Function at 0x456910
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x6e8], 0
jne 0x456944
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, 0x5055dc
call fcn.00411480
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test al, al
je 0x4569a4
mov ecx, 0x5055dc
call fcn.00410b40
mov ecx, 0x5055dc
mov esi, 3
call fcn.00411480
test al, al
je 0x4569a4
test esi, esi
jle 0x4569a4
mov ecx, 0x5055dc
call fcn.00410b40
mov ecx, 0x5055dc
dec esi
call fcn.00411480
test al, al
je 0x4569a4
push 0x64
call edi
mov ecx, 0x5055dc
call fcn.00411480
test al, al
jne 0x456975
mov ecx, 0x5055dc
call fcn.00411480
test al, al
jne 0x456a1e
push 0x3b
xor eax, eax
mov dword [ebp - 0x6c], 0
push str.https:__dd.browser.360.cn_static_a_1286.8791.gif__referer6
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.00403e30
push 0
mov dl, 1
lea ecx, [ebp - 0x7c]
call fcn.00412a10
mov edx, dword [ebp - 0x68]
add esp, 4
cmp edx, 8
jb 0x456a1e
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456a14
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e56
push edx
push ecx
call fcn.004bdd39
add esp, 8
lea esi, [ebx + 0x6d8]
push str.360huabao.exe
mov edx, esi
lea ecx, [ebp - 0x4c]
call fcn.004048c0
add esp, 4
lea ecx, [ebp - 0x34]
mov edx, esi
push 0x50e8a8
call fcn.004048c0
add esp, 4
lea ecx, [ebp - 0x1c]
mov edx, esi
push str.userdata
call fcn.004048c0
add esp, 4
push 0x3e8
call edi
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00402f60
mov cl, 1
call fcn.004110c0
add esp, 0x18
test al, al
je 0x456b82
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x4c]
push eax
call esi
test eax, eax
je 0x456b21
push 0x3b
xor eax, eax
mov dword [ebp - 0x6c], 0
push str.https:__dd.browser.360.cn_static_a_1286.8791.gif__referer3
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
call fcn.00403e30
push 0
mov dl, 1
lea ecx, [ebp - 0x7c]
call fcn.00412a10
mov edx, dword [ebp - 0x68]
add esp, 4
cmp edx, 8
jb 0x456b06
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456afc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e5b
push edx
push ecx
call fcn.004bdd39
add esp, 8
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push 4
cmovae eax, dword [ebp - 0x4c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x456d6f
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call esi
test eax, eax
je 0x456b4e
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push 4
cmovae eax, dword [ebp - 0x34]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x456d6f
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x456b7b
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 4
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x456d6f
mov bl, 1
jmp 0x456d71
push str.360huabaosetup.exe
lea eax, [ebx + 0x6f0]
mov edx, esi
push eax
push 0x5010bc
lea ecx, [ebp - 0x94]
call fcn.004048c0
add esp, 4
lea ecx, [ebp - 0x7c]
mov edx, eax
call fcn.004047f0
add esp, 4
lea ecx, [ebp - 0x64]
mov edx, eax
call fcn.00404850
mov edx, dword [ebp - 0x68]
add esp, 4
cmp edx, 8
jb 0x456bf7
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456bed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e60
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
cmp edx, 8
jb 0x456c48
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456c3e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e60
push edx
push ecx
call fcn.004bdd39
add esp, 8
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
cmovae eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x68], 7
push 0x3b
test eax, eax
je 0x456cc6
xor eax, eax
push str.https:__dd.browser.360.cn_static_a_1286.8791.gif__referer4
mov word [ebp - 0x7c], ax
call fcn.00403e30
push 0
mov dl, 1
lea ecx, [ebp - 0x7c]
call fcn.00412a10
mov edx, dword [ebp - 0x68]
add esp, 4
cmp edx, 8
jb 0x456d1f
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456d15
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e65
jmp 0x456d15
xor eax, eax
push str.https:__dd.browser.360.cn_static_a_1286.8791.gif__referer5
mov word [ebp - 0x7c], ax
call fcn.00403e30
push 0
mov dl, 1
lea ecx, [ebp - 0x7c]
call fcn.00412a10
mov edx, dword [ebp - 0x68]
add esp, 4
cmp edx, 8
jb 0x456d1f
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456d15
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e6a
push edx
push ecx
call fcn.004bdd39
add esp, 8
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push 4
cmovae eax, dword [ebp - 0x4c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, dword [ebp - 0x50]
cmp edx, 8
jb 0x456d6f
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456d65
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e6f
push edx
push ecx
call fcn.004bdd39
add esp, 8
xor bl, bl
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x456dab
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456da1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e74
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
cmp edx, 8
jb 0x456df9
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456def
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e74
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x456e43
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456e39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456e74
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
int3