Function at 0x495dc3
Capabilities:
Check if file exists
Check mutex on windows
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52448a
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [0x577698]
xor eax, esp
mov dword [esp + 0x330], eax
push ebx
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x348]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
push str.software360TotalSecurity
lea eax, [esp + 0xb4]
push eax
push str.EnableLowDisk
mov edi, str.TrashClean
push edi
mov dword [esp + 0xc0], 1
call fcn.004475d9
add esp, 0x14
xor eax, eax
xor esi, esi
cmp dword [esp + 0xac], esi
push reloc.OLEAUT32.dll_SysReAllocString
setne al
push str.software360TotalSecurity
mov dword [esp + 0xb4], 1
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xb4]
push eax
push str.EnableCanSaveDisk
push edi
call fcn.004475d9
xor eax, eax
add esp, 0x14
cmp dword [esp + 0xac], esi
setne al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x24], esi
jne 0x495e91
cmp eax, esi
je 0x496355
call fcn.00495bb2
mov dword [esp + 0xac], eax
xor eax, eax
cmp dword [0x585740], esi
lea edi, [esp + 0x40]
setne al
mov dword [esp + 0x40], str.SOFTWARE360TotalSecurityTrashClean
mov dword [esp + 0x44], str.lastscantime
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
add eax, 0x80000001
mov dword [esp + 0x50], eax
call fcn.00442768
test al, al
je 0x495ef4
push esi
call fcn.004eb76c
sub eax, dword [esp + 0x4c]
pop ecx
sbb edx, dword [esp + 0x4c]
push esi
push 0x15180
push edx
push eax
call fcn.004f6130
jmp 0x495ef9
call fcn.00442913
cmp eax, 7
jl 0x496355
cmp dword [esp + 0xac], 0xffffffff
je 0x495f1a
cmp dword [esp + 0xac], 7
jl 0x496355
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x40]
push eax
call sub.KERNEL32.dll_GetSystemTimes
mov eax, dword [ebx + 0x514]
cmp eax, esi
je 0x495f88
cmp dword [ebx + 0x518], esi
je 0x495f88
push 0x1d4c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x495f92
jmp 0x49606e
push 0x1d4c0
call sub.KERNEL32.dll_Sleep
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetSystemTimes
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
sub edx, dword [esp + 0x38]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x3c]
sbb ecx, eax
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0x5c]
sub edx, dword [esp + 0x28]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
mov dword [esp + 0xb0], ecx
mov ecx, dword [esp + 0x60]
stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c]
sbb ecx, eax
sub edx, dword [esp + 0x6c]
push esi
sbb ecx, dword [esp + 0x74]
add edx, dword [esp + 0x68]
push 2
push dword [esp + 0xb8]
adc ecx, dword [esp + 0x74]
push dword [esp + 0xb8]
mov dword [esp + 0x2c], edx
mov edi, ecx
call fcn.004f28b0
cmp edx, edi
ja 0x496040
jb 0x49606e
cmp eax, dword [esp + 0x1c]
jb 0x49606e
mov eax, ebx
call fcn.00495b2a
push esi
cmp al, 1
je 0x49606f
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x49606e
call fcn.004428ea
test eax, eax
je 0x49606e
call fcn.004415ab
cmp eax, 1
jne 0x496088
push esi
push dword [0x57a728]
push 0x457
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x496355
push str.LocalCleanning
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp eax, esi
je 0x4960a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x496355
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x496355
push 0x43
pop eax
mov byte [ebx + 0x6d5], 0
mov word [ebx + 0x6d6], ax
mov dword [ebx + 0x6d8], esi
mov dword [ebx + 0x6dc], esi
mov byte [ebx + 0x6e0], 0
mov dword [ebx + 0x6e8], esi
mov dword [ebx + 0x6ec], esi
cmp dword [esp + 0x14], esi
je 0x49610d
mov byte [ebx + 0x6e0], 1
call fcn.004492fa
mov ecx, 0x40000000
mul ecx
mov dword [ebx + 0x6e8], eax
mov dword [ebx + 0x6ec], edx
xor eax, eax
push 0x206
mov word [esp + 0x138], ax
lea eax, [esp + 0x13a]
push esi
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [esp + 0x134]
push eax
push esi
push esi
push 0x24
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x4961de
mov eax, dword [0x54835c]
mov dword [esp + 0xac], eax
mov eax, dword [0x548360]
mov dword [esp + 0xb0], eax
mov ax, word [esp + 0x134]
mov word [esp + 0xac], ax
mov word [ebx + 0x6d6], ax
xor eax, eax
mov dword [esp + 0x14], esi
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push esi
push esi
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4961de
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x6d8], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x6dc], eax
cmp dword [esp + 0x24], esi
je 0x4961de
call fcn.004492b5
mov ecx, 0x40000000
mul ecx
mov ecx, dword [ebx + 0x6dc]
cmp ecx, edx
ja 0x4961de
jb 0x4961d7
mov ecx, dword [ebx + 0x6d8]
cmp ecx, eax
jae 0x4961de
mov byte [ebx + 0x6d5], 1
cmp byte [ebx + 0x6e0], 0
jne 0x4961f4
cmp byte [ebx + 0x6d5], 0
je 0x496355
mov edi, 0x52f388
push edi
lea eax, [esp + 0x78]
call fcn.0040441b
push str.Count
lea eax, [esp + 0x44]
mov dword [esp + 0x354], esi
call fcn.0040441b
mov byte [esp + 0x350], 1
call fcn.0043bc41
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x44]
push eax
push 3
call fcn.0043e1cd
push esi
push 1
lea esi, [esp + 0x48]
mov byte [esp + 0x1a], al
mov byte [esp + 0x358], 0
call fcn.00404e82
push edi
lea eax, [esp + 0x94]
call fcn.0040441b
push str.Size
lea eax, [esp + 0x44]
mov byte [esp + 0x354], 2
call fcn.0040441b
mov byte [esp + 0x350], 3
call fcn.0043bc41
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x44]
push eax
push 3
call fcn.0043e1cd
xor edi, edi
push edi
push 1
lea esi, [esp + 0x48]
mov byte [esp + 0x1b], al
mov byte [esp + 0x358], 2
call fcn.00404e82
cmp byte [esp + 0x12], 0
je 0x4962de
cmp byte [esp + 0x13], 0
je 0x4962de
push 0x5305dc
lea esi, [esp + 0x78]
call fcn.0041ed99
test eax, eax
je 0x4962de
push edi
push edi
push 0x407
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x49633a
test byte [0x5875d0], 1
jne 0x4962ee
call fcn.004437a9
jmp 0x4962f3
mov al, byte [0x5875cc]
cmp al, 1
je 0x49633a
mov esi, 0x80
push esi
lea eax, [esp + 0xb8]
push edi
push eax
call fcn.004e7380
add esp, 0xc
push str._silent
push str._runtrashcheck
push str._s__s
lea eax, [esp + 0xc0]
push esi
push eax
call fcn.004250b8
add esp, 0x14
lea esi, [esp + 0xb4]
call fcn.004a9bbd
push edi
push 1
lea esi, [esp + 0x98]
call fcn.00404e82
push edi
push 1
lea esi, [esp + 0x7c]
call fcn.00404e82
mov ecx, dword [esp + 0x348]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x330]
xor ecx, esp
call fcn.004e736b
mov esp, ebp
pop ebp
ret 4