Function at 0x41030e
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
sub esp, 0xa2c
mov edx, dword [esp + 0xa34]
push ebx
push ebp
push esi
test edx, edx
push edi
mov dword [esp + 0x10], ecx
je 0x41049f
cmp word [edx], 0
je 0x41049f
and word [esp + 0x62c], 0
mov ebx, 0x81
mov ecx, ebx
xor eax, eax
lea edi, [esp + 0x62e]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str._sextensions
lea eax, [esp + 0x634]
push 0x103
push eax
call ebp
lea eax, [esp + 0x63c]
push 0x7d0
push eax
call fcn.00414318
add esp, 0x18
mov esi, str.360sess.exe
lea edi, [esp + 0x834]
xor eax, eax
push 6
and word [esp + 0x18], ax
pop ecx
and word [esp + 0x424], 0
rep movsd dword es:[edi], dword [esi]
push 0x7c
lea edi, [esp + 0x850]
pop ecx
rep stosd dword es:[edi], eax
mov ecx, ebx
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push dword [esp + 0xa44]
mov ecx, ebx
xor eax, eax
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._sShield360SESS
lea eax, [esp + 0x42c]
push 0x103
push eax
call ebp
lea eax, [esp + 0x24]
push 0x104
push eax
lea eax, [esp + 0x84c]
push eax
lea eax, [esp + 0x440]
push eax
call fcn.004146be
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
test eax, eax
je 0x4104ae
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x4104ae
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x4104ae
push 0x31
push dword [0x42a774]
push 0x429124
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x41049f
lea eax, [esp + 0x14]
push 0x1388
push eax
call fcn.00414185
pop ecx
pop ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x4104ae
push 0x35
push dword [0x42a774]
push 0x4290ec
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
je 0x410463
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 0x10
and word [esp + 0x21c], 0
mov ecx, ebx
xor eax, eax
lea edi, [esp + 0x21e]
rep stosd dword es:[edi], eax
push str.360se.exe.bak
push dword [esp + 0xa48]
stosw word es:[edi], ax
push 0x424924
lea eax, [esp + 0x228]
push 0x103
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x14
lea eax, [esp + 0x21c]
push eax
call edi
mov ebp, dword [esp + 0xa48]
push ebp
call esi
test eax, eax
je 0x410520
mov ebx, dword [esp + 0x10]
push 0x4269b4
push dword [esp + 0xa48]
mov ecx, ebx
call fcn.0040cedf
jmp 0x410524
mov ebx, dword [esp + 0x10]
push ebp
call esi
test eax, eax
je 0x4105bd
push ebp
call edi
test eax, eax
jne 0x4105bd
push 0x31
push dword [0x42a774]
push 0x429124
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
pop ecx
cmp eax, ecx
jne 0x4105b9
mov eax, dword [ebx + 4]
mov dword [ebx + 0x50], ecx
cmp dword [eax + 8], ecx
jne 0x410569
mov dword [ebx + 0x54], ecx
push 0x1388
push dword [esp + 0xa48]
call fcn.00414318
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call ebx
push ebp
call edi
push ebp
call esi
test eax, eax
je 0x4105bd
push 0x35
push dword [0x42a774]
push 0x4290ec
push dword [esp + 0xa4c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x4105b9
push 0x1f4
jmp 0x410587
xor esi, esi
jmp 0x4105e9
cmp dword [esp + 0xa4c], 0
jne 0x4105e6
lea eax, [esp + 0x21c]
push eax
call esi
test eax, eax
je 0x4105e6
push 0
lea eax, [esp + 0x220]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
pop esi
lea eax, [esp + 0x21c]
push eax
call edi
mov eax, esi
jmp 0x4104a1