Function at 0x40a9e6
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16ec
call fcn.0050d9b0
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x1046
mov word [ebp - 0x16e4], ax
lea eax, [ebp - 0x16e2]
push ebx
push eax
call fcn.005091d0
push 0x7f
lea eax, [ebp - 0x83]
mov byte [ebp - 0x84], bl
push ebx
push eax
call fcn.005091d0
lea ecx, [ebp - 0x84]
call fcn.00465840
xor eax, eax
mov dword [ebp - 0x16e8], 1
mov esi, 0x206
mov word [ebp - 0x28c], ax
push esi
lea eax, [ebp - 0x28a]
push ebx
push eax
call fcn.005091d0
add esp, 0x24
mov dword [ebp - 0x16ec], esi
lea eax, [ebp - 0x16ec]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x16e8]
push eax
push 0x5401cc
push str.Software360360se6chrome
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp ax, word [ebp - 0x28c]
jne 0x40aabf
push 0x54020c
push 0x53fe20
lea eax, [ebp - 0x28c]
push 0x103
push eax
call fcn.005028f6
add esp, 0x10
cmp dword [0x5c92f0], 0x10
mov esi, dword [0x5c92dc]
jae 0x40aad3
mov esi, 0x5c92dc
test esi, esi
je 0x40aaf0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40aadc
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x40aaf4
mov edi, ebx
jmp 0x40ab0a
lea eax, [edi + edi]
call fcn.00512570
mov ecx, esp
mov edx, esi
push 3
push edi
call fcn.00409a99
mov edi, eax
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ab13
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jg 0x40ab41
lea eax, [esi + esi]
call fcn.00512570
mov ecx, esp
lea edx, [ebp - 0x84]
push 3
push esi
call fcn.00409a99
mov ebx, eax
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ab4a
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x40ab62
xor eax, eax
jmp 0x40ab7a
lea eax, [esi + esi]
call fcn.00512570
mov ecx, esp
lea edx, [ebp - 0x84]
push 3
push esi
call fcn.00409a99
lea ecx, [ebp - 0x28c]
push ecx
push edi
push ebx
push 0x5d7600
push 0x5d7e20
push 0x5d73f8
push 0x5d71e8
push 0x5d8848
push 0x5d7c18
mov ecx, 0x5d8230
xor ebx, ebx
push ecx
push 0x5d8c58
push ebx
push ebx
push ecx
push eax
push str.http:__pvstat.qihoo.com_dimana.gif__pdt360se6bq_dim_kpid__guid__ver_dim_v360se6___s___sm_dmts_diname_sifver_simod_simodver_sicode_sioff_sios_siie_smid_spt_spid_s
lea eax, [ebp - 0x16e4]
push 0x823
push eax
call fcn.005028f6
add esp, 0x48
lea eax, [ebp - 0x16e4]
mov esi, 0x5da878
mov ecx, esi
push eax
call fcn.00409b00
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x69c], ax
lea eax, [ebp - 0x69a]
push ebx
push eax
call fcn.005091d0
xor eax, eax
push edi
mov word [ebp - 0x494], ax
lea eax, [ebp - 0x492]
push ebx
push eax
call fcn.005091d0
add esp, 0x18
lea eax, [ebp - 0x69c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x5401c4
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x494]
mov ecx, esi
push eax
call fcn.00409b32
mov ecx, esi
mov dword [0x5dcce0], 1
mov dword [0x5dcf20], 0x1388
call fcn.0040cea1
mov ecx, esi
call fcn.0040d1b0
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.0040cf50
lea esp, [ebp - 0x16f8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501d03
mov esp, ebp
pop ebp
ret