Function at 0x447cf0
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469925
mov eax, dword fs:[0]
push eax
sub esp, 0xa68
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x224], eax
mov eax, dword [0x4ec618]
and eax, 1
jne 0x447e43
mov ecx, dword [0x4ec618]
or ecx, 1
mov dword [0x4ec618], ecx
mov dword [ebp - 4], 0
push str.bugreport.exe
mov ecx, 0x4ec5e8
call fcn.00430de0
mov byte [ebp - 4], 1
push str.Common.dll
mov ecx, 0x4ec5ec
call fcn.00430de0
mov byte [ebp - 4], 2
push str.GF.dll
mov ecx, 0x4ec5f0
call fcn.00430de0
mov byte [ebp - 4], 3
push str.jgImage.dll
mov ecx, 0x4ec5f4
call fcn.00430de0
mov byte [ebp - 4], 4
push str.jgIOStub.dll
mov ecx, 0x4ec5f8
call fcn.00430de0
mov byte [ebp - 4], 5
push str.libexpat.dll
mov ecx, 0x4ec5fc
call fcn.00430de0
mov byte [ebp - 4], 6
push str.libjpeg6.dll
mov ecx, 0x4ec600
call fcn.00430de0
mov byte [ebp - 4], 7
push str.libpng.dll
mov ecx, 0x4ec604
call fcn.00430de0
mov byte [ebp - 4], 8
push str.xGraphic32.dll
mov ecx, 0x4ec608
call fcn.00430de0
mov byte [ebp - 4], 9
push str.xImage.dll
mov ecx, 0x4ec60c
call fcn.00430de0
mov byte [ebp - 4], 0xa
push str.zlib.dll
mov ecx, 0x4ec610
call fcn.00430de0
mov byte [ebp - 4], 0xb
push str.tinyxml.dll
mov ecx, 0x4ec614
call fcn.00430de0
mov byte [ebp - 4], 0
push 0x46a570
call fcn.00416635
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x644], 0
jmp 0x447e5e
mov edx, dword [ebp - 0x644]
add edx, 1
mov dword [ebp - 0x644], edx
cmp dword [ebp - 0x644], 0xc
jae 0x447f4b
mov eax, dword [ebp - 0x644]
lea ecx, [eax*4 + 0x4ec5e8]
push ecx
lea ecx, [ebp - 0xa58]
call fcn.00431030
mov word [ebp - 0xa54], 0
push 0x206
push 0
lea edx, [ebp - 0xa52]
push edx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x84c], 0
push 0x206
push 0
lea eax, [ebp - 0x84a]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0xa58]
call fcn.004312a0
push eax
push 0x4880d0
push 0x476d54
push 0x208
push 0x104
lea ecx, [ebp - 0xa54]
push ecx
call fcn.004157ac
add esp, 0x18
lea ecx, [ebp - 0xa58]
call fcn.004312a0
push eax
push str.PluginCom.Tencent.NetDiskBinQQDiskBin
push 0x4880d0
push str._s_s_s
push 0x208
push 0x104
lea edx, [ebp - 0x84c]
push edx
call fcn.004157ac
add esp, 0x1c
push 0
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0xa54]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0xa58]
call fcn.004310c0
jmp 0x447e4f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x224], eax
push 0
push 3
push 4
call fcn.0044d8b0
add esp, 0xc
cmp dword [0x48acb0], 0
je 0x447f82
push 0x4840b8
mov edx, dword [0x4846d0]
push edx
call fcn.0045ce20
add esp, 8
push str.dlcore.dll
lea ecx, [ebp - 0x640]
call fcn.00430de0
mov dword [ebp - 4], 0xc
push 0x4840b8
lea ecx, [ebp - 0xa5c]
call fcn.00431060
mov dword [ebp - 0xa68], eax
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa6c], eax
mov byte [ebp - 4], 0xd
push 0x476de8
mov ecx, dword [ebp - 0xa6c]
push ecx
lea edx, [ebp - 0xa60]
push edx
call fcn.004315f0
add esp, 0xc
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0xa74], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x640]
push ecx
mov edx, dword [ebp - 0xa74]
push edx
lea eax, [ebp - 0x220]
push eax
call fcn.00431540
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa60]
call fcn.004310c0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa5c]
call fcn.004310c0
mov word [ebp - 0x42c], 0
push 0x206
push 0
lea ecx, [ebp - 0x42a]
push ecx
call fcn.00415680
add esp, 0xc
mov edx, dword [ebp - 0x640]
push edx
push 0x4880d0
push 0x476dec
push 0x208
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.004157ac
add esp, 0x18
push 0
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x220]
call fcn.004312a0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.00415680
add esp, 0xc
push 0x4880d0
push str.__sBinTencentdl.exe_
push 0x208
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.004157ac
add esp, 0x14
mov word [ebp - 0x63c], 0
push 0x206
push 0
lea ecx, [ebp - 0x63a]
push ecx
call fcn.00415680
add esp, 0xc
push 0x4880d0
push str.__sBin_
push 0x208
push 0x104
lea edx, [ebp - 0x63c]
push edx
call fcn.004157ac
add esp, 0x14
push 0
push 0
push str._install
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x430], eax
mov dword [ebp - 0xa64], 1
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x220]
call fcn.004310c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x640]
call fcn.004310c0
mov eax, dword [ebp - 0xa64]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret