Function at 0x40dba3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7d0]
sub esp, 0x850
mov eax, dword [0x439c3c]
xor eax, ebp
mov dword [ebp + 0x7cc], eax
mov eax, dword [ebp + 0x7e0]
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x7d8]
mov dword [ebp - 0x5c], eax
cmp word [0x43c488], bx
jne 0x40dddb
push esi
xor eax, eax
push 0x40e
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push ebx
push eax
call fcn.00419dc0
mov esi, 0x208
push esi
lea eax, [ebp + 0x5c4]
push ebx
push eax
call fcn.00419dc0
push esi
lea eax, [ebp + 0x3bc]
push ebx
push eax
call fcn.00419dc0
add esp, 0x24
push 0x104
lea eax, [ebp + 0x3bc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x80], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
mov dword [ebp - 0x7c], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360ExtHost.exe
mov dword [ebp - 0x78], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
mov dword [ebp - 0x74], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360EDRSensor.exe
mov dword [ebp - 0x70], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsMMScan.exe
mov dword [ebp - 0x6c], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360asset.exe
mov dword [ebp - 0x68], eax
xor edi, edi
push esi
lea eax, [ebp + 0x5c4]
push ebx
push eax
call fcn.00419dc0
mov eax, dword [ebp + edi*4 - 0x80]
lea ecx, [ebp + 0x5c4]
add esp, 0xc
test ecx, ecx
je 0x40dd00
cmp eax, ebx
je 0x40dd00
xor ecx, ecx
cmp cx, word [eax]
je 0x40dd00
lea ecx, [ebp - 0x58]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x58], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dd00
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x5c4]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push str.Path
push dword [ebp - 0x58]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x60], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp + 0x5c4]
je 0x40dcf1
lea eax, [ebp + 0x5c4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp + 0x5c4]
push eax
call fcn.0041a94b
pop ecx
jmp 0x40dd02
xor eax, eax
cmp word [ebp + 0x5c4], bx
je 0x40dd26
push eax
lea eax, [ebp + 0x5c4]
push eax
lea eax, [ebp + 0x3bc]
push eax
call fcn.0041af25
add esp, 0xc
test eax, eax
je 0x40dd47
cmp edi, 5
jne 0x40dd3b
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0040db0d
pop ecx
pop ecx
test eax, eax
je 0x40dd5e
inc edi
cmp edi, 7
jb 0x40dc5d
jmp 0x40dd5e
lea eax, [ebp + 0x5c4]
push eax
push dword [ebp + 0x7e4]
push 0x43c488
call fcn.004082d5
cmp word [0x43c488], bx
jne 0x40ddac
push esi
lea eax, [ebp + 0x5c4]
push ebx
push eax
call fcn.00419dc0
mov eax, dword [ebp + 0x7dc]
add esp, 0xc
inc eax
cmp eax, ebx
jbe 0x40dd95
mov esi, eax
lea eax, [ebp + 0x3bc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
dec esi
jne 0x40dd85
lea eax, [ebp + 0x3bc]
push eax
push dword [ebp + 0x7e4]
push 0x43c488
call fcn.004082d5
push 0x43c488
call fcn.0041a94b
pop ecx
pop esi
cmp eax, ebx
je 0x40ddce
lea eax, [eax*2 + 0x43c486]
cmp word [eax], 0x5c
jne 0x40ddce
xor ecx, ecx
mov word [eax], cx
cmp word [0x43c488], bx
jne 0x40dddb
xor eax, eax
jmp 0x40ddf3
push 0x43c488
push dword [ebp + 0x7e4]
push dword [ebp - 0x5c]
call fcn.004082d5
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x7cc]
pop edi
xor ecx, ebp
pop ebx
call fcn.00419db1
add ebp, 0x7d0
leave
ret