Function at 0x52c3f0
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Delete file
Delete registry value
Get common file path
Initialize winsock library
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7864
call fcn.00613c30
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.005320f0
test eax, eax
je 0x52c494
call fcn.004bd140
test eax, eax
jne 0x52c494
lea ecx, [ebp - 0x77e4]
call fcn.00413220
push 0x104
push 0x105
lea ecx, [ebp - 0x77e4]
call fcn.0040dc90
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x77e4]
call fcn.004c9de0
push 5
push 0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x77e4]
call fcn.0040d3c0
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x7818], 0
lea ecx, [ebp - 0x77e4]
call fcn.00413870
mov eax, dword [ebp - 0x7818]
jmp 0x52cb43
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0049d070
mov ecx, eax
call fcn.004cc620
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x42c]
call fcn.004219c0
push 0x4a
call fcn.004bec80
add esp, 4
push 0x111
call fcn.004bec80
add esp, 4
mov dword [ebp - 0x784c], 0
mov dword [ebp - 0x7800], 0
mov dword [ebp - 0x77f0], 0
call fcn.00531470
push 0x69c04c
lea ecx, [ebp - 0x474]
call fcn.004219c0
push 1
lea eax, [ebp - 0x474]
push eax
call fcn.0049d070
mov ecx, eax
call fcn.004cc6c0
test eax, eax
jne 0x52c522
mov dword [ebp - 0x77ec], 1
jmp 0x52c52c
mov dword [ebp - 0x77ec], 0
mov cl, byte [ebp - 0x77ec]
mov byte [ebp - 0x77da], cl
lea ecx, [ebp - 0x474]
call fcn.00421c50
movzx edx, byte [ebp - 0x77da]
test edx, edx
je 0x52c577
call fcn.0052d6f0
test eax, eax
je 0x52c577
mov dword [ebp - 0x7814], 0
lea ecx, [ebp - 0x42c]
call fcn.00421c50
mov eax, dword [ebp - 0x7814]
jmp 0x52cb43
mov eax, dword [ebp + 0x10]
push eax
call fcn.00641e0e
add esp, 4
test eax, eax
jne 0x52c591
mov dword [ebp - 0x77f0], 1
call fcn.004becf0
test eax, eax
jne 0x52c69e
call fcn.004becd0
test eax, eax
jne 0x52c69e
push str.UpdateFinish
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x52c69e
mov dword [ebp - 0x77f0], 1
push 0x208
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.0063a460
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
mov byte [ebp - 0x77db], cl
lea ecx, [ebp - 0x77db]
call fcn.00530320
push eax
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [ebp - 0x7838], eax
mov dword [ebp - 0x7834], eax
mov dword [ebp - 0x7830], eax
mov dword [ebp - 0x782c], eax
mov dword [ebp - 0x7828], eax
mov dword [ebp - 0x7824], eax
mov dword [ebp - 0x7820], eax
mov word [ebp - 0x781c], ax
mov dword [ebp - 0x7838], 0
mov dword [ebp - 0x7834], 3
mov ecx, 0x414
mov word [ebp - 0x7828], cx
lea edx, [ebp - 0x414]
mov dword [ebp - 0x7830], edx
mov dword [ebp - 0x782c], 0
mov dword [ebp - 0x781e], 0
lea eax, [ebp - 0x7838]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x7850], eax
mov cx, word [0x69c084]
mov word [ebp - 0x20c], cx
push 0x206
push 0
lea edx, [ebp - 0x20a]
push edx
call fcn.0063a460
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.005b0500
add esp, 4
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.wpskin
mov ecx, 0x708bf4
call fcn.00413a70
push str._ReportWallPaper
lea ecx, [ebp - 0x444]
call fcn.004219c0
push str._StartSkin
lea ecx, [ebp - 0x45c]
call fcn.004219c0
mov dword [ebp - 0x7854], 0xffffffff
push 0
lea edx, [ebp - 0x444]
push edx
lea ecx, [ebp - 0x42c]
call fcn.00528e30
cmp eax, 0xffffffff
je 0x52c76a
mov dword [ebp - 0x7810], 0
lea ecx, [ebp - 0x45c]
call fcn.00421c50
lea ecx, [ebp - 0x444]
call fcn.00421c50
lea ecx, [ebp - 0x42c]
call fcn.00421c50
mov eax, dword [ebp - 0x7810]
jmp 0x52cb43
push 0x114
push 0
lea eax, [ebp - 0x588]
push eax
call fcn.0063a460
add esp, 0xc
mov dword [ebp - 0x588], 0x114
lea ecx, [ebp - 0x588]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x77f8], 0
mov dword [ebp - 0x77f4], 0
xor edx, edx
mov byte [ebp - 0x77dc], dl
push 0
lea ecx, [ebp - 0x77dc]
call fcn.0052fe40
push eax
lea ecx, [ebp - 0x77d9]
call fcn.0052cd00
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00531260
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x6fb03c
call fcn.00531e30
mov dword [ebp - 0x77f4], eax
cmp dword [ebp - 0x77f4], 0
jge 0x52c84e
mov dword [ebp - 0x780c], 0
lea ecx, [ebp - 0x77d9]
call fcn.0052cd60
lea ecx, [ebp - 0x45c]
call fcn.00421c50
lea ecx, [ebp - 0x444]
call fcn.00421c50
lea ecx, [ebp - 0x42c]
call fcn.00421c50
mov eax, dword [ebp - 0x780c]
jmp 0x52cb43
call fcn.0052d900
push 0
push 0x6fb078
push 0x6faa8c
call sub.gdiplus.dll_GdiplusStartup
call fcn.0049d0a0
mov ecx, eax
call fcn.004e9a20
call fcn.00531b00
mov ecx, eax
call fcn.00600540
call fcn.00531b30
mov ecx, eax
call fcn.0055d050
xor ecx, ecx
mov byte [ebp - 0x77dd], cl
lea ecx, [ebp - 0x77dd]
call fcn.00530060
push eax
call fcn.00531ad0
mov ecx, eax
call fcn.0052b8d0
mov dword [ebp - 0x783c], str.http:__ss.shanhutech.cn_bizhi_pidpidmidmidmid2mid2appverappvermodvermodvertypetypeactionaction
mov edx, dword [ebp - 0x783c]
push edx
push str.bizhi
push 0
call fcn.004154a0
mov ecx, eax
call fcn.005f0fe0
call fcn.0042a2c0
call fcn.0058f720
lea ecx, [ebp - 0x77d8]
call fcn.005352f0
lea eax, [ebp - 0x77d8]
mov dword [0x6faa88], eax
call fcn.0055bf10
test eax, eax
je 0x52c90f
mov dword [ebp - 0x7800], 1
lea ecx, [ebp - 0x77d8]
call fcn.0052f540
jmp 0x52c9d0
push 0x6faa90
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x7858], eax
call fcn.004da390
call fcn.0053a840
call fcn.004c9870
mov ecx, eax
call fcn.004ae300
call fcn.004c9840
mov ecx, eax
call fcn.00493e40
call fcn.0048e600
mov ecx, eax
call fcn.0049f2c0
xor ecx, ecx
mov byte [ebp - 0x77de], cl
push str.AutoRun_Interval
lea ecx, [ebp - 0x77de]
call fcn.005302d0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.005b0260
call fcn.004bfb80
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0052daa0
add esp, 8
mov dword [ebp - 0x77f8], eax
call fcn.005b0320
call fcn.0058f5b0
call fcn.0053a890
call fcn.004da3c0
call dword [sym.imp.WS2_32.dll_WSACleanup]
call fcn.0048e600
mov ecx, eax
call fcn.0049f330
lea ecx, [ebp - 0x77d8]
call fcn.0052f540
xor ecx, ecx
jne 0x52c8cc
call fcn.00533c30
call fcn.00531b30
mov ecx, eax
call fcn.0055e050
call fcn.00531b00
mov ecx, eax
call fcn.0040d290
call fcn.0049d0a0
mov ecx, eax
call fcn.004e9a80
call fcn.00531aa0
mov ecx, eax
call fcn.0049b9c0
mov ecx, 0x6fb03c
call fcn.00534400
mov edx, dword [0x6faa8c]
push edx
call sub.gdiplus.dll_GdiplusShutdown
cmp dword [ebp - 0x7800], 0
je 0x52cad9
push 0
push 0x69c1f8
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x77fc], eax
cmp dword [ebp - 0x77fc], 0
je 0x52cad9
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x77e8]
call fcn.004131e0
xor eax, eax
mov dword [ebp - 0x7864], eax
mov dword [ebp - 0x7860], eax
mov dword [ebp - 0x785c], eax
mov dword [ebp - 0x7848], 0x1024
lea ecx, [ebp - 0x77e8]
call fcn.0040dcd0
lea ecx, [eax + eax + 2]
mov dword [ebp - 0x7844], ecx
lea ecx, [ebp - 0x77e8]
call fcn.0040d3c0
mov dword [ebp - 0x7840], eax
mov dword [ebp - 0x7804], 0
lea edx, [ebp - 0x7804]
push edx
push 0x3e8
push 1
lea eax, [ebp - 0x7848]
push eax
push 0
push 0x4a
mov ecx, dword [ebp - 0x77fc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea ecx, [ebp - 0x77e8]
call fcn.00413870
push str.winmain
call fcn.005564a0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x6faa88], 0
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x77f8]
mov dword [ebp - 0x7808], edx
lea ecx, [ebp - 0x77d9]
call fcn.0052cd60
lea ecx, [ebp - 0x45c]
call fcn.00421c50
lea ecx, [ebp - 0x444]
call fcn.00421c50
lea ecx, [ebp - 0x42c]
call fcn.00421c50
mov eax, dword [ebp - 0x7808]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0x10