Function at 0x4174c0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f633
mov eax, dword fs:[0]
push eax
sub esp, 0xab8
mov eax, dword [0x4483b0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xab0], 0
call fcn.0040f820
mov dword [ebp - 0x650], eax
lea ecx, [ebp - 0x24]
call fcn.00417da0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
push str.dl.360safe.com
call fcn.004172e0
add esp, 8
lea ecx, [ebp - 0x85c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.360ini.cab
lea edx, [ebp - 0x85c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x24]
call fcn.00417e70
test eax, eax
jbe 0x4176e1
mov dword [ebp - 0x860], 0
jmp 0x41756f
mov eax, dword [ebp - 0x860]
add eax, 1
mov dword [ebp - 0x860], eax
lea ecx, [ebp - 0x24]
call fcn.00417e70
cmp dword [ebp - 0x860], eax
jae 0x4176aa
xor ecx, ecx
mov word [ebp - 0xa6c], cx
push 0x206
push 0
lea edx, [ebp - 0xa6a]
push edx
call fcn.0041a970
add esp, 0xc
mov eax, dword [ebp - 0x860]
push eax
lea ecx, [ebp - 0x24]
call fcn.00417e90
push eax
lea ecx, [ebp - 0xa88]
call fcn.00417c20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa88]
call fcn.00417c80
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0
jne 0x4175e7
mov dword [ebp - 0xab4], 0
jmp 0x41764f
mov ecx, dword [ebp - 0x654]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x3fffffff
jle 0x41760f
mov dword [ebp - 0xab8], 0
jmp 0x417643
mov eax, dword [ebp - 0x28]
shl eax, 1
call fcn.0041c5c0
mov dword [ebp - 0xabc], esp
mov edx, dword [ebp - 0x650]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x654]
push ecx
mov edx, dword [ebp - 0xabc]
push edx
call fcn.00417930
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xab4], eax
mov ecx, dword [ebp - 0xab4]
push ecx
push str.http:___s_gf_360ini.cab
lea edx, [ebp - 0xa6c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0xa6c]
push ecx
call fcn.00417280
add esp, 8
test eax, eax
je 0x417696
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa88]
call fcn.00417c60
jmp 0x4176aa
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa88]
call fcn.00417c60
jmp 0x417560
lea edx, [ebp - 0x85c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4176df
mov dword [ebp - 0xa8c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417e10
mov eax, dword [ebp - 0xa8c]
jmp 0x417904
jmp 0x41771d
lea eax, [ebp - 0x85c]
push eax
push str.http:__dl.360safe.com_gf_360ini.cab
call fcn.00417280
add esp, 8
test eax, eax
jne 0x41771d
mov dword [ebp - 0xa90], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417e10
mov eax, dword [ebp - 0xa90]
jmp 0x417904
lea ecx, [ebp - 0x444]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x10
lea edx, [ebp - 0x234]
push edx
call fcn.004167e0
add esp, 8
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x444]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4177b0
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0xa98]
call fcn.0040bb00
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xab0]
or ecx, 1
mov dword [ebp - 0xab0], ecx
mov ecx, dword [ebp - 0xac0]
call fcn.0040c090
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x4177b0
mov dword [ebp - 0xac4], 1
jmp 0x4177ba
mov dword [ebp - 0xac4], 0
mov dl, byte [ebp - 0xac4]
mov byte [ebp - 0xa91], dl
mov eax, dword [ebp - 0xab0]
and eax, 1
je 0x4177e3
and dword [ebp - 0xab0], 0xfffffffe
lea ecx, [ebp - 0xa98]
call fcn.0040ce70
movzx ecx, byte [ebp - 0xa91]
test ecx, ecx
je 0x417812
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417e10
mov eax, dword [ebp - 0xa9c]
jmp 0x417904
lea edx, [ebp - 0x444]
push edx
push 0x416970
push 0
lea eax, [ebp - 0x85c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
mov dword [ebp - 0x238], eax
lea ecx, [ebp - 0x85c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x238], 0
jne 0x41786d
mov dword [ebp - 0xaa0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417e10
mov eax, dword [ebp - 0xaa0]
jmp 0x417904
push str.360ini.dll
lea edx, [ebp - 0x444]
push edx
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x4178ab
mov dword [ebp - 0xaa4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417e10
mov eax, dword [ebp - 0xaa4]
jmp 0x417904
lea ecx, [ebp - 0x64c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4178dd
mov dword [ebp - 0xaa8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417e10
mov eax, dword [ebp - 0xaa8]
jmp 0x417904
lea edx, [ebp - 0x64c]
push edx
call fcn.0041a2e0
mov dword [ebp - 0xaac], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417e10
mov eax, dword [ebp - 0xaac]
lea esp, [ebp - 0xac8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0041a95f
mov esp, ebp
pop ebp
ret