Function at 0x41fbe5
Capabilities:
Check if file exists
Delete registry key
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
push edi
mov esi, 0x208
push esi
xor ebx, ebx
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], ecx
call fcn.004670a0
add esp, 0xc
push ebx
push 0x23
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x7c]
push eax
call edi
cmp eax, 1
jne 0x41fc6e
push esi
lea eax, [ebp + 0x394]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push str.360safe
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x394]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp + 0x394]
push eax
call fcn.00453537
pop ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 8]
call fcn.0044c743
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
test eax, eax
je 0x41fd20
push esi
lea eax, [ebp + 0x18c]
push ebx
push eax
call fcn.004670a0
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 8]
add esp, 0xc
call fcn.0044c743
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
test eax, eax
push 0x104
lea eax, [ebp + 0x18c]
push eax
je 0x41fcc1
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x41fcc7
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x18c]
push eax
call edi
cmp eax, 1
jne 0x41fe04
push esi
lea eax, [ebp + 0x394]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push str.config_systemprofileAppDataRoaming360safe
lea eax, [ebp + 0x18c]
push eax
lea eax, [ebp + 0x394]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp + 0x394]
push eax
call edi
cmp eax, 1
jne 0x41fe04
lea eax, [ebp + 0x394]
jmp 0x41fdfd
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 8]
call fcn.0044c743
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
je 0x41fd7c
push esi
lea eax, [ebp + 0x394]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push ebx
push 0x28
lea eax, [ebp + 0x394]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x394]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp + 0x18c]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push str.LocalServiceApplication_Data360safe360leakfixer
jmp 0x41fdd6
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 8]
call fcn.0044c743
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
test eax, eax
je 0x41fe04
push esi
lea eax, [ebp + 0x394]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push ebx
push 0x28
lea eax, [ebp + 0x394]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x394]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp + 0x18c]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push str.Default_UserApplication_Data360safe360leakfixer
lea eax, [ebp + 0x394]
push eax
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp + 0x18c]
push eax
call edi
test eax, eax
je 0x41fe04
lea eax, [ebp + 0x18c]
push eax
call fcn.00453537
pop ecx
push 0x490abc
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp + 0x59c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x5a0
leave
ret