Function at 0x417d93
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
sub esp, 0x824
mov edx, dword [esp + 0x82c]
push ebx
xor ebx, ebx
push ebp
push esi
cmp edx, ebx
push edi
mov dword [esp + 0x10], ecx
je 0x418032
cmp word [edx], bx
je 0x418032
push 6
mov esi, str.360sess.exe
pop ecx
lea edi, [esp + 0x62c]
rep movsd dword es:[edi], dword [esi]
push 0x7c
xor eax, eax
pop ecx
lea edi, [esp + 0x644]
rep stosd dword es:[edi], eax
mov esi, 0x81
lea edi, [esp + 0x16]
mov ecx, esi
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str._sShield360SESS
lea eax, [esp + 0x42c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x24]
push 0x104
push eax
lea eax, [esp + 0x644]
push eax
lea eax, [esp + 0x440]
push eax
call fcn.00420f9d
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
test eax, eax
je 0x417eeb
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x417eeb
lea eax, [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x417eeb
push 0x31
push dword [0x44462c]
push 0x4401d4
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x418032
lea eax, [esp + 0x14]
push 0x1388
push eax
call fcn.00420a4d
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call edi
lea eax, [esp + 0x14]
push eax
call ebp
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x417eeb
push 0x35
push dword [0x44462c]
push 0x44019c
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x418032
push 0x1f4
jmp 0x417ead
and word [esp + 0x21c], 0
mov ecx, esi
xor eax, eax
lea edi, [esp + 0x21e]
rep stosd dword es:[edi], eax
push str.360se.exe.bak
push dword [esp + 0x840]
stosw word es:[edi], ax
push 0x43bb44
lea eax, [esp + 0x228]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [esp + 0x21c]
push eax
call ebp
mov esi, dword [esp + 0x840]
push esi
call ebx
test eax, eax
je 0x417f5b
mov edi, dword [esp + 0x10]
push 0x43d9ac
push dword [esp + 0x840]
mov ecx, edi
call fcn.004135a2
jmp 0x417f5f
mov edi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x417ff8
push esi
call ebp
test eax, eax
jne 0x417ff8
push 0x31
push dword [0x44462c]
push 0x4401d4
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
pop ecx
cmp eax, ecx
jne 0x417ff4
mov eax, dword [edi + 4]
mov dword [edi + 0x74], ecx
cmp dword [eax + 8], ecx
jne 0x417fa4
mov dword [edi + 0x78], ecx
push 0x1388
push dword [esp + 0x840]
call fcn.00420be0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call edi
push esi
call ebp
push esi
call ebx
test eax, eax
je 0x417ff8
push 0x35
push dword [0x44462c]
push 0x44019c
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x417ff4
push 0x1f4
jmp 0x417fc2
xor esi, esi
jmp 0x418024
cmp dword [esp + 0x844], 0
jne 0x418021
lea eax, [esp + 0x21c]
push eax
call ebx
test eax, eax
je 0x418021
push 0
lea eax, [esp + 0x220]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
pop esi
lea eax, [esp + 0x21c]
push eax
call ebp
mov eax, esi
jmp 0x418034
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x824
ret 0x10