Function at 0x49daaf
Capabilities:
Check if file exists
Check mutex on windows
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52faee
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [0x585698]
xor eax, esp
mov dword [esp + 0x330], eax
push ebx
push esi
push edi
mov eax, dword [0x585698]
xor eax, esp
push eax
lea eax, [esp + 0x348]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
push str.software360TotalSecurity
lea eax, [esp + 0xb4]
push eax
push str.EnableLowDisk
mov edi, str.TrashClean
push edi
mov dword [esp + 0xc0], 1
call fcn.0044e7e9
add esp, 0x14
xor eax, eax
xor esi, esi
cmp dword [esp + 0xac], esi
push reloc.OLEAUT32.dll_SysReAllocString
setne al
push str.software360TotalSecurity
mov dword [esp + 0xb4], 1
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xb4]
push eax
push str.EnableCanSaveDisk
push edi
call fcn.0044e7e9
xor eax, eax
add esp, 0x14
cmp dword [esp + 0xac], esi
setne al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x24], esi
jne 0x49db7d
cmp eax, esi
je 0x49e041
call fcn.0049d89c
mov dword [esp + 0xac], eax
xor eax, eax
cmp dword [0x593800], esi
lea edi, [esp + 0x40]
setne al
mov dword [esp + 0x40], str.SOFTWARE360TotalSecurityTrashClean
mov dword [esp + 0x44], str.lastscantime
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
add eax, 0x80000001
mov dword [esp + 0x50], eax
call fcn.00449406
test al, al
je 0x49dbe0
push esi
call fcn.004f5c9c
sub eax, dword [esp + 0x4c]
pop ecx
sbb edx, dword [esp + 0x4c]
push esi
push 0x15180
push edx
push eax
call fcn.005006a0
jmp 0x49dbe5
call fcn.004495b1
cmp eax, 7
jl 0x49e041
cmp dword [esp + 0xac], 0xffffffff
je 0x49dc06
cmp dword [esp + 0xac], 7
jl 0x49e041
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x40]
push eax
call sub.KERNEL32.dll_GetSystemTimes
mov eax, dword [ebx + 0x514]
cmp eax, esi
je 0x49dc74
cmp dword [ebx + 0x518], esi
je 0x49dc74
push 0x1d4c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x49dc7e
jmp 0x49dd5a
push 0x1d4c0
call sub.KERNEL32.dll_Sleep
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetSystemTimes
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
sub edx, dword [esp + 0x38]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x3c]
sbb ecx, eax
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0x5c]
sub edx, dword [esp + 0x28]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
mov dword [esp + 0xb0], ecx
mov ecx, dword [esp + 0x60]
stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c]
sbb ecx, eax
sub edx, dword [esp + 0x6c]
push esi
sbb ecx, dword [esp + 0x74]
add edx, dword [esp + 0x68]
push 2
push dword [esp + 0xb8]
adc ecx, dword [esp + 0x74]
push dword [esp + 0xb8]
mov dword [esp + 0x2c], edx
mov edi, ecx
call fcn.004fce20
cmp edx, edi
ja 0x49dd2c
jb 0x49dd5a
cmp eax, dword [esp + 0x1c]
jb 0x49dd5a
mov eax, ebx
call fcn.0049d814
push esi
cmp al, 1
je 0x49dd5b
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x49dd5a
call fcn.00449588
test eax, eax
je 0x49dd5a
call fcn.00448249
cmp eax, 1
jne 0x49dd74
push esi
push dword [0x588750]
push 0x457
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x49e041
push str.LocalCleanning
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp eax, esi
je 0x49dd95
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49e041
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x49e041
push 0x43
pop eax
mov byte [ebx + 0x6d5], 0
mov word [ebx + 0x6d6], ax
mov dword [ebx + 0x6d8], esi
mov dword [ebx + 0x6dc], esi
mov byte [ebx + 0x6e0], 0
mov dword [ebx + 0x6e8], esi
mov dword [ebx + 0x6ec], esi
cmp dword [esp + 0x14], esi
je 0x49ddf9
mov byte [ebx + 0x6e0], 1
call fcn.0045050c
mov ecx, 0x40000000
mul ecx
mov dword [ebx + 0x6e8], eax
mov dword [ebx + 0x6ec], edx
xor eax, eax
push 0x206
mov word [esp + 0x138], ax
lea eax, [esp + 0x13a]
push esi
push eax
call fcn.004f18b0
add esp, 0xc
lea eax, [esp + 0x134]
push eax
push esi
push esi
push 0x24
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x49deca
mov eax, dword [0x553f7c]
mov dword [esp + 0xac], eax
mov eax, dword [0x553f80]
mov dword [esp + 0xb0], eax
mov ax, word [esp + 0x134]
mov word [esp + 0xac], ax
mov word [ebx + 0x6d6], ax
xor eax, eax
mov dword [esp + 0x14], esi
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push esi
push esi
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49deca
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x6d8], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x6dc], eax
cmp dword [esp + 0x24], esi
je 0x49deca
call fcn.004504c7
mov ecx, 0x40000000
mul ecx
mov ecx, dword [ebx + 0x6dc]
cmp ecx, edx
ja 0x49deca
jb 0x49dec3
mov ecx, dword [ebx + 0x6d8]
cmp ecx, eax
jae 0x49deca
mov byte [ebx + 0x6d5], 1
cmp byte [ebx + 0x6e0], 0
jne 0x49dee0
cmp byte [ebx + 0x6d5], 0
je 0x49e041
mov edi, 0x53a3d8
push edi
lea eax, [esp + 0x78]
call fcn.004043d1
push str.Count
lea eax, [esp + 0x44]
mov dword [esp + 0x354], esi
call fcn.004043d1
mov byte [esp + 0x350], 1
call fcn.00440e5e
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x44]
push eax
push 3
call fcn.00443337
push esi
push 1
lea esi, [esp + 0x48]
mov byte [esp + 0x1a], al
mov byte [esp + 0x358], 0
call fcn.00404e29
push edi
lea eax, [esp + 0x94]
call fcn.004043d1
push str.Size
lea eax, [esp + 0x44]
mov byte [esp + 0x354], 2
call fcn.004043d1
mov byte [esp + 0x350], 3
call fcn.00440e5e
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x44]
push eax
push 3
call fcn.00443337
xor edi, edi
push edi
push 1
lea esi, [esp + 0x48]
mov byte [esp + 0x1b], al
mov byte [esp + 0x358], 2
call fcn.00404e29
cmp byte [esp + 0x12], 0
je 0x49dfca
cmp byte [esp + 0x13], 0
je 0x49dfca
push 0x53b884
lea esi, [esp + 0x78]
call fcn.00423c33
test eax, eax
je 0x49dfca
push edi
push edi
push 0x407
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x49e026
test byte [0x5957d0], 1
jne 0x49dfda
call fcn.0044a44c
jmp 0x49dfdf
mov al, byte [0x5957cc]
cmp al, 1
je 0x49e026
mov esi, 0x80
push esi
lea eax, [esp + 0xb8]
push edi
push eax
call fcn.004f18b0
add esp, 0xc
push str._silent
push str._runtrashcheck
push str._s__s
lea eax, [esp + 0xc0]
push esi
push eax
call fcn.0042a55b
add esp, 0x14
lea esi, [esp + 0xb4]
call fcn.004b289c
push edi
push 1
lea esi, [esp + 0x98]
call fcn.00404e29
push edi
push 1
lea esi, [esp + 0x7c]
call fcn.00404e29
mov ecx, dword [esp + 0x348]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x330]
xor ecx, esp
call fcn.004f189b
mov esp, ebp
pop ebp
ret 4