Function at 0x410607
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x448137
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x45a258]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45a258]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor ebp, ebp
xor edi, edi
inc edi
mov ebx, 0x45dc04
mov ecx, ebx
mov esi, 0x46059c
mov dword [esp + 0x20], 0x45f5f0
mov dword [0x460428], ebp
mov dword [0x460548], ebp
mov dword [0x46054c], ebp
mov dword [0x460550], ebp
mov dword [0x460558], ebp
mov dword [0x46055c], ebp
mov dword [0x460560], ebp
mov dword [0x460564], ebp
mov dword [0x460568], edi
mov dword [0x46056c], ebp
mov dword [0x460570], ebp
mov dword [0x460574], ebp
mov dword [0x460578], edi
mov dword [0x46057c], ebp
mov dword [0x460580], ebp
mov dword [0x460594], 0x44fd1c
call fcn.00405f8a
mov ecx, ebx
mov esi, 0x4605a0
call fcn.00405f8a
mov esi, 0x104
push esi
push 0x45f5f0
push ebp
mov dword [esp + 0x244], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x45f7f8
push ebx
mov edx, 0x45f5f0
mov ecx, esi
call fcn.00405fa5
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x20019
xor eax, eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
mov word [0x45fa00], ax
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.004051c7
test eax, eax
jne 0x410759
push str.Path
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esi
push eax
lea esi, [esp + 0x1c]
mov edi, 0x45fa00
call fcn.0040c482
xor edi, edi
mov esi, 0x104
inc edi
cmp dword [esp + 0x18], ebp
je 0x410769
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [0x45fa00], bp
je 0x410781
push 0x45fa00
call fcn.0040d868
pop ecx
test al, al
jne 0x41079a
push 0x45fa00
mov edx, ebx
mov ecx, esi
call fcn.00405fa5
push 0x45fa00
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x45fa00
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
mov ebx, 0x460018
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x4107eb
push str.Sysnative_
push ebx
push 0x45fe10
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.System32
push ebx
push 0x45fc08
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x45fe10
call fcn.0042e151
dec eax
pop ecx
mov dword [0x460428], eax
jmp 0x4107ff
xor eax, eax
mov word [0x45fc08], ax
mov word [0x460018], ax
mov word [0x45fe10], ax
push 0x11c
push ebp
mov ebx, 0x46042c
push ebx
call fcn.0042dec0
add esp, 0xc
push ebx
mov dword [0x46042c], 0x11c
call fcn.004105da
mov eax, dword [0x460430]
cmp eax, 5
jne 0x41084a
cmp dword [0x460434], 2
jne 0x41084a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x410864
mov dword [0x460548], edi
jmp 0x410864
cmp byte [0x460546], 1
je 0x410864
mov dword [0x460548], edi
cmp eax, 6
jb 0x410864
mov dword [0x46054c], edi
push 0x460574
call fcn.00410a69
mov dword [0x460570], eax
mov eax, dword [0x460430]
pop ecx
mov ecx, dword [0x460434]
cmp eax, 0xa
jne 0x41088e
cmp ecx, ebp
jne 0x410893
mov dword [0x460550], edi
cmp eax, 6
jb 0x410899
mov dword [0x460558], edi
cmp eax, 5
jne 0x4108b2
cmp ecx, edi
jne 0x4108b2
cmp word [0x460540], 2
jne 0x4108b2
mov dword [0x460554], edi
push ebp
mov dword [0x460584], ebp
mov dword [0x460588], ebp
mov dword [0x46058c], ebp
mov dword [0x460590], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebp
je 0x4108df
call fcn.004105a0
mov dword [0x460590], eax
call fcn.0040ed69
test eax, eax
je 0x410975
mov ebx, 0x460220
push ebx
mov edx, 0x45fa00
mov ecx, esi
call fcn.00405fa5
push str.Config_newui_themes_
mov eax, esi
mov ecx, ebx
call fcn.0040c1f1
xor eax, eax
push 0x206
mov word [esp + 0x28], ax
lea eax, [esp + 0x2a]
push ebp
push eax
call fcn.0042dec0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x20]
push eax
push str.skin
push str.SOFTWARE360SafeTheme
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x410967
cmp dword [esp + 0x14], ebp
je 0x410967
lea eax, [esp + 0x24]
push eax
jmp 0x41096c
push str.default
mov eax, esi
mov ecx, ebx
call fcn.0040c1f1
mov eax, 0x45f5f0
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0042deb1
add esp, 0x228
ret