Function at 0x4aef40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], 0
je 0x4aef65
call fcn.004b1f20
movzx eax, al
test eax, eax
jne 0x4aef6c
xor al, al
jmp 0x4af2fb
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040f510
push 0x50d4a8
lea ecx, [ebp - 0x14]
call fcn.004b0170
push 0x50d4a8
lea ecx, [ebp - 0x14]
call fcn.004b00c0
lea ecx, [ebp - 0x14]
call fcn.0047ef80
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x104
jb 0x4aefba
mov byte [ebp - 0x55], 0
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov al, byte [ebp - 0x55]
jmp 0x4af2fb
lea ecx, [ebp - 0x14]
call fcn.0044ea20
push eax
lea ecx, [ebp - 0xdc]
call fcn.00434150
mov ecx, eax
call fcn.0044ea20
push eax
lea ecx, [ebp - 8]
call fcn.0047ec80
lea ecx, [ebp - 0xdc]
call fcn.00434180
lea ecx, [ebp - 8]
call fcn.004b0070
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
push str._:users_appdatalocalpackagesqihu360softwareco.limited.__tempstate____________________________________.360safeuap
call fcn.004b0280
add esp, 8
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x19], al
movzx edx, byte [ebp - 0x19]
test edx, edx
jne 0x4af03a
mov byte [ebp - 0xdd], 0
lea ecx, [ebp - 8]
call fcn.004335b0
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov al, byte [ebp - 0xdd]
jmp 0x4af2fb
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea ecx, [ebp - 0xc]
call fcn.0047ec80
push 0x5203b1
push str..360safeuap
lea ecx, [ebp - 0xc]
call fcn.00481e30
lea ecx, [ebp - 0xc]
call fcn.0047ef80
cmp eax, 0x24
je 0x4af09b
mov byte [ebp - 0xde], 0
lea ecx, [ebp - 0xc]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.004335b0
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov al, byte [ebp - 0xde]
jmp 0x4af2fb
lea ecx, [ebp - 0xc]
call fcn.0044ea20
push eax
call fcn.004af560
add esp, 4
xor eax, eax
mov word [ebp - 0x40], ax
xor ecx, ecx
mov dword [ebp - 0x3e], ecx
mov dword [ebp - 0x3a], ecx
mov dword [ebp - 0x36], ecx
mov dword [ebp - 0x32], ecx
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov word [ebp - 0x22], cx
lea ecx, [ebp - 0x14]
call fcn.0044ea20
push eax
push 0xf
lea edx, [ebp - 0x40]
push edx
push 0x52022c
push str.type
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x40]
push eax
call fcn.004f0085
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xf0], ecx
mov edx, dword [ebp - 0xf0]
sub edx, 1
mov dword [ebp - 0xf0], edx
cmp dword [ebp - 0xf0], 6
ja case.default.0x4af139
mov eax, dword [ebp - 0xf0]
jmp dword [eax*4 + 0x4af30c]
mov dword [ebp - 0x18], str._FUNNAMEqinglilaji
mov dword [ebp - 0x44], 0x636
jmp case.default.0x4af139
mov dword [ebp - 0x18], str._FUNNAMEtijian
mov dword [ebp - 0x44], 0x626
jmp case.default.0x4af139
mov dword [ebp - 0x18], str._FUNNAMErunupdate
mov dword [ebp - 0x44], 0x627
jmp case.default.0x4af139
mov dword [ebp - 0x18], str._FUNNAMEshareboot
mov dword [ebp - 0x44], 0x629
jmp case.default.0x4af139
mov dword [ebp - 0x18], str._FUNNAMEmyboottime
mov dword [ebp - 0x44], 0x628
jmp case.default.0x4af139
call fcn.004c4cd0
push 0x1388
movzx ecx, byte [ebp + 0xc]
push ecx
push 0x13
call fcn.004c4d60
add esp, 0xc
jmp case.default.0x4af139
push 0
push str.Q360SafeMonClass
call fcn.004b0810
add esp, 8
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x4af1f0
push 0
push 0x3e8
push 0
push 0
push 0x15
mov edx, dword [ebp - 0x48]
push edx
call fcn.004b08d0
add esp, 0x18
jmp case.default.0x4af139
push str._safemon360tray.exe
lea eax, [ebp - 0xe4]
push eax
call fcn.004b0420
add esp, 4
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.004185a0
add esp, 0xc
lea ecx, [ebp - 0xe4]
call fcn.004335b0
push 0
lea ecx, [ebp - 0x4c]
call fcn.0044ea20
push eax
call fcn.00417b40
add esp, 8
test eax, eax
je 0x4af254
push 5
push 0
push str._enable__protection
lea ecx, [ebp - 0x4c]
call fcn.0044ea20
push eax
push str.open
push 0
call fcn.00450890
add esp, 0x18
lea ecx, [ebp - 0x4c]
call fcn.004335b0
cmp dword [ebp - 0x18], 0
je 0x4af2d6
push 0x518ed8
lea edx, [ebp - 0xe8]
push edx
call fcn.004b0420
add esp, 4
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004185a0
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.004335b0
push 0x511e1c
call fcn.004b7980
add esp, 4
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4af2ae
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push 5
push 0
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x50]
call fcn.0044ea20
push eax
push str.open
push 0
call fcn.00450890
add esp, 0x18
lea ecx, [ebp - 0x50]
call fcn.004335b0
mov byte [ebp - 0xe9], 1
lea ecx, [ebp - 0xc]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.004335b0
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov al, byte [ebp - 0xe9]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret