Function at 0x10057950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x100f51d4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [0x100f8d04]
mov ecx, edi
call fcn.100571d0
test eax, eax
jne 0x10057e47
push ebx
push esi
push 0x208
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.10097030
add esp, 0xc
lea eax, [ebp - 0xa2c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10097030
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
add esp, 0xc
cmp ax, word [str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360ExtHost.exe]
je 0x10057b16
mov dword [ebp - 0xa30], eax
lea eax, [ebp - 0xa30]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360ExtHost.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10057b16
lea eax, [ebp - 0xa34]
mov dword [ebp - 0xa38], 1
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xa34], 0x208
push eax
lea eax, [ebp - 0xa38]
push eax
push 0
push str.Path
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dx, word [ebp - 0x414]
xor eax, eax
cmp ax, dx
je 0x10057a62
lea eax, [ebp - 0x414]
push eax
call ebx
mov dx, word [ebp - 0x414]
lea ecx, [ebp - 0x414]
lea esi, [ecx + 2]
jmp 0x10057a70
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10057a70
sub ecx, esi
sar ecx, 1
je 0x10057b10
xor eax, eax
cmp ax, dx
je 0x10057b10
push ecx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10057b10
push 0x208
push eax
lea esi, [eax + 0x40]
lea eax, [ebp - 0x20c]
push eax
call fcn.10097030
push str.safemonwin7shield.dll
lea eax, [ebp - 0x414]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
js 0x10057afd
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10057afd
mov esi, 0x140
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.10097030
xor eax, eax
add esp, 0xc
cmp ax, word [str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360EDRSensor.exe]
je 0x10057c47
mov dword [ebp - 0xa30], eax
lea eax, [ebp - 0xa30]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360EDRSensor.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10057c47
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa34], 1
push eax
lea eax, [ebp - 0x824]
mov dword [ebp - 0xa38], 0x208
push eax
lea eax, [ebp - 0xa34]
push eax
push 0
push str.Path
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dx, word [ebp - 0x824]
xor eax, eax
cmp ax, dx
je 0x10057bf2
lea eax, [ebp - 0x824]
push eax
call ebx
mov dx, word [ebp - 0x824]
lea ecx, [ebp - 0x824]
lea esi, [ecx + 2]
jmp 0x10057c00
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10057c00
sub ecx, esi
sar ecx, 1
je 0x10057c47
xor eax, eax
cmp ax, dx
je 0x10057c47
push ecx
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10057c47
pop esi
pop ebx
mov eax, 0x240
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
call fcn.10057e60
test eax, eax
je 0x10057cba
mov eax, dword [0x100f6004]
mov esi, 0x100e185c
cmp eax, 4
jae 0x10057c6a
mov esi, dword [eax*4 + 0x100e7680]
test esi, esi
je 0x10057cba
push str.MMScan
push esi
call fcn.100a62ba
add esp, 8
test eax, eax
jne 0x10057c92
pop esi
pop ebx
mov eax, 0x400
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
push str.360asset
push esi
call fcn.100a62ba
add esp, 8
test eax, eax
jne 0x10057cba
pop esi
pop ebx
mov eax, 0x800
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.10097030
xor eax, eax
add esp, 0xc
cmp ax, word [str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe]
je 0x10057e43
mov dword [ebp - 0xa30], eax
lea eax, [ebp - 0xa30]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10057e43
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa34], 1
push eax
lea eax, [ebp - 0x61c]
mov dword [ebp - 0xa38], 0x208
push eax
lea eax, [ebp - 0xa34]
push eax
push 0
push str.Path
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cx, word [ebp - 0x61c]
xor eax, eax
cmp ax, cx
je 0x10057d71
lea eax, [ebp - 0x61c]
push eax
call ebx
mov cx, word [ebp - 0x61c]
lea esi, [ebp - 0x61c]
lea edx, [esi + 2]
lea ebx, [ebx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10057d80
sub esi, edx
sar esi, 1
je 0x10057e43
xor eax, eax
cmp ax, cx
je 0x10057e43
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10097030
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10057e43
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10097030
push str.360SkinMgr.exe
lea eax, [ebp - 0x61c]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
js 0x10057e43
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10057e43
pop esi
pop ebx
mov eax, 0x1000
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10071699
mov esp, ebp
pop ebp
ret