Function at 0x40a5e0
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x435e41
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x453358]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x453358]
xor eax, esp
push eax
lea eax, [esp + 0x434]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00424d40
mov ecx, eax
call fcn.00424e10
test eax, eax
je 0x40a8ac
call fcn.00424d40
mov ecx, eax
call fcn.00424d50
test eax, eax
je 0x40a8ac
mov ecx, esi
call fcn.00409ca0
test eax, eax
je 0x40a8ac
mov ecx, dword [esi + 0x14]
xor edi, edi
mov dword [esi + 0x20], edi
cmp ecx, edi
je 0x40a8b3
cmp dword [esi + 0x18], edi
je 0x40a8b3
call fcn.00430910
push eax
lea ecx, [esp + 0x18]
call fcn.00409f40
push 0x208
lea eax, [esp + 0x22c]
push edi
push eax
mov dword [esp + 0x448], edi
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x228]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea edx, [esp + 0x24]
push edi
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x20]
push ecx
push eax
push str.__tmpini_
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str..360.cn_
lea ecx, [esp + 0x18]
call fcn.00408c90
cmp eax, 0xffffffff
jne 0x40a724
push str..360safe.com_
lea ecx, [esp + 0x18]
call fcn.00408c90
cmp eax, 0xffffffff
jne 0x40a724
lea ecx, [esp + 0x14]
mov dword [esi + 0x2c], 1
call fcn.00410b70
jmp 0x40a8b3
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, dword [esp + 0x14]
push 0xea60
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x18]
push edx
mov ebx, eax
call fcn.0041b4a0
mov ebp, eax
call edi
mov ecx, eax
sub ecx, ebx
mov eax, 0x10624dd3
mul ecx
mov eax, dword [0x4444f4]
shr edx, 6
mov dword [esp + 0x18], eax
push edx
lea ecx, [esp + 0x1c]
push str.usetime_d
mov ebx, 1
push ecx
mov byte [esp + 0x448], bl
call fcn.00409ff0
mov edx, dword [esp + 0x24]
add esp, 0xc
push edx
push 0
push 0x18
mov ecx, esi
call fcn.004090f0
test ebp, ebp
jne 0x40a7bf
mov ecx, dword [esi + 0x18]
call fcn.0041bb10
neg eax
sbb eax, eax
and eax, 4
add eax, 2
mov dword [esi + 0x2c], eax
lea ecx, [esp + 0x18]
call fcn.00410b70
lea ecx, [esp + 0x14]
call fcn.00410b70
jmp 0x40a8b3
push 0x104
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
call dword [sym.imp.MSVCR90.dll_wcsncpy]
push 0x104
lea edx, [esp + 0x238]
push 0x439aa0
push edx
call dword [sym.imp.MSVCR90.dll_wcsncat]
add esp, 0x18
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.004081e0
lea edx, [esp + 0x20]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
jne 0x40a820
mov dword [esi + 0x2c], 4
jmp 0x40a7a8
mov eax, dword [0x4444f4]
mov dword [esp + 0x1c], eax
push 0xa1
lea ecx, [esp + 0x20]
mov byte [esp + 0x440], 2
call fcn.00409a10
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x22c]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 0x14]
call fcn.00430c80
lea edx, [esp + 0x228]
push edx
mov ecx, esi
mov edi, eax
call fcn.0040a080
lea ecx, [esp + 0x1c]
test edi, edi
jne 0x40a88e
mov dword [esi + 0x2c], 5
call fcn.00410b70
jmp 0x40a7a8
mov dword [esi + 0x20], ebx
call fcn.00410b70
lea ecx, [esp + 0x18]
call fcn.00410b70
lea ecx, [esp + 0x14]
call fcn.00410b70
mov eax, ebx
jmp 0x40a8b5
mov dword [esi + 0x2c], 3
xor eax, eax
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.00434fc4
add esp, 0x42c
ret