Function at 0x1800655a8
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rcx
xor r13d, r13d
cmp dword [rcx + 0x28], r13d
je 0x180065610
cmp qword [rcx + 8], r13
je 0x180065608
cmp qword [rcx + 0x10], r13
lea r14d, [r13 + 1]
jne 0x180065ab3
mov r14d, r13d
jmp 0x180065ab3
lea rbx, [rcx + 0x48]
mov rcx, r13
mov qword [rsp + 0x48], rcx
test rbx, rbx
je 0x180065632
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
mov qword [rsp + 0x48], rbx
cmp dword [rsi + 0x28], r13d
je 0x180065652
cmp qword [rsi + 8], r13
je 0x18006564a
cmp qword [rsi + 0x10], r13
mov r14d, 1
jne 0x18006564d
mov r14d, r13d
jmp 0x180065aa8
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x180065ae6
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r15d, r13d
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str...360base64.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.deepscan360base64.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov r12d, r13d
mov r14d, 1
test rax, rax
cmovne r12d, r14d
lea ebx, [r14 + 0x20]
mov ecx, ebx
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x1800656e9
call rax
jmp 0x1800656ef
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
test eax, eax
je 0x180065711
mov r15d, r14d
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x180065702
jmp 0x180065803
lea rdx, str.....360base64.dll
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, ebx
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x180065733
call rax
jmp 0x180065739
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [rsp + 0x60]
test eax, eax
je 0x180065769
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x180065745
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180005498
mov r15d, r12d
jmp 0x180065815
mov r8d, 0x208
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x3c], r14d
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
lea r8, str.path
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [rsp + 0x60], r13w
je 0x180065815
lea rdx, str.360base64.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x180065815
mov ecx, ebx
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x1800657e7
call rax
jmp 0x1800657ed
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180065815
lea rcx, [rsp + 0x60]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1800657f9
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180005498
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], r13d
je 0x180065888
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x70]
call fcn.18000525c
lea r9, str.360base64.dll
mov r8d, r15d
mov rdx, qword [rsi + 0x70]
mov rcx, rsi
call fcn.180065af4
test eax, eax
je 0x180065855
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x180065884
lea rdx, [0x18008c528]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, [0x180090110]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
or rdi, 0xffffffffffffffff
mov r15d, r13d
lea rcx, [rsp + 0x30]
call fcn.1800055b8
mov word [rsp + 0x60], r13w
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str...360conf64.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ebx, 0x21
mov ecx, ebx
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x1800658dc
call rax
jmp 0x1800658e2
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [rsp + 0x60]
test eax, eax
je 0x180065900
mov r15d, r14d
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1800658f1
jmp 0x1800659f3
lea rdx, str.....360conf64.dll
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, ebx
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x180065922
call rax
jmp 0x180065928
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [rsp + 0x60]
test eax, eax
je 0x180065958
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x180065934
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180005498
mov r15d, r12d
jmp 0x180065a05
mov eax, 0x208
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], r14d
mov r8d, eax
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, str.path
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [rsp + 0x60], r13w
je 0x180065a05
lea rdx, str.360conf64.dll
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x180065a05
mov ecx, ebx
call fcn.18000a354
lea rcx, [rsp + 0x60]
test rax, rax
je 0x1800659d7
call rax
jmp 0x1800659dd
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180065a05
lea rcx, [rsp + 0x60]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1800659e9
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180005498
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], r13d
je 0x180065a74
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x78]
call fcn.18000525c
lea r9, str.360conf64.dll
mov r8d, r15d
mov rdx, qword [rsi + 0x78]
mov rcx, rsi
call fcn.180065af4
test eax, eax
je 0x180065a45
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x180065a74
lea rdx, [0x18008c528]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, [0x180090110]
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
mov dword [rsi + 0x28], r14d
cmp qword [rsi + 8], r13
je 0x180065a84
cmp qword [rsi + 0x10], r13
jne 0x180065a87
mov r14d, r13d
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180065aa3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180065ab3
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r14d
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.18000a540
int3