Function at 0x40fa72
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3c8]
sub esp, 0x448
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp + 0x3c4], eax
push ebx
mov ebx, dword [ebp + 0x3d0]
push esi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.0040b135
test eax, eax
je 0x40fb1b
mov eax, dword [0x49501c]
push 0x47ff60
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], eax
call fcn.0040e910
mov eax, dword [0x49501c]
push 0x47ff48
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], eax
call fcn.0040e910
push 0x41
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x40fb03
push eax
push esi
push esi
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x54]
call fcn.0040bf88
lea ecx, [ebp - 0x58]
call fcn.0040bf88
xor eax, eax
inc eax
jmp 0x4100b5
push edi
push 0x404
call fcn.0040b558
mov edi, str.Q360InstallerMainWnd
push edi
push 0x47fea8
push ebx
call fcn.0040b0e9
push 0x47fea4
push esi
call fcn.0044c698
add esp, 0x18
push esi
push ebx
push esi
mov ecx, 0x49b988
call fcn.0040bebf
call fcn.0040edfc
call fcn.0040fa32
mov ecx, eax
call fcn.00442dc0
lea eax, [ebp - 0x60]
push eax
push str.360Installer.exe
push edi
mov ecx, 0x49b9c4
mov dword [ebp - 0x60], esi
call fcn.0043f4af
test eax, eax
je 0x40fbeb
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40ffd5
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x40fba9
push 9
push dword [ebp - 0x60]
call edi
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x40fbbd
push 5
push dword [ebp - 0x60]
call edi
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp - 0x60]
call edi
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [ebp - 0x60]
call edi
jmp 0x40ffd5
call fcn.0040bc02
mov ecx, eax
call fcn.004430bd
call fcn.0043b12f
mov ecx, eax
call fcn.0043b466
lea ecx, [ebp - 0x6c]
call fcn.0043d7c5
call fcn.0043c09c
test eax, eax
jne 0x40fc25
push 0x40
push 0x96
push 0xa2
jmp 0x40fd65
xor eax, eax
push 0x206
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x4e]
push esi
push eax
call fcn.00449bc0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0x104
call ebx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, 0x96
test eax, eax
jne 0x40fcb2
push 0x40
push edi
push 0xbf
push esi
call fcn.0042beee
add esp, 0x10
cmp eax, 1
jne 0x40fd5d
mov eax, dword [0x49501c]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
call fcn.0040ed0d
pop ecx
test eax, eax
jne 0x40fcaa
push 0x40
push edi
push 0xc0
push esi
call fcn.0042beee
add esp, 0x10
lea ecx, [ebp - 0x54]
jmp 0x40ffc8
lea ecx, [ebp - 0x54]
call fcn.0040bf88
mov eax, dword [0x49501c]
push 0x8f
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
call fcn.0040ec64
lea eax, [ebp - 0x5c]
push eax
call fcn.0040f7b9
pop ecx
push 0x94
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x54], eax
call fcn.0040ec64
cmp dword [ebp - 0x54], esi
je 0x40fcf3
lea eax, [ebp - 0x5c]
push eax
call fcn.0040f7b9
pop ecx
mov dword [ebp - 0x54], eax
push 0x9b
lea ecx, [ebp - 0x5c]
call fcn.0040ec64
cmp dword [ebp - 0x54], esi
je 0x40fd13
lea eax, [ebp - 0x5c]
push eax
call fcn.0040f7b9
pop ecx
cmp eax, esi
jne 0x40fd73
push 0x18
call fcn.0040fa32
mov ecx, eax
call fcn.00442e80
push 0x40
push 0x47fe78
push 0x47fe68
push 0x47fe20
push esi
call fcn.0042c026
add esp, 0x14
cmp eax, 1
jne 0x40ffc5
push eax
push esi
push esi
push str.http:__360.cn
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40ffc5
push 0x40
push edi
push 0xc1
push esi
call fcn.0042beee
add esp, 0x10
jmp 0x40ffcd
call fcn.0043ffcb
mov ecx, eax
call fcn.0044022f
test eax, eax
je 0x41007e
call fcn.0043ffcb
mov ecx, eax
call fcn.0043ffd1
test eax, eax
je 0x41007e
xor eax, eax
push 0x208
mov word [ebp + 0x1b8], ax
lea eax, [ebp + 0x1ba]
push esi
push eax
call fcn.00449bc0
add esp, 0xc
lea eax, [ebp + 0x1b8]
push eax
push 0x104
call ebx
push esi
lea eax, [ebp + 0x1b8]
push 0xf000000
push eax
call fcn.0043bfe9
add esp, 0xc
test eax, eax
jne 0x40fe65
push 0x1a
call fcn.0040fa32
mov ecx, eax
call fcn.00442e80
lea eax, [ebp + 0x1b8]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0043cb72
pop ecx
pop ecx
push 1
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040f6b8
push eax
lea ecx, [ebp - 0x58]
call fcn.0040e8c0
lea ecx, [ebp - 0x64]
call fcn.0040bf88
mov eax, dword [0x49501c]
push 0xf0
push dword [ebp - 0x58]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push 0x95
push eax
call fcn.0040f709
push 0x40
push edi
push dword [ebp - 0x54]
push esi
call fcn.0042bf8a
add esp, 0x20
lea ecx, [ebp - 0x54]
call fcn.0040bf88
lea ecx, [ebp - 0x58]
call fcn.0040bf88
jmp 0x40ffc5
lea ecx, [ebp - 0x80]
call fcn.0043bdac
mov eax, dword [ebp - 0x78]
cmp dword [eax - 8], esi
je 0x40fe85
lea eax, [ebp - 0x78]
push eax
call fcn.0040fa32
mov ecx, eax
call fcn.00442a1c
mov ebx, 0x49c1e0
mov ecx, ebx
call fcn.00440bb5
mov ecx, ebx
call fcn.004409f4
cmp dword [0x49c23c], esi
je 0x40fef0
mov ebx, 0x49c220
push ebx
call fcn.0040f87f
pop ecx
test eax, eax
je 0x40fef0
push ebx
call fcn.0040f8b7
pop ecx
test eax, eax
jne 0x40fef0
mov eax, dword [0x49501c]
push 0xc3
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], eax
call fcn.0040ec64
push 0x40
push 0x47fe78
push 0x4874bc
push dword [ebp - 0x54]
push esi
call fcn.0042c026
add esp, 0x14
lea ecx, [ebp - 0x54]
jmp 0x40ffb8
call fcn.0043cffd
test eax, eax
jne 0x40fff4
push 0x49c25c
lea ecx, [ebp - 0x64]
call fcn.0040f623
mov eax, dword [0x49501c]
push 0x9c
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], eax
call fcn.0040ec64
push dword [ebp - 0x54]
call fcn.0044aa30
pop ecx
push 0x9d
lea ecx, [ebp - 0x58]
mov dword [0x49c28c], eax
call fcn.0040ec64
push dword [ebp - 0x58]
call fcn.0044aa30
mov dword [0x49c290], eax
mov eax, dword [0x49c28c]
shl eax, 0x14
cdq
push edx
push eax
push dword [ebp - 0x64]
call fcn.0043bfe9
add esp, 0x10
test eax, eax
jne 0x40ffdc
push 0x1b
call fcn.0040fa32
mov ecx, eax
call fcn.00442e80
mov eax, dword [0x49501c]
push dword [0x49c28c]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push 0x99
push eax
call fcn.0040f709
push 0x40
push edi
push dword [ebp - 0x70]
push esi
call fcn.0042bf8a
add esp, 0x1c
lea ecx, [ebp - 0x70]
call fcn.0040bf88
lea ecx, [ebp - 0x58]
call fcn.0040bf88
lea ecx, [ebp - 0x54]
call fcn.0040bf88
lea ecx, [ebp - 0x64]
call fcn.0040bf88
lea ecx, [ebp - 0x80]
call fcn.0043bc48
lea ecx, [ebp - 0x5c]
call fcn.0040bf88
lea ecx, [ebp - 0x6c]
call fcn.0043d781
xor eax, eax
jmp 0x4100b4
lea ecx, [ebp - 0x58]
call fcn.0040bf88
lea ecx, [ebp - 0x54]
call fcn.0040bf88
lea ecx, [ebp - 0x64]
call fcn.0040bf88
cmp dword [0x49c23c], esi
je 0x410017
call fcn.0041b459
test eax, eax
je 0x410009
push 0x12
jmp 0x41000b
push 0x13
push 0x7d0
call fcn.004296de
pop ecx
pop ecx
push dword [ebp + 0x3dc]
push dword [ebp + 0x3d8]
call fcn.0040ef12
pop ecx
pop ecx
mov ecx, 0x49b9c4
mov esi, eax
call fcn.0043f2d5
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x49b988
call fcn.0040e83e
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0040ee87
call fcn.0040fa32
mov ecx, eax
call fcn.004427cb
lea ecx, [ebp - 0x80]
call fcn.0043bc48
lea ecx, [ebp - 0x5c]
call fcn.0040bf88
lea ecx, [ebp - 0x6c]
call fcn.0043d781
mov eax, esi
jmp 0x4100b4
push 0x19
call fcn.0040fa32
mov ecx, eax
call fcn.00442e80
push 0x40
push 0x80
push 0x8d
push esi
call fcn.0042beee
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0040bf88
lea ecx, [ebp - 0x6c]
call fcn.0043d781
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp + 0x3c4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00449c3a
add ebp, 0x3c8
leave
ret 0x10