Function at 0x4a5129
Capabilities:
Create process on windows
Get common file path
Get program files directory
Get startup folder

Disassembly:
push 0x22c
mov eax, 0x52fdf3
call fcn.004f1db2
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0x44]
jne 0x4a5156
lea ecx, [edi - 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
call fcn.00460614
jmp 0x4a5573
cmp eax, dword [edi + 0x48]
jne 0x4a5171
call fcn.0049bf4b
mov ecx, eax
call fcn.0049bc99
lea ecx, [edi - 0x3c]
mov eax, dword [ecx]
jmp 0x4a5405
mov ecx, dword [edi + 0x174]
cmp eax, ecx
jne 0x4a5188
lea ecx, [edi - 0x3c]
call fcn.004a5640
jmp 0x4a5573
cmp eax, dword [edi + 0x180]
je 0x4a556e
mov ecx, dword [edi + 0x1e8]
cmp eax, ecx
je 0x4a5548
cmp eax, dword [edi + 0x1e4]
je 0x4a5548
cmp eax, dword [edi + 0x184]
jne 0x4a5277
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4a520e
lea eax, [ebp - 0x218]
push eax
call fcn.00416680
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00417b50
mov esi, str.Internet_Exploreriexplore.exe
push esi
call fcn.00416680
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00418190
push str.https:__www.ijinshan.com_privacy_liebaocnLicense.html
lea ecx, [ebp - 0x234]
call fcn.0043c206
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push ebx
push dword [ebp - 0x234]
push eax
push 0x55b570
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push ebx
push 1
jmp 0x4a533d
cmp eax, dword [edi + 0x18c]
jne 0x4a534d
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
xor edi, edi
push eax
push ebx
push ebx
push 0x26
inc edi
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4a52da
lea eax, [ebp - 0x218]
push eax
call fcn.00416680
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00417b50
mov esi, str.Internet_Exploreriexplore.exe
push esi
call fcn.00416680
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00418190
push str.https:__www.ijinshan.com_privacy_liebaoprivate.html
lea ecx, [ebp - 0x234]
call fcn.0043c206
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push ebx
push dword [ebp - 0x234]
push eax
push 0x55b570
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push ebx
push edi
lea ecx, [ebp - 0x230]
call fcn.00417d20
jmp 0x4a5573
mov ecx, dword [edi + 0x190]
cmp eax, ecx
je 0x4a54e3
cmp eax, dword [edi + 0x194]
je 0x4a54e3
cmp eax, dword [edi + 0x1d0]
je 0x4a5492
cmp eax, dword [edi + 0x1cc]
je 0x4a5492
mov ecx, dword [edi + 0x1d8]
cmp eax, ecx
je 0x4a5461
cmp eax, dword [edi + 0x1d4]
je 0x4a545d
mov ecx, dword [edi + 0x1e0]
cmp eax, ecx
je 0x4a542c
cmp eax, dword [edi + 0x1dc]
je 0x4a5428
cmp dword [edi + 0x178], 0
je 0x4a5573
add edi, 0xffffffc4
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 8]
mov ecx, eax
call fcn.00460406
push eax
lea ecx, [ebp - 0x238]
call fcn.0049ffde
lea ecx, [ebp - 0x238]
call fcn.004a0743
cmp dword [ebp - 0x234], 3
jne 0x4a5414
push 0x559c78
push 0x17
push 0x1a0a
call fcn.004dab8e
mov eax, dword [edi]
add esp, 0xc
mov ecx, edi
call dword [eax + 8]
mov ecx, eax
call fcn.00460623
jmp 0x4a5573
cmp dword [ebp - 0x234], 2
jne 0x4a5573
mov ecx, edi
jmp 0x4a517e
cmp eax, ecx
jne 0x4a5447
mov ecx, dword [edi + 0x1dc]
cmp byte [ecx + 0x40], 0
sete al
mov byte [ecx + 0x40], al
mov ecx, dword [edi + 0x1dc]
call fcn.004627f1
call fcn.0049bf4b
mov ecx, dword [edi + 0x1dc]
mov cl, byte [ecx + 0x40]
mov byte [eax + 9], cl
jmp 0x4a5573
cmp eax, ecx
jne 0x4a547c
mov ecx, dword [edi + 0x1d4]
cmp byte [ecx + 0x40], 0
sete al
mov byte [ecx + 0x40], al
mov ecx, dword [edi + 0x1d4]
call fcn.004627f1
call fcn.0049bf4b
mov ecx, dword [edi + 0x1d4]
mov cl, byte [ecx + 0x40]
mov byte [eax + 8], cl
jmp 0x4a5573
call fcn.0049bf4b
mov ebx, eax
mov ecx, ebx
call fcn.0049bf8f
test al, al
jne 0x4a5573
lea ecx, [edi - 0x3c]
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, eax
call fcn.00460406
push eax
mov ecx, ebx
call fcn.0049c213
mov eax, dword [edi + 0x1cc]
mov ecx, ebx
mov esi, dword [eax]
call fcn.0049bf47
mov ecx, dword [edi + 0x1cc]
push eax
call dword [esi + 0x40]
mov ecx, dword [edi + 0x1cc]
jmp 0x4a556e
cmp byte [edi + 0x1a0], 0
push 1
sete al
mov byte [edi + 0x1a0], al
test al, al
je 0x4a5500
push 0x9c51
jmp 0x4a5505
push 0x9c50
call fcn.0046374f
mov ecx, dword [edi + 0x190]
xor eax, eax
cmp byte [edi + 0x1a0], al
sete al
add eax, 0xe
push eax
push 0x24e
call fcn.0046272f
mov eax, dword [edi + 0x190]
lea ecx, [edi - 0x3c]
xor ebx, ebx
push ebx
mov byte [eax + 5], bl
mov eax, dword [edi + 0x194]
mov byte [eax + 5], bl
call fcn.004a585a
jmp 0x4a5573
test ecx, ecx
jne 0x4a5554
cmp dword [edi + 0x1e4], ecx
je 0x4a5573
cmp eax, ecx
jne 0x4a5568
mov edx, dword [edi + 0x1e4]
cmp byte [edx + 0x40], 0
sete al
mov byte [edx + 0x40], al
mov ecx, dword [edi + 0x1e4]
call fcn.004627f1
call fcn.004f1d61
ret 4