Function at 0x100571d0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x100f51d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
xor ebx, ebx
mov dword [ebp - 0x628], ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.10097030
add esp, 0xc
mov dword [ebp - 0x620], ebx
lea eax, [ebp - 0x620]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10057666
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x624], 1
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x62c], 0x208
push eax
lea eax, [ebp - 0x624]
push eax
push ebx
push str.Path
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cx, word [ebp - 0x414]
xor eax, eax
cmp ax, cx
je 0x10057296
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov cx, word [ebp - 0x414]
lea esi, [ebp - 0x414]
lea edx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100572a0
sub esi, edx
sar esi, 1
je 0x10057666
xor eax, eax
cmp ax, cx
je 0x10057666
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10097030
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10057654
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10097030
push str.360leakfixer.exe
lea eax, [ebp - 0x414]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
test eax, eax
js 0x10057479
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x10057479
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
push str.safemonpedrver.dll
lea eax, [ebp - 0x414]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
jns 0x100573a0
xor ebx, ebx
jmp 0x100573ab
lea eax, [ebp - 0x20c]
push eax
call esi
mov ebx, eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
push str.safemonFreeSaaS.tpi
lea eax, [ebp - 0x414]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
js 0x1005745c
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x1005745c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
push str.safemon_saasver.dll
lea eax, [ebp - 0x414]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
js 0x1005745c
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x1005745c
neg ebx
pop esi
sbb ebx, ebx
and ebx, 0x80
add ebx, 0x20
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
neg ebx
pop esi
sbb ebx, ebx
and ebx, 0x80
inc ebx
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
push str.hipsver.dll
lea eax, [ebp - 0x414]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
js 0x10057654
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x10057654
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
push str.safemon360Cactus.tpi
lea eax, [ebp - 0x414]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
js 0x1005764f
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x1005764f
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.10097030
xor eax, eax
add esp, 0xc
cmp ax, word [str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe]
je 0x100575c8
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x620]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100575c8
lea eax, [ebp - 0x628]
mov dword [ebp - 0x624], 1
push eax
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x628], 0x208
push eax
lea eax, [ebp - 0x624]
push eax
push 0
push str.Path
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp - 0x61c]
je 0x100575c8
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
push str.360SkinMgr.exe
lea eax, [ebp - 0x61c]
push eax
push 0x100e37fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
test eax, eax
jns 0x10057626
xor ebx, ebx
xor eax, eax
test eax, eax
pop esi
setne bl
lea ebx, [ebx*4 + 6]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call esi
xor ebx, ebx
test eax, eax
pop esi
setne bl
lea ebx, [ebx*4 + 6]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
mov ebx, 0x10
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10071699
mov esp, ebp
pop ebp
ret