Function at 0x180062870
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5c8]
sub rsp, 0x6a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x590], rax
xor r13d, r13d
mov dword [rsp + 0x34], r13d
cmp dword [0x18013240c], r13d
jne 0x180062be0
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x180]
call fcn.1800abaa0
mov r8d, 0x208
lea rdx, [rbp + 0x180]
mov rcx, qword [0x180131308]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
lea edi, [r13 + 1]
cmp eax, 0x206
ja 0x180062bda
lea rdx, [0x1800fce34]
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
nop
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x180062c21
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x58], r13
mov r9d, edi
lea r8, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionApp_Paths360ExtHost.exe
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.180022180
lea r14, [r13 - 1]
test eax, eax
jne 0x180062b87
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.1800abaa0
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Path
mov r15, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180062a30
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, edi
ja 0x180062a30
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1800629e6
test dil, al
jne 0x180062a30
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], r13w
je 0x1800629ec
jmp 0x180062a30
mov word [rsp + 0x70], r13w
lea rax, [rsp + 0x70]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1800629f4
test edi, edi
jne 0x180062ac6
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x180062a2b
cmp dword [rdx + 0x10], 0
jge 0x180062a94
cmp dword [rbx - 0xc], 0
jl 0x180062c2c
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
mov edi, 1
test r15, r15
je 0x180062a43
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], r13d
lea rdx, [rbp + 0x180]
mov rcx, rbx
call fcn.1800bb554
test eax, eax
jne 0x180062bb8
lea rdx, str.safemon360ExtHost.exe
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x21
call fcn.180033710
lea rcx, [rbp + 0x180]
test rax, rax
je 0x180062b91
call rax
jmp 0x180062b97
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180062aaa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r15, qword [rsp + 0x48]
jmp 0x180062a2b
mov r12d, dword [rbx - 0x10]
lea rsi, [rsp + 0x70]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x180062c37
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180062aff
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.180025470
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
cmp rsi, r12
ja 0x180062b56
lea rdx, [rbx + rsi*2]
lea rsi, [rax + rax]
test rsi, rsi
je 0x180062b71
test rdx, rdx
jne 0x180062b2b
call fcn.1800aeaf8
mov dword [rax], 0x16
call fcn.1800aee10
jmp 0x180062b71
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, rsi
jae 0x180062b49
call fcn.1800aeaf8
mov dword [rax], 0x22
call fcn.1800aee10
jmp 0x180062b71
mov r8, rsi
mov rcx, rbx
call fcn.1800ab630
jmp 0x180062b71
lea rsi, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, rsi
lea r8, [rsp + 0x70]
mov rcx, rbx
call fcn.1800213f0
cmp edi, dword [rbx - 0xc]
jg 0x180062c16
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], r13w
jmp 0x180062a2b
mov r15, qword [rsp + 0x48]
jmp 0x180062a30
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180062bb8
lea rcx, [rbp + 0x180]
call fcn.1800249d0
mov ecx, dword [0x180132408]
test eax, eax
cmovne ecx, edi
mov dword [0x180132408], ecx
mov eax, edi
and eax, 0xfffffffe
mov dword [rsp + 0x34], eax
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180062bda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [0x18013240c], edi
mov eax, dword [0x180132408]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80070057
call fcn.1800220a0
int3
mov ecx, 0x80070057
call fcn.1800220a0
int3