Function at 0x10041e20
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get program files directory

Disassembly:
sub esp, 0xa58
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0xa54], eax
push ebx
push ebp
mov ebp, dword [esp + 0xa6c]
push esi
push edi
xor eax, eax
push 0x208
mov edi, ecx
push eax
lea ecx, [esp + 0x32]
push ecx
mov dword [esp + 0x20], 0
mov word [esp + 0x34], ax
call fcn.1007dcf0
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x662]
push eax
mov word [esp + 0x664], dx
call fcn.1007dcf0
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x256]
push edx
mov word [esp + 0x258], cx
call fcn.1007dcf0
add esp, 0x24
call fcn.10047710
test eax, eax
je 0x100420f4
push 2
call fcn.100489d0
add esp, 4
test eax, eax
jne 0x10041ed5
mov esi, dword [esp + 0xa6c]
push 0x169
xor edx, edx
mov eax, edi
call fcn.1002d4f0
add esp, 4
jmp 0x1004223f
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x100de408
call esi
test eax, eax
jne 0x10041f52
cmp eax, 0x100de408
je 0x100420d7
push 0x100de408
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100420d7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10076c50
add esp, 4
test eax, eax
je 0x10041f2a
push 0x100de408
mov eax, 0x100e4788
call fcn.100770b0
test eax, eax
jne 0x10041f3c
mov eax, 0x100de408
call fcn.10071800
test eax, eax
je 0x100420d7
push 0x100de408
call esi
test eax, eax
jne 0x10041f52
push 0x100de408
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x100420d7
push str.SDSetup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x100420af
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x1004209f
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x100a1950
lea edx, [esp + 0x2c]
push edx
call esi
test eax, eax
je 0x1004209f
push str.360sd
lea eax, [esp + 0x2c]
push eax
call esi
test eax, eax
je 0x1004209f
test byte [esp + 0xa70], 2
je 0x10041ffc
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10041fd0
sub eax, edx
sar eax, 1
xor ecx, ecx
test eax, eax
jle 0x10041ffc
cmp word [ebp + ecx*2], 0x2f
jne 0x10041ff7
mov edx, 0x40
mov word [ebp + ecx*2], dx
inc ecx
cmp ecx, eax
jl 0x10041fe5
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x44a]
mov dword [0x100db784], 1
push ecx
mov word [esp + 0x44c], ax
call fcn.1007dcf0
mov esi, dword [esp + 0xa78]
push ebp
push esi
lea edx, [esp + 0x454]
push str._pid_d__homepage_s
push edx
mov ecx, 0x104
call fcn.10018220
push 0x16c
xor edx, edx
mov eax, edi
call fcn.1002d4f0
add esp, 0x20
lea eax, [esp + 0x440]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ebp, 1
push 0x100de200
mov dword [0x100db784], ebp
call ebx
test eax, eax
je 0x1004208a
push 0x16e
xor edx, edx
mov eax, edi
call fcn.1002d4f0
add esp, 4
jmp 0x1004208e
mov dword [esp + 0x14], ebp
push 0x16d
xor edx, edx
mov eax, edi
call fcn.1002d4f0
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1004223f
mov esi, dword [esp + 0xa6c]
push 0x16b
xor edx, edx
mov eax, edi
call fcn.1002d4f0
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1004223f
mov esi, dword [esp + 0xa6c]
push 0x16a
xor edx, edx
mov eax, edi
call fcn.1002d4f0
add esp, 4
jmp 0x1004223f
xor eax, eax
xor edx, edx
test byte [esp + 0xa70], 2
mov ecx, 0x53
mov word [esp + 0x18], cx
mov word [esp + 0x1a], dx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
je 0x1004214e
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10042122
sub eax, edx
sar eax, 1
xor ecx, ecx
test eax, eax
jle 0x1004214e
cmp word [ebp + ecx*2], 0x2f
jne 0x10042149
mov edx, 0x40
mov word [ebp + ecx*2], dx
inc ecx
cmp ecx, eax
jl 0x10042137
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x862]
mov ebx, 1
mov dword [0x100db784], ebx
push ecx
mov word [esp + 0x864], ax
call fcn.1007dcf0
mov esi, dword [esp + 0xa78]
push ebp
push esi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x24c]
push str.__S__pid_d__homepage_S
push eax
mov ecx, 0x104
call fcn.10018220
mov edx, dword [0x100d9234]
mov eax, dword [str.v_ds_dr_dd_d]
sub edi, ebx
neg edi
sbb edi, edi
push esi
and edi, 0xfffffc18
add edi, 0x3e8
push 0
lea ecx, [edi + 0x16f]
push ecx
push edx
push eax
xor ecx, ecx
mov dword [0x100db784], ebx
call fcn.1002d3f0
add esp, 0x34
push 0xf
push 0
lea ecx, [esp + 0x23c]
push ecx
push 0x100de200
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x100421fd
mov dword [esp + 0x14], ebx
jmp 0x1004221e
mov eax, dword [0x100d9234]
mov ecx, dword [str.v_ds_dr_dd_d]
push esi
push 0
lea edx, [edi + 0x171]
push edx
push eax
push ecx
xor ecx, ecx
call fcn.1002d3f0
add esp, 0x14
mov edx, dword [0x100d9234]
mov eax, dword [str.v_ds_dr_dd_d]
push esi
push 0
add edi, 0x170
push edi
push edx
push eax
xor ecx, ecx
call fcn.1002d3f0
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x100de200
call esi
push 0x100de408
call esi
mov ecx, dword [esp + 0xa64]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0xa58
ret