Function at 0x470233
Capabilities:
Read .ini file

Disassembly:
push 0x3c
mov eax, 0x532c26
call fcn.004fc737
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4702b7
call fcn.0040ccef
test al, al
je 0x4702b7
mov esi, 0x104
push esi
push ebx
call fcn.004f1d8a
pop ecx
pop ecx
cmp eax, esi
jae 0x4702b7
push ebx
lea eax, [ebp - 0x38]
push eax
call fcn.00443f43
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
mov edi, dword [eax - 0xc]
push edi
lea esi, [ebp - 0x38]
call fcn.0041adfb
lea ecx, [edi + 1]
push ecx
push eax
call fcn.004facd1
mov eax, dword [ebp - 0x38]
mov dword [eax - 0xc], edi
mov eax, dword [ebp - 0x38]
mov byte [edi + eax], 0
mov esi, dword [ebp - 0x38]
pop ecx
pop ecx
mov eax, esi
mov ecx, str._:users_appdatalocalpackagesqihu360softwareco.limited.__tempstate____________________________________.totalsecurity
call fcn.00474867
test eax, eax
setne al
test al, al
jne 0x4702bf
lea eax, [esi - 0x10]
call fcn.00405521
xor al, al
call fcn.004fc7ba
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0041ac14
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.00472b89
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax - 0xc]
cmp ecx, 0x24
je 0x4702f8
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
jmp 0x4702b2
push 0x40
push eax
mov esi, eax
call fcn.004f97b1
pop ecx
pop ecx
cmp eax, 0x24
jne 0x470312
push eax
push esi
call fcn.0044ec48
pop ecx
pop ecx
push 7
pop ecx
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
rep stosd dword es:[edi], eax
push ebx
push 0xf
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
push 0x53a3d8
push str.type
push 0x54dd24
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x30]
push eax
call fcn.004fa60a
dec eax
pop ecx
je 0x470456
dec eax
je 0x470446
dec eax
je 0x470436
dec eax
je 0x47041f
dec eax
je 0x47040f
dec eax
je 0x470388
dec eax
jne 0x47050d
mov dword [ebp - 0x34], str._optimizeboot
mov dword [ebp - 0x3c], 0x628
jmp 0x470464
xor esi, esi
push esi
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x4703b3
push esi
push 0x3e8
push esi
push esi
push 0x15
mov edi, eax
call fcn.0043bf4b
add esp, 0x14
jmp 0x47050d
lea edi, [ebp - 0x40]
call fcn.00404523
lea ecx, [ebp - 0x34]
push str.safemonQHSafeTray.exe
push ecx
mov edi, eax
mov byte [ebp - 4], 2
call fcn.00405a46
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
call fcn.00405521
push dword [ebp - 0x34]
push 0x589d80
call fcn.00440b7b
test eax, eax
je 0x470407
mov esi, dword [ebp - 0x34]
push 5
push str._enable__protection
mov edi, str.open
call fcn.00449849
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
jmp 0x470505
mov dword [ebp - 0x34], str._shareboot
mov dword [ebp - 0x3c], 0x629
jmp 0x470464
push 0x1388
push dword [ebp + 0xc]
push 0x13
call fcn.00472a0b
add esp, 0xc
jmp 0x47050d
mov dword [ebp - 0x34], str._runupdate
mov dword [ebp - 0x3c], 0x627
jmp 0x470464
mov dword [ebp - 0x34], str._runexam
mov dword [ebp - 0x3c], 0x626
jmp 0x470464
mov dword [ebp - 0x34], str._runclean
mov dword [ebp - 0x3c], 0x636
lea edi, [ebp - 0x48]
call fcn.00404523
mov esi, 0x548e20
lea ecx, [ebp - 0x40]
push esi
push ecx
mov edi, eax
mov byte [ebp - 4], 5
call fcn.00405a46
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
call fcn.00405521
push dword [ebp - 0x40]
push 0x589d80
call fcn.00440b7b
test eax, eax
je 0x470502
push esi
call fcn.00410b35
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x4704b7
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push ebx
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
cmp edi, ebx
je 0x4704ee
cmp dword [ebp - 0x3c], ebx
je 0x4704ee
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push ebx
push 0x62b
push edi
call esi
test eax, eax
je 0x4704ee
push ebx
push ebx
push dword [ebp - 0x3c]
push edi
call esi
test eax, eax
jne 0x470502
mov esi, dword [ebp - 0x40]
push 5
push dword [ebp - 0x34]
mov edi, str.open
call fcn.00449849
pop ecx
pop ecx
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
call fcn.00405521
mov al, 1
jmp 0x4702b9