Function at 0x4ef5e0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Get common file path
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f8ccb
push eax
mov eax, dword [0x5c0938]
mov dword fs:[0], esp
sub esp, 0xa30
push esi
xor esi, esi
cmp eax, esi
je 0x4ef622
mov eax, dword [0x5c0934]
pop esi
mov ecx, dword [esp + 0xa30]
mov dword fs:[0], ecx
add esp, 0xa3c
ret
push ebx
push ebp
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x42a]
mov word [esp + 0x428], si
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [esp + 0x42c]
push 0x1a
push eax
push esi
mov dword [0x5c0938], 1
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov word [esp + 0x18], si
push str.360seie8core
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x42c]
lea edx, [esp + 0x1c]
push ecx
push edx
stosw word es:[edi], ax
call ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x632]
mov word [esp + 0x630], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x630]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, esi
je 0x4ef7f5
push 0xb
push str.360SeSS.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x4ef7f5
cmp dword [0x5b8084], esi
je 0x4ef7f5
cmp dword [0x5b806c], esi
je 0x4ef7f5
cmp dword [0x5b807c], esi
jne 0x4ef7f5
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x804
jne 0x4ef7f5
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ef7f5
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push 0x20000
push esi
push str.SoftwareIEStub
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ef7e6
mov ecx, 0x81
lea edi, [esp + 0x83a]
mov word [esp + 0x838], si
push 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x83c]
push 0x1a
push ecx
push esi
stosw word es:[edi], ax
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x838]
push str.360sedataguardconfig.ini
lea eax, [esp + 0x224]
push edx
push eax
call ebp
lea ecx, [esp + 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ef7dc
lea edx, [esp + 0x220]
push edx
push 1
push 0x536678
push str.switch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4ef7e6
mov dword [0x5c0934], 1
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4ef7f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [0x5c0934], esi
je 0x4ef83e
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0xa4c], esi
call fcn.004f0310
cmp eax, esi
mov dword [0x5c0934], eax
jne 0x4ef83e
push esi
push esi
push esi
call fcn.004ef5a0
push eax
mov ecx, 0x5c0510
call fcn.004eef80
call edi
mov ecx, dword [esp + 0xa40]
mov eax, dword [0x5c0934]
pop edi
pop ebp
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0xa3c
ret