Function at 0x48bcb7
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path

Disassembly:
push 0x8a4
mov eax, 0x4e4e6d
call fcn.004b5257
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x844], ebx
mov dword [ebp - 0x848], ecx
mov dword [ebp - 0x84c], eax
mov dword [eax], ebx
cmp ecx, ebx
je 0x48bd08
push str._TSinstall
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x48bd08
mov dword [0x53fedc], 1
xor eax, eax
call fcn.004b52da
ret
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004b4620
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [ebp - 0x420], bx
je 0x48bd00
lea ecx, [ebp - 0x83c]
call fcn.0040c7d0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x83c]
push eax
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x840], esp
push str.Path
call fcn.0044bc85
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x834], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
call fcn.0044bc85
mov byte [ebp - 4], 2
push 0x80000002
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x86c]
call fcn.00443769
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x844], 1
call fcn.0044b15c
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
test eax, eax
je 0x48bdc4
push dword [ebp - 0x83c]
call edi
mov byte [ebp - 0x835], 1
test eax, eax
jne 0x48bdca
mov byte [ebp - 0x835], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x844], 1
and dword [ebp - 0x844], 0xfffffffe
lea ecx, [ebp - 0x86c]
call fcn.00443c39
cmp byte [ebp - 0x835], bl
je 0x48bebe
mov eax, dword [ebp - 0x83c]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x83c]
call fcn.0046f6d0
cmp ax, 0x5c
je 0x48be1e
push 0x5c
lea ecx, [ebp - 0x83c]
call fcn.004452a8
mov eax, dword [ebp - 0x83c]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x834]
call fcn.0044bc85
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x834]
mov eax, dword [ebp - 0x840]
cmp dword [ecx - 0xc], eax
jle 0x48beb0
dec eax
push eax
lea ecx, [ebp - 0x834]
call fcn.0046f6d0
cmp ax, 0x5c
jne 0x48beb0
push ebx
push dword [ebp - 0x840]
lea ecx, [ebp - 0x834]
call fcn.00484611
push dword [ebp - 0x83c]
lea ecx, [ebp - 0x834]
call fcn.0043f457
test eax, eax
jne 0x48beb0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x834]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x83c]
call fcn.0040d610
jmp 0x48bd00
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x834]
call fcn.0040d610
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004b4620
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
push str.Program_Files__x86_
mov word [ebp - 0x212], ax
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.0040b680
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x48bf2b
push str.Program_Files
mov word [ebp - 0x212], ax
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.0040b680
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x48be9c
mov dword [ebp - 0x834], ebx
lea ecx, [ebp - 0x840]
call fcn.0040c7d0
mov byte [ebp - 4], 5
push dword [ebp - 0x834]
push ebx
call fcn.004b5d2c
pop ecx
push edx
push eax
lea eax, [ebp - 0x840]
push str._I64u__d
push eax
call fcn.0040e3f0
add esp, 0x14
push 0x4f8b70
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.0040b680
push dword [ebp - 0x840]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0040b680
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x48bfcb
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x840]
call fcn.0040d610
mov eax, dword [ebp - 0x834]
inc dword [ebp - 0x834]
cmp eax, 0xa
jl 0x48bf42
jmp 0x48bfd9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x840]
call fcn.0040d610
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.004b4620
lea eax, [ebp - 0x420]
push eax
call fcn.004b5d07
add esp, 0x10
jmp 0x48c01f
movzx ecx, word [ebp + eax*2 - 0x422]
dec eax
cmp cx, 0x5c
je 0x48c024
cmp cx, 0x2f
je 0x48c024
cmp eax, ebx
jg 0x48c00a
dec eax
cmp eax, ebx
jle 0x48c03d
lea eax, [ebp + eax*2 - 0x41e]
push eax
push esi
lea eax, [ebp - 0x830]
push eax
call fcn.0040b640
lea eax, [ebp - 0x830]
push eax
call fcn.004b5d07
pop ecx
test eax, eax
jbe 0x48be9c
push 0x208
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x628]
push eax
call fcn.0040b640
push 0x4f8b70
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.0040b680
lea eax, [ebp - 0x830]
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.0040b680
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x48c0bb
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x48c0f4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x83c]
call fcn.0040d610
mov eax, ebx
jmp 0x48bd02
push ebx
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x540ca8
call fcn.004a6717
test eax, eax
je 0x48c27d
cmp dword [ebp - 0x848], ebx
je 0x48c126
push dword [ebp - 0x848]
call fcn.004b5d07
pop ecx
mov edi, eax
jmp 0x48c128
xor edi, edi
lea eax, [ebp - 0x218]
push eax
call fcn.004b5d07
mov dword [esp], 0x541444
lea edi, [edi + eax + 0x1e]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b60d0
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x48c27d
mov eax, dword [ebp - 0x848]
cmp eax, ebx
je 0x48c189
cmp word [eax], bx
je 0x48c189
push eax
lea eax, [ebp - 0x218]
push eax
push str.__s___s__TSinstall
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x48c19f
lea eax, [ebp - 0x218]
push eax
push str.__s___TSinstall
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x8ac]
push ebx
push eax
call fcn.004b4620
xor eax, eax
mov dword [ebp - 0x85c], ebx
lea edi, [ebp - 0x858]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
xor eax, eax
inc eax
mov word [ebp - 0x880], ax
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x8b0]
push eax
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 0x8b0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
mov edi, eax
call fcn.004ae180
pop ecx
cmp edi, ebx
je 0x48c27d
cmp dword [ebp - 0x85c], ebx
je 0x48c27d
push dword [ebp - 0x858]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0xffffffffffffffff
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp - 0x84c]
push esi
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x48c246
mov dword [esi], 0x64
push dword [ebp - 0x85c]
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x628]
push eax
call fcn.0044e746
pop ecx
pop ecx
jmp 0x48c0de
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
jmp 0x48c26a