Function at 0x412475
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push 0xc58
mov eax, 0x46bfba
call fcn.004437b0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc50], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x838], ax
xor esi, esi
lea eax, [ebp - 0x836]
push esi
push eax
call fcn.0043e1d0
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push esi
push 0x17
lea eax, [ebp - 0x838]
push eax
push esi
call ebx
test eax, eax
je 0x4124ed
push 0x4755f0
push 0x4765d8
lea eax, [ebp - 0x838]
push eax
mov eax, dword [ebp - 0xc50]
add eax, 0xc
push 0x476734
push eax
call fcn.00402e53
add esp, 0x14
xor eax, eax
push edi
mov word [ebp - 0xc48], ax
lea eax, [ebp - 0xc46]
push esi
push eax
call fcn.0043e1d0
add esp, 0xc
push esi
push 0x16
lea eax, [ebp - 0xc48]
push eax
push esi
call ebx
test eax, eax
je 0x41252e
mov eax, dword [ebp - 0xc50]
lea ecx, [ebp - 0xc48]
add eax, 0x10
push ecx
push eax
call fcn.00402c33
xor eax, eax
push edi
mov word [ebp - 0x630], ax
lea eax, [ebp - 0x62e]
push esi
push eax
call fcn.0043e1d0
add esp, 0xc
push 1
push 0x10
lea eax, [ebp - 0x630]
push eax
push esi
call ebx
test eax, eax
je 0x412570
mov eax, dword [ebp - 0xc50]
lea ecx, [ebp - 0x630]
add eax, 0x14
push ecx
push eax
call fcn.00402c33
xor eax, eax
push edi
mov word [ebp - 0xa40], ax
lea eax, [ebp - 0xa3e]
push esi
push eax
call fcn.0043e1d0
add esp, 0xc
push esi
push 0x1a
lea eax, [ebp - 0xa40]
push eax
push esi
call ebx
cmp eax, esi
je 0x4125b9
lea eax, [ebp - 0xa40]
push eax
mov eax, dword [ebp - 0xc50]
add eax, 8
push 0x475100
push eax
call fcn.00402e53
add esp, 0xc
mov ecx, 0x485f6c
lea esi, [ebp - 0xc54]
call fcn.00402b4a
and dword [ebp - 4], 0
xor eax, eax
push edi
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.0043e1d0
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x428]
inc esi
push eax
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xc60], 0x104
call fcn.00411f89
xor ecx, ecx
mov edi, 0x208
push edi
push ecx
cmp eax, ecx
je 0x4126e6
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0043e1d0
add esp, 0xc
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc64]
push eax
push str.DisplayVersion
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360DrvMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc4c], edi
mov dword [ebp - 0xc64], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x220]
push eax
call fcn.0043f08a
mov edi, dword [ebp - 0xc50]
add edi, 0x18
pop ecx
cmp eax, 0xffff
jne 0x412689
push str.2.0.0.1570
jmp 0x412690
lea eax, [ebp - 0x220]
push eax
push edi
call fcn.00402c33
push dword [edi]
call fcn.00416583
pop ecx
test eax, eax
jge 0x4126aa
mov dword [ebp - 0xc58], esi
jmp 0x4126b9
xor ecx, ecx
test eax, eax
setne cl
inc ecx
inc ecx
mov dword [ebp - 0xc58], ecx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xc54]
push 0x475100
push eax
call fcn.00402e53
add esp, 0xc
jmp 0x412825
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
mov dword [ebp - 0xc58], ecx
call fcn.0043e1d0
add esp, 0xc
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc5c]
push eax
push 0x474f2c
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xc60], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41277a
lea eax, [ebp - 0x220]
push eax
call fcn.0043eca9
pop ecx
test eax, eax
jbe 0x41277a
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41277a
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
call esi
jmp 0x41279b
push 0
push 0x26
lea eax, [ebp - 0x220]
push eax
push 0
call ebx
push 0x476850
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc4c]
push eax
call fcn.00402ad3
push 0x5c
push 0x2f
lea eax, [ebp - 0xc4c]
mov byte [ebp - 4], 1
call fcn.0040892b
push 0x5c
lea edi, [ebp - 0xc4c]
call fcn.00413161
mov edi, 0x4767b0
jmp 0x4127e1
lea eax, [ebp - 0xc4c]
push eax
call fcn.00412ff8
push edi
xor ecx, ecx
lea esi, [ebp - 0xc4c]
call fcn.004068db
cmp eax, 0xffffffff
jne 0x4127d5
push str.360DrvMgr
push dword [ebp - 0xc4c]
lea eax, [ebp - 0xc54]
push 0x475124
push eax
call fcn.00402e53
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc4c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp - 0xc58]
mov edi, dword [ebp - 0xc50]
mov dword [edi + 0x28], eax
add edi, 0x20
lea eax, [ebp - 0xc54]
call fcn.00402b81
mov eax, edi
mov edi, 0x488580
call fcn.00402b81
mov eax, dword [ebp - 0xc54]
add eax, 0xfffffff0
call fcn.004031f6
call fcn.00443833
ret 4