Function at 0x4a5605
Capabilities:
Create process on windows
Get common file path
Get program files directory
Get startup folder

Disassembly:
push 0x22c
mov eax, 0x53049a
call fcn.004f2332
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0x44]
jne 0x4a5632
lea ecx, [edi - 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
call fcn.00460614
jmp 0x4a5a4f
cmp eax, dword [edi + 0x48]
jne 0x4a564d
call fcn.0049c3bc
mov ecx, eax
call fcn.0049c10a
lea ecx, [edi - 0x3c]
mov eax, dword [ecx]
jmp 0x4a58e1
mov ecx, dword [edi + 0x174]
cmp eax, ecx
jne 0x4a5664
lea ecx, [edi - 0x3c]
call fcn.004a5b1c
jmp 0x4a5a4f
cmp eax, dword [edi + 0x180]
je 0x4a5a4a
mov ecx, dword [edi + 0x1e8]
cmp eax, ecx
je 0x4a5a24
cmp eax, dword [edi + 0x1e4]
je 0x4a5a24
cmp eax, dword [edi + 0x184]
jne 0x4a5753
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4a56ea
lea eax, [ebp - 0x218]
push eax
call fcn.00416680
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00417b50
mov esi, str.Internet_Exploreriexplore.exe
push esi
call fcn.00416680
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00418190
push str.https:__www.ijinshan.com_privacy_liebaocnLicense.html
lea ecx, [ebp - 0x234]
call fcn.0043c206
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push ebx
push dword [ebp - 0x234]
push eax
push 0x55c8f0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push ebx
push 1
jmp 0x4a5819
cmp eax, dword [edi + 0x18c]
jne 0x4a5829
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
xor edi, edi
push eax
push ebx
push ebx
push 0x26
inc edi
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4a57b6
lea eax, [ebp - 0x218]
push eax
call fcn.00416680
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00417b50
mov esi, str.Internet_Exploreriexplore.exe
push esi
call fcn.00416680
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00418190
push str.https:__www.ijinshan.com_privacy_liebaoprivate.html
lea ecx, [ebp - 0x234]
call fcn.0043c206
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push ebx
push dword [ebp - 0x234]
push eax
push 0x55c8f0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push ebx
push edi
lea ecx, [ebp - 0x230]
call fcn.00417d20
jmp 0x4a5a4f
mov ecx, dword [edi + 0x190]
cmp eax, ecx
je 0x4a59bf
cmp eax, dword [edi + 0x194]
je 0x4a59bf
cmp eax, dword [edi + 0x1d0]
je 0x4a596e
cmp eax, dword [edi + 0x1cc]
je 0x4a596e
mov ecx, dword [edi + 0x1d8]
cmp eax, ecx
je 0x4a593d
cmp eax, dword [edi + 0x1d4]
je 0x4a5939
mov ecx, dword [edi + 0x1e0]
cmp eax, ecx
je 0x4a5908
cmp eax, dword [edi + 0x1dc]
je 0x4a5904
cmp dword [edi + 0x178], 0
je 0x4a5a4f
add edi, 0xffffffc4
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 8]
mov ecx, eax
call fcn.00460406
push eax
lea ecx, [ebp - 0x238]
call fcn.004a04ba
lea ecx, [ebp - 0x238]
call fcn.004a0c1f
cmp dword [ebp - 0x234], 3
jne 0x4a58f0
push 0x55aff0
push 0x17
push 0x1a0a
call fcn.004db115
mov eax, dword [edi]
add esp, 0xc
mov ecx, edi
call dword [eax + 8]
mov ecx, eax
call fcn.00460623
jmp 0x4a5a4f
cmp dword [ebp - 0x234], 2
jne 0x4a5a4f
mov ecx, edi
jmp 0x4a565a
cmp eax, ecx
jne 0x4a5923
mov ecx, dword [edi + 0x1dc]
cmp byte [ecx + 0x40], 0
sete al
mov byte [ecx + 0x40], al
mov ecx, dword [edi + 0x1dc]
call fcn.004627f1
call fcn.0049c3bc
mov ecx, dword [edi + 0x1dc]
mov cl, byte [ecx + 0x40]
mov byte [eax + 9], cl
jmp 0x4a5a4f
cmp eax, ecx
jne 0x4a5958
mov ecx, dword [edi + 0x1d4]
cmp byte [ecx + 0x40], 0
sete al
mov byte [ecx + 0x40], al
mov ecx, dword [edi + 0x1d4]
call fcn.004627f1
call fcn.0049c3bc
mov ecx, dword [edi + 0x1d4]
mov cl, byte [ecx + 0x40]
mov byte [eax + 8], cl
jmp 0x4a5a4f
call fcn.0049c3bc
mov ebx, eax
mov ecx, ebx
call fcn.0049c400
test al, al
jne 0x4a5a4f
lea ecx, [edi - 0x3c]
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, eax
call fcn.00460406
push eax
mov ecx, ebx
call fcn.0049c684
mov eax, dword [edi + 0x1cc]
mov ecx, ebx
mov esi, dword [eax]
call fcn.0049c3b8
mov ecx, dword [edi + 0x1cc]
push eax
call dword [esi + 0x40]
mov ecx, dword [edi + 0x1cc]
jmp 0x4a5a4a
cmp byte [edi + 0x1a0], 0
push 1
sete al
mov byte [edi + 0x1a0], al
test al, al
je 0x4a59dc
push 0x9c51
jmp 0x4a59e1
push 0x9c50
call fcn.0046374f
mov ecx, dword [edi + 0x190]
xor eax, eax
cmp byte [edi + 0x1a0], al
sete al
add eax, 0xe
push eax
push 0x24e
call fcn.0046272f
mov eax, dword [edi + 0x190]
lea ecx, [edi - 0x3c]
xor ebx, ebx
push ebx
mov byte [eax + 5], bl
mov eax, dword [edi + 0x194]
mov byte [eax + 5], bl
call fcn.004a5d36
jmp 0x4a5a4f
test ecx, ecx
jne 0x4a5a30
cmp dword [edi + 0x1e4], ecx
je 0x4a5a4f
cmp eax, ecx
jne 0x4a5a44
mov edx, dword [edi + 0x1e4]
cmp byte [edx + 0x40], 0
sete al
mov byte [edx + 0x40], al
mov ecx, dword [edi + 0x1e4]
call fcn.004627f1
call fcn.004f22e1
ret 4