Function at 0x499f85
Capabilities:
Delete registry value
Persist via app paths registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push 0xec
mov eax, 0x4e7842
call fcn.004b5417
lea ebx, [ecx + 0x80]
push ebx
mov dword [ebp - 0xa4], ecx
call fcn.0049621b
mov dword [esp], 0x501294
push ebx
call fcn.004962d8
push str.safemonQHSafeTray.exe
push ebx
call fcn.004962d8
add esp, 0x10
xor esi, esi
push esi
push str.QHSafeMain.exe
lea eax, [ebp - 0x9c]
push ebx
push eax
call fcn.00445250
add esp, 0xc
mov dword [ebp - 4], esi
push dword [eax]
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push 0x50ea8c
call fcn.0044bc85
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push edi
call fcn.0044bc85
mov byte [ebp - 4], 2
mov esi, 0x80000002
push esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 3
push eax
call fcn.0043ea28
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0040d610
push 0
push dword [ebx]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.Path
call fcn.0044bc85
mov dword [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push edi
call fcn.0044bc85
mov byte [ebp - 4], 5
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 6
push eax
call fcn.0043ea28
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
call fcn.0046a127
test eax, eax
jne 0x49a0ba
call fcn.0046b02f
test eax, eax
je 0x49a19b
push 0
push str.QHSafeMain.exe
lea eax, [ebp - 0x9c]
push ebx
push eax
call fcn.00445250
add esp, 0xc
mov dword [ebp - 4], 7
push dword [eax]
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push 0x50ea8c
call fcn.0044bc85
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
push edi
call fcn.0044bc85
mov byte [ebp - 4], 9
push esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 0xa
push eax
call fcn.0043ea28
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0040d610
push 0
push dword [ebx]
xor ebx, ebx
inc ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.Path
call fcn.0044bc85
mov dword [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push edi
call fcn.0044bc85
mov byte [ebp - 4], 0xc
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0xd
push eax
call fcn.0043ea28
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
jmp 0x49a19e
xor ebx, ebx
inc ebx
call fcn.0043c47e
test al, al
jne 0x49a203
push ebx
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.i18n
call fcn.0044bc85
mov dword [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.SYSTEMCurrentControlSet_services360SelfProtection
call fcn.0044bc85
mov byte [ebp - 4], 0xf
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0x10
push eax
call fcn.0043ea52
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x88]
push eax
mov edi, str.software360TotalSecurity
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x49a235
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x88], 0
lea ecx, [ebp - 0x8c]
call fcn.004413bb
mov dword [ebp - 4], 0x11
push str.UserProfile
push edi
lea eax, [ebp - 0x8c]
push str._s_s
push eax
call fcn.00461c09
and dword [ebp - 0x9c], 0
add esp, 0x10
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
mov edi, str.MaskFlags
push edi
push dword [ebp - 0x8c]
mov dword [ebp - 0x84], ebx
push esi
mov dword [ebp - 0x94], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x49a2ad
cmp dword [ebp - 0x9c], 4
je 0x49a2cc
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push edi
push dword [ebp - 0x8c]
mov dword [ebp - 0x84], ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.0044209e
cmp byte [0x53fe3d], 0
mov ebx, str.SOFTWARE360TotalSecurityExperience
je 0x49a3bc
and dword [ebp - 0x94], 0
lea eax, [ebp - 0x94]
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.ShowTipsValue
call fcn.0044bc85
mov dword [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
push ebx
call fcn.0044bc85
mov byte [ebp - 4], 0x13
mov edi, 0x80000001
push edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0x14
push eax
call fcn.0043e957
pop ecx
pop ecx
mov dword [ebp - 0x94], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
cmp dword [ebp - 0x94], 0
je 0x49a3bc
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.ShowTipsValue
call fcn.0044bc85
mov dword [ebp - 4], 0x15
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push ebx
call fcn.0044bc85
mov byte [ebp - 4], 0x16
push edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0x17
push eax
call fcn.0043ea6a
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
call fcn.0043a989
test al, al
jne 0x49a3fc
lea ecx, [ebp - 0x98]
call fcn.00439d70
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0x98]
call fcn.0044dba1
lea ecx, [ebp - 0x98]
call fcn.0044dad1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00481762
push 0
call fcn.004b5eec
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ecx
push 8
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xb0]
push eax
push 0xb
push str.insttime
push str.SOFTWARE360SafeCoop
push esi
mov dword [ebp - 0xac], edx
call edi
mov ecx, dword [ebp - 0xa4]
call fcn.004984ca
cmp byte [0x53fe3c], 0
jne 0x49a9fe
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x88]
push eax
mov ebx, str.software360TotalSecurityUserProfile
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x49a478
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x88], 0
lea ecx, [ebp - 0x8c]
call fcn.0040c7d0
mov dword [ebp - 4], 0x19
push dword [ebp - 0xac]
lea eax, [ebp - 0x8c]
push dword [ebp - 0xb0]
push str._I64d
push eax
call fcn.0040e3f0
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ecx - 0xc]
add esp, 0x10
add eax, eax
push eax
push ecx
push 1
push str.InstallDate
push ebx
push esi
call edi
push str.ReInstall
push str.SOFTWARE360TotalSecurityUserProfile
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.0040d610
lea ecx, [ebp - 0xdc]
call fcn.00475e3d
mov dword [ebp - 4], 0x1a
push 1
lea eax, [ebp - 0xdc]
push 1
push eax
call fcn.004676f4
add esp, 0xc
cmp dword [ebp - 0xc4], 0
je 0x49a51d
mov eax, dword [ebp - 0xa4]
mov byte [eax + 0x49c], 1
mov eax, dword [0x53fe40]
mov ecx, dword [ebp - 0xa4]
push eax
mov dword [ebp - 0x88], eax
call fcn.0049537f
and dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x8c]
push eax
mov ebx, str.SOFTWARE360TotalSecurityActiveProtection
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x49a56c
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x8c], 0
push 4
lea eax, [ebp - 0x88]
push eax
push 4
push str.mode
push ebx
push esi
call edi
mov eax, dword [ebp - 0x88]
cmp eax, 1
je 0x49a5de
test eax, eax
je 0x49a5de
cmp eax, 0xfe
jne 0x49a5ac
push dword [0x53fe30]
mov ecx, dword [ebp - 0xa4]
call fcn.00493833
jmp 0x49a673
cmp eax, 2
jne 0x49a673
cmp byte [0x53fe55], 0
je 0x49a673
and dword [ebp - 0x94], 0
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.ExtFlags
jmp 0x49a66f
lea eax, [ebp - 0x8c]
push eax
mov ebx, str.SOFTWARE360Safe_filemon
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x49a609
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x8c], 0
and dword [ebp - 0x84], 0
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.AVEnable
push ebx
push esi
call edi
cmp dword [ebp - 0x88], 1
jne 0x49a673
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.AVReadProtectEnable
push ebx
push esi
call edi
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.AVWriteProtectEnable
push ebx
push esi
call edi
push 4
lea eax, [ebp - 0x84]
push eax
push 4
mov dword [ebp - 0x84], 1
push str.Level
push ebx
push esi
call edi
cmp byte [0x53fe3d], 0
jne 0x49a822
mov byte [ebp - 0x8d], 1
call fcn.0043a56b
test al, al
je 0x49a80f
push str.privacy_link
lea eax, [ebp - 0x94]
mov ebx, 0x53fda0
push eax
mov ecx, ebx
call fcn.0047d67a
mov byte [ebp - 4], 0x1b
push dword [eax]
lea ecx, [ebp - 0x64]
call fcn.0042b420
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x94]
call fcn.0040d610
push str.license_link
lea eax, [ebp - 0x94]
push eax
mov ecx, ebx
call fcn.0047d67a
mov byte [ebp - 4], 0x1e
push dword [eax]
lea ecx, [ebp - 0x80]
call fcn.0042b420
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x94]
call fcn.0040d610
mov ebx, str.json
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0044c3ea
add esp, 0xc
mov byte [ebp - 4], 0x21
cmp dword [eax + 0x18], 8
jb 0x49a721
mov eax, dword [eax + 4]
jmp 0x49a724
add eax, 4
push 0x1388
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00499967
add esp, 0xc
mov byte [ebp - 4], 0x23
push 0
push 1
lea ecx, [ebp - 0xf8]
call fcn.0040d590
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0044c3ea
add esp, 0xc
mov byte [ebp - 4], 0x24
cmp dword [eax + 0x18], 8
jb 0x49a76c
mov eax, dword [eax + 4]
jmp 0x49a76f
add eax, 4
push 0x1388
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00499967
add esp, 0xc
mov byte [ebp - 4], 0x26
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xf8]
call fcn.0040d590
cmp dword [ebp - 0x34], ebx
je 0x49a7cb
cmp dword [ebp - 0x18], ebx
je 0x49a7cb
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x49a7ab
lea eax, [ebp - 0x28]
push eax
call fcn.00462768
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
pop ecx
jae 0x49a7be
lea eax, [ebp - 0x44]
push eax
call fcn.0046266c
pop ecx
mov byte [ebp - 0x8d], bl
mov byte [ebp - 4], 0x23
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d590
mov byte [ebp - 4], 0x20
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040d590
mov byte [ebp - 4], 0x1d
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.0040d590
mov byte [ebp - 4], 0x1a
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.0040d590
cmp byte [ebp - 0x8d], bl
je 0x49a822
mov ebx, 0x4fa7a8
push ebx
call fcn.00462768
push ebx
call fcn.0046266c
pop ecx
pop ecx
mov eax, dword [0x53fe58]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x49a837
cmp eax, 2
jne 0x49a983
cmp byte [0x53fe68], 0
je 0x49a983
mov eax, dword [0x53fe64]
test eax, eax
jne 0x49a899
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.InstallOpera
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0xa0]
call fcn.00439d70
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xa0]
call fcn.004555b4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xa0]
call fcn.00481762
jmp 0x49a983
cmp eax, ecx
jne 0x49a8e9
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.InstallYandex
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0x8d]
call fcn.00439d6a
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x8d]
call fcn.0044dc8b
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8d]
call fcn.00481762
jmp 0x49a983
cmp eax, 2
jne 0x49a937
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.Install360SecureBrowser
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0xa0]
call fcn.00439d70
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xa0]
call fcn.00455796
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xa0]
call fcn.00481762
jmp 0x49a983
cmp eax, 3
jne 0x49a983
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.InstallWPSOffice
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0xa0]
call fcn.00439d70
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xa0]
call fcn.004556a5
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xa0]
call fcn.00481762
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call fcn.00475e13
mov ecx, dword [ebp - 0xa4]
call fcn.004958a1
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x53fda0
call fcn.00484b80
mov dword [ebp - 4], 0x2b
push str.ACCOUNT
mov ecx, eax
call fcn.0043f433
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0040d610
test bl, bl
je 0x49a9f1
push 0
push 3
push 0
push 1
push 0x1000000
call fcn.0046231c
add esp, 0x14
push 1
call fcn.0044112d
pop ecx
jmp 0x49ad17
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.ReInstall
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], 1
call edi
and dword [ebp - 0x9c], 0
lea eax, [ebp - 0x9c]
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
push str.NewLanguageChecked
call fcn.0044bc85
mov dword [ebp - 4], 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0x8c], esp
push ebx
call fcn.0044bc85
mov byte [ebp - 4], 0x2d
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0x2e
push eax
call fcn.0043e957
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
cmp dword [ebp - 0x9c], 1
je 0x49ab22
lea ecx, [ebp - 0x88]
call fcn.0040c7d0
mov dword [ebp - 4], 0x2f
lea eax, [ebp - 0x88]
push eax
mov ecx, 0x53fda0
call fcn.004980fa
test al, al
je 0x49ab13
push 0
push dword [ebp - 0x88]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.NewLanguageArrivalCheck
call fcn.0044bc85
mov byte [ebp - 4], 0x30
push ecx
mov ecx, esp
mov dword [ebp - 0x8c], esp
push ebx
call fcn.0044bc85
mov byte [ebp - 4], 0x31
push esi
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 0x32
push eax
call fcn.0043ea28
add esp, 0xc
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x20]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.0040d610
and dword [ebp - 0x84], 0
cmp dword [0x53fed8], 1
push 4
pop eax
mov ebx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
jne 0x49ac63
push eax
lea ecx, [ebp - 0x84]
push ecx
push eax
push str.ExtFlags
push ebx
push esi
call edi
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push str.mode
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ad17
push 4
pop eax
cmp dword [ebp - 0x8c], eax
jne 0x49ad17
cmp dword [ebp - 0x84], 2
jne 0x49ad17
and dword [ebp - 0x84], 0
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push str.Flags
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49abf8
cmp dword [ebp - 0x8c], 4
jne 0x49abf8
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.Flags
push ebx
push esi
call edi
and dword [ebp - 0x84], 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0x4f98b8
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ad17
cmp dword [ebp - 0x8c], 4
jne 0x49ad17
test dword [ebp - 0x84], 2
jne 0x49ad17
or dword [ebp - 0x84], 2
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push 0x4f98b8
push ebx
jmp 0x49ad14
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
push eax
push str.mode
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ad17
push 4
pop eax
cmp dword [ebp - 0x88], eax
jne 0x49ad17
cmp dword [ebp - 0x84], 2
jne 0x49ad17
and dword [ebp - 0x84], 0
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
push eax
push str.ExtFlags
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x49ad17
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.Flags
push ebx
push esi
mov dword [ebp - 0x84], 0x30013f0f
call edi
and dword [ebp - 0x84], 0
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push 0x4f98b8
push str.SOFTWARE360Safe_filemon
push esi
call edi
call fcn.00464fee
xor ebx, ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.new_func_tips
call fcn.0044bc85
mov dword [ebp - 4], 0x33
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.Software360desktopliteConfig
call fcn.0044bc85
mov byte [ebp - 4], 0x34
push 0x80000001
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00443769
mov dword [ebp - 4], 0x35
lea ecx, [ebp - 0xa8]
call fcn.0040c7d0
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.0044b15c
pop ecx
pop ecx
test eax, eax
je 0x49ad9e
mov eax, dword [ebp - 0xa8]
cmp dword [eax - 0xc], ebx
jne 0x49adb3
push ebx
lea eax, [ebp - 0xc0]
push 0x4f24c0
push eax
call fcn.0043ea28
add esp, 0xc
mov ebx, str.smurf
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push str.default
push str.Software360TotalSecurityTheme
push esi
call edi
cmp byte [0x53fe78], 1
jne 0x49ae07
push 1
push ebx
call fcn.0046502d
pop ecx
pop ecx
cmp al, 1
jne 0x49ae07
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push str.name
push str.Software360TotalSecurityTheme
push 0x80000001
call edi
xor edi, edi
push edi
push 3
push edi
push edi
push 0x100
call fcn.0046231c
mov esi, dword [ebp - 0xa4]
add esp, 0x14
mov ecx, esi
call fcn.00497345
mov ecx, esi
call fcn.004940e6
mov ecx, esi
call fcn.00495ad7
mov eax, dword [0x536610]
cmp eax, 0xffffffff
je 0x49ae4f
cmp eax, edi
setne al
movzx eax, al
push eax
call fcn.0048b71c
pop ecx
mov ecx, esi
call fcn.00497605
mov ecx, esi
call fcn.004976df
mov ecx, esi
call fcn.0049783e
mov ecx, esi
call fcn.00499506
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xa8]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00443c39
mov al, 1
call fcn.004b549a
ret