Function at 0x40cae8
Capabilities:
Check if file exists
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
lea edi, [esi + 0x1c]
add eax, 0x10
mov ecx, edi
push eax
call fcn.00410e44
mov edi, dword [edi]
cmp dword [edi - 8], 0
je 0x40ccdc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ccdc
mov eax, dword [esi + 4]
lea ebx, [esi + 0x18]
add eax, 0x14
mov ecx, ebx
push eax
call fcn.00410e44
push 0x4269b4
lea edi, [esi + 0x14]
push dword [ebx]
push 0x424924
push edi
call fcn.00403a35
push dword [ebx]
call fcn.00414c27
push dword [ebx]
call fcn.00414cab
add esp, 0x18
test al, al
jne 0x40cb75
push 0x30
push dword [0x42a774]
push 0x424970
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40cbbe
mov ecx, esi
call fcn.00410975
test eax, eax
jne 0x40cb8f
push 0x40
push dword [0x42a774]
push 0x4249b4
jmp 0x40cb6a
mov eax, dword [esi + 4]
cmp dword [eax + 4], 9
jge 0x40cbc6
mov ecx, esi
call fcn.00410a1b
test eax, eax
je 0x40cbc6
push 0x44
push dword [0x42a774]
push 0x426950
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40cbc6
or eax, 0xffffffff
jmp 0x40ccde
push dword [edi]
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [edi]
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.004105fa
mov ecx, dword [esi + 4]
push 5
push dword [ebp + 8]
call fcn.00411390
mov edi, dword [edi]
mov eax, dword [ebx]
push 1
push edi
push eax
mov ecx, esi
push dword [ebp + 8]
call fcn.0041030e
test eax, eax
je 0x40ccdc
mov eax, dword [0x424504]
push str.360se_bin
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push dword [eax + 0x18]
lea eax, [ebp - 4]
push 0x424924
push eax
call fcn.00403a35
add esp, 0x10
cmp dword [0x42ae28], 0
je 0x40cd45
mov eax, dword [esi + 4]
cmp dword [eax + 4], 6
jle 0x40cd45
push dword [ebx]
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x40cd45
push 0x42ac20
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cd45
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x42ac20
push 0x4269b4
push edi
push 0x424924
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x20c]
mov ecx, esi
push 0
push eax
push edi
push dword [ebp + 8]
call fcn.0041030e
test eax, eax
jne 0x40cce5
lea ecx, [ebp - 4]
call fcn.00403e0f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebx]
push edi
call fcn.00414eca
mov dword [esi + 0x58], eax
mov eax, dword [esi + 4]
pop ecx
cmp dword [eax + 4], 9
pop ecx
jl 0x40cd45
and word [ebp - 0x414], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push str._s__tp:11__v:0
lea eax, [ebp - 0x414]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00414608
add esp, 0x1c
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0xa
push edi
call fcn.00411390
mov ecx, esi
call fcn.0040dc64
mov ecx, dword [esi + 4]
push 0xf
push edi
call fcn.00411390
mov ecx, esi
call fcn.0040deb0
mov ecx, dword [esi + 4]
push 0x19
push edi
call fcn.00411390
push edi
mov ecx, esi
call fcn.0040e1a5
lea ecx, [ebp - 4]
call fcn.00403e0f
push 1
pop eax
jmp 0x40ccde