Function at 0x46f170
Capabilities:
Check if file exists
Create process on windows
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x476df8
push eax
mov dword fs:[0], esp
sub esp, 0x4d4
cmp dword [0x4a388c], 2
jg 0x46fbf7
mov eax, dword [0x4aca40]
test al, 1
jne 0x46f1e4
or eax, 1
mov dword [0x4aca40], eax
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f1c8
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
push 0x478eb0
mov dword [0x4aca3c], eax
call fcn.0044cc93
add esp, 4
push 0x100000
call fcn.0042935e
add esp, 4
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x290]
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xff
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.chenfeng_pc
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x46f23b
push 0x479cd0
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov word [ebp + eax*2 - 0x290], cx
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f264
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f294
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f2c1
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 2
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f2ee
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f31b
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 4
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f348
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 5
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f375
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 6
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f3a2
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 7
call fcn.0046d890
add esp, 0x20
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f3f7
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f424
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 9
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f451
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0xa
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f47e
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xb
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f4ab
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push 3
push 0x48f2d4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.00408f60
cmp dword [0x4aca64], 0
je 0x46f4e5
push 5
push str.baidu
lea ecx, [ebp - 0x18]
call fcn.00408f60
jmp 0x46f4fb
cmp dword [0x4aca60], 0
je 0x46f4fb
push 0x48f2dc
lea ecx, [ebp - 0x18]
call fcn.00401f00
cmp dword [0x4aca24], 0
je 0x46f513
push 3
push 0x48f2e4
lea ecx, [ebp - 0x18]
call fcn.00402570
push 8
push str.onlinetv
lea ecx, [ebp - 0x24]
call fcn.00408f60
cmp dword [0x4aca50], 0
je 0x46f53c
push 5
push str.baidu
lea ecx, [ebp - 0x24]
call fcn.00408f60
jmp 0x46f552
cmp dword [0x4aca68], 0
je 0x46f552
push 0x48f2dc
lea ecx, [ebp - 0x24]
call fcn.00401f00
cmp dword [0x4aca28], 0
je 0x46f56a
push 3
push 0x48f2e4
lea ecx, [ebp - 0x24]
call fcn.00402570
push 6
push str.youdao
lea ecx, [ebp - 0x10]
call fcn.00408f60
cmp dword [0x4aca54], 0
je 0x46f593
push 5
push str.baidu
lea ecx, [ebp - 0x10]
call fcn.00408f60
jmp 0x46f5a9
cmp dword [0x4aca6c], 0
je 0x46f5a9
push 0x48f2dc
lea ecx, [ebp - 0x10]
call fcn.00401f00
cmp dword [0x4aca2c], 0
je 0x46f5c1
push 3
push 0x48f2e4
lea ecx, [ebp - 0x10]
call fcn.00402570
push 6
push str.wiseie
lea ecx, [ebp - 0x2c]
call fcn.00408f60
cmp dword [0x4aca58], 0
je 0x46f5ea
push 5
push str.baidu
lea ecx, [ebp - 0x10]
call fcn.00408f60
jmp 0x46f600
cmp dword [0x4aca74], 0
je 0x46f600
push 0x48f2dc
lea ecx, [ebp - 0x2c]
call fcn.00401f00
cmp dword [0x4a95f0], 0
je 0x46f618
push 3
push 0x48f2e4
lea ecx, [ebp - 0x2c]
call fcn.00402570
push 4
push str.duba
lea ecx, [ebp - 0x20]
call fcn.00408f60
cmp dword [0x4aca5c], 0
je 0x46f641
push 5
push str.baidu
lea ecx, [ebp - 0x20]
call fcn.00408f60
jmp 0x46f657
cmp dword [0x4aca70], 0
je 0x46f657
push 0x48f2dc
lea ecx, [ebp - 0x20]
call fcn.00401f00
cmp dword [0x4aca30], 0
je 0x46f66f
push 3
push 0x48f2e4
lea ecx, [ebp - 0x20]
call fcn.00402570
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f68b
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x48], eax
push 1
push 0x47dac0
push 0
lea eax, [ebp - 0x48]
push eax
push str.qq8skintool_zol.txt
mov byte [ebp - 4], 0xd
call fcn.00466df0
add esp, 0x14
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f6d2
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
push ebx
push esi
push edi
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x1c], edi
cmp dword [0x4a388c], 1
mov byte [ebp - 4], 0xe
jne 0x46fc05
call fcn.00429930
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f70f
push 0x80004005
call fcn.00402670
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x68]
push 2
push eax
mov byte [ebp - 4], 0xf
call fcn.004675d0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp dword [eax], 0
jne 0x46f767
movzx eax, word [ebp - 0x5e]
push eax
movzx eax, word [ebp - 0x60]
push eax
movzx eax, word [ebp - 0x62]
push eax
movzx eax, word [ebp - 0x66]
push eax
movzx eax, word [ebp - 0x68]
push eax
lea eax, [ebp - 0x14]
push str.12.18_new_user:_4d._02d._02d__02d:_02d
push eax
call fcn.00405230
add esp, 0x1c
jmp 0x46f847
lea eax, [ebp - 0x4e0]
push eax
push 0
push 0x479cd0
call fcn.004651e0
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x5e]
push eax
movzx eax, word [ebp - 0x60]
push eax
movzx eax, word [ebp - 0x62]
push eax
movzx eax, word [ebp - 0x66]
push eax
movzx eax, word [ebp - 0x68]
push eax
movzx eax, word [ebp - 0x6e]
push eax
movzx eax, word [ebp - 0x70]
push eax
movzx eax, word [ebp - 0x72]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
lea eax, [ebp - 0x14]
push str.12.18_old_user:_4d._02d._02d__02d:_02d__4d._02d._02d__02d:_02d
push eax
call fcn.00405230
add esp, 0x30
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x78]
movzx ecx, word [ebp - 0x76]
imul edx, edx, 0x16d
mov eax, ecx
shl eax, 4
sub eax, ecx
movzx ecx, word [ebp - 0x8e]
lea esi, [edx + eax*2]
movzx edx, word [ebp - 0x90]
movzx eax, word [ebp - 0x72]
imul edx, edx, 0x16d
add esi, eax
mov eax, ecx
shl eax, 4
sub eax, ecx
lea ecx, [edx + eax*2]
movzx eax, word [ebp - 0x8a]
add ecx, eax
sub ecx, esi
mov dword [0x4aca44], ecx
push dword [ebp - 0x28]
mov ebx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x14]
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push esi
push str.__s_:___s:_s:_s:_s:_s:_s:_s
push 0x4aca3c
call fcn.00405230
add esi, 0xfffffff0
add esp, 0x28
mov byte [ebp - 4], 0xe
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46f891
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x28]
cmp dword [0x4a388c], 2
jne 0x46fa08
cmp dword [0x4aca24], 0
jne 0x46f8c5
mov eax, dword [0x4aca30]
add eax, dword [0x4a95f0]
add eax, dword [0x4aca2c]
add eax, dword [0x4aca28]
test eax, eax
jle 0x46f8d2
push 0x4a81f0
call fcn.0046e660
add esp, 4
cmp dword [0x4aca44], 1
jle 0x46f8f0
push str.countold.php
push str.count.php
lea ecx, [ebp - 0x1c]
call fcn.00408880
mov edi, dword [ebp - 0x1c]
push 0x4a81f0
call fcn.004653d0
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x46f98b
push eax
push str.noad.ini
call fcn.00469a30
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46f98b
push eax
push str.noad.ini
call fcn.004651e0
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46f98b
cmp dword [0x4a81e0], eax
jne 0x46f98b
cmp dword [ebp + 0x2c], eax
jne 0x46f98b
cmp dword [0x4aca44], 2
jle 0x46f98b
push 0x48f538
lea ecx, [ebp - 0x14]
call fcn.004016a0
push 1
push 0x48dd48
push dword [ebp - 0x14]
mov byte [ebp - 4], 0x10
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x46f97f
call fcn.0046f090
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xe
call fcn.00419ae0
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x4c]
push edi
call fcn.00465740
add esp, 0xc
test eax, eax
je 0x46f9c4
push str.http:__www.cfxy.me
push str.http:__soft.cfxy.me
lea ecx, [ebp - 0x1c]
call fcn.00408880
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x4c]
push edi
call fcn.00465740
add esp, 0xc
cmp dword [0x4a81e0], 0
jne 0x46fa08
cmp dword [ebp + 0x2c], 0
jne 0x46fa08
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x46fa08
push 1
push 0x48f608
push 0x48f648
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x46fa08
push eax
push 0
push 0
push str.http:__bbs.cfxy.me
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x4c]
inc dword [0x4a388c]
call fcn.00429353
lea edx, [edi - 0x10]
or edi, 0xffffffff
add esp, 4
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fa39
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fa59
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xb
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fa79
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xa
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fa99
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fab9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 8
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fad9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46faf9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 6
lea eax, [ebx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fb16
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fb33
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fb53
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fb73
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fb93
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fbb3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46fbd3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
pop edi
pop esi
pop ebx
jg 0x46fbf7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x50]
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x44]
push esi
push ebx
push dword [ebp - 0x30]
mov eax, dword [ebp + 0x28]
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push dword [0x4aca3c]
push dword [eax]
lea eax, [ebp - 0x290]
push dword [ebp - 0x48]
push eax
lea eax, [ebp - 0x1c]
push str.http:__soft.cfxy.me_count.php_product_s_ssource___s__s___s__s__s__s__s_:___s:_s:_s:_s:_s:_s:_s:_s
push eax
call fcn.00405230
mov edi, dword [ebp - 0x1c]
add esp, 0x4c
jmp 0x46f894