Function at 0x180063170
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5c8]
sub rsp, 0x6a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x590], rax
xor r13d, r13d
mov dword [rsp + 0x34], r13d
cmp dword [0x180132404], r13d
jne 0x18006355b
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x180]
call fcn.1800abaa0
mov r8d, 0x208
lea rdx, [rbp + 0x180]
mov rcx, qword [0x180131308]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
lea edi, [r13 + 1]
cmp eax, 0x206
ja 0x180063555
lea rdx, [0x1800fce34]
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
nop
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x18006359c
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x58], r13
mov r9d, edi
lea r8, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.180022180
lea r14, [r13 - 1]
test eax, eax
jne 0x180063487
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.1800abaa0
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Path
mov r15, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180063330
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, edi
ja 0x180063330
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1800632e6
test dil, al
jne 0x180063330
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], r13w
je 0x1800632ec
jmp 0x180063330
mov word [rsp + 0x70], r13w
lea rax, [rsp + 0x70]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1800632f4
test edi, edi
jne 0x1800633c6
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x18006332b
cmp dword [rdx + 0x10], 0
jge 0x180063394
cmp dword [rbx - 0xc], 0
jl 0x1800635a7
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
mov edi, 1
test r15, r15
je 0x180063343
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], r13d
lea rdx, [rbp + 0x180]
mov rcx, rbx
call fcn.1800bb554
lea rcx, [rbp + 0x180]
test eax, eax
jne 0x1800634bb
lea rdx, str.safemon360Cactus.tpi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x21
call fcn.180033710
lea rcx, [rbp + 0x180]
test rax, rax
je 0x180063491
call rax
jmp 0x180063497
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800633aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r15, qword [rsp + 0x48]
jmp 0x18006332b
mov r12d, dword [rbx - 0x10]
lea rsi, [rsp + 0x70]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x1800635b2
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1800633ff
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.180025470
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
cmp rsi, r12
ja 0x180063456
lea rdx, [rbx + rsi*2]
lea rsi, [rax + rax]
test rsi, rsi
je 0x180063471
test rdx, rdx
jne 0x18006342b
call fcn.1800aeaf8
mov dword [rax], 0x16
call fcn.1800aee10
jmp 0x180063471
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, rsi
jae 0x180063449
call fcn.1800aeaf8
mov dword [rax], 0x22
call fcn.1800aee10
jmp 0x180063471
mov r8, rsi
mov rcx, rbx
call fcn.1800ab630
jmp 0x180063471
lea rsi, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, rsi
lea r8, [rsp + 0x70]
mov rcx, rbx
call fcn.1800213f0
cmp edi, dword [rbx - 0xc]
jg 0x180063591
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], r13w
jmp 0x18006332b
mov r15, qword [rsp + 0x48]
jmp 0x180063330
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180063533
lea rcx, [rbp + 0x180]
call fcn.1800249d0
test eax, eax
je 0x180063533
mov dword [0x180132400], edi
jmp 0x180063533
lea rdx, str.360sd.exe
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x21
call fcn.180033710
lea rcx, [rbp + 0x180]
test rax, rax
je 0x1800634e2
call rax
jmp 0x1800634e8
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180063533
lea rdx, str...360SkinMgr.exe
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x21
call fcn.180033710
lea rcx, [rbp + 0x180]
test rax, rax
je 0x18006351a
call rax
jmp 0x180063520
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, eax
mov eax, dword [0x180132400]
test ecx, ecx
cmove eax, edi
mov dword [0x180132400], eax
mov eax, edi
and eax, 0xfffffffe
mov dword [rsp + 0x34], eax
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180063555
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [0x180132404], edi
mov eax, dword [0x180132400]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1800220a0
nop
mov ecx, 0x80004005
call fcn.1800220a0
nop
mov ecx, 0x80070057
call fcn.1800220a0
int3
mov ecx, 0x80070057
call fcn.1800220a0
int3