Function at 0x46b460
Capabilities:
Check if file exists
Enumerate processes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8c10
mov eax, dword fs:[0]
push eax
mov eax, 0x1410
call fcn.00477a70
mov eax, dword [0x4f9340]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x1240]
push eax
call fcn.0043fc3e
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [eax]
mov esi, 0x4c2e94
push esi
push eax
call fcn.00477047
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1240]
add ecx, 0xfffffff0
call fcn.00409a10
inc bl
je 0x46b511
lea ecx, [ebp - 0x141c]
call fcn.0046182a
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x141c]
call fcn.0044be5d
lea ecx, [ebp - 0x141c]
call fcn.0046526d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x141c]
call fcn.0046193c
jmp 0x46b658
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x1240]
push eax
call fcn.0043fc3e
mov dword [ebp - 4], 3
mov eax, dword [eax]
push 0x4c9c38
push eax
call fcn.00477047
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1240]
add ecx, 0xfffffff0
call fcn.00409a10
inc bl
je 0x46b658
push edi
push 2
mov dword [ebp - 0x1240], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x123c]
push eax
push edi
mov dword [ebp - 0x123c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push 0x4f930c
lea ecx, [ebp - 0x1244]
mov ebx, eax
call fcn.0040a6cc
mov dword [ebp - 4], 6
test ebx, ebx
je 0x46b602
lea eax, [ebp - 0x1218]
push eax
call fcn.00413682
pop ecx
push eax
lea eax, [ebp - 0x1218]
push eax
lea ecx, [ebp - 0x1244]
call fcn.0040a8e3
push 0x4ca740
lea ecx, [ebp - 0x1244]
call fcn.004286e1
test eax, eax
je 0x46b5f8
push 0x4ca71c
lea ecx, [ebp - 0x1244]
call fcn.004286e1
test eax, eax
je 0x46b5f8
lea eax, [ebp - 0x123c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x46b59d
jmp 0x46b602
mov dword [ebp - 0x1240], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1240], 0
jne 0x46b646
lea ecx, [ebp - 0x141c]
call fcn.0046182a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x141c]
call fcn.0044be5d
lea ecx, [ebp - 0x141c]
call fcn.0046526d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x141c]
call fcn.0046193c
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1244]
add ecx, 0xfffffff0
call fcn.00409a10
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x1240]
push eax
call fcn.0043fd3a
mov dword [ebp - 4], 9
mov eax, dword [eax]
push esi
push eax
call fcn.00477047
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1240]
add ecx, 0xfffffff0
call fcn.00409a10
inc bl
je 0x46bc01
lea ecx, [ebp - 0x1268]
call fcn.0042d1df
mov dword [ebp - 4], 0xb
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x124c], esp
push str.SoftwareBaiduHao123hao123desk
call fcn.00418464
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1268]
call fcn.00431279
mov esi, 0x4c2d20
test eax, eax
je 0x46ba7b
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x1244]
push eax
call fcn.0043fc92
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x124c], esp
push esi
call fcn.00418464
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x1240], esp
mov edi, str.BaiduTn
push edi
call fcn.00418464
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x1248]
push eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1268]
call fcn.00432ae1
mov byte [ebp - 4], 0x10
push dword [ebp - 0x1244]
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46b7b6
push str.12092018_18_hao_pg
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46b7b6
push 0x4c2e98
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46b7b6
push ecx
lea eax, [ebp - 0x1244]
mov ecx, esp
mov dword [ebp - 0x124c], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x1240], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1268]
call fcn.0042d445
push ecx
mov ecx, esp
mov dword [ebp - 0x124c], esp
push esi
call fcn.00418464
mov byte [ebp - 4], 0x13
push ecx
mov ecx, esp
mov dword [ebp - 0x1250], esp
mov edi, str.TnFromIEHomePage
push edi
call fcn.00418464
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x1240]
push eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1268]
call fcn.00432ae1
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x1248]
call fcn.0040aac8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1240]
add ecx, 0xfffffff0
call fcn.00409a10
push dword [ebp - 0x1244]
lea ecx, [ebp - 0x1248]
call fcn.004286e1
mov ebx, 0x4caad4
test eax, eax
je 0x46b909
push str.tn12092018_18_hao_pg
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46b909
push str.tn12092018_15_hao_pg
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46b909
mov eax, dword [ebp - 0x1244]
add eax, 0xfffffff0
push eax
call fcn.0040a753
add eax, 0x10
mov dword [ebp - 0x1240], eax
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x1240]
push eax
lea eax, [ebp - 0x124c]
push ebx
push eax
call fcn.0042f71d
add esp, 0x10
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x1240]
call fcn.0040aac8
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x124c]
add ecx, 0xfffffff0
call fcn.00409a10
push ecx
lea eax, [ebp - 0x1240]
mov ecx, esp
mov dword [ebp - 0x1250], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, esp
mov dword [ebp - 0x124c], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1268]
call fcn.0042d445
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1240]
add ecx, 0xfffffff0
call fcn.00409a10
push ecx
mov ecx, esp
mov dword [ebp - 0x1250], esp
push esi
call fcn.00418464
mov byte [ebp - 4], 0x1e
push ecx
mov ecx, esp
mov dword [ebp - 0x1240], esp
mov edi, str.NewBaiduTn
push edi
call fcn.00418464
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x124c]
push eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1268]
call fcn.00432ae1
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x1248]
call fcn.0040aac8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x124c]
add ecx, 0xfffffff0
call fcn.00409a10
push dword [ebp - 0x1244]
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46ba57
push str.tn12092018_18_hao_pg
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46ba57
push str.tn12092018_15_hao_pg
lea ecx, [ebp - 0x1248]
call fcn.004286e1
test eax, eax
je 0x46ba57
mov eax, dword [ebp - 0x1244]
add eax, 0xfffffff0
push eax
call fcn.0040a753
add eax, 0x10
mov dword [ebp - 0x1240], eax
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x1240]
push eax
lea eax, [ebp - 0x124c]
push ebx
push eax
call fcn.0042f71d
add esp, 0x10
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x1240]
call fcn.0040aac8
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x124c]
add ecx, 0xfffffff0
call fcn.00409a10
push ecx
lea eax, [ebp - 0x1240]
mov ecx, esp
mov dword [ebp - 0x1250], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x26
push ecx
mov ecx, esp
mov dword [ebp - 0x124c], esp
push edi
call fcn.00418464
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x1268]
call fcn.0042d445
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1240]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x1248]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1244]
add ecx, 0xfffffff0
call fcn.00409a10
call fcn.004342da
cmp eax, 0x17
jl 0x46bbf2
lea ecx, [ebp - 0x1280]
call fcn.0042d1df
mov byte [ebp - 4], 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0x1250], esp
push str._AppData_MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBarhao123
call fcn.00418464
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x1244]
push eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1284]
call fcn.0044aba1
mov byte [ebp - 4], 0x2e
push dword [ebp - 0x1244]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46bbd1
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x100e]
push eax
call fcn.00473120
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push dword [ebp - 0x1244]
lea eax, [ebp - 0x1010]
push 0x800
push eax
push esi
push 0x4c5674
mov ebx, 0x4c5650
push ebx
call edi
mov ecx, dword [0x4fb330]
lea eax, [ebp - 0x1240]
push eax
call fcn.0043fce6
mov byte [ebp - 4], 0x2f
push dword [ebp - 0x1240]
lea eax, [ebp - 0x1010]
push eax
call fcn.00477047
pop ecx
pop ecx
test eax, eax
je 0x46bbbf
push dword [ebp - 0x1244]
push dword [ebp - 0x1240]
push 0x4c5674
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call ebx
push dword [ebp - 0x1244]
xor eax, eax
push 0x800
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x1010]
push eax
push esi
push str.Prop6
mov esi, str.A7AF692E_098D_4C08_A225_D433CA835ED0
push esi
call edi
lea eax, [ebp - 0x1010]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x46bb9b
sub eax, ecx
sar eax, 1
jne 0x46bbbf
push dword [ebp - 0x1244]
push 0x4ca93c
push str.Prop6
push esi
call ebx
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x1240]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x1244]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1280]
call fcn.0042d237
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1268]
call fcn.0042d237
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00473108
leave
ret