Function at 0x4c592b
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x354
mov eax, 0x5e9f64
call fcn.00592017
push 0x20
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x208
lea eax, [ebp - 0x298]
push esi
push 0
push eax
call fcn.005a88e0
add esp, 0xc
mov dword [ebp - 0x35c], esi
lea eax, [ebp - 0x35c]
xor edi, edi
inc edi
mov dword [ebp - 0x360], edi
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x360]
push eax
push str.Path
lea eax, [ebp - 0x90]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c5c01
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x298]
push eax
call esi
test eax, eax
je 0x4c5c01
push str.hipsver.dll
lea ecx, [ebp - 0x328]
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0040c61f
pop ecx
push 2
pop ebx
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], bl
call fcn.0040b67b
push str.360leakfixer.exe
lea ecx, [ebp - 0x340]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c8]
call fcn.0040c61f
pop ecx
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 5
call fcn.0040b67b
push str._safemon360Cactus.tpi
lea ecx, [ebp - 0x328]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2b0]
call fcn.0040c61f
pop ecx
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 8
call fcn.0040b67b
push str._safemonFreeSaaS.tpi
lea ecx, [ebp - 0x340]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x310]
call fcn.0040c61f
pop ecx
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0xb
call fcn.0040b67b
push str._safemon_saasver.dll
lea ecx, [ebp - 0x358]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2f8]
call fcn.0040c61f
pop ecx
lea ecx, [ebp - 0x358]
call fcn.0040b67b
cmp dword [ebp - 0x2b4], 8
lea eax, [ebp - 0x2c8]
cmovae eax, dword [ebp - 0x2c8]
push eax
call esi
test eax, eax
jne 0x4c5b1c
cmp dword [ebp - 0x2cc], 8
lea eax, [ebp - 0x2e0]
cmovae eax, dword [ebp - 0x2e0]
push eax
call esi
test eax, eax
je 0x4c5b1c
cmp dword [ebp - 0x29c], 8
lea eax, [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x2b0]
push eax
call esi
test eax, eax
jne 0x4c5bc6
push 8
pop ebx
cmp dword [ebp - 0x2b4], ebx
lea eax, [ebp - 0x2c8]
cmovae eax, dword [ebp - 0x2c8]
push eax
call esi
test eax, eax
jne 0x4c5b71
cmp dword [ebp - 0x2cc], ebx
lea eax, [ebp - 0x2e0]
cmovae eax, dword [ebp - 0x2e0]
push eax
call esi
test eax, eax
je 0x4c5b71
cmp dword [ebp - 0x29c], ebx
lea eax, [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x2b0]
push eax
call esi
test eax, eax
jne 0x4c5b71
push 3
jmp 0x4c5bc1
cmp dword [ebp - 0x2fc], ebx
lea eax, [ebp - 0x310]
cmovae eax, dword [ebp - 0x310]
push eax
call esi
test eax, eax
je 0x4c5bb6
cmp dword [ebp - 0x2e4], ebx
lea eax, [ebp - 0x2f8]
cmovae eax, dword [ebp - 0x2f8]
push eax
call esi
test eax, eax
je 0x4c5bb6
call fcn.004c58ff
test eax, eax
je 0x4c5bb2
push 4
jmp 0x4c5bc1
push 5
jmp 0x4c5bc1
call fcn.004c56a8
test eax, eax
je 0x4c5bc4
push 6
pop ebx
jmp 0x4c5bc6
mov ebx, edi
lea ecx, [ebp - 0x2f8]
call fcn.0040b67b
lea ecx, [ebp - 0x310]
call fcn.0040b67b
lea ecx, [ebp - 0x2b0]
call fcn.0040b67b
lea ecx, [ebp - 0x2c8]
call fcn.0040b67b
lea ecx, [ebp - 0x2e0]
call fcn.0040b67b
mov eax, ebx
jmp 0x4c5c03
xor eax, eax
call fcn.00591fc1
ret