Function at 0x408db0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x473f29
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x4c40a0]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push esi
push edi
mov eax, dword [0x4c40a0]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xa4]
mov dword [esp + 0x14], edi
call fcn.0040e9b0
push 0xc
mov eax, 0x499570
lea ecx, [esp + 0xa8]
mov dword [esp + 0xd4], 0
call fcn.0040a010
add edi, 0x170
push edi
mov ebx, 0x499570
lea esi, [esp + 0x8c]
call fcn.0040ad70
add esp, 4
mov byte [esp + 0xd0], 1
mov ecx, dword [esp + 0xa8]
mov esi, 8
cmp dword [esp + 0xbc], esi
jae 0x408e5f
lea ecx, [esp + 0xa8]
mov eax, dword [esp + 0x8c]
cmp dword [esp + 0xa0], esi
jae 0x408e76
lea eax, [esp + 0x8c]
xor ebx, ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x6c]
call fcn.0040db60
push 0x13
mov eax, str.360Inst_sohuyy.exe
lea ecx, [esp + 0x70]
mov byte [esp + 0xd4], 2
call fcn.0040a010
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x58], ax
push ebx
mov eax, edi
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], ebx
call fcn.0040a0f0
push 0x13
mov eax, str.360Inst_sohuyy.exe
lea ecx, [esp + 0x54]
mov byte [esp + 0xd4], 3
call fcn.0040a010
mov ecx, dword [esp + 0x70]
cmp dword [esp + 0x84], esi
jae 0x408eec
lea ecx, [esp + 0x70]
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x68], esi
jae 0x408efa
lea eax, [esp + 0x54]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x408f1b
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x68], esi
jae 0x408f14
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x68], esi
jb 0x408f2e
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0046190e
add esp, 4
xor edx, edx
mov byte [esp + 0xd0], 1
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], dx
cmp dword [esp + 0x84], esi
jb 0x408f5f
mov eax, dword [esp + 0x70]
push eax
call fcn.0046190e
add esp, 4
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x3c], cx
push ebx
mov eax, edi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
call fcn.0040a0f0
push edi
mov ebx, str.FileAssociationsTool.exe
lea esi, [esp + 0x70]
mov byte [esp + 0xd4], 4
call fcn.0040ad70
add esp, 4
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd8], 5
call fcn.0040a0f0
cmp dword [esp + 0x84], 8
jb 0x408fc6
mov edx, dword [esp + 0x70]
push edx
call fcn.0046190e
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
push 0xe
mov eax, str._EnableAutoRun
lea esi, [esp + 0x1c]
mov byte [esp + 0xd4], 6
call fcn.0040a600
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0040e850
add esp, 4
push 0x13
mov eax, str._ModifyMainShortcut
call fcn.0040a600
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.0040e850
add esp, 4
push 2
mov eax, 0x4995fc
call fcn.0040a600
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.0040e850
add esp, 4
push 0x1d
mov eax, str._ChangeSohuVARunToSHplayerRun
call fcn.0040a600
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.0040e850
add esp, 4
push 0xb
mov eax, str._ReleaseSWF
call fcn.0040a600
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.0040e850
add esp, 4
push 0x10
mov eax, str._InstallSuccess
call fcn.0040a600
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x1e0], 0
push 1
mov ecx, esi
mov eax, 0x49967c
jne 0x409097
mov eax, 0x499680
call fcn.0040a010
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040e850
add esp, 4
push edi
mov ebx, 0x499684
lea esi, [esp + 0x70]
call fcn.0040ad70
add esp, 4
push 0xffffffffffffffff
mov ebx, 7
push 0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd8], bl
call fcn.0040a0f0
mov edi, 8
mov byte [esp + 0xd0], 6
cmp dword [esp + 0x84], edi
jb 0x4090fb
mov edx, dword [esp + 0x70]
push edx
call fcn.0046190e
add esp, 4
push 0xa
mov eax, str._RegServer
lea esi, [esp + 0x1c]
call fcn.0040a600
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.0040e850
add esp, 4
cmp dword [esp + 0x30], edi
jb 0x40912d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0046190e
add esp, 4
xor esi, esi
xor edx, edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], esi
mov word [esp + 0x1c], dx
cmp dword [esp + 0x4c], edi
jb 0x409151
mov eax, dword [esp + 0x38]
push eax
call fcn.0046190e
add esp, 4
xor ecx, ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], esi
mov word [esp + 0x38], cx
cmp dword [esp + 0xa0], edi
jb 0x409179
mov edx, dword [esp + 0x8c]
push edx
call fcn.0046190e
add esp, 4
xor eax, eax
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], esi
mov word [esp + 0x8c], ax
cmp dword [esp + 0xbc], edi
jb 0x4091aa
mov ecx, dword [esp + 0xa8]
push ecx
call fcn.0046190e
add esp, 4
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.00461919
mov esp, ebp
pop ebp
ret