Function at 0x416e36
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
sub esp, 0x824
mov edx, dword [esp + 0x82c]
push ebx
xor ebx, ebx
push ebp
push esi
cmp edx, ebx
push edi
mov dword [esp + 0x10], ecx
je 0x4170d5
cmp word [edx], bx
je 0x4170d5
push 6
mov esi, str.360sess.exe
pop ecx
lea edi, [esp + 0x62c]
rep movsd dword es:[edi], dword [esi]
push 0x7c
xor eax, eax
pop ecx
lea edi, [esp + 0x644]
rep stosd dword es:[edi], eax
mov esi, 0x81
lea edi, [esp + 0x16]
mov ecx, esi
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str._sShield360SESS
lea eax, [esp + 0x42c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x24]
push 0x104
push eax
lea eax, [esp + 0x644]
push eax
lea eax, [esp + 0x440]
push eax
call fcn.0041cb9c
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
test eax, eax
je 0x416f8e
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x416f8e
lea eax, [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x416f8e
push 0x31
push dword [0x4363bc]
push 0x433ccc
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4170d5
lea eax, [esp + 0x14]
push 0x1388
push eax
call fcn.0041c64c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call edi
lea eax, [esp + 0x14]
push eax
call ebp
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x416f8e
push 0x35
push dword [0x4363bc]
push 0x433c94
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x4170d5
push 0x1f4
jmp 0x416f50
and word [esp + 0x21c], 0
mov ecx, esi
xor eax, eax
lea edi, [esp + 0x21e]
rep stosd dword es:[edi], eax
push str.360se.exe.bak
push dword [esp + 0x840]
stosw word es:[edi], ax
push 0x42f9cc
lea eax, [esp + 0x228]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [esp + 0x21c]
push eax
call ebp
mov esi, dword [esp + 0x840]
push esi
call ebx
test eax, eax
je 0x416ffe
mov edi, dword [esp + 0x10]
push 0x431634
push dword [esp + 0x840]
mov ecx, edi
call fcn.00412a11
jmp 0x417002
mov edi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x41709b
push esi
call ebp
test eax, eax
jne 0x41709b
push 0x31
push dword [0x4363bc]
push 0x433ccc
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
pop ecx
cmp eax, ecx
jne 0x417097
mov eax, dword [edi + 4]
mov dword [edi + 0x54], ecx
cmp dword [eax + 8], ecx
jne 0x417047
mov dword [edi + 0x58], ecx
push 0x1388
push dword [esp + 0x840]
call fcn.0041c7df
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x1f4
call edi
push esi
call ebp
push esi
call ebx
test eax, eax
je 0x41709b
push 0x35
push dword [0x4363bc]
push 0x433c94
push dword [esp + 0x844]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x417097
push 0x1f4
jmp 0x417065
xor esi, esi
jmp 0x4170c7
cmp dword [esp + 0x844], 0
jne 0x4170c4
lea eax, [esp + 0x21c]
push eax
call ebx
test eax, eax
je 0x4170c4
push 0
lea eax, [esp + 0x220]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
pop esi
lea eax, [esp + 0x21c]
push eax
call ebp
mov eax, esi
jmp 0x4170d7
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x824
ret 0x10