Function at 0x499eac
Capabilities:
Delete registry value
Persist via app paths registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push 0xec
mov eax, 0x4e7677
call fcn.004b5257
mov edi, ecx
mov dword [ebp - 0xa4], edi
sub edi, 0xffffff80
push edi
call fcn.0049621b
mov dword [esp], 0x501294
push edi
call fcn.004962d8
push str.safemonQHSafeTray.exe
push edi
call fcn.004962d8
add esp, 0x10
xor ebx, ebx
push ebx
push str.QHSafeMain.exe
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.00445250
add esp, 0xc
mov dword [ebp - 4], ebx
push dword [eax]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push 0x50ea0c
call fcn.0044bc85
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
call fcn.0044bc85
mov byte [ebp - 4], 2
mov esi, 0x80000002
push esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 3
push eax
call fcn.0043ea28
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0040d610
push ebx
push dword [edi]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.Path
call fcn.0044bc85
push 4
pop edi
mov dword [ebp - 4], edi
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
call fcn.0044bc85
mov byte [ebp - 4], 5
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 6
push eax
call fcn.0043ea28
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
call fcn.0043c47e
test al, al
jne 0x49a02d
push 1
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.i18n
call fcn.0044bc85
mov dword [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.SYSTEMCurrentControlSet_services360SelfProtection
call fcn.0044bc85
mov byte [ebp - 4], 8
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 9
push eax
call fcn.0043ea52
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
lea eax, [ebp - 0x88]
push eax
push str.software360TotalSecurity
push esi
mov dword [ebp - 0x88], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x49a05c
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x88], ebx
lea ecx, [ebp - 0x8c]
call fcn.004413bb
mov dword [ebp - 4], 0xa
push str.UserProfile
push str.software360TotalSecurity
lea eax, [ebp - 0x8c]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
push str.MaskFlags
push dword [ebp - 0x8c]
mov dword [ebp - 0x84], 1
push esi
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x94], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x49a0d5
cmp dword [ebp - 0x9c], edi
je 0x49a0fa
push edi
lea eax, [ebp - 0x84]
push eax
push edi
push str.MaskFlags
push dword [ebp - 0x8c]
mov dword [ebp - 0x84], 1
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.0044209e
cmp byte [0x53fe3d], 0
je 0x49a1e9
lea eax, [ebp - 0x94]
push eax
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.ShowTipsValue
mov dword [ebp - 0x94], ebx
call fcn.0044bc85
mov dword [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
mov edi, str.SOFTWARE360TotalSecurityExperience
push edi
call fcn.0044bc85
mov byte [ebp - 4], 0xc
push 0x80000001
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0xd
push eax
call fcn.0043e957
pop ecx
pop ecx
mov dword [ebp - 0x94], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
cmp dword [ebp - 0x94], ebx
je 0x49a1e9
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.ShowTipsValue
call fcn.0044bc85
mov dword [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push edi
call fcn.0044bc85
mov byte [ebp - 4], 0xf
push 0x80000001
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0x10
push eax
call fcn.0043ea6a
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
call fcn.0043a989
test al, al
jne 0x49a229
lea ecx, [ebp - 0x98]
call fcn.00439d70
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0x98]
call fcn.0044dba1
lea ecx, [ebp - 0x98]
call fcn.0044dad1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00481762
push ebx
call fcn.004b5d2c
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ecx
push 8
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xb0]
push eax
push 0xb
push str.insttime
push str.SOFTWARE360SafeCoop
push esi
mov dword [ebp - 0xac], edx
call edi
mov ecx, dword [ebp - 0xa4]
call fcn.004983f4
cmp byte [0x53fe3c], 0
jne 0x49a829
lea eax, [ebp - 0x88]
push eax
push str.software360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x88], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x49a2a1
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x88], ebx
lea ecx, [ebp - 0x8c]
call fcn.0040c7d0
mov dword [ebp - 4], 0x12
push dword [ebp - 0xac]
lea eax, [ebp - 0x8c]
push dword [ebp - 0xb0]
push str._I64d
push eax
call fcn.0040e3f0
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ecx - 0xc]
add esp, 0x10
add eax, eax
push eax
push ecx
push 1
push str.InstallDate
push str.software360TotalSecurityUserProfile
push esi
call edi
push str.ReInstall
push str.SOFTWARE360TotalSecurityUserProfile
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.0040d610
lea ecx, [ebp - 0xdc]
call fcn.00475e3d
mov dword [ebp - 4], 0x13
push 1
lea eax, [ebp - 0xdc]
push 1
push eax
call fcn.004676f4
add esp, 0xc
cmp dword [ebp - 0xc4], ebx
je 0x49a349
mov eax, dword [ebp - 0xa4]
mov byte [eax + 0x49c], 1
mov eax, dword [0x53fe40]
mov ecx, dword [ebp - 0xa4]
push eax
mov dword [ebp - 0x88], eax
call fcn.0049537f
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], ebx
push eax
mov ebx, str.SOFTWARE360TotalSecurityActiveProtection
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x49a397
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x8c], 0
push 4
lea eax, [ebp - 0x88]
push eax
push 4
push str.mode
push ebx
push esi
call edi
mov eax, dword [ebp - 0x88]
cmp eax, 1
je 0x49a409
test eax, eax
je 0x49a409
cmp eax, 0xfe
jne 0x49a3d7
push dword [0x53fe30]
mov ecx, dword [ebp - 0xa4]
call fcn.00493833
jmp 0x49a49e
cmp eax, 2
jne 0x49a49e
cmp byte [0x53fe55], 0
je 0x49a49e
and dword [ebp - 0x94], 0
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.ExtFlags
jmp 0x49a49a
lea eax, [ebp - 0x8c]
push eax
mov ebx, str.SOFTWARE360Safe_filemon
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x49a434
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x8c], 0
and dword [ebp - 0x84], 0
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.AVEnable
push ebx
push esi
call edi
cmp dword [ebp - 0x88], 1
jne 0x49a49e
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.AVReadProtectEnable
push ebx
push esi
call edi
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.AVWriteProtectEnable
push ebx
push esi
call edi
push 4
lea eax, [ebp - 0x84]
push eax
push 4
mov dword [ebp - 0x84], 1
push str.Level
push ebx
push esi
call edi
cmp byte [0x53fe3d], 0
jne 0x49a64d
mov byte [ebp - 0x8d], 1
call fcn.0043a56b
test al, al
je 0x49a63a
push str.privacy_link
lea eax, [ebp - 0x94]
mov ebx, 0x53fda0
push eax
mov ecx, ebx
call fcn.0047d67a
mov byte [ebp - 4], 0x14
push dword [eax]
lea ecx, [ebp - 0x64]
call fcn.0042b420
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x94]
call fcn.0040d610
push str.license_link
lea eax, [ebp - 0x94]
push eax
mov ecx, ebx
call fcn.0047d67a
mov byte [ebp - 4], 0x17
push dword [eax]
lea ecx, [ebp - 0x80]
call fcn.0042b420
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x94]
call fcn.0040d610
mov ebx, str.json
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0044c3ea
add esp, 0xc
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x18], 8
jb 0x49a54c
mov eax, dword [eax + 4]
jmp 0x49a54f
add eax, 4
push 0x1388
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00499891
add esp, 0xc
mov byte [ebp - 4], 0x1c
push 0
push 1
lea ecx, [ebp - 0xf8]
call fcn.0040d590
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0044c3ea
add esp, 0xc
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x18], 8
jb 0x49a597
mov eax, dword [eax + 4]
jmp 0x49a59a
add eax, 4
push 0x1388
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00499891
add esp, 0xc
mov byte [ebp - 4], 0x1f
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xf8]
call fcn.0040d590
cmp dword [ebp - 0x34], ebx
je 0x49a5f6
cmp dword [ebp - 0x18], ebx
je 0x49a5f6
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x49a5d6
lea eax, [ebp - 0x28]
push eax
call fcn.00462768
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
pop ecx
jae 0x49a5e9
lea eax, [ebp - 0x44]
push eax
call fcn.0046266c
pop ecx
mov byte [ebp - 0x8d], bl
mov byte [ebp - 4], 0x1c
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d590
mov byte [ebp - 4], 0x19
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040d590
mov byte [ebp - 4], 0x16
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.0040d590
mov byte [ebp - 4], 0x13
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.0040d590
cmp byte [ebp - 0x8d], bl
je 0x49a64d
mov ebx, 0x4fa7a8
push ebx
call fcn.00462768
push ebx
call fcn.0046266c
pop ecx
pop ecx
mov eax, dword [0x53fe58]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x49a662
cmp eax, 2
jne 0x49a7ae
cmp byte [0x53fe68], 0
je 0x49a7ae
mov eax, dword [0x53fe64]
test eax, eax
jne 0x49a6c4
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.InstallOpera
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0xa0]
call fcn.00439d70
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xa0]
call fcn.004555b4
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa0]
call fcn.00481762
jmp 0x49a7ae
cmp eax, ecx
jne 0x49a714
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.InstallYandex
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0x8d]
call fcn.00439d6a
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x8d]
call fcn.0044dc8b
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x8d]
call fcn.00481762
jmp 0x49a7ae
cmp eax, 2
jne 0x49a762
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.Install360SecureBrowser
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0xa0]
call fcn.00439d70
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xa0]
call fcn.00455796
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa0]
call fcn.00481762
jmp 0x49a7ae
cmp eax, 3
jne 0x49a7ae
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.InstallWPSOffice
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], ecx
call edi
lea ecx, [ebp - 0xa0]
call fcn.00439d70
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xa0]
call fcn.004556a5
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa0]
call fcn.00481762
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call fcn.00475e13
mov ecx, dword [ebp - 0xa4]
call fcn.004958a1
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x53fda0
call fcn.00484b80
mov dword [ebp - 4], 0x24
push str.ACCOUNT
mov ecx, eax
call fcn.0043f433
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0040d610
test bl, bl
je 0x49a81c
push 0
push 3
push 0
push 1
push 0x1000000
call fcn.0046231c
add esp, 0x14
push 1
call fcn.0044112d
pop ecx
jmp 0x49ab45
push 4
lea eax, [ebp - 0x94]
push eax
push 4
push str.ReInstall
push str.SOFTWARE360TotalSecurityUserProfile
push esi
mov dword [ebp - 0x94], 1
call edi
lea eax, [ebp - 0x9c]
push eax
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
push str.NewLanguageChecked
mov dword [ebp - 0x9c], ebx
call fcn.0044bc85
mov dword [ebp - 4], 0x25
push ecx
mov ecx, esp
mov dword [ebp - 0x8c], esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.0044bc85
mov byte [ebp - 4], 0x26
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443769
mov dword [ebp - 4], 0x27
push eax
call fcn.0043e957
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443c39
cmp dword [ebp - 0x9c], 1
je 0x49a951
lea ecx, [ebp - 0x88]
call fcn.0040c7d0
mov dword [ebp - 4], 0x28
lea eax, [ebp - 0x88]
push eax
mov ecx, 0x53fda0
call fcn.00498024
test al, al
je 0x49a942
push ebx
push dword [ebp - 0x88]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.NewLanguageArrivalCheck
call fcn.0044bc85
mov byte [ebp - 4], 0x29
push ecx
mov ecx, esp
mov dword [ebp - 0x8c], esp
push str.SOFTWARE360TotalSecurityExperience
call fcn.0044bc85
mov byte [ebp - 4], 0x2a
push esi
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 0x2b
push eax
call fcn.0043ea28
add esp, 0xc
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.0040d610
cmp dword [0x53fed8], 1
push 4
pop eax
mov dword [ebp - 0x84], ebx
mov ebx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
jne 0x49aa91
push eax
lea ecx, [ebp - 0x84]
push ecx
push eax
push str.ExtFlags
push ebx
push esi
call edi
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push str.mode
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ab45
push 4
pop eax
cmp dword [ebp - 0x8c], eax
jne 0x49ab45
cmp dword [ebp - 0x84], 2
jne 0x49ab45
and dword [ebp - 0x84], 0
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push str.Flags
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49aa26
cmp dword [ebp - 0x8c], 4
jne 0x49aa26
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.Flags
push ebx
push esi
call edi
and dword [ebp - 0x84], 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0x4f98b8
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ab45
cmp dword [ebp - 0x8c], 4
jne 0x49ab45
test dword [ebp - 0x84], 2
jne 0x49ab45
or dword [ebp - 0x84], 2
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push 0x4f98b8
push ebx
jmp 0x49ab42
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
push eax
push str.mode
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ab45
push 4
pop eax
cmp dword [ebp - 0x88], eax
jne 0x49ab45
cmp dword [ebp - 0x84], 2
jne 0x49ab45
and dword [ebp - 0x84], 0
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
push eax
push str.ExtFlags
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x49ab45
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push str.Flags
push ebx
push esi
mov dword [ebp - 0x84], 0x30013f0f
call edi
and dword [ebp - 0x84], 0
push 4
lea eax, [ebp - 0x84]
push eax
push 4
push 0x4f98b8
push str.SOFTWARE360Safe_filemon
push esi
call edi
call fcn.00464fee
xor ebx, ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push str.new_func_tips
call fcn.0044bc85
mov dword [ebp - 4], 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.Software360desktopliteConfig
call fcn.0044bc85
mov byte [ebp - 4], 0x2d
push 0x80000001
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00443769
mov dword [ebp - 4], 0x2e
lea ecx, [ebp - 0xa8]
call fcn.0040c7d0
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.0044b15c
pop ecx
pop ecx
test eax, eax
je 0x49abcc
mov eax, dword [ebp - 0xa8]
cmp dword [eax - 0xc], ebx
jne 0x49abe1
push ebx
lea eax, [ebp - 0xc0]
push 0x4f24c0
push eax
call fcn.0043ea28
add esp, 0xc
mov ebx, str.smurf
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push str.default
push str.Software360TotalSecurityTheme
push esi
call edi
cmp byte [0x53fe78], 1
jne 0x49ac35
push 1
push ebx
call fcn.0046502d
pop ecx
pop ecx
cmp al, 1
jne 0x49ac35
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push str.name
push str.Software360TotalSecurityTheme
push 0x80000001
call edi
xor edi, edi
push edi
push 3
push edi
push edi
push 0x100
call fcn.0046231c
mov esi, dword [ebp - 0xa4]
add esp, 0x14
mov ecx, esi
call fcn.0049726f
mov ecx, esi
call fcn.004940e6
mov ecx, esi
call fcn.00495ad7
mov eax, dword [0x536610]
cmp eax, 0xffffffff
je 0x49ac7d
cmp eax, edi
setne al
movzx eax, al
push eax
call fcn.0048b71c
pop ecx
mov ecx, esi
call fcn.0049752f
mov ecx, esi
call fcn.00497609
mov ecx, esi
call fcn.00497768
mov ecx, esi
call fcn.00499430
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xa8]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00443c39
mov al, 1
call fcn.004b52da
ret