Function at 0x575b20
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x260
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, 0x208
lea edi, [ebp - 0x218]
push esi
push 0
push edi
call fcn.005191b0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 1
lea ecx, [ebp - 0x220]
mov dword [ecx], esi
push ecx
push edi
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor esi, esi
test eax, eax
jne 0x575b8a
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x575ba1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, esi
add esp, 0x260
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x238]
mov ecx, esi
push str.hipsver.dll
call fcn.005477d0
xor ebx, ebx
mov ecx, esi
push edi
push ebx
call fcn.005628f0
mov ecx, dword [eax + 8]
mov dword [ebp - 0x224], ecx
movsd xmm0, qword [eax]
movsd qword [ebp - 0x22c], xmm0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], ebx
cmp byte [esi + 0xb], 0
jns 0x575bef
push dword [ebp - 0x238]
call fcn.0050fc7c
add esp, 4
lea esi, [ebp - 0x244]
mov ecx, esi
push str.360leakfixer.exe
call fcn.005477d0
mov ecx, esi
push edi
push ebx
call fcn.005628f0
mov ecx, dword [eax + 8]
mov dword [ebp - 0x230], ecx
movsd xmm0, qword [eax]
movsd qword [ebp - 0x238], xmm0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], ebx
mov dword [ebp - 0x26c], esi
cmp byte [esi + 0xb], 0
jns 0x575c41
push dword [ebp - 0x244]
call fcn.0050fc7c
add esp, 4
lea esi, [ebp - 0x250]
mov ecx, esi
push str._safemon360Cactus.tpi
call fcn.005477d0
xor ebx, ebx
mov ecx, esi
push edi
push ebx
call fcn.005628f0
mov ecx, dword [eax + 8]
mov dword [ebp - 0x23c], ecx
movsd xmm0, qword [eax]
movsd qword [ebp - 0x244], xmm0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], ebx
cmp byte [esi + 0xb], 0
jns 0x575c8f
push dword [ebp - 0x250]
call fcn.0050fc7c
add esp, 4
lea esi, [ebp - 0x25c]
mov ecx, esi
push str._safemonFreeSaaS.tpi
call fcn.005477d0
mov ecx, esi
push edi
push ebx
call fcn.005628f0
mov ecx, dword [eax + 8]
mov dword [ebp - 0x248], ecx
movsd xmm0, qword [eax]
movsd qword [ebp - 0x250], xmm0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], ebx
cmp byte [esi + 0xb], 0
jns 0x575cdb
push dword [ebp - 0x25c]
call fcn.0050fc7c
add esp, 4
lea ebx, [ebp - 0x268]
mov ecx, ebx
push str._safemon_saasver.dll
call fcn.005477d0
xor esi, esi
mov ecx, ebx
push edi
push esi
call fcn.005628f0
mov ecx, dword [eax + 8]
mov dword [ebp - 0x254], ecx
movsd xmm0, qword [eax]
movsd qword [ebp - 0x25c], xmm0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax], esi
cmp byte [ebx + 0xb], 0
jns 0x575d29
push dword [ebp - 0x268]
call fcn.0050fc7c
add esp, 4
cmp byte [ebp - 0x22d], 0
lea eax, [ebp - 0x238]
jns 0x575d3e
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea esi, [ebp - 0x250]
je 0x575e39
cmp byte [ebp - 0x22d], 0
jns 0x575d64
mov eax, dword [ebp - 0x238]
jmp 0x575d6a
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x575e4a
cmp byte [ebp - 0x245], 0
jns 0x575d88
mov esi, dword [ebp - 0x250]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x575db8
cmp byte [ebp - 0x251], 0
lea eax, [ebp - 0x25c]
jns 0x575da8
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 3
test eax, eax
jne 0x575dbd
mov esi, 4
cmp byte [ebp - 0x251], 0
jns 0x575dd4
push dword [ebp - 0x25c]
call fcn.0050fc7c
add esp, 4
cmp byte [ebp - 0x245], 0
jns 0x575deb
push dword [ebp - 0x250]
call fcn.0050fc7c
add esp, 4
cmp byte [ebp - 0x239], 0
jns 0x575e02
push dword [ebp - 0x244]
call fcn.0050fc7c
add esp, 4
cmp byte [ebp - 0x22d], 0
jns 0x575e19
push dword [ebp - 0x238]
call fcn.0050fc7c
add esp, 4
cmp byte [ebp - 0x221], 0
jns 0x575b8a
push dword [ebp - 0x22c]
call fcn.0050fc7c
add esp, 4
jmp 0x575b8a
cmp byte [ebp - 0x221], 0
jns 0x575e5b
mov eax, dword [ebp - 0x22c]
jmp 0x575e61
cmp byte [ebp - 0x221], 0
jns 0x575e81
mov eax, dword [ebp - 0x22c]
jmp 0x575e87
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x575d53
cmp byte [ebp - 0x239], 0
jns 0x575ec9
mov eax, dword [ebp - 0x244]
jmp 0x575ecf
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x575d79
cmp byte [ebp - 0x239], 0
jns 0x575eab
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x26c], eax
push dword [ebp - 0x26c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x575d79
mov esi, 2
jmp 0x575dbd
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x575d53
xor esi, esi
inc esi
jmp 0x575dbd