Function at 0x4caee0
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ebc78
mov eax, dword fs:[0]
push eax
sub esp, 0xa94
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
call fcn.005824b0
mov ecx, eax
call fcn.00582430
mov edx, dword [edi + 0x3d8]
movzx esi, word [ebp + 0x10]
test edx, edx
je 0x4cb2f2
mov ecx, dword [edi + 0x3dc]
test ecx, ecx
je 0x4cb2f2
mov eax, esi
cmp eax, edx
jb 0x4cb2f2
cmp eax, ecx
ja 0x4cb2f2
cmp eax, dword [edi + 0x420]
jne 0x4caf92
push 1
push 0
push 0
push str.http:__skin.qq.pinyin.cn
push 0x5ff750
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 1
push 0x98
lea ecx, [ebp - 0xa48]
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
jmp 0x4cc13c
cmp eax, dword [edi + 0x428]
jne 0x4cb026
lea eax, [ebp - 0xa4c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa4c]
mov dword [ebp - 4], 0
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa4c]
push 0x10
push 0x604fc0
call fcn.004bdc50
lea ecx, [ebp - 0xa3c]
call fcn.004c2910
push 0xd
push str._focuspage_21
lea ecx, [ebp - 0xa3c]
mov byte [ebp - 4], 1
call fcn.004c0470
push 0
push 1
push dword [ebp - 0xa3c]
push dword [ebp - 0xa4c]
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa3c]
call fcn.004b2a80
lea ecx, [ebp - 0xa4c]
call fcn.004b2a80
jmp 0x4cc13c
push eax
mov ecx, edi
call fcn.004c9eb0
mov ebx, eax
test ebx, ebx
je 0x4cc13c
push 0x62a144
lea ecx, [ebp - 0xa40]
call fcn.004bc730
push 0x62a144
lea ecx, [ebp - 0xa3c]
mov dword [ebp - 4], 2
call fcn.004bc730
mov eax, dword [ebx + 4]
mov ecx, str.10000000_0000_0000_0000_000000000001
mov byte [ebp - 4], 3
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4cb096
test dx, dx
je 0x4cb092
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4cb096
add eax, 4
add ecx, 4
test dx, dx
jne 0x4cb070
xor eax, eax
jmp 0x4cb09b
sbb eax, eax
or eax, 1
lea ecx, [ebp - 0xa40]
test eax, eax
jne 0x4cb0c5
push 0x24
push str.10000000_0000_0000_0000_000000000001
call fcn.004c0470
push 0
push 0x62a144
lea ecx, [ebp - 0xa3c]
call fcn.004c0470
jmp 0x4cb0dd
lea eax, [ebx + 4]
push eax
call fcn.004bfcd0
lea eax, [ebx + 0xc]
push eax
lea ecx, [ebp - 0xa3c]
call fcn.004bfcd0
lea ecx, [ebp - 0xa5c]
mov dword [ebp - 0xa50], 0xffffffff
push ecx
lea ecx, [ebp - 0xa48]
mov dword [ebp - 0xa48], 0xffffffff
push ecx
lea ecx, [ebp - 0xa50]
mov dword [ebp - 0xa5c], 0xffffffff
push ecx
lea ecx, [edi + 0x434]
call fcn.004d3b20
test eax, eax
je 0x4cb2d9
cmp word [ebp - 0xa5c], si
jne 0x4cb2ce
mov eax, dword [ebp - 0xa50]
cmp eax, 2
jne 0x4cb1b0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebp - 0xa58]
push 0x60500c
push eax
call fcn.004c3d40
push 0x605000
push eax
lea eax, [ebp - 0xa60]
mov byte [ebp - 4], 4
push eax
call fcn.004c3c70
add esp, 0x18
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 6
call fcn.004b2a80
push 4
push 0x60501c
push dword [ebp - 0xa60]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4cb1a5
push dword [ebp - 0xa40]
call fcn.004c7400
mov ecx, eax
call fcn.004c6b10
lea ecx, [ebp - 0xa60]
jmp 0x4cb2ae
cmp eax, 4
jne 0x4cb2ce
lea eax, [ebp - 0xa54]
push eax
call fcn.00579160
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 7
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa54]
push 0x10
push 0x604fc0
call fcn.004bdc50
lea ecx, [ebp - 0xa4c]
call fcn.004c2910
push 0xd
push str._focuspage_22
lea ecx, [ebp - 0xa4c]
mov byte [ebp - 4], 8
call fcn.004c0470
mov eax, dword [ebp - 0xa40]
add eax, 0xfffffff0
push eax
call fcn.004bfdc0
add eax, 0x10
add esp, 4
mov dword [ebp - 0xa44], eax
push 0x605044
push 0x605048
lea ecx, [ebp - 0xa44]
mov byte [ebp - 4], 9
call fcn.004cc700
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0xa58]
push 0x60504c
push eax
call fcn.004c3d40
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0xa4c]
mov byte [ebp - 4], 0xa
push dword [eax - 0xc]
push eax
call fcn.004bdc50
lea ecx, [ebp - 0xa58]
call fcn.004b2a80
push 0
push 1
push dword [ebp - 0xa4c]
push dword [ebp - 0xa54]
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa44]
call fcn.004b2a80
lea ecx, [ebp - 0xa4c]
call fcn.004b2a80
lea ecx, [ebp - 0xa54]
call fcn.004b2a80
lea ecx, [ebp - 0xa3c]
call fcn.004b2a80
lea ecx, [ebp - 0xa40]
call fcn.004b2a80
jmp 0x4cc13c
lea ecx, [edi + 0x434]
call fcn.004d2430
push ebx
push ecx
lea eax, [ebp - 0xa40]
mov ecx, esp
push eax
call fcn.004b2f20
mov ecx, edi
call fcn.004c9bd0
jmp 0x4cb2b3
push esi
lea ecx, [edi + 0x434]
call fcn.004d3dc0
test eax, eax
je 0x4cb4a3
mov eax, 0x9c53
cmp ax, si
je 0x4cb382
mov eax, 0x9c55
cmp ax, si
je 0x4cb382
mov eax, 0x9c56
cmp ax, si
je 0x4cb382
mov eax, 0x9c57
cmp ax, si
je 0x4cb382
mov eax, 0x9c52
cmp ax, si
je 0x4cb382
mov eax, 0x9c59
cmp ax, si
je 0x4cb382
mov eax, 0x9c4c
cmp ax, si
je 0x4cb382
mov eax, 0x9c4d
cmp ax, si
je 0x4cb382
mov eax, 0x9c5e
cmp ax, si
je 0x4cb382
mov eax, 0x9c5f
cmp ax, si
je 0x4cb382
mov eax, 0x9c60
cmp ax, si
je 0x4cb382
mov eax, 0x9c64
cmp ax, si
jne 0x4cb4a3
lea eax, [ebp - 0xa48]
mov dword [ebp - 0xa50], 0xffffffff
push eax
lea eax, [ebp - 0xa44]
mov dword [ebp - 0xa44], 0xffffffff
push eax
lea eax, [ebp - 0xa50]
mov dword [ebp - 0xa48], 0xffffffff
push eax
lea ecx, [edi + 0x434]
call fcn.004d3b20
test eax, eax
je 0x4cb4a3
cmp dword [ebp - 0xa50], 8
jne 0x4cb4a3
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0xb
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa3c]
push 0x10
push 0x604fc0
call fcn.004bdc50
call fcn.004bfba0
mov ecx, eax
test ecx, ecx
je 0x4cc15a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa5c], eax
push 0xd
push str._focuspage_61
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 0xc
call fcn.004c0470
mov esi, dword [ebp - 0xa5c]
push 1
push 0
push esi
push dword [ebp - 0xa3c]
push 0x5ff750
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xb
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cb478
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa3c]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4cc13c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4cc13c
movzx ebx, word [ebp + 0x10]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, ebx
mov dword [ebp - 0xa40], ecx
lea eax, [ecx - 0x9c41]
cmp eax, 0x23
ja case.0x4cb4c4.40006
jmp dword [eax*4 + 0x4cc164]
push 1
push 1
call fcn.005824b0
mov ecx, eax
call fcn.00584660
call fcn.005824b0
mov ecx, eax
call fcn.005826d0
jmp 0x4cc0d8
push 1
push 0
jmp 0x4cb4cf
push 1
push 2
jmp 0x4cb4cf
push 1
push 1
call fcn.005824b0
mov ecx, eax
call fcn.00584410
jmp 0x4cc0d8
push 1
push 2
call fcn.005824b0
mov ecx, eax
call fcn.00584410
jmp 0x4cc0d8
push 1
push 0
call fcn.005824b0
mov ecx, eax
call fcn.00584410
jmp 0x4cc0d8
push 0
push 1
push 0
push 0x6006d8
call fcn.004c70b0
add esp, 0x10
jmp 0x4cc0d8
push 0
push 1
push 0
push str.http:__skin.qq.pinyin.cn
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa48]
push 0
push 1
push 0x98
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
jmp 0x4cc0d8
push 0
push 1
push 0
push str.http:__dict.py.qq.com
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa48]
push 0
push 1
push 0x97
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
jmp 0x4cc0d8
push 0
push 1
push 0
push str.http:__100189996.qzone.qq.com_
call fcn.004c70b0
add esp, 0x10
jmp 0x4cc0d8
push 0
push 1
push 0
push str.http:__t.qq.com_QQWubi
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa48]
push 0
push 1
push 0xba
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
jmp 0x4cc0d8
lea eax, [ebp - 0xa48]
push eax
call fcn.00579160
push dword [eax]
mov dword [ebp - 4], 0xd
call fcn.004bd560
add esp, 8
lea ecx, [ebp - 0xa48]
call fcn.004b2a80
push 0
push 0x4bcad0
push 0
push 0x198e
push dword [0x66b0e4]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0xe
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa3c]
push 0xf
push str.QQWubiZiGen.exe
call fcn.004bdc50
push 0
push 1
push 0
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
push 0
push 1
push 0x8b
lea ecx, [ebp - 0xa48]
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
lea ecx, [ebp - 0xa3c]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0058c8f0
lea eax, [ebp - 0xa48]
mov dword [ebp - 0xa5c], 0
push eax
lea eax, [ebp - 0xa50]
mov dword [ebp - 0xa50], 0
push eax
lea eax, [ebp - 0xa5c]
mov dword [ebp - 0xa48], 0
push eax
call fcn.0057b1c0
add esp, 0x18
call fcn.0057b5d0
lea ecx, [ebp - 0xa4c]
mov edi, eax
call fcn.004c2910
lea eax, [ebp - 0xa4c]
mov dword [ebp - 4], 0xf
push eax
push str.svcVersion
push str.SoftwareMicrosoftInternet_Explorer
call fcn.0057c070
mov eax, dword [ebp - 0xa4c]
add esp, 0xc
mov edx, 0x6051a4
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x4cb779
test si, si
je 0x4cb775
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4cb779
add ecx, 4
add edx, 4
test si, si
jne 0x4cb753
xor ecx, ecx
jmp 0x4cb77e
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4cb7a1
lea eax, [ebp - 0xa4c]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
call fcn.0057c070
mov eax, dword [ebp - 0xa4c]
add esp, 0xc
push eax
push 0x6051bc
mov ecx, 0x6051dc
test edi, edi
mov eax, 0x6051d4
cmove eax, ecx
push eax
push dword [ebp - 0xa50]
lea eax, [ebp - 0x21c]
push dword [ebp - 0xa5c]
push str.http:__qq.pinyin.cn_help_feedback.php
push str._s_sv_d._dsd_sv_siev_s
push 0x104
push eax
call fcn.004ba650
add esp, 0x24
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0xa44]
push eax
call fcn.004bc730
push dword [ebp - 0xa44]
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x10
call fcn.004c2730
push dword [eax]
lea ecx, [ebp - 0xa38]
mov byte [ebp - 4], 0x11
call fcn.004c2940
mov edx, dword [ebp - 0xa58]
or eax, 0xffffffff
mov byte [ebp - 4], 0x13
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cb83b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xa24], 0x10
lea eax, [ebp - 0xa38]
push 1
cmovae eax, dword [ebp - 0xa38]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 1
push 0x9c
lea ecx, [ebp - 0xa60]
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
lea ecx, [ebp - 0xa38]
call fcn.004b3140
lea ecx, [ebp - 0xa44]
call fcn.004b2a80
lea ecx, [ebp - 0xa4c]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
push 1
push 0
push 0
push str.http:__pc.qq.com_cgi_bin_jump_oid6000188
push 0x5ff750
push 0
call esi
push 0
push 1
push 0x99
lea ecx, [ebp - 0xa48]
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
jmp 0x4cc0d8
push 1
push 1
call fcn.005824b0
mov ecx, eax
call fcn.005842d0
call fcn.005824b0
mov ecx, eax
call fcn.005826d0
jmp 0x4cc0d8
push 1
push 2
call fcn.005824b0
mov ecx, eax
call fcn.005842d0
call fcn.005824b0
mov ecx, eax
call fcn.005826d0
jmp 0x4cc0d8
push 1
push 3
call fcn.005824b0
mov ecx, eax
call fcn.005842d0
call fcn.005824b0
mov ecx, eax
call fcn.005826d0
jmp 0x4cc0d8
push 1
push 4
call fcn.005824b0
mov ecx, eax
call fcn.005842d0
call fcn.005824b0
mov ecx, eax
call fcn.005826d0
jmp 0x4cc0d8
push 1
push 0
call fcn.005824b0
mov ecx, eax
call fcn.005842d0
call fcn.005824b0
mov ecx, eax
call fcn.005826d0
jmp 0x4cc0d8
push 0
push 0
mov esi, 1
call fcn.005824b0
mov ecx, eax
call fcn.00582430
cmp byte [eax + 0x58], 0
je 0x4cb9aa
cmp byte [eax + 0x59], 0
mov ecx, 3
cmovne esi, ecx
lea ecx, [ebp - 0xa3c]
call fcn.004c2910
push esi
push 3
push 2
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x14
push str._Mode___d__UpdateImeType___u__UpdateDictType___u_
push eax
call fcn.004c7330
lea eax, [ebp - 0xa44]
push eax
call fcn.00579160
lea eax, [ebp - 0xa44]
mov byte [ebp - 4], 0x15
push eax
call fcn.004ce260
push str.QQWBLiveUp.exe
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0xa48]
push eax
call fcn.004c3c70
push 0
push 1
push dword [ebp - 0xa3c]
push dword [eax]
call fcn.004c70b0
add esp, 0x38
lea ecx, [ebp - 0xa48]
call fcn.004b2a80
push 0
call fcn.005acd3f
mov edi, eax
push edi
push str.lastupdatetime
push str.SoftwareTencentQQWubiLiveup
call fcn.0057c520
add esp, 0x10
cmp esi, 3
jne 0x4cba59
push edi
push str.LastDictUpdateTime
push str.SoftwareTencentQQWubiLiveup
call fcn.0057c520
add esp, 0xc
lea ecx, [ebp - 0xa44]
call fcn.004b2a80
lea ecx, [ebp - 0xa3c]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
lea eax, [ebp - 0xa44]
push eax
call fcn.00579160
add esp, 4
push 0x10
push 0x604fc0
lea ecx, [ebp - 0xa44]
mov dword [ebp - 4], 0x16
call fcn.004bdc50
push 0
push 1
push 0
push dword [ebp - 0xa44]
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa48]
push 0
push 1
push 0x8f
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
lea ecx, [ebp - 0xa44]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x17
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa3c]
push 0x12
push str.QQWubiTypeStat.exe
call fcn.004bdc50
push 0
push 1
push 0
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
push 0
push 1
push 0x8e
jmp 0x4cb69e
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x18
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa3c]
push 0x13
push str.QQWBDictManager.exe
call fcn.004bdc50
push 0
push 1
push 0
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
push 0
push 1
push 0x9b
jmp 0x4cb69e
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x19
push eax
call fcn.004ce260
add esp, 8
push 0x11
push str.QQWBCodeQuery.exe
lea ecx, [ebp - 0xa3c]
call fcn.004bdc50
push 0
push 1
push 0
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
push 0
push 1
push 0x89
jmp 0x4cb69e
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x1a
push eax
call fcn.004ce260
add esp, 8
push 0x11
push str.QQPYHandInput.exe
jmp 0x4cbbbc
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x1b
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa3c]
push 0x13
push str.QQWBDictManager.exe
call fcn.004bdc50
push str._ShowMainUI0__ActivePage__1__PageCmd__1_
lea ecx, [ebp - 0xa50]
call fcn.004bc730
push 0
push 1
push dword [ebp - 0xa50]
mov byte [ebp - 4], 0x1c
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa48]
push 0
push 1
push 0x8a
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
lea ecx, [ebp - 0xa50]
call fcn.004b2a80
lea ecx, [ebp - 0xa3c]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x1d
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa3c]
push 0xe
push str.QQWubiFace.exe
call fcn.004bdc50
push 0
push 1
push 0
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
push 0
push 1
push 0x8c
jmp 0x4cb69e
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0x1e
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa3c]
push 0xc
push str.SnapShot.exe
call fcn.004bdc50
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 1
push 0
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
push 0
push 1
push 0x8d
jmp 0x4cb69e
mov ecx, edi
call fcn.004c8410
test eax, eax
je 0x4cc0d8
lea eax, [ebp - 0xa44]
push eax
call fcn.00579160
lea eax, [ebp - 0xa44]
mov dword [ebp - 4], 0x1f
push eax
call fcn.004ce260
add esp, 8
lea ecx, [ebp - 0xa50]
push str.configskinpuncphrase
call fcn.004bc730
lea ecx, [ebp - 0xa4c]
call fcn.004c2910
push 0x10
lea eax, [ebp - 0xa4c]
mov byte [ebp - 4], 0x21
push str.CMD_d_
push eax
call fcn.004c7330
add esp, 0xc
lea ecx, [ebp - 0xa4c]
push 7
push str.Module
call fcn.004bdc50
mov eax, dword [ebp - 0xa50]
lea ecx, [ebp - 0xa4c]
push dword [eax - 0xc]
push eax
call fcn.004bdc50
push 0x3b
lea ecx, [ebp - 0xa4c]
call fcn.004bdbf0
push 0x604fc0
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0xa48]
push eax
call fcn.004c3c70
add esp, 0xc
push 0
push 0
push dword [ebp - 0xa4c]
push dword [eax]
push 0x5ff750
push 0
call esi
lea ecx, [ebp - 0xa48]
call fcn.004b2a80
lea ecx, [ebp - 0xa4c]
call fcn.004b2a80
lea ecx, [ebp - 0xa50]
call fcn.004b2a80
lea ecx, [ebp - 0xa44]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
lea ecx, [ebp - 0xa44]
call fcn.004c2910
push 8
lea eax, [ebp - 0xa44]
mov dword [ebp - 4], 0x22
push str._CMD___d_
push eax
call fcn.004c7330
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0xa3c]
push eax
call fcn.004ce260
add esp, 0x14
lea ecx, [ebp - 0xa3c]
push 0x10
push 0x604fc0
call fcn.004bdc50
push 0
push 0
push dword [ebp - 0xa44]
push dword [ebp - 0xa3c]
call fcn.004c70b0
add esp, 0x10
lea ecx, [ebp - 0xa3c]
call fcn.004b2a80
lea ecx, [ebp - 0xa44]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
lea ecx, [ebp - 0xa44]
call fcn.004c2910
push 9
lea eax, [ebp - 0xa44]
mov dword [ebp - 4], 0x24
push str._CMD___d_
push eax
call fcn.004c7330
lea eax, [ebp - 0xa3c]
push eax
call fcn.00579160
mov byte [ebp - 4], 0x25
jmp 0x4cbe9d
push 0x802
lea eax, [ebp - 0xa20]
push 0
push eax
call fcn.0058c8f0
add esp, 0xc
lea eax, [ebp - 0xa20]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4cc13c
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xa54]
call fcn.004bc730
lea eax, [ebp - 0xa54]
mov dword [ebp - 4], 0x26
push eax
call fcn.004ce260
push str.rundll32.exe
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0xa58]
push eax
call fcn.004c3c70
add esp, 0x10
push str.Shell32.dll_Control_RunDLL
lea ecx, [ebp - 0xa60]
mov byte [ebp - 4], 0x27
call fcn.004bc730
push str.input.dll
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0xa48]
push eax
call fcn.004c3c70
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0xa60]
mov byte [ebp - 4], 0x29
push dword [eax - 0xc]
push eax
call fcn.004bdc50
lea ecx, [ebp - 0xa48]
mov byte [ebp - 4], 0x28
call fcn.004b2a80
mov eax, dword [ebp - 0xa58]
xorps xmm0, xmm0
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xa8c], eax
lea eax, [ebp - 0xaa0]
push eax
movlpd qword [ebp - 0xa98], xmm0
mov dword [ebp - 0xa88], 0
movlpd qword [ebp - 0xa80], xmm0
movlpd qword [ebp - 0xa78], xmm0
movlpd qword [ebp - 0xa70], xmm0
mov dword [ebp - 0xa68], 0
mov dword [ebp - 0xaa0], 0x3c
mov dword [ebp - 0xa9c], 0x40
mov dword [ebp - 0xa84], 8
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4cc083
push dword [ebp - 0xa68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
push 0x9a
lea ecx, [ebp - 0xa64]
call fcn.004bdb20
mov ecx, eax
call fcn.004be8d0
lea ecx, [ebp - 0xa60]
call fcn.004b2a80
lea ecx, [ebp - 0xa58]
call fcn.004b2a80
lea ecx, [ebp - 0xa54]
call fcn.004b2a80
mov ecx, dword [ebp - 0xa40]
jmp case.0x4cb4c4.40006
lea ecx, [edi + 0x20]
call fcn.004d4ed0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, ebx
lea eax, [ebx + 0x635c]
cmp ax, 0x32
ja 0x4cc13c
mov edi, dword [0x66b100]
lea esi, [ecx - 0x9ca4]
mov ecx, dword [0x66b104]
mov eax, 0x66666667
sub ecx, edi
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jge 0x4cc13c
lea esi, [esi + esi*4]
push dword [edi + esi*4 + 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cc13c
mov eax, dword [0x66b100]
push 1
push 0
push 0
push dword [eax + esi*4 + 4]
push 0x5ff750
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004b3510
aaa
mov ch, 76
add byte [ebx + 0x37004cb9], al
mov ch, 0x4c
add byte [ebp + 0x4cb5], dh
mov dh, 0x4c
add dl, bl
ror byte [eax + eax + 0x62], 0xb9
dec esp
add byte [edx + 0x4f004cb5], al
mov ch, 0x4c
add byte [eax - 0x42], ch
dec esp
add bh, dh
mov esi, 0xb4cb004c
dec esp
add ah, ch
mov ah, 0x4c
add dl, dh
mov ah, 0x4c
add dh, bl
mov eax, 0xb941004c
dec esp
add byte [edi - 0x43], ah
dec esp
add byte [edx - 0x46], bh
dec esp
add byte [ebx + 0x14004cbb], dl
mov esp, 0xb64d004c
dec esp
add byte [eax + 0x6004cbc], dh
mov ebp, 0xbae7004c
dec esp
add byte [0xc6004cbb], bh
mov dh, 0x4c
add byte [edx - 0xffb348], ch
mov eax, 0xb920004c
dec esp
add al, bh
mov ah, 0x4c
add byte [edx], ah
mov ch, 0x4c
add byte [0x31004cb5], cl
mov edi, 0xc0c7004c
dec esp
add ch, cl
mov ch, 0x4c
add cl, ch
mov ebx, 0xcccc004c
int3