Function at 0x1002d6f0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009822a
mov eax, dword fs:[0]
push eax
sub esp, 0x8a8
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x8a0], eax
push ebx
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x8b8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x3c], eax
mov eax, dword [0x100e4924]
mov dword [esp + 0x44], ecx
test eax, eax
jne 0x1002e12c
mov dword [esp + 0x10], eax
mov dword [esp + 0x8c0], 1
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x4a6]
push eax
mov word [esp + 0x4a8], dx
call fcn.1007dcf0
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6ae]
push edx
mov word [esp + 0x6b0], cx
call fcn.1007dcf0
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0xc
lea eax, [esp + 0x49c]
push eax
push 0x104
call esi
lea ecx, [esp + 0x6a4]
push ecx
push 0x104
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360IniV2Internet360Ini.dll
lea edx, [esp + 0x4a0]
push edx
call esi
push str.360IniVerify.ini
lea eax, [esp + 0x6a8]
push eax
call esi
call fcn.1004a550
test eax, eax
je 0x1002dcab
lea ecx, [esp + 0x18]
push ecx
mov edi, str.version
mov ecx, str.360iniVer
call fcn.1004a5a0
add esp, 4
mov byte [esp + 0x8c0], 2
mov edx, dword [0x100d9aac]
mov eax, dword [edx + 0xc]
mov ecx, 0x100d9aac
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x8c0], 4
xor esi, esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov byte [esp + 0x8c0], 5
and dword [esp + 0x38], 0xfffffffc
mov byte [esp + 0x8c0], 9
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x1009f430
call fcn.10013050
mov byte [esp + 0x8c0], 0xa
lea edx, [esp + 0x14]
push edx
mov ecx, 0x1009f434
call fcn.10013050
mov bl, 0xb
mov byte [esp + 0x8c0], bl
lea eax, [esp + 0x20]
push eax
mov ecx, 0x1009ed34
call fcn.10013050
mov byte [esp + 0x8c0], 0xc
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.1001d320
mov byte [esp + 0x8c0], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002d8dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x8c0], 0xa
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002d904
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x8c0], 9
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002d92c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x14], esi
mov edx, dword [0x100d9aac]
mov eax, dword [edx + 0xc]
mov ecx, 0x100d9aac
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x8c0], 0x11
mov edx, dword [0x100d9aac]
mov eax, dword [edx + 0xc]
mov ecx, 0x100d9aac
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x20], edi
mov byte [esp + 0x8c0], 0x13
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x2c]
jae 0x1002da33
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
mov eax, ecx
mov ecx, dword [edx + eax*8]
lea ebx, [edx + eax*8]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x1002d9df
cmp dword [esi + 0xc], 0
jl 0x1002d9d1
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x1002d9d1
call fcn.1006d080
mov dword [esp + 0x40], eax
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1002d9c4
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x40]
add ecx, 0x10
mov dword [esp + 0x1c], ecx
jmp 0x1002d9df
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x24]
call fcn.1006d1c0
mov ecx, dword [ebx + 4]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x1002da33
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x1002da21
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x1002da21
call fcn.1006d080
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x1002da18
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebx + 0x10]
mov dword [esp + 0x20], edi
jmp 0x1002da33
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x28]
call fcn.1006d1c0
mov edi, dword [esp + 0x20]
push 0xa
push 0
push edi
call fcn.1007a629
mov esi, dword [esp + 0x20]
add esp, 0xc
mov dword [esp + esi*4 + 0x48], eax
mov byte [esp + 0x8c0], 0x11
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002da6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x8c0], 9
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002da94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc esi
mov dword [esp + 0x14], esi
cmp esi, 4
jb 0x1002d930
push 0x208
call fcn.10079b72
add esp, 4
mov dword [esp + 0x10], eax
mov ecx, 0x100dd3c8
mov edx, eax
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1002dac0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x58]
push ecx
call fcn.1002d660
add esp, 4
test eax, eax
jne 0x1002db3d
mov byte [esp + 0x8c0], 0x16
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x1002db10
mov edx, dword [esp + 0x2c]
push edx
call fcn.1001b990
mov eax, dword [esp + 0x2c]
add esp, 4
push eax
call fcn.10079c70
add esp, 4
mov byte [esp + 0x8c0], 2
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002db38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x1002dc83
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x60]
shl esi, 0x10
or esi, dword [esp + 0x4c]
cmp eax, esi
ja 0x1002e08c
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
jne 0x1002db6f
mov ecx, edi
shl ecx, 0x10
or ecx, ebx
cmp dword [esp + 0x64], ecx
jae 0x1002e08c
lea edx, [esp + 0x49c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002dc71
lea ecx, [esp + 0x49c]
call fcn.1002e300
test eax, eax
je 0x1002dc71
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4a0]
call fcn.1002d660
add esp, 4
test eax, eax
jne 0x1002dbd9
mov byte [esp + 0x8c0], 2
lea ecx, [esp + 0x24]
push ecx
call fcn.100185d0
mov byte [esp + 0x8c0], 1
lea ecx, [esp + 0x18]
call fcn.10013100
jmp 0x1002dcab
mov eax, dword [esp + 0x60]
cmp eax, esi
ja 0x1002dbfd
jne 0x1002dbee
shl edi, 0x10
or edi, ebx
cmp dword [esp + 0x64], edi
jae 0x1002dbfd
mov byte [esp + 0x8c0], 2
lea edx, [esp + 0x24]
push edx
jmp 0x1002dbbe
lea esi, [esp + 0x49c]
call fcn.1002e9e0
push 0
push 0
mov ecx, esi
call fcn.10013f20
test eax, eax
jne 0x1002dc1c
xor esi, esi
jmp 0x1002dc2c
lea eax, [esp + 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [0x100e4924], esi
mov byte [esp + 0x8c0], 2
lea ecx, [esp + 0x24]
push ecx
call fcn.100185d0
mov byte [esp + 0x8c0], 1
lea ecx, [esp + 0x18]
call fcn.10013100
mov dword [esp + 0x8c0], 0xffffffff
lea edx, [esp + 0x10]
push edx
call fcn.10023040
mov eax, esi
jmp 0x1002e12c
mov byte [esp + 0x8c0], 2
lea eax, [esp + 0x24]
push eax
call fcn.100185d0
mov byte [esp + 0x8c0], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002dcab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x3c]
xor ebx, ebx
cmp esi, ebx
je 0x1002dd04
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1002dd04
lea eax, [esp + 0x8c]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1002dcf6
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1002dcf6
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1002dcd0
sub eax, 2
mov word [eax], dx
jmp 0x1002dd2a
cmp edx, ebx
jne 0x1002dcfd
sub eax, 2
xor edx, edx
mov word [eax], dx
jmp 0x1002dd2a
lea eax, [esp + 0x8c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.360ini.cab
lea ecx, [esp + 0x90]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
sub esp, 0x1c
mov esi, esp
mov edi, 7
xor edx, edx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
lea eax, [esp + 0xac]
mov word [esi + 4], dx
mov dword [esp + 0x5c], esp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1002dd50
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.10013510
mov byte [esp + 0x8e0], 0x20
sub esp, 0x1c
mov esi, esp
xor ecx, ecx
mov eax, str.http:__dl.360safe.com_gf_360ini.cab
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov dword [esp + 0x7c], esp
mov word [esi + 4], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1002dd92
sub eax, edx
sar eax, 1
push eax
push str.http:__dl.360safe.com_gf_360ini.cab
call fcn.10013510
mov byte [esp + 0x8fc], 0x21
mov byte [esp + 0x8fc], 1
call fcn.10036a10
add esp, 0x3c
cmp eax, ebx
jne 0x1002ddec
mov dword [0x100e4924], ebx
mov dword [esp + 0x8c0], 0xffffffff
mov edx, dword [esp + 0x10]
push edx
call fcn.10079c70
mov dword [esp + 0x14], ebx
jmp 0x1002e127
mov esi, dword [esp + 0x44]
cmp esi, ebx
je 0x1002dea6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1002dea6
lea eax, [esp + 0x294]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
jmp 0x1002de20
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1002de40
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1002de40
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1002de20
jmp 0x1002de44
cmp edx, ebx
jne 0x1002de47
sub eax, 2
xor edx, edx
mov word [eax], dx
lea edx, [esp + 0x294]
push edx
push 0x1002d5d0
push ebx
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x8c]
push ecx
mov esi, eax
call edi
cmp esi, ebx
jne 0x1002df2d
mov dword [0x100e4924], ebx
mov dword [esp + 0x8c0], 0xffffffff
mov edx, dword [esp + 0x10]
push edx
call fcn.10079c70
mov dword [esp + 0x14], ebx
jmp 0x1002e127
lea eax, [esp + 0x294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.360IniV2
lea ecx, [esp + 0x298]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x294]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1002de4c
lea eax, [esp + 0x294]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, ebx
je 0x1002de4c
cmp eax, 0x50
je 0x1002de4c
cmp eax, 0xb7
je 0x1002de4c
mov dword [0x100e4924], ebx
mov dword [esp + 0x8c0], 0xffffffff
lea ecx, [esp + 0x10]
push ecx
call fcn.10023040
jmp 0x1002e12a
push str.360ini.dll
lea eax, [esp + 0x298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x294]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002df76
mov dword [0x100e4924], ebx
mov dword [esp + 0x8c0], 0xffffffff
mov edx, dword [esp + 0x10]
push edx
call fcn.10079c70
mov dword [esp + 0x14], ebx
jmp 0x1002e127
lea eax, [esp + 0x8c]
lea esi, [esp + 0x294]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [ecx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1002dfb0
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1002dfb0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1002df90
jmp 0x1002dfb4
cmp edx, ebx
jne 0x1002dfb7
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Internet360Ini.dll
lea ecx, [esp + 0x90]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.Internet360Ini
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002e00c
mov dword [0x100e4924], ebx
mov dword [esp + 0x8c0], 0xffffffff
lea edx, [esp + 0x10]
push edx
call fcn.10023040
jmp 0x1002e12a
lea eax, [esp + 0x8c]
push eax
call edi
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x298]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1002e050
mov dword [0x100e4924], ebx
mov dword [esp + 0x8c0], 0xffffffff
lea eax, [esp + 0x10]
push eax
call fcn.10023040
jmp 0x1002e12a
push ebx
push ebx
lea ecx, [esp + 0x94]
call fcn.10013f20
test eax, eax
je 0x1002e070
lea ecx, [esp + 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea esi, [esp + 0x8c]
mov dword [0x100e4924], eax
call fcn.1002e9e0
mov esi, dword [0x100e4924]
jmp 0x1002dc55
xor esi, esi
mov dword [0x100e4924], esi
mov byte [esp + 0x8c0], 0x1a
mov ecx, dword [esp + 0x28]
cmp ecx, esi
je 0x1002e0be
mov eax, dword [esp + 0x2c]
push eax
call fcn.1001b990
mov ecx, dword [esp + 0x2c]
add esp, 4
push ecx
call fcn.10079c70
add esp, 4
mov byte [esp + 0x8c0], 2
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1002e0e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x8c0], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002e10e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x8c0], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10079c70
mov dword [esp + 0x14], esi
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x8b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8a0]
xor ecx, esp
call fcn.10079a05
mov esp, ebp
pop ebp
ret