Function at 0x42af90
Capabilities:
Check if file exists
Delete file
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x9c8
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0x9c0], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1b2]
push ecx
xor ebx, ebx
mov word [esp + 0x1b4], ax
call fcn.00462160
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x5c2]
push eax
mov word [esp + 0x5c4], dx
call fcn.00462160
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x7ca]
push edx
mov word [esp + 0x7cc], cx
call fcn.00462160
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push SysReAllocStringLen
mov dword [esp + 0x28], 0x208
mov dword [esp + 0x2c], 1
call edi
test eax, eax
jne 0x42b066
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
lea ecx, [esp + 0x1ac]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b222
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x3ba]
push edx
mov word [esp + 0x3bc], cx
call fcn.00462160
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.updatecfg.ini
lea eax, [esp + 0x1ac]
push eax
lea ecx, [esp + 0x3b8]
push ecx
call esi
push str.libleak.dat
lea edx, [esp + 0x1ac]
push edx
lea eax, [esp + 0x5c0]
push eax
call esi
push str.libleak_64.dat
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x7c8]
push edx
call esi
xor eax, eax
push 0xc6
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.00462160
add esp, 0xc
xor edx, edx
push 0xc6
push edx
lea eax, [esp + 0xea]
push eax
mov word [esp + 0xec], dx
call fcn.00462160
add esp, 0xc
mov dword [esp + 0x10], 0x64
call fcn.0045c5b0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x3b0]
push ecx
push edx
test eax, eax
lea eax, [esp + 0x20]
push eax
push 0x47abd0
push 0x47cad4
je 0x42b155
push str.libleak_64.dat
jmp 0x42b15a
push str.libleak.dat
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x1c]
push eax
push str.lastnotiver
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x28], 0xc8
mov dword [esp + 0x2c], 1
call edi
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42b1be
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x42b1be
mov ebx, 1
lea ecx, [esp + 0x18]
push ecx
call fcn.00461172
add esp, 4
cmp eax, 2
jl 0x42b222
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x5b8]
push edx
call esi
lea eax, [esp + 0x7c0]
push eax
call esi
push str.err_lib20
push str.action_s
push str.http:__update.360safe.com_safe_leakpop.html_
push 1
mov ecx, 0x490040
call fcn.0045dc00
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9c0]
xor ecx, esp
call fcn.00460259
add esp, 0x9c8
ret
mov ecx, dword [esp + 0x9cc]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00460259
add esp, 0x9c8
ret