Function at 0x43341b
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x288
lea ebp, [esp - 4]
mov eax, dword [0x4f2be0]
xor eax, ebp
mov dword [ebp + 0x288], eax
push 0x10
mov eax, 0x4aeb1f
call fcn.00475a5f
mov edi, dword [ebp + 0x294]
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
mov ebx, ecx
call fcn.00474a10
mov ecx, dword [ebx + 8]
add esp, 0xc
test ecx, ecx
je 0x433762
call fcn.0045e3af
mov esi, eax
test esi, esi
je 0x433762
mov ecx, dword [ebx + 8]
call fcn.0045e42a
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403cb4
and dword [ebp - 4], 0
push str.InstallVer
mov ecx, edi
call fcn.00403b59
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00403c9c
mov eax, dword [esi]
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x58]
push str.LocalVer
mov ecx, edi
call fcn.00403b59
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b59
mov ecx, dword [ebx + 8]
call fcn.0045e455
mov esi, eax
test esi, esi
je 0x433757
push 0x80
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.00474a10
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp + 0x208]
push ecx
push esi
call dword [eax + 0x60]
push 0x4b892c
mov ecx, edi
call fcn.00403b59
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b59
mov eax, dword [esi]
push esi
call dword [eax + 0x50]
push 0x4b8920
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00403b59
cmp dword [ebp - 0x14], 0
mov eax, 0x4b891c
jne 0x433542
mov eax, 0x4b8918
push eax
mov ecx, edi
call fcn.00403b59
xor eax, eax
push 0x206
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00474a10
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 0x14], 0
lea eax, [ebp]
je 0x433582
push str.Drivers360fsflt.sys
jmp 0x433587
push str.Drivers360selfprotection.sys
push esi
push eax
call fcn.00475da9
add esp, 0xc
push 0x80
xor esi, esi
lea eax, [ebp + 0x208]
push esi
push eax
call fcn.00474a10
add esp, 0xc
mov ecx, ebx
call fcn.0043067a
cmp eax, esi
je 0x433757
mov ecx, dword [eax]
push 0x40
lea edx, [ebp + 0x208]
push edx
lea edx, [ebp]
push edx
push eax
call dword [ecx + 0x64]
push str.DriverVer
mov ecx, edi
call fcn.00403b59
lea eax, [ebp + 0x208]
push eax
mov ecx, edi
call fcn.00403b59
push 0x4f8ce0
lea ecx, [ebp - 0x18]
call fcn.004029af
mov ecx, dword [ebx + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0045fd29
push str._safemon360procmon.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403a89
add esp, 0xc
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 2
call ebx
test eax, eax
je 0x433639
push esi
push dword [ebp - 0x10]
call fcn.00402402
pop ecx
pop ecx
test eax, eax
je 0x433639
inc esi
push str.360procmon.dll
mov ecx, edi
call fcn.00403b59
mov eax, 0x4b8918
test esi, esi
jne 0x433653
mov eax, 0x4b891c
push eax
mov ecx, edi
call fcn.00403b59
push str._safemon360tray.exe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a89
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401df2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004029d4
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x4336aa
push 0
push dword [ebp - 0x10]
call fcn.00402402
pop ecx
pop ecx
test eax, eax
je 0x4336aa
xor esi, esi
inc esi
jmp 0x4336ac
xor esi, esi
push 0x4b8824
mov ecx, edi
call fcn.00403b59
mov eax, 0x4b8918
test esi, esi
jne 0x4336c6
mov eax, 0x4b891c
push eax
mov ecx, edi
call fcn.00403b59
push str._safemonSelfProtectAPI2.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a89
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401df2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004029d4
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x43371d
push 0
push dword [ebp - 0x10]
call fcn.00402402
pop ecx
pop ecx
test eax, eax
je 0x43371d
xor ebx, ebx
inc ebx
jmp 0x43371f
xor ebx, ebx
push str.SelfProtectAPI2.dll
mov ecx, edi
call fcn.00403b59
mov eax, 0x4b8918
test ebx, ebx
jne 0x433739
mov eax, 0x4b891c
push eax
mov ecx, edi
call fcn.00403b59
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004029d4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004029d4
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004029d4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x288]
xor ecx, ebp
call fcn.00474a8a
add ebp, 0x28c
leave
ret 4