Function at 0x407260
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x47735b
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x83c]
xor edi, edi
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
push 0x800
lea eax, [esp + 0x28]
push edi
push eax
mov dword [esp + 0x840], edi
call fcn.0045bc00
mov eax, dword [esi + 0x14c]
mov ecx, dword [esi + 0x114]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 1
push edi
push eax
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4073a2
mov esi, dword [esi + 0x150]
mov ebx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edi
push eax
lea edi, [esp + 0x20]
lea esi, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0x400
call fcn.00409020
test eax, eax
jne 0x407387
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407387
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x407387
mov edx, 0x400
mov eax, ebp
sub esi, ebp
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x407366
movzx ecx, word [esi + eax]
test cx, cx
je 0x407366
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407346
jmp 0x40736a
test edx, edx
jne 0x40736d
sub eax, 2
xor edx, edx
mov word [eax], dx
test ebx, ebx
je 0x40737d
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x407567
test ebx, ebx
je 0x407398
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
xor edi, edi
call fcn.004071d0
test eax, eax
je 0x40755a
lea eax, [esp + 0x18]
push eax
push 0x2001f
push edi
push str.SYSTEMCurrentControlSetServices360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4074da
xor eax, eax
cmp ebx, edi
je 0x4073e3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
cmp eax, edi
jne 0x4074da
push str.RULE_360Safe
lea ecx, [esp + 0x20]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x2c]
mov dword [esp + 0x20], 0x400
call fcn.00409020
test eax, eax
jne 0x4074bf
cmp dword [esp + 0x18], 0xd
jbe 0x4074bf
push 4
mov edx, esi
push 0x484e0c
push edx
call fcn.0045d80f
add esp, 0xc
test eax, eax
jne 0x4074bf
push str.....
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4074bf
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4074bf
lea esi, [esp + 0x2c]
mov edx, 0x400
mov eax, ebp
sub esi, ebp
mov edi, edi
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x4074a0
movzx ecx, word [esi + eax]
test cx, cx
je 0x4074a0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407480
jmp 0x4074a4
test edx, edx
jne 0x4074a7
sub eax, 2
xor edx, edx
lea ecx, [esp + 0x1c]
mov word [eax], dx
call fcn.00409100
mov eax, 1
jmp 0x407567
test ebx, ebx
je 0x4074d0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
xor edi, edi
push edi
push 0x26
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40755a
push str.360360Safe
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40755a
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40755a
lea esi, [esp + 0x24]
mov edx, 0x400
mov eax, ebp
sub esi, ebp
jmp 0x407530
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x407553
movzx ecx, word [esi + eax]
cmp cx, di
je 0x407553
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407530
jmp 0x4074a4
cmp edx, edi
jmp 0x4074a2
cmp ebx, edi
je 0x407565
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0045bbec
add esp, 0x824
ret 4