Function at 0x412653
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push 0xc58
mov eax, 0x46c0ba
call fcn.00443910
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc50], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x838], ax
xor esi, esi
lea eax, [ebp - 0x836]
push esi
push eax
call fcn.0043e330
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push esi
push 0x17
lea eax, [ebp - 0x838]
push eax
push esi
call ebx
test eax, eax
je 0x4126cb
push 0x475678
push 0x476660
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0xc50]
add eax, 0xc
push 0x4767bc
push eax
call fcn.00402e53
add esp, 0x14
xor eax, eax
push edi
mov word [ebp - 0xc48], ax
lea eax, [ebp - 0xc46]
push esi
push eax
call fcn.0043e330
add esp, 0xc
push esi
push 0x16
lea eax, [ebp - 0xc48]
push eax
push esi
call ebx
test eax, eax
je 0x41270c
mov eax, dword [ebp - 0xc50]
lea ecx, [ebp - 0xc48]
add eax, 0x10
push ecx
push eax
call fcn.00402c33
xor eax, eax
push edi
mov word [ebp - 0x630], ax
lea eax, [ebp - 0x62e]
push esi
push eax
call fcn.0043e330
add esp, 0xc
push 1
push 0x10
lea eax, [ebp - 0x630]
push eax
push esi
call ebx
test eax, eax
je 0x41274e
mov eax, dword [ebp - 0xc50]
lea ecx, [ebp - 0x630]
add eax, 0x14
push ecx
push eax
call fcn.00402c33
xor eax, eax
push edi
mov word [ebp - 0xa40], ax
lea eax, [ebp - 0xa3e]
push esi
push eax
call fcn.0043e330
add esp, 0xc
push esi
push 0x1a
lea eax, [ebp - 0xa40]
push eax
push esi
call ebx
cmp eax, esi
je 0x412797
lea eax, [ebp - 0xa40]
push eax
mov eax, dword [ebp - 0xc50]
add eax, 8
push 0x475100
push eax
call fcn.00402e53
add esp, 0xc
mov ecx, 0x485f6c
lea esi, [ebp - 0xc54]
call fcn.00402b4a
and dword [ebp - 4], 0
xor eax, eax
push edi
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.0043e330
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x428]
inc esi
push eax
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xc60], 0x104
call fcn.00412167
xor ecx, ecx
mov edi, 0x208
push edi
push ecx
cmp eax, ecx
je 0x4128c4
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0043e330
add esp, 0xc
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc64]
push eax
push str.DisplayVersion
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360DrvMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc4c], edi
mov dword [ebp - 0xc64], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x220]
push eax
call fcn.0043f1ea
mov edi, dword [ebp - 0xc50]
add edi, 0x18
pop ecx
cmp eax, 0xffff
jne 0x412867
push str.2.0.0.1570
jmp 0x41286e
lea eax, [ebp - 0x220]
push eax
push edi
call fcn.00402c33
push dword [edi]
call fcn.00416768
pop ecx
test eax, eax
jge 0x412888
mov dword [ebp - 0xc58], esi
jmp 0x412897
xor ecx, ecx
test eax, eax
setne cl
inc ecx
inc ecx
mov dword [ebp - 0xc58], ecx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xc54]
push 0x475100
push eax
call fcn.00402e53
add esp, 0xc
jmp 0x412a03
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
mov dword [ebp - 0xc58], ecx
call fcn.0043e330
add esp, 0xc
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc5c]
push eax
push 0x474f2c
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xc60], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x412958
lea eax, [ebp - 0x220]
push eax
call fcn.0043ee09
pop ecx
test eax, eax
jbe 0x412958
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412958
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
call esi
jmp 0x412979
push 0
push 0x26
lea eax, [ebp - 0x220]
push eax
push 0
call ebx
push 0x4768d8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc4c]
push eax
call fcn.00402ad3
push 0x5c
push 0x2f
lea eax, [ebp - 0xc4c]
mov byte [ebp - 4], 1
call fcn.00408baf
push 0x5c
lea edi, [ebp - 0xc4c]
call fcn.0041333d
mov edi, 0x476838
jmp 0x4129bf
lea eax, [ebp - 0xc4c]
push eax
call fcn.004131d4
push edi
xor ecx, ecx
lea esi, [ebp - 0xc4c]
call fcn.00406a54
cmp eax, 0xffffffff
jne 0x4129b3
push str.360DrvMgr
push dword [ebp - 0xc4c]
lea eax, [ebp - 0xc54]
push 0x475124
push eax
call fcn.00402e53
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc4c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp - 0xc58]
mov edi, dword [ebp - 0xc50]
mov dword [edi + 0x28], eax
add edi, 0x20
lea eax, [ebp - 0xc54]
call fcn.00402b81
mov eax, edi
mov edi, 0x488580
call fcn.00402b81
mov eax, dword [ebp - 0xc54]
add eax, 0xfffffff0
call fcn.004031f6
call fcn.00443993
ret 4