Function at 0x4ef9b3
Capabilities:
Check if file exists
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e84
call fcn.00609980
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x4ef9e1
xor eax, eax
jmp 0x4f0415
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4df0]
call fcn.0041775d
lea eax, [ebp - 0x4df0]
push eax
call fcn.0047d3f6
mov eax, dword [ebp - 0x4df0]
pop ecx
cmp dword [eax - 0xc], ebx
jne 0x4efa17
lea eax, [ebp - 0x4df0]
push eax
call fcn.0047d525
pop ecx
lea ecx, [ebp - 0x4df0]
call fcn.00505c10
lea ecx, [ebp - 0x4df0]
call fcn.00505ce8
lea ecx, [ebp - 0x4e50]
call fcn.00417833
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4e10]
call fcn.0041775d
push ebx
push ecx
mov ecx, esp
push str.SOFTWARERuanMeiMyTime
call fcn.004177e7
push SysReAllocString
lea ecx, [ebp - 0x4e50]
call fcn.004f7115
test eax, eax
je 0x4efab1
push ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push str.Install_File
call fcn.004177e7
lea eax, [ebp - 0x4e04]
push eax
lea ecx, [ebp - 0x4e50]
call fcn.004e6ef3
push eax
lea ecx, [ebp - 0x4e10]
call fcn.00418bac
mov ecx, dword [ebp - 0x4e04]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea eax, [ebp - 0x4e04]
push eax
call fcn.00479879
lea eax, [ebp - 0x4e2c]
push eax
call fcn.0048191e
lea eax, [ebp - 0x4e28]
push eax
call fcn.00484962
add esp, 0xc
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4e0c]
call fcn.0041775d
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
inc eax
push eax
call esi
push eax
push ebx
call esi
push eax
lea eax, [ebp - 0x4e0c]
push 0x68c500
push eax
call fcn.0041a1e9
lea eax, [ebp - 0x4e24]
push eax
call fcn.004815f0
lea eax, [ebp - 0x4e20]
push eax
call fcn.00483263
lea eax, [ebp - 0x4e1c]
push eax
call fcn.0047dc8c
add esp, 0x1c
call fcn.004825ac
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x4e54], eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edi, ebx
call fcn.004177e7
push SysReAllocString
lea ecx, [ebp - 0x4e50]
call fcn.004f7115
test eax, eax
je 0x4efbaa
push ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push str.MyTime
call fcn.004177e7
lea eax, [ebp - 0x4e00]
push eax
lea ecx, [ebp - 0x4e50]
call fcn.004e6ef3
mov esi, dword [ebp - 0x4e00]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 1
test eax, eax
pop ecx
cmovne edi, ecx
lea ecx, [esi - 0x10]
call fcn.00419521
push ebx
push ecx
mov ecx, esp
push str.SoftwareRuanMeiMyTime
call fcn.004177e7
push SysReAllocString
lea ecx, [ebp - 0x4e50]
call fcn.004f7115
xor esi, esi
inc esi
push esi
push ecx
mov ecx, esp
push str.DeskLunar
call fcn.004177e7
lea ecx, [ebp - 0x4e50]
call fcn.004e6bc5
test eax, eax
setne bl
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4e00]
call fcn.0041775d
lea eax, [ebp - 0x4e00]
mov dword [ebp - 0x4de0], esi
push eax
lea eax, [ebp - 0x4de8]
xor esi, esi
push eax
lea eax, [ebp - 0x4de0]
mov dword [ebp - 0x4de8], esi
push eax
call fcn.0047e1d7
lea eax, [ebp - 0x4e18]
push esi
push eax
call fcn.00484cc2
add esp, 0x14
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4df4]
call fcn.0041775d
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4e08]
call fcn.0041775d
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4df8]
call fcn.0041775d
push dword [ebp - 0x4de8]
lea eax, [ebp - 0x4df4]
push dword [ebp - 0x4de0]
push edi
push esi
push dword [ebp - 0x4e1c]
push dword [ebp - 0x4e20]
push dword [ebp - 0x4e24]
push dword [ebp - 0x4e0c]
push dword [ebp - 0x4e28]
push dword [ebp - 0x4df0]
push dword [ebp - 0x4e2c]
push dword [ebp - 0x4e04]
push dword [ebp - 0x4e10]
push dword [ebp - 0x4e18]
push str.version:_s_business:magictray_setup:_s_cpu:_s_memory:_s_disk:_s_partition:_s_resolution:_s_mac:_s_os:_s_ie:_s_process:_d_autorun:_d_browser:_d_defaultbrowser:_d_
push eax
call fcn.0041a1e9
lea eax, [ebp - 0x4e08]
push str.enablemainpage:0_enablesearch:0_protectmainpage:_protectsearch:_
push eax
call fcn.0041a1e9
add esp, 0x48
movzx eax, bl
push eax
lea eax, [ebp - 0x4df8]
push str.append1:_d_append2:_append3:_append4:_append5:_
push eax
call fcn.0041a1e9
mov eax, dword [ebp - 0x4e08]
add esp, 0xc
push dword [eax - 0xc]
lea ecx, [ebp - 0x4df4]
push eax
call fcn.00419f48
mov eax, dword [ebp - 0x4df4]
xor ecx, ecx
inc ecx
cmp dword [eax - 4], ecx
jle 0x4efd23
push dword [eax - 0xc]
lea ecx, [ebp - 0x4df4]
call fcn.00418f15
mov eax, dword [ebp - 0x4df4]
push esi
push eax
call fcn.00507e2a
pop ecx
pop ecx
push esi
mov ebx, eax
lea ecx, [ebp - 0x26f0]
push str.q_2D8lJ
mov dword [ebp - 0x4dfc], ebx
call fcn.004a6f7b
push ebx
call fcn.006182a0
mov ebx, eax
pop ecx
and eax, 0x80000007
jns 0x4efd5a
dec eax
or eax, 0xfffffff8
inc eax
je 0x4efd63
push 8
pop ecx
sub ecx, eax
add ebx, ecx
lea esi, [ebx*8 + 1]
push esi
call fcn.00609926
push esi
mov dword [ebp - 0x4de0], eax
call fcn.00609926
lea ecx, [ebx + 1]
mov dword [ebp - 0x4de8], eax
push ecx
call fcn.00609926
push esi
push 0
push dword [ebp - 0x4de0]
mov edi, eax
call fcn.0060b7a0
push esi
push 0
push dword [ebp - 0x4de8]
call fcn.0060b7a0
push ebx
push 0
push edi
call fcn.0060b7a0
mov esi, dword [ebp - 0x4dfc]
push esi
push edi
call fcn.0063fc10
push esi
call fcn.0060992f
add esp, 0x3c
lea ecx, [ebp - 0x26f0]
push 0
push ebx
push edi
call fcn.0046abc9
mov esi, ebx
lea eax, [ebp - 0x2005]
mov ebx, dword [ebp - 0x4de0]
lea ecx, [ebp - 0x26f0]
shl esi, 3
push esi
push ebx
push eax
call fcn.00456635
push esi
push ebx
mov ebx, dword [ebp - 0x4de8]
lea ecx, [ebp - 0x26f0]
push ebx
call fcn.004565c5
push edi
call fcn.0060992f
lea ecx, [ebp - 0x4de4]
mov dword [esp], str.http:__union.ruanmei.com_receive_postdata.aspx_uid
call fcn.004177e7
xor esi, esi
inc esi
cmp dword [ebp + 8], esi
jne 0x4efe31
push str.http:__union.ruanmei.com_receive_install.aspx_uninstall1uid
jmp 0x4efe3c
cmp dword [ebp + 8], 0
jne 0x4efe47
push str.http:__union.ruanmei.com_receive_install.aspx_uid
lea ecx, [ebp - 0x4de4]
call fcn.004195af
push ebx
lea ecx, [ebp - 0x4de4]
call fcn.0044cb6a
push dword [ebp - 0x4de0]
call fcn.0060992f
push ebx
call fcn.0060992f
mov eax, dword [ebp - 0x4df8]
pop ecx
pop ecx
cmp dword [eax - 4], esi
jle 0x4efe85
push dword [eax - 0xc]
lea ecx, [ebp - 0x4df8]
call fcn.00418f15
mov eax, dword [ebp - 0x4df8]
push 0
push eax
call fcn.00507e2a
pop ecx
pop ecx
push 0
mov ebx, eax
lea ecx, [ebp - 0x4ddc]
push str.q_2D8lJ
mov dword [ebp - 0x4dec], ebx
call fcn.004a6f7b
push ebx
call fcn.006182a0
pop ecx
mov edi, eax
mov dword [ebp - 0x4de8], eax
mov ecx, edi
and ecx, 0x80000007
jns 0x4efec7
dec ecx
or ecx, 0xfffffff8
inc ecx
je 0x4efed6
push 8
pop eax
sub eax, ecx
add edi, eax
mov dword [ebp - 0x4de8], edi
lea esi, [edi*8 + 1]
push esi
call fcn.00609926
push esi
mov dword [ebp - 0x4de0], eax
call fcn.00609926
lea ecx, [edi + 1]
mov ebx, eax
push ecx
call fcn.00609926
push esi
push 0
push dword [ebp - 0x4de0]
mov edi, eax
call fcn.0060b7a0
push esi
push 0
push ebx
call fcn.0060b7a0
mov esi, dword [ebp - 0x4de8]
push esi
push 0
push edi
call fcn.0060b7a0
push dword [ebp - 0x4dec]
push edi
call fcn.0063fc10
push dword [ebp - 0x4dec]
call fcn.0060992f
add esp, 0x3c
lea ecx, [ebp - 0x4ddc]
push 0
push esi
push edi
call fcn.0046abc9
shl esi, 3
lea eax, [ebp - 0x46f1]
push esi
push dword [ebp - 0x4de0]
lea ecx, [ebp - 0x4ddc]
push eax
call fcn.00456635
push esi
mov esi, dword [ebp - 0x4de0]
lea ecx, [ebp - 0x4ddc]
push esi
push ebx
call fcn.004565c5
push edi
call fcn.0060992f
lea ecx, [ebp - 0x4de4]
mov dword [esp], 0x68de78
call fcn.004228d4
push ebx
lea ecx, [ebp - 0x4de4]
call fcn.0044cb6a
push esi
call fcn.0060992f
push ebx
call fcn.0060992f
pop ecx
pop ecx
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4de8]
call fcn.0041775d
xor ebx, ebx
push ebx
call fcn.00643abc
push eax
call fcn.0063eef8
call fcn.0063eed7
push eax
lea eax, [ebp - 0x4de8]
push str.r_d
push eax
call fcn.0041a1e9
mov eax, dword [ebp - 0x4de8]
add esp, 0x14
push dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x4de4]
call fcn.00419f48
lea ecx, [ebp - 0x4de4]
cmp byte [ebp + 0xc], bl
je 0x4f000d
push str.t1
jmp 0x4f0012
push str.t0
call fcn.004228d4
call fcn.004191ed
lea ecx, [ebp - 0x4de4]
test eax, eax
je 0x4f002d
push str.t11
jmp 0x4f0032
push str.t10
call fcn.004228d4
lea ecx, [ebp - 0x4e84]
mov edi, ebx
call fcn.00417833
push ecx
mov ecx, esp
push str.driversANDROIDUSB.sys
call fcn.004177e7
push ecx
push esp
lea ecx, [ebp - 0x4e84]
call fcn.0050498e
lea eax, [ebp - 0x4dfc]
push eax
lea ecx, [ebp - 0x4e84]
call fcn.0041934b
lea eax, [ebp - 0x4e14]
mov dword [ebp - 0x4e14], ebx
push eax
call fcn.005082e9
pop ecx
push dword [ebp - 0x4dfc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
test eax, eax
je 0x4f00a0
push 2
pop edi
jmp 0x4f0152
lea ecx, [ebp - 0x4e6c]
call fcn.00417833
push ebx
push ecx
mov ecx, esp
push str.SYSTEMCurrentControlSetEnumUSBSTOR
call fcn.004177e7
push esi
lea ecx, [ebp - 0x4e6c]
call fcn.004f7115
test eax, eax
je 0x4f0139
lea eax, [ebp - 0x4e38]
mov dword [ebp - 0x4e38], ebx
push eax
lea ecx, [ebp - 0x4e6c]
mov dword [ebp - 0x4e34], ebx
mov dword [ebp - 0x4e30], ebx
call fcn.0048afd2
mov esi, ebx
cmp dword [ebp - 0x4e34], ebx
jle 0x4f0129
push ebx
push str.android
push esi
lea ecx, [ebp - 0x4e38]
call fcn.0044c702
mov ecx, eax
call fcn.004b2aeb
mov ecx, eax
call fcn.004713d7
test eax, eax
jns 0x4f0126
inc esi
cmp esi, dword [ebp - 0x4e34]
jl 0x4f00f7
jmp 0x4f0129
push 2
pop edi
lea ecx, [ebp - 0x4e38]
call fcn.004e8a9c
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4e6c]
call fcn.00418dd0
mov ecx, dword [ebp - 0x4e5c]
add ecx, 0xfffffff0
call fcn.00419521
call fcn.004191ed
push ebx
push ecx
mov ecx, esp
test eax, eax
je 0x4f0166
push str.SOFTWAREWow6432NodeApple_Computer__Inc.iPodRegisteredApps4
jmp 0x4f016b
push str.SOFTWAREApple_Computer__Inc.iPodRegisteredApps4
call fcn.004177e7
push esi
lea ecx, [ebp - 0x4e50]
call fcn.004f7115
mov ebx, eax
test ebx, ebx
je 0x4f01d7
push ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push str.path
call fcn.004177e7
lea eax, [ebp - 0x4dec]
push eax
lea ecx, [ebp - 0x4e50]
call fcn.004e6ef3
mov esi, dword [ebp - 0x4dec]
cmp dword [esi - 0xc], 0
je 0x4f01ca
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f01ca
xor ecx, ecx
inc ecx
or edi, ecx
lea ecx, [esi - 0x10]
call fcn.00419521
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftZune
call fcn.004177e7
push esi
lea ecx, [ebp - 0x4e50]
call fcn.004f7115
test eax, eax
je 0x4f023e
push ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push str.Installation_Directory
call fcn.004177e7
lea eax, [ebp - 0x4dec]
push eax
lea ecx, [ebp - 0x4e50]
call fcn.004e6ef3
mov esi, dword [ebp - 0x4dec]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f0236
or edi, 4
lea ecx, [esi - 0x10]
call fcn.00419521
test ebx, ebx
je 0x4f024e
push dword [ebp - 0x4e14]
call fcn.0050833a
pop ecx
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4de0]
call fcn.0041775d
push edi
lea eax, [ebp - 0x4de0]
push str.t2_d
push eax
call fcn.0041a1e9
mov eax, dword [ebp - 0x4de0]
lea ecx, [ebp - 0x4de4]
add esp, 0xc
push dword [eax - 0xc]
push eax
call fcn.00419f48
call fcn.00418f81
push eax
lea ecx, [ebp - 0x4dec]
call fcn.0041775d
push dword [ebp - 0x4e54]
lea eax, [ebp - 0x4dec]
push str.t3_d
push eax
call fcn.0041a1e9
mov esi, dword [ebp - 0x4dec]
lea ecx, [ebp - 0x4de4]
add esp, 0xc
push dword [esi - 0xc]
push esi
call fcn.00419f48
mov edi, dword [ebp - 0x4de4]
push 0
push 0
push edi
call fcn.004f1090
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esi - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4de0]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4dfc]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x4e84]
call fcn.00418dd0
mov ecx, dword [ebp - 0x4e74]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4de8]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [edi - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4df8]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e08]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4df4]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e18]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e00]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e1c]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e20]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e24]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e0c]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e28]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e2c]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e04]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x4e10]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x4e50]
call fcn.00418dd0
mov ecx, dword [ebp - 0x4e40]
add ecx, 0xfffffff0
call fcn.00419521
mov ecx, dword [ebp - 0x4df0]
lea ecx, [ecx - 0x10]
call fcn.00419521
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret