Function at 0x40cfff
Capabilities:
Check if file exists
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x74], eax
mov eax, dword [esi + 4]
lea edi, [esi + 0x1c]
add eax, 0x10
push eax
mov ecx, edi
call fcn.00411c35
mov edi, dword [edi]
cmp dword [edi - 8], 0
je 0x40d21a
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d21a
mov eax, dword [esi + 4]
lea ebx, [esi + 0x18]
add eax, 0x14
mov ecx, ebx
push eax
call fcn.00411c35
push 0x427aa8
lea edi, [esi + 0x14]
push dword [ebx]
push 0x425944
push edi
call fcn.00403a7b
push dword [ebx]
call fcn.00415a35
push dword [ebx]
call fcn.00415ab9
add esp, 0x18
test al, al
jne 0x40d092
push 0x30
push dword [0x42b934]
push 0x425990
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40d0db
mov ecx, esi
call fcn.00411459
test eax, eax
jne 0x40d0ac
push 0x40
push dword [0x42b934]
push 0x4259d4
jmp 0x40d087
mov eax, dword [esi + 4]
cmp dword [eax + 4], 9
jge 0x40d0e3
mov ecx, esi
call fcn.004114ff
test eax, eax
je 0x40d0e3
push 0x44
push dword [0x42b934]
push 0x427a48
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40d0e3
or eax, 0xffffffff
jmp 0x40d21c
push dword [edi]
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [edi]
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 4
push eax
push 4
push str.AllSitesCompatibilityMode
push str.SoftwareMicrosoftInternet_ExplorerBrowserEmulation
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, esi
call fcn.004110de
mov ecx, dword [esi + 4]
push 5
push dword [ebp + 8]
call fcn.00412181
mov edi, dword [edi]
mov eax, dword [ebx]
push 1
push edi
push eax
mov ecx, esi
push dword [ebp + 8]
call fcn.00410dd9
test eax, eax
je 0x40d21a
mov eax, dword [0x425504]
push str.360se_bin
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push dword [eax + 0x18]
lea eax, [ebp - 4]
push 0x425944
push eax
call fcn.00403a7b
add esp, 0x10
cmp dword [0x42bfe8], 0
je 0x40d283
mov eax, dword [esi + 4]
cmp dword [eax + 4], 6
jle 0x40d283
push dword [ebx]
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x40d283
push 0x42bde0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d283
and word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x42bde0
push 0x427aa8
push edi
push 0x425944
lea eax, [ebp - 0x210]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x210]
mov ecx, esi
push 0
push eax
push edi
push dword [ebp + 8]
call fcn.00410dd9
test eax, eax
jne 0x40d223
lea ecx, [ebp - 4]
call fcn.00403e55
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebx]
push edi
call fcn.00415cd8
mov dword [esi + 0x58], eax
mov eax, dword [esi + 4]
pop ecx
cmp dword [eax + 4], 9
pop ecx
jl 0x40d283
and word [ebp - 0x418], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push str._s__tp:11__v:0
lea eax, [ebp - 0x418]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00415416
add esp, 0x1c
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0xa
push edi
call fcn.00412181
mov ecx, esi
call fcn.0040e372
mov ecx, dword [esi + 4]
push 0xf
push edi
call fcn.00412181
mov ecx, esi
call fcn.0040e59a
mov ecx, dword [esi + 4]
push 0x19
push edi
call fcn.00412181
push edi
mov ecx, esi
call fcn.0040e8ae
lea ecx, [ebp - 4]
call fcn.00403e55
push 1
pop eax
jmp 0x40d21c