Function at 0x490776
Capabilities:
Check if file exists
Delete registry value
Query or enumerate registry value

Disassembly:
push 0xe8c
mov eax, 0x524666
call fcn.004f21c7
and dword [ebp - 0x658], 0
push 4
pop eax
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x664]
push eax
push str.rebootflag
push str.Software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x658], 1
jne 0x490a55
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.004e7380
add esp, 0xc
lea ecx, [ebp - 0x654]
call fcn.004416bb
push dword [eax]
mov ebx, 0x104
push ebx
lea edx, [ebp - 0x420]
call fcn.00424ffd
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
call fcn.0040557a
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.deepscanCloudSec3.dll
lea eax, [ebp - 0x420]
push eax
call edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004e7380
add esp, 0xc
lea ecx, [ebp - 0x654]
call fcn.004416bb
push dword [eax]
lea edx, [ebp - 0x218]
push ebx
call fcn.00424ffd
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
call fcn.0040557a
lea eax, [ebp - 0x218]
push eax
call esi
push str.deepscanDeepscan.dll
lea eax, [ebp - 0x218]
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x490a55
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x490a55
xor edi, edi
push 0x804
lea eax, [ebp - 0xe88]
push edi
push eax
mov dword [ebp - method.CDeepScan.virtual_0], vtable.CDeepScan.0
mov dword [ebp - 0x684], edi
mov dword [ebp - 0xe90], edi
mov dword [ebp - 0xe8c], edi
mov dword [ebp - 0xe94], edi
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xe98]
mov dword [ebp - 4], edi
call fcn.0044a2cb
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x490a4a
cmp dword [ebp - 0xe3c], edi
je 0x490933
lea eax, [ebp - 0x218]
push eax
call dword [ebp - 0xe3c]
jmp 0x490935
mov eax, ebx
cmp eax, edi
je 0x490a3f
push str.rebootflag
push str.Software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [ebp - 0xe20], edi
je 0x490968
call dword [ebp - 0xe20]
mov dword [ebp - 0x654], eax
jmp 0x49096e
mov dword [ebp - 0x654], edi
lea eax, [ebp - 0x650]
push eax
call fcn.0044b075
push ecx
mov eax, esp
mov dword [ebp - 0x65c], esp
push ecx
mov byte [ebp - 4], 1
mov dword [eax], edi
mov eax, esp
mov dword [ebp - 0x65c], esp
push edi
lea esi, [ebp - 0x624]
mov dword [eax], edi
call fcn.0044d511
cmp eax, edi
je 0x490a2f
push edi
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0x680]
call fcn.0043913e
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x4909c9
mov eax, dword [eax + 4]
jmp 0x4909cc
add eax, 4
push eax
push dword [ebp - 0x620]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push ebx
lea esi, [ebp - 0x680]
call fcn.00404e82
lea eax, [ebp - 0x650]
push eax
call fcn.0044cb8b
push ebx
push str.IDS_OK
push ebx
lea ecx, [ebp - 0x650]
call fcn.0044cc65
mov edx, str.IDS_REBOOT_FLAG_RESTORE
cmp dword [ebp - 0x654], edi
jne 0x490a16
mov edx, str.IDS_REBOOT_FLAG_REMOVE
push ebx
lea ecx, [ebp - 0x650]
call fcn.0044c8aa
push edi
push ebx
lea esi, [ebp - 0x650]
call fcn.0044c7ce
lea eax, [ebp - 0x650]
push eax
mov byte [ebp - 4], 0
call fcn.0044b1d0
lea esi, [ebp - 0xe98]
call fcn.0044a37f
lea ecx, [ebp - 0xe98]
call fcn.0044a2bb
call fcn.004f224a
ret