Function at 0x4205ca
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x3e4
lea ebp, [esp - 4]
mov eax, dword [0x4ad40c]
xor eax, ebp
mov dword [ebp + 0x3e4], eax
push 0x58
mov eax, 0x47ffa1
call fcn.00442103
lea ecx, [ebp - 0x40]
call fcn.00417a67
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x114], ax
lea eax, [ebp + 0x116]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00441830
add esp, 0xc
push 0x104
lea eax, [ebp + 0x114]
push eax
lea ecx, [ebp - 0x40]
call fcn.00418e52
xor eax, eax
push 0x62
mov word [ebp + 0x380], ax
lea eax, [ebp + 0x382]
push ebx
push eax
call fcn.00441830
lea eax, [ebp + 0x380]
push 0x32
push eax
call fcn.00408fd0
xor eax, eax
push 0x62
mov word [ebp + 0x31c], ax
lea eax, [ebp + 0x31e]
push ebx
push eax
call fcn.00441830
add esp, 0x20
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push dword [ebp + 0xc]
lea eax, [ebp + 0x31c]
push dword [ebp + 8]
push dword [ebp + 4]
push str._d._d_Build_d_
push 0x32
push eax
call fcn.00403161
lea eax, [ebp - 0x64]
push eax
call fcn.004078a5
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0x1c
push 4
mov dword [ebp - 0x30], eax
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push str.vdays
push str.SOFTWARE360Safe_stat
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x28], ebx
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push str.vcount
push str.SOFTWARE360Safe_stat
mov dword [ebp - 0x18], ebx
push esi
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push str.360safeuplib
push str.SOFTWARE360SafeLiveupUpdateTime
push esi
mov dword [ebp - 0x20], ebx
call edi
push ebx
call fcn.0044431d
pop ecx
cdq
mov ecx, 0xe10
idiv ecx
push 0x18
pop ecx
xor edx, edx
mov dword [ebp - 0x24], ebx
mov ebx, str.SOFTWARE360Safe_setting
sub eax, dword [ebp - 0x20]
div ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push str.update
push ebx
push esi
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push str.ForceUpdateLibs
push ebx
push esi
mov dword [ebp - 0x1c], 1
call edi
xor edi, edi
inc edi
cmp dword [ebp - 0x24], 3
jne 0x42077a
mov edi, dword [ebp - 0x1c]
neg edi
sbb edi, edi
add edi, 3
push 0x4856cc
push str.Software360safeLiveup
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.004202b6
movzx ecx, word [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x30]
push edi
push dword [ebp - 0x18]
neg eax
push dword [ebp - 0x28]
sbb eax, eax
push dword [0x4ab120]
and eax, ecx
push dword [0x4ab11c]
push dword [ebp - 0x2c]
push eax
lea eax, [ebp + 0x31c]
push eax
lea eax, [ebp + 0x380]
push eax
call fcn.00403393
push eax
lea ecx, [ebp - 0x40]
call fcn.00418e97
push eax
lea eax, [ebp + 0x114]
push eax
push str.http:__s.360.cn_safe_tray.html_pid_suid_dmid_sver_ssysver_spa_dtypetraylt_due_dlanguage_dvdays_dvcount_dstatus_dh3_d
push 0x800
push 0x4b15e0
call fcn.00403161
add esp, 0x40
lea ecx, [ebp - 0x40]
call fcn.00417a84
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3e4]
xor ecx, ebp
call fcn.004420f4
add ebp, 0x3e8
leave
ret