Function at 0x40ee07
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x439c3c]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3b0]
push ebx
push esi
push edi
mov esi, 0x208
push esi
mov dword [ebp - 0x74], eax
xor edi, edi
lea eax, [ebp + 0x19c]
push edi
push eax
call fcn.00419dc0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0x19c]
add esp, 0xc
test eax, eax
je 0x40eedd
xor ecx, ecx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
cmp ecx, eax
je 0x40eedd
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f08e
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push str.Path
push dword [ebp - 0x70]
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x80], esi
call ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp + 0x19c]
je 0x40eecb
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp + 0x19c]
push eax
call fcn.0041a94b
pop ecx
mov dword [ebp - 0x70], eax
jmp 0x40eee0
mov dword [ebp - 0x70], edi
cmp dword [ebp - 0x70], edi
je 0x40f08e
xor eax, eax
cmp ax, word [ebp + 0x19c]
je 0x40f08e
cmp dword [ebp + 0x3b4], edi
je 0x40ef3f
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00419dc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp - 0x70]
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
neg eax
sbb eax, eax
inc eax
je 0x40f088
lea eax, [ebp + 0x19c]
push str.360leakfixer.exe
push eax
call fcn.0040ed93
pop ecx
test eax, eax
pop ecx
lea eax, [ebp + 0x19c]
je 0x40efb2
push str.safemonpedrver.dll
push eax
call fcn.0040ed93
pop ecx
pop ecx
mov esi, 0x80
test eax, eax
jne 0x40ef74
mov esi, edi
lea eax, [ebp + 0x19c]
push str.safemonFreeSaaS.tpi
push eax
call fcn.0040ed93
pop ecx
pop ecx
test eax, eax
je 0x40efaa
lea eax, [ebp + 0x19c]
push str.safemon_saasver.dll
push eax
call fcn.0040ed93
pop ecx
pop ecx
test eax, eax
je 0x40efaa
or esi, 0x20
jmp 0x40f08a
or esi, 1
jmp 0x40f08a
push str.hipsver.dll
push eax
call fcn.0040ed93
pop ecx
pop ecx
test eax, eax
je 0x40f088
lea eax, [ebp + 0x19c]
push str.safemon360Cactus.tpi
push eax
call fcn.0040ed93
pop ecx
pop ecx
test eax, eax
je 0x40f083
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00419dc0
lea eax, [ebp - 0x6c]
add esp, 0xc
test eax, eax
je 0x40f065
xor ecx, ecx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
cmp ecx, eax
je 0x40f065
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f065
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push str.Path
push dword [ebp - 0x70]
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], esi
call ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp - 0x6c]
je 0x40f05b
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a94b
pop ecx
lea eax, [ebp - 0x6c]
push str.360SkinMgr.exe
push eax
call fcn.0040ed93
mov esi, eax
neg esi
sbb esi, esi
pop ecx
and esi, 4
pop ecx
add esi, 6
jmp 0x40f08a
push 0x10
pop esi
jmp 0x40f08a
mov esi, edi
mov eax, esi
jmp 0x40f090
xor eax, eax
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419db1
add ebp, 0x3a8
leave
ret