Function at 0x5517e0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
lea esi, [esp + 0x13]
call fcn.005514c0
mov ebx, dword [ebp + 0x10]
push ebx
push str.kwifi_in:_s
mov ecx, 0x6180b8
call fcn.00435a30
add esp, 8
call fcn.00551090
cmp eax, 1
jne 0x551837
push str.not_admin_restart_kwifi
mov ecx, 0x6180b8
call fcn.00435a30
add esp, 4
call fcn.004357a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, ebx
call fcn.00551680
test eax, eax
je 0x551864
push str.multi_kwifi_exit
mov ecx, 0x6180b8
call fcn.00435a30
add esp, 4
call fcn.004357a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00551220
mov ecx, ebx
call fcn.005513b0
test eax, eax
je 0x551896
push str.app_compat_reset_kwifi
mov ecx, 0x6180b8
call fcn.00435a30
add esp, 4
call fcn.004357a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.KwifiGuard_Mutex_x86
xor ebx, ebx
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp eax, ebx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x5518bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x55190d
xor edi, edi
lea ebx, [esp + 0x20]
call fcn.004125d0
push eax
lea eax, [esp + 0x18]
push eax
mov ebx, str.kwifiguard.exe
call fcn.0041a8a0
add esp, 8
lea ecx, [esp + 0x20]
call fcn.00410000
mov ecx, dword [esp + 0x14]
push ecx
call esi
test eax, eax
je 0x551902
mov edx, dword [esp + 0x14]
push edi
push edi
push edi
push edx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x14]
call fcn.00410000
xor ebx, ebx
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.00551bf0
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
push str.kwifi_start:__s
mov ecx, 0x6180b8
call fcn.00435a30
add esp, 8
call fcn.00551150
lea edx, [esp + 0x28]
push edx
call fcn.00550e20
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x64]
push ecx
mov byte [esp + 0x54], bl
mov dword [esp + 0x58], 1
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call sub.gdiplus.dll_GdiplusStartup
mov byte [esp + 0x48], 1
call fcn.00550c50
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.00554330
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
xor edi, edi
lea ebx, [esp + 0x24]
call fcn.004125d0
push eax
lea edx, [esp + 0x24]
push edx
mov ebx, str.res__
call fcn.0041a8a0
push eax
lea eax, [esp + 0x24]
push eax
mov ebx, str.default.kskin
call fcn.0041a8a0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x551a0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x551a2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor edi, edi
lea ebx, [esp + 0x24]
call fcn.004125d0
push eax
lea ecx, [esp + 0x20]
push ecx
mov ebx, str.knatsrv.dll
call fcn.0041a8a0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x551a68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push ecx
call esi
test eax, eax
je 0x551ba3
mov edx, dword [esp + 0x1c]
push edx
call esi
test eax, eax
je 0x551ba3
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
call fcn.00410660
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x34]
push eax
call fcn.004e1260
test eax, eax
jne 0x551ad9
lea edx, [esp + 0x30]
call fcn.004e1500
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x551abf
call eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x551ad4
mov edx, dword [eax + 0xc]
lea ecx, [eax + 0xc]
mov eax, dword [edx + 0xc]
push 1
call eax
call fcn.005331d0
call fcn.00554170
mov esi, dword [0x619834]
test esi, esi
je 0x551aed
call fcn.005541f0
call fcn.00554240
push str.kwifi_exit
mov ecx, 0x6180b8
call fcn.00435a30
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x551b24
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x551b44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x551b53
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [esp + 0x48], 0
je 0x551b69
mov ecx, dword [esp + 0x5c]
push ecx
call sub.gdiplus.dll_GdiplusShutdown
mov byte [esp + 0x48], 0
lea edx, [esp + 0x28]
push edx
call fcn.00550e90
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x551b93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004357a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x31
push 0x5b25fc
push 0x5b2604
push 0
call esi
cmp eax, 1
jne 0x551ad9
call fcn.0043ad40
test eax, eax
jne 0x551ad9
push 0x10
push 0x5b2630
push 0x5b2638
push eax
call esi
mov esi, str.http:__wifi.liebao.cn
call fcn.0051d060
jmp 0x551ad9