Function at 0x1004c650
Capabilities:
Check if file exists
Copy file
Delete file
Query or enumerate registry value
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100941bb
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov eax, dword [esp + 0x450]
push 0x208
lea edx, [esp + 0x238]
push 0
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], 0
call fcn.1007dcf0
add esp, 0xc
cmp dword [0x100e4b9c], 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x28], 0x208
jne 0x1004c6e7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100e4b9c], eax
call fcn.10046fe0
mov dword [0x100e4ba0], eax
cmp dword [0x100e4ba0], 0
je 0x1004c8ab
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x238]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1004c8ab
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.modules
lea ecx, [esp + 0x238]
push ecx
call edi
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x234]
push edx
call ebp
test eax, eax
je 0x1004c8ab
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
mov dword [esp + 0x14], 0x61
nop
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.1007dcf0
add esp, 0xc
lea edx, [esp + 0x234]
push edx
lea eax, [esp + 0x30]
push eax
call ebx
push str.360safeup
lea ecx, [esp + 0x30]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
call esi
push str..exe
lea ecx, [esp + 0x30]
push ecx
call esi
lea edx, [esp + 0x2c]
push edx
call ebp
test eax, eax
je 0x1004c80e
push 0x80
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1004c7f6
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1004c7f6
lea edx, [esp + 0x2c]
push edx
call ebp
test eax, eax
je 0x1004c81d
inc word [esp + 0x14]
mov eax, dword [esp + 0x14]
add eax, 0xffffff9f
cmp ax, 0x19
jbe 0x1004c770
jmp 0x1004c82c
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x238]
push edx
jmp 0x1004c82a
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x238]
push ecx
call ebx
cmp word [esp + 0x14], 0x7b
jne 0x1004c838
xor eax, eax
jmp 0x1004c8af
lea edx, [esp + 0x234]
push edx
call ebp
test eax, eax
jne 0x1004c8ab
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
push 0
lea ecx, [esp + 0x238]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1004c8ab
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x238]
call fcn.10013050
mov dword [esp + 0x448], 0
mov edi, dword [esp + 0x24]
call fcn.1006cca0
mov dword [esp + 0x448], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10013100
mov eax, dword [edi]
push eax
call ebp
test eax, eax
je 0x1004c8ab
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.10079a05
add esp, 0x438
ret