Function at 0x494268
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x2e4
mov eax, 0x4e6178
call fcn.004be9c5
lea eax, [ebp - 0x2a8]
mov ebx, ecx
push eax
mov dword [ebp - 0x224], ebx
call fcn.004928a5
and dword [ebp - 4], 0
mov eax, 0x5159f8
push eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 0x515a10
lea esi, [ebp - 0x2a8]
mov byte [ebp - 4], 1
call fcn.004948cd
push 0x5159f8
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x2a8]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], esi
je 0x494552
cmp byte [ebx + 0x68], 0
je 0x494316
lea esi, [ebp - 0x2a8]
call fcn.00492ac8
xor eax, eax
inc eax
call fcn.004bea48
ret
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebx + 0x68], 1
call fcn.0049a839
push dword [ebx + 0xc]
lea ecx, [ebp - 0x234]
call fcn.0049ab48
lea esi, [ebp - 0x234]
call fcn.0049a93e
call fcn.0049271c
test eax, eax
je 0x494350
call fcn.0049596c
mov eax, dword [ebx + 8]
mov esi, dword [ebp - 0x224]
cmp dword [esi + 0x70], 0
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x244], eax
mov ebx, 0x515a60
jne 0x4944d8
push 0x1c
call fcn.004b9140
mov edi, eax
test edi, edi
pop ecx
je 0x4943b5
mov esi, edi
call fcn.004016f0
lea esi, [edi + 4]
call fcn.004016f0
lea esi, [edi + 8]
call fcn.004016f0
mov esi, dword [ebp - 0x224]
xor eax, eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
jmp 0x4943b7
xor edi, edi
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x26c]
push eax
mov ecx, edi
mov dword [esi + 0x70], edi
call fcn.004a3774
test eax, eax
mov dword [ebp - 0x244], eax
jne 0x494436
cmp dword [esi + 0x6c], eax
jne 0x494436
push 0x10
call fcn.004b9140
mov edi, eax
xor eax, eax
cmp edi, eax
pop ecx
je 0x494420
push eax
push eax
push eax
push eax
mov dword [edi + 4], eax
mov dword [edi], vtable.QMDDetector::CQDWatch.0
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
xor eax, eax
jmp 0x494422
xor edi, edi
cmp edi, eax
mov dword [esi + 0x6c], edi
je 0x494436
mov esi, edi
call fcn.0048ed01
mov esi, dword [ebp - 0x224]
mov ecx, dword [esi + 0x70]
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x49444f
mov edi, ecx
call fcn.004a3a32
mov esi, dword [ebp - 0x224]
jmp 0x494476
cmp eax, 1
jne 0x494473
cmp dword [ecx + 0x18], 0
jne 0x494461
call fcn.004a393b
jmp 0x494476
cmp eax, 1
jne 0x494473
cmp dword [ecx + 0x18], 0
je 0x494473
call fcn.004a3acf
jmp 0x494476
or eax, 0xffffffff
test eax, eax
mov dword [ebp - 0x23c], eax
je 0x4944c0
call fcn.0048ef9f
cmp dword [ebp - 0x244], 1
push ebx
jne 0x4944a5
mov byte [eax + 3], 0xa
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a88], 0x10
jmp 0x4944b9
mov byte [eax + 3], 0xf
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a88], 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esi + 0x70]
test esi, esi
je 0x4944d8
mov edi, esi
call fcn.00494c1e
mov eax, dword [ebp - 0x224]
and dword [eax + 0x70], 0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x23c]
and dword [0x515afc], 0
test eax, eax
mov dword [0x515a98], eax
jne 0x4944fc
or dword [0x515a94], 2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00491b61
mov esi, eax
call fcn.0048ef9f
mov eax, dword [eax + 4]
and dword [esi + 0xc], 0
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x248]
push eax
mov dword [esi + 8], 0xc22
call fcn.00491b61
mov esi, eax
call fcn.0049716c
mov eax, dword [ebp - 0x224]
mov byte [eax + 0x68], 0
xor edi, edi
inc edi
lea esi, [ebp - 0x2a8]
call fcn.00492ac8
mov eax, edi
jmp 0x494310
push 0x40
lea eax, [ebp - 0x2ec]
push esi
push eax
call fcn.004be240
xor eax, eax
mov dword [ebp - 0x258], esi
lea edi, [ebp - 0x254]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 0x208
stosd dword es:[edi], eax
lea eax, [ebp - 0x21e]
push esi
push eax
mov dword [ebp - 0x2f0], 0x44
mov word [ebp - 0x220], si
call fcn.004be240
add esp, 0xc
lea edi, [ebx + 0x2c]
push edi
mov ecx, 0x4ef7d8
call fcn.00401570
test al, al
pop ecx
je 0x494651
lea ecx, [ebp - 0x228]
call fcn.00492786
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov esi, dword [edi]
lea eax, [ecx - 0x10]
sub esi, 0x10
cmp eax, esi
je 0x49460b
cmp dword [esi + 0xc], 0
jl 0x4945fa
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4945fa
call fcn.004012e0
mov dword [ebp - 0x22c], eax
mov eax, esi
call fcn.004010d0
mov eax, dword [ebp - 0x22c]
add eax, 0x10
mov dword [edi], eax
jmp 0x49460b
mov ebx, dword [ecx - 0xc]
push ecx
mov eax, edi
call fcn.00401470
mov ebx, dword [ebp - 0x224]
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0
call fcn.004016d0
mov eax, edi
call fcn.004934a9
mov edx, str.Download_
call fcn.004139a0
mov edx, dword [edi]
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x22c], esp
call fcn.00403710
call fcn.0048f078
add esp, 0x1c
mov edx, str.QQPCDownload.exe
call fcn.004139a0
xor esi, esi
push edi
mov ecx, 0x4ef7d8
call fcn.00413b40
test al, al
pop ecx
je 0x49469a
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49469a
call fcn.0048ef9f
mov ebx, 0x515a60
push ebx
mov byte [eax + 3], 6
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a88], 6
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x494540
mov ecx, dword [edi]
push 0x4f7018
call fcn.0048fde1
mov ecx, dword [edi]
mov dword [esp], 0x4f7018
call fcn.0048fb89
lea eax, [ebx + 0x34]
pop ecx
push eax
mov ecx, 0x4ef7d8
mov dword [ebp - 0x224], eax
call fcn.00401570
test al, al
pop ecx
je 0x494701
mov ecx, dword [ebp - 0x224]
push 1
call fcn.004941e8
test al, al
pop ecx
jne 0x494701
call fcn.0048ef9f
mov ebx, 0x515a60
push ebx
mov byte [eax + 3], 7
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a88], 7
jmp 0x49468c
lea eax, [ebx + 0x38]
push eax
mov ecx, 0x4ef7d8
mov dword [ebp - 0x228], eax
call fcn.00401570
test al, al
pop ecx
je 0x494750
mov ecx, dword [ebp - 0x228]
push 2
call fcn.004941e8
test al, al
pop ecx
jne 0x494750
call fcn.0048ef9f
mov ebx, 0x515a60
push ebx
mov byte [eax + 3], 8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a88], 8
jmp 0x49468c
cmp dword [ebx + 0xc], esi
jne 0x4947a2
push esi
lea edx, [ebp - 0x22c]
mov ecx, str.ProductID
mov dword [ebp - 0x22c], esi
call fcn.0049239c
test eax, eax
pop ecx
jne 0x494795
call fcn.0048ef9f
mov ebx, 0x515a60
push ebx
mov byte [eax + 3], 9
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x515a88], 9
jmp 0x49468c
mov eax, dword [ebp - 0x22c]
cmp eax, esi
mov dword [ebx + 0xc], eax
je 0x4947c9
lea eax, [ebp - 0x240]
push eax
call fcn.0049a839
push dword [ebx + 0xc]
lea ecx, [ebp - 0x240]
call fcn.0049ab48
lea esi, [ebp - 0x240]
call fcn.0049a93e
xor esi, esi
call fcn.0049271c
test eax, eax
je 0x4947d7
call fcn.0049596c
mov eax, dword [ebp - 0x228]
push dword [eax]
mov eax, dword [ebp - 0x224]
push dword [eax]
lea eax, [ebp - 0x220]
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [edi]
push str._s_cmd1_supplyid_d_target_d_cgi_s_productname_s_
push eax
call fcn.004dab63
add esp, 0x1c
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x2f0]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4948a2
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4948a2
mov eax, dword [ebp - 0x228]
push dword [eax]
mov eax, dword [ebp - 0x224]
push dword [eax]
lea eax, [ebp - 0x220]
push dword [ebx + 0xc]
push dword [ebx + 8]
push str.cmd1_supplyid_d_target_d_cgi_s_productname_s_
push eax
call fcn.004dab63
mov eax, dword [edi]
add esp, 0x18
push esi
push esi
lea ecx, [ebp - 0x220]
push ecx
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x4948a2
call fcn.0048ef9f
mov ebx, 0x515a60
push ebx
mov byte [eax + 3], 0xa
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
mov dword [0x515a88], 0xa
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
mov esi, edi
call fcn.00409a20
mov esi, dword [ebp - 0x224]
or eax, 0xffffffff
call fcn.00409a20
mov esi, dword [ebp - 0x228]
or eax, 0xffffffff
call fcn.00409a20
jmp 0x49453d