Function at 0x433170
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x463976
push eax
mov eax, dword [0x47b7a4]
mov dword fs:[0], esp
sub esp, 0xa38
mov ecx, 0x47a9a8
push ebx
push ebp
push esi
push edi
push eax
call fcn.0040dbe0
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.360.dat
lea ecx, [esp + 0x844]
push 0x47afc0
push ecx
call ebp
push str.360U.dat
lea edx, [esp + 0x24]
push 0x47afc0
push edx
call ebp
call fcn.00404010
test eax, eax
je 0x4331dd
mov eax, 4
jmp 0x433595
lea eax, [esp + 0x10]
push eax
call fcn.00408910
mov eax, dword [eax]
add esp, 4
push eax
push 1
push str.InitSuc
push str.protect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00408010
test esi, esi
jne 0x433218
mov eax, 1
jmp 0x433595
mov eax, dword [0x47b858]
test eax, eax
jne 0x433297
mov cx, word [0x47a15c]
xor eax, eax
mov word [esp + 0x430], cx
mov ecx, 0x81
lea edi, [esp + 0x432]
push str.safeboxapi.dll
rep stosd dword es:[edi], eax
lea edx, [esp + 0x434]
push 0x47abb0
push edx
stosw word es:[edi], ax
call ebp
lea eax, [esp + 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x433297
push str.APICreateObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433297
push 0x47b858
push 4
call eax
add esp, 8
test eax, eax
je 0x433297
mov ecx, dword [0x47b858]
push 0x47b85c
mov edx, dword [ecx]
call dword [edx]
mov eax, dword [0x46f42c]
mov dword [esp + 0x10], eax
push 0
lea ecx, [esp + 0x14]
push 0x46f644
push ecx
mov dword [esp + 0xa5c], 0
call fcn.004076f0
lea edx, [esp + 0x20]
push edx
call fcn.00408910
mov eax, dword [eax]
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Protect360
push str.protect
call ebx
lea ecx, [esp + 0x14]
call fcn.00408010
lea ecx, [esp + 0x10]
mov dword [esp + 0xa50], 0xffffffff
call fcn.00408010
mov eax, dword [0x47b858]
xor edx, edx
cmp eax, edx
je 0x433590
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22a]
mov word [esp + 0x228], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x63a]
mov word [esp + 0x638], dx
rep stosd dword es:[edi], eax
push str.360safe.exe
lea ecx, [esp + 0x22c]
push 0x47adb8
push ecx
stosw word es:[edi], ax
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x228]
push edx
call esi
test eax, eax
jne 0x433375
mov eax, 6
jmp 0x433595
mov eax, dword [esp + 0xa58]
test eax, eax
je 0x433508
push str.safemon360realpro.exe
lea eax, [esp + 0x63c]
push 0x47adb8
push eax
call ebp
lea ecx, [esp + 0x638]
push ecx
call esi
test eax, eax
jne 0x4334fe
lea edx, [esp + 0x228]
push edx
call fcn.00405c40
add esp, 4
test eax, eax
je 0x4334fe
lea eax, [esp + 0x840]
push eax
call esi
test eax, eax
jne 0x4333da
mov eax, 2
jmp 0x433595
lea ecx, [esp + 0x20]
lea edx, [esp + 0x840]
push ecx
push edx
call fcn.00405910
add esp, 8
test eax, eax
je 0x43352c
mov ecx, dword [0x47b858]
lea edx, [esp + 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 0x40]
test eax, eax
je 0x433589
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Q360SafeMainClass
call fcn.00407200
call fcn.00432d40
add esp, 8
test eax, eax
je 0x433589
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Q360SafeMonClass
call fcn.00407200
call fcn.00432d40
add esp, 8
test eax, eax
je 0x433589
mov eax, dword [0x46f42c]
mov dword [esp + 0x18], eax
push 1
lea ecx, [esp + 0x1c]
push 0x46f644
push ecx
mov dword [esp + 0xa5c], 1
call fcn.004076f0
lea edx, [esp + 0x28]
push edx
call fcn.00408910
mov eax, dword [eax]
mov ecx, dword [esp + 0x28]
add esp, 0x10
push eax
push ecx
push str.Protect360
push str.protect
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x46f430]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4334cc
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4334cc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4334f7
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4334f7
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
xor eax, eax
jmp 0x433595
mov eax, 7
jmp 0x433595
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x433533
lea ecx, [esp + 0x20]
lea edx, [esp + 0x840]
push ecx
push edx
call fcn.00405910
add esp, 8
test eax, eax
jne 0x433533
mov eax, 3
jmp 0x433595
mov ecx, dword [0x47b858]
lea edx, [esp + 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 0x3c]
test eax, eax
je 0x433589
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Q360SafeMainClass
call fcn.00407200
call fcn.00432d40
add esp, 8
test eax, eax
je 0x433589
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Q360SafeMonClass
call fcn.00407200
call fcn.00432d40
add esp, 8
test eax, eax
je 0x433589
xor eax, eax
jmp 0x433595
mov eax, 5
jmp 0x433595
mov eax, 9
mov ecx, dword [esp + 0xa48]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xa44
ret