Function at 0x41c41b
Capabilities:
Create process on windows

Disassembly:
push 0x260
mov eax, 0x438d19
call fcn.00433cb0
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
and dword [ebp - 4], 0
push str.tencent:
lea ecx, [ebp - 0x220]
call esi
push str.txupd
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call esi
push 0x43d8ac
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::MakeLower_void_]
push 0x43cd1c
push 0x43cd14
lea ecx, [ebp + 8]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::Replace_wchar_t_const___wchar_t_const__]
lea ecx, [ebp - 0x220]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::GetLength_void_const]
mov edi, dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_]
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 8]
call edi
lea ecx, [ebp - 0x220]
push ecx
push eax
mov byte [ebp - 4], 4
call dword [0x43a0b8]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop ecx
pop ecx
lea ecx, [ebp - 0x228]
mov bl, al
mov byte [ebp - 4], 3
call esi
test bl, bl
je 0x41c505
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
xor eax, eax
call fcn.00433d33
ret 4
mov ebx, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 0
lea ecx, [ebp - 0x224]
call ebx
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::Find_wchar_t_const___int_const]
cmp eax, 0xffffffff
jne 0x41c557
xor edi, edi
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
mov eax, edi
jmp 0x41c4fd
and word [ebp - 0x218], 0
push 0x206
lea eax, [ebp - 0x216]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t__]
push 0x5c
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const]
test eax, eax
jl 0x41c5ed
inc eax
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
call edi
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 6
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_class_CTXStringW_const__]
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 5
call esi
push str.txupd.exe
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x26c]
push 0
push eax
mov byte [ebp - 4], 7
call sub.MSVCR80.dll_memset
and dword [ebp - 0x264], 0
add esp, 0x18
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], 0x540
mov dword [ebp - 0x260], str.open
call ebx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x25c], eax
call ebx
mov dword [ebp - 0x254], eax
xor edi, edi
lea eax, [ebp - 0x26c]
inc edi
push eax
mov dword [ebp - 0x258], str.__manual
mov dword [ebp - 0x250], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41c6aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.start_up_txupd_failed__last_error__lu
push str.TXUPD
push 2
push str.func
push 0x1bf
push str.file
call fcn.00417e3d
add esp, 0x1c
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call esi
jmp 0x41c526