Function at 0x476c31
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov esi, 0x50739c
push esi
lea ecx, [ebp - 8]
call fcn.0041af40
push esi
lea ecx, [ebp - 0x10]
call fcn.0041af40
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallPSafe_Antivirus
call fcn.00404030
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
mov esi, 0x4e0a48
test eax, eax
je 0x476cb7
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
mov byte [ebp - 1], 1
test eax, eax
jne 0x476cbb
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
je 0x476ce9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00404d60
mov eax, 0x4fe200
jmp 0x477226
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallPSafe_Total
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x476d3b
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
mov byte [ebp - 1], 1
test eax, eax
jne 0x476d3f
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
je 0x476d6f
mov esi, 0x4fe200
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00404d60
mov eax, esi
jmp 0x477226
lea ecx, [ebp - 8]
call fcn.00404c40
lea eax, [ebp - 0x10]
push eax
push 0
push ecx
mov ecx, esp
push str.Edition
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360TotalSecurity
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x28]
inc bl
call fcn.0040faf0
test bl, bl
jne 0x476dd7
push str.Professional
lea ecx, [ebp - 0x10]
call fcn.0040b6b0
test eax, eax
je 0x476dd7
mov esi, 0x4fe230
jmp 0x476d52
lea ecx, [ebp - 8]
call fcn.00404c40
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360_Internet_Security
call fcn.00404030
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x476e43
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
test eax, eax
je 0x476e43
push dword [ebp - 8]
call fcn.00474ed4
pop ecx
mov byte [ebp - 1], 1
test eax, eax
jne 0x476e47
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
je 0x476e5f
mov esi, 0x4fe20c
jmp 0x476d52
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360_Internet_Security_2013
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x476ebe
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
test eax, eax
je 0x476ebe
push dword [ebp - 8]
call fcn.00474ed4
pop ecx
mov byte [ebp - 1], 1
test eax, eax
jne 0x476ec2
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
jne 0x476e55
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_safebox
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x476f2f
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
test eax, eax
je 0x476f2f
push dword [ebp - 8]
call fcn.00474ed4
pop ecx
mov byte [ebp - 1], 1
test eax, eax
jne 0x476f33
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
je 0x476f4b
mov esi, 0x4fe224
jmp 0x476d52
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x476faa
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
test eax, eax
je 0x476faa
push dword [ebp - 8]
call fcn.00474ed4
pop ecx
mov byte [ebp - 1], 1
test eax, eax
jne 0x476fae
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
jne 0x476f41
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push 0x4e0c80
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x47701b
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
test eax, eax
je 0x47701b
push dword [ebp - 8]
call fcn.00474ed4
pop ecx
mov byte [ebp - 1], 1
test eax, eax
jne 0x47701f
mov byte [ebp - 1], 0
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
je 0x4770cb
push str...360EntClient.exe
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0xc], 0x80
call fcn.00406480
add esp, 0xc
push dword [eax]
call edi
test eax, eax
je 0x477084
push str...360EntClient.exe
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], 0x180
call fcn.00406480
push dword [eax]
call fcn.00474ed4
add esp, 0x10
mov byte [ebp - 1], 1
test eax, eax
jne 0x477088
mov byte [ebp - 1], 0
test dword [ebp - 0xc], 0x100
je 0x4770a3
mov ecx, dword [ebp - 0x14]
and dword [ebp - 0xc], 0xfffffeff
add ecx, 0xfffffff0
call fcn.00404d60
test byte [ebp - 0xc], 0x80
je 0x4770bb
mov ecx, dword [ebp - 0x18]
and dword [ebp - 0xc], 0xffffff7f
add ecx, 0xfffffff0
call fcn.00404d60
cmp byte [ebp - 1], 0
je 0x4770cb
mov esi, 0x4fe23c
jmp 0x476d52
and dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.00404c40
or dword [ebp - 0xc], 0x200
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push 0x4d6ec8
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x47713d
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
test eax, eax
je 0x47713d
push dword [ebp - 8]
call fcn.00474ed4
pop ecx
mov byte [ebp - 1], 1
test eax, eax
jne 0x477141
mov byte [ebp - 1], 0
test dword [ebp - 0xc], 0x200
je 0x477159
and dword [ebp - 0xc], 0xfffffdff
lea ecx, [ebp - 0x28]
call fcn.0040faf0
cmp byte [ebp - 1], 0
je 0x477166
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 8]
call fcn.00404c40
or dword [ebp - 0xc], 0x400
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov ecx, esp
push str.UninstallString
call fcn.00404030
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360SD
call fcn.00404030
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f060
push eax
call fcn.0040f4b0
pop ecx
pop ecx
test eax, eax
je 0x4771d4
push esi
push esi
lea ecx, [ebp - 8]
call fcn.004750d1
mov ecx, eax
call fcn.00474fdd
push dword [eax]
call edi
test eax, eax
je 0x4771d4
push dword [ebp - 8]
call fcn.00474ed4
pop ecx
test eax, eax
je 0x4771d4
mov bl, 1
jmp 0x4771d6
xor bl, bl
test dword [ebp - 0xc], 0x400
je 0x4771e7
lea ecx, [ebp - 0x28]
call fcn.0040faf0
test bl, bl
je 0x477205
cmp dword [ebp - 0x14], 1
jne 0x4771fb
mov esi, 0x4fe1f4
jmp 0x476d52
mov esi, 0x4fe1e8
jmp 0x476d52
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00404d60
mov eax, dword [ebp - 0x14]
imul eax, eax, 0xc
add eax, 0x4fe1d0
pop edi
pop esi
pop ebx
leave
ret