Function at 0x41afda
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x4cc
mov eax, 0x43e47f
call fcn.00429c87
xor eax, eax
push 0x206
mov word [ebp - 0x488], ax
xor ebx, ebx
lea eax, [ebp - 0x486]
push ebx
push eax
call fcn.004253c0
add esp, 0xc
push 0x104
lea edi, [ebp - 0x488]
mov eax, 0x4545b8
call fcn.00414625
push str.360ver
lea eax, [ebp - 0x494]
push eax
call fcn.00409ada
push str.0.0.0.0
lea eax, [ebp - 0x498]
push eax
mov dword [ebp - 4], ebx
call fcn.00409ada
lea eax, [ebp - 0x498]
push eax
lea esi, [ebp - 0x494]
mov byte [ebp - 4], 1
call fcn.0040abec
pop ecx
xor eax, eax
push 0x62
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push ebx
push eax
call fcn.004253c0
add esp, 0xc
push dword [0x4551f8]
lea edi, [ebp - 0x78]
push dword [0x4551f4]
push dword [0x4551f0]
push str._d._d_Build_d_
push 0x32
pop eax
call fcn.00409ded
push 0x24
lea eax, [ebp - 0x4d8]
push ebx
push eax
call fcn.004253c0
add esp, 0x1c
push 0x44334c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41b0cc
lea ecx, [ebp - 0x4d8]
push ecx
call eax
xor edi, edi
inc edi
jmp 0x41b0ce
xor edi, edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 4
pop eax
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x490]
push eax
push str.vdays
mov dword [ebp - 0x4ac], ebx
push str.SOFTWARE360Safe_stat
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call esi
and dword [ebp - 0x4a8], 0
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x490]
push eax
push str.vcount
push str.SOFTWARE360Safe_stat
push ebx
call esi
and dword [ebp - 0x4a0], 0
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x490]
push eax
push str.360safeuplib
push str.SOFTWARE360SafeLiveupUpdateTime
push ebx
call esi
push 0
call fcn.00427316
pop ecx
cdq
mov ecx, 0xe10
idiv ecx
push 0x18
pop ecx
xor edx, edx
and dword [ebp - 0x4b0], 0
sub eax, dword [ebp - 0x4a0]
div ecx
mov dword [ebp - 0x4b4], eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x490]
push eax
push str.update
push str.SOFTWARE360Safe_setting
push ebx
call esi
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x490]
push eax
push str.ForceUpdateLibs
push str.SOFTWARE360Safe_setting
push ebx
mov dword [ebp - 0x4a4], 1
call esi
cmp dword [ebp - 0x4b0], 3
mov dword [ebp - 0x49c], 1
jne 0x41b200
mov eax, dword [ebp - 0x4a4]
neg eax
sbb eax, eax
add eax, 3
mov dword [ebp - 0x49c], eax
movzx eax, word [0x455302]
push eax
movzx eax, word [0x455300]
push eax
call fcn.0041934a
push eax
push ecx
call fcn.0041af5b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x3c
pop ecx
xor edx, edx
div ecx
push eax
push ecx
call fcn.0041db9a
pop ecx
push eax
call fcn.0041ad29
push eax
push dword [ebp - 0x49c]
movzx eax, word [ebp - 0x4d8]
push dword [ebp - 0x4a8]
neg edi
push dword [ebp - 0x4ac]
sbb edi, edi
push dword [0x455314]
and edi, eax
push dword [ebp - 0x4b4]
lea eax, [ebp - 0x78]
push edi
push eax
push dword [ebp - 0x498]
push ecx
call fcn.00405833
pop ecx
push eax
mov eax, 0x4545b8
call fcn.00414873
push eax
lea eax, [ebp - 0x488]
push eax
push str.http:__s.360.cn_safe_tray.html_pid_suid_dmid_sver_ssysver_spa_dtypetraylt_due_dvdays_dvcount_dstatus_dh3_dm3_sst_dpt_dinstdays_dsp_d._d
mov eax, 0x800
mov edi, 0x453cd8
call fcn.00409ded
add esp, 0x4c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x280], ax
lea eax, [ebp - 0x27e]
push eax
call fcn.004253c0
add esp, 0xc
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x490]
push eax
push 0x4454d0
push str.Software360safeCoop
push ebx
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x48c], 0x208
call esi
mov esi, 0x800
test eax, eax
jne 0x41b325
push str.iPartner
mov eax, esi
mov ecx, edi
call fcn.00414e5b
lea eax, [ebp - 0x280]
push eax
mov eax, esi
mov ecx, edi
call fcn.00414e5b
push str.versrc
mov eax, esi
mov ecx, edi
call fcn.00414e5b
push dword [ebp - 0x494]
mov eax, esi
mov ecx, edi
call fcn.00414e5b
mov eax, dword [ebp - 0x498]
add eax, 0xfffffff0
call fcn.004054cf
mov eax, dword [ebp - 0x494]
add eax, 0xfffffff0
call fcn.004054cf
call fcn.00429d0a
ret