Function at 0x40f880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x465944]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov dword [ebp - 0xc38], ebx
cmp ax, word [0x466dd8]
jne 0x40f962
mov dword [ebp - 0xc28], eax
lea eax, [ebp - 0xc28]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f94e
lea eax, [ebp - 0xc34]
mov dword [ebp - 0xc2c], 1
push eax
push 0x466dd8
lea eax, [ebp - 0xc2c]
mov dword [ebp - 0xc34], 0x208
push eax
push 0
push str.Path
push dword [ebp - 0xc28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x466dd8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f923
sub ecx, edx
sar ecx, 1
je 0x40f950
cmp word [ecx*2 + 0x466dd6], 0x5c
je 0x40f950
mov eax, 0x5c
mov word [ecx*2 + 0x466dd8], ax
jmp 0x40f950
xor ecx, ecx
cmp word [0x466dd8], 0
mov dword [0x466dd4], ecx
je 0x40f988
jmp 0x40f968
mov ecx, dword [0x466dd4]
push ecx
push 0x466dd8
push ebx
call fcn.00433b5a
add esp, 0xc
test eax, eax
jne 0x40f988
call fcn.004083f0
test eax, eax
jne 0x40fb5a
cmp dword [0x464964], 0
jne 0x40fb31
push 0x40e
lea eax, [ebp - 0x412]
push 0
push eax
call fcn.0042c930
mov esi, dword [0x4670d4]
xor eax, eax
add esp, 0xc
mov word [ebp - 0x414], ax
test esi, esi
je 0x40fb84
push 0x810
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.0042c930
add esp, 0xc
lea eax, [ebp - 0xc24]
push 0x404
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0xc24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.360Base.dll
lea eax, [ebp - 0xc24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0xc24]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fa12
sub ecx, edx
sar ecx, 1
cmp ecx, 0x100
jge 0x40fb84
push ecx
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0042f66a
add esp, 0x10
cmp word [ebp - 0x414], 0
je 0x40fb84
cmp word [ebp - 0x412], 0x3a
jne 0x40fb84
cmp dword [0x464960], 0
jne 0x40fb28
push 0x464948
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x464960], 0
jne 0x40fb1d
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004084f0
mov edi, eax
add esp, 4
mov ebx, 0x80004005
test edi, edi
je 0x40fb00
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitLibs
push edi
call esi
push str.CreateObject
push edi
mov dword [ebp - 0xc2c], eax
call esi
mov ecx, dword [ebp - 0xc2c]
mov dword [0x464540], eax
test ecx, ecx
je 0x40fb6f
push 0x464544
mov dword [0x464544], 0x100
call ecx
mov ebx, eax
test ebx, ebx
je 0x40fb79
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x46453c], 0
xor eax, eax
mov dword [0x464960], 1
test ebx, ebx
mov ebx, dword [ebp - 0xc38]
pop edi
sete al
mov dword [0x464964], eax
push 0x464948
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x464964], 0
je 0x40fb84
lea eax, [ebp - 0xc30]
mov dword [ebp - 0xc30], 0
push eax
push ebx
mov ecx, 0x464538
call fcn.00407bd0
test eax, eax
je 0x40fb84
cmp dword [ebp - 0xc30], 3
je 0x40fb84
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a853
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x40faef
xor ebx, ebx
mov dword [0x46453c], edi
jmp 0x40fb00
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a853
mov esp, ebp
pop ebp
ret