Function at 0x44ee20
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3570
call fcn.0042a4c0
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x486038
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov word [ebp - 0x1488], 0
push 0x40e
push 0
lea eax, [ebp - 0x1486]
push eax
call fcn.00415680
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push 0x478d2c
push 0x410
push 0x208
lea edx, [ebp - 0x1488]
push edx
call fcn.004157ac
add esp, 0x14
mov dword [0x48a80c], 0
mov dword [0x48a810], 0
mov dword [0x48a814], 0
mov dword [0x48a818], 0
cmp dword [ebp + 0x14], 0
jne 0x44eebb
mov dword [0x48a81c], 0
mov dword [0x48a824], 0
mov dword [0x48a828], 0
mov dword [ebp - 0x1494], 0
mov word [ebp - 0xa48], 0
push 0x206
push 0
lea eax, [ebp - 0xa46]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x2718], 0
push 0x206
push 0
lea ecx, [ebp - 0x2716]
push ecx
call fcn.00415680
add esp, 0xc
lea edx, [ebp - 0x2718]
push edx
lea eax, [ebp - 0xa48]
push eax
push 0x482384
call fcn.004444d0
add esp, 0xc
push str.1.0.0.17
lea ecx, [ebp - 0xa48]
push ecx
call fcn.004383a0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jge 0x44ef61
mov dword [0x48a820], 1
jmp 0x44ef6b
mov dword [0x48a820], 0
mov word [ebp - 0x840], 0
push 0x206
push 0
lea edx, [ebp - 0x83e]
push edx
call fcn.00415680
add esp, 0xc
push 0x4844c8
push str._sProcDll.dll
push 0x208
push 0x104
lea eax, [ebp - 0x840]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x1498], eax
cmp dword [ebp - 0x1498], 0
jne 0x44efde
push 0x486038
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x44f7f3
push str.IsProcRunning
mov edx, dword [ebp - 0x1498]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1074], eax
push str.WaitKillProcRunning
mov eax, dword [ebp - 0x1498]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x214], eax
push str.WaitKillProcIDRunning
mov ecx, dword [ebp - 0x1498]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x148c], eax
push str.IsModuleExist
mov edx, dword [ebp - 0x1498]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc54], eax
cmp dword [ebp - 0x1074], 0
je 0x44f062
cmp dword [ebp - 0x214], 0
je 0x44f062
cmp dword [ebp - 0x148c], 0
je 0x44f062
cmp dword [ebp - 0xc54], 0
jne 0x44f084
mov eax, dword [ebp - 0x1498]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x486038
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x44f7f3
mov byte [ebp - 0xc50], 0
push 0x207
push 0
lea ecx, [ebp - 0xc4f]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x2300], 0
push 0x40e
push 0
lea edx, [ebp - 0x22fe]
push edx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x1490], 0
mov dword [ebp - 0x1ad8], 0
mov dword [ebp - 0x2924], 0
mov dword [ebp - 0x18c4], 0
mov dword [ebp - 0x1078], 0
mov word [ebp - 0x1ad0], 0
push 0x206
push 0
lea eax, [ebp - 0x1ace]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x2920], 0
push 0x206
push 0
lea ecx, [ebp - 0x291e]
push ecx
call fcn.00415680
add esp, 0xc
mov byte [ebp - 0x638], 0
push 0x208
push 0
lea edx, [ebp - 0x637]
push edx
call fcn.00415680
add esp, 0xc
mov byte [ebp - 0x1ef0], 0
push 0x208
push 0
lea eax, [ebp - 0x1eef]
push eax
call fcn.00415680
add esp, 0xc
mov byte [ebp - 0x1070], 0
push 0x208
push 0
lea ecx, [ebp - 0x106f]
push ecx
call fcn.00415680
add esp, 0xc
mov byte [ebp - 0x2510], 0
push 0x208
push 0
lea edx, [ebp - 0x250f]
push edx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 4], 0
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00415680
add esp, 0xc
mov byte [ebp - 0x16b0], 0
push 0x208
push 0
lea ecx, [ebp - 0x16af]
push ecx
call fcn.00415680
add esp, 0xc
mov byte [ebp - 0x18c0], 0
push 0x208
push 0
lea edx, [ebp - 0x18bf]
push edx
call fcn.00415680
add esp, 0xc
lea eax, [ebp - 0x1488]
push eax
call fcn.00414d31
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x148a]
cmp ecx, 0x5c
jne 0x44f291
lea edx, [ebp - 0x1488]
push edx
push 0x478db4
push 0x208
push 0x104
lea eax, [ebp - 0x1ad0]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x1488]
push ecx
push 0x478dd0
push 0x208
push 0x104
lea edx, [ebp - 0x420]
push edx
call fcn.004157ac
add esp, 0x14
lea eax, [ebp - 0x1488]
push eax
push 0x478df4
push 0x208
push 0x104
lea ecx, [ebp - 0x2920]
push ecx
call fcn.004157ac
add esp, 0x14
jmp 0x44f300
lea edx, [ebp - 0x1488]
push edx
push str._sBinGF.dll
push 0x208
push 0x104
lea eax, [ebp - 0x1ad0]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x1488]
push ecx
push str._sBinCommon.dll
push 0x208
push 0x104
lea edx, [ebp - 0x420]
push edx
call fcn.004157ac
add esp, 0x14
lea eax, [ebp - 0x1488]
push eax
push str._sBinTimwp.dll
push 0x208
push 0x104
lea ecx, [ebp - 0x2920]
push ecx
call fcn.004157ac
add esp, 0x14
push 0
push 0
push 0x209
lea edx, [ebp - 0x1ef0]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x1ad0]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0x209
lea ecx, [ebp - 0x16b0]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x420]
push edx
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0x209
lea eax, [ebp - 0x638]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x2920]
push ecx
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x1070]
push edx
lea eax, [ebp - 0x18c4]
push eax
lea ecx, [ebp - 0x1ef0]
push ecx
call dword [ebp - 0xc54]
add esp, 0xc
mov dword [ebp - 0x1490], eax
lea edx, [ebp - 0x18c0]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x16b0]
push ecx
call dword [ebp - 0xc54]
add esp, 0xc
mov dword [ebp - 0x1ad8], eax
lea edx, [ebp - 0x2510]
push edx
lea eax, [ebp - 0x1078]
push eax
lea ecx, [ebp - 0x638]
push ecx
call dword [ebp - 0xc54]
add esp, 0xc
mov dword [ebp - 0x2924], eax
cmp dword [ebp - 0x1490], 0
je 0x44f3f3
lea edx, [ebp - 0x1ad0]
push edx
call fcn.00436040
add esp, 4
cmp dword [ebp - 0x1ad8], 0
je 0x44f40b
lea eax, [ebp - 0x420]
push eax
call fcn.00436040
add esp, 4
cmp dword [ebp - 0x2924], 0
je 0x44f423
lea ecx, [ebp - 0x2920]
push ecx
call fcn.00436040
add esp, 4
cmp dword [0x48a820], 0
je 0x44f542
lea edx, [ebp - 0x2718]
push edx
call fcn.00436040
add esp, 4
mov dword [ebp - 0x2b34], 0
mov byte [ebp - 0x2d48], 0
push 0x208
push 0
lea eax, [ebp - 0x2d47]
push eax
call fcn.00415680
add esp, 0xc
mov byte [ebp - 0x2f58], 0
push 0x208
push 0
lea ecx, [ebp - 0x2f57]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x2b30], 0
push 0x206
push 0
lea edx, [ebp - 0x2b2e]
push edx
call fcn.00415680
add esp, 0xc
cmp dword [ebp - 0x1494], 0
je 0x44f542
push 0x208
lea eax, [ebp - 0x2b30]
push eax
lea ecx, [ebp - 0x2f58]
push ecx
call fcn.00415fa0
add esp, 4
push eax
lea edx, [ebp - 0x2f58]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x2300]
push eax
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x44f51d
lea ecx, [ebp - 0x2b30]
push ecx
lea edx, [ebp - 0x2300]
push edx
push 0x478e78
push 0x410
push 0x208
lea eax, [ebp - 0x2300]
push eax
call fcn.004157ac
add esp, 0x18
jmp 0x44f542
lea ecx, [ebp - 0x2b30]
push ecx
push 0x478e84
push 0x410
push 0x208
lea edx, [ebp - 0x2300]
push edx
call fcn.004157ac
add esp, 0x14
mov word [ebp - 0x1ce0], 0
push 0x206
push 0
lea eax, [ebp - 0x1cde]
push eax
call fcn.00415680
add esp, 0xc
push 0x4880d0
push str._sBinmsimg32.dll
push 0x208
push 0x104
lea ecx, [ebp - 0x1ce0]
push ecx
call fcn.004157ac
add esp, 0x14
lea edx, [ebp - 0x1ce0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x14a0], eax
cmp dword [ebp - 0x14a0], 0
je 0x44f669
mov word [ebp - 0x3160], 0
push 0x206
push 0
lea eax, [ebp - 0x315e]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x1ce0]
push ecx
call fcn.00414d31
add esp, 4
sub eax, 4
push eax
lea edx, [ebp - 0x1ce0]
push edx
push 0x104
lea eax, [ebp - 0x3160]
push eax
call fcn.0041629d
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x3160]
push ecx
push str._s__08X.dll
push 0x208
push 0x104
lea edx, [ebp - 0x3368]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x3368]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f63b
lea ecx, [ebp - 0x3368]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x3368]
push edx
lea eax, [ebp - 0x1ce0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x44f669
push 4
lea ecx, [ebp - 0x3368]
push ecx
lea edx, [ebp - 0x1ce0]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x1ad4], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x1ad4]
push ecx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x1ad4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov word [ebp - 0xe60], 0
push 0x206
push 0
lea ecx, [ebp - 0xe5e]
push ecx
call fcn.00415680
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push str._sTencentQQSafeBase
push 0x208
push 0x104
lea eax, [ebp - 0xe60]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0xe60]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x149c], eax
cmp dword [ebp - 0x149c], 0xffffffff
je 0x44f7d6
mov edx, dword [ebp - 0x149c]
and edx, 0x10
jne 0x44f7d6
lea eax, [ebp - 0xe60]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44f7d6
mov word [ebp - 0x3570], 0
push 0x206
push 0
lea ecx, [ebp - 0x356e]
push ecx
call fcn.00415680
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [ebp - 0xe60]
push edx
push str._s__08X
push 0x208
push 0x104
lea eax, [ebp - 0x3570]
push eax
call fcn.004157ac
add esp, 0x18
lea ecx, [ebp - 0x3570]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f7a8
lea edx, [ebp - 0x3570]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x3570]
push eax
lea ecx, [ebp - 0xe60]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x44f7d6
push 4
lea edx, [ebp - 0x3570]
push edx
lea eax, [ebp - 0xe60]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x1498]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x486038
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret