Function at 0x401180
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Get file attributes
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb14
mov eax, dword [0x40e004]
xor eax, esp
mov dword [esp + 0xb0c], eax
push ebx
push ebp
mov eax, 0x40c5a8
mov dword [esp + 0xe4], eax
mov dword [esp + 0x30], eax
push esi
mov eax, 0x1d58d59
push edi
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov eax, 0x1d58591
mov ecx, 0x40c590
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
push 0x104
lea eax, [esp + 0x504]
mov edx, 0x40c578
mov dword [esp + 0xec], ecx
mov dword [esp + 0x24], ecx
mov ecx, 0x1da2715
push eax
mov ebp, str.SmadExtMenu64.dll
mov ebx, 0x40c50c
mov edi, 0x40c52c
mov esi, str.SmadavUpdateMain.exe
push 0
mov dword [esp + 0xc8], 0x40c40c
mov dword [esp + 0xcc], 0x40c42c
mov dword [esp + 0xd0], str.SmadavProtect32.exe
mov dword [esp + 0xd4], str.SmadavProtect64.exe
mov dword [esp + 0xd8], 0x40c4a0
mov dword [esp + 0xdc], 0x40c4c8
mov dword [esp + 0xe0], ebp
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], edi
mov dword [esp + 0xec], esi
mov dword [esp + 0xf0], edx
mov dword [esp + 0x30], 0x40c4a0
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], 0x40c42c
mov dword [esp + 0x3c], str.SmadavProtect32.exe
mov dword [esp + 0x40], str.SmadavProtect64.exe
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 0x40c4c8
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], 0x40c40c
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], 0x1d98bf5
mov dword [esp + 0x9c], 0x1da2704
mov dword [esp + 0xa0], 0x1da26c3
mov dword [esp + 0xac], 0x1d97e95
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], 0x1d8f28b
mov dword [esp + 0x60], 0x749b79d6
mov dword [esp + 0x64], 0x4d740fa7
mov dword [esp + 0x68], 0xe070ba4c
mov dword [esp + 0x6c], 0xfc915fa5
mov dword [esp + 0x70], 0xe3f2f1c4
mov dword [esp + 0x74], 0xe60a26bb
mov dword [esp + 0x78], 0x6623bea1
mov dword [esp + 0x7c], 0x4e159efe
mov dword [esp + 0x80], 0xd30dfd62
mov dword [esp + 0x84], 0x994f8825
mov dword [esp + 0x88], 0x9be02a66
mov dword [esp + 0x8c], 0x902dc188
mov dword [esp + 0x90], 0x94d72029
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x910]
lea ecx, [esp + 0x500]
call fcn.00401060
push eax
push str._sSmadavUpdaterDir
mov ecx, 0x104
lea ebx, [esp + 0x300]
call section..text
mov ecx, ebx
push ecx
push str._sSmadavUpdateMain.exe
mov ecx, 0x104
lea ebx, [esp + 0x718]
call section..text
add esp, 0x10
push 0
lea edx, [esp + 0x2fc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
xor esi, esi
jmp 0x4013f0
mov eax, dword [esp + esi*4 + 0xbc]
push eax
lea ecx, [esp + 0x2fc]
push ecx
push 0x40c638
mov ecx, 0x104
lea ebx, [esp + 0xfc]
call section..text
add esp, 0xc
mov edx, ebx
push edx
call ebp
cmp eax, 0xffffffff
je 0x40142c
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x65]
push ecx
lea edx, [esp + 0xf4]
push edx
call fcn.004010f0
add esp, 8
test eax, eax
je 0x401445
inc edi
inc esi
cmp esi, 0xd
jb 0x4013f0
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], edi
xor esi, esi
mov eax, dword [esp + esi + 0x88]
mov edx, dword [esp + esi + 0x20]
mov ecx, dword [esp + esi + 0x54]
mov dword [esp + 0x1c], eax
push edx
lea eax, [esp + 0x2fc]
push eax
mov dword [esp + 0x20], ecx
push 0x40c638
mov ecx, 0x104
lea ebx, [esp + 0xfc]
call section..text
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
mov ecx, ebx
push ecx
call ebp
lea edx, [esp + 0x18]
push edx
push 0
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, 0x34
jb 0x401457
push 1
push 0
push 0x40c644
lea eax, [esp + 0x714]
push eax
push 0x40c64c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0xb1c]
pop edi
xor eax, eax
cmp dword [esp + 0x10], 0xd
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.004019dc
add esp, 0xb14
ret