Function at 0x4237f7
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x288
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x288], eax
push 0x10
mov eax, 0x487cbb
call fcn.004677c7
mov edi, dword [ebp + 0x294]
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
mov ebx, ecx
call fcn.004670a0
mov ecx, dword [ebx + 8]
add esp, 0xc
test ecx, ecx
je 0x423b3e
call fcn.00428edd
mov esi, eax
test esi, esi
je 0x423b3e
mov ecx, dword [ebx + 8]
call fcn.0044c718
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402ee2
and dword [ebp - 4], 0
push str.InstallVer
mov ecx, edi
call fcn.00402f00
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00422dc2
mov eax, dword [esi]
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x58]
push str.LocalVer
mov ecx, edi
call fcn.00402f00
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00402f00
mov ecx, dword [ebx + 8]
call fcn.0044c743
mov esi, eax
test esi, esi
je 0x423b33
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.004670a0
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x5c]
push str.OS
mov ecx, edi
call fcn.00402f00
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00402f00
mov eax, dword [esi]
push esi
call dword [eax + 0x48]
push 0x491d30
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00402f00
cmp dword [ebp - 0x14], 0
mov eax, 0x491d2c
jne 0x42391e
mov eax, 0x491d28
push eax
mov ecx, edi
call fcn.00402f00
xor eax, eax
push 0x206
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.004670a0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 0x14], 0
lea eax, [ebp]
je 0x42395e
push str.Drivers360fsflt.sys
jmp 0x423963
push str.Drivers360selfprotection.sys
push esi
push eax
call fcn.00467a3e
add esp, 0xc
push 0x80
xor esi, esi
lea eax, [ebp + 0x208]
push esi
push eax
call fcn.004670a0
add esp, 0xc
mov ecx, ebx
call fcn.0041f7f0
cmp eax, esi
je 0x423b33
mov ecx, dword [eax]
push 0x40
lea edx, [ebp + 0x208]
push edx
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x60]
push str.DriverVer
mov ecx, edi
call fcn.00402f00
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00402f00
push 0x4c4f30
lea ecx, [ebp - 0x18]
call fcn.00401ce4
mov ecx, dword [ebx + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0044d477
push str._safemon360procmon.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040d822
add esp, 0xc
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 2
call ebx
test eax, eax
je 0x423a15
push esi
push dword [ebp - 0x10]
call fcn.00402032
pop ecx
pop ecx
test eax, eax
je 0x423a15
inc esi
push str.360procmon.dll
mov ecx, edi
call fcn.00402f00
mov eax, 0x491d28
test esi, esi
jne 0x423a2f
mov eax, 0x491d2c
push eax
mov ecx, edi
call fcn.00402f00
push str._safemon360tray.exe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401d13
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004023e9
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x423a86
push 0
push dword [ebp - 0x10]
call fcn.00402032
pop ecx
pop ecx
test eax, eax
je 0x423a86
xor esi, esi
inc esi
jmp 0x423a88
xor esi, esi
push 0x491c08
mov ecx, edi
call fcn.00402f00
mov eax, 0x491d28
test esi, esi
jne 0x423aa2
mov eax, 0x491d2c
push eax
mov ecx, edi
call fcn.00402f00
push str._safemonSelfProtectAPI2.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401d13
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004023e9
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x423af9
push 0
push dword [ebp - 0x10]
call fcn.00402032
pop ecx
pop ecx
test eax, eax
je 0x423af9
xor ebx, ebx
inc ebx
jmp 0x423afb
xor ebx, ebx
push str.SelfProtectAPI2.dll
mov ecx, edi
call fcn.00402f00
mov eax, 0x491d28
test ebx, ebx
jne 0x423b15
mov eax, 0x491d2c
push eax
mov ecx, edi
call fcn.00402f00
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x288]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x28c
leave
ret 4