Function at 0x4165f7
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov edi, ecx
push 0x7d0
push dword [edi + 0x34]
lea ebx, [edi + 0x34]
call fcn.0041fc79
pop ecx
lea eax, [ebp - 8]
pop ecx
push str._seext.dll
push ebx
push eax
call fcn.0041b302
push dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._sefix.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._seup.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._sefix_bak.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._seup_bak.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str.urls.dat
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push dword [edi + 0x30]
call esi
and word [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
push str.360se.exe.bak
push dword [ebx]
stosw word es:[edi], ax
push 0x43add0
lea eax, [ebp - 0x218]
push 0x103
push eax
call dword [0x4323e4]
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call esi
push str._sefix.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
push dword [eax]
mov edi, dword [0x432520]
call edi
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.00404c0d
cmp dword [ebp - 0xc], 0
je 0x416771
push str._sefix_bak.exe
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
mov eax, dword [eax]
push str._sefix.exe
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
push dword [ebp - 0xc]
mov eax, dword [eax]
push eax
call fcn.004209a3
pop ecx
pop ecx
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
push str._seup.exe
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call edi
lea ecx, [ebp - 4]
mov edi, eax
call fcn.00404c0d
test edi, edi
je 0x4167cd
push str._seup_bak.exe
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0041b302
mov edi, dword [eax]
push str._seup.exe
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
mov eax, dword [eax]
push edi
push eax
call fcn.004209a3
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
push str.extensionsComCore
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call fcn.004206b8
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push str.extensionsExtMinibar
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call fcn.004206b8
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push str.extensionsExtFlvDownload
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call fcn.004206b8
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push str.extensionsExtChongZhi
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call fcn.004206b8
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
mov edi, str.360SEUP.dll.bak
lea eax, [ebp - 4]
push edi
push ebx
push eax
call fcn.0041b302
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
push edi
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0041b302
mov eax, dword [eax]
push 0x43de58
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0041b302
push dword [ebp - 4]
mov eax, dword [eax]
push eax
call fcn.004209a3
pop ecx
pop ecx
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 8]
call fcn.00404c0d
push edi
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
push dword [eax]
call esi
neg eax
sbb al, al
inc al
lea ecx, [ebp - 4]
mov byte [ebp - 0xd], al
call fcn.00404c0d
cmp byte [ebp - 0xd], 0
je 0x4168e7
push edi
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0041b302
mov eax, dword [eax]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret