Function at 0x498018
Capabilities:
Check if file exists
Delete registry value
Query or enumerate registry value

Disassembly:
push 0xe8c
mov eax, 0x52fcca
call fcn.004fc737
and dword [ebp - 0x658], 0
push 4
pop eax
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x664]
push eax
push str.rebootflag
push str.Software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x658], 1
jne 0x4982f7
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.004f18b0
add esp, 0xc
lea ecx, [ebp - 0x654]
call fcn.00448359
push dword [eax]
mov ebx, 0x104
push ebx
lea edx, [ebp - 0x420]
call fcn.0042a4a0
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
call fcn.00405521
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.deepscanCloudSec3.dll
lea eax, [ebp - 0x420]
push eax
call edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004f18b0
add esp, 0xc
lea ecx, [ebp - 0x654]
call fcn.00448359
push dword [eax]
lea edx, [ebp - 0x218]
push ebx
call fcn.0042a4a0
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
call fcn.00405521
lea eax, [ebp - 0x218]
push eax
call esi
push str.deepscanDeepscan.dll
lea eax, [ebp - 0x218]
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x4982f7
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x4982f7
xor edi, edi
push 0x804
lea eax, [ebp - 0xe88]
push edi
push eax
mov dword [ebp - method.CDeepScan.virtual_0], vtable.CDeepScan.0
mov dword [ebp - 0x684], edi
mov dword [ebp - 0xe90], edi
mov dword [ebp - 0xe8c], edi
mov dword [ebp - 0xe94], edi
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xe98]
mov dword [ebp - 4], edi
call fcn.004514f9
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x4982ec
cmp dword [ebp - 0xe3c], edi
je 0x4981d5
lea eax, [ebp - 0x218]
push eax
call dword [ebp - 0xe3c]
jmp 0x4981d7
mov eax, ebx
cmp eax, edi
je 0x4982e1
push str.rebootflag
push str.Software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [ebp - 0xe20], edi
je 0x49820a
call dword [ebp - 0xe20]
mov dword [ebp - 0x654], eax
jmp 0x498210
mov dword [ebp - 0x654], edi
lea eax, [ebp - 0x650]
push eax
call fcn.004522c2
push ecx
mov eax, esp
mov dword [ebp - 0x65c], esp
push ecx
mov byte [ebp - 4], 1
mov dword [eax], edi
mov eax, esp
mov dword [ebp - 0x65c], esp
push edi
lea esi, [ebp - 0x624]
mov dword [eax], edi
call fcn.00454766
cmp eax, edi
je 0x4982d1
push edi
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0x680]
call fcn.0043e727
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x49826b
mov eax, dword [eax + 4]
jmp 0x49826e
add eax, 4
push eax
push dword [ebp - 0x620]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push ebx
lea esi, [ebp - 0x680]
call fcn.00404e29
lea eax, [ebp - 0x650]
push eax
call fcn.00453dd8
push ebx
push str.IDS_OK
push ebx
lea ecx, [ebp - 0x650]
call fcn.00453eb2
mov edx, str.IDS_REBOOT_FLAG_RESTORE
cmp dword [ebp - 0x654], edi
jne 0x4982b8
mov edx, str.IDS_REBOOT_FLAG_REMOVE
push ebx
lea ecx, [ebp - 0x650]
call fcn.00453af7
push edi
push ebx
lea esi, [ebp - 0x650]
call fcn.00453a1b
lea eax, [ebp - 0x650]
push eax
mov byte [ebp - 4], 0
call fcn.0045241d
lea esi, [ebp - 0xe98]
call fcn.004515ad
lea ecx, [ebp - 0xe98]
call fcn.004514e9
call fcn.004fc7ba
ret