Function at 0x413307
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2fc], edi
lea esi, [ebp - 0x308]
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x308], edi
mov dword [ebp - 0x304], edi
call fcn.0044effe
mov ebx, dword [0x52b010]
mov eax, esi
push eax
push 1
push edi
push str.mhtmlfile_shellopencommand
push 0x80000000
call ebx
test eax, eax
je 0x413377
call fcn.0044effe
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
xor eax, eax
mov word [ebp - 0x2a0], ax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x308]
push eax
mov ecx, 0x543da0
mov dword [ebp - 0x28c], 7
mov dword [ebp - 0x290], edi
call fcn.0044f09d
test eax, eax
jne 0x4133cc
xor bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0x2a0]
call fcn.004021a4
lea esi, [ebp - 0x308]
call fcn.0044effe
mov al, bl
jmp 0x413368
lea edi, [ebp - 0x330]
call fcn.0044cb53
lea ecx, [ebp - 0x2a0]
mov edx, edi
call fcn.0044d28e
push dword [ebp - 0x330]
lea eax, [ebp - 0x268]
call fcn.0044a559
lea eax, [ebp - 0x268]
push eax
lea esi, [ebp - 0x284]
call fcn.0040202c
push 1
xor edi, edi
lea esi, [ebp - 0x268]
call fcn.004021a4
mov edi, dword [ebp - 0x30c]
push str.360se.exe
lea eax, [ebp - 0x24c]
call fcn.00414a64
cmp dword [eax + 0x14], 8
pop ecx
mov ecx, dword [eax + 0x10]
jb 0x413438
mov eax, dword [eax]
push ecx
push eax
mov eax, dword [ebp - 0x274]
xor esi, esi
lea ecx, [ebp - 0x284]
call fcn.00402852
test eax, eax
setne byte [ebp - 0x2f5]
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.004021a4
cmp byte [ebp - 0x2f5], 0
je 0x41348f
push 1
xor edi, edi
lea esi, [ebp - 0x284]
call fcn.004021a4
lea eax, [ebp - 0x330]
call fcn.0044cba8
mov bl, 1
jmp 0x4133ae
xor edi, edi
xor eax, eax
lea esi, [ebp - 0x300]
mov dword [ebp - 0x300], edi
mov dword [ebp - 0x2fc], edi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], ax
call fcn.0044effe
mov eax, esi
push eax
push 1
push edi
push 0x53c828
push 0x80000002
call ebx
test eax, eax
je 0x4134ed
lea eax, [ebp - 0x230]
push eax
mov eax, esi
push eax
mov ecx, 0x543da0
call fcn.0044f09d
jmp 0x413567
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push edi
push eax
call fcn.00506540
add esp, 0xc
push edi
push 0x26
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x413567
lea eax, [ebp - 0x214]
sub eax, 2
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x413529
push 0x10
mov edi, eax
pop ecx
lea eax, [ebp - 0x214]
mov esi, str.internet_exploreriexplore.exe
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413565
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00402178
xor edi, edi
cmp dword [ebp - 0x220], edi
jne 0x4135a6
push 1
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.004021a4
lea esi, [ebp - 0x300]
call fcn.0044effe
push 1
lea esi, [ebp - 0x284]
call fcn.004021a4
lea eax, [ebp - 0x330]
call fcn.0044cba8
jmp 0x4133ac
call fcn.004389cc
mov ebx, eax
push 0x544efc
lea edi, [ebp - 0x230]
lea eax, [ebp - 0x2f4]
call fcn.00414ab4
mov dword [esp], str.___nohome
push eax
call fcn.0040afbc
push eax
lea esi, [ebp - 0x268]
call fcn.00402a37
cmp dword [ebp - 0x254], 8
mov eax, dword [ebp - 0x268]
jae 0x4135ed
mov eax, esi
push eax
lea esi, [ebp - 0x24c]
call fcn.0040204f
push 0x543da0
lea esi, [ebp - 0x2bc]
call fcn.0040204f
push str.mhtmlfile_shellopencommand
lea esi, [ebp - 0x2d8]
call fcn.0040204f
mov eax, dword [ebx]
push 1
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x2bc]
push ecx
mov ecx, esi
push ecx
push 0x80000000
mov ecx, ebx
call dword [eax + 0x40]
push 1
xor edi, edi
call fcn.004021a4
push 1
lea esi, [ebp - 0x2bc]
call fcn.004021a4
push 1
lea esi, [ebp - 0x24c]
call fcn.004021a4
push 1
lea esi, [ebp - 0x268]
call fcn.004021a4
push 1
lea esi, [ebp - 0x2f4]
call fcn.004021a4
push str.__1_
lea esi, [ebp - 0x2d8]
call fcn.0040204f
push 0x543da0
lea esi, [ebp - 0x2bc]
call fcn.0040204f
push str.mhtmlfileDefaultIcon
lea esi, [ebp - 0x24c]
call fcn.0040204f
mov eax, dword [ebx]
push 1
lea ecx, [ebp - 0x2d8]
push ecx
lea ecx, [ebp - 0x2bc]
push ecx
mov ecx, esi
push ecx
push 0x80000000
mov ecx, ebx
call dword [eax + 0x40]
push 1
call fcn.004021a4
push 1
lea esi, [ebp - 0x2bc]
call fcn.004021a4
push 1
lea esi, [ebp - 0x2d8]
call fcn.004021a4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test al, al
je 0x413725
xor eax, eax
push eax
push eax
push eax
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
push 1
lea esi, [ebp - 0x230]
call fcn.004021a4
lea esi, [ebp - 0x300]
call fcn.0044effe
jmp 0x41346e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
jmp 0x41356f