Function at 0x4da6b5
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Read .ini file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1974
call fcn.00515150
push ebx
push esi
push edi
push str.v3_20150309_begin
call fcn.0049d036
pop ecx
xor eax, eax
mov esi, 0x206
push esi
mov word [esp + 0x164], ax
xor edi, edi
lea eax, [esp + 0x166]
push edi
push eax
call fcn.004fe380
add esp, 0xc
xor eax, eax
push esi
mov word [esp + 0x574], ax
lea eax, [esp + 0x576]
push edi
push eax
call fcn.004fe380
add esp, 0xc
push 1
push 0x1a
lea eax, [esp + 0x578]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.360mobilemgr_supports
lea eax, [esp + 0x574]
push eax
lea eax, [esp + 0x168]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x160]
push eax
call ebx
test eax, eax
jne 0x4da767
push eax
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4da7b6
xor eax, eax
push esi
push eax
mov word [esp + 0x370], ax
lea eax, [esp + 0x372]
push eax
call fcn.004fe380
add esp, 0xc
push str.imkcuf.pkg
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x370]
push eax
call edi
lea eax, [esp + 0x368]
push eax
call ebx
test eax, eax
je 0x4da7b6
lea eax, [esp + 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0x1c]
xor ebx, ebx
call fcn.0048dc40
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0xb4]
call fcn.004dae3d
lea ecx, [esp + 0x18]
call fcn.00407f70
push str.mauthorization.pkg
lea ecx, [esp + 0x1c]
call fcn.0048dc40
mov eax, esi
push eax
lea eax, [esp + 0x1c]
call fcn.004dae91
lea ecx, [esp + 0x18]
call fcn.00407f70
push 0x104
lea eax, [esp + 0x77c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x778]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.mobileadapt.ini
lea eax, [esp + 0x77c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x778]
push eax
push 0x400
lea eax, [esp + 0x1188]
push eax
push ebx
push str.0x43_v3
push str.devices_ext
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4da8c7
lea eax, [esp + 0x1180]
push eax
call fcn.004f7d3f
test eax, eax
setne al
pop ecx
test al, al
jne 0x4da8c7
mov eax, esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cbe0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x4da897
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x18]
call fcn.00407f70
or edi, 0xffffffff
lea esi, [esp + 0xb0]
call fcn.004da601
push str.v3_20150309_end
call fcn.0049d036
mov eax, edi
jmp 0x4dade5
cmp dword [ebp + 8], ebx
je 0x4dadcd
mov edi, 0x80
cmp dword [ebp + 0xc], edi
jne 0x4dadcd
cmp dword [ebp + 0x10], ebx
je 0x4da8aa
cmp dword [ebp + 0x14], ebx
jle 0x4da8aa
push 7
pop esi
push ebx
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], esi
call fcn.00409dd0
push ebx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x74], esi
call fcn.00409dd0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], ebx
inc dword [esp + 0x14]
cmp byte [esp + 0x13], 0
jne 0x4dab20
or dword [esp + 0x54], 0xffffffff
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cbe0
lea eax, [esp + 0x18]
call fcn.004e8509
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00407f70
test bl, bl
je 0x4daa4e
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x98]
call fcn.0042cbe0
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x148]
call fcn.0042cbe0
cmp dword [eax + 0x18], 8
jb 0x4da984
mov eax, dword [eax + 4]
jmp 0x4da987
add eax, 4
push 0x5dee8c
push eax
call fcn.004f9299
pop ecx
pop ecx
lea ecx, [esp + 0x144]
mov esi, eax
call fcn.00407f70
lea ecx, [esp + 0x94]
call fcn.00407f70
test esi, esi
jne 0x4da9e7
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cbe0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x4da9d2
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x18]
call fcn.00407f70
jmp 0x4dab15
push 2
push 0xfffffffffffffffc
push esi
call fcn.004f9855
add esp, 0xc
push esi
push 1
lea eax, [esp + 0x5c]
push 4
push eax
call fcn.004f95a3
add esp, 0x10
cmp eax, 1
je 0x4daa47
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cbe0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x4daa2b
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x18]
call fcn.00407f70
push esi
call fcn.004f9951
pop ecx
jmp 0x4dab15
push esi
call fcn.004f9951
pop ecx
xor esi, esi
push dword [esp + 0x54]
call fcn.004d9ac4
pop ecx
test eax, eax
je 0x4daa6f
cmp eax, 0xfffffffe
je 0x4dab56
mov eax, esi
inc esi
cmp eax, 3
jl 0x4daa50
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x98]
call fcn.0042cbe0
lea eax, [esp + 0x94]
call fcn.004e8509
mov bl, al
neg bl
sbb bl, bl
lea ecx, [esp + 0x94]
inc bl
call fcn.00407f70
test bl, bl
jne 0x4dab86
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x98]
call fcn.0042cbe0
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x9c]
call fcn.004df0d8
pop ecx
pop ecx
test eax, eax
lea ecx, [esp + 0x94]
setne bl
call fcn.00407f70
test bl, bl
jne 0x4da9b2
mov eax, dword [esp + 0x38]
push 8
pop ebx
cmp dword [esp + 0x4c], ebx
jae 0x4dab01
lea eax, [esp + 0x38]
push eax
call fcn.00404460
pop ecx
test eax, eax
je 0x4dab98
mov byte [esp + 0x13], 1
cmp dword [esp + 0x14], 3
jl 0x4da910
xor ebx, ebx
cmp dword [esp + 0x48], ebx
je 0x4dab86
push str.v3_do_perm
call fcn.0049d036
or dword [esp + 0x78], 0xffffffff
pop ecx
lea eax, [esp + 0x78]
push eax
call fcn.004da628
pop ecx
cmp dword [esp + 0x8c], ebx
jne 0x4dabf8
lea ecx, [esp + 0x78]
jmp 0x4dab81
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cbe0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x4dab76
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x18]
call fcn.00407f70
lea ecx, [esp + 0x58]
call fcn.00407f70
lea ecx, [esp + 0x34]
jmp 0x4da8a2
push str.SmartCheck360Sign_failed_
call fcn.0049d036
pop ecx
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cbe0
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebx
jae 0x4dabc2
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
lea ecx, [esp + 0x18]
call fcn.00407f70
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], ebx
jae 0x4dabe2
lea eax, [esp + 0x38]
push eax
call esi
mov eax, dword [esp + 0x5c]
cmp dword [esp + 0x70], ebx
jae 0x4dabf3
lea eax, [esp + 0x5c]
push eax
call esi
jmp 0x4dab86
cmp dword [esp + 0x90], 8
mov eax, dword [esp + 0x7c]
jae 0x4dac0a
lea eax, [esp + 0x7c]
push eax
mov esi, 0x800
push esi
push ebx
push 4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x4dab50
push esi
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
jne 0x4dac4c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4dab50
push edi
push dword [ebp + 8]
lea ebx, [esi + 8]
push ebx
mov dword [esi], 0x4d524550
mov dword [esi + 4], edi
call fcn.00500790
or dword [esp + 0x5c], 0xffffffff
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x988], ax
lea eax, [esp + 0x98a]
push eax
call fcn.004fe380
mov ecx, dword [esp + 0x88]
add esp, 0xc
cmp dword [esp + 0x90], 8
jae 0x4dac9f
lea ecx, [esp + 0x7c]
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x4dacae
lea eax, [esp + 0x5c]
push dword [ebp + 0x18]
push ecx
push eax
lea eax, [esp + 0x98c]
push str.__s____s___d
push eax
call fcn.004f674e
add esp, 0x14
lea eax, [esp + 0x980]
push eax
push str.Create_mauthorization.exe_begin_command_is:_s
call fcn.0049d036
cmp dword [esp + 0x54], 8
mov eax, dword [esp + 0x40]
pop ecx
pop ecx
jae 0x4daceb
lea eax, [esp + 0x38]
lea ecx, [esp + 0x980]
push ecx
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004dedc1
test eax, eax
je 0x4dad63
cmp dword [esp + 0x50], 0
jne 0x4dad63
mov ecx, dword [esi]
mov eax, str.OKAY
cmp ecx, dword [eax]
jne 0x4dad63
push str.v3_do_perm_ok
call fcn.0049d036
mov edi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
cmp edi, eax
pop ecx
mov ecx, edi
jl 0x4dad2d
mov ecx, eax
test ecx, ecx
jge 0x4dad35
xor eax, eax
jmp 0x4dad3b
cmp edi, eax
jge 0x4dad3b
mov eax, edi
push eax
push ebx
push dword [ebp + 0x10]
call fcn.00500790
mov eax, dword [esi + 4]
add esp, 0xc
cmp edi, eax
mov ecx, edi
jl 0x4dad53
mov ecx, eax
test ecx, ecx
jge 0x4dad5b
xor edi, edi
jmp 0x4dad67
cmp edi, eax
jl 0x4dad67
mov edi, eax
jmp 0x4dad67
mov edi, dword [esp + 0x74]
push str.Create_mauthorization.exe_end.
call fcn.0049d036
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x4c], 8
mov eax, dword [esp + 0x38]
jae 0x4dad92
lea eax, [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x4dadaa
lea eax, [esp + 0x5c]
push eax
call esi
lea ecx, [esp + 0x78]
call fcn.00407f70
lea ecx, [esp + 0x58]
call fcn.00407f70
lea ecx, [esp + 0x34]
call fcn.00407f70
jmp 0x4da8aa
lea esi, [esp + 0xb0]
call fcn.004da601
push str.v3_20150309_end
call fcn.0049d036
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14