Function at 0x415060
Capabilities:
Check if file exists
Check mutex on windows
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x337c
call fcn.004f78e0
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x52cb74
mov eax, dword [ebp + 8]
push eax
call fcn.0041b370
add esp, 8
test eax, eax
je 0x4150e8
call fcn.00414db0
lea ecx, [ebp - 0x18b0]
push ecx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x4150b1
xor eax, eax
jmp 0x415720
push 0x52cb84
lea edx, [ebp - 0x18b0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x18b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4150e1
lea ecx, [ebp - 0x18b0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x415720
push 0x52cba0
mov edx, dword [ebp + 8]
push edx
call fcn.0041b370
add esp, 8
test eax, eax
je 0x415231
push 0
push 0x52cbb0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x18b4], eax
cmp dword [ebp - 0x18b4], 0
je 0x415130
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x18b4]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push str.Q360AdMgr
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x18c0], eax
cmp dword [ebp - 0x18c0], 0
je 0x41515f
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x18c0]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x52cbf4
push str.PopWndCleanTip
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x18bc], eax
cmp dword [ebp - 0x18bc], 0
je 0x4151a4
push 0
push 0
push 0x10
mov edx, dword [ebp - 0x18bc]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x12
mov eax, dword [ebp - 0x18bc]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x18b8]
call fcn.0041d080
push 0
push 0x10
push 0x104
lea ecx, [ebp - 0x18b8]
call fcn.0041d2c0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18b8]
call fcn.0041d320
push 0x52cc34
lea ecx, [ebp - 0x18b8]
call fcn.0041d180
lea ecx, [ebp - 0x18b8]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415211
lea ecx, [ebp - 0x18b8]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x3350], 0
lea ecx, [ebp - 0x18b8]
call fcn.0041d100
mov eax, dword [ebp - 0x3350]
jmp 0x415720
push 0x52cc50
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041b370
add esp, 8
test eax, eax
je 0x41531b
lea edx, [ebp - 0x3354]
push edx
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 1
push str.FirstOpen
push 0x52cc74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x18c4], eax
lea ecx, [ebp - 0x3354]
call fcn.0041d100
cmp dword [ebp - 0x18c4], 1
jne 0x4152e5
lea eax, [ebp - 0x3358]
push eax
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 0x52cc88
push 0x52cc8c
push 0x52cca0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x3358]
call fcn.0041d100
lea ecx, [ebp - 0x2f21]
call fcn.0049dc90
lea ecx, [ebp - 0x2f21]
call fcn.0049e300
lea ecx, [ebp - 0x2f21]
call fcn.0049dca0
lea ecx, [ebp - 0x2f20]
call fcn.004742b0
lea ecx, [ebp - 0x2f20]
call fcn.0047a8a0
mov dword [ebp - 0x335c], 0
lea ecx, [ebp - 0x2f20]
call fcn.004744f0
mov eax, dword [ebp - 0x335c]
jmp 0x415720
push 0x52ccb4
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041b370
add esp, 8
test eax, eax
je 0x4153a0
cmp dword [0x556618], 0
jne 0x415399
push 0x557078
push 0x70
call fcn.004f7a7c
add esp, 8
mov dword [ebp - 0x3360], eax
cmp dword [ebp - 0x3360], 0
je 0x41536a
mov ecx, dword [ebp - 0x3360]
call fcn.004b9440
mov dword [ebp - 0x337c], eax
jmp 0x415374
mov dword [ebp - 0x337c], 0
mov edx, dword [ebp - 0x337c]
mov dword [0x556618], edx
cmp dword [0x556618], 0
je 0x415399
push 0x493e0
mov ecx, dword [0x556618]
call fcn.004b94c0
xor eax, eax
jmp 0x415720
lea eax, [ebp - 8]
push eax
call fcn.004163f0
add esp, 4
lea ecx, [ebp - 0x1670]
push ecx
call fcn.004164d0
add esp, 4
mov dword [ebp - 0x166c], 0
lea ecx, [ebp - 8]
call fcn.0041d2e0
test eax, eax
jle 0x415488
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415488
push 0x208
push 0
lea edx, [ebp - 0x3338]
push edx
call fcn.004f7580
add esp, 0xc
push 0x104
lea eax, [ebp - 0x3338]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x3338]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x208
push 0
lea edx, [ebp - 0x3130]
push edx
call fcn.004f7580
add esp, 0xc
push str.safemon
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
lea eax, [ebp - 0x3130]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x3130]
push ecx
call fcn.004f7670
add esp, 4
push eax
lea edx, [ebp - 0x3338]
push edx
lea eax, [ebp - 0x3130]
push eax
call fcn.004f780c
add esp, 0xc
test eax, eax
jne 0x415488
mov dword [ebp - 0x166c], 1
cmp dword [ebp - 0x166c], 0
je 0x4154a0
mov dword [0x55661c], 1
call fcn.00414ec0
lea ecx, [ebp - 0x16a8]
call fcn.0041b390
lea ecx, [ebp - 0x16a8]
push ecx
mov ecx, 0x5546c4
call fcn.0041c340
call fcn.00414940
test eax, eax
jne 0x4154f8
mov dword [ebp - 0x3364], 0
lea ecx, [ebp - 0x16a8]
call fcn.0041b3c0
lea ecx, [ebp - 0x1670]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x3364]
jmp 0x415720
mov dword [0x5546c0], 0
push str.Global__Q360PopwndTracker
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x5546c0], eax
cmp dword [0x5546c0], 0
je 0x415600
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x415600
push 0
push 0x52cd08
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x333c], eax
cmp dword [ebp - 0x333c], 0
je 0x4155cd
mov edx, dword [ebp - 0x333c]
push edx
call fcn.004c3790
add esp, 4
cmp dword [ebp + 8], 0
je 0x4155cd
mov eax, dword [ebp + 8]
push eax
call fcn.004f7670
add esp, 4
cmp eax, 3
jbe 0x4155cd
push 0
push 0
push 0x8205
mov ecx, dword [ebp - 0x333c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3348], 0x360366
mov edx, dword [ebp + 8]
push edx
call fcn.004f7670
add esp, 4
lea eax, [eax + eax + 2]
mov dword [ebp - 0x3344], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x3340], ecx
lea edx, [ebp - 0x3348]
push edx
push 0
push 0x4a
mov eax, dword [ebp - 0x333c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3368], 0
lea ecx, [ebp - 0x16a8]
call fcn.0041b3c0
lea ecx, [ebp - 0x1670]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x3368]
jmp 0x415720
cmp dword [ebp - 0x166c], 0
je 0x41562c
lea ecx, [ebp - 0x3349]
call fcn.0049dc90
push 0
lea ecx, [ebp - 0x3349]
call fcn.0049e390
lea ecx, [ebp - 0x3349]
call fcn.0049dca0
lea ecx, [ebp - 0x1668]
call fcn.004742b0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1668]
call fcn.0047ab00
push 0
push ecx
mov ecx, esp
push 0
call fcn.0041c5d0
push 0
push 0
push 0
push ecx
mov ecx, esp
push 0
call fcn.0041c5b0
push 0
lea ecx, [ebp - 0x163c]
call fcn.0041c5f0
test eax, eax
jne 0x4156ae
mov dword [ebp - 0x3374], 0
lea ecx, [ebp - 0x1668]
call fcn.004744f0
lea ecx, [ebp - 0x16a8]
call fcn.0041b3c0
lea ecx, [ebp - 0x1670]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x3374]
jmp 0x415720
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x1638]
call fcn.0041c920
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1668]
call fcn.00479bd0
lea ecx, [ebp - 0x16a8]
call fcn.0041bd90
mov dword [ebp - 4], eax
mov ecx, 0x5546c4
call fcn.0041c420
mov edx, dword [ebp - 4]
mov dword [ebp - 0x3378], edx
lea ecx, [ebp - 0x1668]
call fcn.004744f0
lea ecx, [ebp - 0x16a8]
call fcn.0041b3c0
lea ecx, [ebp - 0x1670]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x3378]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret