Function at 0x48dad0
Capabilities:
Create directory
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x586670
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push str._binSnapShot.exe
lea eax, [esp + 0xc]
push 0x5f2878
push eax
call fcn.00401ba0
add esp, 0xc
test edi, edi
mov dword [esp + 0x28], 0
jne 0x48db62
mov ecx, dword [esp + 8]
call fcn.004600b0
test eax, eax
je 0x48db62
mov ecx, dword [esp + 8]
push 5
push edi
push edi
push ecx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x48ddf0
push str.TencentTTPlugins1SnapShotSnapShot.exe
lea ecx, [esp + 0x10]
push 0x5f23ec
push ecx
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.00402310
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48dbad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
jne 0x48dc0f
mov ecx, dword [esp + 8]
call fcn.004600b0
test eax, eax
je 0x48dbd3
mov ecx, dword [esp + 8]
push 5
push edi
push edi
push ecx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0
push 0x5add30
call fcn.00539414
mov eax, dword [esi + 0x568c]
push 0
push 0
push 0xffffffffffffffff
push 1
push 1
push 0
push 0
push str.http:__www.tgsoso.com_faq.htm
push eax
call fcn.004d7180
jmp 0x48ddd4
mov ecx, dword [0x5f288c]
mov esi, ecx
call fcn.004600b0
test eax, eax
jne 0x48dc3b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x48dc3b
push 0x5f23e8
mov ecx, 0x5f288c
call fcn.00402310
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48dc55
push 0x80004005
call fcn.00401f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push str._screen1.bmp
lea ecx, [esp + 0x14]
push 0x5f288c
push ecx
mov byte [esp + 0x34], 2
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call fcn.00402310
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48dcb5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0xc]
push esi
call fcn.0046ae80
add esp, 4
cmp eax, 0xffffffff
jne 0x48dcda
push 0
push 0
push 0x59a7fc
call fcn.00539414
jmp 0x48ddb3
cmp eax, 0xfffffffe
jne 0x48dcf2
push 0
push 0
push 0x5addd8
call fcn.00539414
jmp 0x48ddb3
push 0x5a7eb0
lea ecx, [esp + 0x1c]
call fcn.00402390
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x34], 4
call fcn.00401ae0
add esp, 0xc
push 0x5a7eb0
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34], 5
call fcn.00401ba0
mov eax, dword [eax]
add esp, 0xc
push 5
push 0
push eax
push str.mspaint.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48dd69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48dd8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48ddb3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48ddd4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48ddfc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret