Function at 0x402de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.00427f00
mov eax, dword [0x44ef24]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x44fc3c], 0
jne 0x4031be
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x1014]
add esp, 0xc
mov dword [ebp - 0x1014], 0x208
mov dword [ebp - 0x100c], 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x440678
push 0x4406e8
push 0x80000002
call esi
cmp word [ebp - 0x20c], 0
je 0x402e91
push 0x104
push 0
push 0x44fa20
call sub.msvcrt.dll_memset
push dword [ebp - 0x1014]
lea eax, [ebp - 0x20c]
push eax
push 0x44fa20
call sub.msvcrt.dll_memcpy
add esp, 0x18
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x100c], 0xffffffff
push eax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x1010], 4
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1014], 4
push eax
push str.SiteAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
call esi
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1014], 0xffffffff
push eax
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1018], 4
push eax
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1010], 4
push eax
push str.MonitoringSpoofing
push str.SOFTWARE360Safe_safemon
push 0x80000002
call esi
mov edi, dword [ebp - 0x1014]
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], 0xffffffff
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1010], 4
push eax
push str.MonitoringMalware
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 0x1018], 4
call esi
mov ecx, dword [ebp - 0x1014]
mov eax, dword [ebp - 0x100c]
cmp edi, 0xffffffff
jne 0x402f80
mov edi, 1
cmp eax, 0xffffffff
je 0x402f80
mov edi, eax
cmp ecx, 0xffffffff
jne 0x402f90
cmp eax, ecx
mov ecx, 1
je 0x402f90
mov ecx, eax
lea eax, [ebp - 0x1018]
mov dword [0x44fc2c], ecx
push eax
lea eax, [ebp - 0x100c]
mov dword [0x44fc30], edi
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x100c], 1
push eax
push str.NetQueryUrl
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 0x1010], 4
mov dword [ebp - 0x1018], 4
call esi
xor eax, eax
mov dword [ebp - 0x1010], 4
cmp dword [ebp - 0x100c], eax
mov dword [ebp - 0x100c], 1
setne al
mov dword [ebp - 0x1018], 4
mov dword [0x44e140], eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1010]
push eax
push str.SubmitRiskInfo
push str.SOFTWARE360Safe_safemon
push 0x80000002
call esi
mov eax, dword [ebp - 0x100c]
mov dword [0x44e144], eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 1
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1010], 4
push eax
push str.IEProtNotify
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 0x1018], 4
call esi
mov eax, dword [ebp - 0x100c]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.Q360SafeMonClass
mov dword [0x44fc38], eax
call edi
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call esi
neg eax
sbb eax, eax
neg eax
mov dword [0x44fc28], eax
call fcn.0040b960
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1008], 0x43485354
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x804]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x440814
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1004]
push eax
push str.CCPCommon::NotifyTrayOnChromeStart____ws
call fcn.00401530
add esp, 8
mov dword [ebp - 0x1024], 0x4d47534d
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1020], 0x804
mov dword [ebp - 0x101c], eax
push 0
push str.Q360SafeMonClass
call edi
mov edi, eax
push edi
call esi
test eax, eax
je 0x403189
lea eax, [ebp - 0x1018]
push eax
push 0x3e8
push 0
lea eax, [ebp - 0x1024]
push eax
push 0
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
cmp dword [0x44fc28], 0
pop edi
pop esi
je 0x4031a6
cmp dword [0x44fc2c], 0
jne 0x4031aa
cmp dword [0x44fc30], 0
jne 0x4031aa
xor eax, eax
jmp 0x4031af
mov eax, 1
mov dword [0x44fc34], eax
mov dword [0x44fc3c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427ee9
mov esp, ebp
pop ebp
ret