Function at 0x40a400
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x473cc9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], eax
lea esi, [edi + 0x24]
mov dword [esp + 0x24], ebx
call fcn.0045bd50
mov byte [esp + 0x24], 1
mov dword [edi + 0x90], vtable.WTL::CMessageFilter.0
mov dword [edi], vtable.CLeakSettingWnd.0
mov dword [esi], vtable.CLeakSettingWnd.1.0
mov dword [edi + 0x90], vtable.CLeakSettingWnd.2.0
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [edi + 0x94], eax
mov byte [esp + 0x24], 2
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [edi + 0x98], eax
mov byte [esp + 0x24], 3
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [edi + 0x9c], eax
mov byte [esp + 0x24], 4
mov dword [edi + 0x2ac], ebx
mov dword [edi + 0x2b0], ebx
mov dword [edi + 0x2b4], ebx
mov dword [edi + 0x2b8], ebx
mov dword [edi + 0x2bc], ebx
mov dword [edi + 0x2c0], ebx
mov dword [edi + 0x2c4], ebx
mov dword [edi + 0x2c8], ebx
mov dword [edi + 0x2cc], ebx
mov dword [edi + 0x2dc], ebx
mov dword [edi + 0x2d4], ebx
mov dword [edi + method.CSomWndTipImpl_class_CSomButton3_.virtual_0], vtable.CSomWndTipImpl_class_CSomButton3_.0
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [edi + 0x2e0], eax
lea ecx, [edi + 0x2e4]
push ecx
mov byte [esp + 0x28], 5
call fcn.004563e0
lea edx, [edi + 0x334]
mov byte [esp + 0x24], 6
push edx
mov dword [edi + 0x330], ebx
call fcn.004563e0
lea eax, [edi + 0x380]
push eax
mov byte [esp + 0x28], 7
call fcn.004563e0
lea ecx, [edi + 0x3cc]
push ecx
mov byte [esp + 0x28], 8
call fcn.004563e0
lea edx, [edi + 0x418]
push edx
mov byte [esp + 0x28], 9
call fcn.004563e0
lea eax, [edi + 0x464]
push eax
mov byte [esp + 0x28], 0xa
call fcn.004563e0
lea ecx, [edi + 0x4b0]
push ecx
mov byte [esp + 0x28], 0xb
call fcn.004563e0
lea edx, [edi + 0x4fc]
push edx
mov byte [esp + 0x28], 0xc
call fcn.004563e0
lea esi, [edi + 0x548]
push 1
mov ecx, 0x491b60
call fcn.00450550
mov dword [esi], vtable.CLFRadioBox.0
lea esi, [edi + 0x590]
push 1
mov ecx, 0x491b60
call fcn.00450550
mov dword [esi], vtable.CLFRadioBox.0
lea esi, [edi + 0x5d8]
push 1
mov ecx, 0x491b60
call fcn.00450550
mov dword [esi], vtable.CLFRadioBox.0
lea esi, [edi + 0x620]
push 1
mov ecx, 0x491b60
call fcn.00450550
mov dword [esi], vtable.CLFRadioBox.0
lea esi, [edi + 0x668]
push 1
mov ecx, 0x491b60
call fcn.00450550
mov dword [esi], vtable.CLFRadioBox.0
lea esi, [edi + 0x6b0]
push 1
mov ecx, 0x491b60
call fcn.00450550
mov dword [esi], vtable.CLFRadioBox.0
lea esi, [edi + 0x6f8]
push 1
mov ecx, 0x491b60
call fcn.00450550
mov dword [esi], vtable.CLFRadioBox.0
lea esi, [edi + 0x740]
push ebx
mov ecx, 0x491b48
call fcn.00450550
mov dword [esi], vtable.CLFCheckBox.0
lea esi, [edi + 0x788]
push ebx
mov ecx, 0x491b48
call fcn.00450550
mov dword [esi], vtable.CLFCheckBox.0
lea esi, [edi + 0x7d0]
push ebx
mov ecx, 0x491b48
call fcn.00450550
mov dword [esi], vtable.CLFCheckBox.0
mov dword [edi + 0x81c], ebx
mov dword [edi + 0x820], ebx
mov dword [edi + 0x824], ebx
mov dword [edi + 0x828], ebx
mov dword [edi + 0x82c], ebx
mov dword [edi + 0x830], ebx
mov esi, vtable.CSomButton4.0
mov dword [edi + 0x834], ebx
mov dword [edi + 0x838], ebx
mov dword [edi + 0x83c], ebx
mov dword [edi + 0x818], esi
mov ecx, 0x48e57c
mov eax, dword [0x48e57c]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [edi + 0x844], eax
mov dword [edi + 0x850], ebx
mov dword [edi + 0x848], ebx
mov dword [edi + 0x85c], ebx
mov dword [edi + 0x860], ebx
mov dword [edi + 0x864], ebx
mov dword [edi + 0x868], ebx
mov dword [edi + 0x86c], ebx
mov dword [edi + 0x870], ebx
mov dword [edi + 0x874], ebx
mov dword [edi + 0x878], ebx
mov dword [edi + 0x87c], ebx
mov dword [edi + 0x858], esi
mov eax, dword [0x48e57c]
mov edx, dword [eax + 0xc]
mov ecx, 0x48e57c
call edx
add eax, 0x10
mov dword [edi + 0x884], eax
mov dword [edi + 0x890], ebx
mov dword [edi + 0x888], ebx
mov dword [edi + 0x89c], ebx
mov dword [edi + 0x8a0], ebx
mov dword [edi + 0x8a4], ebx
mov dword [edi + 0x8a8], ebx
mov dword [edi + 0x8ac], ebx
mov dword [edi + 0x8b0], ebx
mov dword [edi + 0x8b4], ebx
mov dword [edi + 0x8b8], ebx
mov dword [edi + 0x8bc], ebx
mov dword [edi + 0x898], esi
mov eax, dword [0x48e57c]
mov edx, dword [eax + 0xc]
mov ecx, 0x48e57c
call edx
add eax, 0x10
mov dword [edi + 0x8c4], eax
mov dword [edi + 0x8d0], ebx
mov dword [edi + 0x8c8], ebx
mov dword [edi + 0x8dc], ebx
mov dword [edi + 0x8e0], ebx
mov dword [edi + 0x8e4], ebx
mov dword [edi + 0x8e8], ebx
mov dword [edi + 0x8ec], ebx
mov dword [edi + 0x8f0], ebx
mov dword [edi + 0x8f4], ebx
mov dword [edi + 0x8f8], ebx
mov dword [edi + 0x8fc], ebx
mov dword [edi + 0x8d8], esi
mov eax, dword [0x48e57c]
mov edx, dword [eax + 0xc]
mov ecx, 0x48e57c
call edx
add eax, 0x10
mov dword [edi + 0x904], eax
mov dword [edi + 0x910], ebx
mov dword [edi + 0x908], ebx
mov dword [edi + 0x918], ebx
mov dword [edi + 0x91c], ebx
mov dword [edi + 0x924], ebx
mov dword [edi + 0x928], ebx
mov dword [edi + 0x92c], ebx
mov dword [edi + 0x930], ebx
mov dword [edi + 0x934], ebx
mov dword [edi + 0x938], ebx
push 0x208
lea esi, [edi + 0xa0]
push ebx
push esi
mov dword [edi + 0x93c], ebx
mov dword [edi + 0x940], ebx
mov dword [edi + 0x944], ebx
mov dword [edi + 0x920], 0x47ceac
mov dword [edi + 0x948], ebx
mov dword [edi + 0x94c], ebx
call fcn.00462160
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push SysReAllocStringLen
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40a8d9
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4