Function at 0x424d30
Capabilities:
Create process on windows
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5ad941
mov eax, dword fs:[0]
push eax
mov eax, 0x1184
call fcn.00595100
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x1180], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x1198]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x5fdb9c]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 3
mov ebx, edx
push eax
mov dword [esp + 0x24], ebx
call ebp
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
cmp esi, 0x4ca
jne 0x424dd9
push 0
push 0
push 0xf0
push esi
push ebx
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
push esi
push 0x4cb
push ebx
call ebp
push eax
call edi
push esi
push 0x4e2
push ebx
call ebp
push eax
call edi
push esi
push 0x4c9
push ebx
call ebp
push eax
call edi
jmp 0x42554f
cmp esi, 0x3eb
jne 0x424e1c
push 0x24
push 0x5bdca0
push 0x5bdca8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42554f
lea eax, [esp + 0x164]
call fcn.0040c700
lea esi, [esp + 0x164]
mov eax, ebx
call fcn.00424b10
jmp 0x42554f
cmp esi, 0x4c5
jne 0x424e70
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x24
push 0x5be6d4
push 0x5be6e8
push ebx
call esi
cmp eax, 6
jne 0x42554f
push 0
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xaf
call fcn.0047b6b0
call fcn.0044bb80
push 0x40
push 0x5be714
push 0x5be724
push ebx
call esi
jmp 0x42554f
cmp esi, 0x4c6
jne 0x425006
push 0x58
xor edi, edi
lea ecx, [esp + 0x28]
push edi
push ecx
call fcn.00580260
add esp, 0xc
push 0x208
lea edx, [esp + 0xd7a]
push edi
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 0x58
mov word [esp + 0xd80], di
call fcn.00580260
add esp, 0xc
push 0x208
lea eax, [esp + 0xf8a]
push edi
push eax
mov word [esp + 0xf90], di
call fcn.00580260
add esp, 0xc
lea esi, [esp + 0xd74]
call fcn.004241f0
mov eax, 0x104
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x24]
mov ecx, esi
lea edx, [esp + 0xf84]
push eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x5c], 0x802
mov dword [esp + 0x64], 0x5be738
mov dword [esp + 0x34], 0x5be740
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
je 0x42554f
push edi
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xb1
call fcn.0047b6b0
mov ecx, esi
call fcn.0044c800
lea ecx, [esp + 0x9c]
push ecx
mov esi, eax
call fcn.004054d0
push str.ag_u7b
push ecx
push esi
push ecx
lea edx, [esp + 0xac]
push 0x5be788
push edx
mov dword [esp + 0x11b8], edi
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00425ca0
add esp, 4
push eax
call fcn.00415f80
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00425df0
mov ecx, esi
call fcn.00414130
lea eax, [esp + 0xd74]
push eax
push esi
call fcn.00415f80
add esp, 8
lea ecx, [esp + 0x80]
lea eax, [esp + 0x9c]
call fcn.00414210
cmp dword [eax + 0x18], 8
jb 0x424fcc
mov eax, dword [eax + 4]
jmp 0x424fcf
add eax, 4
push 0x40
push 0x5be794
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esi, [esp + 0x80]
call fcn.004385c0
lea eax, [esp + 0x9c]
mov dword [esp + 0x11a0], 0xffffffff
call fcn.004051f0
jmp 0x42554f
cmp esi, 0x4c7
jne 0x4251ff
xor edi, edi
push 0x208
lea ecx, [esp + 0xd7a]
push edi
push ecx
mov word [esp + 0xd80], di
call fcn.00580260
add esp, 0xc
push 0x208
lea edx, [esp + 0xf8a]
push edi
push edx
mov word [esp + 0xf90], di
call fcn.00580260
add esp, 0xc
push 0x58
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00580260
mov eax, 0x104
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], eax
add esp, 0xc
lea eax, [esp + 0x24]
lea ecx, [esp + 0xd74]
lea edx, [esp + 0xf84]
push eax
mov dword [esp + 0x28], 0x58
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x5c], 0x802
mov dword [esp + 0x64], 0x5be738
mov dword [esp + 0x34], 0x5be740
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
test eax, eax
je 0x42554f
push edi
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xb0
call fcn.0047b6b0
lea ecx, [esp + 0xd74]
call fcn.0044bbd0
mov esi, eax
cmp esi, edi
jle 0x42515e
lea ecx, [esp + 0x9c]
push ecx
call fcn.004054d0
push str.N_h
push ecx
push esi
push ecx
lea edx, [esp + 0xac]
push 0x5be7b0
push edx
mov dword [esp + 0x11b8], 1
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00413fe0
add esp, 4
push eax
call fcn.00415f80
add esp, 8
lea ecx, [esp + 0x80]
lea eax, [esp + 0x9c]
call fcn.00414210
cmp dword [eax + 0x18], 8
jb 0x42514f
mov eax, dword [eax + 4]
push 0x40
push 0x5be7bc
jmp 0x424fd6
push 0x40
add eax, 4
push 0x5be7bc
jmp 0x424fd6
jne 0x425178
push 0x30
push 0x5be7bc
push 0x5be7c4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42554f
push 0x24
push 0x5be7bc
push 0x5be7d8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42554f
lea esi, [esp + 0x9c]
call fcn.00421380
lea eax, [esp + 0xd74]
push eax
mov dword [esp + 0x11a4], 2
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov edi, esi
call fcn.00425f20
cmp eax, 1
jne 0x4251e2
push ebx
call fcn.00424540
add esp, 4
push ebx
mov dword [0x5fe5d4], 1
call fcn.00424970
add esp, 4
lea ecx, [esp + 0x9c]
push ecx
mov dword [esp + 0x11a4], 0xffffffff
call fcn.00421430
jmp 0x42554f
cmp esi, 0x4c9
jne 0x425340
push ebx
call fcn.00424970
add esp, 4
lea ebx, [esp + 0x1c]
call fcn.004747c0
mov ebx, 3
lea eax, [esp + 0x1c]
mov dword [esp + 0x11a0], ebx
call fcn.0047aca0
mov edx, str.QQPYLiveUp.exe
lea edi, [esp + 0x1c]
call fcn.00412930
lea edx, [esp + 0x9c]
push edx
call fcn.004054d0
push 2
push ecx
push str.__UpdateDictType_
push ecx
push 1
push ecx
push str.__UpdateImeType_
push ecx
push 2
push ecx
lea eax, [esp + 0xc4]
push str._Mode_
push eax
mov byte [esp + 0x11d0], 4
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00413fe0
add esp, 4
push eax
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00413fe0
add esp, 4
push eax
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00413fe0
lea ecx, [esp + 0x80]
lea eax, [esp + 0x9c]
call fcn.00414210
cmp dword [eax + 0x18], 8
jb 0x4252c7
mov eax, dword [eax + 4]
jmp 0x4252ca
add eax, 4
mov ecx, dword [esp + 0x1c]
push 1
push 0
push eax
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea esi, [esp + 0x80]
call fcn.004385c0
mov edx, dword [esp + 0x18]
push 0
push 0x4cc
push edx
call ebp
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
call fcn.0057abc7
add esp, 4
push eax
mov edx, str.LastDictUpdateTime
mov ecx, str.SOFTWARETencentQQPinyin
call fcn.00473c10
add esp, 4
lea eax, [esp + 0x9c]
mov byte [esp + 0x11a0], bl
call fcn.004051f0
lea ecx, [esp + 0x1c]
call fcn.00404510
jmp 0x42554f
cmp esi, 0x4c8
jne 0x4253ad
lea esi, [esp + 0x9c]
call fcn.00421380
push 0
mov dword [esp + 0x11a4], 5
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov edi, esi
call fcn.00425f20
cmp eax, 1
jne 0x425390
push ebx
call fcn.00424540
add esp, 4
push ebx
mov dword [0x5fe5d4], 1
call fcn.00424970
add esp, 4
lea eax, [esp + 0x9c]
push eax
mov dword [esp + 0x11a4], 0xffffffff
call fcn.00421430
jmp 0x42554f
cmp esi, 0x4cc
jne 0x42550a
push 0x24
push 0x5bdca0
push str._fT_Rd
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42554f
push 0x4e2
push ebx
mov dword [esp + 0x28], 0
call ebp
push 2
push 0xffffffffffffffff
mov ebp, eax
push 0x100c
push ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42554f
jmp 0x425410
cmp edi, dword [0x5fff48]
jae 0x425500
mov esi, edi
imul esi, esi, 0x2c
add esi, dword [0x5fff44]
mov ebx, dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esi + 4]
lea ebx, [esi + 4]
push edx
call fcn.004d5790
mov eax, dword [0x5fff48]
add esp, 4
xor esi, esi
test eax, eax
jbe 0x42549a
xor ebp, ebp
cmp esi, eax
jae 0x425500
mov eax, dword [0x5fff44]
lea eax, [eax + ebp + 4]
push ebx
call fcn.00425c40
add esp, 4
test al, al
jne 0x42548f
mov eax, dword [0x5fff48]
add esi, 1
add ebp, 0x2c
cmp esi, eax
jb 0x425468
jmp 0x425496
mov eax, esi
call fcn.00426f70
mov ebp, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xf000
push edi
push 0x102c
push ebp
call esi
shr eax, 0xc
sub eax, 1
je 0x4254be
mov dword [esp + 0x20], 1
push 0
push edi
push 0x1008
push ebp
call esi
push 2
push 0xffffffffffffffff
push 0x100c
push ebp
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x425410
cmp dword [esp + 0x20], 0
je 0x42554f
mov ecx, dword [esp + 0x18]
push ecx
mov dword [0x5fe5d4], 1
call fcn.00424970
add esp, 4
jmp 0x42554f
push 0x80070057
call fcn.00404550
cmp esi, 0x567
jne 0x42554f
lea edx, [esp + 0x11c]
push edx
call fcn.0041b190
mov dword [esp + 0x11a0], 6
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea edi, [esp + 0x120]
call fcn.00426020
mov ecx, edi
mov dword [esp + 0x11a0], 0xffffffff
call fcn.0041b290
mov ecx, dword [esp + 0x1198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1180]
xor ecx, esp
call fcn.005787fd
add esp, 0x1190
ret