Function at 0x43352d
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x288
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x288], eax
push 0x10
mov eax, 0x4af62f
call fcn.00476610
mov edi, dword [ebp + 0x294]
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
mov ebx, ecx
call fcn.00475570
mov ecx, dword [ebx + 8]
add esp, 0xc
test ecx, ecx
je 0x433874
call fcn.0045f3a7
mov esi, eax
test esi, esi
je 0x433874
mov ecx, dword [ebx + 8]
call fcn.0045f422
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403c96
and dword [ebp - 4], 0
push str.InstallVer
mov ecx, edi
call fcn.00403b3b
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00403c7e
mov eax, dword [esi]
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x58]
push str.LocalVer
mov ecx, edi
call fcn.00403b3b
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b3b
mov ecx, dword [ebx + 8]
call fcn.0045f44d
mov esi, eax
test esi, esi
je 0x433869
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.00475570
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x60]
push 0x4b9ccc
mov ecx, edi
call fcn.00403b3b
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b3b
mov eax, dword [esi]
push esi
call dword [eax + 0x50]
push 0x4b9cc0
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00403b3b
cmp dword [ebp - 0x14], 0
mov eax, 0x4b9cbc
jne 0x433654
mov eax, 0x4b9cb8
push eax
mov ecx, edi
call fcn.00403b3b
xor eax, eax
push 0x206
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00475570
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 0x14], 0
lea eax, [ebp]
je 0x433694
push str.Drivers360fsflt.sys
jmp 0x433699
push str.Drivers360selfprotection.sys
push esi
push eax
call fcn.0047695a
add esp, 0xc
push 0x80
xor esi, esi
lea eax, [ebp + 0x208]
push esi
push eax
call fcn.00475570
add esp, 0xc
mov ecx, ebx
call fcn.00430505
cmp eax, esi
je 0x433869
mov ecx, dword [eax]
push 0x40
lea edx, [ebp + 0x208]
push edx
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x64]
push str.DriverVer
mov ecx, edi
call fcn.00403b3b
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b3b
push 0x4f9e18
lea ecx, [ebp - 0x18]
call fcn.0040284b
mov ecx, dword [ebx + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00460e88
push str._safemon360procmon.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403a6b
add esp, 0xc
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 2
call ebx
test eax, eax
je 0x43374b
push esi
push dword [ebp - 0x10]
call fcn.0040229e
pop ecx
pop ecx
test eax, eax
je 0x43374b
inc esi
push str.360procmon.dll
mov ecx, edi
call fcn.00403b3b
mov eax, 0x4b9cb8
test esi, esi
jne 0x433765
mov eax, 0x4b9cbc
push eax
mov ecx, edi
call fcn.00403b3b
push str._safemon360tray.exe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a6b
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401c8e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00402870
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x4337bc
push 0
push dword [ebp - 0x10]
call fcn.0040229e
pop ecx
pop ecx
test eax, eax
je 0x4337bc
xor esi, esi
inc esi
jmp 0x4337be
xor esi, esi
push 0x4b9bc4
mov ecx, edi
call fcn.00403b3b
mov eax, 0x4b9cb8
test esi, esi
jne 0x4337d8
mov eax, 0x4b9cbc
push eax
mov ecx, edi
call fcn.00403b3b
push str._safemonSelfProtectAPI2.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a6b
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401c8e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00402870
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x43382f
push 0
push dword [ebp - 0x10]
call fcn.0040229e
pop ecx
pop ecx
test eax, eax
je 0x43382f
xor ebx, ebx
inc ebx
jmp 0x433831
xor ebx, ebx
push str.SelfProtectAPI2.dll
mov ecx, edi
call fcn.00403b3b
mov eax, 0x4b9cb8
test ebx, ebx
jne 0x43384b
mov eax, 0x4b9cbc
push eax
mov ecx, edi
call fcn.00403b3b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x288]
xor ecx, ebp
call fcn.004755ea
add ebp, 0x28c
leave
ret 4