Function at 0x469399
Capabilities:
Read .ini file

Disassembly:
push 0x3c
mov eax, 0x52750f
call fcn.004f21c7
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x46941d
call int.0040a4e1
test al, al
je 0x46941d
mov esi, 0x104
push esi
push ebx
call fcn.004e785a
pop ecx
pop ecx
cmp eax, esi
jae 0x46941d
push ebx
lea eax, [ebp - 0x38]
push eax
call fcn.0043ee1d
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
mov edi, dword [eax - 0xc]
push edi
lea esi, [ebp - 0x38]
call fcn.0041722d
lea ecx, [edi + 1]
push ecx
push eax
call fcn.004f0761
mov eax, dword [ebp - 0x38]
mov dword [eax - 0xc], edi
mov eax, dword [ebp - 0x38]
mov byte [edi + eax], 0
mov esi, dword [ebp - 0x38]
pop ecx
pop ecx
mov eax, esi
mov ecx, str._:users_appdatalocalpackagesqihu360softwareco.limited.__tempstate____________________________________.totalsecurity
call fcn.0046d797
test eax, eax
setne al
test al, al
jne 0x469425
lea eax, [esi - 0x10]
call fcn.0040557a
xor al, al
call fcn.004f224a
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00417046
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.0046bca4
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax - 0xc]
cmp ecx, 0x24
je 0x46945e
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
jmp 0x469418
push 0x40
push eax
mov esi, eax
call fcn.004ef281
pop ecx
pop ecx
cmp eax, 0x24
jne 0x469478
push eax
push esi
call fcn.00447a38
pop ecx
pop ecx
push 7
pop ecx
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
rep stosd dword es:[edi], eax
push ebx
push 0xf
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
push 0x52f388
push str.type
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x30]
push eax
call fcn.004f00da
dec eax
pop ecx
je 0x4695bc
dec eax
je 0x4695ac
dec eax
je 0x46959c
dec eax
je 0x469585
dec eax
je 0x469575
dec eax
je 0x4694ee
dec eax
jne 0x469673
mov dword [ebp - 0x34], str._optimizeboot
mov dword [ebp - 0x3c], 0x628
jmp 0x4695ca
xor esi, esi
push esi
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x469519
push esi
push 0x3e8
push esi
push esi
push 0x15
mov edi, eax
call fcn.00436944
add esp, 0x14
jmp 0x469673
lea edi, [ebp - 0x40]
call fcn.0040457c
lea ecx, [ebp - 0x34]
push str.safemonQHSafeTray.exe
push ecx
mov edi, eax
mov byte [ebp - 4], 2
call fcn.0040603b
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
call fcn.0040557a
push dword [ebp - 0x34]
push 0x57bd00
call fcn.0043b95e
test eax, eax
je 0x46956d
mov esi, dword [ebp - 0x34]
push 5
push str._enable__protection
mov edi, str.open
call fcn.00442bab
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
jmp 0x46966b
mov dword [ebp - 0x34], str._shareboot
mov dword [ebp - 0x3c], 0x629
jmp 0x4695ca
push 0x1388
push dword [ebp + 0xc]
push 0x13
call fcn.0046bb26
add esp, 0xc
jmp 0x469673
mov dword [ebp - 0x34], str._runupdate
mov dword [ebp - 0x3c], 0x627
jmp 0x4695ca
mov dword [ebp - 0x34], str._runexam
mov dword [ebp - 0x3c], 0x626
jmp 0x4695ca
mov dword [ebp - 0x34], str._runclean
mov dword [ebp - 0x3c], 0x636
lea edi, [ebp - 0x48]
call fcn.0040457c
mov esi, 0x53d4c0
lea ecx, [ebp - 0x40]
push esi
push ecx
mov edi, eax
mov byte [ebp - 4], 5
call fcn.0040603b
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
call fcn.0040557a
push dword [ebp - 0x40]
push 0x57bd00
call fcn.0043b95e
test eax, eax
je 0x469668
push esi
call fcn.0040e350
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x46961d
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push ebx
push str.Q360InternationSafeClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
cmp edi, ebx
je 0x469654
cmp dword [ebp - 0x3c], ebx
je 0x469654
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push ebx
push 0x62b
push edi
call esi
test eax, eax
je 0x469654
push ebx
push ebx
push dword [ebp - 0x3c]
push edi
call esi
test eax, eax
jne 0x469668
mov esi, dword [ebp - 0x40]
push 5
push dword [ebp - 0x34]
mov edi, str.open
call fcn.00442bab
pop ecx
pop ecx
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
call fcn.0040557a
mov al, 1
jmp 0x46941f