Function at 0x407fb0
Capabilities:
Create process on windows
Get common file path
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4a0], ecx
push 0x3f6
lea eax, [ebp - 0x45c]
push eax
mov ecx, dword [ebp - 0x4a0]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 4]
call fcn.00407300
lea ecx, [ebp - 4]
call fcn.004090e0
test eax, eax
je 0x408098
push str.yylauncher.exe
push 0x434318
push 0x43e210
lea ecx, [ebp - 0x460]
push ecx
call fcn.00406c00
push eax
lea edx, [ebp - 0x1c]
push edx
call fcn.00406c00
lea ecx, [ebp - 0x460]
call fcn.00401860
lea ecx, [ebp - 0x20]
call fcn.00401bf0
lea eax, [ebp - 0x47c]
push eax
call fcn.0041e7b0
add esp, 4
mov ecx, eax
call fcn.004074a0
push eax
lea ecx, [ebp - 0x20]
call fcn.00401360
lea ecx, [ebp - 0x47c]
call fcn.00407480
push 1
lea ecx, [ebp - 0x20]
call fcn.00411410
push eax
push 0
lea ecx, [ebp - 0x1c]
call fcn.00411410
push eax
push 0x43431c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x20]
call fcn.00401860
lea ecx, [ebp - 0x1c]
call fcn.00401860
push 0x3f4
lea ecx, [ebp - 0x480]
push ecx
mov ecx, dword [ebp - 0x4a0]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 0xc]
call fcn.00407300
lea ecx, [ebp - 0xc]
call fcn.004090e0
test eax, eax
je 0x408122
push str.ReleaseNotes.txt
push 0x43434c
push 0x43e210
lea edx, [ebp - 0x484]
push edx
call fcn.00406c00
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00406c00
lea ecx, [ebp - 0x484]
call fcn.00401860
push 5
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.00411410
push eax
push 0x434350
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x24]
call fcn.00401860
push 0x3f5
lea ecx, [ebp - 0x488]
push ecx
mov ecx, dword [ebp - 0x4a0]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.00411410
push eax
lea ecx, [ebp - 0x18]
call fcn.00407300
lea ecx, [ebp - 0x18]
call fcn.004090e0
test eax, eax
je 0x40828f
lea edx, [ebp - 0x2c]
push edx
push 6
mov eax, dword [ebp - 0x4a0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40828f
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40828f
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x240]
call fcn.00402fc0
push 0
push 0
push 2
push 0
push 0
push 0x1f01ff
push 0x43435c
push 0x434370
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp - 0x48c]
push eax
call fcn.00406c00
push eax
lea ecx, [ebp - 0x490]
push ecx
call fcn.00406c00
mov ecx, eax
call fcn.00411410
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x23c], eax
lea ecx, [ebp - 0x490]
call fcn.00401860
lea ecx, [ebp - 0x48c]
call fcn.00401860
cmp dword [ebp - 0x23c], 0xffffffff
je 0x40827a
push str._InternetShortcut__nURLhttp:__www.duowan.com_index3.html
lea ecx, [ebp - 0x248]
call fcn.00402fc0
lea ecx, [ebp - 0x248]
call fcn.00401c10
shl eax, 1
mov dword [ebp - 0x244], eax
push 0
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x244]
push eax
lea ecx, [ebp - 0x248]
call fcn.00411410
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x248]
call fcn.00401860
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x240]
call fcn.00401860
push 5
push 0
push 0
push 0x434374
push 0x43441c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.installstat.exe
push 0x434448
push 0x43e210
lea ecx, [ebp - 0x494]
push ecx
call fcn.00406c00
push eax
lea edx, [ebp - 0x14]
push edx
call fcn.00406c00
lea ecx, [ebp - 0x494]
call fcn.00401860
lea ecx, [ebp - 8]
call fcn.00401bf0
push 1
push 0x43444c
push str.__s_di_
lea eax, [ebp - 8]
push eax
call fcn.00408680
add esp, 0x10
push 0
mov ecx, 0x43e210
call fcn.00411410
push eax
lea ecx, [ebp - 8]
call fcn.00411410
push eax
lea ecx, [ebp - 0x14]
call fcn.00411410
push eax
push 0x434474
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.yyrun.exe
push 0x434494
push 0x43e210
lea ecx, [ebp - 0x498]
push ecx
call fcn.00406c00
push eax
lea edx, [ebp - 0x10]
push edx
call fcn.00406c00
lea ecx, [ebp - 0x498]
call fcn.00401860
push 0
mov ecx, 0x43e210
call fcn.00411410
push eax
push 0x434498
lea ecx, [ebp - 0x10]
call fcn.00411410
push eax
push 0x4344a4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
je 0x408408
xor ecx, ecx
mov word [ebp - 0x458], cx
push 0x206
push 0
lea edx, [ebp - 0x456]
push edx
call fcn.004227a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x458]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x250]
call fcn.00402fc0
push str.installer_duowanyy.exe
lea ecx, [ebp - 0x250]
call fcn.00403060
push 0
push 0
push 0x4344ec
lea ecx, [ebp - 0x250]
call fcn.00411410
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x250]
call fcn.00401860
mov dword [ebp - 0x49c], 0
lea ecx, [ebp - 0x10]
call fcn.00401860
lea ecx, [ebp - 8]
call fcn.00401860
lea ecx, [ebp - 0x14]
call fcn.00401860
mov eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00422550
mov esp, ebp
pop ebp
ret