Function at 0x41f1c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x3e4
lea ebp, [esp - 4]
mov eax, dword [0x4aa3ec]
xor eax, ebp
mov dword [ebp + 0x3e4], eax
push 0x58
mov eax, 0x47e3e0
call fcn.004409e3
lea ecx, [ebp - 0x40]
call fcn.004166b0
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x114], ax
lea eax, [ebp + 0x116]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00440110
add esp, 0xc
push 0x104
lea eax, [ebp + 0x114]
push eax
lea ecx, [ebp - 0x40]
call fcn.00417c32
xor eax, eax
push 0x62
mov word [ebp + 0x380], ax
lea eax, [ebp + 0x382]
push ebx
push eax
call fcn.00440110
lea eax, [ebp + 0x380]
push 0x32
push eax
call fcn.004089b5
xor eax, eax
push 0x62
mov word [ebp + 0x31c], ax
lea eax, [ebp + 0x31e]
push ebx
push eax
call fcn.00440110
add esp, 0x20
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push dword [ebp + 0xc]
lea eax, [ebp + 0x31c]
push dword [ebp + 8]
push dword [ebp + 4]
push str._d._d_Build_d_
push 0x32
push eax
call fcn.00402fd0
lea eax, [ebp - 0x64]
push eax
call fcn.004074ac
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0x1c
push 4
mov dword [ebp - 0x30], eax
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push str.vdays
push str.SOFTWARE360Safe_stat
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x28], ebx
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push str.vcount
push str.SOFTWARE360Safe_stat
mov dword [ebp - 0x18], ebx
push edi
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push str.360safeuplib
push str.SOFTWARE360SafeLiveupUpdateTime
push edi
mov dword [ebp - 0x20], ebx
call esi
push ebx
call fcn.00442bfd
pop ecx
cdq
mov ecx, 0xe10
idiv ecx
push 0x18
pop ecx
xor edx, edx
mov dword [ebp - 0x24], ebx
mov ebx, str.SOFTWARE360SafeSetting
sub eax, dword [ebp - 0x20]
div ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push str.update
push ebx
push edi
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push str.ForceUpdateLibs
push ebx
push edi
mov dword [ebp - 0x1c], 1
call esi
xor esi, esi
inc esi
cmp dword [ebp - 0x24], 3
jne 0x41f375
mov esi, dword [ebp - 0x1c]
neg esi
sbb esi, esi
add esi, 3
call fcn.0041ee61
movzx ecx, word [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x30]
push esi
push dword [ebp - 0x18]
neg eax
push dword [ebp - 0x28]
sbb eax, eax
push dword [0x4a8120]
and eax, ecx
push dword [0x4a811c]
push dword [ebp - 0x2c]
push eax
lea eax, [ebp + 0x31c]
push eax
lea eax, [ebp + 0x380]
push eax
call fcn.004031d3
push eax
lea ecx, [ebp - 0x40]
call fcn.00417c77
push eax
lea eax, [ebp + 0x114]
push eax
push str.http:__s.360.cn_safe_tray.html_pid_suid_dmid_sver_ssysver_spa_dtypetraylt_due_dlanguage_dvdays_dvcount_dstatus_dh3_d
push 0x800
push 0x4adf20
call fcn.00402fd0
add esp, 0x40
lea ecx, [ebp - 0x40]
call fcn.004166cd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3e4]
xor ecx, ebp
call fcn.004409d4
add ebp, 0x3e8
leave
ret