Function at 0x43d6d0
Capabilities:
Check if file exists
Delete registry value
Get file size
Read file on windows
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472aae
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0x4c0], eax
push ebx
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x4d8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], 3
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43eb30
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x44], edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x120089
push esi
mov dword [esp + 0x4fc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x43d7ef
push ebx
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea edx, [esi + 1]
push edx
call fcn.0045e006
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43d7e2
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x2c]
push eax
push esi
push ebx
push ecx
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x43d7d9
mov byte [ebx + esi], 0
mov eax, ebx
test esi, esi
jle 0x43d7cc
lea ecx, [ecx]
mov dl, byte [eax]
not dl
mov byte [eax], dl
dec esi
inc eax
test esi, esi
jg 0x43d7c0
lea eax, [esp + 0x44]
call fcn.0043bbe0
mov edi, dword [esp + 0x44]
push ebx
call fcn.00461608
add esp, 4
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [edi - 0xc], ebx
jne 0x43d824
add edi, 0xfffffff0
mov dword [esp + 0x4e0], 0xffffffff
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43eb30
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
jmp 0x43eb30
mov dword [esp + 0x38], ebx
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x4e4], 1
call fcn.004384e0
mov esi, dword [esp + 0x3c]
add esp, 4
test eax, eax
jl 0x43eaf9
cmp esi, ebx
je 0x43eaf9
push str._xml_
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, ebx
jne 0x43d86e
mov byte [esp + 0x4e0], 0
jmp 0x43eb05
lea edx, [esp + 0x78]
push edx
mov dword [esp + 0x7c], ebx
mov ecx, dword [esi]
push eax
mov eax, dword [ecx + 0x104]
push esi
call eax
test eax, eax
jl 0x43eacc
cmp word [esp + 0x78], bx
je 0x43eacc
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x40], eax
mov eax, 0x47cb48
lea esi, [esp + 0x14]
mov byte [esp + 0x4e0], 4
call fcn.0043c5d0
mov byte [esp + 0x4e0], 5
mov eax, dword [eax]
mov edi, dword [esp + 0x38]
mov ecx, dword [edi]
lea edx, [esp + 0x4c]
push edx
push eax
mov eax, dword [ecx + 0x94]
mov ebx, 1
push edi
mov dword [esp + 0x38], ebx
call eax
test eax, eax
jl 0x43d938
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x43d938
mov ebx, eax
mov eax, str.params
lea esi, [esp + 0x28]
call fcn.0043c5d0
mov dword [esp + 0x4e0], 6
mov eax, dword [eax]
mov ecx, dword [ebx]
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ecx + 0x94]
push ebx
mov dword [esp + 0x38], 3
call eax
mov ebx, dword [esp + 0x2c]
test eax, eax
jl 0x43d938
cmp dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
jne 0x43d93d
mov byte [esp + 0x1b], 1
test bl, 2
je 0x43d950
mov ecx, dword [esp + 0x28]
push ecx
and ebx, 0xfffffffd
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esp + 0x4e0], 4
test bl, 1
je 0x43d96e
mov edx, dword [esp + 0x14]
push edx
and ebx, 0xfffffffe
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 0x1b], 0
je 0x43d9db
mov byte [esp + 0x4e0], 3
mov eax, dword [esp + 0x40]
test eax, eax
je 0x43d98d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4e0], 2
mov eax, dword [esp + 0x24]
test eax, eax
je 0x43d9a5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4e0], 1
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x43d9bd
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4e0], 0
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
lea eax, [esp + 0x44]
call fcn.004568e0
jmp 0x43eb30
mov eax, dword [esp + 0x1c]
add eax, 0xc60
mov dword [esp + 0x14], eax
call fcn.004387e0
lea edx, [esp + 0xa4]
push edx
call fcn.004442c0
mov dword [esp + 0x48], 0
mov byte [esp + 0x4e0], 8
mov edi, dword [esp + 0x24]
mov eax, str.specialhotfix
lea esi, [esp + 0x28]
call fcn.0043c5d0
mov byte [esp + 0x4e0], 9
mov eax, dword [eax]
mov ecx, dword [edi]
lea edx, [esp + 0x48]
push edx
push eax
mov eax, dword [ecx + 0x94]
or ebx, 4
push edi
mov dword [esp + 0x38], ebx
call eax
test eax, eax
jl 0x43da4e
cmp dword [esp + 0x48], 0
mov byte [esp + 0x1b], 1
jne 0x43da53
mov byte [esp + 0x1b], 0
mov dword [esp + 0x4e0], 8
test bl, 4
je 0x43da75
mov ecx, dword [esp + 0x28]
and ebx, 0xfffffffb
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 0x1b], 0
je 0x43da8e
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00438e70
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0xa8]
push edx
call fcn.004391a0
lea eax, [esp + 0x54]
push eax
call fcn.0042a060
lea ecx, [esp + 0x24]
push ecx
lea esi, [esp + 0x58]
mov byte [esp + 0x4e4], 0xa
call fcn.0043d480
test eax, eax
je 0x43ea33
lea edx, [esp + 0x3c]
push edx
mov ecx, str.date
call fcn.00454940
lea ebx, [esp + 0x3c]
mov edi, esi
mov byte [esp + 0x4e0], 0xb
call fcn.0043d330
mov eax, dword [eax]
sub eax, 0x10
call fcn.00452ce0
lea esi, [eax + 0x10]
mov dword [esp + 0x28], esi
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
cmp dword [esi - 0xc], 0
jle 0x43ea1a
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push str.LastDiffDate
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.balloon
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0xe
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43dbb6
lea eax, [esp + 0x10]
push eax
mov ecx, str.balloon
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0xf
call fcn.0043d330
mov eax, dword [eax]
push eax
call fcn.00461172
mov esi, dword [esp + 0x20]
mov dword [esi + 0xc54], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
jmp 0x43dbba
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.autotopmost
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x10
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43dc3c
lea eax, [esp + 0x10]
push eax
mov ecx, str.autotopmost
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x11
call fcn.0043d330
mov eax, dword [eax]
push eax
call fcn.00461172
mov dword [esi + 0xc4c], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.autofix
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x12
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43dcda
lea eax, [esp + 0x10]
push eax
mov ecx, str.autofix
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x13
call fcn.0043d330
mov eax, dword [eax]
push eax
call fcn.00461172
mov dword [esi + 0xc50], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
cmp dword [esi + 0x630], 0
je 0x43dcda
cmp dword [esi + 0xc50], 0
je 0x43dcda
mov dword [esi + 0x628], 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.examinscan
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x14
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43dd7a
lea eax, [esp + 0x10]
push eax
mov ecx, str.examinscan
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x15
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc5c]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
push 4
push edi
push 4
push str.examinscan
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43dd99
push str.examinscan
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esi + 0xc5c], 1
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.poprate
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x16
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43de39
lea eax, [esp + 0x10]
push eax
mov ecx, str.poprate
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x17
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc9c]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
push 4
push edi
push 4
push str.poprate
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43de4e
push str.poprate
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.c_poprate
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x18
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43deee
lea eax, [esp + 0x10]
push eax
mov ecx, str.c_poprate
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x19
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xca0]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
push 4
push edi
push 4
push str.c_poprate
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43df03
push str.c_poprate
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.autofixtip
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x1a
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43dfa3
lea eax, [esp + 0x10]
push eax
mov ecx, str.autofixtip
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x1b
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc80]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
push 4
push edi
push 4
push str.autofixtip
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43dfc2
push str.autofixtip
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esi + 0xc80], 0
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.popwidth
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x1c
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43e078
lea eax, [esp + 0x10]
push eax
mov ecx, str.popwidth
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x1d
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc88]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
mov eax, dword [edi]
cmp eax, 0x3e8
ja 0x43e056
cmp eax, 0x17d
jae 0x43e05c
mov dword [edi], 0x17d
push 4
push edi
push 4
push str.popwidth
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43e097
push str.popwidth
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov dword [esi + 0xc88], 0x17d
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.popheight
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x1e
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43e14d
lea eax, [esp + 0x10]
push eax
mov ecx, str.popheight
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x1f
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc8c]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
mov eax, dword [edi]
cmp eax, 0x3e8
ja 0x43e12b
cmp eax, 0x1a9
jae 0x43e131
mov dword [edi], 0x1a9
push 4
push edi
push 4
push str.popheight
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43e16c
push str.popheight
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov dword [esi + 0xc8c], 0x1a9
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.poppos
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x20
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43e21e
lea eax, [esp + 0x10]
push eax
mov ecx, str.poppos
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x21
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc90]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
mov eax, dword [edi]
cmp eax, 1
jge 0x43e202
cmp eax, 5
jle 0x43e202
mov dword [edi], 1
push 4
push edi
push 4
push str.poppos
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43e23d
push str.poppos
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov dword [esi + 0xc90], 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.edgedistx
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x22
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43e2e8
lea eax, [esp + 0x10]
push eax
mov ecx, str.edgedistx
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x23
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc94]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
cmp dword [edi], 0x32
jbe 0x43e2cc
mov dword [edi], 5
push 4
push edi
push 4
push str.edgedistx
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43e307
push str.edgedistx
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov dword [esi + 0xc94], 5
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.edgedisty
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x24
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43e3b2
lea eax, [esp + 0x10]
push eax
mov ecx, str.edgedisty
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x25
call fcn.0043d330
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc98]
call fcn.00461172
mov dword [edi], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
cmp dword [edi], 0x32
jbe 0x43e396
mov dword [edi], 5
push 4
push edi
push 4
push str.edgedisty
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x43e3d1
push str.edgedisty
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov dword [esi + 0xc98], 5
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.pday_s
call fcn.00454940
lea ebx, [esp + 0x10]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x26
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x10]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43e49f
lea eax, [esp + 0x14]
push eax
mov ecx, str.pday_s
call fcn.00454940
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.pday_s
mov byte [esp + 0x4e4], 0x27
call fcn.00454940
lea ebx, [esp + 0x14]
mov byte [esp + 0x4e0], 0x28
call fcn.0043d330
mov edx, dword [eax]
lea ebx, [esp + 0x10]
mov dword [esp + 0x34], edx
call fcn.0043d330
mov edi, dword [eax]
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push str.pday_s
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, ebx
call fcn.004568e0
lea eax, [esp + 0x14]
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
jmp 0x43e4b4
push str.pday_s
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.topmostproc_s
call fcn.00454940
lea ebx, [esp + 0x14]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x29
call fcn.0043d330
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
lea eax, [esp + 0x14]
setg bl
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
test bl, bl
je 0x43e5d8
lea eax, [esp + 0x10]
push eax
mov ecx, str.topmostproc_s
call fcn.00454940
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.topmostproc_s
mov byte [esp + 0x4e4], 0x2a
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x2b
call fcn.0043d330
mov esi, dword [eax]
lea ebx, [esp + 0x14]
call fcn.0043d330
mov edi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push str.topmostproc_s
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, ebx
call fcn.004568e0
lea eax, [esp + 0x10]
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
lea edx, [esp + 0x14]
push edx
mov ecx, str.topmostproc_s
call fcn.00454940
lea ebx, [esp + 0x14]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x2c
call fcn.0043d330
mov eax, dword [eax]
lea ecx, [esp + 0x34]
push ecx
mov esi, eax
call fcn.0043bc60
mov byte [esp + 0x4e0], 0x2d
mov eax, dword [eax]
mov ecx, dword [esp + 0x1c]
push eax
call fcn.00439940
lea eax, [esp + 0x34]
call fcn.004568e0
mov eax, ebx
mov byte [esp + 0x4e0], 0xd
call fcn.004568e0
jmp 0x43e5f6
push 0
mov ecx, esi
call fcn.00439940
push str.topmostproc_s
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea edx, [esp + 0x14]
push edx
mov ecx, str.cptinst_s
call fcn.00454940
lea ebx, [esp + 0x14]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x2e
call fcn.0043d330
mov eax, dword [eax]
lea ecx, [esp + 0x74]
push ecx
mov esi, eax
call fcn.0043bc60
mov eax, ebx
mov byte [esp + 0x4e0], 0x30
call fcn.004568e0
lea edx, [esp + 0x10]
push edx
mov ecx, str.cptproc_s
call fcn.00454940
lea ebx, [esp + 0x10]
mov byte [esp + 0x4e0], 0x31
call fcn.0043d330
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
mov esi, eax
call fcn.0043bc60
mov eax, ebx
mov byte [esp + 0x4e0], 0x33
call fcn.004568e0
mov eax, dword [esp + 0x74]
mov esi, 1
mov dword [esp + 0x50], esi
cmp dword [eax - 0xc], 0
jne 0x43e69d
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], 0
jne 0x43e69d
mov eax, dword [esp + 0x1c]
mov dword [eax + 0xc58], esi
jmp 0x43e6c4
push eax
call fcn.0043bdd0
test eax, eax
jne 0x43e6ba
mov ecx, dword [esp + 0x20]
call fcn.0043c220
test eax, eax
jne 0x43e6ba
mov dword [esp + 0x50], eax
jmp 0x43e6c8
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 0xc58], esi
mov dword [esp + 0x50], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea edx, [esp + 0x54]
push edx
push 4
push 0x47c610
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call esi
lea eax, [esp + 0x14]
push eax
mov ecx, str.sendlevel
call fcn.00454940
lea ebx, [esp + 0x14]
lea edi, [esp + 0x54]
mov byte [esp + 0x4e0], 0x34
call fcn.0043d330
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
lea eax, [esp + 0x14]
setg bl
mov byte [esp + 0x4e0], 0x33
call fcn.004568e0
test bl, bl
je 0x43e785
lea edx, [esp + 0x14]
push edx
mov ecx, str.sendlevel
call fcn.00454940
lea ebx, [esp + 0x14]
mov byte [esp + 0x4e0], 0x35
call fcn.0043d330
mov eax, dword [eax]
push eax
call fcn.00461172
mov dword [0x48ccfc], eax
add esp, 4
mov eax, ebx
mov byte [esp + 0x4e0], 0x33
call fcn.004568e0
push 4
push 0x48ccfc
push 4
push str.sendlevel
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call esi
jmp 0x43e79a
push str.sendlevel
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, dword [esp + 0x24]
mov eax, str.safel
lea esi, [esp + 0x34]
mov dword [esp + 0x3c], 0
call fcn.0043c5d0
mov byte [esp + 0x4e0], 0x36
mov eax, dword [eax]
mov ecx, dword [edi]
or dword [esp + 0x2c], 8
lea edx, [esp + 0x40]
push edx
push eax
mov eax, dword [ecx + 0x94]
push edi
call eax
test eax, eax
jl 0x43e7e3
cmp dword [esp + 0x40], 0
je 0x43e7e3
xor bl, bl
jmp 0x43e7e5
mov bl, 1
mov dword [esp + 0x4e0], 0x33
test byte [esp + 0x2c], 8
je 0x43e802
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test bl, bl
je 0x43e8c5
lea eax, [esp + 0x20]
call fcn.004568e0
lea eax, [esp + 0x74]
call fcn.004568e0
lea eax, [esp + 0x28]
call fcn.004568e0
lea edx, [esp + 0x54]
push edx
mov byte [esp + 0x4e4], 8
call fcn.0043ca50
mov byte [esp + 0x4e0], 7
mov eax, dword [esp + 0x48]
test eax, eax
je 0x43e84f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea esi, [esp + 0xa4]
call fcn.00440f60
mov byte [esp + 0x4e0], 3
mov eax, dword [esp + 0x40]
test eax, eax
je 0x43e873
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4e0], 2
mov eax, dword [esp + 0x24]
test eax, eax
je 0x43e88b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4e0], 1
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x43e8a3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4e0], 0
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x44]
call fcn.004568e0
jmp 0x43eb30
lea eax, [esp + 0x84]
push eax
call fcn.0042a060
lea ecx, [esp + 0x40]
push ecx
lea esi, [esp + 0x88]
mov byte [esp + 0x4e4], 0x37
call fcn.0043d480
test eax, eax
je 0x43e9f1
cmp dword [esp + 0xa0], 0
jle 0x43e9f1
mov edx, dword [esp + 0x9c]
mov eax, dword [edx]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
mov bl, 0x38
jmp 0x43e920
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x84]
lea esi, [esp + 0x7c]
lea edi, [esp + 0x2c]
mov dword [esp + 0x80], edx
mov dword [esp + 0x7c], eax
call fcn.0043d680
test al, al
je 0x43e9f1
mov esi, edi
call fcn.0043d6a0
mov eax, dword [eax]
sub eax, 0x10
call fcn.00452ce0
lea edi, [eax + 0x10]
mov dword [esp + 0x1c], edi
mov byte [esp + 0x4e0], bl
call fcn.0043d6a0
add eax, 4
mov eax, dword [eax]
sub eax, 0x10
call fcn.00452ce0
push 0x47cc1c
lea esi, [eax + 0x10]
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x43e9a2
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax]
push ecx
push esi
push 1
jmp 0x43e9b8
push esi
call fcn.00461172
add esp, 4
push 4
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], eax
push 4
push edi
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [esp + 0x14]
call fcn.004568e0
lea eax, [esp + 0x1c]
mov byte [esp + 0x4e0], 0x37
call fcn.004568e0
lea esi, [esp + 0x2c]
call fcn.004434b0
jmp 0x43e920
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x4e4], 0x33
call fcn.0043ca50
lea eax, [esp + 0x20]
call fcn.004568e0
lea eax, [esp + 0x74]
call fcn.004568e0
jmp 0x43ea22
mov dword [esp + 0x3c], 1
lea eax, [esp + 0x28]
mov byte [esp + 0x4e0], 0xa
call fcn.004568e0
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.0044e820
test eax, eax
jne 0x43ea99
lea esi, [esp + 0xbc]
call fcn.00440480
mov eax, esi
call fcn.0044b420
push str.aiRestore
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call edi
push str.aiRestore0
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call edi
push str.aiBackup
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call edi
push str.lastreboottime
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call edi
lea ecx, [esp + 0x54]
push ecx
mov byte [esp + 0x4e4], 8
call fcn.0043ca50
mov byte [esp + 0x4e0], 7
mov eax, dword [esp + 0x48]
test eax, eax
je 0x43e84f
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x43e84f
mov byte [esp + 0x4e0], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
add edi, 0xfffffff0
mov dword [esp + 0x4e0], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jmp 0x43eb24
mov byte [esp + 0x4e0], 0
cmp esi, ebx
je 0x43eb0d
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
mov dword [esp + 0x4e0], ecx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43eb30
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x4d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c0]
xor ecx, esp
call fcn.00460259
mov esp, ebp
pop ebp
ret 4