcn.00408cf0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040d390
add esp, 4
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x10c]
cmp dword [edx + 0x770], 0
jne 0x42b5c3
push str.TopSpBrowser
call fcn.00402e20
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.00406710
push ecx
mov ecx, esp
mov dword [ebp - 0x1f0], esp
lea eax, [ebp - 0x18]
push eax
call fcn.0040c170
lea ecx, [ebp - 0x1e0]
push ecx
mov ecx, dword [ebp - 0x10c]
call fcn.0042acb0
mov dword [ebp - 0x1d8], eax
mov edx, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1dc]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1e0]
call fcn.00406090
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx + 0x76c]
call fcn.00447640
movzx edx, al
test edx, edx
je 0x42b5be
push 4
lea ecx, [ebp - 0x34]
call fcn.00408cf0
push str.SPChrome
call fcn.00402e20
add esp, 4
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.0040c7d0
add esp, 0xc
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x34]
push edx
call fcn.0040eec0
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x34]
call fcn.00406090
jmp 0x42ba33
mov eax, dword [ebp - 0x10c]
cmp dword [eax + 0x770], 2
jne 0x42b6fe
push 0x52e808
call fcn.00402e20
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.00406710
push ecx
mov ecx, esp
mov dword [ebp - 0x1fc], esp
lea edx, [ebp - 0x18]
push edx
call fcn.0040c170
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x10c]
call fcn.0042acb0
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x134], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x134]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040c570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x138]
call fcn.00406090
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x76c]
call fcn.00447640
movzx ecx, al
test ecx, ecx
je 0x42b6f9
push 4
lea ecx, [ebp - 0x38]
call fcn.00408cf0
push str.MiaosuBroUser_Data
call fcn.00402e20
add esp, 4
push eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.0040c7d0
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x38]
push ecx
call fcn.0040eec0
add esp, 4
push str.MiaosuBro
call fcn.00402e20
add esp, 4
push eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x144]
push eax
call fcn.0040c7d0
add esp, 0xc
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x140]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040c570
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x144]
call fcn.00406090
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00406090
jmp 0x42ba33
mov eax, dword [ebp - 0x10c]
cmp dword [eax + 0x770], 3
jne 0x42b839
push 0x52e858
call fcn.00402e20
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.00406710
push ecx
mov ecx, esp
mov dword [ebp - 0x1f4], esp
lea edx, [ebp - 0x18]
push edx
call fcn.0040c170
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x10c]
call fcn.0042acb0
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x14c], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x14c]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040c570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x150]
call fcn.00406090
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x76c]
call fcn.00447640
movzx ecx, al
test ecx, ecx
je 0x42b834
push 4
lea ecx, [ebp - 0x30]
call fcn.00408cf0
push str.QingYunBroUser_Data
call fcn.00402e20
add esp, 4
push eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.0040c7d0
add esp, 0xc
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x30]
push ecx
call fcn.0040eec0
add esp, 4
push str.QingYunBro
call fcn.00402e20
add esp, 4
push eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x15c]
push eax
call fcn.0040c7d0
add esp, 0xc
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x158], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x158]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040c570
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x15c]
call fcn.00406090
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x30]
call fcn.00406090
jmp 0x42ba33
mov eax, dword [ebp - 0x10c]
cmp dword [eax + 0x770], 4
jne 0x42b91b
push str.ChatBot
call fcn.00402e20
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.00406710
push ecx
mov ecx, esp
mov dword [ebp - 0x1f8], esp
lea edx, [ebp - 0x18]
push edx
call fcn.0040c170
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp - 0x10c]
call fcn.0042acb0
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x164], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040c570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x168]
call fcn.00406090
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x76c]
call fcn.00447640
movzx ecx, al
test ecx, ecx
je 0x42b916
push 4
lea ecx, [ebp - 0x3c]
call fcn.00408cf0
push str.chatbot
call fcn.00402e20
add esp, 4
push eax
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x3c]
push eax
call fcn.0040c7d0
add esp, 0xc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0040eec0
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x3c]
call fcn.00406090
jmp 0x42ba33
push str.Google_Chrome
call fcn.00402e20
add esp, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.00406710
push 0x52e8f0
call fcn.00402e20
add esp, 4
push eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x174]
push eax
call fcn.0040c7d0
add esp, 0xc
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x16c]
mov dword [ebp - 0x170], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x170]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040c570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x174]
call fcn.00406090
push str.chrome.ico
call fcn.00402e20
add esp, 4
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x17c]
push ecx
call fcn.0040c7d0
add esp, 0xc
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
call fcn.004076f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x17c]
call fcn.00406090
push str.Application
call fcn.00402e20
add esp, 4
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c9d0
mov edx, dword [ebp - 0x10c]
mov ecx, dword [edx + 0x76c]
call fcn.00447640
movzx eax, al
test eax, eax
je 0x42ba33
push 4
lea ecx, [ebp - 0x40]
call fcn.00408cf0
push str.Chrome
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040c7d0
add esp, 0xc
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x40]
push eax
call fcn.0040eec0
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
call fcn.00406090
mov ecx, dword [ebp - 0x10c]
cmp dword [ecx + 0x770], 0
je 0x42ba73
mov edx, dword [ebp - 0x10c]
cmp dword [edx + 0x770], 2
je 0x42ba73
mov eax, dword [ebp - 0x10c]
cmp dword [eax + 0x770], 3
je 0x42ba73
mov ecx, dword [ebp - 0x10c]
cmp dword [ecx + 0x770], 4
jne 0x42bbb5
call fcn.00410680
add eax, 0x138
mov ecx, eax
call fcn.00404870
push eax
lea ecx, [ebp - 0x114]
call fcn.0040c1b0
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x10c]
add eax, 0x774
push eax
lea ecx, [ebp - 0x188]
push ecx
call fcn.0040c700
add esp, 0xc
mov dword [ebp - 0x180], eax
mov edx, dword [ebp - 0x180]
mov dword [ebp - 0x184], edx
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x184]
push eax
lea ecx, [ebp - 0x24]
call fcn.0040c570
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x188]
call fcn.00406090
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x114]
call fcn.00406090
push 4
lea ecx, [ebp - 0x44]
call fcn.00408cf0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x194]
push edx
call fcn.0040f130
add esp, 4
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x190], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x190]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.0040c700
add esp, 0xc
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x194]
call fcn.00406090
lea ecx, [ebp - 0x44]
call fcn.004076f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
lea ecx, [ebp - 0x28]
call fcn.00408cf0
lea eax, [ebp - 0x28]
push eax
call fcn.0040d8f0
add esp, 4
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x10c]
add ecx, 0x774
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040c9b0
lea edx, [ebp - 0x28]
push edx
call fcn.0040eec0
add esp, 4
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x28]
call fcn.00406090
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x44]
call fcn.00406090
jmp 0x42bcf4
call fcn.00410680
add eax, 0x138
mov ecx, eax
call fcn.00404870
push eax
lea ecx, [ebp - 0x118]
call fcn.0040c1b0
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x774
push ecx
lea edx, [ebp - 0x1a0]
push edx
call fcn.0040c700
add esp, 0xc
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x19c], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x19c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040c570
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1a0]
call fcn.00406090
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x118]
call fcn.00406090
push 4
lea ecx, [ebp - 0x48]
call fcn.00408cf0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x1ac]
push eax
call fcn.0040f240
add esp, 4
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], ecx
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.0040c700
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1ac]
call fcn.00406090
lea ecx, [ebp - 0x48]
call fcn.004076f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
lea ecx, [ebp - 0x2c]
call fcn.00408cf0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040d8f0
add esp, 4
mov byte [ebp - 4], 0x20
push str.GoogleChrome
call fcn.00402e20
add esp, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c9d0
lea edx, [ebp - 0x2c]
push edx
call fcn.0040eec0
add esp, 4
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x2c]
call fcn.00406090
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x48]
call fcn.00406090
push 4
lea ecx, [ebp - 0x20]
call fcn.00408cf0
push 0x52e96c
lea ecx, [ebp - 0x11c]
call fcn.0040c1b0
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x1b8]
push ecx
call fcn.0040d810
add esp, 4
mov dword [ebp - 0x1d4], eax
mov edx, dword [ebp - 0x1d4]
mov dword [ebp - 0x1b4], edx
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.0040c700
add esp, 0xc
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x1b8]
call fcn.00406090
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x11c]
call fcn.00406090
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x20]
call fcn.0040c9b0
lea ecx, [ebp - 0x20]
call fcn.004076f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42be84
push 0x52e970
lea ecx, [ebp - 0x124]
call fcn.0040c1b0
mov byte [ebp - 4], 0x26
push 0x52e974
lea ecx, [ebp - 0x120]
call fcn.0040c1b0
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x1d0]
push eax
call fcn.0040c700
add esp, 0xc
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x1c0]
push edx
lea eax, [ebp - 0x1cc]
push eax
call fcn.0040c700
add esp, 0xc
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], ecx
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x1c8]
push edx
lea ecx, [ebp - 0x20]
call fcn.0040c570
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1cc]
call fcn.00406090
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1d0]
call fcn.00406090
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x120]
call fcn.00406090
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x124]
call fcn.00406090
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.004076f0
push eax
push 0x52e978
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
mov dword [ebp - 0x1e4], esp
lea eax, [ebp - 0x18]
push eax
call fcn.0040c170
call fcn.0042c200
add esp, 4
push 0x18
call fcn.004f4e76
add esp, 4
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x42beca
mov ecx, dword [ebp - 0x128]
call fcn.004032e0
mov dword [ebp - 0x12c], eax
jmp 0x42bed4
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x110], ecx
push 0x52e994
mov ecx, dword [ebp - 0x110]
call fcn.0040aed0
lea ecx, [ebp - 0x7c]
call fcn.004093c0
movzx edx, al
test edx, edx
je 0x42bf0d
mov eax, dword [ebp - 0x110]
push eax
call fcn.004162e0
jmp 0x42bf36
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1e8], esp
lea ecx, [ebp - 0x7c]
call fcn.00404870
push eax
push esi
call fcn.0040b170
add esp, 8
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.00416760
push ecx
mov ecx, esp
mov dword [ebp - 0x1ec], esp
lea edx, [ebp - 0x14]
push edx
call fcn.0040c170
call fcn.0040e0c0
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.00406090
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4c]
call fcn.00406090
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.00406090
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.00406090
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
call fcn.00406090
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00406090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00403390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00403390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret