Function at 0x41632b
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
mov ebx, ecx
push 0x28
push dword [ebp + 8]
mov ecx, dword [ebx + 4]
call fcn.0041a8a4
lea eax, [ebx + 0x2c]
push str.extensionsExtDoctor360Doctor.exe
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a0ea
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x4163d7
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call fcn.004212d0
add esp, 0x14
mov eax, dword [0x43a50c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push dword [ebp - 0x40]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push str._d._d._d._d
push eax
call fcn.00409921
push str.2.0.0.1002
push dword [ebp - 0x34]
call fcn.00421396
add esp, 0x20
test eax, eax
jne 0x4163cf
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x34]
call fcn.00404c0d
push 0xd
push ecx
mov ecx, esp
push str.doctor.dll
call fcn.00404729
push ecx
mov edi, 0x443154
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
push 0x14
push ecx
mov ecx, esp
push str.suggest.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
mov ecx, dword [ebx + 4]
push 0x2d
push dword [ebp + 8]
call fcn.0041a8a4
push 0x16
push ecx
mov ecx, esp
push str.urlquery.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
push 0xe
push ecx
mov ecx, esp
push str.download.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
push 0x26
push ecx
mov ecx, esp
push str.360dl.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
lea eax, [ebx + 0x2c]
push str.extensionsExtDownload_
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041a0ea
lea eax, [ebp - 0x18]
push str.livep.dat
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0041a0ea
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x4164ba
push dword [ebp - 0x18]
call fcn.00421506
pop ecx
lea eax, [ebx + 0x38]
push 0x43f91c
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push dword [ebp - 0x3c]
push eax
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov ecx, dword [ebx + 4]
push 0x32
push dword [ebp + 8]
call fcn.0041a8a4
push 0x1b
push ecx
mov ecx, esp
push str.pluginbar.dll
call fcn.00404729
push ecx
mov ecx, esp
push edi
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
lea eax, [ebx + 0x34]
push str.Pages
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call fcn.00421506
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
push 0x10
push ecx
mov ecx, esp
push str.Pages.dll
call fcn.00404729
push ecx
mov ecx, esp
push 0x43f8d0
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
push 0x11
push ecx
mov ecx, esp
push str.ScreenHelper.exe
call fcn.00404729
push ecx
mov ecx, esp
push 0x43f8d0
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
push 0x28
push ecx
mov ecx, esp
push str.newTab.dll
call fcn.00404729
push ecx
mov ecx, esp
push 0x43f8d0
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
push 0x29
push ecx
mov ecx, esp
push str.newTab2.dll
call fcn.00404729
push ecx
mov ecx, esp
push 0x43f8d0
call fcn.00404729
mov ecx, ebx
call fcn.0041994d
lea eax, [ebx + 0x2c]
push str.extensionsFavorites_
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0041a0ea
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4165e6
push dword [ebp - 0x30]
call fcn.00421506
pop ecx
push 6
push ecx
mov ecx, esp
push str.titleopt.dll
call fcn.00404729
mov ecx, ebx
call fcn.004195b0
mov ecx, dword [ebx + 4]
push 0x37
push dword [ebp + 8]
call fcn.0041a8a4
cmp dword [ebx + 0x9c], 0
jne 0x41666a
lea eax, [ebx + 0x38]
push str.LoginEnrolLoginEnrol.dll
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
lea eax, [ebx + 0x38]
push str.FavoritesFavorites.dll
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41665a
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41665a
push dword [ebp + 8]
mov ecx, ebx
call fcn.00415eaa
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp - 8]
call fcn.00404c0d
lea eax, [ebx + 0x2c]
push str._apps_
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041a0ea
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416692
push dword [ebp - 0x14]
call fcn.00421506
pop ecx
lea eax, [ebx + 0x38]
push str.Apps
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [ebp - 0x14]
mov eax, dword [eax]
push eax
call fcn.004217a9
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebx + 0x34]
push 0x43f7f4
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0041a0ea
push dword [ebp - 0x38]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41674e
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 4], eax
je 0x41674e
push str.InitPluginbar
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x445394], eax
je 0x416745
and word [ebp - 0x248], 0
push dword [ebx + 0x34]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x246]
push 0x43ab18
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x248]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x248]
push eax
call dword [0x445394]
mov edi, 0x443154
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x14]
push str.BankMode
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call fcn.0042161f
pop ecx
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebp - 0x14]
push str.appsi.dll
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebx + 0x2c]
push str.data_
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0041a0ea
push dword [ebp - 0x24]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4167ba
push dword [ebp - 0x24]
call fcn.00421506
pop ecx
lea eax, [ebx + 0x2c]
push str.data_switch.ini
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push str.data_switch.ini
mov dword [ebp - 4], eax
lea eax, [ebx + 0x38]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea eax, [ebx + 0x2c]
push str.data_newskin.dat
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push str.data_newskin.dat
mov dword [ebp - 4], eax
lea eax, [ebx + 0x38]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea eax, [ebx + 0x2c]
push str.datagameurls.dat
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push str.datagameurls.dat
mov dword [ebp - 4], eax
lea eax, [ebx + 0x38]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea eax, [ebx + 0x2c]
push str.dataAdfilter.dat
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push str.dataAdfilter.dat
mov dword [ebp - 4], eax
lea eax, [ebx + 0x38]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea eax, [ebx + 0x2c]
push str.dataguardconfig.ini
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push str.dataguardconfig.ini
mov dword [ebp - 4], eax
lea eax, [ebx + 0x38]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
push 0x444ce4
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
call edi
pop ecx
test eax, eax
pop ecx
je 0x416999
push 0x444ce4
push 0x444adc
call edi
pop ecx
test eax, eax
pop ecx
jne 0x416999
mov edi, str.datapreset.dat
lea eax, [ebx + 0x2c]
push edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb al, al
lea ecx, [ebp - 4]
inc al
mov byte [ebp - 0xd], al
call fcn.00404c0d
cmp byte [ebp - 0xd], 0
je 0x4169d9
lea eax, [ebx + 0x2c]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push edi
mov dword [ebp - 4], eax
lea eax, [ebx + 0x38]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
jmp 0x4169d4
mov edi, str.datapreset.dat
lea eax, [ebx + 0x2c]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push edi
mov dword [ebp - 4], eax
lea eax, [ebx + 0x38]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
mov edi, str.dataurls.dat
lea eax, [ebx + 0x2c]
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041a0ea
push dword [ebp - 0x2c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416a19
lea eax, [ebx + 0x38]
push edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push dword [ebp - 0x2c]
push eax
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
lea eax, [ebx + 0x2c]
push str.extensionsExtDoctor_
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041a0ea
lea eax, [ebp - 0x20]
push str.ExtDoctor.ini
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041a0ea
push dword [ebp - 0x28]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x416a78
push dword [ebp - 0x20]
call edi
test eax, eax
jne 0x416a64
push dword [ebp - 0x20]
call fcn.00421506
pop ecx
push dword [ebp - 0x28]
push 0x43a628
push str.TXUserActionState
push str.QQZoneSpeed
call esi
mov eax, dword [ebx + 4]
cmp dword [eax + 8], 0
je 0x416ad4
and word [ebp - 0x248], 0
push dword [ebx + 0x74]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x246]
push 0x43f614
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x248]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x248]
push dword [ebx + 0x28]
push eax
push str.State
push str.InstallState
call esi
mov ecx, ebx
call fcn.0041371a
mov ecx, dword [ebx + 4]
push 0x3c
push dword [ebp + 8]
call fcn.0041a8a4
lea ecx, [ebp - 0x28]
call fcn.00404c0d
lea ecx, [ebp - 0x20]
call fcn.00404c0d
lea ecx, [ebp - 0x2c]
call fcn.00404c0d
lea ecx, [ebp - 0x24]
call fcn.00404c0d
lea ecx, [ebp - 0x38]
call fcn.00404c0d
lea ecx, [ebp - 0x14]
call fcn.00404c0d
lea ecx, [ebp - 0x30]
call fcn.00404c0d
lea ecx, [ebp - 0x3c]
call fcn.00404c0d
lea ecx, [ebp - 0x18]
call fcn.00404c0d
lea ecx, [ebp - 0x1c]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret 4