Function at 0x411390
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], 0
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
mov dword [ebp - 8], esi
test eax, eax
je 0x411647
mov ecx, str.Modules360cav.dll
mov byte [ebp - 0x114], 0
test ecx, ecx
je 0x411462
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x914]
push str.Modules360cav.dll
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
test eax, eax
je 0x411448
lea edx, [ebp - 0x914]
push 0x800
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x914]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea ecx, [ebp - 0x914]
push str.Modules360cav.dll
lea edx, [ebp - 0x914]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x914]
push 0x104
lea ecx, [ebp - 0x114]
push eax
push ecx
jmp 0x411459
push 0x104
lea edx, [ebp - 0x114]
push str.Modules360cav.dll
push edx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x411518
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00422fa0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, esp
push esi
push edi
lea edx, [ebp - 0x114]
push 0xffffffffffffffff
push edx
push 0
push 0
mov word [edi], 0
call ebx
push edi
call fcn.00420f30
add esp, 4
test eax, eax
jne 0x411515
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00422fa0
mov edi, esp
push esi
push edi
lea ecx, [ebp - 0x114]
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [edi], 0
call ebx
call fcn.00420d70
push eax
push edi
call fcn.00420d80
mov eax, dword [ebp - 8]
add esp, 8
lea esp, [ebp - 0x920]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 8]
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x411647
push str.GetAntiVirusInfoA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x411640
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
call ebx
test eax, eax
je 0x411640
mov eax, dword [ebp - 4]
test eax, eax
jle 0x411640
inc eax
push eax
mov dword [ebp - 4], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [ebp - 4]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp - 0xc], esi
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push esi
call ebx
test eax, eax
je 0x411631
test esi, esi
jne 0x4115a8
xor ebx, ebx
jmp 0x4115b1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
cmp edx, 1
jg 0x4115c6
cmp ebx, dword [eax - 4]
jle 0x411600
mov edx, dword [0x42a2c4]
add eax, 0xfffffff4
cmp eax, edx
je 0x4115f4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4115ec
mov ecx, dword [edi]
sub ecx, 0xc
push ecx
call fcn.00420d62
add esp, 4
mov edx, dword [0x42a2c0]
mov dword [edi], edx
push ebx
mov ecx, edi
call fcn.00402890
test eax, eax
je 0x41162a
lea eax, [ebx + 1]
cmp eax, ebx
jb 0x41161f
mov edi, dword [edi]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [eax - 8], ebx
mov ecx, dword [edi]
mov byte [ecx + ebx], 0
mov dword [ebp - 8], 1
push esi
call fcn.00420d62
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x920]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4