Function at 0x416700
Capabilities:
Accept command line arguments
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46010a
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x33c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x354]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
mov dword [esp + 0x35c], 0
je 0x416773
mov eax, dword [esp + 0x364]
cmp dword [eax - 0xc], 0
je 0x416f12
lea edx, [esp + 0x364]
lea ecx, [esi + 0x10]
push edx
call fcn.00409200
jmp 0x416f12
mov edx, dword [0x4792d8]
push 0x104
lea ecx, [esp + 0x14c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x148]
push eax
call ebp
lea ecx, [esp + 0x148]
push ecx
lea ecx, [esp + 0x30]
call fcn.004098a0
mov byte [esp + 0x35c], 1
call fcn.004230f0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00407ab0
lea edi, [eax + 0x10]
mov dword [esp + 0x24], edi
mov byte [esp + 0x360], 2
call fcn.004231d0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00407ab0
add eax, 0x10
mov dword [esp + 0x30], eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x368], 3
call fcn.004232b0
add esp, 0xc
cmp dword [edi - 0xc], 0
mov bl, 4
mov byte [esp + 0x35c], bl
je 0x41691e
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00407ab0
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
mov byte [esp + 0x368], 5
call fcn.00407ab0
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x364], bl
call fcn.004226e0
add esp, 8
test al, al
je 0x41691e
push str.Utils
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040bb30
add esp, 0xc
lea ecx, [esi + 8]
push eax
mov byte [esp + 0x360], 6
call fcn.00409200
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x35c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4168b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.deepscancloudcom2.dll
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040bb30
add esp, 0xc
lea ecx, [esi + 0x14]
push eax
mov byte [esp + 0x360], 7
call fcn.00409200
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x35c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416905
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edx, [esp + 0x20]
lea ecx, [esi + 0xc]
push edx
call fcn.00409200
mov dword [esi + 0x38], 3
jmp 0x416d8a
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
je 0x416a34
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00407ab0
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
mov byte [esp + 0x368], 8
call fcn.00407ab0
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x364], bl
call fcn.004226e0
add esp, 8
test al, al
je 0x416a34
push str.DrvMgr
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040bb30
add esp, 0xc
lea edi, [esi + 8]
push eax
mov ecx, edi
mov byte [esp + 0x360], 9
call fcn.00409200
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x35c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4169d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.cloudcom2.dll
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.0040bb30
add esp, 0xc
lea ecx, [esi + 0x14]
push eax
mov byte [esp + 0x360], 0xa
call fcn.00409200
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x35c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416a1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edx, [esp + 0x24]
lea ecx, [esi + 0xc]
push edx
call fcn.00409200
mov dword [esi + 0x38], 2
jmp 0x416d8a
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
je 0x416b04
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00407ab0
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
mov byte [esp + 0x368], 0xb
call fcn.00407ab0
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x364], bl
call fcn.004226e0
add esp, 8
test al, al
je 0x416b04
lea ecx, [esp + 0x28]
lea edi, [esi + 8]
push ecx
mov ecx, edi
call fcn.00409200
push str.cloudcom2.dll
lea edx, [esp + 0x18]
push edi
push edx
call fcn.0040bb30
add esp, 0xc
lea ecx, [esi + 0x14]
push eax
mov byte [esp + 0x360], 0xc
call fcn.00409200
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x35c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416aeb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edx, [esp + 0x28]
lea ecx, [esi + 0xc]
push edx
call fcn.00409200
mov dword [esi + 0x38], 1
jmp 0x416d8a
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x34]
call fcn.004098a0
push str.360Base.dll
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x368], 0xd
call fcn.0040bb30
add esp, 0xc
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x35c], 0xf
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416b58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ecx
call edi
test eax, eax
je 0x416bdc
lea edx, [esp + 0x148]
lea edi, [esi + 8]
push edx
mov ecx, edi
call fcn.004095b0
push str.cloudcom2.dll
lea eax, [esp + 0x20]
push edi
push eax
call fcn.0040bb30
add esp, 0xc
lea ecx, [esi + 0x14]
push eax
mov byte [esp + 0x360], 0x10
call fcn.00409200
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x35c], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416bc7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0xc]
push edi
call fcn.00409200
mov dword [esi + 0x38], 1
jmp 0x416d63
lea ecx, [esp + 0x148]
push ecx
call ebp
lea edx, [esp + 0x148]
push edx
lea ecx, [esp + 0x1c]
call fcn.004098a0
push str.360Base.dll
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x368], 0x11
call fcn.0040bb30
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x360], 0x12
call fcn.00409200
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x35c], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416c4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x35c], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416c74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
test eax, eax
je 0x416d63
lea edx, [esp + 0x148]
push edx
lea ecx, [esp + 0x20]
call fcn.004098a0
push str.Utils
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x368], 0x13
call fcn.0040bb30
add esp, 0xc
lea ecx, [esi + 8]
push eax
mov byte [esp + 0x360], 0x14
call fcn.00409200
lea ecx, [esp + 0x18]
call fcn.00407a10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x35c], 0xf
call fcn.00407a10
lea ecx, [esp + 0x148]
push ecx
lea ecx, [esp + 0x20]
call fcn.004098a0
push str.deepscancloudcom2.dll
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x368], 0x15
call fcn.0040bb30
add esp, 0xc
lea ecx, [esi + 0x14]
push eax
mov byte [esp + 0x360], 0x16
call fcn.00409200
lea ecx, [esp + 0x18]
call fcn.00407a10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x35c], 0xf
call fcn.00407a10
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x1c]
call fcn.004098a0
lea ecx, [esi + 0xc]
push eax
mov byte [esp + 0x360], 0x17
call fcn.00409200
lea ecx, [esp + 0x18]
call fcn.00407a10
mov dword [esi + 0x38], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x35c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416d8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ecx, esi
call fcn.00416570
call fcn.00415200
push 0x110
lea ecx, [esp + 0x3c]
push 0
push ecx
mov dword [esi + 0x28], eax
mov dword [esp + 0x40], 0
call fcn.0043f440
lea edx, [esp + 0x40]
push edx
call fcn.00421080
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x374]
add esp, 0x10
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edx
cmp dword [eax - 0xc], 0
jne 0x416e4f
push 0
push 0x1a
lea ecx, [esp + 0x150]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 1
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00415e00
mov eax, dword [eax]
push eax
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416e3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x148]
lea edi, [esi + 0x10]
push ecx
mov ecx, edi
call fcn.004095b0
jmp 0x416e61
lea edx, [esp + 0x364]
lea edi, [esi + 0x10]
push edx
mov ecx, edi
call fcn.00409200
mov eax, dword [edi]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esi], 1
mov byte [esp + 0x35c], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416e9a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x35c], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416ec2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x35c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416eea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x35c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416f12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x364]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x35c], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416f3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x354]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x33c]
xor ecx, esp
call fcn.0043f03d
add esp, 0x34c
ret 4