Function at 0x4336b5
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x288
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x288], eax
push 0x10
mov eax, 0x4af4f7
call fcn.004764b0
mov edi, dword [ebp + 0x294]
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
mov ebx, ecx
call fcn.00475410
mov ecx, dword [ebx + 8]
add esp, 0xc
test ecx, ecx
je 0x4339fc
call fcn.0043a6c5
mov esi, eax
test esi, esi
je 0x4339fc
mov ecx, dword [ebx + 8]
call fcn.0045e76c
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403c36
and dword [ebp - 4], 0
push str.InstallVer
mov ecx, edi
call fcn.00403af2
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00403c1e
mov eax, dword [esi]
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x58]
push str.LocalVer
mov ecx, edi
call fcn.00403af2
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403af2
mov ecx, dword [ebx + 8]
call fcn.0045e797
mov esi, eax
test esi, esi
je 0x4339f1
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.00475410
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x60]
push 0x4b8ccc
mov ecx, edi
call fcn.00403af2
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403af2
mov eax, dword [esi]
push esi
call dword [eax + 0x50]
push 0x4b8cc0
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00403af2
cmp dword [ebp - 0x14], 0
mov eax, 0x4b8cbc
jne 0x4337dc
mov eax, 0x4b8cb8
push eax
mov ecx, edi
call fcn.00403af2
xor eax, eax
push 0x206
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00475410
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 0x14], 0
lea eax, [ebp]
je 0x43381c
push str.Drivers360fsflt.sys
jmp 0x433821
push str.Drivers360selfprotection.sys
push esi
push eax
call fcn.004767fa
add esp, 0xc
push 0x80
xor esi, esi
lea eax, [ebp + 0x208]
push esi
push eax
call fcn.00475410
add esp, 0xc
mov ecx, ebx
call fcn.00430655
cmp eax, esi
je 0x4339f1
mov ecx, dword [eax]
push 0x40
lea edx, [ebp + 0x208]
push edx
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x64]
push str.DriverVer
mov ecx, edi
call fcn.00403af2
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403af2
push 0x4f9e00
lea ecx, [ebp - 0x18]
call fcn.0040293e
mov ecx, dword [ebx + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.004600b7
push str._safemon360procmon.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403a22
add esp, 0xc
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 2
call ebx
test eax, eax
je 0x4338d3
push esi
push dword [ebp - 0x10]
call fcn.0040239b
pop ecx
pop ecx
test eax, eax
je 0x4338d3
inc esi
push str.360procmon.dll
mov ecx, edi
call fcn.00403af2
mov eax, 0x4b8cb8
test esi, esi
jne 0x4338ed
mov eax, 0x4b8cbc
push eax
mov ecx, edi
call fcn.00403af2
push str._safemon360tray.exe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a22
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401df2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00402963
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x433944
push 0
push dword [ebp - 0x10]
call fcn.0040239b
pop ecx
pop ecx
test eax, eax
je 0x433944
xor esi, esi
inc esi
jmp 0x433946
xor esi, esi
push 0x4b8bc4
mov ecx, edi
call fcn.00403af2
mov eax, 0x4b8cb8
test esi, esi
jne 0x433960
mov eax, 0x4b8cbc
push eax
mov ecx, edi
call fcn.00403af2
push str._safemonSelfProtectAPI2.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a22
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401df2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00402963
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x4339b7
push 0
push dword [ebp - 0x10]
call fcn.0040239b
pop ecx
pop ecx
test eax, eax
je 0x4339b7
xor ebx, ebx
inc ebx
jmp 0x4339b9
xor ebx, ebx
push str.SelfProtectAPI2.dll
mov ecx, edi
call fcn.00403af2
mov eax, 0x4b8cb8
test ebx, ebx
jne 0x4339d3
mov eax, 0x4b8cbc
push eax
mov ecx, edi
call fcn.00403af2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x288]
xor ecx, ebp
call fcn.0047548a
add ebp, 0x28c
leave
ret 4