Function at 0x433727
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x288
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x288], eax
push 0x10
mov eax, 0x4af5a6
call fcn.004764c0
mov edi, dword [ebp + 0x294]
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
mov ebx, ecx
call fcn.00475420
mov ecx, dword [ebx + 8]
add esp, 0xc
test ecx, ecx
je 0x433a6e
call fcn.0043a82b
mov esi, eax
test esi, esi
je 0x433a6e
mov ecx, dword [ebx + 8]
call fcn.0045f2b7
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403cb9
and dword [ebp - 4], 0
push str.InstallVer
mov ecx, edi
call fcn.00403b09
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00403ca1
mov eax, dword [esi]
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x58]
push str.LocalVer
mov ecx, edi
call fcn.00403b09
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b09
mov ecx, dword [ebx + 8]
call fcn.0045f2e2
mov esi, eax
test esi, esi
je 0x433a63
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.00475420
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x60]
push 0x4b8ccc
mov ecx, edi
call fcn.00403b09
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b09
mov eax, dword [esi]
push esi
call dword [eax + 0x50]
push 0x4b8cc0
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00403b09
cmp dword [ebp - 0x14], 0
mov eax, 0x4b8cbc
jne 0x43384e
mov eax, 0x4b8cb8
push eax
mov ecx, edi
call fcn.00403b09
xor eax, eax
push 0x206
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00475420
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 0x14], 0
lea eax, [ebp]
je 0x43388e
push str.Drivers360fsflt.sys
jmp 0x433893
push str.Drivers360selfprotection.sys
push esi
push eax
call fcn.0047680a
add esp, 0xc
push 0x80
xor esi, esi
lea eax, [ebp + 0x208]
push esi
push eax
call fcn.00475420
add esp, 0xc
mov ecx, ebx
call fcn.00430605
cmp eax, esi
je 0x433a63
mov ecx, dword [eax]
push 0x40
lea edx, [ebp + 0x208]
push edx
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x64]
push str.DriverVer
mov ecx, edi
call fcn.00403b09
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b09
push 0x4f9e00
lea ecx, [ebp - 0x18]
call fcn.004027fb
mov ecx, dword [ebx + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00460be6
push str._safemon360procmon.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403a39
add esp, 0xc
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 2
call ebx
test eax, eax
je 0x433945
push esi
push dword [ebp - 0x10]
call fcn.0040224e
pop ecx
pop ecx
test eax, eax
je 0x433945
inc esi
push str.360procmon.dll
mov ecx, edi
call fcn.00403b09
mov eax, 0x4b8cb8
test esi, esi
jne 0x43395f
mov eax, 0x4b8cbc
push eax
mov ecx, edi
call fcn.00403b09
push str._safemon360tray.exe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a39
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401c3e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00402820
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x4339b6
push 0
push dword [ebp - 0x10]
call fcn.0040224e
pop ecx
pop ecx
test eax, eax
je 0x4339b6
xor esi, esi
inc esi
jmp 0x4339b8
xor esi, esi
push 0x4b8bc4
mov ecx, edi
call fcn.00403b09
mov eax, 0x4b8cb8
test esi, esi
jne 0x4339d2
mov eax, 0x4b8cbc
push eax
mov ecx, edi
call fcn.00403b09
push str._safemonSelfProtectAPI2.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a39
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401c3e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00402820
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x433a29
push 0
push dword [ebp - 0x10]
call fcn.0040224e
pop ecx
pop ecx
test eax, eax
je 0x433a29
xor ebx, ebx
inc ebx
jmp 0x433a2b
xor ebx, ebx
push str.SelfProtectAPI2.dll
mov ecx, edi
call fcn.00403b09
mov eax, 0x4b8cb8
test ebx, ebx
jne 0x433a45
mov eax, 0x4b8cbc
push eax
mov ecx, edi
call fcn.00403b09
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x288]
xor ecx, ebp
call fcn.0047549a
add ebp, 0x28c
leave
ret 4