Function at 0x44dc40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1ce6
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
cmp dword [ebx + 0x10], edi
je 0x44dc8c
cmp dword [ebx], edi
je 0x44dc85
cmp dword [ebx + 4], edi
je 0x44dc85
lea eax, [edi + 1]
jmp 0x44e0ae
xor eax, eax
jmp 0x44e0ae
lea esi, [ebx + 0x20]
xor eax, eax
mov dword [ebp - 0x224], eax
cmp esi, edi
je 0x44dcaa
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov dword [ebp - 0x224], esi
mov eax, esi
mov dword [ebp - 4], edi
cmp dword [ebx + 0x10], edi
je 0x44dcd6
cmp dword [ebx], edi
je 0x44dcc2
cmp dword [ebx + 4], edi
je 0x44dcc2
mov esi, 1
jmp 0x44dcc4
xor esi, esi
cmp eax, edi
je 0x44dccf
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, esi
jmp 0x44e0ae
mov eax, dword [0x4e3954]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3954
call edx
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
mov byte [ebp - 4], 1
push ecx
mov dword [ebp - 0x220], edi
mov word [ebp - 0x218], ax
call fcn.0048f0a0
mov eax, dword [ebx + 0x1c]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str...360base.dll
lea ecx, [ebp - 0x218]
push ecx
call edi
push str.deepscan360base.dll
lea edx, [ebp - 0x218]
push edx
mov dword [ebp - 0x230], 0
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44dd6a
mov dword [ebp - 0x230], 1
lea esi, [ebp - 0x218]
call fcn.00449ac0
test eax, eax
je 0x44dd88
mov dword [ebp - 0x220], 1
jmp 0x44de4d
push str.....360base.dll
lea eax, [ebp - 0x218]
push eax
call edi
lea esi, [ebp - 0x218]
call fcn.00449ac0
test eax, eax
je 0x44ddce
mov edx, esi
lea edi, [ebp - 0x21c]
call fcn.00403c10
cmp dword [ebp - 0x230], 0
je 0x44de5e
mov dword [ebp - 0x220], 1
jmp 0x44de5e
push 0x208
lea ecx, [ebp - 0x218]
push 0
push ecx
mov dword [ebp - 0x22c], 0x208
mov dword [ebp - 0x228], 1
call fcn.0048f0a0
add esp, 0xc
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
push ecx
push str.path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x44de5e
push str.360base.dll
lea edx, [ebp - 0x218]
push edx
call edi
test eax, eax
je 0x44de5e
lea esi, [ebp - 0x218]
call fcn.00449ac0
test eax, eax
je 0x44de5e
lea edx, [ebp - 0x218]
lea edi, [ebp - 0x21c]
call fcn.00403c10
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x44deca
lea ecx, [ebp - 0x21c]
lea esi, [ebx + 0x38]
push ecx
mov ecx, esi
call fcn.004064b0
mov eax, dword [ebp - 0x220]
mov edx, dword [esi]
push eax
mov edi, str.360base.dll
mov ecx, ebx
call fcn.0044e0d0
test eax, eax
je 0x44dea5
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x44deca
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.CreateObject
push eax
call esi
mov edx, dword [ebx + 0x14]
push str.InitLibs
push edx
mov dword [ebx], eax
call esi
mov dword [ebx + 8], eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], 0
call fcn.00403940
mov edx, dword [ebx + 0x1c]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
xor eax, eax
push edx
mov word [ebp - 0x218], ax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str...360conf.dll
lea eax, [ebp - 0x218]
push eax
call edi
lea esi, [ebp - 0x218]
call fcn.00449ac0
test eax, eax
je 0x44df30
mov dword [ebp - 0x220], 1
jmp 0x44dfef
push str.....360conf.dll
lea ecx, [ebp - 0x218]
push ecx
call edi
lea esi, [ebp - 0x218]
call fcn.00449ac0
mov edx, esi
test eax, eax
je 0x44df76
lea edi, [ebp - 0x21c]
call fcn.00403c10
cmp dword [ebp - 0x230], 0
je 0x44e000
mov dword [ebp - 0x220], 1
jmp 0x44e000
push 0x208
push 0
push edx
mov dword [ebp - 0x228], 0x208
mov dword [ebp - 0x22c], 1
call fcn.0048f0a0
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x22c]
push edx
push str.path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x44e000
push str.360conf.dll
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x44e000
lea esi, [ebp - 0x218]
call fcn.00449ac0
test eax, eax
je 0x44e000
lea edx, [ebp - 0x218]
lea edi, [ebp - 0x21c]
call fcn.00403c10
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 0xc], 0
je 0x44e066
lea ecx, [ebp - 0x21c]
lea edi, [ebx + 0x3c]
push ecx
mov ecx, edi
call fcn.004064b0
mov eax, dword [ebp - 0x220]
mov edx, dword [edi]
push eax
mov edi, str.360conf.dll
mov ecx, ebx
call fcn.0044e0d0
test eax, eax
je 0x44e040
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x44e066
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.CreateObject
push eax
call edi
mov ecx, dword [ebx + 0x18]
push str.InitLibs
push ecx
mov dword [ebx + 4], eax
call edi
mov dword [ebx + 0xc], eax
cmp dword [ebx], 0
mov edi, 1
mov dword [ebx + 0x10], edi
je 0x44e079
cmp dword [ebx + 4], 0
jne 0x44e07b
xor edi, edi
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44e09b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x44e0ac
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret