Function at 0x405310
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x7a8
mov eax, dword [0x4231d0]
xor eax, esp
mov dword [esp + 0x7a4], eax
mov eax, dword [esp + 0x7ac]
push ebx
push ebp
push esi
push edi
push 0x208
lea ecx, [esp + 0xa0]
push 0
push ecx
mov dword [esp + 0x24], eax
call fcn.0040d9e0
push 0x208
lea edx, [esp + 0x3b4]
push 0
push edx
call fcn.0040d9e0
add esp, 0x18
push 0x104
lea eax, [esp + 0x3a8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x3a4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x80
lea edx, [esp + 0x328]
push 0
push edx
call fcn.0040d9e0
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str...360ver.dll
lea eax, [esp + 0x3a8]
push eax
lea ecx, [esp + 0xa4]
push ecx
call ebp
lea edi, [esp + 0x324]
lea esi, [esp + 0x9c]
call fcn.00405090
push 0x80
lea edx, [esp + 0x20]
push 0
push edx
call fcn.0040d9e0
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.00405260
call fcn.00404ef0
mov ebx, eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x5b6]
push ecx
mov word [esp + 0x5b8], ax
call fcn.0040d9e0
add esp, 0xc
push 0x104
lea edx, [esp + 0x5b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test ebx, ebx
je 0x405437
push str.Drivers360fsflt.sys
push 0x104
lea eax, [esp + 0x5b4]
push eax
jmp 0x405449
push str.Drivers360selfprotection.sys
push 0x104
lea ecx, [esp + 0x5b4]
push ecx
call fcn.0040d6c8
add esp, 0xc
push 0x80
lea edx, [esp + 0x2a8]
push 0
push edx
call fcn.0040d9e0
add esp, 0xc
lea edi, [esp + 0x2a4]
lea esi, [esp + 0x5ac]
call fcn.00405090
push str.360procmon.dll
lea eax, [esp + 0x3a8]
push eax
lea ecx, [esp + 0xa4]
push ecx
call ebp
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x9c]
push edx
call edi
test eax, eax
je 0x4054e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401df0
add esp, 4
test eax, eax
jne 0x4054de
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xa0]
call fcn.00406bc0
add esp, 4
test eax, eax
je 0x4054e8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4054e8
cmp eax, 1
je 0x4054e8
mov dword [esp + 0x10], 1
jmp 0x4054f0
mov dword [esp + 0x10], 0
push str.360tray.exe
lea ecx, [esp + 0x3a8]
push ecx
lea edx, [esp + 0xa4]
push edx
call ebp
lea eax, [esp + 0x9c]
push eax
call edi
test eax, eax
je 0x405554
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401df0
add esp, 4
test eax, eax
jne 0x40554d
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0xa0]
call fcn.00406bc0
add esp, 4
test eax, eax
je 0x405554
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405554
cmp eax, 1
je 0x405554
mov esi, 1
jmp 0x405556
xor esi, esi
push str.SelfProtectAPI2.dll
lea edx, [esp + 0x3a8]
push edx
lea eax, [esp + 0xa4]
push eax
call ebp
lea ecx, [esp + 0x9c]
push ecx
call edi
test eax, eax
je 0x4055ba
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401df0
add esp, 4
test eax, eax
jne 0x4055b3
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xa0]
call fcn.00406bc0
add esp, 4
test eax, eax
je 0x4055ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4055ba
cmp eax, 1
je 0x4055ba
mov eax, 1
jmp 0x4055bc
xor eax, eax
push eax
mov eax, dword [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x2b0]
push ecx
push ebx
mov ebx, dword [esp + 0x2c]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x33c]
push eax
push str.LocalVer_sOS_sx64_dDriverVer_s360procmon.dll_d360tray.exe_dSelfProtectAPI2.dll_d
mov ecx, 0x200
call fcn.00402090
mov ecx, dword [esp + 0x7d4]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040caaf
add esp, 0x7a8
ret