Function at 0x413e00
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Delete file
Get common file path

Disassembly:
push 0x454
mov eax, 0x493da6
call fcn.004626c9
mov eax, dword [0x4bd024]
mov dword [ebp - 0x440], eax
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x424]
push str.....MiniUI9.dll
push eax
mov byte [ebp - 4], 0xc
call fcn.00421f6b
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0xd
call fcn.004119d8
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
lea eax, [ebp - 0x424]
push str.....360Common.dll
push eax
call fcn.00421f6b
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 0xe
call fcn.004119d8
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
lea eax, [ebp - 0x424]
push str...360NetUL.dll
push eax
call fcn.00421f6b
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 0xf
call fcn.004119d8
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
lea eax, [ebp - 0x424]
push str....._sites.dll
push eax
call fcn.00421f6b
pop ecx
pop ecx
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x438]
call fcn.004119d8
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
lea eax, [ebp - 0x424]
push str.....360Base.dll
push eax
call fcn.00421f6b
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x11
call fcn.004119d8
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
lea eax, [ebp - 0x424]
push str...360ScreenCapture.exe
push eax
call fcn.00421f6b
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 0x12
call fcn.004119d8
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push dword [ebp - 0x440]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x414097
push dword [ebp - 0x43c]
call esi
test eax, eax
je 0x414097
push dword [ebp - 0x444]
call esi
test eax, eax
je 0x414097
push dword [ebp - 0x434]
call esi
test eax, eax
je 0x414097
push dword [ebp - 0x438]
call esi
test eax, eax
je 0x414097
push dword [ebp - 0x448]
call esi
test eax, eax
je 0x414097
xor edi, edi
inc edi
lea ecx, [ebp - 0x430]
call fcn.0040e14c
lea ecx, [ebp - 0x460]
call fcn.0040e14c
lea ecx, [ebp - 0x450]
call fcn.0040e14c
lea ecx, [ebp - 0x458]
call fcn.0040e14c
lea ecx, [ebp - 0x44c]
call fcn.0040e14c
lea ecx, [ebp - 0x45c]
call fcn.0040e14c
lea ecx, [ebp - 0x454]
call fcn.0040e14c
lea ecx, [ebp - 0x448]
call fcn.0040e14c
lea ecx, [ebp - 0x434]
call fcn.0040e14c
lea ecx, [ebp - 0x438]
call fcn.0040e14c
lea ecx, [ebp - 0x43c]
call fcn.0040e14c
lea ecx, [ebp - 0x444]
call fcn.0040e14c
lea ecx, [ebp - 0x440]
call fcn.0040e14c
mov eax, edi
call fcn.0046274c
ret
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.00461390
add esp, 0xc
cmp byte [ebp + 8], 0
jne 0x4140d7
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.0041c225
pop ecx
pop ecx
test eax, eax
je 0x414000
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x430]
call fcn.00411a2b
cmp byte [ebp + 8], 0
je 0x4143b5
xor eax, eax
push ebx
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00461390
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.MiniUI.dll
lea ecx, [ebp - 0x428]
call fcn.004130cd
mov esi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x13
call fcn.004130cd
push esi
push eax
lea eax, [ebp - 0x424]
push eax
mov byte [ebp - 4], 0x14
call fcn.0041319b
push eax
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x15
call fcn.004119d8
lea ecx, [ebp - 0x424]
call fcn.0040e14c
lea ecx, [ebp - 0x42c]
call fcn.0040e14c
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push str.360NetUL.dll
lea ecx, [ebp - 0x424]
call fcn.004130cd
mov esi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x16
call fcn.004130cd
push esi
push eax
lea eax, [ebp - 0x428]
push eax
mov byte [ebp - 4], 0x17
call fcn.0041319b
push eax
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x18
call fcn.004119d8
lea ecx, [ebp - 0x428]
call fcn.0040e14c
lea ecx, [ebp - 0x42c]
call fcn.0040e14c
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push str.360Common.dll
lea ecx, [ebp - 0x424]
call fcn.004130cd
mov esi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x19
call fcn.004130cd
push esi
push eax
lea eax, [ebp - 0x428]
push eax
mov byte [ebp - 4], 0x1a
call fcn.0041319b
push eax
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0x1b
call fcn.004119d8
lea ecx, [ebp - 0x428]
call fcn.0040e14c
lea ecx, [ebp - 0x42c]
call fcn.0040e14c
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push str.sites.dll
lea ecx, [ebp - 0x424]
call fcn.004130cd
mov esi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x1c
call fcn.004130cd
push esi
push eax
lea eax, [ebp - 0x428]
push eax
mov byte [ebp - 4], 0x1d
call fcn.0041319b
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 0x1e
call fcn.004119d8
lea ecx, [ebp - 0x428]
call fcn.0040e14c
lea ecx, [ebp - 0x42c]
call fcn.0040e14c
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push str.360Base.dll
lea ecx, [ebp - 0x424]
call fcn.004130cd
mov esi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x1f
call fcn.004130cd
push esi
push eax
lea eax, [ebp - 0x428]
push eax
mov byte [ebp - 4], 0x20
call fcn.0041319b
push eax
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x21
call fcn.004119d8
lea ecx, [ebp - 0x428]
call fcn.0040e14c
lea ecx, [ebp - 0x42c]
call fcn.0040e14c
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push str.360ScreenCapture.exe
lea ecx, [ebp - 0x424]
call fcn.004130cd
mov esi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x22
call fcn.004130cd
push esi
push eax
lea eax, [ebp - 0x428]
push eax
mov byte [ebp - 4], 0x23
call fcn.0041319b
push eax
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x24
call fcn.004119d8
lea ecx, [ebp - 0x428]
call fcn.0040e14c
lea ecx, [ebp - 0x42c]
call fcn.0040e14c
lea ecx, [ebp - 0x424]
jmp 0x4144f1
push 0x49c320
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004131e3
push eax
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x25
call fcn.004119d8
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push 0x49c304
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004131e3
push eax
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x26
call fcn.004119d8
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push 0x49c2e4
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004131e3
push eax
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0x27
call fcn.004119d8
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push str._sites.dll
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004131e3
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 0x28
call fcn.004119d8
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
lea eax, [ebp - 0x428]
push str.......360Base.dll
push eax
call fcn.00421f6b
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x29
call fcn.004119d8
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push str.Utils360ScreenCapture.exe
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004131e3
push eax
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x2a
call fcn.004119d8
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.0040e14c
push edi
push dword [ebp - 0x440]
mov dword [ebp - 0x424], edi
push dword [ebp - 0x454]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4145a6
push 0
push dword [ebp - 0x43c]
push dword [ebp - 0x44c]
call edi
test eax, eax
je 0x4145a6
push 0
push dword [ebp - 0x444]
push dword [ebp - 0x45c]
call edi
test eax, eax
je 0x4145a6
push 0
push dword [ebp - 0x434]
push dword [ebp - 0x450]
call edi
test eax, eax
je 0x4145a6
push 0
push dword [ebp - 0x438]
push dword [ebp - 0x458]
call edi
test eax, eax
je 0x4145a6
push 0
push dword [ebp - 0x448]
push dword [ebp - 0x460]
call edi
test eax, eax
je 0x4145a6
cmp byte [ebp + 8], 0
mov dword [ebp - 0x424], 1
je 0x41462c
push str.http:__dd.browser.360.cn_static_a_389.2118.gif
call fcn.0044ef2f
pop ecx
cmp byte [ebp + 8], 0
je 0x414623
push dword [ebp - 0x454]
call esi
push dword [ebp - 0x44c]
call esi
push dword [ebp - 0x45c]
call esi
push dword [ebp - 0x450]
call esi
push dword [ebp - 0x458]
call esi
push dword [ebp - 0x460]
call esi
xor eax, eax
push ebx
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00461390
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x49b91c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call esi
cmp dword [ebp - 0x424], 0
je 0x414690
push dword [ebp - 0x434]
call fcn.0041f907
pop ecx
test eax, eax
je 0x414690
push dword [ebp - 0x440]
call fcn.0041f907
pop ecx
test eax, eax
je 0x414690
push dword [ebp - 0x43c]
call fcn.0041f907
pop ecx
test eax, eax
je 0x414690
push dword [ebp - 0x444]
call fcn.0041f907
pop ecx
test eax, eax
je 0x414690
push dword [ebp - 0x448]
call fcn.0041f907
pop ecx
test eax, eax
je 0x414690
push dword [ebp - 0x438]
call fcn.0041f907
pop ecx
test eax, eax
jne 0x413ffd
push dword [ebp - 0x440]
call esi
push dword [ebp - 0x43c]
call esi
push dword [ebp - 0x444]
call esi
push dword [ebp - 0x438]
call esi
push dword [ebp - 0x434]
call esi
push dword [ebp - 0x448]
call esi
xor edi, edi
jmp 0x414000