Function at 0x415460
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push esi
push edi
mov ebx, ecx
push 0x28
push dword [ebp + 8]
mov ecx, dword [ebx + 4]
call fcn.00419562
push 0xb
push ecx
mov ecx, esp
push str.adfilter.dll
call fcn.00404729
push ecx
mov edi, 0x434ee4
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.00418933
push 0xe
push ecx
mov ecx, esp
push str.doctor.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.00418933
push 0x15
push ecx
mov ecx, esp
push str.suggest.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.00418933
mov ecx, dword [ebx + 4]
push 0x2d
push dword [ebp + 8]
call fcn.00419562
push 0x17
push ecx
mov ecx, esp
push str.urlquery.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.00418933
push 0xf
push ecx
mov ecx, esp
push str.download.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.00418933
push 0x27
push ecx
mov ecx, esp
push str.360dl.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.00418933
lea eax, [ebx + 0x14]
push str.extensionsExtDownload_
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00418da8
lea eax, [ebp - 0x20]
push str.livep.dat
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00418da8
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415581
push dword [ebp - 0x20]
call fcn.0041d105
pop ecx
lea eax, [ebx + 0x20]
push 0x433450
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00418da8
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push dword [ebp - 0x40]
push eax
call esi
lea ecx, [ebp - 0x14]
call fcn.00404c0d
mov ecx, dword [ebx + 4]
push 0x32
push dword [ebp + 8]
call fcn.00419562
push 0x1c
push ecx
mov ecx, esp
push str.pluginbar.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.00418933
lea eax, [ebx + 0x1c]
push str.Pages
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
push dword [eax]
call fcn.0041d105
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push 0x11
push ecx
mov ecx, esp
push str.Pages.dll
call fcn.00404729
push ecx
mov ecx, esp
push 0x433404
call fcn.00404729
mov ecx, ebx
call fcn.00418933
push 0x12
push ecx
mov ecx, esp
push str.ScreenHelper.exe
call fcn.00404729
push ecx
mov ecx, esp
push 0x433404
call fcn.00404729
mov ecx, ebx
call fcn.00418933
push 0x29
push ecx
mov ecx, esp
push str.newTab.dll
call fcn.00404729
push ecx
mov ecx, esp
push 0x433404
call fcn.00404729
mov ecx, ebx
call fcn.00418933
push 0x2a
push ecx
mov ecx, esp
push str.newTab2.dll
call fcn.00404729
push ecx
mov ecx, esp
push 0x433404
call fcn.00404729
mov ecx, ebx
call fcn.00418933
lea eax, [ebx + 0x14]
push str.Favorites_
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00418da8
push dword [ebp - 0x24]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4156b0
push dword [ebp - 0x24]
call fcn.0041d105
pop ecx
push 6
push ecx
mov ecx, esp
push str.titleopt.dll
call fcn.00404729
mov ecx, ebx
call fcn.00418596
mov ecx, dword [ebx + 4]
push 0x37
push dword [ebp + 8]
call fcn.00419562
lea eax, [ebx + 0x20]
push str.LoginEnrolLoginEnrol.dll
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00418da8
lea eax, [ebx + 0x20]
push str.FavoritesFavorites.dll
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00418da8
push dword [ebp - 0x38]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41571b
push dword [ebp - 0x3c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41571b
push dword [ebp + 8]
mov ecx, ebx
call fcn.00415074
lea eax, [ebx + 0x14]
push str._apps_
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00418da8
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415743
push dword [ebp - 0x18]
call fcn.0041d105
pop ecx
lea eax, [ebx + 0x20]
push str.Apps
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
push dword [ebp - 0x18]
mov eax, dword [eax]
push eax
call fcn.0041d3a8
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push 0x433340
lea eax, [ebp - 0x30]
push dword [ebp - 0x14]
push eax
call fcn.00418da8
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415800
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 4], eax
je 0x415800
push str.InitPluginbar
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x43711c], eax
je 0x4157f7
and word [ebp - 0x250], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x24e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x14]
push dword [eax]
lea eax, [ebp - 0x250]
push 0x42eb18
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x250]
push eax
call dword [0x43711c]
mov edi, 0x434ee4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x18]
push str.BankMode
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
push dword [eax]
call fcn.0041d21e
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebp - 0x18]
push str.appsi.dll
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebx + 0x14]
push str.data_
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00418da8
push dword [ebp - 0x34]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41586c
push dword [ebp - 0x34]
call fcn.0041d105
pop ecx
lea eax, [ebx + 0x14]
push str.data_switch.ini
push eax
lea eax, [ebp - 8]
push eax
call fcn.00418da8
mov eax, dword [eax]
push str.data_switch.ini
mov dword [ebp - 4], eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 8]
call fcn.00404c0d
lea eax, [ebx + 0x14]
push str.data_newskin.dat
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
mov eax, dword [eax]
push str.data_newskin.dat
mov dword [ebp - 8], eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0
push dword [ebp - 8]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebx + 0x14]
push str.datagameurls.dat
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
mov eax, dword [eax]
push str.datagameurls.dat
mov dword [ebp - 8], eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0
push dword [ebp - 8]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebx + 0x14]
push str.dataguardconfig.ini
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
mov eax, dword [eax]
push str.dataguardconfig.ini
mov dword [ebp - 8], eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0
push dword [ebp - 8]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
push 0x436a74
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
call edi
pop ecx
test eax, eax
pop ecx
je 0x415a08
push 0x436a74
push 0x43686c
call edi
pop ecx
test eax, eax
pop ecx
jne 0x415a08
mov edi, str.datapreset.dat
lea eax, [ebx + 0x14]
push edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00418da8
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb al, al
lea ecx, [ebp - 8]
inc al
mov byte [ebp - 0xd], al
call fcn.00404c0d
cmp byte [ebp - 0xd], 0
je 0x415a48
lea eax, [ebx + 0x14]
push edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
mov eax, dword [eax]
push edi
mov dword [ebp - 8], eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0
push dword [ebp - 8]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 4]
jmp 0x415a43
mov edi, str.datapreset.dat
lea eax, [ebx + 0x14]
push edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418da8
mov eax, dword [eax]
push edi
mov dword [ebp - 8], eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0
push dword [ebp - 8]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebx + 0x14]
push str.dataurls.dat
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00418da8
push dword [ebp - 0x2c]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
jne 0x415a8d
lea eax, [ebx + 0x20]
push str.dataurls.dat
push eax
lea eax, [ebp - 8]
push eax
call fcn.00418da8
mov eax, dword [eax]
push 0
push dword [ebp - 0x2c]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea eax, [ebx + 0x14]
push str.extensionsExtDoctor_
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00418da8
lea eax, [ebp - 0x1c]
push str.ExtDoctor.ini
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00418da8
push dword [ebp - 0x28]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x415ae6
push dword [ebp - 0x1c]
call edi
test eax, eax
jne 0x415ad2
push dword [ebp - 0x1c]
call fcn.0041d105
pop ecx
push dword [ebp - 0x28]
push 0x42e628
push str.TXUserActionState
push str.QQZoneSpeed
call esi
mov eax, dword [ebx + 4]
cmp dword [eax + 8], 0
je 0x415b48
and word [ebp - 0x250], 0
push dword [ebx + 0x54]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x24e]
push 0x433188
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x250]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x250]
push dword [ebx + 0x10]
push eax
push str.State
push str.InstallState
call esi
mov ecx, ebx
call fcn.00412b89
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebx + 4]
push 0x3c
push dword [ebp + 8]
call fcn.00419562
push str.LoginEnrolLoginEnrol.dll
lea eax, [ebp - 0x48]
push dword [ebp - 0x14]
push eax
call fcn.00418da8
push str.FavoritesFavorites.dll
lea eax, [ebp - 0x44]
push dword [ebp - 0x14]
push eax
call fcn.00418da8
push dword [ebp - 0x48]
call edi
test eax, eax
je 0x415b89
push dword [ebp - 0x44]
call edi
test eax, eax
jne 0x415bae
push 0x10
push dword [0x4363bc]
push str.6e9Y
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x44]
call fcn.00404c0d
lea ecx, [ebp - 0x48]
call fcn.00404c0d
lea ecx, [ebp - 0x28]
call fcn.00404c0d
lea ecx, [ebp - 0x1c]
call fcn.00404c0d
lea ecx, [ebp - 0x2c]
call fcn.00404c0d
lea ecx, [ebp - 0x34]
call fcn.00404c0d
lea ecx, [ebp - 0x30]
call fcn.00404c0d
lea ecx, [ebp - 0x18]
call fcn.00404c0d
lea ecx, [ebp - 0x3c]
call fcn.00404c0d
lea ecx, [ebp - 0x38]
call fcn.00404c0d
lea ecx, [ebp - 0x24]
call fcn.00404c0d
lea ecx, [ebp - 0x40]
call fcn.00404c0d
lea ecx, [ebp - 0x20]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret 4