Function at 0x517b70
Capabilities:
Check for time delay via gettickcount
Check if file exists
Get common file path
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x52285b
push eax
mov eax, dword [0x58e910]
mov dword fs:[0], esp
sub esp, 0xa30
push esi
xor esi, esi
cmp eax, esi
je 0x517bb2
mov eax, dword [0x58e90c]
pop esi
mov ecx, dword [esp + 0xa30]
mov dword fs:[0], ecx
add esp, 0xa3c
ret
push ebx
push ebp
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x42a]
mov word [esp + 0x428], si
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [esp + 0x42c]
push 0x1a
push eax
push esi
mov dword [0x58e910], 1
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov word [esp + 0x18], si
push str.360seie8core
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x42c]
lea edx, [esp + 0x1c]
push ecx
push edx
stosw word es:[edi], ax
call ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x632]
mov word [esp + 0x630], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x630]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, esi
je 0x517d85
push 0xb
push str.360SeSS.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x517d85
cmp dword [0x585fa8], esi
je 0x517d85
cmp dword [0x585f94], esi
je 0x517d85
cmp dword [0x585fbc], esi
jne 0x517d85
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x804
jne 0x517d85
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x517d85
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push 0x20000
push esi
push str.SoftwareIEStub
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x517d76
mov ecx, 0x81
lea edi, [esp + 0x83a]
mov word [esp + 0x838], si
push 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x83c]
push 0x1a
push ecx
push esi
stosw word es:[edi], ax
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x838]
push str.360sedataguardconfig.ini
lea eax, [esp + 0x224]
push edx
push eax
call ebp
lea ecx, [esp + 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x517d6c
lea edx, [esp + 0x220]
push edx
push 1
push 0x5664f8
push str.switch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x517d76
mov dword [0x58e90c], 1
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x517d85
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [0x58e90c], esi
je 0x517dce
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0xa4c], esi
call fcn.00518920
cmp eax, esi
mov dword [0x58e90c], eax
jne 0x517dce
push esi
push esi
push esi
call fcn.00517b30
push eax
mov ecx, 0x58e4e8
call fcn.00517510
call edi
mov ecx, dword [esp + 0xa40]
mov eax, dword [0x58e90c]
pop edi
pop ebp
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0xa3c
ret