Function at 0x4332c7
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x288
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x288], eax
push 0x10
mov eax, 0x4aa1e5
call fcn.004711ef
mov edi, dword [ebp + 0x294]
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
mov ebx, ecx
call fcn.004701a0
mov ecx, dword [ebx + 8]
add esp, 0xc
test ecx, ecx
je 0x43360e
call fcn.0045b9c4
mov esi, eax
test esi, esi
je 0x43360e
mov ecx, dword [ebx + 8]
call fcn.0045ba8a
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403c4d
and dword [ebp - 4], 0
push str.InstallVer
mov ecx, edi
call fcn.00403a9d
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00403c35
mov eax, dword [esi]
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x58]
push str.LocalVer
mov ecx, edi
call fcn.00403a9d
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403a9d
mov ecx, dword [ebx + 8]
call fcn.0045bab5
mov esi, eax
test esi, esi
je 0x433603
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.004701a0
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x60]
push str.OS
mov ecx, edi
call fcn.00403a9d
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403a9d
mov eax, dword [esi]
push esi
call dword [eax + 0x50]
push 0x4b3bd0
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00403a9d
cmp dword [ebp - 0x14], 0
mov eax, 0x4b3bcc
jne 0x4333ee
mov eax, 0x4b3bc8
push eax
mov ecx, edi
call fcn.00403a9d
xor eax, eax
push 0x206
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.004701a0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 0x14], 0
lea eax, [ebp]
je 0x43342e
push str.Drivers360fsflt.sys
jmp 0x433433
push str.Drivers360selfprotection.sys
push esi
push eax
call fcn.00471539
add esp, 0xc
push 0x80
xor esi, esi
lea eax, [ebp + 0x208]
push esi
push eax
call fcn.004701a0
add esp, 0xc
mov ecx, ebx
call fcn.004301e5
cmp eax, esi
je 0x433603
mov ecx, dword [eax]
push 0x40
lea edx, [ebp + 0x208]
push edx
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x60]
push str.DriverVer
mov ecx, edi
call fcn.00403a9d
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403a9d
push 0x4f39f8
lea ecx, [ebp - 0x18]
call fcn.004028e9
mov ecx, dword [ebx + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0045da4b
push str._safemon360procmon.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004039cd
add esp, 0xc
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 2
call ebx
test eax, eax
je 0x4334e5
push esi
push dword [ebp - 0x10]
call fcn.00402346
pop ecx
pop ecx
test eax, eax
je 0x4334e5
inc esi
push str.360procmon.dll
mov ecx, edi
call fcn.00403a9d
mov eax, 0x4b3bc8
test esi, esi
jne 0x4334ff
mov eax, 0x4b3bcc
push eax
mov ecx, edi
call fcn.00403a9d
push str._safemon360tray.exe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004039cd
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401d9d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.0040290e
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x433556
push 0
push dword [ebp - 0x10]
call fcn.00402346
pop ecx
pop ecx
test eax, eax
je 0x433556
xor esi, esi
inc esi
jmp 0x433558
xor esi, esi
push 0x4b3ad4
mov ecx, edi
call fcn.00403a9d
mov eax, 0x4b3bc8
test esi, esi
jne 0x433572
mov eax, 0x4b3bcc
push eax
mov ecx, edi
call fcn.00403a9d
push str._safemonSelfProtectAPI2.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004039cd
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401d9d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.0040290e
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x4335c9
push 0
push dword [ebp - 0x10]
call fcn.00402346
pop ecx
pop ecx
test eax, eax
je 0x4335c9
xor ebx, ebx
inc ebx
jmp 0x4335cb
xor ebx, ebx
push str.SelfProtectAPI2.dll
mov ecx, edi
call fcn.00403a9d
mov eax, 0x4b3bc8
test ebx, ebx
jne 0x4335e5
mov eax, 0x4b3bcc
push eax
mov ecx, edi
call fcn.00403a9d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040290e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x288]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x28c
leave
ret 4