Function at 0x470fa0
Capabilities:
Check if file exists
Create process on windows
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x19c], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9c41
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x17
ja case.0x470ff5.1
mov ecx, dword [ebp - 0x1a0]
jmp dword [ecx*4 + 0x471c40]
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x484], 0
jne 0x4710bc
push 0x1ae
push 0x20d
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.00441340
push 0x2f8
call fcn.00512067
add esp, 4
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x471054
mov ecx, dword [ebp - 0x88]
call fcn.00471ca0
mov dword [ebp - 0x1a4], eax
jmp 0x47105e
mov dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x1a4]
mov dword [eax + 0x484], ecx
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x484], 0
je 0x4710b1
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x55fdf8
push 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x484]
call fcn.004ce96a
mov ecx, dword [ebp - 0x19c]
call fcn.0047b7b0
push 1
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.00477800
mov edx, dword [ebp - 0x19c]
add edx, 0x3e8
sub esp, 0x10
mov ecx, esp
push edx
call fcn.0047d720
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x484]
call fcn.004784a0
push 0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.004cdf2d
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x484]
call fcn.00477990
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fde0
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
lea eax, [ebp - 0x1c]
push eax
call fcn.00421190
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4711a4
push 5
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fdc4
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
lea ecx, [ebp - 0x1c]
call fcn.0040f740
jmp case.0x470ff5.1
push 0x47d520
push 0
push 0x4293a0
call fcn.0051af0d
add esp, 0xc
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fda8
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
push 1
push 0
push str.Shell32.dll_Control_RunDLL_timedate.cpl
push str.Rundll32.exe
push 0x55fd30
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fd0c
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
push 0x554518
lea ecx, [ebp - 0x24]
call fcn.0041c8a0
push 0x104
push 0x105
lea ecx, [ebp - 0x24]
call fcn.00453160
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20]
call fcn.0040ee90
mov eax, dword [ebp - 0x24]
push eax
push str._select__s
lea ecx, [ebp - 0x20]
push ecx
call fcn.004beff0
add esp, 0xc
push 5
push 0x554518
lea ecx, [ebp - 0x20]
call fcn.0041cb20
push eax
push str.explorer.exe
push 0x55fd30
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fcb8
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
lea ecx, [ebp - 0x20]
call fcn.0040f740
lea ecx, [ebp - 0x24]
call fcn.0040f740
jmp case.0x470ff5.1
lea ecx, [ebp - 0x40]
call fcn.0042e050
push 1
push ecx
mov ecx, esp
push 0x55a860
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x40]
call fcn.0042e1a0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55a708
call fcn.0041c8a0
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x40]
call fcn.0042e400
push 5
push 0x554518
push 0
lea ecx, [ebp - 0x28]
call fcn.0041cb20
push eax
push 0x55fd30
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fc98
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
lea ecx, [ebp - 0x28]
call fcn.0040f740
lea ecx, [ebp - 0x40]
call fcn.0042e110
jmp case.0x470ff5.1
push 1
push ecx
mov ecx, esp
push str.http:__xzs.ithome.com
call fcn.0041c8a0
call fcn.004222e0
add esp, 8
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fc54
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
push 1
push ecx
mov ecx, esp
push str.http:__go.ruanmei.com_url.aspx_linkid155
call fcn.0041c8a0
call fcn.004222e0
add esp, 8
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fbe0
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x48c], 0
jne 0x4714a7
push 0x2d8
call fcn.00512067
add esp, 4
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x47144a
mov ecx, dword [ebp - 0xe4]
call fcn.00457540
mov dword [ebp - 0x1a8], eax
jmp 0x471454
mov dword [ebp - 0x1a8], 0
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x1a8]
mov dword [ecx + 0x48c], edx
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x48c], 0
je 0x4714a7
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x55a6b4
push 0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x48c]
call fcn.004ce96a
push 0
push 5
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x48c]
call fcn.004cdeda
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fbc8
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x480], 0
je 0x471507
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x480]
call fcn.00469220
mov ecx, dword [ebp - 0x19c]
add ecx, 0x3e0
call fcn.004917b0
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fbac
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x484], 0
jne 0x471603
push 0x1ae
push 0x20d
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.00441340
push 0x2f8
call fcn.00512067
add esp, 4
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x47159b
mov ecx, dword [ebp - 0xf8]
call fcn.00471ca0
mov dword [ebp - 0x1ac], eax
jmp 0x4715a5
mov dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x1ac]
mov dword [eax + 0x484], ecx
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x484], 0
je 0x4715f8
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x55fdf8
push 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x484]
call fcn.004ce96a
mov ecx, dword [ebp - 0x19c]
call fcn.0047b7b0
push 2
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.00477800
mov edx, dword [ebp - 0x19c]
add edx, 0x3e8
sub esp, 0x10
mov ecx, esp
push edx
call fcn.0047d720
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x484]
call fcn.004784a0
push 0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x484]
call fcn.004cdf2d
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x484]
call fcn.00477990
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fb88
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
push 1
push 0
push 0
push str.taskmgr.exe
push 0x55fd30
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fb50
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x49c], 0
jne 0x47176f
push 0x2e0
call fcn.00512067
add esp, 4
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x471712
mov ecx, dword [ebp - 0x110]
call fcn.0047b1f0
mov dword [ebp - 0x1b0], eax
jmp 0x47171c
mov dword [ebp - 0x1b0], 0
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x1b0]
mov dword [ecx + 0x49c], edx
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x49c], 0
je 0x47176f
push 0
push SysReAllocString
push SysReAllocString
push 0
push 0
push 0x88
push SysReAllocString
push 0x55a6b4
push 0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x49c]
call fcn.004ce96a
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x49c], 0
je 0x4717ce
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x49c]
movzx edx, byte [ecx + 0x2d8]
test edx, edx
je 0x47179f
mov eax, 1
jmp 0x471c2f
push ecx
mov ecx, esp
push 0x55fb3c
call fcn.0041c8a0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x49c]
call fcn.004610d0
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x49c]
call fcn.0047b5b0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00421da0
add esp, 4
test eax, eax
jne 0x471869
push 0
push ecx
mov ecx, esp
push str._checktime
call fcn.0041c8a0
push ecx
mov edx, esp
push 0x55fb0c
push 0x591300
push edx
call fcn.0041ca60
add esp, 0xc
call fcn.00422ca0
add esp, 0xc
test eax, eax
je 0x471818
jmp 0x471867
push str._checktime
lea ecx, [ebp - 0x120]
call fcn.0041c8a0
lea eax, [ebp - 0x120]
push eax
push 0x55fb0c
push 0x591300
lea ecx, [ebp - 0x124]
push ecx
call fcn.0041ca60
add esp, 0xc
push eax
call fcn.00421e20
add esp, 8
lea ecx, [ebp - 0x124]
call fcn.0040f740
lea ecx, [ebp - 0x120]
call fcn.0040f740
jmp 0x4718a8
push 5
push 0
push str._checktime
push 0x55fb0c
push 0x591300
lea edx, [ebp - 0x128]
push edx
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x128]
call fcn.0040f740
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55faf0
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047c760
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fad0
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047c790
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fab8
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047c950
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fa9c
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047cb30
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fa7c
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047c8b0
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fa64
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047c810
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fa4c
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047cb50
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fa34
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
mov ecx, dword [ebp - 0x19c]
call fcn.0047cbd0
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fa1c
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp case.0x470ff5.1
lea ecx, [ebp - 0x6c]
call fcn.0042e050
push 0
push ecx
mov ecx, esp
push 0x55a860
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x6c]
call fcn.0042e1a0
push 1
push ecx
mov ecx, esp
push 0x55d84c
call fcn.0041c8a0
lea ecx, [ebp - 0x6c]
call fcn.0042ef30
test eax, eax
setne al
mov byte [ebp - 0x51], al
movzx ecx, byte [ebp - 0x51]
test ecx, ecx
je 0x471b01
mov ecx, dword [ebp - 0x19c]
call fcn.00462030
push 1
push ecx
mov ecx, esp
push 0x558be0
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fa08
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
jmp 0x471b4e
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x4a0], 0
je 0x471b28
push 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0x4a0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push ecx
mov ecx, esp
push 0x558be8
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55e588
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
lea ecx, [ebp - 0x6c]
call fcn.0042e110
jmp case.0x470ff5.1
lea ecx, [ebp - 0x84]
call fcn.0042e050
push 0
push ecx
mov ecx, esp
push 0x55a860
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x84]
call fcn.0042e1a0
push 1
push ecx
mov ecx, esp
push 0x55c654
call fcn.0041c8a0
lea ecx, [ebp - 0x84]
call fcn.0042ef30
test eax, eax
setne al
mov byte [0x59103a], al
mov ecx, dword [ebp - 0x19c]
cmp dword [ecx + 0x4a0], 0
je 0x471bc9
mov edx, dword [ebp - 0x19c]
mov ecx, dword [edx + 0x4a0]
call fcn.00467870
movzx eax, byte [0x59103a]
test eax, eax
je 0x471be0
mov dword [ebp - 0x1b4], 0x558be0
jmp 0x471bea
mov dword [ebp - 0x1b4], 0x558be8
push 1
push ecx
mov ecx, esp
mov edx, dword [ebp - 0x1b4]
push edx
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55f9f8
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
lea ecx, [ebp - 0x84]
call fcn.0042e110
mov eax, dword [ebp - 0x19c]
mov byte [eax + 0x4a8], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 0x10