Function at 0x472b5f
Capabilities:
Create process on windows
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x52fe80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp eax, dword [edi + 0x88]
jne 0x472ba3
mov byte [edi + 0x44], 1
call fcn.0046835f
mov ecx, eax
call fcn.0046897b
cmp byte [edi + 0xc], 0
lea ecx, [edi - 0x3c]
je 0x472bae
call fcn.0047463d
jmp 0x472e70
cmp eax, dword [edi + 0x10c]
jne 0x472bb8
lea ecx, [edi - 0x3c]
call fcn.004745ba
jmp 0x472e70
push esi
cmp eax, dword [edi + 0x100]
je 0x472e20
cmp eax, dword [edi + 0xfc]
je 0x472e20
cmp eax, dword [edi + 0x7c]
jne 0x472bf3
lea esi, [edi - 0x3c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, eax
call fcn.0044a0e1
mov ecx, esi
call fcn.0047308a
jmp 0x472e6f
cmp eax, dword [edi + 0x80]
jne 0x472c1b
call fcn.0046835f
mov ecx, eax
call fcn.004680aa
lea ecx, [edi - 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
call fcn.0044a0f0
jmp 0x472e6f
mov ecx, dword [edi + 0x104]
cmp eax, ecx
je 0x472dcc
cmp eax, dword [edi + 0x108]
je 0x472dd4
mov ecx, dword [edi + 0xf8]
cmp eax, ecx
jne 0x472c80
mov byte [ecx + 4], 0
mov eax, dword [edi + 0x110]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x118]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x11c]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x120]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x124]
mov byte [eax + 4], 1
mov ecx, dword [edi + 0xf4]
jmp 0x472e19
mov ecx, dword [edi + 0x110]
cmp eax, ecx
je 0x472d99
cmp eax, dword [edi + 0x118]
je 0x472da1
mov ecx, dword [edi + 0x11c]
cmp eax, ecx
je 0x472d66
cmp eax, dword [edi + 0x120]
je 0x472d6e
cmp eax, dword [edi + 0x124]
jne 0x472e6f
xor eax, eax
mov dword [ebp - 0x210], 7
mov word [ebp - 0x224], ax
xor edi, edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x472d11
lea eax, [ebp - 0x20c]
push eax
call fcn.00405d70
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00407560
mov esi, str.Internet_Exploreriexplore.exe
push esi
call fcn.00405d70
pop ecx
push eax
push esi
lea ecx, [ebp - 0x224]
call fcn.00407480
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
push 5
cmovae eax, dword [ebp - 0x224]
push edi
push str.http:__www.liebao.cn_reports.html
push eax
push 0x511078
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push 1
lea ecx, [ebp - 0x224]
call fcn.00403650
jmp 0x472e6f
cmp eax, dword [edi + 0x120]
jne 0x472d83
cmp byte [ecx + 0x3c], 0
sete al
mov byte [ecx + 0x3c], al
mov ecx, dword [edi + 0x11c]
call fcn.0044dbb4
call fcn.0046835f
mov ecx, dword [edi + 0x11c]
mov cl, byte [ecx + 0x3c]
mov byte [eax + 9], cl
jmp 0x472e6f
cmp eax, dword [edi + 0x118]
jne 0x472db6
cmp byte [ecx + 0x3c], 0
sete al
mov byte [ecx + 0x3c], al
mov ecx, dword [edi + 0x110]
call fcn.0044dbb4
call fcn.0046835f
mov ecx, dword [edi + 0x110]
mov cl, byte [ecx + 0x3c]
mov byte [eax + 8], cl
jmp 0x472e6f
cmp eax, dword [edi + 0x108]
jne 0x472de9
cmp byte [ecx + 0x3c], 0
sete al
mov byte [ecx + 0x3c], al
mov ecx, dword [edi + 0x104]
call fcn.0044dbb4
mov eax, dword [edi + 0x104]
mov ecx, dword [edi + 0x88]
cmp byte [eax + 0x3c], 0
je 0x472e0c
push 0
call fcn.0044e72d
lea ecx, [edi - 0x3c]
call fcn.00474592
jmp 0x472e13
push 3
call fcn.0044e72d
mov ecx, dword [edi + 0x88]
call fcn.0044dbb4
jmp 0x472e6f
push ebx
call fcn.0046835f
mov ebx, eax
mov ecx, ebx
call fcn.0046839e
test al, al
jne 0x472e6e
lea ecx, [edi - 0x3c]
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, eax
call fcn.00449e7f
push eax
mov ecx, ebx
call fcn.004685d9
mov eax, dword [edi + 0xfc]
mov ecx, ebx
mov esi, dword [eax]
call fcn.0046835b
mov ecx, dword [edi + 0xfc]
push eax
call dword [esi + 0x40]
mov ecx, dword [edi + 0xfc]
call fcn.0044dbb4
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret 4