Function at 0x44b470
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3980
mov eax, dword fs:[0]
push eax
mov eax, 0x7864
call fcn.0049ae80
push esi
push edi
push ecx
lea edi, [ebp - 0x7870]
mov ecx, 0x1e19
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4c6280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x34]
call fcn.004104c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
call fcn.00461fd0
add esp, 4
push str.http:__guanjia.qq.com_report_uninstallreason.html_
lea ecx, [ebp - 0x40]
call fcn.0040ff10
mov byte [ebp - 4], 1
call fcn.00464980
call fcn.004659c0
mov dword [ebp - 0x48], eax
call fcn.00464980
call fcn.00465190
test eax, eax
je 0x44b69c
cmp dword [ebp - 0x48], 0
je 0x44b69c
mov byte [ebp - 0x2850], 0
push 0x2800
push 0
lea ecx, [ebp - 0x284f]
push ecx
call fcn.004806d0
add esp, 0xc
mov word [ebp - 0x785c], 0
push 0x5000
push 0
lea edx, [ebp - 0x785a]
push edx
call fcn.004806d0
add esp, 0xc
mov esi, esp
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x7864], eax
mov eax, dword [ebp - 0x7864]
and eax, 0xff
movzx ecx, al
mov dword [ebp - 0x7868], ecx
movzx edx, word [ebp - 0x7864]
sar edx, 8
and edx, 0xff
movzx eax, dl
mov dword [ebp - 0x786c], eax
mov ecx, dword [ebp - 0x7864]
shr ecx, 0x10
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0x7870], edx
lea ecx, [ebp - 0x34]
call fcn.004105d0
push eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x60
call fcn.004105d0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [eax + 0x58]
push edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [eax + 0x50]
push edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [eax + 0x48]
push edx
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax + 0x42]
push ecx
mov edx, dword [ebp - 0x48]
movzx eax, word [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx + 0x3e]
push edx
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax + 0x3c]
push ecx
mov edx, dword [ebp - 0x48]
movzx eax, word [edx + 0x3a]
push eax
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx + 0x38]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x46c]
push ecx
mov edx, dword [eax + 0x468]
push edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [edx + 0x20]
push ecx
mov ecx, dword [ebp - 0x48]
call fcn.004105d0
push eax
mov edx, dword [ebp - 0x7870]
push edx
mov eax, dword [ebp - 0x786c]
push eax
mov ecx, dword [ebp - 0x7868]
push ecx
push str.bgclr_d__d__dstrGuid_suni64Client_version_I64uuiSupplyid_uuni64Qq_num_I64uusSys_major_uusSys_minor_uusSys_build_uusSys_sp_uusArchitecture_uusLanguage_uuni64Ie_version_I64uuni64Office_ver1_I64uuni64Office_ver2_I64ustrQQGuid_susUnInstallResult0strOsVersion_s
push 0x2800
lea edx, [ebp - 0x2850]
push edx
call fcn.00483e35
add esp, 0x68
mov esi, esp
push 0x2800
lea eax, [ebp - 0x785c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x2850]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, esp
call fcn.0049f8de
lea edx, [ebp - 0x785c]
push edx
lea ecx, [ebp - 0x40]
call fcn.00420a90
mov esi, esp
push 0
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00410760
push eax
push 0x4b137c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp esi, esp
call fcn.0049f8de
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x498], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040fde0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00410570
push edx
mov ecx, ebp
push eax
lea edx, [0x44b728]
call fcn.0049f901
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f404
add esp, 0x7870
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret