Function at 0x4344f0
Capabilities:
Create directory
Get common file path
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xab4
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
mov dword [ebx + 0x42a8], 1
mov dword [ebx + 0x42ac], esi
test eax, eax
jne 0x434798
lea eax, [ebp - 0xa8c]
push eax
call fcn.0042166a
pop ecx
mov ecx, dword [eax]
call fcn.00435db3
mov ecx, dword [ebp - 0xa88]
test ecx, ecx
je 0x434548
call fcn.00420b3e
lea eax, [ebp - 0xa44]
push eax
call fcn.004db235
mov edi, dword [eax]
lea eax, [ebp - 0xa94]
push eax
call fcn.0042166a
pop ecx
pop ecx
push 1
mov esi, dword [eax]
push 1
push edi
call fcn.004db1b7
push eax
mov ecx, esi
call fcn.00435c47
mov ecx, dword [ebp - 0xa90]
test ecx, ecx
je 0x434587
call fcn.00420b3e
mov ecx, dword [ebp - 0xa44]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebx + 8]
mov eax, dword [ecx]
call dword [eax + 0x14]
push 0x410
xor edi, edi
lea eax, [ebp - 0xa2c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa2c]
push 1
push 0x1a
push eax
push dword [ebx - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.360safe360DiagnoseScanDriverInfo.txt
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 8
call fcn.004044d6
pop ecx
push edi
push edi
push 3
push edi
push 3
push 0x10000000
test eax, eax
je 0x4345fd
lea ecx, [ebp - 0xa2c]
push ecx
call eax
jmp 0x43460a
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x434c10
push 0x11
mov dword [ebp - 0xa38], edi
call fcn.004044d6
pop ecx
push edi
push esi
test eax, eax
je 0x43462d
call eax
jmp 0x434633
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0xa34], eax
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
mov eax, dword [ebp - 0xa34]
push 9
mov dword [ebp - 0xa30], eax
call fcn.004044d6
pop ecx
pop ecx
push 0
test eax, eax
je 0x43466f
lea ecx, [ebp - 0xa38]
push ecx
push dword [ebp - 0xa30]
push edi
push esi
call eax
jmp 0x434684
lea eax, [ebp - 0xa38]
push eax
push dword [ebp - 0xa30]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call fcn.00433ba6
lea eax, [ebp - 0xa2c]
push eax
call fcn.0041420e
push 0x3e7c
lea eax, [edi + 0x618]
push eax
lea eax, [ebx + 0x42c]
push eax
call sub.msvcrt.dll_memcpy
lea esi, [edi + 0x208]
push esi
call sub.msvcrt.dll_wcslen
add esp, 0x10
lea ecx, [ebx + 0x360]
push eax
push esi
call fcn.00410dd4
lea esi, [edi + 0x410]
push esi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push esi
lea ecx, [ebx + 0x3d8]
call fcn.00410dd4
push edi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push edi
lea ecx, [ebx + 0x224]
call fcn.00410dd4
xor esi, esi
inc esi
push esi
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov dword [ebx + 0x42ac], esi
lea eax, [ebp - 0x20c]
mov esi, 0x208
push esi
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x14
mov dword [ebp - 0xa48], 1
lea eax, [ebp - 0xa34]
mov dword [ebp - 0xa34], esi
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa48]
push eax
push str.fixItemName
push str.Software360Safe360DiagnoseScan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x434783
mov esi, dword [ebx + 8]
lea eax, [ebp - 0x20c]
push ecx
mov ecx, esp
push eax
call fcn.00402af5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call fcn.004db1b7
mov ecx, dword [ebx + 8]
push eax
call dword [esi + 0x7c]
xor esi, esi
jmp 0x4347a4
push eax
lea ecx, [ebx + 0xac]
call fcn.0042ab9c
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [ebx + 0x234], esi
je 0x434823
lea eax, [ebx + 0x224]
cmp dword [eax + 0x14], 8
jb 0x4347c0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xa3c]
call fcn.00402af5
push eax
push 0x530600
lea ecx, [ebp - 0xa50]
call fcn.00402af5
push eax
lea eax, [ebp - 0xa4c]
push eax
call fcn.004133f1
add esp, 0xc
push dword [eax]
push 0x40f
push dword [ebx - 0x1c]
call edi
mov ecx, dword [ebp - 0xa4c]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0xa50]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0xa3c]
lea ecx, [ecx - 0x10]
call fcn.004042e9
lea eax, [ebx + 0x32a8]
push eax
lea ecx, [ebx + 0x3c]
call fcn.00404527
push 0x410
lea eax, [ebp - 0x61c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x61c]
push 1
push 0x1a
push eax
push dword [ebx - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.360safe360DiagnoseScan_
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea eax, [ebp - 0x61c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebx + 0x3aa8]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x61c]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebx + 0x40]
call fcn.00404550
call fcn.00403a64
push eax
lea ecx, [ebp - 0xa30]
call fcn.00402a6b
lea eax, [ebx + 0x688]
push eax
lea eax, [ebx + 0x488]
push eax
lea eax, [ebp - 0xa30]
push str._._boldtrue_colorrgb_51_51_51____.__s____._boldfalse_colorrgb_51_51_51___.__s
push eax
call fcn.00415254
add esp, 0x10
push dword [ebp - 0xa30]
push 0x50f
push dword [ebx - 0x1c]
call edi
lea eax, [ebx + 0x2aa8]
push eax
lea eax, [ebp - 0xa30]
push 0x530740
push eax
call fcn.00415254
add esp, 0xc
push dword [ebp - 0xa30]
push 0x510
push dword [ebx - 0x1c]
call edi
mov ecx, dword [ebx + 0x2a9c]
fild dword [ebx + 0x2a9c]
test ecx, ecx
jns 0x434931
fadd qword [0x528db0]
fstp qword [ebp - 0xa9c]
fld qword [ebp - 0xa9c]
fld qword [0x530d40]
fmul st(1), st(0)
fmulp st(1)
fld1
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x434974
shr ecx, 0xa
fstp st(0)
mov dword [ebp - 0xa3c], ecx
mov eax, 0x530780
fild dword [ebp - 0xa3c]
test ecx, ecx
jns 0x434979
fadd qword [0x528db0]
jmp 0x434979
mov eax, 0x5307c8
push ecx
push ecx
fstp qword [esp]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00415254
mov edi, dword [ebp - 0xa30]
add esp, 0x10
push edi
push 0x511
push dword [ebx - 0x1c]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebx + 0x42c]
sub eax, 1
je 0x434a98
sub eax, 1
je 0x434a66
sub eax, 1
je 0x434a34
sub eax, 1
je 0x4349ff
sub eax, 4
je 0x4349ff
push str.safemon_skin_browserfixOtherHardware.png
push dword [0x577c88]
lea eax, [ebp - 0xa54]
push eax
call fcn.0041bbfe
add esp, 0xc
mov ecx, ebx
push 1
push dword [eax]
push 0x4c6
call fcn.004b535f
mov ecx, dword [ebp - 0xa54]
jmp 0x434ac8
push str.safemon_skin_browserfixmodemIco.png
push dword [0x577c88]
lea eax, [ebp - 0xa58]
push eax
call fcn.0041bbfe
add esp, 0xc
mov ecx, ebx
push 1
push dword [eax]
push 0x4c6
call fcn.004b535f
mov ecx, dword [ebp - 0xa58]
jmp 0x434ac8
push str.safemon_skin_browserfix_audioIco.png
push dword [0x577c88]
lea eax, [ebp - 0xa5c]
push eax
call fcn.0041bbfe
add esp, 0xc
mov ecx, ebx
push 1
push dword [eax]
push 0x4c6
call fcn.004b535f
mov ecx, dword [ebp - 0xa5c]
jmp 0x434ac8
push str.safemon_skin_browserfix_videoIco.png
push dword [0x577c88]
lea eax, [ebp - 0xa60]
push eax
call fcn.0041bbfe
add esp, 0xc
mov ecx, ebx
push 1
push dword [eax]
push 0x4c6
call fcn.004b535f
mov ecx, dword [ebp - 0xa60]
jmp 0x434ac8
push str.safemon_skin_browserfixmainBoardIco.png
push dword [0x577c88]
lea eax, [ebp - 0xa64]
push eax
call fcn.0041bbfe
add esp, 0xc
mov ecx, ebx
push 1
push dword [eax]
push 0x4c6
call fcn.004b535f
mov ecx, dword [ebp - 0xa64]
lea ecx, [ecx - 0x10]
call fcn.004042e9
push str.safemon_skin_browserfix_softBack.png
push dword [0x577c88]
lea eax, [ebp - 0xa40]
push eax
call fcn.0041bbfe
add esp, 0xc
lea ecx, [ebp - 0xa74]
push 0x50d
push dword [ebx - 0x1c]
call fcn.0041f472
cmp dword [ebp - 0xa68], 0
mov esi, dword [ebp - 0xa40]
je 0x434b83
push 1
lea ecx, [ebp - 0xa74]
call fcn.00420653
mov eax, dword [ebp - 0xa68]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0xa68]
lea edx, [ebp - 0xa7c]
push edx
mov dword [ebp - 0xa84], 0xd
lea edx, [ebp - 0xa84]
mov dword [ebp - 0xa80], 0x11
mov dword [ebp - 0xa7c], 0x14
mov dword [ebp - 0xa78], 0x18
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x54]
mov eax, dword [ebp - 0xa68]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 1
lea ecx, [ebp - 0xa74]
call fcn.00420772
push 1
push 0
push 1
push dword [ebx - 0x1c]
lea ecx, [ebp - 0xab4]
call fcn.00419f27
cmp dword [ebp - 0xaa4], 0
je 0x434bc2
push 1
lea ecx, [ebp - 0xab4]
call fcn.0042689c
mov eax, dword [ebp - 0xaa4]
push 0
push 1
push str.CommonCoolUIDlgBackground_simple.png
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
push 1
lea ecx, [ebx - 0x20]
call fcn.00435610
push 0
push 0
push 0x402
push dword [ebx + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xaa0]
add ecx, 0xfffffff0
call fcn.004042e9
lea ecx, [esi - 0x10]
call fcn.004042e9
lea ecx, [edi - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00522d04
leave
ret 8
push edi
call fcn.00516bc0
int3