Function at 0x48c299
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x468
mov eax, 0x4e4ea0
call fcn.004b5257
mov ebx, dword [ebp + 8]
push 0x53f3f0
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x440], ebx
call fcn.0044bc85
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x430]
call fcn.0044644e
mov ecx, eax
call fcn.00444d1f
mov esi, dword [ebp + 0xc]
neg esi
sbb esi, esi
mov eax, 0x100
and esi, eax
add esi, eax
lea eax, [ebp - 0x42c]
push eax
or esi, 0x2001f
push esi
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push ebx
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48c43f
mov ebx, 0x208
push ebx
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
mov dword [ebp - 0x438], edi
call fcn.004b4620
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
jmp 0x48c40f
xor eax, eax
push ebx
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push edi
push eax
call fcn.004b4620
mov eax, dword [ebp - 0x430]
add esp, 0xc
lea ecx, [ebp - 0x428]
push ecx
push eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
push eax
push dword [ebp - 0x43c]
call dword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
push str..exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x48c3dc
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x430]
call fcn.0043f457
test eax, eax
jne 0x48c3dc
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x48c3e2
inc dword [ebp - 0x438]
push 0x20a
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.004b4620
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x438]
push dword [ebp - 0x42c]
mov dword [ebp - 0x434], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x48c34c
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x42c], edi
lea eax, [ebp - 0x42c]
push eax
push esi
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCustom
push dword [ebp - 0x440]
mov dword [ebp - 0x474], 0x501294
mov dword [ebp - 0x470], str.QHAccount.exe
mov dword [ebp - 0x46c], str.LiveUpdate360.exe
mov dword [ebp - 0x468], str.360SkinView.exe
mov dword [ebp - 0x464], str.ModuleUpdate.exe
mov dword [ebp - 0x460], str.360Tray.exe
mov dword [ebp - 0x45c], str.QHSafeTray.exe
mov dword [ebp - 0x458], str.QHActiveDefense.exe
mov dword [ebp - 0x454], str.QHWatchdog.exe
mov dword [ebp - 0x450], str.dsmain.exe
mov dword [ebp - 0x44c], str.360netcfg.exe
mov dword [ebp - 0x448], str.PromoUtil.exe
mov dword [ebp - 0x444], str.cefutil.exe
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48c50c
xor esi, esi
push dword [ebp + esi*4 - 0x474]
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
inc esi
cmp esi, 0xd
jb 0x48c4e1
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x42c], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.0040d610
call fcn.004b52da
ret