Function at 0x408bc0
Capabilities:
Check if file exists
Check os version
Copy file
Get common file path
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4995a2
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x4c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x4d8]
mov dword fs:[0], eax
mov edi, 7
xor ebx, ebx
xor eax, eax
mov dword [esp + 0xb8], edi
mov dword [esp + 0xb4], ebx
mov word [esp + 0xa4], ax
mov dword [esp + 0x4e0], ebx
xor ecx, ecx
mov dword [esp + 0x9c], edi
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], cx
mov byte [esp + 0x4e0], 1
push 0x208
lea edx, [esp + 0xc0]
push ebx
push edx
call fcn.00476ef0
add esp, 0xc
push 0x208
lea eax, [esp + 0x2c8]
push ebx
push eax
call fcn.00476ef0
add esp, 0xc
lea ecx, [esp + 0xa0]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], str._safemonhlp.dll
mov dword [esp + 0x24], str._sesafepro.dll
mov dword [esp + 0x28], str.uniconft.dll
mov dword [esp + 0x2c], str.WdHPFileSafe.dll
mov dword [esp + 0x30], str.urlproc.dll
mov dword [esp + 0x34], str._frag.dat
mov dword [esp + 0x38], str._fragex.dat
mov dword [esp + 0x3c], str.wd.ini
mov dword [esp + 0x40], str.360Conf.dll
mov dword [esp + 0x44], str.cloudcom2.dll
mov dword [esp + 0x48], str.heavygate.dll
call fcn.0040ccf0
test eax, eax
jne 0x408d5b
mov byte [esp + 0x4e0], bl
mov esi, 8
cmp dword [esp + 0x9c], esi
jb 0x408d07
mov ecx, dword [esp + 0x88]
push ecx
call fcn.00471eaf
add esp, 4
xor edx, edx
mov dword [esp + 0x9c], edi
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], dx
mov dword [esp + 0x4e0], 0xffffffff
cmp dword [esp + 0xb8], esi
jb 0x408d43
mov eax, dword [esp + 0xa4]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0xb8], edi
mov word [esp + 0xa4], cx
xor eax, eax
jmp 0x409326
lea ecx, [esp + 0x84]
call fcn.0040ccf0
test eax, eax
jne 0x408dfa
push ebx
push 0x4a5b20
lea esi, [esp + 0x8c]
call fcn.00402bd0
mov byte [esp + 0x4e0], bl
mov esi, 8
cmp dword [esp + 0x9c], esi
jb 0x408da6
mov edx, dword [esp + 0x88]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x9c], edi
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], ax
mov dword [esp + 0x4e0], 0xffffffff
cmp dword [esp + 0xb8], esi
jb 0x408de2
mov ecx, dword [esp + 0xa4]
push ecx
call fcn.00471eaf
add esp, 4
xor edx, edx
mov dword [esp + 0xb8], edi
mov word [esp + 0xa4], dx
xor eax, eax
jmp 0x409326
push 9
push str.Download
lea eax, [esp + 0x8c]
call fcn.004037d0
lea eax, [esp + 0xbc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edi, edi
mov dword [esp + 0x18], edi
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xa8]
xor ecx, ecx
mov esi, 7
push edx
lea eax, [esp + 0x74]
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], cx
call fcn.00402a90
mov byte [esp + 0x4e0], 2
push 0xffffffffffffffff
xor eax, eax
push ebx
lea ecx, [esp + 0x8c]
mov word [esp + 0x58], ax
push ecx
lea eax, [esp + 0x58]
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
call fcn.00402a90
mov byte [esp + 0x4e0], 3
mov esi, dword [esp + edi*4 + 0x20]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408e90
sub eax, edx
sar eax, 1
push eax
push esi
lea eax, [esp + 0x70]
call fcn.004037d0
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408eb0
sub eax, edx
sar eax, 1
push eax
push esi
lea eax, [esp + 0x54]
call fcn.004037d0
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
jae 0x408ed9
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x408f3f
mov byte [esp + 0x4e0], 2
cmp dword [esp + 0x64], 8
jb 0x408f00
mov edx, dword [esp + 0x50]
push edx
call fcn.00471eaf
add esp, 4
mov esi, 7
xor eax, eax
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], ax
mov byte [esp + 0x4e0], 1
cmp dword [esp + 0x80], 8
jb 0x408f33
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.00471eaf
add esp, 4
mov dword [esp + 0x80], esi
jmp 0x409220
mov eax, dword [esp + 0x50]
xor esi, esi
cmp dword [esp + 0x64], 8
jae 0x408f50
lea eax, [esp + 0x50]
push eax
call fcn.00430310
add esp, 4
test eax, eax
je 0x40904c
cmp dword [esp + 0x64], 8
mov edi, dword [esp + 0x50]
jae 0x408f70
lea edi, [esp + 0x50]
push 0x517930
call fcn.00405520
test eax, eax
je 0x408fe3
mov eax, dword [esp + 0x6c]
mov ecx, 8
cmp dword [esp + 0x80], ecx
jae 0x408f94
lea eax, [esp + 0x6c]
cmp dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x50]
jae 0x408fa2
lea ecx, [esp + 0x50]
push eax
call fcn.004396b0
add esp, 4
test eax, eax
jne 0x408fda
mov byte [esp + 0x4e0], 2
lea esi, [esp + 0x4c]
call fcn.00428ca0
mov byte [esp + 0x4e0], 1
lea esi, [esp + 0x68]
call fcn.00428ca0
mov edi, dword [esp + 0x18]
jmp 0x40922b
mov edi, dword [esp + 0x18]
jmp 0x40907d
mov byte [esp + 0x4e0], 2
mov edi, 8
cmp dword [esp + 0x64], edi
jb 0x409003
mov eax, dword [esp + 0x50]
push eax
call fcn.00471eaf
add esp, 4
mov esi, 7
xor ecx, ecx
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], cx
mov byte [esp + 0x4e0], 1
cmp dword [esp + 0x80], edi
jb 0x409035
mov edx, dword [esp + 0x6c]
push edx
call fcn.00471eaf
add esp, 4
mov edi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x80], esi
mov word [esp + 0x6c], ax
jmp 0x409227
mov ecx, dword [esp + 0x6c]
mov eax, 8
cmp dword [esp + 0x80], eax
jae 0x409062
lea ecx, [esp + 0x6c]
cmp dword [esp + 0x64], eax
mov eax, dword [esp + 0x50]
jae 0x409070
lea eax, [esp + 0x50]
push ecx
call fcn.004304e0
add esp, 4
test eax, eax
je 0x409082
mov esi, 1
mov ecx, dword [esp + 0x6c]
mov eax, 8
cmp dword [esp + 0x80], eax
jae 0x409098
lea ecx, [esp + 0x6c]
cmp dword [esp + 0x64], eax
mov eax, dword [esp + 0x50]
jae 0x4090a6
lea eax, [esp + 0x50]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x40912c
lea ecx, [esp + 0x2c4]
push ecx
push ebx
push 0x4a6330
lea edx, [esp + 0xc8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp dword [esp + 0x80], 8
mov eax, dword [esp + 0x6c]
jae 0x4090e5
lea eax, [esp + 0x6c]
push 3
lea ecx, [esp + 0x2c8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [esp + 0x80], 8
mov ecx, dword [esp + 0x6c]
jae 0x409108
lea ecx, [esp + 0x6c]
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
jae 0x409117
lea eax, [esp + 0x50]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x4091c7
cmp esi, ebx
je 0x4091c7
cmp edi, ebx
jne 0x409142
or dword [esp + 0x14], 1
jmp 0x4091c7
cmp edi, 1
jne 0x409151
or dword [esp + 0x14], 2
jmp 0x4091c7
cmp edi, 2
jne 0x40915d
or dword [esp + 0x14], 4
jmp 0x4091c7
cmp edi, 3
jne 0x409169
or dword [esp + 0x14], 8
jmp 0x4091c7
cmp edi, 4
jne 0x409175
or dword [esp + 0x14], 0x10
jmp 0x4091c7
cmp edi, 5
jne 0x409181
or dword [esp + 0x14], 0x20
jmp 0x4091c7
cmp edi, 6
jne 0x40918d
or dword [esp + 0x14], 0x40
jmp 0x4091c7
cmp edi, 7
jne 0x40919c
or dword [esp + 0x14], 0x80
jmp 0x4091c7
cmp edi, 8
jne 0x4091ab
or dword [esp + 0x14], 0x100
jmp 0x4091c7
cmp edi, 9
jne 0x4091ba
or dword [esp + 0x14], 0x200
jmp 0x4091c7
cmp edi, 0xa
jne 0x4091c7
or dword [esp + 0x14], 0x400
mov byte [esp + 0x4e0], 2
cmp dword [esp + 0x64], 8
jb 0x4091e3
mov edx, dword [esp + 0x50]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], ax
mov byte [esp + 0x4e0], 1
cmp dword [esp + 0x80], 8
jb 0x409215
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.00471eaf
add esp, 4
mov dword [esp + 0x80], 7
xor edx, edx
mov word [esp + 0x6c], dx
mov dword [esp + 0x7c], ebx
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0xb
jb 0x408e26
cmp dword [esp + 0x14], ebx
je 0x4092ab
mov eax, dword [esp + 0x14]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 0xd
mov edi, 7
xor ecx, ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.UpNetGuardRet
mov word [esi + 4], cx
call fcn.00402bd0
mov byte [esp + 0x500], 4
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x50], esp
push 0xa
xor edx, edx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.UpNetGuard
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x51c], 5
mov byte [esp + 0x51c], 1
call fcn.00404570
add esp, 0x3c
mov byte [esp + 0x4e0], bl
mov edi, 8
cmp dword [esp + 0x9c], edi
jb 0x4092d0
mov eax, dword [esp + 0x88]
push eax
call fcn.00471eaf
add esp, 4
mov esi, 7
xor ecx, ecx
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], cx
mov dword [esp + 0x4e0], 0xffffffff
cmp dword [esp + 0xb8], edi
jb 0x409311
mov edx, dword [esp + 0xa4]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov word [esp + 0xa4], ax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xb8], esi
mov dword [esp + 0xb4], ebx
mov ecx, dword [esp + 0x4d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c0]
xor ecx, esp
call fcn.00471eba
mov esp, ebp
pop ebp
ret