Function at 0x461f20
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469b20
mov eax, dword fs:[0]
push eax
mov eax, 0x150c
call fcn.0042a4c0
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [0x4846d0], eax
call fcn.0043be40
test eax, eax
jne 0x461f67
xor eax, eax
jmp 0x46265f
mov dword [ebp - 0x220], 0
mov word [ebp - 0x634], 0
push 0x206
push 0
lea ecx, [ebp - 0x632]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x42c], 0
push 0x206
push 0
lea edx, [ebp - 0x42a]
push edx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea edx, [ebp - 0x634]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea ecx, [ebp - 0x634]
push ecx
push str._sTencentLogsQQInstall.txt
push 0x208
push 0x104
lea edx, [ebp - 0x42c]
push edx
call fcn.004157ac
add esp, 0x14
mov eax, dword [ebp + 0x10]
push eax
call fcn.00436480
add esp, 4
cmp dword [0x48acb0], 0
je 0x462137
push 0x486038
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x486068
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x486050
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004626e0
add esp, 4
mov edx, dword [ebp + 0x10]
push edx
push 0x479efc
push 0x400
push 0x200
lea eax, [ebp - 0xc4c]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0xc4c]
push ecx
call fcn.004626a0
add esp, 4
xor edx, edx
jne 0x462061
xor eax, eax
cmp dword [0x48acb0], 0
setne al
push eax
push 0x479f18
push 0x400
push 0x200
lea ecx, [ebp - 0x104c]
push ecx
call fcn.004157ac
add esp, 0x14
lea edx, [ebp - 0x104c]
push edx
call fcn.004626a0
add esp, 4
xor eax, eax
jne 0x462096
call fcn.00460f60
push 0x479f28
push 0x400
push 0x200
lea ecx, [ebp - 0x144c]
push ecx
call fcn.004157ac
add esp, 0x10
lea edx, [ebp - 0x144c]
push edx
call fcn.004626a0
add esp, 4
xor eax, eax
jne 0x4620d9
call fcn.00437300
push 0x486038
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x486068
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x486050
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
jmp 0x46265f
call fcn.004614c0
test eax, eax
je 0x46229c
lea ecx, [ebp - 0x1484]
call fcn.00401190
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1468]
call fcn.00401190
mov byte [ebp - 4], 1
push 0x479f44
lea ecx, [ebp - 0x14c0]
call fcn.004011c0
mov byte [ebp - 4], 2
push 0x479f58
lea ecx, [ebp - 0x14dc]
call fcn.004011c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14c0]
push ecx
lea edx, [ebp - 0x14dc]
push edx
lea eax, [ebp - 0x1484]
push eax
call fcn.00442ad0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14dc]
call fcn.00401200
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14c0]
call fcn.00401200
push 0x479fec
lea ecx, [ebp - 0x14f8]
call fcn.004011c0
mov byte [ebp - 4], 4
push 0x47a000
lea ecx, [ebp - 0x1514]
call fcn.004011c0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14f8]
push ecx
lea edx, [ebp - 0x1514]
push edx
lea eax, [ebp - 0x1468]
push eax
call fcn.00442ad0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1514]
call fcn.00401200
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14f8]
call fcn.00401200
push 0x40
lea ecx, [ebp - 0x1468]
call fcn.00401220
push eax
lea ecx, [ebp - 0x1484]
call fcn.00401220
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [0x489b40], 5
mov dword [0x489b44], 1
call fcn.00440d80
mov dword [ebp - 0x1518], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1468]
call fcn.00401200
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1484]
call fcn.00401200
mov eax, dword [ebp - 0x1518]
jmp 0x46265f
call fcn.00461310
test eax, eax
je 0x4622ac
xor eax, eax
jmp 0x46265f
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004626e0
add esp, 4
call fcn.0044c7f0
mov edx, dword [0x4846d0]
push edx
call fcn.0045a7d0
add esp, 4
call fcn.0044bd20
push 0x485c1c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x486068
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x486050
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x486038
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.004398d0
test eax, eax
je 0x46230e
call fcn.00448d60
push str._TXQQ0824
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x48628c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46234c
push 0x30
push 0x47a040
push 0x47a068
push 0
call fcn.00458ce0
add esp, 0x10
xor eax, eax
jmp 0x46265f
mov dword [ebp - 0x840], 0
push str._TXTM0824
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x840], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x462395
push 0x30
push str._ProductName_
push 0x47a0c8
push 0
call fcn.00458ce0
add esp, 0x10
xor eax, eax
jmp 0x46265f
mov eax, dword [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.00440980
add esp, 4
test eax, eax
jne 0x4623bc
call fcn.00440d80
xor eax, eax
jmp 0x46265f
push 1
push 0
call fcn.00440340
add esp, 8
test eax, eax
jne 0x4623ec
mov dword [0x489b40], 2
mov dword [0x489b44], 2
call fcn.00440d80
xor eax, eax
jmp 0x46265f
push 1
push 0
call fcn.00440280
add esp, 8
test eax, eax
jne 0x46241c
mov dword [0x489b40], 2
mov dword [0x489b44], 2
call fcn.00440d80
xor eax, eax
jmp 0x46265f
push 0x47a100
call fcn.00438490
add esp, 4
call fcn.00460f60
call fcn.00460f50
mov dword [ebp - 0x844], 0
push 0x485c1c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4842c0
mov ecx, dword [0x4846d0]
push ecx
call fcn.0045cea0
add esp, 8
mov dword [ebp - 0x844], eax
push 0x485c1c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x45a3a0
push 0
push 0x3ea
mov edx, dword [0x4846d0]
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x462525
call fcn.00459330
cmp dword [ebp - 0x844], 0
jne 0x4624a4
call fcn.00461120
push 0x6d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [ebp - 0x1488], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x14a4]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x462520
cmp dword [ebp - 0x14a0], 0x1400
jne 0x4624e5
mov edx, dword [ebp - 0x1498]
mov dword [0x486290], edx
lea eax, [ebp - 0x14a4]
push eax
mov ecx, dword [ebp - 0x1488]
push ecx
mov edx, dword [ebp - 0x14a4]
push edx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x46251e
lea eax, [ebp - 0x14a4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x14a4]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4624b6
call fcn.004592c0
mov dword [ebp - 0x84c], 0
lea edx, [ebp - 0x84c]
push edx
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x83c]
push eax
mov ecx, dword [ebp - 0x84c]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x4880d0
push str.BinGF.dll
call fcn.00438340
add esp, 8
push 0x4880d0
push str.BinCommon.dll
call fcn.00438340
add esp, 8
push 0x4880d0
push str.BinTimwp.dll
call fcn.00438340
add esp, 8
push 0x4880d0
push str.BinTXPlatform.exe
call fcn.00438340
add esp, 8
push 0x4880d0
push str.BinTXPFProxy.dll
call fcn.00438340
add esp, 8
push 0x4880d0
push str.BinCPHelper.dll
call fcn.00438340
add esp, 8
push 0x4880d0
push str.BinTXFTNActiveX.dll
call fcn.00438340
add esp, 8
push 0x4844c8
call fcn.00438d00
add esp, 4
mov dword [ebp - 0x848], eax
push 0x4842c0
call fcn.00438d00
add esp, 4
mov dword [ebp - 0x848], eax
push 0x4840b8
call fcn.00438d00
add esp, 4
mov dword [ebp - 0x848], eax
push 0x485c1c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x486068
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x486050
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x486038
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.00448ea0
call fcn.0045a7b0
call fcn.00448c80
call fcn.00462680
mov edx, dword [0x48628c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00440d80
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret 0x10