Function at 0x417c87
Capabilities:
Check if file exists
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
push edi
mov dword [ebp - 0x520], ecx
mov ecx, dword [ebp - 0x520]
call fcn.004164be
cmp eax, 1
jne 0x417cb1
mov eax, 1
jmp 0x417eea
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x51c], 0
mov al, byte [0x439af4]
mov byte [ebp - 0x414], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439af8]
mov byte [ebp - 0x518], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x517]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x439afc]
mov byte [ebp - 0x208], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.kwatch.vxd]
mov dword [ebp - 0x104], eax
mov ecx, dword [0x435a40]
mov dword [ebp - 0x100], ecx
mov dx, word [0x435a44]
mov word [ebp - 0xfc], dx
mov al, byte [0x435a46]
mov byte [ebp - 0xfa], al
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0xf9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, dword [str.kavkrnl.vxd]
mov dword [ebp - 0x310], ecx
mov edx, dword [0x435a4c]
mov dword [ebp - 0x30c], edx
mov eax, dword [0x435a50]
mov dword [ebp - 0x308], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x304]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x417dc5
push 0
push str.KANUpdate2::CheckFireWallFile_GetSystemDirectory_fail
call fcn.00410257
add esp, 8
jmp 0x417ee8
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x414]
push eax
push 0x435a8c
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x417e4d
lea eax, [ebp - 0x518]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call fcn.00405071
add esp, 0xc
push 0
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x417e4d
push 0
push str.KANUpdate2::CheckFireWallFile_CopyFile_kwatch.vxd_fail
call fcn.00410257
add esp, 8
jmp 0x417ee6
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x414]
push edx
push 0x435acc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x417ed2
lea edx, [ebp - 0x518]
push edx
push 0x104
lea eax, [ebp - 0x310]
push eax
call fcn.00405071
add esp, 0xc
push 0
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x518]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x417ed2
push 0
push str.KANUpdate2::CheckFireWallFile_CopyFile_kavkrnl.vxd_fail
call fcn.00410257
add esp, 8
jmp 0x417ee4
mov dword [ebp - 0x51c], 1
mov eax, dword [ebp - 0x51c]
jmp 0x417eea
jmp 0x417edc
jmp 0x417edc
jmp 0x417edc
pop edi
mov esp, ebp
pop ebp
ret