Function at 0x412436
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push 0xc58
mov eax, 0x46bf6a
call fcn.00443760
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc50], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x838], ax
xor esi, esi
lea eax, [ebp - 0x836]
push esi
push eax
call fcn.0043e180
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push esi
push 0x17
lea eax, [ebp - 0x838]
push eax
push esi
call ebx
test eax, eax
je 0x4124ae
push 0x4755e8
push 0x4765d0
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0xc50]
add eax, 0xc
push 0x47672c
push eax
call fcn.00402e53
add esp, 0x14
xor eax, eax
push edi
mov word [ebp - 0xc48], ax
lea eax, [ebp - 0xc46]
push esi
push eax
call fcn.0043e180
add esp, 0xc
push esi
push 0x16
lea eax, [ebp - 0xc48]
push eax
push esi
call ebx
test eax, eax
je 0x4124ef
mov eax, dword [ebp - 0xc50]
lea ecx, [ebp - 0xc48]
add eax, 0x10
push ecx
push eax
call fcn.00402c33
xor eax, eax
push edi
mov word [ebp - 0x630], ax
lea eax, [ebp - 0x62e]
push esi
push eax
call fcn.0043e180
add esp, 0xc
push 1
push 0x10
lea eax, [ebp - 0x630]
push eax
push esi
call ebx
test eax, eax
je 0x412531
mov eax, dword [ebp - 0xc50]
lea ecx, [ebp - 0x630]
add eax, 0x14
push ecx
push eax
call fcn.00402c33
xor eax, eax
push edi
mov word [ebp - 0xa40], ax
lea eax, [ebp - 0xa3e]
push esi
push eax
call fcn.0043e180
add esp, 0xc
push esi
push 0x1a
lea eax, [ebp - 0xa40]
push eax
push esi
call ebx
cmp eax, esi
je 0x41257a
lea eax, [ebp - 0xa40]
push eax
mov eax, dword [ebp - 0xc50]
add eax, 8
push 0x475100
push eax
call fcn.00402e53
add esp, 0xc
mov ecx, 0x485f6c
lea esi, [ebp - 0xc54]
call fcn.00402b4a
and dword [ebp - 4], 0
xor eax, eax
push edi
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.0043e180
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x428]
inc esi
push eax
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xc60], 0x104
call fcn.00411f4a
xor ecx, ecx
mov edi, 0x208
push edi
push ecx
cmp eax, ecx
je 0x4126a7
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0043e180
add esp, 0xc
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc64]
push eax
push str.DisplayVersion
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360DrvMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc4c], edi
mov dword [ebp - 0xc64], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x220]
push eax
call fcn.0043f03a
mov edi, dword [ebp - 0xc50]
add edi, 0x18
pop ecx
cmp eax, 0xffff
jne 0x41264a
push str.2.0.0.1570
jmp 0x412651
lea eax, [ebp - 0x220]
push eax
push edi
call fcn.00402c33
push dword [edi]
call fcn.00416543
pop ecx
test eax, eax
jge 0x41266b
mov dword [ebp - 0xc58], esi
jmp 0x41267a
xor ecx, ecx
test eax, eax
setne cl
inc ecx
inc ecx
mov dword [ebp - 0xc58], ecx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xc54]
push 0x475100
push eax
call fcn.00402e53
add esp, 0xc
jmp 0x4127e6
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
mov dword [ebp - 0xc58], ecx
call fcn.0043e180
add esp, 0xc
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc5c]
push eax
push 0x474f2c
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xc60], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41273b
lea eax, [ebp - 0x220]
push eax
call fcn.0043ec59
pop ecx
test eax, eax
jbe 0x41273b
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41273b
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
call esi
jmp 0x41275c
push 0
push 0x26
lea eax, [ebp - 0x220]
push eax
push 0
call ebx
push 0x476848
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc4c]
push eax
call fcn.00402ad3
push 0x5c
push 0x2f
lea eax, [ebp - 0xc4c]
mov byte [ebp - 4], 1
call fcn.004088eb
push 0x5c
lea edi, [ebp - 0xc4c]
call fcn.00413120
mov edi, 0x4767a8
jmp 0x4127a2
lea eax, [ebp - 0xc4c]
push eax
call fcn.00412fb7
push edi
xor ecx, ecx
lea esi, [ebp - 0xc4c]
call fcn.00406890
cmp eax, 0xffffffff
jne 0x412796
push str.360DrvMgr
push dword [ebp - 0xc4c]
lea eax, [ebp - 0xc54]
push 0x475124
push eax
call fcn.00402e53
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc4c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp - 0xc58]
mov edi, dword [ebp - 0xc50]
mov dword [edi + 0x28], eax
add edi, 0x20
lea eax, [ebp - 0xc54]
call fcn.00402b81
mov eax, edi
mov edi, 0x488580
call fcn.00402b81
mov eax, dword [ebp - 0xc54]
add eax, 0xfffffff0
call fcn.004031f6
call fcn.004437e3
ret 4