Function at 0x49ea76
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push 0x878
mov eax, 0x51f44a
call fcn.004f21c7
mov dword [ebp - 4], 2
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x84c], eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x858]
push eax
mov esi, str.InstallCheck
push esi
mov ebx, str.software360TotalSecurityUserProfile
mov byte [ebp - 4], 3
and dword [ebp - 0x858], 0
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x848], 1
mov dword [ebp - 0x864], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49eaff
cmp dword [ebp - 0x858], 4
je 0x49eebf
push 4
lea eax, [ebp - 0x848]
push eax
push 4
push esi
push ebx
push edi
mov dword [ebp - 0x848], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x21c], ax
xor esi, esi
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.004e7380
add esp, 0xc
lea edi, [ebp - 0x844]
call fcn.0040457c
mov eax, dword [eax]
push str.Uninstall.exe
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 0x844]
add eax, 0xfffffff0
call fcn.0040557a
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x21c]
push eax
call edi
mov dword [ebp - 0x868], eax
xor eax, eax
push ebx
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push esi
push eax
call fcn.004e7380
add esp, 0xc
push 1
push 0x17
lea eax, [ebp - 0x834]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x840], eax
mov byte [ebp - 4], 4
push dword [ebp + 8]
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x840]
push 0x53c8fc
push eax
call fcn.00404568
add esp, 0x10
push dword [ebp - 0x840]
call edi
push str.IDS_UNINSTALL_SHORTCUT_PTAH
xor ecx, ecx
lea esi, [ebp - 0x840]
mov dword [ebp - 0x844], eax
call fcn.0042450a
cmp eax, 0xffffffff
je 0x49ec14
mov dword [ebp - 0x844], 1
xor eax, eax
push ebx
push eax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push eax
call fcn.004e7380
add esp, 0xc
lea edi, [ebp - 0x83c]
call fcn.0040457c
mov eax, dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x53d4c0
push eax
lea eax, [ebp - 0x62c]
push eax
call esi
mov eax, dword [ebp - 0x83c]
add eax, 0xfffffff0
call fcn.0040557a
xor eax, eax
push ebx
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
call fcn.004e7380
add esp, 0xc
lea edi, [ebp - 0x83c]
call fcn.0040457c
mov eax, dword [eax]
push 0x52f388
push eax
lea eax, [ebp - 0x424]
push eax
call esi
mov eax, dword [ebp - 0x83c]
add eax, 0xfffffff0
call fcn.0040557a
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push str.IDS_PRODUCT_TITLE
push dword [ebp + 0xc]
call fcn.004eac41
pop ecx
pop ecx
mov esi, 0x52f3e9
test eax, eax
jne 0x49ecd0
push esi
lea eax, [ebp + 0xc]
call fcn.0042360a
push str.IDS_PRODUCT_PUBLISHER
push dword [ebp + 0x10]
call fcn.004eac41
pop ecx
pop ecx
test eax, eax
jne 0x49ecec
push esi
lea eax, [ebp + 0x10]
call fcn.0042360a
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x83c]
push eax
call fcn.00405747
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x85c]
push eax
mov byte [ebp - 4], 5
call fcn.00405747
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x860]
push eax
mov byte [ebp - 4], 6
call fcn.00405747
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360TotalSecurity
lea eax, [ebp - 0x838]
push eax
mov byte [ebp - 4], 7
call fcn.00405747
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp + 0xc]
lea eax, [ebp - 0x838]
mov byte [ebp - 4], 8
call fcn.0040c63a
mov bl, al
mov eax, dword [ebp - 0x838]
add esp, 0x10
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x860]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x85c]
add eax, 0xfffffff0
call fcn.0040557a
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x83c]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x838], eax
xor edi, edi
push edi
mov byte [ebp - 4], 9
call fcn.004eb76c
pop ecx
push edx
push eax
xor eax, eax
test bl, bl
sete al
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x838]
push dword [ebp - 0x868]
push dword [0x5864cc]
push dword [0x5864c8]
push dword [0x5864c4]
push dword [0x5864c0]
push dword [0x5864bc]
push dword [0x5864b4]
push str.mid_sver_slan_sos_sch_ssch_senvtrayuninstall_exe_dsecurity_center_duninstall_registry_dtimestamp_I64d
push eax
call fcn.00404568
add esp, 0x34
lea edx, [ebp - 0x838]
lea ecx, [ebp - 0x850]
call fcn.0049e7b8
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x850]
cmp dword [eax - 0xc], edi
je 0x49ee9b
push esi
lea ecx, [ebp - 0x884]
call fcn.00405375
lea eax, [ebp - 0x884]
push eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0x850]
lea eax, [ebp - 0x854]
push eax
push 0x5864e0
call fcn.00410179
push edi
push 1
lea ecx, [ebp - 0x884]
call fcn.004051fe
push dword [ebp - 0x854]
call fcn.004b05f0
mov eax, dword [ebp - 0x854]
pop ecx
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x850]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x838]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x840]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x84c]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.0040557a
call fcn.004f224a
ret