Function at 0x43fe17
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16f4
call fcn.004703d0
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x1046
mov word [ebp - 0x16e4], ax
xor ebx, ebx
lea eax, [ebp - 0x16e2]
push ebx
push eax
call fcn.0046e0e0
push 0x7f
lea eax, [ebp - 0x83]
push ebx
push eax
mov byte [ebp - 0x84], bl
call fcn.0046e0e0
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00419350
push 0x20
pop ecx
lea esi, [ebp - 0x84]
mov edi, 0x505e60
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x28a]
push ebx
push eax
mov dword [ebp - 0x16f0], 1
call fcn.0046e0e0
add esp, 0x2c
lea eax, [ebp - 0x16f4]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x16f0]
push eax
push 0x49125c
push str.Software360Chromechrome
push SysReAllocString
mov dword [ebp - 0x16f4], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp ax, word [ebp - 0x28c]
jne 0x43ff06
push str.360se
push 0x4912cc
lea eax, [ebp - 0x28c]
push 0x103
push eax
call fcn.0046dffd
add esp, 0x10
cmp dword [0x4a0150], 0x10
jb 0x43ff1c
mov eax, dword [0x4a013c]
mov dword [ebp - 0x16e8], eax
jmp 0x43ff26
mov dword [ebp - 0x16e8], 0x4a013c
cmp dword [ebp - 0x16e8], ebx
je 0x43ff45
push dword [ebp - 0x16e8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x43ff4d
mov dword [ebp - 0x16e8], ebx
jmp 0x43ff6c
lea eax, [esi + esi]
call fcn.004710e0
mov eax, esp
push 3
push esi
push dword [ebp - 0x16e8]
push eax
call fcn.0043f07a
mov dword [ebp - 0x16e8], eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x43ff8c
mov dword [ebp - 0x16ec], ebx
jmp 0x43ffac
lea eax, [esi + esi]
call fcn.004710e0
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x84]
push ecx
push eax
call fcn.0043f07a
mov dword [ebp - 0x16ec], eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x43ffc8
xor eax, eax
jmp 0x43ffe2
lea eax, [esi + esi]
call fcn.004710e0
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x84]
push ecx
push eax
call fcn.0043f07a
lea ecx, [ebp - 0x28c]
push ecx
push dword [ebp - 0x16e8]
mov ecx, 0x506308
push dword [ebp - 0x16ec]
push 0x507140
push 0x506f38
push 0x506d30
push 0x506b28
push 0x506920
push 0x506718
push ecx
push 0x505ef8
push ebx
push ebx
push ecx
push eax
push str.http:__pvstat.qihoo.com_dimana.gif__pdt360chromebq_dim_kpid__guid__ver_dim_v360chrome___s___sm_dmts_diname_sifver_simod_simodver_sicode_sioff_sios_siie_smid_spt_spid_s
lea eax, [ebp - 0x16e4]
push 0x823
push eax
call fcn.0046dffd
add esp, 0x48
lea eax, [ebp - 0x16e4]
mov esi, 0x507968
push eax
mov ecx, esi
call fcn.0042c315
xor eax, eax
push edi
mov word [ebp - 0x69c], ax
lea eax, [ebp - 0x69a]
push ebx
push eax
call fcn.0046e0e0
xor eax, eax
push edi
mov word [ebp - 0x494], ax
lea eax, [ebp - 0x492]
push ebx
push eax
call fcn.0046e0e0
add esp, 0x18
lea eax, [ebp - 0x69c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x493b6c
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x494]
push eax
mov ecx, esi
call fcn.0042c347
mov ecx, esi
mov dword [0x509dd0], 1
mov dword [0x50a010], 0x1388
call fcn.00465aa0
mov ecx, esi
call fcn.0046144a
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.004642be
lea esp, [ebp - 0x1700]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e0cd
leave
ret