Function at 0x404bac
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1700
call fcn.00517f10
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x16f8], eax
xor esi, esi
lea eax, [esp + 0x6b0]
push 0x1048
push esi
push eax
call fcn.006030b0
add esp, 0xc
xorps xmm0, xmm0
lea eax, [esp + 0x630]
movaps xmmword [eax + 0x70], xmm0
movaps xmmword [eax + 0x60], xmm0
movaps xmmword [eax + 0x50], xmm0
movaps xmmword [eax + 0x40], xmm0
movaps xmmword [eax + 0x30], xmm0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
push 0x80
push eax
call fcn.0048a4f0
add esp, 8
lea edi, [esp + 0x14]
mov dword [edi], 1
lea ebx, [esp + 0x428]
push 0x208
push esi
push ebx
call fcn.006030b0
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [eax], 0x206
push eax
push ebx
push edi
push 0x639a78
push str.Software360360se6chrome
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebx], 0
jne 0x404c7c
push str.360se
push 0x639712
push 0x103
push ebx
call fcn.00404830
add esp, 0x10
mov edi, 0x70d804
cmp byte [0x70d80f], 0
jns 0x404c98
mov edi, dword [0x70d804]
test edi, edi
je 0x404e9a
push edi
call fcn.0061fdf0
add esp, 4
lea esi, [esp + 0x220]
push eax
push edi
push esi
call fcn.0047cba0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x404cc0
mov esi, dword [esp + 0x220]
lea edi, [esp + 0x630]
push edi
call fcn.0061fdf0
add esp, 4
lea ebx, [esp + 0x18]
push eax
push edi
push ebx
call fcn.0047cba0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x404ce9
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x630]
push eax
call fcn.0061fdf0
add esp, 4
lea edi, [esp + 4]
push eax
lea eax, [esp + 0x634]
push eax
push edi
call fcn.0047cba0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x404d19
mov edi, dword [esp + 4]
mov eax, 0x70c1ac
xor ecx, ecx
lea edx, [esp + 0x428]
push edx
push esi
push ebx
push 0x70cfe4
push 0x70cddc
push 0x70cbd4
push 0x70c9cc
push 0x70c7c4
push 0x70c5bc
push eax
push 0x70bd9c
push ecx
push ecx
push eax
push edi
push str.http:__pvstat.qihoo.com_dimana.gif__pdt360se6bq_dim_kpid__guid__ver_dim_v360se6___s___sm_dmts_diname_sifver_simod_simodver_sicode_sioff_sios_siie_smid_spt_spid_s
push 0x823
lea esi, [esp + 0x6f4]
push esi
call fcn.00404830
add esp, 0x48
cmp byte [esp + 0xf], 0
jns 0x404d7f
push dword [esp + 4]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x23], 0
jns 0x404d92
push dword [esp + 0x18]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x22b], 0
jns 0x404dab
push dword [esp + 0x220]
call fcn.00517bd6
add esp, 4
xor eax, eax
mov edi, 0x76ad40
push 0x1048
push eax
push edi
call fcn.006030b0
add esp, 0xc
mov eax, 0x639712
push esi
push eax
push 0x823
push edi
call fcn.00405a12
add esp, 0x10
mov ebx, 0x208
lea esi, [esp + 0x220]
push ebx
xor eax, eax
push eax
push esi
call fcn.006030b0
add esp, 0xc
lea edi, [esp + 0x18]
push ebx
xor eax, eax
push eax
push edi
call fcn.006030b0
add esp, 0xc
mov eax, 0x103
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push eax
push 0x639a70
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, 0x76a930
push ebx
xor eax, eax
push eax
push esi
call fcn.006030b0
add esp, 0xc
push edi
mov eax, 0x639712
push eax
mov eax, 0x103
push eax
push esi
call fcn.00405a6e
add esp, 0x10
mov dword [0x70fc78], 1
mov dword [0x70feb8], 0x1388
mov ecx, 0x70d810
call fcn.0048b370
mov ecx, 0x70d810
push 0xffffffffffffffff
call fcn.0048b7e0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x70d810
call fcn.0048b640
mov ecx, dword [esp + 0x16f8]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
xor eax, eax
jmp 0x404ca1