Function at 0x40a5dc
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c8
mov eax, dword [0x4223b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.004074cf
pop ecx
push ebx
push dword [ebp + 8]
mov ecx, 0x4236c0
push ebx
call fcn.00407798
call fcn.004068d5
test eax, eax
setne al
mov byte [0x423685], al
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov byte [0x423686], bl
call fcn.0040b4c0
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004074ed
add esp, 0x14
mov byte [0x423684], al
cmp byte [0x423685], bl
je 0x40a673
call fcn.0040a333
call fcn.0040765d
test al, al
je 0x40a6a7
call fcn.0040a200
cmp eax, ebx
sete cl
mov byte [0x423686], cl
cmp cl, bl
jne 0x40a6a7
push eax
call fcn.0040a23a
pop ecx
call fcn.0040a200
neg eax
sbb al, al
inc al
mov byte [0x423686], al
mov esi, dword [0x42381c]
or eax, 0xffffffff
cmp dword [0x423814], 2
mov dword [ebp - 0x7c4], eax
jle 0x40a6d7
push dword [esi + 4]
call fcn.0040cadd
push dword [esi + 8]
mov dword [ebp - 0x7c4], eax
call fcn.0040cadd
pop ecx
pop ecx
push eax
push dword [ebp - 0x7c4]
lea ecx, [ebp - 0x6d0]
call fcn.00403268
mov esi, dword [sym.imp.USER32.dll_GetActiveWindow]
push ebx
call esi
push eax
lea ecx, [ebp - 0x6d0]
call fcn.004025d4
mov dword [ebp - 0x7c4], eax
push ebx
lea eax, [ebp - 0x7c8]
push eax
push str.HKCUSoftwarePPTAssistCommonSettingHasTried
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x7c8], ebx
call fcn.00404fe2
add esp, 0xc
cmp dword [ebp - 0x7c4], 0x65
jne 0x40a748
push 5
push ebx
push ebx
push str.http:__www.meihuappt.com
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40aa7d
cmp dword [ebp - 0x7c4], 0x67
jne 0x40a781
lea ecx, [ebp - 0x7b4]
call fcn.00403368
push ebx
call esi
push eax
lea ecx, [ebp - 0x7b4]
call fcn.004025d4
lea ecx, [ebp - 0x7b4]
mov dword [ebp - 0x7b0], ebx
call fcn.004022e0
jmp 0x40aa7d
xor eax, eax
push 0x206
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push ebx
push eax
call fcn.0040b4c0
add esp, 0xc
push edi
lea eax, [ebp - 0x61c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 0x7c4], 0x64
jne 0x40a953
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.0040b4c0
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0040767e
add esp, 0x14
test al, al
je 0x40a8b2
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x7b8]
call fcn.0040313e
mov esi, str.POWERPNT.EXE
push esi
call fcn.0040b53a
pop ecx
push eax
push esi
lea ecx, [ebp - 0x7b8]
call fcn.00402624
lea ecx, [ebp - 0x7b8]
call fcn.00405be8
push eax
lea ecx, [ebp - 0x7b8]
call fcn.00404a7c
push dword [ebp - 0x7b8]
call fcn.0040a3c3
pop ecx
test eax, eax
jne 0x40a858
push ebx
push 0xa
push ebx
push ebx
push 0x41c834
push dword [ebp - 0x7b8]
call fcn.00401492
add esp, 0x18
push 0x41a950
lea ecx, [ebp - 0x7bc]
call fcn.0040313e
mov esi, str.open
push esi
lea ecx, [ebp - 0x7c0]
call fcn.0040313e
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x7c0]
push eax
call fcn.0040317f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7c0]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x7bc]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x7b8]
jmp 0x40a911
push 0x40
push 0x41c82c
push 0x41c7e0
call esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x41c7d8
lea ecx, [ebp - 0x7c0]
call fcn.0040313e
mov esi, str.open
push esi
lea ecx, [ebp - 0x7bc]
call fcn.0040313e
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7bc]
push eax
call fcn.0040317f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7bc]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x7c0]
add ecx, 0xfffffff0
call fcn.0040124f
cmp dword [ebp - 0x7c8], ebx
jne 0x40aa7d
push 3
push ebx
push ebx
push str.http:__www.meihuappt.com_experience.php
push esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
inc edi
push ebx
push edi
push str.HKCUSoftwarePPTAssistCommonSettingHasTried
mov dword [ebp - 0x7c8], edi
call fcn.004050bf
add esp, 0xc
jmp 0x40aa7d
cmp dword [ebp - 0x7c4], 0x66
jne 0x40aa7d
cmp byte [0x423684], bl
jne 0x40a977
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004074ed
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x7b8]
call fcn.0040313e
mov esi, str.office6wpp.exe
push esi
call fcn.0040b53a
pop ecx
push eax
push esi
lea ecx, [ebp - 0x7b8]
call fcn.00402624
push dword [ebp - 0x7b8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40aa6f
push dword [ebp - 0x7b8]
call fcn.0040a3c3
xor edi, edi
inc edi
pop ecx
test eax, eax
jne 0x40a9e0
push ebx
push edi
push ebx
push ebx
push 0x41a4d8
push dword [ebp - 0x7b8]
call fcn.00401492
add esp, 0x18
mov esi, str.open
cmp dword [ebp - 0x7c8], ebx
jne 0x40aa13
push 3
push ebx
push ebx
push str.http:__www.meihuappt.com_experience.php
push esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push edi
push str.HKCUSoftwarePPTAssistCommonSettingHasTried
mov dword [ebp - 0x7c8], edi
call fcn.004050bf
add esp, 0xc
lea ecx, [ebp - 0x7c0]
cmp byte [0x423684], bl
jne 0x40aa28
push 0x41a948
jmp 0x40aa2d
push 0x41a94c
call fcn.0040313e
push esi
lea ecx, [ebp - 0x7bc]
call fcn.0040313e
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7bc]
push eax
call fcn.0040317f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7bc]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x7c0]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, dword [ebp - 0x7b8]
add ecx, 0xfffffff0
call fcn.0040124f
mov ecx, 0x4236c0
call fcn.0040949f
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x6d0]
call fcn.00402056
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x7c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b555
leave
ret 0x10