Function at 0x414169
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov edi, ecx
push 0x7d0
push dword [edi + 0x1c]
lea ebx, [edi + 0x1c]
call fcn.0041c7df
pop ecx
lea eax, [ebp - 8]
pop ecx
push str._seext.dll
push ebx
push eax
call fcn.00418da8
push dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._sefix.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._seup.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._sefix_bak.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str._seup_bak.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push str.urls.dat
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
push dword [edi + 0x18]
call esi
and word [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
push str.360se.exe.bak
push dword [ebx]
stosw word es:[edi], ax
push 0x42f9cc
lea eax, [ebp - 0x218]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call esi
push str._sefix.exe
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
push dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.00404c0d
cmp dword [ebp - 0xc], 0
je 0x4142e3
push str._sefix_bak.exe
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
mov eax, dword [eax]
push str._sefix.exe
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
push dword [ebp - 0xc]
mov eax, dword [eax]
push eax
call fcn.0041d509
pop ecx
pop ecx
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
push str._seup.exe
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call edi
lea ecx, [ebp - 4]
mov edi, eax
call fcn.00404c0d
test edi, edi
je 0x41433f
push str._seup_bak.exe
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00418da8
mov edi, dword [eax]
push str._seup.exe
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
mov eax, dword [eax]
push edi
push eax
call fcn.0041d509
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
push str.extensionsComCore
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call fcn.0041d21e
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push str.extensionsExtMinibar
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call fcn.0041d21e
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push str.extensionsExtFlvDownload
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call fcn.0041d21e
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push str.extensionsExtChongZhi
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call fcn.0041d21e
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
mov edi, str.360SEUP.dll.bak
lea eax, [ebp - 4]
push edi
push ebx
push eax
call fcn.00418da8
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
push edi
lea eax, [ebp - 8]
push ebx
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0x4328dc
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00418da8
push dword [ebp - 4]
mov eax, dword [eax]
push eax
call fcn.0041d509
pop ecx
pop ecx
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 8]
call fcn.00404c0d
push edi
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
push dword [eax]
call esi
neg eax
sbb al, al
inc al
lea ecx, [ebp - 4]
mov byte [ebp - 0xd], al
call fcn.00404c0d
cmp byte [ebp - 0xd], 0
je 0x414459
push edi
lea eax, [ebp - 4]
push ebx
push eax
call fcn.00418da8
mov eax, dword [eax]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret