Function at 0x4727b8
Capabilities:
Create process on windows
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp eax, dword [edi + 0x88]
jne 0x4727fc
mov byte [edi + 0x44], 1
call fcn.00467fb2
mov ecx, eax
call fcn.004685ce
cmp byte [edi + 0xc], 0
lea ecx, [edi - 0x3c]
je 0x472807
call fcn.00474298
jmp 0x472ac9
cmp eax, dword [edi + 0x10c]
jne 0x472811
lea ecx, [edi - 0x3c]
call fcn.00474215
jmp 0x472ac9
push esi
cmp eax, dword [edi + 0x100]
je 0x472a79
cmp eax, dword [edi + 0xfc]
je 0x472a79
cmp eax, dword [edi + 0x7c]
jne 0x47284c
lea esi, [edi - 0x3c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, eax
call fcn.00449d9c
mov ecx, esi
call fcn.00472ce3
jmp 0x472ac8
cmp eax, dword [edi + 0x80]
jne 0x472874
call fcn.00467fb2
mov ecx, eax
call fcn.00467cfd
lea ecx, [edi - 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
call fcn.00449dab
jmp 0x472ac8
mov ecx, dword [edi + 0x104]
cmp eax, ecx
je 0x472a25
cmp eax, dword [edi + 0x108]
je 0x472a2d
mov ecx, dword [edi + 0xf8]
cmp eax, ecx
jne 0x4728d9
mov byte [ecx + 4], 0
mov eax, dword [edi + 0x110]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x118]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x11c]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x120]
mov byte [eax + 4], 1
mov eax, dword [edi + 0x124]
mov byte [eax + 4], 1
mov ecx, dword [edi + 0xf4]
jmp 0x472a72
mov ecx, dword [edi + 0x110]
cmp eax, ecx
je 0x4729f2
cmp eax, dword [edi + 0x118]
je 0x4729fa
mov ecx, dword [edi + 0x11c]
cmp eax, ecx
je 0x4729bf
cmp eax, dword [edi + 0x120]
je 0x4729c7
cmp eax, dword [edi + 0x124]
jne 0x472ac8
xor eax, eax
mov dword [ebp - 0x210], 7
mov word [ebp - 0x224], ax
xor edi, edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x47296a
lea eax, [ebp - 0x20c]
push eax
call fcn.00402df0
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00406500
mov esi, str.Internet_Exploreriexplore.exe
push esi
call fcn.00402df0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x224]
call fcn.00406420
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
push 5
cmovae eax, dword [ebp - 0x224]
push edi
push str.http:__www.liebao.cn_reports.html
push eax
push 0x50f004
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push 1
lea ecx, [ebp - 0x224]
call fcn.00402540
jmp 0x472ac8
cmp eax, dword [edi + 0x120]
jne 0x4729dc
cmp byte [ecx + 0x3c], 0
sete al
mov byte [ecx + 0x3c], al
mov ecx, dword [edi + 0x11c]
call fcn.0044d82c
call fcn.00467fb2
mov ecx, dword [edi + 0x11c]
mov cl, byte [ecx + 0x3c]
mov byte [eax + 9], cl
jmp 0x472ac8
cmp eax, dword [edi + 0x118]
jne 0x472a0f
cmp byte [ecx + 0x3c], 0
sete al
mov byte [ecx + 0x3c], al
mov ecx, dword [edi + 0x110]
call fcn.0044d82c
call fcn.00467fb2
mov ecx, dword [edi + 0x110]
mov cl, byte [ecx + 0x3c]
mov byte [eax + 8], cl
jmp 0x472ac8
cmp eax, dword [edi + 0x108]
jne 0x472a42
cmp byte [ecx + 0x3c], 0
sete al
mov byte [ecx + 0x3c], al
mov ecx, dword [edi + 0x104]
call fcn.0044d82c
mov eax, dword [edi + 0x104]
mov ecx, dword [edi + 0x88]
cmp byte [eax + 0x3c], 0
je 0x472a65
push 0
call fcn.0044e3a5
lea ecx, [edi - 0x3c]
call fcn.004741ed
jmp 0x472a6c
push 3
call fcn.0044e3a5
mov ecx, dword [edi + 0x88]
call fcn.0044d82c
jmp 0x472ac8
push ebx
call fcn.00467fb2
mov ebx, eax
mov ecx, ebx
call fcn.00467ff1
test al, al
jne 0x472ac7
lea ecx, [edi - 0x3c]
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, eax
call fcn.00449b3a
push eax
mov ecx, ebx
call fcn.0046822c
mov eax, dword [edi + 0xfc]
mov ecx, ebx
mov esi, dword [eax]
call fcn.00467fae
mov ecx, dword [edi + 0xfc]
push eax
call dword [esi + 0x40]
mov ecx, dword [edi + 0xfc]
call fcn.0044d82c
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004bc45f
mov esp, ebp
pop ebp
ret 4