Function at 0x448bb0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x49c498]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x111
jne 0x449316
mov eax, dword [ebp + 0x10]
mov ebx, 0x3eb
mov edx, eax
movzx ecx, ax
shr edx, 0x10
cmp bx, cx
jne 0x448ca7
xor ebx, ebx
cmp bx, dx
jne 0x448ca7
mov ecx, dword [edi + 0x60]
test ecx, ecx
je 0x448c33
mov eax, dword [ecx]
lea edx, [ebp - 0x214]
push edx
push 1
push 0x3eb
push ecx
mov dword [ebp - 0x214], ebx
call dword [eax + 0x108]
mov esi, dword [ebp - 0x214]
jmp 0x448c35
xor esi, esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], esi
push eax
lea ecx, [ebp - 0x210]
call fcn.00404e30
test esi, esi
je 0x448c57
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov esi, dword [ebp - 0x210]
test esi, esi
je 0x448c81
mov eax, dword [esi]
push 0x9e
push 0
push esi
call dword [eax + 0x5c]
mov ecx, dword [edi + 0x5c]
test ecx, ecx
je 0x4493ee
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x4c]
push 0
push 0
push dword [edi + 0xd8]
push dword [edi + 0x30]
call dword [sym.imp.USER32.dll_PostMessageW]
test esi, esi
je 0x4493d9
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x4493d9
mov dword [ebp - 0x210], 0x40c
mov ebx, edx
cmp word [ebp - 0x210], cx
jne 0x448da5
mov eax, ebx
mov dword [ebp - 0x210], eax
xor eax, eax
cmp ax, bx
mov eax, dword [ebp + 0x10]
jne 0x448d9f
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0047de77
add esp, 0xc
push str.Utils360Feedback.exe
call fcn.00445f90
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4493d9
call fcn.00403da0
mov ecx, eax
test ecx, ecx
je 0x4493f8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x214]
push str._catlogOther__desc_AI
mov dword [ebp - 0x214], eax
call fcn.00403530
test al, al
jne 0x448d5c
push 0x2d
push str._catlogOther__desc_AI
lea ecx, [ebp - 0x214]
call fcn.004039f0
mov esi, dword [ebp - 0x214]
lea ecx, [ebp - 0x20c]
push 1
sub esp, 8
mov edx, esi
call fcn.00446480
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4493d9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4493d9
mov ebx, dword [ebp - 0x210]
mov dword [ebp - 0x210], 0x3ee
movzx ebx, bx
cmp word [ebp - 0x210], cx
jne 0x448deb
mov dword [ebp - 0x210], 0
cmp word [ebp - 0x210], bx
jne 0x448deb
sub esp, 0x10
mov ecx, edi
call fcn.0044da60
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 0x210], 0x405
cmp word [ebp - 0x210], cx
jne 0x448e11
mov dword [ebp - 0x210], 0
cmp word [ebp - 0x210], bx
je 0x448dce
mov dword [ebp - 0x210], 0x3f5
cmp word [ebp - 0x210], cx
jne 0x448f36
mov dword [ebp - 0x210], 0
mov eax, edx
cmp word [ebp - 0x210], bx
jne 0x448f39
test esi, esi
je 0x4493d9
mov eax, dword [esi]
lea ecx, [ebp - 0x218]
push ecx
push esi
mov dword [ebp - 0x218], 0
call dword [eax + 0xb4]
mov esi, dword [ebp - 0x218]
mov dword [ebp - 0x214], 0
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x448e82
mov eax, dword [esi]
push esi
call dword [eax + 4]
lea ecx, [ebp - 0x214]
call fcn.004050b0
test eax, eax
jns 0x448e9c
cmp eax, 0x80004002
jne 0x449402
test esi, esi
je 0x448ea6
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov esi, dword [ebp - 0x214]
test esi, esi
je 0x4493d9
mov eax, dword [esi]
lea ecx, [ebp - 0x214]
push ecx
push esi
mov dword [ebp - 0x214], 0
call dword [eax + 0xbc]
mov edi, dword [ebp - 0x214]
test edi, edi
je 0x448f2b
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 8]
push 0
push 0x49e624
push 0x49e6f0
push 0
push edi
call fcn.0047e118
mov edi, eax
add esp, 0x14
test edi, edi
je 0x448f2b
push ecx
push dword [edi + 0x68]
push 0x488200
push str.text_btn_list
push ecx
push str.xiaobei_msg_click
push ecx
mov ecx, 0x49db40
call fcn.004332d0
lea eax, [edi + 0x74]
mov ecx, 0x49ccc8
push eax
call fcn.00428410
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x4493d9
shr eax, 0x10
mov dword [ebp - 0x210], 0x3f6
cmp word [ebp - 0x210], cx
jne 0x448f7d
mov dword [ebp - 0x210], 0
mov eax, edx
cmp word [ebp - 0x210], bx
jne 0x448f7d
push esi
sub esp, 0xc
call fcn.0044de40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 0x210], 0x3f7
cmp word [ebp - 0x210], cx
jne 0x448fc1
mov dword [ebp - 0x210], 0
mov eax, edx
cmp word [ebp - 0x210], bx
jne 0x448fc1
push esi
sub esp, 0xc
call fcn.0044e090
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 0x210], 0x3fb
cmp word [ebp - 0x210], cx
jne 0x44905c
mov eax, edx
xor edx, edx
cmp dx, bx
jne 0x44905c
test esi, esi
je 0x4493d9
mov eax, dword [esi]
lea ecx, [ebp - 0x218]
push ecx
push esi
mov dword [ebp - 0x218], edx
call dword [eax + 0xbc]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x449050
push dword [eax]
lea ecx, [ebp - 0x214]
call fcn.00403600
lea eax, [ebp - 0x214]
push eax
lea ecx, [edi + 0x148]
call fcn.0043bc50
mov edx, dword [ebp - 0x214]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x449046
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
sub esp, 0x10
mov ecx, edi
call fcn.0044da60
mov ecx, edi
call fcn.0044fbd0
jmp 0x4493d9
mov edx, 0x3f1
cmp dx, cx
jne 0x44909d
mov dword [ebp - 0x210], 0
mov edx, ebx
cmp word [ebp - 0x210], bx
jne 0x4490a0
push esi
push dword [ebp - 0x214]
sub esp, 8
call fcn.0044eff0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
movzx edx, ax
mov ebx, 0x404
movzx edx, dx
cmp bx, cx
jne 0x4490d2
xor ebx, ebx
cmp bx, dx
jne 0x4490d2
push esi
sub esp, 0xc
mov ecx, edi
call fcn.0044e2e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
mov ebx, 0x40d
cmp bx, cx
jne 0x449131
xor ebx, ebx
cmp bx, dx
jne 0x449131
test esi, esi
je 0x4493d9
cmp dword [0x49d624], ebx
je 0x449114
cmp dword [0x49d204], 5
jbe 0x449114
mov eax, dword [0x49d21c]
test eax, eax
je 0x449114
push str.http:__www.360.cn_safeBrain__from360ia
call eax
test eax, eax
jne 0x4493d9
push 5
push 0
push 0
push str.http:__www.360.cn_safeBrain__from360ia
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4493d9
mov ebx, 0x424
cmp bx, cx
jne 0x449172
mov dword [ebp - 0x210], 0
mov ebx, eax
cmp word [ebp - 0x210], dx
jne 0x449178
push esi
push dword [ebp - 0x214]
sub esp, 8
call fcn.0044eb30
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [ebp + 0x10]
shr ebx, 0x10
mov dword [ebp - 0x210], 0x438
cmp word [ebp - 0x210], cx
jne 0x4491a0
mov dword [ebp - 0x210], 0
mov ebx, eax
cmp word [ebp - 0x210], dx
je 0x4491f7
mov dword [ebp - 0x210], 0x433
cmp word [ebp - 0x210], cx
jne 0x4491c8
mov dword [ebp - 0x210], 0
mov ebx, eax
cmp word [ebp - 0x210], dx
je 0x4491f7
mov dword [ebp - 0x210], 0x431
cmp word [ebp - 0x210], cx
jne 0x4491e4
mov ebx, eax
xor eax, eax
cmp ax, dx
je 0x4491f7
mov eax, 0x43a
cmp ax, cx
jne 0x449213
xor ebx, ebx
mov eax, edx
cmp bx, dx
jne 0x449216
push esi
sub esp, 0xc
call fcn.0044eca0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
movzx eax, bx
movzx edx, ax
mov eax, 0x43b
cmp ax, cx
jne 0x44922a
xor eax, eax
cmp ax, dx
je 0x4491f7
mov eax, 0x43e
cmp ax, cx
jne 0x44923b
xor eax, eax
cmp ax, dx
je 0x4491f7
mov eax, 0x445
cmp ax, cx
jne 0x449268
xor eax, eax
cmp ax, dx
jne 0x449268
push esi
sub esp, 0xc
call fcn.0044eeb0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x440
cmp ax, cx
jne 0x449279
xor eax, eax
cmp ax, dx
je 0x44924c
lea eax, [ecx - 0x410]
cmp ax, 8
ja 0x4492a8
xor eax, eax
cmp ax, dx
jne 0x4492a8
push esi
push ecx
push ecx
push ecx
call fcn.0044e470
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ecx - 0x429]
cmp ax, 2
ja 0x4492dd
xor eax, eax
cmp ax, dx
jne 0x4492dd
push esi
push dword [ebp - 0x214]
sub esp, 8
call fcn.0044e7d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ecx - 0x42d]
cmp ax, 2
ja 0x4493d9
xor eax, eax
cmp ax, dx
jne 0x4493d9
push esi
push ecx
push ecx
push ecx
mov ecx, edi
call fcn.0044e600
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 0x7ed
jne 0x4493b9
test esi, esi
je 0x4493d9
mov eax, dword [esi]
lea ecx, [ebp - 0x218]
push ecx
push esi
mov dword [ebp - 0x218], 0
call dword [eax + 0x2c]
mov eax, 0x405
cmp ax, word [ebp - 0x218]
jne 0x4493d9
push ecx
mov eax, esp
push esi
mov dword [eax], esi
mov eax, dword [esi]
call dword [eax + 4]
xor ecx, ecx
call fcn.00404330
mov ecx, dword [edi + 0x60]
add esp, 4
test ecx, ecx
je 0x4493d9
mov eax, dword [ecx]
lea edx, [ebp - 0x214]
push edx
push 1
push 0x408
push ecx
mov dword [ebp - 0x214], 0
call dword [eax + 0x108]
mov esi, dword [ebp - 0x214]
test esi, esi
je 0x4493d9
mov eax, dword [esi]
push 0x10000000
push 0
push esi
call dword [eax + 0x5c]
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x9c]
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x4493d9
cmp eax, 0x4e
jne 0x4493d9
test esi, esi
je 0x4493d9
mov eax, dword [esi]
lea ecx, [ebp - 0x210]
push ecx
push esi
mov dword [ebp - 0x210], 0
call dword [eax + 0x2c]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 0x14
push 0x80004003
call fcn.00469080
push 0x80004005
call fcn.00403b50
push eax
call fcn.00469080
int3