Function at 0x4020c2
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
mov eax, 0x40ab61
call fcn.00408f80
mov eax, 0x12b8
call fcn.00408f40
and word [ebp - 0x694], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x692]
mov esi, dword [0x40b218]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x410300
mov ebx, 0x102
push 0x40e7f0
lea eax, [ebp - 0x694]
push ebx
push eax
call esi
and word [ebp - 0xcac], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xcaa]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
mov edi, dword [0x40b030]
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0xcac]
push eax
call edi
lea eax, [ebp - 0xcac]
push 0x40e7ec
push eax
call dword [0x40b0ac]
lea eax, [ebp - 0xcac]
push 0
push eax
call fcn.004084f1
pop ecx
lea eax, [ebp - 0x694]
pop ecx
push 0x411548
push eax
call edi
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x694]
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x74], ecx
mov ecx, 0x81
lea edi, [ebp - 0x89a]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x70], eax
mov word [ebp - 0x89c], ax
mov dword [ebp - 0x6a], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x694]
mov word [ebp - 0x6c], 0x414
push eax
push str._sSkin_
lea eax, [ebp - 0x89c]
push 0x103
push eax
mov dword [ebp - 0x78], 2
call esi
lea eax, [ebp - 0x89c]
push eax
call fcn.00404a47
mov edx, 0x81
add esp, 0x14
and word [ebp - 0x48c], 0
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x48a]
rep stosd dword es:[edi], eax
and word [ebp - 0x284], 0
mov ecx, edx
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x282]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x48c]
push str.360SE.exe
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x70], eax
push 0x410300
push 0x40e3ec
lea eax, [ebp - 0x48c]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x694]
push str.360sess
push eax
push str._s_s.exe
lea eax, [ebp - 0x284]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
call dword [0x40b29c]
xor edi, edi
push edi
mov dword [ebp - 0x48], edi
call dword [0x40b0e0]
push eax
lea eax, [ebp - 0x48]
push 0x83e
push eax
push str.360SE.EXE
call fcn.00403422
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x40232f
mov word [ebp - 0xeb8], di
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0xeb6]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x694]
mov edi, 0x104
push eax
push str._s360se.exe
lea eax, [ebp - 0xeb8]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xeb8]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [0x40b0e4]
cmp eax, 0xffffffff
mov dword [ebp - 0x5c], eax
jne 0x40230d
lea eax, [ebp - 0xeb8]
push eax
push str.CreateFile_360se.exe_Failed_path_S
call fcn.004045d4
pop ecx
xor eax, eax
pop ecx
jmp 0x402904
lea ecx, [ebp - 0x10]
push 0
push ecx
and dword [ebp - 0x10], 0
push dword [ebp - 0x48]
push dword [ebp - 0x14]
push eax
call dword [0x40b0fc]
push dword [ebp - 0x5c]
call dword [0x40b134]
jmp 0x402334
mov edi, 0x104
and dword [ebp - 0x2c], 0
mov eax, str.sqlite3.dll
mov ecx, eax
mov dword [ebp - 0x44], eax
test ecx, ecx
mov dword [ebp - 0x40], str.adfilter.dll
mov dword [ebp - 0x3c], str.doctor.dll
mov dword [ebp - 0x38], str.download.dll
mov dword [ebp - 0x34], str.suggest.dll
mov dword [ebp - 0x30], str.urlquery.dll
je 0x4023ce
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x48c]
push 0x410300
push 0x40e3ec
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x694]
push dword [ebp - 0x10]
push eax
push 0x40e6b8
lea eax, [ebp - 0x284]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x284]
push 0
push eax
lea eax, [ebp - 0x48c]
push eax
call dword [0x40b100]
add dword [ebp - 0x14], 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x402372
and dword [ebp - 0x2c], 0
mov eax, str.Favorites
mov ecx, eax
mov dword [ebp - 0x3c], eax
test ecx, ecx
mov dword [ebp - 0x38], str.LoginEnrol
mov dword [ebp - 0x34], str.Pages
mov dword [ebp - 0x30], str.SafeCentral
je 0x40247f
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.00408f36
push edi
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.00408f36
add esp, 0x18
lea eax, [ebp - 0x48c]
push dword [ebp - 0x14]
push 0x410300
push str._s_s.
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x694]
push dword [ebp - 0x14]
push eax
push 0x40e644
lea eax, [ebp - 0x284]
push ebx
push eax
call esi
lea eax, [ebp - 0x284]
push eax
call fcn.00404a47
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
call dword [0x40b29c]
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x402402
push edi
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.00408f36
push edi
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.00408f36
add esp, 0x18
lea eax, [ebp - 0x48c]
push str.SkinIE6Default.zip
push 0x410300
push 0x40e3ec
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x89c]
push str.IE6Default.zip
push eax
push 0x40e3ec
lea eax, [ebp - 0x284]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x284]
push 0
push eax
lea eax, [ebp - 0x48c]
push eax
call dword [0x40b100]
push edi
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.00408f36
push edi
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.00408f36
add esp, 0x18
mov edi, 0x40e3ec
lea eax, [ebp - 0x48c]
push str.ShieldInstall360SafeModuleSkin
push 0x410300
push edi
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x89c]
push 0x412078
push eax
push edi
lea eax, [ebp - 0x284]
push ebx
push eax
call esi
lea eax, [ebp - 0x284]
push eax
call fcn.00404a47
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x48c]
push eax
call fcn.004088d5
add esp, 0x20
cmp dword [0x411d6c], 5
jne 0x402901
and word [ebp - 0xaa4], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xaa2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0xaa4]
push 0x1a
push eax
push 0
call dword [0x40b2a4]
mov al, byte [ebp - 0x15]
push 0
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x58], al
call dword [0x40b194]
mov ebx, dword [0x40b23c]
mov edi, 0x410918
push edi
call ebx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call dword [0x40b190]
xor edi, edi
push 2
lea eax, [ebp - 0x38]
push edi
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], edi
call dword [0x40b18c]
mov ecx, dword [0x40b188]
mov byte [ebp - 4], 1
push dword [ecx]
lea ecx, [ebp - 0x58]
push edi
push eax
call dword [0x40b184]
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x38]
call dword [0x40b194]
mov edi, str.360SANDBOXSHADOW
push edi
call ebx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call dword [0x40b180]
lea eax, [ebp - 0xaa0]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0xaa0]
push eax
lea ecx, [ebp - 0x58]
call dword [0x40b180]
xor edi, edi
cmp word [0x411f78], di
je 0x402801
mov al, byte [ebp - 0x58]
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x38], al
call dword [0x40b194]
mov eax, dword [0x40b188]
lea ecx, [ebp - 0x38]
push dword [eax]
lea eax, [ebp - 0x58]
push edi
push eax
call dword [0x40b184]
mov edi, str.360sedata_
mov byte [ebp - 4], 2
push edi
call ebx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x38]
call dword [0x40b180]
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40268d
mov eax, dword [0x40b17c]
push eax
call fcn.00404a47
mov edi, str.360sefav.db
push edi
call ebx
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x38]
call dword [0x40b180]
mov al, byte [ebp - 0x15]
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], al
call dword [0x40b194]
mov edi, 0x411f78
push edi
call ebx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call dword [0x40b190]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call dword [0x40b19c]
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x22
jne 0x4026f8
lea ecx, [ebp - 0x28]
call dword [0x40b19c]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x28]
call dword [0x40b198]
cmp dword [ebp - 0x20], 0
jbe 0x402745
lea ecx, [ebp - 0x28]
call dword [0x40b19c]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov ecx, eax
neg ecx
lea eax, [eax + edx*2]
sbb ecx, ecx
and ecx, eax
cmp word [ecx - 2], 0x22
jne 0x402745
lea ecx, [ebp - 0x28]
call dword [0x40b19c]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov ecx, eax
neg ecx
lea eax, [eax + edx*2]
sbb ecx, ecx
and ecx, eax
dec ecx
dec ecx
push ecx
lea ecx, [ebp - 0x28]
call dword [0x40b198]
mov edi, 0x40e568
push edi
call ebx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call dword [0x40b180]
mov ecx, dword [ebp - 0x34]
mov eax, dword [0x40b17c]
xor edi, edi
cmp ecx, edi
jne 0x402769
mov ecx, eax
cmp dword [ebp - 0x24], edi
je 0x402771
mov eax, dword [ebp - 0x24]
push edi
push ecx
push eax
call dword [0x40b100]
cmp eax, edi
jne 0x4027e1
mov word [ebp - 0x10bc], di
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x10ba]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x34]
stosw word es:[edi], ax
mov eax, dword [0x40b17c]
test ecx, ecx
mov dword [ebp - 0x10], eax
je 0x4027a8
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp - 0x24]
test edi, edi
jne 0x4027b1
mov edi, eax
call dword [0x40b104]
push eax
push 0
push dword [ebp - 0x10]
lea eax, [ebp - 0x10bc]
push edi
push str.CopyFile__ws_n:_ws_n____d__0x_0x
push 0x207
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x10bc]
push eax
call dword [0x40b108]
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call dword [0x40b194]
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x38]
call dword [0x40b194]
xor edi, edi
mov al, byte [ebp - 0x58]
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x38], al
call dword [0x40b194]
mov eax, dword [0x40b188]
lea ecx, [ebp - 0x38]
push dword [eax]
lea eax, [ebp - 0x58]
push edi
push eax
call dword [0x40b184]
mov edi, str.360se_
mov byte [ebp - 4], 4
push edi
call ebx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x38]
call dword [0x40b180]
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40284a
mov eax, dword [0x40b17c]
push eax
call fcn.00404a47
mov edi, str.login.ini
push edi
call ebx
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x38]
call dword [0x40b180]
mov eax, dword [ebp - 0x34]
xor edi, edi
cmp eax, edi
jne 0x402873
mov eax, dword [0x40b17c]
push edi
push edi
push 2
push edi
push edi
push 0x10000000
push eax
call dword [0x40b0e4]
cmp eax, 0xffffffff
je 0x402893
push eax
call dword [0x40b134]
jmp 0x4028e3
mov word [ebp - 0x12c4], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x12c2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x34]
test edi, edi
jne 0x4028b8
mov edi, dword [0x40b17c]
call dword [0x40b104]
push eax
push edi
push str.CreateFile__ws___0x_0x
lea eax, [ebp - 0x12c4]
push 0x103
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x12c4]
push eax
call dword [0x40b108]
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x38]
call dword [0x40b194]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x58]
call dword [0x40b194]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret