Function at 0x4cf32b
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x354
mov eax, 0x5f4c7f
call fcn.0059bbd7
push 0x20
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x208
lea eax, [ebp - 0x298]
push esi
push 0
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [ebp - 0x35c], esi
lea eax, [ebp - 0x35c]
xor edi, edi
inc edi
mov dword [ebp - 0x360], edi
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x360]
push eax
push str.Path
lea eax, [ebp - 0x90]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4cf601
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x298]
push eax
call esi
test eax, eax
je 0x4cf601
push str.hipsver.dll
lea ecx, [ebp - 0x328]
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0040c622
pop ecx
push 2
pop ebx
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], bl
call fcn.0040b67e
push str.360leakfixer.exe
lea ecx, [ebp - 0x340]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c8]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 5
call fcn.0040b67e
push str._safemon360Cactus.tpi
lea ecx, [ebp - 0x328]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2b0]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 8
call fcn.0040b67e
push str._safemonFreeSaaS.tpi
lea ecx, [ebp - 0x340]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x310]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0xb
call fcn.0040b67e
push str._safemon_saasver.dll
lea ecx, [ebp - 0x358]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2f8]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x358]
call fcn.0040b67e
cmp dword [ebp - 0x2b4], 8
lea eax, [ebp - 0x2c8]
cmovae eax, dword [ebp - 0x2c8]
push eax
call esi
test eax, eax
jne 0x4cf51c
cmp dword [ebp - 0x2cc], 8
lea eax, [ebp - 0x2e0]
cmovae eax, dword [ebp - 0x2e0]
push eax
call esi
test eax, eax
je 0x4cf51c
cmp dword [ebp - 0x29c], 8
lea eax, [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x2b0]
push eax
call esi
test eax, eax
jne 0x4cf5c6
push 8
pop ebx
cmp dword [ebp - 0x2b4], ebx
lea eax, [ebp - 0x2c8]
cmovae eax, dword [ebp - 0x2c8]
push eax
call esi
test eax, eax
jne 0x4cf571
cmp dword [ebp - 0x2cc], ebx
lea eax, [ebp - 0x2e0]
cmovae eax, dword [ebp - 0x2e0]
push eax
call esi
test eax, eax
je 0x4cf571
cmp dword [ebp - 0x29c], ebx
lea eax, [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x2b0]
push eax
call esi
test eax, eax
jne 0x4cf571
push 3
jmp 0x4cf5c1
cmp dword [ebp - 0x2fc], ebx
lea eax, [ebp - 0x310]
cmovae eax, dword [ebp - 0x310]
push eax
call esi
test eax, eax
je 0x4cf5b6
cmp dword [ebp - 0x2e4], ebx
lea eax, [ebp - 0x2f8]
cmovae eax, dword [ebp - 0x2f8]
push eax
call esi
test eax, eax
je 0x4cf5b6
call fcn.004cf2ff
test eax, eax
je 0x4cf5b2
push 4
jmp 0x4cf5c1
push 5
jmp 0x4cf5c1
call fcn.004cf0a8
test eax, eax
je 0x4cf5c4
push 6
pop ebx
jmp 0x4cf5c6
mov ebx, edi
lea ecx, [ebp - 0x2f8]
call fcn.0040b67e
lea ecx, [ebp - 0x310]
call fcn.0040b67e
lea ecx, [ebp - 0x2b0]
call fcn.0040b67e
lea ecx, [ebp - 0x2c8]
call fcn.0040b67e
lea ecx, [ebp - 0x2e0]
call fcn.0040b67e
mov eax, ebx
jmp 0x4cf603
xor eax, eax
call fcn.0059bb81
ret