Function at 0x4020a5
Capabilities:
Copy file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc80
and word [ebp - 0x664], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x662]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4101c0
mov ebx, 0x102
push 0x40e754
lea eax, [ebp - 0x664]
push ebx
push eax
call esi
and word [ebp - 0xa74], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa72]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0xa74]
push eax
call edi
lea eax, [ebp - 0xa74]
push 0x40e750
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xa74]
push 0
push eax
call fcn.00407eb2
pop ecx
lea eax, [ebp - 0x664]
pop ecx
push 0x411408
push eax
call edi
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x664]
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x44], ecx
mov ecx, 0x81
lea edi, [ebp - 0x86a]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x86c], ax
mov dword [ebp - 0x3a], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x664]
mov word [ebp - 0x3c], 0x414
push eax
push str._sSkin_
lea eax, [ebp - 0x86c]
push 0x103
push eax
mov dword [ebp - 0x48], 2
call esi
lea eax, [ebp - 0x86c]
push eax
call fcn.004044ba
and word [ebp - 0x45c], 0
mov edx, 0x81
add esp, 0x14
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x45a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
and word [ebp - 0x254], 0
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x252]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x45c]
push str.360SE.exe
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x40], eax
push 0x4101c0
push 0x40e434
lea eax, [ebp - 0x45c]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x664]
push str.360sess
push eax
push str._s_s.exe
lea eax, [ebp - 0x254]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
xor edi, edi
push edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
lea eax, [ebp - 0xc]
push 0x83e
push eax
push str.360SE.EXE
call fcn.00402f2c
add esp, 0x10
cmp eax, edi
mov dword [ebp - 4], eax
je 0x402307
mov word [ebp - 0xc80], di
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0xc7e]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x664]
mov edi, 0x104
push eax
push str._s360se.exe
lea eax, [ebp - 0xc80]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xc80]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x4022e5
lea eax, [ebp - 0xc80]
push eax
push str.CreateFile_360se.exe_Failed_path_S
call fcn.00404047
pop ecx
xor eax, eax
pop ecx
jmp 0x402542
lea ecx, [ebp - 8]
push 0
push ecx
and dword [ebp - 8], 0
push dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40230c
mov edi, 0x104
and dword [ebp - 0x14], 0
mov eax, str.sqlite3.dll
mov ecx, eax
mov dword [ebp - 0x2c], eax
test ecx, ecx
mov dword [ebp - 0x28], str.adfilter.dll
mov dword [ebp - 0x24], str.doctor.dll
mov dword [ebp - 0x20], str.download.dll
mov dword [ebp - 0x1c], str.suggest.dll
mov dword [ebp - 0x18], str.urlquery.dll
je 0x4023a6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], eax
push dword [ebp - 8]
lea eax, [ebp - 0x45c]
push 0x4101c0
push 0x40e434
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x664]
push dword [ebp - 8]
push eax
push str._s_s
lea eax, [ebp - 0x254]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x254]
push 0
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 8], eax
jne 0x40234a
and dword [ebp - 0x14], 0
mov eax, str.Favorites
mov ecx, eax
mov dword [ebp - 0x24], eax
test ecx, ecx
mov dword [ebp - 0x20], str.LoginEnrol
mov dword [ebp - 0x1c], str.Pages
mov dword [ebp - 0x18], str.SafeCentral
je 0x402457
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x45c]
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x254]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x45c]
push dword [ebp - 4]
push 0x4101c0
push str._s_s.
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x664]
push dword [ebp - 4]
push eax
push 0x40e5a8
lea eax, [ebp - 0x254]
push ebx
push eax
call esi
lea eax, [ebp - 0x254]
push eax
call fcn.004044ba
add esp, 0x18
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
add dword [ebp - 8], 4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 4], eax
jne 0x4023da
push edi
lea eax, [ebp - 0x45c]
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x254]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x45c]
push str.SkinIE6Default.zip
push 0x4101c0
push 0x40e434
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x86c]
push str.IE6Default.zip
push eax
push 0x40e434
lea eax, [ebp - 0x254]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x254]
push 0
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
lea eax, [ebp - 0x45c]
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x254]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov edi, 0x40e434
lea eax, [ebp - 0x45c]
push str.ShieldInstall360SafeModuleSkin
push 0x4101c0
push edi
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x86c]
push 0x411c2c
push eax
push edi
lea eax, [ebp - 0x254]
push ebx
push eax
call esi
lea eax, [ebp - 0x254]
push eax
call fcn.004044ba
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00408296
add esp, 0x20
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret