Function at 0x4c6cbc
Capabilities:
Check if file exists
Create directory
Create thread
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x24], ebx
call fcn.004a02eb
push 0
push 0
mov ecx, ebx
call fcn.005c254d
lea ecx, [ebx + 0x3ec]
call fcn.004f432b
cmp dword [0x735a78], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jne 0x4c6d18
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call esi
mov dword [0x735a78], eax
cmp dword [0x735a74], 0
jne 0x4c6d35
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call esi
mov dword [0x735a74], eax
cmp dword [0x735a7c], 0
je 0x4c6d52
push str.NtQuerySystemInformation
push str.ntdll.dll
call edi
push eax
call esi
mov dword [0x735a7c], eax
lea ecx, [ebp - 0x44]
call fcn.00417833
push ecx
push esp
lea ecx, [ebp - 0x44]
call fcn.00418c45
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x44]
call fcn.00419083
lea eax, [ebp - 0x28]
mov ecx, 0x735a80
push eax
call fcn.00418bac
lea ecx, [ebp - 0x5c]
call fcn.00417833
push 1
push ecx
mov ecx, esp
push str.SoftwareRuanMeiMyTime
call fcn.004177e7
push SysReAllocString
lea ecx, [ebp - 0x5c]
call fcn.004f7115
xor edi, edi
push edi
push ecx
mov ecx, esp
push str.pleisure
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.004e6bc5
push edi
push ecx
test eax, eax
mov ecx, esp
push str.pnet
setne byte [0x735a24]
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.004e6bc5
push edi
push ecx
test eax, eax
mov ecx, esp
push str.pmytimeweb
setne byte [0x735a25]
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.004e6bc5
push edi
push ecx
test eax, eax
mov ecx, esp
push str.plapin
setne byte [0x735a26]
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.004e6bc5
push edi
push ecx
test eax, eax
mov ecx, esp
push str.ins_runtip
setne byte [0x735a27]
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.004e6bc5
push edi
push ecx
test eax, eax
mov ecx, esp
push str.ins_upmytime
setne byte [0x735767]
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.004e6bc5
test eax, eax
push ecx
setne byte [0x735766]
mov esi, esp
mov eax, dword [0x735a80]
add eax, 0xfffffff0
push eax
call fcn.00418dea
add eax, 0x10
mov ecx, esp
push str.Install_Dir
mov dword [esi], eax
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.0050857a
mov eax, dword [ebx + 4]
mov ecx, ebx
mov dword [0x735624], eax
call fcn.0048c18c
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [0x735620], eax
mov eax, dword [0x735a84]
cmp dword [eax - 0xc], edi
je 0x4c6ece
mov ecx, dword [0x735a88]
cmp dword [ecx - 0xc], edi
je 0x4c6ece
push eax
call esi
test eax, eax
je 0x4c6ece
push dword [0x735a88]
call esi
test eax, eax
jne 0x4c715f
mov edi, str.mytime.txt
lea eax, [ebp - 0x28]
push edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004227e4
push 0x68b3c0
push dword [eax]
call fcn.0062a5d6
mov ecx, dword [ebp - 0x20]
add esp, 0x14
add ecx, 0xfffffff0
mov esi, eax
call fcn.00419521
test esi, esi
je 0x4c6fd2
push esi
call fcn.0062a2ec
push edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004227e4
add esp, 0x10
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00419521
push ecx
mov ecx, esp
push 0x6bb5b0
call fcn.004177e7
mov edi, dword [ebp - 0x28]
push ecx
add edi, 0xfffffff0
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x20]
push eax
call fcn.0041934b
push eax
mov ecx, 0x735a84
call fcn.00418bac
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00419521
push ecx
mov ecx, esp
push str.plugins
call fcn.004177e7
push ecx
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x20]
push eax
call fcn.0041934b
push eax
mov ecx, 0x735a88
call fcn.00418bac
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00419521
push ecx
mov ecx, esp
push str.users
call fcn.004177e7
push ecx
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
jmp 0x4c705b
push ecx
mov ecx, esp
push str.pcmasterconfigmytime
call fcn.004177e7
push ecx
push esp
lea ecx, [ebp - 0x44]
call fcn.00454cc3
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x44]
call fcn.0041934b
push eax
mov ecx, 0x735a84
call fcn.00418bac
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00419521
push ecx
mov ecx, esp
push str.pcmasterplugins
call fcn.004177e7
push ecx
push esp
lea ecx, [ebp - 0x44]
call fcn.00454cc3
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x44]
call fcn.0041934b
push eax
mov ecx, 0x735a88
call fcn.00418bac
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00419521
push ecx
mov ecx, esp
push str.MyTimeusers
call fcn.004177e7
push ecx
push esp
lea ecx, [ebp - 0x44]
call fcn.00454cc3
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x44]
call fcn.0041934b
push eax
mov ecx, 0x735a8c
call fcn.00418bac
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00419521
mov eax, dword [0x735a84]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
mov ecx, esp
push str.ConfigPathNew
mov dword [esi], eax
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.0050857a
push ecx
mov ecx, esp
mov edi, 0x6809b0
push edi
call fcn.004177e7
push ecx
mov ecx, esp
push str.PluginsPathOld
call fcn.004177e7
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004e6ef3
mov esi, dword [ebp - 0x20]
cmp dword [esi - 0xc], 0
jne 0x4c712b
push ecx
mov ecx, esp
push edi
call fcn.004177e7
push ecx
mov ecx, esp
push str.PluginsPath
call fcn.004177e7
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004e6ef3
mov ebx, dword [ebp - 0x20]
push ecx
add ebx, 0xfffffff0
mov edi, esp
push ebx
call fcn.00418dea
add eax, 0x10
mov ecx, esp
push str.PluginsPathOld
mov dword [edi], eax
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.0050857a
mov ecx, ebx
call fcn.00419521
mov ebx, dword [ebp - 0x24]
mov eax, dword [0x735a88]
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
call fcn.00418dea
add eax, 0x10
mov ecx, esp
push str.PluginsPath
mov dword [edi], eax
call fcn.004177e7
lea ecx, [ebp - 0x5c]
call fcn.0050857a
lea ecx, [esi - 0x10]
call fcn.00419521
xor edi, edi
lea ecx, [ebp - 0x5c]
call fcn.00418dd0
push ecx
mov ecx, esp
push str.sound
call fcn.004177e7
mov eax, dword [0x735a88]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041934b
push ecx
mov ecx, esp
push str.weathericon
call fcn.004177e7
mov eax, dword [0x735a88]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x20]
push eax
call fcn.0041934b
push ecx
mov ecx, esp
push str.pcmasterupgrade
call fcn.004177e7
push ecx
push esp
lea ecx, [ebp - 0x44]
call fcn.00454cc3
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x44]
call fcn.0041934b
push eax
mov ecx, 0x735a90
call fcn.00418bac
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
push dword [0x735a84]
push edi
call esi
push edi
push dword [0x735a88]
push edi
call esi
push edi
push dword [0x735a8c]
push edi
call esi
push edi
push dword [0x735a90]
push edi
call esi
push edi
mov edi, dword [ebp - 0x2c]
push edi
push 0
call esi
push 0
push dword [ebp - 0x20]
push 0
call esi
mov ecx, ebx
call fcn.004e8214
mov eax, dword [0x735a88]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
mov dword [esi], eax
mov esi, 0x735e00
pop ecx
mov ecx, esi
call fcn.004f52c8
mov ecx, esi
call fcn.004602e9
mov ecx, ebx
call fcn.00457923
mov ecx, ebx
call fcn.00458aeb
mov ecx, dword [0x736914]
call fcn.004affb9
mov ecx, ebx
call fcn.004b0697
mov ecx, ebx
call fcn.0049c2a5
mov ecx, ebx
call fcn.0049d754
mov ecx, ebx
call fcn.004a7083
lea ecx, [ebx + 0x2c0]
call fcn.004a16c7
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebx + 0x3ec]
call fcn.004726be
push 0
push str._PCMaster6
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4c72e7
push 1
push 2
push 0x709
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x3e8
push 0x1f7
push dword [ebx + 4]
call esi
imul eax, dword [0x735fd4], 0x3e8
mov ecx, 0x1b7740
cmp eax, ecx
jb 0x4c7318
cmp eax, 0x5265c00
jbe 0x4c731a
mov eax, ecx
push 0
push eax
push 0x1ff
push dword [ebx + 4]
call esi
push 0
push 0x2710
push 0x203
push dword [ebx + 4]
call esi
push 0
push 0x1b7740
push 0x209
push dword [ebx + 4]
call esi
mov eax, dword [0x735a70]
cmp eax, 1
jne 0x4c735c
push 0
push 0x7530
jmp 0x4c7392
cmp eax, 2
jne 0x4c736a
push 0
push 0x36ee80
jmp 0x4c7392
cmp eax, 3
jne 0x4c7378
push 0
push 0x6ddd00
jmp 0x4c7392
cmp eax, 4
jne 0x4c7386
push 0
push 0xdbba00
jmp 0x4c7392
cmp eax, 0xc
jne 0x4c739c
push 0
push 0x2932e00
push 0x20a
push dword [ebx + 4]
call esi
push 0
push 0
push 0x4f0426
call fcn.006423a8
add esp, 0xc
lea ecx, [ebx + 0x364]
call fcn.004a6de6
cmp byte [ebx + 0x4d8], 0
jne 0x4c74fb
call fcn.00418f81
push eax
lea ecx, [ebp - 0x24]
call fcn.0041775d
push 0x105
lea ecx, [ebp - 0x24]
call fcn.0041948e
push 0x105
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.00419584
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x74]
call fcn.00417833
push 1
push ecx
mov ecx, esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004177e7
push SysReAllocString
lea ecx, [ebp - 0x74]
call fcn.004f7115
push ecx
mov ecx, esp
push str.MagicTray
call fcn.004177e7
lea ecx, [ebp - 0x74]
call fcn.00461d4b
mov eax, dword [ebp - 0x24]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x2c], eax
call fcn.00418dea
add eax, 0x10
mov ecx, esp
push str.mytime
mov dword [esi], eax
call fcn.004177e7
lea ecx, [ebp - 0x74]
call fcn.0050857a
lea ecx, [ebp - 0x1c]
mov byte [0x735a64], 1
call fcn.00417833
push 1
push ecx
mov ecx, esp
push str.SoftwareRuanMeiPCMaster
call fcn.004177e7
push SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.004f7115
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov esi, str.appstart
push esi
call fcn.004177e7
lea ecx, [ebp - 0x1c]
call fcn.004e6c3f
cmp byte [0x735a64], 0
je 0x4c74b2
or eax, 1
jmp 0x4c74b5
and eax, 0xfffffffe
push eax
push ecx
mov ecx, esp
push esi
call fcn.004177e7
lea ecx, [ebp - 0x1c]
call fcn.0050848c
lea ecx, [ebp - 0x1c]
call fcn.00418dd0
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x74]
call fcn.00418dd0
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x2c]
call fcn.00419521
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x4b54c1
push 0xe
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0
push 0x2710
push 0x20c
mov dword [0x736778], eax
push dword [ebx + 4]
call esi
push 0
push 0xa4cb80
push 0x20d
push dword [ebx + 4]
call esi
push 0
push 0x1770
push 0x20f
push dword [ebx + 4]
call esi
push 0
push 0x7d0
push 0x215
push dword [ebx + 4]
call esi
lea ecx, [ebx + 0x2c0]
call fcn.0047b303
push 0
push 0x3e8
push 0x210
push dword [ebx + 4]
call esi
imul eax, dword [0x735fd8], 0x3e8
mov ecx, 0x493e0
cmp eax, ecx
jb 0x4c7592
cmp eax, 0x5265c00
jbe 0x4c7594
mov eax, ecx
push 0
push eax
push 0x20e
push dword [ebx + 4]
call esi
push ebx
xor esi, esi
push esi
push 0x4800d1
call fcn.006423a8
push ebx
push esi
push 0x47cd30
call fcn.006423a8
push esi
push esi
push 0x480648
call fcn.006423a8
add esp, 0x24
mov ecx, ebx
call fcn.00502311
push ecx
mov ecx, esp
push str.countdown.xml
call fcn.004177e7
mov eax, dword [0x735a84]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041934b
mov esi, dword [ebp - 0x2c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c7668
push 0x340
call fcn.00609934
pop ecx
test eax, eax
je 0x4c762c
mov ecx, eax
call fcn.00440f23
mov dword [ebp - 0x24], eax
xor edx, edx
jmp 0x4c7633
xor edx, edx
mov eax, edx
mov dword [ebp - 0x24], edx
test eax, eax
je 0x4c7653
push edx
mov ecx, SysReAllocString
push ecx
push ecx
push edx
push edx
push edx
push ecx
push 0x6bb6fc
push edx
mov ecx, eax
call fcn.005c122f
mov eax, dword [ebp - 0x24]
push 0
push 0
mov ecx, eax
call fcn.005c254d
mov ecx, dword [ebp - 0x24]
push 0
call fcn.005c105a
push 0
push 0
push 0x540
mov ecx, ebx
call fcn.005c1d01
lea ecx, [esi - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [edi - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x5c]
call fcn.00418dd0
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x44]
call fcn.00418dd0
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret