Function at 0x410dd9
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
sub esp, 0xa2c
mov edx, dword [esp + 0xa34]
push ebx
push ebp
push esi
test edx, edx
push edi
mov dword [esp + 0x10], ecx
je 0x410f6a
cmp word [edx], 0
je 0x410f6a
and word [esp + 0x62c], 0
mov ebx, 0x81
mov ecx, ebx
xor eax, eax
lea edi, [esp + 0x62e]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str._sextensions
lea eax, [esp + 0x634]
push 0x103
push eax
call ebp
lea eax, [esp + 0x63c]
push 0x7d0
push eax
call fcn.00415126
add esp, 0x18
mov esi, str.360sess.exe
lea edi, [esp + 0x834]
xor eax, eax
push 6
and word [esp + 0x18], ax
pop ecx
and word [esp + 0x424], 0
rep movsd dword es:[edi], dword [esi]
push 0x7c
lea edi, [esp + 0x850]
pop ecx
rep stosd dword es:[edi], eax
mov ecx, ebx
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push dword [esp + 0xa44]
mov ecx, ebx
xor eax, eax
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._sShield360SESS
lea eax, [esp + 0x42c]
push 0x103
push eax
call ebp
lea eax, [esp + 0x24]
push 0x104
push eax
lea eax, [esp + 0x84c]
push eax
lea eax, [esp + 0x440]
push eax
call fcn.004154cc
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
test eax, eax
je 0x410f79
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x410f79
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x410f79
push 0x31
push dword [0x42b934]
push 0x42a234
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x410f6a
lea eax, [esp + 0x14]
push 0x1388
push eax
call fcn.00414f93
pop ecx
pop ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x410f79
push 0x35
push dword [0x42b934]
push 0x42a1fc
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
je 0x410f2e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 0x10
and word [esp + 0x21c], 0
mov ecx, ebx
xor eax, eax
lea edi, [esp + 0x21e]
rep stosd dword es:[edi], eax
push str.360se.exe.bak
push dword [esp + 0xa48]
stosw word es:[edi], ax
push 0x425944
lea eax, [esp + 0x228]
push 0x103
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x14
lea eax, [esp + 0x21c]
push eax
call edi
mov ebp, dword [esp + 0xa48]
push ebp
call esi
test eax, eax
je 0x410feb
mov ebx, dword [esp + 0x10]
push 0x427aa8
push dword [esp + 0xa48]
mov ecx, ebx
call fcn.0040d42e
jmp 0x410fef
mov ebx, dword [esp + 0x10]
push ebp
call esi
test eax, eax
je 0x41109d
push ebp
call edi
test eax, eax
jne 0x41109d
push 0x31
push dword [0x42b934]
push 0x42a234
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
pop ecx
cmp eax, ecx
jne 0x4110da
mov eax, dword [ebx + 4]
mov dword [ebx + 0x50], ecx
cmp dword [eax + 8], ecx
jne 0x411038
mov dword [ebx + 0x54], ecx
push 0x1388
push dword [esp + 0xa48]
call fcn.00415126
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call ebx
push ebp
call edi
push ebp
call esi
test eax, eax
je 0x41109d
push 0x35
push dword [0x42b934]
push 0x42a1fc
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x4110da
push 0x1f4
call ebx
push ebp
call edi
push ebp
call esi
test eax, eax
jne 0x411062
mov ecx, dword [esp + 0x10]
push 1
call fcn.0040f583
cmp dword [esp + 0xa4c], 0
jne 0x4110c6
lea eax, [esp + 0x21c]
push eax
call esi
test eax, eax
je 0x4110c6
push 0
lea eax, [esp + 0x220]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
pop esi
lea eax, [esp + 0x21c]
push eax
call edi
mov eax, esi
jmp 0x410f6c
xor esi, esi
jmp 0x4110c9