Function at 0x408a00
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x474b8b
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x490d68]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x490d68]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x83c]
xor edi, edi
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
push 0x800
lea eax, [esp + 0x28]
push edi
push eax
mov dword [esp + 0x840], edi
call fcn.00457170
mov eax, dword [esi + 0x130]
mov ecx, dword [esi + 0xfc]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 1
push edi
push eax
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x408b42
mov esi, dword [esi + 0x134]
mov ebx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edi
push eax
lea edi, [esp + 0x20]
lea esi, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0x400
call fcn.004097e0
test eax, eax
jne 0x408b27
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408b27
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x408b27
mov edx, 0x400
mov eax, ebp
sub esi, ebp
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x408b06
movzx ecx, word [esi + eax]
test cx, cx
je 0x408b06
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408ae6
jmp 0x408b0a
test edx, edx
jne 0x408b0d
sub eax, 2
xor edx, edx
mov word [eax], dx
test ebx, ebx
je 0x408b1d
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x408d07
test ebx, ebx
je 0x408b38
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
xor edi, edi
call fcn.00408970
test eax, eax
je 0x408cfa
lea eax, [esp + 0x18]
push eax
push 0x2001f
push edi
push str.SYSTEMCurrentControlSetServices360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x408c7a
xor eax, eax
cmp ebx, edi
je 0x408b83
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
cmp eax, edi
jne 0x408c7a
push str.RULE_360Safe
lea ecx, [esp + 0x20]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x2c]
mov dword [esp + 0x20], 0x400
call fcn.004097e0
test eax, eax
jne 0x408c5f
cmp dword [esp + 0x18], 0xd
jbe 0x408c5f
push 4
mov edx, esi
push 0x481dcc
push edx
call fcn.00459ded
add esp, 0xc
test eax, eax
jne 0x408c5f
push str.....
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408c5f
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x408c5f
lea esi, [esp + 0x2c]
mov edx, 0x400
mov eax, ebp
sub esi, ebp
mov edi, edi
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x408c40
movzx ecx, word [esi + eax]
test cx, cx
je 0x408c40
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408c20
jmp 0x408c44
test edx, edx
jne 0x408c47
sub eax, 2
xor edx, edx
lea ecx, [esp + 0x1c]
mov word [eax], dx
call fcn.004098c0
mov eax, 1
jmp 0x408d07
test ebx, ebx
je 0x408c70
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
xor edi, edi
push edi
push 0x26
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x408cfa
push str.360360Safe
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408cfa
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x408cfa
lea esi, [esp + 0x24]
mov edx, 0x400
mov eax, ebp
sub esi, ebp
jmp 0x408cd0
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x408cf3
movzx ecx, word [esi + eax]
cmp cx, di
je 0x408cf3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408cd0
jmp 0x408c44
cmp edx, edi
jmp 0x408c42
cmp ebx, edi
je 0x408d05
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0045715c
add esp, 0x824
ret 4