Function at 0x401e9e
Capabilities:
Check if file exists
Create directory
Delete file
Download url
Get common file path
Receive data

Disassembly:
push 0x8b4
mov eax, 0x4388eb
call fcn.0041bb48
mov esi, ecx
mov ebx, 0x20a
lea eax, [ebp - 0x65c]
xor edi, edi
push ebx
push edi
push eax
mov dword [ebp - 0x8c0], edi
call fcn.0041e010
add esp, 0xc
lea eax, [ebp - 0x65c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.0041e010
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x44c]
push 0x105
push eax
call fcn.00420507
mov ebx, dword [sym.imp.ole32.dll_CoCreateGuid]
lea eax, [ebp - 0x8ac]
add esp, 0x18
push eax
call ebx
lea edx, [ebp - 0x8ac]
lea ecx, [ebp - 0x884]
call fcn.00401d60
mov dword [ebp - 4], edi
cmp dword [ebp - 0x874], edi
jne 0x401f40
lea eax, [ebp - 0x884]
push eax
call fcn.00406a40
pop ecx
mov edi, str..cab
push edi
call fcn.00401253
pop ecx
push eax
push edi
lea ecx, [ebp - 0x884]
call fcn.0040252a
cmp dword [ebp - 0x870], 8
lea eax, [ebp - 0x884]
cmovae eax, dword [ebp - 0x884]
push eax
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x44c]
push eax
call fcn.00401253
pop ecx
push eax
lea eax, [ebp - 0x44c]
push eax
lea ecx, [esi + 0x258]
call fcn.004024b1
xor ecx, ecx
lea eax, [ebp - 0x44c]
push ecx
push ecx
push eax
push str.http:__dl.360safe.com_gf_KitTip_KitTip.cab
push ecx
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x4021ab
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x44c]
push eax
call edi
test eax, eax
je 0x4021ab
push 0x9c40
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x8bc]
push eax
call ebx
lea edx, [ebp - 0x8bc]
lea ecx, [ebp - 0x89c]
call fcn.00401d60
mov byte [ebp - 4], 1
cmp dword [ebp - 0x88c], 0
jne 0x40201d
lea eax, [ebp - 0x89c]
push eax
call fcn.00406a40
pop ecx
push 0x20a
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.0041e010
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x23c]
push 0x105
push eax
call fcn.00420507
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x89c]
add esp, 0x18
cmp dword [ebp - 0x888], 8
cmovae eax, dword [ebp - 0x89c]
push eax
lea eax, [ebp - 0x23c]
push eax
call ebx
push 0x20a
lea eax, [ebp - 0x86c]
push 0
push eax
call fcn.0041e010
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x86c]
push 0x105
push eax
call fcn.00420507
add esp, 0x18
lea eax, [ebp - 0x86c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4b
pop eax
push 0x69
pop ecx
push 0x74
mov word [ebp - 0x2c], ax
pop eax
push 0x54
mov word [ebp - 0x28], ax
pop eax
push 0x70
mov word [ebp - 0x26], ax
pop eax
push 0x2e
mov word [ebp - 0x22], ax
pop eax
push 0x64
mov word [ebp - 0x20], ax
pop eax
mov word [ebp - 0x1e], ax
push 0x6c
pop eax
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x23c]
mov word [ebp - 0x2a], cx
push eax
mov word [ebp - 0x24], cx
call ebx
xor ebx, ebx
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x86c]
push eax
push 0x401e08
push 0
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x23c]
push eax
call edi
test eax, eax
jne 0x402147
inc ebx
cmp ebx, 3
jb 0x402101
lea eax, [ebp - 0x23c]
push eax
call edi
test eax, eax
jne 0x402180
mov dword [esi + 0x28c], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x290], eax
xor esi, esi
inc esi
push 0
push esi
lea ecx, [ebp - 0x89c]
call fcn.0040245a
push 0
push esi
jmp 0x4021c5
lea eax, [ebp - 0x23c]
push eax
call fcn.00401253
pop ecx
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [esi + 0x270]
call fcn.004024b1
xor esi, esi
inc esi
mov dword [ebp - 0x8c0], esi
jmp 0x40216d
mov dword [esi + 0x28c], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov dword [esi + 0x290], eax
push 1
lea ecx, [ebp - 0x884]
call fcn.0040245a
mov eax, dword [ebp - 0x8c0]
call fcn.0041baf2
ret