Function at 0x414d70
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43e2f1
mov eax, dword fs:[0]
push eax
sub esp, 0x7e4
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x7e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x7f8]
mov dword fs:[0], eax
mov ecx, 9
mov esi, str.UserDataImportSet
lea edi, [esp + 0xe4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x44219c]
mov dword [esp + 0xa0], ecx
mov ecx, dword [0x4421a8]
mov dword [esp + 0xac], ecx
mov ecx, dword [0x44259c]
mov dword [esp + 0xb8], ecx
mov ecx, dword [0x4425a8]
mov dword [esp + 0xc4], ecx
mov ecx, 9
mov esi, str.OldVerDataPathType
lea edi, [esp + 0x178]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ebp, 7
mov edx, dword [0x4421a0]
mov ecx, ebp
mov esi, str.OldVerDataPath
lea edi, [esp + 0x134]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [str.UserDataSet]
movsw word es:[edi], word [esi]
mov ecx, 0xa
mov esi, str.OldQQCRMInstallPath
lea edi, [esp + 0x1b4]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa
mov esi, str.UserDataSavePathType
lea edi, [esp + 0x108]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xa4], edx
mov edx, dword [0x4421ac]
movsw word es:[edi], word [esi]
mov dword [esp + 0x9c], eax
mov eax, dword [0x4421a4]
mov dword [esp + 0xb0], edx
mov edx, dword [0x4425a0]
mov ecx, 8
mov esi, str.UserDataSavePath
lea edi, [esp + 0x154]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x442624]
mov dword [esp + 0xa8], eax
mov eax, dword [str.OldVersion]
mov dword [esp + 0xbc], edx
movzx edx, word [0x4425ac]
mov dword [esp + 0xb4], eax
mov eax, dword [0x4425a4]
mov word [esp + 0xc8], dx
mov edx, dword [0x442628]
mov dword [esp + 0xc0], eax
mov eax, dword [str.NewVersion]
mov dword [esp + 0xd4], edx
movzx edx, word [0x442634]
mov dword [esp + 0xcc], eax
mov eax, dword [0x44262c]
mov dword [esp + 0xd0], ecx
mov ecx, dword [0x442630]
xor ebx, ebx
movsw word es:[edi], word [esi]
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], ecx
mov word [esp + 0xe0], dx
mov dword [esp + 0x98], ebp
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], bx
lea ecx, [esp + 0x80]
mov dword [esp + 0x800], ebx
call fcn.0040dd30
call fcn.00414260
push 0x206
lea eax, [esp + 0x1e2]
push ebx
push eax
mov word [esp + 0x1e8], bx
call fcn.00429d70
add esp, 0xc
cmp dword [esp + 0x98], 8
mov eax, dword [esp + 0x84]
jae 0x414f75
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x94]
push ecx
push eax
lea edx, [esp + 0x1e4]
push edx
call fcn.00424e97
mov eax, dword [esp + 0xa0]
add eax, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov ecx, 0x5c
jl 0x414fba
cmp word [esp + eax*2 + 0x1dc], cx
je 0x414fb2
sub eax, 1
jns 0x414fa1
jmp 0x414fba
mov word [esp + eax*2 + 0x1dc], bx
lea ecx, [esp + 0x1dc]
call fcn.0041db10
mov eax, 0x450e98
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x414fd0
sub eax, edx
sar eax, 1
je 0x415015
mov ecx, str.20.65.0.0.264
mov eax, 0x450e98
call fcn.0041cf00
test eax, eax
jle 0x415015
cmp dword [esp + 0x98], 8
jb 0x41500e
mov eax, dword [esp + 0x84]
push eax
call fcn.004250ac
add esp, 4
xor eax, eax
jmp 0x4155c3
push 0x206
lea ecx, [esp + 0x1e2]
push ebx
push ecx
mov word [esp + 0x1e8], bx
call fcn.00429d70
add esp, 0xc
push ebx
push 0x441b18
lea esi, [esp + 0x6c]
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], bx
call fcn.00401d00
push 1
push 5
lea edx, [esp + 0x1e4]
push edx
mov byte [esp + 0x80c], 1
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
call edi
test eax, eax
je 0x4150e7
lea eax, [esp + 0x1dc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x415080
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1e0]
push eax
lea esi, [esp + 0x6c]
call fcn.00401d00
mov eax, dword [esp + 0x78]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4150b1
call fcn.0042588d
cmp dword [esp + 0x7c], 8
mov eax, dword [esp + 0x68]
jae 0x4150c0
lea eax, [esp + 0x68]
cmp word [eax + esi*2], 0x5c
je 0x4150d7
push 1
push 0x4420e8
lea ecx, [esp + 0x6c]
call fcn.0040ff40
push 0xc
push str.QQCRM_Files_
lea ecx, [esp + 0x6c]
call fcn.0040ff40
mov eax, dword [esp + 0x68]
mov esi, 8
cmp dword [esp + 0x7c], esi
jae 0x4150fa
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415116
cmp dword [esp + 0x7c], esi
mov eax, dword [esp + 0x68]
jae 0x415113
lea eax, [esp + 0x68]
push eax
jmp 0x41511b
push 0x441b18
push 0x441d18
push 0x208
push 0x104
push 0x44f428
call fcn.00425032
add esp, 0x14
mov byte [esp + 0x800], bl
cmp dword [esp + 0x7c], esi
jb 0x415151
mov ecx, dword [esp + 0x68]
push ecx
call fcn.004250ac
add esp, 4
push ebx
push 0x441b18
lea esi, [esp + 0x6c]
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], bx
call fcn.00401d00
mov byte [esp + 0x800], 2
cmp dword [0x44d6b8], 1
jne 0x415247
mov ebp, 1
push ebp
push 5
lea edx, [esp + 0x1e4]
push edx
push ebx
call edi
test eax, eax
je 0x41521c
lea eax, [esp + 0x1dc]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4151b0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1e0]
push eax
lea esi, [esp + 0x6c]
call fcn.00401d00
mov eax, dword [esp + 0x78]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4151e1
call fcn.0042588d
mov eax, dword [esp + 0x68]
mov edi, 8
cmp dword [esp + 0x7c], edi
jae 0x4151f4
lea eax, [esp + 0x68]
cmp word [eax + esi*2], 0x5c
je 0x41520a
push ebp
push 0x4420e8
lea ecx, [esp + 0x6c]
call fcn.0040ff40
push 0xe
push 0x4420ec
lea ecx, [esp + 0x6c]
call fcn.0040ff40
jmp 0x415221
mov edi, 8
cmp dword [esp + 0x7c], edi
mov ecx, dword [esp + 0x68]
jae 0x41522f
lea ecx, [esp + 0x68]
mov edx, 0x44f220
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x415234
jmp 0x415270
push 0x44f018
push 0x442658
push 0x208
push 0x104
push 0x44f220
call fcn.00425032
mov edi, 8
add esp, 0x14
lea ebp, [edi - 7]
cmp dword [esp + 0x7c], edi
jb 0x415283
mov ecx, dword [esp + 0x68]
push ecx
call fcn.004250ac
add esp, 4
mov eax, 0x450e98
lea edx, [eax + 2]
jmp 0x415290
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x415290
sub eax, edx
sar eax, 1
mov eax, dword [esp + 0x84]
je 0x4152d0
cmp dword [esp + 0x98], edi
jae 0x4152b8
lea eax, [esp + 0x84]
push eax
push 0x450e98
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0xf0]
push eax
jmp 0x4152f6
cmp dword [esp + 0x98], edi
jae 0x4152e0
lea eax, [esp + 0x84]
push eax
push 0x44f838
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0xf0]
push edx
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call esi
cmp dword [esp + 0x98], edi
mov eax, dword [esp + 0x84]
jae 0x415315
lea eax, [esp + 0x84]
push eax
push 0x442f4c
lea eax, [esp + 0x180]
push eax
lea ecx, [esp + 0xf0]
push ecx
call esi
cmp dword [esp + 0x98], edi
mov eax, dword [esp + 0x84]
jae 0x415344
lea eax, [esp + 0x84]
push eax
push 0x44f428
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0xf0]
push eax
call esi
cmp dword [esp + 0x98], edi
mov eax, dword [esp + 0x84]
jae 0x415373
lea eax, [esp + 0x84]
push eax
push 0x441b18
lea ecx, [esp + 0x1bc]
push ecx
lea edx, [esp + 0xf0]
push edx
call esi
mov ecx, dword [0x4514d4]
push 0xa
lea eax, [esp + 0x1a4]
push eax
push ecx
call fcn.00425a21
mov eax, dword [esp + 0x90]
add esp, 0xc
cmp dword [0x44d6b8], ebp
jne 0x4153db
cmp dword [esp + 0x98], edi
jae 0x4153c3
lea eax, [esp + 0x84]
push eax
push 0x442654
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0xa8]
push eax
jmp 0x415401
cmp dword [esp + 0x98], edi
jae 0x4153eb
lea eax, [esp + 0x84]
push eax
push 0x442f50
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0xa8]
push edx
call esi
cmp dword [esp + 0x98], edi
mov eax, dword [esp + 0x84]
jae 0x41541a
lea eax, [esp + 0x84]
push eax
push 0x44f220
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0xa8]
push ecx
call esi
cmp dword [esp + 0x98], edi
mov eax, dword [esp + 0x84]
jae 0x415449
lea eax, [esp + 0x84]
push eax
push 0x450880
lea edx, [esp + 0xd4]
push edx
lea eax, [esp + 0xa8]
push eax
call esi
push 0x206
lea ecx, [esp + 0x5f2]
push ebx
push ecx
mov word [esp + 0x5f8], bx
call fcn.00429d70
add esp, 0xc
push 0x206
lea edx, [esp + 0x3ea]
push ebx
push edx
mov word [esp + 0x3f0], bx
call fcn.00429d70
mov eax, 0x44f018
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4154a5
sub eax, edx
sar eax, 1
cmp word [eax*2 + 0x44f016], 0x5c
push 0x44f018
jne 0x4154dd
push 0x442f54
push 0x208
push 0x104
lea eax, [esp + 0x3f4]
push eax
jmp 0x4154f4
push str._sBin_
push 0x208
push 0x104
lea ecx, [esp + 0x3f4]
push ecx
call fcn.00425032
add esp, 0x14
push str.StorageTool.exe__fromQQ
lea edx, [esp + 0x3e8]
push edx
push str._s_s
push 0x208
lea eax, [esp + 0x5fc]
push 0x104
push eax
call fcn.00425032
add esp, 0x18
push 0x44f428
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4155a8
push 0x44
lea ecx, [esp + 0x20]
push ebx
push ecx
call fcn.00429d70
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x64]
push edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3ec]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x60c]
push edx
push ebx
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x70], ebp
mov word [esp + 0x74], bp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4155a8
mov eax, dword [esp + 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x68]
push ecx
call esi
cmp dword [esp + 0x98], edi
jb 0x4155c1
mov edx, dword [esp + 0x84]
push edx
call fcn.004250ac
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x7f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e0]
xor ecx, esp
call fcn.00424e88
add esp, 0x7f0
ret