Function at 0x4c73f3
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x354
mov eax, 0x5ebd9a
call fcn.00593b07
push 0x20
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x208
lea eax, [ebp - 0x298]
push esi
push 0
push eax
call fcn.005aa3d0
add esp, 0xc
mov dword [ebp - 0x35c], esi
lea eax, [ebp - 0x35c]
xor edi, edi
inc edi
mov dword [ebp - 0x360], edi
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x360]
push eax
push str.Path
lea eax, [ebp - 0x90]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c76c9
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x298]
push eax
call esi
test eax, eax
je 0x4c76c9
push str.hipsver.dll
lea ecx, [ebp - 0x328]
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0040c622
pop ecx
push 2
pop ebx
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], bl
call fcn.0040b67e
push str.360leakfixer.exe
lea ecx, [ebp - 0x340]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c8]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 5
call fcn.0040b67e
push str._safemon360Cactus.tpi
lea ecx, [ebp - 0x328]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2b0]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 8
call fcn.0040b67e
push str._safemonFreeSaaS.tpi
lea ecx, [ebp - 0x340]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x310]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0xb
call fcn.0040b67e
push str._safemon_saasver.dll
lea ecx, [ebp - 0x358]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x298]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2f8]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x358]
call fcn.0040b67e
cmp dword [ebp - 0x2b4], 8
lea eax, [ebp - 0x2c8]
cmovae eax, dword [ebp - 0x2c8]
push eax
call esi
test eax, eax
jne 0x4c75e4
cmp dword [ebp - 0x2cc], 8
lea eax, [ebp - 0x2e0]
cmovae eax, dword [ebp - 0x2e0]
push eax
call esi
test eax, eax
je 0x4c75e4
cmp dword [ebp - 0x29c], 8
lea eax, [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x2b0]
push eax
call esi
test eax, eax
jne 0x4c768e
push 8
pop ebx
cmp dword [ebp - 0x2b4], ebx
lea eax, [ebp - 0x2c8]
cmovae eax, dword [ebp - 0x2c8]
push eax
call esi
test eax, eax
jne 0x4c7639
cmp dword [ebp - 0x2cc], ebx
lea eax, [ebp - 0x2e0]
cmovae eax, dword [ebp - 0x2e0]
push eax
call esi
test eax, eax
je 0x4c7639
cmp dword [ebp - 0x29c], ebx
lea eax, [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x2b0]
push eax
call esi
test eax, eax
jne 0x4c7639
push 3
jmp 0x4c7689
cmp dword [ebp - 0x2fc], ebx
lea eax, [ebp - 0x310]
cmovae eax, dword [ebp - 0x310]
push eax
call esi
test eax, eax
je 0x4c767e
cmp dword [ebp - 0x2e4], ebx
lea eax, [ebp - 0x2f8]
cmovae eax, dword [ebp - 0x2f8]
push eax
call esi
test eax, eax
je 0x4c767e
call fcn.004c73c7
test eax, eax
je 0x4c767a
push 4
jmp 0x4c7689
push 5
jmp 0x4c7689
call fcn.004c7170
test eax, eax
je 0x4c768c
push 6
pop ebx
jmp 0x4c768e
mov ebx, edi
lea ecx, [ebp - 0x2f8]
call fcn.0040b67e
lea ecx, [ebp - 0x310]
call fcn.0040b67e
lea ecx, [ebp - 0x2b0]
call fcn.0040b67e
lea ecx, [ebp - 0x2c8]
call fcn.0040b67e
lea ecx, [ebp - 0x2e0]
call fcn.0040b67e
mov eax, ebx
jmp 0x4c76cb
xor eax, eax
call fcn.00593ab1
ret