Function at 0x41b9a2
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
push ebx
mov ebx, dword [ebp + 0x1c0]
push esi
push edi
lea eax, [ebp - 0x60]
push eax
push 0x4bf034
mov esi, 0x4bf008
xor edi, edi
push esi
mov ecx, 0x4ebcc8
mov dword [ebp - 0x60], edi
call fcn.0046b89d
test eax, eax
je 0x41ba0c
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41ba05
push edi
push edi
push 0xbd3
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x41bf1c
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.00417402
test eax, eax
je 0x41ba90
mov esi, 0x4ecda4
push esi
lea ecx, [ebp - 0x58]
call fcn.0040ba90
push 0x4befa0
lea ecx, [ebp - 0x58]
call fcn.0040c8e0
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0x4bef88
lea ecx, [ebp - 0x5c]
call fcn.0040c8e0
mov esi, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x58]
push 0x41
push esi
push ebx
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x41ba78
push str.http:__down.360safe.com_safesetup_2000.exe
call fcn.00446dbe
pop ecx
lea ecx, [esi - 0x10]
call fcn.0040dd20
lea ecx, [ebx - 0x10]
call fcn.0040dd20
xor eax, eax
inc eax
jmp 0x41bf1c
push 0x404
call fcn.00417730
push esi
push 0x4bef1c
push ebx
call fcn.004173b6
push 0x4bef18
push edi
call fcn.004864f7
add esp, 0x18
push edi
push ebx
push edi
mov ecx, 0x4ebc8c
call fcn.00418194
call fcn.0041ad72
call fcn.0041b962
mov ecx, eax
call fcn.00474e95
call fcn.00417eb5
mov ecx, eax
call fcn.004751ad
call fcn.00463f7b
mov ecx, eax
call fcn.004642b2
lea ecx, [ebp - 0x68]
call fcn.00469c99
call fcn.00468772
test eax, eax
jne 0x41bb1d
push pe_nt_image_headers32
push 0x96
push 0xa2
push edi
call fcn.00450339
add esp, 0x10
lea ecx, [ebp - 0x68]
call fcn.00469c75
jmp 0x41ba05
xor eax, eax
push 0x206
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push edi
push eax
call fcn.004840d0
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 0x4ecda4
test eax, eax
jne 0x41bbb9
push pe_nt_image_headers32
mov ebx, 0x96
push ebx
push 0xbf
push edi
call fcn.00450339
add esp, 0x10
cmp eax, 1
jne 0x41bc69
push esi
lea ecx, [ebp - 0x58]
call fcn.0040ba90
lea eax, [ebp - 0x58]
push eax
call fcn.0041b805
pop ecx
test eax, eax
jne 0x41bbae
push pe_nt_image_headers32
push ebx
push 0xc0
push edi
call fcn.00450339
mov ecx, dword [ebp - 0x58]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040dd20
jmp 0x41bb10
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0040dd20
push esi
lea ecx, [ebp - 0x58]
call fcn.0040ba90
push 0x8f
lea ecx, [ebp - 0x58]
call fcn.0040bf10
lea eax, [ebp - 0x58]
push eax
call fcn.0041aca4
pop ecx
push 0x94
lea ecx, [ebp - 0x58]
mov ebx, eax
call fcn.0040bf10
cmp ebx, edi
je 0x41bbf8
lea eax, [ebp - 0x58]
push eax
call fcn.0041aca4
pop ecx
mov ebx, eax
push 0x9b
lea ecx, [ebp - 0x58]
call fcn.0040bf10
cmp ebx, edi
je 0x41bc17
lea eax, [ebp - 0x58]
push eax
call fcn.0041aca4
pop ecx
cmp eax, edi
jne 0x41bc76
push 0x18
call fcn.0041b962
mov ecx, eax
call fcn.00474f5d
push pe_nt_image_headers32
push 0x4bef10
push 0x4bef00
push 0x4beeb8
push edi
call fcn.0045075c
add esp, 0x14
cmp eax, 1
jne 0x41bc4f
push 0x4bee9c
call fcn.00446dbe
pop ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0040dd20
lea ecx, [ebp - 0x68]
call fcn.00469c75
mov eax, edi
jmp 0x41bf1c
push pe_nt_image_headers32
push ebx
push 0xc1
jmp 0x41bb07
push edi
push 0x64
call fcn.0044736d
pop ecx
pop ecx
call fcn.0046ca44
mov ecx, eax
call fcn.0046cc61
test eax, eax
je 0x41bed9
call fcn.0046ca44
mov ecx, eax
call fcn.0046ca4a
test eax, eax
je 0x41bed9
mov ecx, 0x4ebc68
call fcn.0041bfa2
test eax, eax
jne 0x41bcc4
push edi
push 0x66
call fcn.0044736d
pop ecx
or edi, 0xffffffff
jmp 0x41bc4e
lea ecx, [ebp - 0x80]
call fcn.00468409
mov eax, dword [ebp - 0x78]
cmp dword [eax - 0xc], edi
je 0x41bce4
lea eax, [ebp - 0x78]
push eax
call fcn.0041b962
mov ecx, eax
call fcn.00474ade
mov ebx, 0x4ec5f8
mov ecx, ebx
call fcn.0046dc44
mov ecx, ebx
call fcn.0046ea79
cmp dword [0x4ec658], edi
je 0x41bdf4
push 0x4ec63c
call fcn.0041b63c
pop ecx
test eax, eax
je 0x41bd60
push edi
push 0x68
call fcn.0044736d
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0xc3
lea ecx, [ebp - 0x5c]
call fcn.0040bf10
mov esi, dword [ebp - 0x5c]
push pe_nt_image_headers32
push 0x4bef10
push 0x4ccb98
push esi
push edi
call fcn.0045075c
add esp, 0x14
lea ecx, [esi - 0x10]
call fcn.0040dd20
lea ecx, [ebp - 0x80]
call fcn.00468292
jmp 0x41bc4f
cmp dword [0x4ec658], edi
je 0x41bdf4
push 0x4ec63c
call fcn.00418509
pop ecx
test eax, eax
je 0x41bda0
push edi
push 0x86
call fcn.0044736d
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0x4bee58
lea ecx, [ebp - 0x5c]
call fcn.0040c8e0
jmp 0x41bd32
cmp dword [0x4ec658], edi
je 0x41bdf4
push 0x4ec63c
call fcn.0041b67a
pop ecx
test eax, eax
je 0x41bdd1
push edi
push 0x69
call fcn.0044736d
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0x4bee10
jmp 0x41bd96
cmp dword [0x4ec658], edi
je 0x41bdf4
call fcn.00432baa
test eax, eax
je 0x41bde6
push 0x12
jmp 0x41bde8
push 0x13
push 0x7d0
call fcn.0044723e
pop ecx
pop ecx
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, ebx
call fcn.0046cf4d
test eax, eax
je 0x41be59
push dword [ebp - 0x6c]
lea eax, [ebp - 0x70]
push eax
mov ecx, ebx
call fcn.0046e01c
push str.parent
lea ecx, [ebp - 0x5c]
call fcn.0040b680
mov eax, dword [ebp - 0x70]
push dword [eax - 0xc]
lea ecx, [ebp - 0x5c]
push eax
call fcn.0041a8eb
push dword [ebp - 0x5c]
push 0x7f
call fcn.0044736d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, 0x4ebc68
call fcn.0041d049
push dword [ebp + 0x1cc]
push dword [ebp + 0x1c8]
call fcn.0041ae94
pop ecx
pop ecx
mov ecx, 0x4ebcc8
mov esi, eax
call fcn.0046b6c3
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x4ebc8c
call fcn.0041ac02
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0041ae03
call fcn.0041b962
mov ecx, eax
call fcn.004748f6
call fcn.00429d84
mov ecx, eax
call fcn.00429e7c
lea ecx, [ebp - 0x80]
call fcn.00468292
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0040dd20
lea ecx, [ebp - 0x68]
call fcn.00469c75
mov eax, esi
jmp 0x41bf1c
push edi
push 0x65
call fcn.0044736d
pop ecx
pop ecx
push 0x19
call fcn.0041b962
mov ecx, eax
call fcn.00474f5d
push pe_nt_image_headers32
push 0x80
push 0x8d
push edi
call fcn.00450339
mov ecx, dword [ebp - 0x58]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040dd20
lea ecx, [ebp - 0x68]
call fcn.00469c75
or eax, 0xffffffff
mov ecx, dword [ebp + 0x1b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004841c7
add ebp, 0x1b8
leave
ret 0x10