Function at 0x4950dc
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x2e4
mov eax, 0x4e6268
call fcn.004beaa5
lea eax, [ebp - 0x2a8]
mov ebx, ecx
push eax
mov dword [ebp - 0x224], ebx
call fcn.00491bc2
and dword [ebp - 4], 0
mov eax, 0x5159d8
push eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 0x5159f0
lea esi, [ebp - 0x2a8]
mov byte [ebp - 4], 1
call fcn.00495741
push 0x5159d8
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x2a8]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], esi
je 0x4953c6
cmp byte [ebx + 0x68], 0
je 0x49518a
lea esi, [ebp - 0x2a8]
call fcn.00491de5
xor eax, eax
inc eax
call fcn.004beb28
ret
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebx + 0x68], 1
call fcn.004940ba
push dword [ebx + 0xc]
lea ecx, [ebp - 0x234]
call fcn.004943c9
lea esi, [ebp - 0x234]
call fcn.004941bf
call fcn.0048fc82
test eax, eax
je 0x4951c4
call fcn.004967e0
mov eax, dword [ebx + 8]
mov esi, dword [ebp - 0x224]
cmp dword [esi + 0x70], 0
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x244], eax
mov ebx, 0x515a40
jne 0x49534c
push 0x1c
call fcn.004b9230
mov edi, eax
test edi, edi
pop ecx
je 0x495229
mov esi, edi
call fcn.00416d00
lea esi, [edi + 4]
call fcn.00416d00
lea esi, [edi + 8]
call fcn.00416d00
mov esi, dword [ebp - 0x224]
xor eax, eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
jmp 0x49522b
xor edi, edi
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x26c]
push eax
mov ecx, edi
mov dword [esi + 0x70], edi
call fcn.004a37bc
test eax, eax
mov dword [ebp - 0x244], eax
jne 0x4952aa
cmp dword [esi + 0x6c], eax
jne 0x4952aa
push 0x10
call fcn.004b9230
mov edi, eax
xor eax, eax
cmp edi, eax
pop ecx
je 0x495294
push eax
push eax
push eax
push eax
mov dword [edi + 4], eax
mov dword [edi], vtable.QMDDetector::CQDWatch.0
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
xor eax, eax
jmp 0x495296
xor edi, edi
cmp edi, eax
mov dword [esi + 0x6c], edi
je 0x4952aa
mov esi, edi
call fcn.00492f6e
mov esi, dword [ebp - 0x224]
mov ecx, dword [esi + 0x70]
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x4952c3
mov edi, ecx
call fcn.004a3a7a
mov esi, dword [ebp - 0x224]
jmp 0x4952ea
cmp eax, 1
jne 0x4952e7
cmp dword [ecx + 0x18], 0
jne 0x4952d5
call fcn.004a3983
jmp 0x4952ea
cmp eax, 1
jne 0x4952e7
cmp dword [ecx + 0x18], 0
je 0x4952e7
call fcn.004a3b17
jmp 0x4952ea
or eax, 0xffffffff
test eax, eax
mov dword [ebp - 0x23c], eax
je 0x495334
call fcn.00492549
cmp dword [ebp - 0x244], 1
push ebx
jne 0x495319
mov byte [eax + 3], 0xa
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a68], 0x10
jmp 0x49532d
mov byte [eax + 3], 0xf
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a68], 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esi + 0x70]
test esi, esi
je 0x49534c
mov edi, esi
call fcn.00495a92
mov eax, dword [ebp - 0x224]
and dword [eax + 0x70], 0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x23c]
and dword [0x515adc], 0
test eax, eax
mov dword [0x515a78], eax
jne 0x495370
or dword [0x515a74], 2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0048f0c7
mov esi, eax
call fcn.00492549
mov eax, dword [eax + 4]
and dword [esi + 0xc], 0
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x248]
push eax
mov dword [esi + 8], 0xc22
call fcn.0048f0c7
mov esi, eax
call fcn.00497eec
mov eax, dword [ebp - 0x224]
mov byte [eax + 0x68], 0
xor edi, edi
inc edi
lea esi, [ebp - 0x2a8]
call fcn.00491de5
mov eax, edi
jmp 0x495184
push 0x40
lea eax, [ebp - 0x2ec]
push esi
push eax
call fcn.004be320
xor eax, eax
mov dword [ebp - 0x258], esi
lea edi, [ebp - 0x254]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 0x208
stosd dword es:[edi], eax
lea eax, [ebp - 0x21e]
push esi
push eax
mov dword [ebp - 0x2f0], 0x44
mov word [ebp - 0x220], si
call fcn.004be320
add esp, 0xc
lea edi, [ebx + 0x2c]
push edi
mov ecx, 0x4ef7d8
call fcn.00401550
test al, al
pop ecx
je 0x4954c5
lea ecx, [ebp - 0x228]
call fcn.0048fcec
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov esi, dword [edi]
lea eax, [ecx - 0x10]
sub esi, 0x10
cmp eax, esi
je 0x49547f
cmp dword [esi + 0xc], 0
jl 0x49546e
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x49546e
call fcn.004012d0
mov dword [ebp - 0x22c], eax
mov eax, esi
call fcn.004010d0
mov eax, dword [ebp - 0x22c]
add eax, 0x10
mov dword [edi], eax
jmp 0x49547f
mov ebx, dword [ecx - 0xc]
push ecx
mov eax, edi
call fcn.00401450
mov ebx, dword [ebp - 0x224]
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0
call fcn.00416ce0
mov eax, edi
call fcn.00492622
mov edx, str.Download_
call fcn.00413750
mov edx, dword [edi]
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x22c], esp
call fcn.004036c0
call fcn.0048fe0b
add esp, 0x1c
mov edx, str.QQPCDownload.exe
call fcn.00413750
xor esi, esi
push edi
mov ecx, 0x4ef7d8
call fcn.004138f0
test al, al
pop ecx
je 0x49550e
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49550e
call fcn.00492549
mov ebx, 0x515a40
push ebx
mov byte [eax + 3], 6
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a68], 6
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x4953b4
mov ecx, dword [edi]
push 0x4f7094
call fcn.00490b74
mov ecx, dword [edi]
mov dword [esp], 0x4f7094
call fcn.0049091c
lea eax, [ebx + 0x34]
pop ecx
push eax
mov ecx, 0x4ef7d8
mov dword [ebp - 0x224], eax
call fcn.00401550
test al, al
pop ecx
je 0x495575
mov ecx, dword [ebp - 0x224]
push 1
call fcn.0049505c
test al, al
pop ecx
jne 0x495575
call fcn.00492549
mov ebx, 0x515a40
push ebx
mov byte [eax + 3], 7
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a68], 7
jmp 0x495500
lea eax, [ebx + 0x38]
push eax
mov ecx, 0x4ef7d8
mov dword [ebp - 0x228], eax
call fcn.00401550
test al, al
pop ecx
je 0x4955c4
mov ecx, dword [ebp - 0x228]
push 2
call fcn.0049505c
test al, al
pop ecx
jne 0x4955c4
call fcn.00492549
mov ebx, 0x515a40
push ebx
mov byte [eax + 3], 8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a68], 8
jmp 0x495500
cmp dword [ebx + 0xc], esi
jne 0x495616
push esi
lea edx, [ebp - 0x22c]
mov ecx, str.ProductID
mov dword [ebp - 0x22c], esi
call fcn.0048f902
test eax, eax
pop ecx
jne 0x495609
call fcn.00492549
mov ebx, 0x515a40
push ebx
mov byte [eax + 3], 9
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a68], 9
jmp 0x495500
mov eax, dword [ebp - 0x22c]
cmp eax, esi
mov dword [ebx + 0xc], eax
je 0x49563d
lea eax, [ebp - 0x240]
push eax
call fcn.004940ba
push dword [ebx + 0xc]
lea ecx, [ebp - 0x240]
call fcn.004943c9
lea esi, [ebp - 0x240]
call fcn.004941bf
xor esi, esi
call fcn.0048fc82
test eax, eax
je 0x49564b
call fcn.004967e0
mov eax, dword [ebp - 0x228]
push dword [eax]
mov eax, dword [ebp - 0x224]
push dword [eax]
lea eax, [ebp - 0x220]
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [edi]
push str._s_cmd1_supplyid_d_target_d_cgi_s_productname_s_
push eax
call fcn.004dac53
add esp, 0x1c
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x2f0]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x495716
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x495716
mov eax, dword [ebp - 0x228]
push dword [eax]
mov eax, dword [ebp - 0x224]
push dword [eax]
lea eax, [ebp - 0x220]
push dword [ebx + 0xc]
push dword [ebx + 8]
push str.cmd1_supplyid_d_target_d_cgi_s_productname_s_
push eax
call fcn.004dac53
mov eax, dword [edi]
add esp, 0x18
push esi
push esi
lea ecx, [ebp - 0x220]
push ecx
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x495716
call fcn.00492549
mov ebx, 0x515a40
push ebx
mov byte [eax + 3], 0xa
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
mov dword [0x515a68], 0xa
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
mov esi, edi
call fcn.00409800
mov esi, dword [ebp - 0x224]
or eax, 0xffffffff
call fcn.00409800
mov esi, dword [ebp - 0x228]
or eax, 0xffffffff
call fcn.00409800
jmp 0x4953b1