Function at 0x4052e0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4465cb
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x45636c]
xor eax, esp
mov dword [esp + 0xa38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45636c]
xor eax, esp
push eax
lea eax, [esp + 0xa50]
mov dword fs:[0], eax
mov eax, dword [0x45a1a0]
xor ebx, ebx
cmp eax, ebx
je 0x405586
cmp dword [eax + 0x1c], ebx
je 0x405586
push 0x410
lea eax, [esp + 0x640]
push ebx
push eax
call fcn.0042f230
add esp, 0xc
push 0x208
lea ecx, [esp + 0x640]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x63c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.NmSvr.cfg
lea eax, [esp + 0x640]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x63c]
push ecx
push ebx
push str.setuptime
push str.setup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov edx, edi
or edx, ebx
je 0x4053cb
push ebx
call fcn.0042bdb0
mov ecx, eax
mov eax, dword [0x45a1a0]
mov eax, dword [eax + 0x24]
add esp, 4
mov esi, edx
sub ecx, edi
cdq
sbb esi, ebx
cmp esi, edx
jl 0x405586
jg 0x4053cb
cmp ecx, eax
jb 0x405586
xor ebp, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
mov dword [esp + 0xa68], ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x405488
mov ebp, dword [esp + 0x18]
push 0x410
lea edx, [esp + 0x230]
push ebx
push edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebx
call fcn.0042f230
add esp, 0xc
push 0x44bf28
lea eax, [esp + 0x20]
push eax
lea edi, [esp + 0x20]
lea esi, [esp + 0x234]
mov dword [esp + 0x20], 0x208
call fcn.004012d0
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405450
sub eax, edx
sar eax, 1
cmp eax, 5
jbe 0x405476
lea ecx, [esp + 0x22c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x405488
push str.Software360safe
push SysReAllocStringLen
call fcn.0040cf00
add esp, 8
push 0x206
lea eax, [esp + 0x2a]
xor edx, edx
push ebx
push eax
mov word [esp + 0x30], dx
call fcn.0042f230
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.360ini360ini.dll
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4054d8
call fcn.004016e0
jmp 0x4054e3
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.IsSafeExist
push esi
call edi
call eax
test eax, eax
jne 0x40555d
push str.Start
push esi
call edi
mov edi, eax
cmp edi, ebx
je 0x405570
push 0x220
lea edx, [esp + 0x230]
push ebx
push edx
call fcn.0042f230
mov eax, 1
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], eax
add esp, 0xc
lea eax, [esp + 0x22c]
push eax
mov dword [esp + 0x230], 3
mov dword [esp + 0x234], 0x20326c
mov dword [esp + 0x240], 0x36ee80
call edi
jmp 0x405570
push str.do505
push esi
call edi
cmp eax, ebx
je 0x405570
push 0x20326c
call eax
cmp esi, ebx
je 0x40557b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebp, ebx
je 0x405586
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.0042a9a5
add esp, 0xa48
ret