Function at 0x417e49
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
sub esp, 0x824
mov edx, dword [esp + 0x82c]
push ebx
xor ebx, ebx
push ebp
push esi
cmp edx, ebx
push edi
mov dword [esp + 0x10], ecx
je 0x4180e8
cmp word [edx], bx
je 0x4180e8
push 6
mov esi, str.360sess.exe
pop ecx
lea edi, [esp + 0x62c]
rep movsd dword es:[edi], dword [esi]
push 0x7c
xor eax, eax
pop ecx
lea edi, [esp + 0x644]
rep stosd dword es:[edi], eax
mov esi, 0x81
lea edi, [esp + 0x16]
mov ecx, esi
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str._sShield360SESS
lea eax, [esp + 0x42c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x24]
push 0x104
push eax
lea eax, [esp + 0x644]
push eax
lea eax, [esp + 0x440]
push eax
call fcn.00421181
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
test eax, eax
je 0x417fa1
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x417fa1
lea eax, [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x417fa1
push 0x31
push dword [0x4456fc]
push 0x441290
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4180e8
lea eax, [esp + 0x14]
push 0x1388
push eax
call fcn.00420c31
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call edi
lea eax, [esp + 0x14]
push eax
call ebp
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x417fa1
push 0x35
push dword [0x4456fc]
push 0x441258
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x4180e8
push 0x1f4
jmp 0x417f63
and word [esp + 0x21c], 0
mov ecx, esi
xor eax, eax
lea edi, [esp + 0x21e]
rep stosd dword es:[edi], eax
push str.360se.exe.bak
push dword [esp + 0x840]
stosw word es:[edi], ax
push 0x43cb6c
lea eax, [esp + 0x228]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [esp + 0x21c]
push eax
call ebp
mov esi, dword [esp + 0x840]
push esi
call ebx
test eax, eax
je 0x418011
mov edi, dword [esp + 0x10]
push 0x43e9f0
push dword [esp + 0x840]
mov ecx, edi
call fcn.00413609
jmp 0x418015
mov edi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x4180ae
push esi
call ebp
test eax, eax
jne 0x4180ae
push 0x31
push dword [0x4456fc]
push 0x441290
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
pop ecx
cmp eax, ecx
jne 0x4180aa
mov eax, dword [edi + 4]
mov dword [edi + 0x78], ecx
cmp dword [eax + 8], ecx
jne 0x41805a
mov dword [edi + 0x7c], ecx
push 0x1388
push dword [esp + 0x840]
call fcn.00420dc4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call edi
push esi
call ebp
push esi
call ebx
test eax, eax
je 0x4180ae
push 0x35
push dword [0x4456fc]
push 0x441258
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x4180aa
push 0x1f4
jmp 0x418078
xor esi, esi
jmp 0x4180da
cmp dword [esp + 0x844], 0
jne 0x4180d7
lea eax, [esp + 0x21c]
push eax
call ebx
test eax, eax
je 0x4180d7
push 0
lea eax, [esp + 0x220]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
pop esi
lea eax, [esp + 0x21c]
push eax
call ebp
mov eax, esi
jmp 0x4180ea
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x824
ret 0x10