Function at 0x41b9f4
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
push ebx
mov ebx, dword [ebp + 0x1c0]
push esi
push edi
lea eax, [ebp - 0x60]
push eax
push 0x4bf09c
mov esi, 0x4bf070
xor edi, edi
push esi
mov ecx, 0x4ebcc8
mov dword [ebp - 0x60], edi
call fcn.0046bd58
test eax, eax
je 0x41ba5e
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41ba57
push edi
push edi
push 0xbd3
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x41bf6e
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.00417402
test eax, eax
je 0x41bae2
mov esi, 0x4ecda4
push esi
lea ecx, [ebp - 0x58]
call fcn.0040ba90
push 0x4bf008
lea ecx, [ebp - 0x58]
call fcn.0040c8e0
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0x4beff0
lea ecx, [ebp - 0x5c]
call fcn.0040c8e0
mov esi, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x58]
push 0x41
push esi
push ebx
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x41baca
push str.http:__sfdw.360safe.com_safesetup_2000.exe
call fcn.00446e27
pop ecx
lea ecx, [esi - 0x10]
call fcn.0040dd20
lea ecx, [ebx - 0x10]
call fcn.0040dd20
xor eax, eax
inc eax
jmp 0x41bf6e
push 0x404
call fcn.00417730
push esi
push 0x4bef84
push ebx
call fcn.004173b6
push 0x4bef80
push edi
call fcn.00486979
add esp, 0x18
push edi
push ebx
push edi
mov ecx, 0x4ebc8c
call fcn.00418194
call fcn.0041adc4
call fcn.0041b9b4
mov ecx, eax
call fcn.0047531f
call fcn.00417eb5
mov ecx, eax
call fcn.00475637
call fcn.00464164
mov ecx, eax
call fcn.0046449b
lea ecx, [ebp - 0x68]
call fcn.0046a154
call fcn.0046895e
test eax, eax
jne 0x41bb6f
push 0x40
push 0x96
push 0xa2
push edi
call fcn.004503a0
add esp, 0x10
lea ecx, [ebp - 0x68]
call fcn.0046a130
jmp 0x41ba57
xor eax, eax
push 0x206
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push edi
push eax
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 0x4ecda4
test eax, eax
jne 0x41bc0b
push 0x40
mov ebx, 0x96
push ebx
push 0xbf
push edi
call fcn.004503a0
add esp, 0x10
cmp eax, 1
jne 0x41bcbb
push esi
lea ecx, [ebp - 0x58]
call fcn.0040ba90
lea eax, [ebp - 0x58]
push eax
call fcn.0041b857
pop ecx
test eax, eax
jne 0x41bc00
push 0x40
push ebx
push 0xc0
push edi
call fcn.004503a0
mov ecx, dword [ebp - 0x58]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040dd20
jmp 0x41bb62
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0040dd20
push esi
lea ecx, [ebp - 0x58]
call fcn.0040ba90
push 0x8f
lea ecx, [ebp - 0x58]
call fcn.0040bf10
lea eax, [ebp - 0x58]
push eax
call fcn.0041aca4
pop ecx
push 0x94
lea ecx, [ebp - 0x58]
mov ebx, eax
call fcn.0040bf10
cmp ebx, edi
je 0x41bc4a
lea eax, [ebp - 0x58]
push eax
call fcn.0041aca4
pop ecx
mov ebx, eax
push 0x9b
lea ecx, [ebp - 0x58]
call fcn.0040bf10
cmp ebx, edi
je 0x41bc69
lea eax, [ebp - 0x58]
push eax
call fcn.0041aca4
pop ecx
cmp eax, edi
jne 0x41bcc8
push 0x18
call fcn.0041b9b4
mov ecx, eax
call fcn.004753e7
push 0x40
push 0x4bef78
push 0x4bef68
push 0x4bef20
push edi
call fcn.004507c3
add esp, 0x14
cmp eax, 1
jne 0x41bca1
push 0x4bef04
call fcn.00446e27
pop ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0040dd20
lea ecx, [ebp - 0x68]
call fcn.0046a130
mov eax, edi
jmp 0x41bf6e
push 0x40
push ebx
push 0xc1
jmp 0x41bb59
push edi
push 0x64
call fcn.004473d5
pop ecx
pop ecx
call fcn.0046ced8
mov ecx, eax
call fcn.0046d0f5
test eax, eax
je 0x41bf2b
call fcn.0046ced8
mov ecx, eax
call fcn.0046cede
test eax, eax
je 0x41bf2b
mov ecx, 0x4ebc68
call fcn.0041bff4
test eax, eax
jne 0x41bd16
push edi
push 0x66
call fcn.004473d5
pop ecx
or edi, 0xffffffff
jmp 0x41bca0
lea ecx, [ebp - 0x80]
call fcn.004685f5
mov eax, dword [ebp - 0x78]
cmp dword [eax - 0xc], edi
je 0x41bd36
lea eax, [ebp - 0x78]
push eax
call fcn.0041b9b4
mov ecx, eax
call fcn.00474f68
mov ebx, 0x4ec5f8
mov ecx, ebx
call fcn.0046e0d8
mov ecx, ebx
call fcn.0046ef0d
cmp dword [0x4ec658], edi
je 0x41be46
push 0x4ec63c
call fcn.0041b68e
pop ecx
test eax, eax
je 0x41bdb2
push edi
push 0x68
call fcn.004473d5
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0xc3
lea ecx, [ebp - 0x5c]
call fcn.0040bf10
mov esi, dword [ebp - 0x5c]
push 0x40
push 0x4bef78
push 0x4ccc68
push esi
push edi
call fcn.004507c3
add esp, 0x14
lea ecx, [esi - 0x10]
call fcn.0040dd20
lea ecx, [ebp - 0x80]
call fcn.0046847e
jmp 0x41bca1
cmp dword [0x4ec658], edi
je 0x41be46
push 0x4ec63c
call fcn.00418509
pop ecx
test eax, eax
je 0x41bdf2
push edi
push 0x86
call fcn.004473d5
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0x4beec0
lea ecx, [ebp - 0x5c]
call fcn.0040c8e0
jmp 0x41bd84
cmp dword [0x4ec658], edi
je 0x41be46
push 0x4ec63c
call fcn.0041b6cc
pop ecx
test eax, eax
je 0x41be23
push edi
push 0x69
call fcn.004473d5
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040ba90
push 0x4bee78
jmp 0x41bde8
cmp dword [0x4ec658], edi
je 0x41be46
call fcn.00432bfd
test eax, eax
je 0x41be38
push 0x12
jmp 0x41be3a
push 0x13
push 0x7d0
call fcn.004472a6
pop ecx
pop ecx
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, ebx
call fcn.0046d3e1
test eax, eax
je 0x41beab
push dword [ebp - 0x6c]
lea eax, [ebp - 0x70]
push eax
mov ecx, ebx
call fcn.0046e4b0
push str.parent
lea ecx, [ebp - 0x5c]
call fcn.0040b680
mov eax, dword [ebp - 0x70]
push dword [eax - 0xc]
lea ecx, [ebp - 0x5c]
push eax
call fcn.0041a8eb
push dword [ebp - 0x5c]
push 0x7f
call fcn.004473d5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, 0x4ebc68
call fcn.0041d09b
push dword [ebp + 0x1cc]
push dword [ebp + 0x1c8]
call fcn.0041aee6
pop ecx
pop ecx
mov ecx, 0x4ebcc8
mov esi, eax
call fcn.0046bb7e
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x4ebc8c
call fcn.0041ac02
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0041ae55
call fcn.0041b9b4
mov ecx, eax
call fcn.00474d80
call fcn.00429dd9
mov ecx, eax
call fcn.00429ed1
lea ecx, [ebp - 0x80]
call fcn.0046847e
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0040dd20
lea ecx, [ebp - 0x68]
call fcn.0046a130
mov eax, esi
jmp 0x41bf6e
push edi
push 0x65
call fcn.004473d5
pop ecx
pop ecx
push 0x19
call fcn.0041b9b4
mov ecx, eax
call fcn.004753e7
push 0x40
push 0x80
push 0x8d
push edi
call fcn.004503a0
mov ecx, dword [ebp - 0x58]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040dd20
lea ecx, [ebp - 0x68]
call fcn.0046a130
or eax, 0xffffffff
mov ecx, dword [ebp + 0x1b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484647
add ebp, 0x1b8
leave
ret 0x10