Function at 0x420f98
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xa5c
mov eax, 0x449424
call fcn.00433037
cmp dword [0x45eca8], 0
jne 0x421677
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x5b0], ax
xor esi, esi
lea eax, [ebp - 0x5ae]
inc esi
push eax
mov dword [0x45eca8], esi
call fcn.0042dec0
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x9cc]
push eax
push str.PrePartner
mov dword [ebp - 0x9cc], esi
mov edi, str.Software360safeCoop
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x9c4], 0x208
call ebx
test eax, eax
jne 0x421677
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x9cc]
push eax
push str.Partner
push edi
push esi
mov dword [ebp - 0x9cc], 1
mov dword [ebp - 0x9c4], 0x208
call ebx
test eax, eax
jne 0x421137
push 0x206
push eax
mov word [ebp - 0x9c0], ax
lea eax, [ebp - 0x9be]
push eax
call fcn.0042dec0
add esp, 0xc
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9c0]
push eax
lea eax, [ebp - 0x9cc]
push eax
push str.regm2
push edi
push esi
mov dword [ebp - 0x9cc], 1
mov dword [ebp - 0x9c4], 0x208
call ebx
test eax, eax
jne 0x421677
call fcn.0040814e
call fcn.00424c30
lea ecx, [ebp - 0x9c0]
push ecx
push eax
mov dword [ebp - 0x9d0], eax
call fcn.0042f37f
pop ecx
pop ecx
test eax, eax
je 0x421677
push str.00000000000000000000000000000000000000000065
push dword [ebp - 0x9d0]
call fcn.0042f37f
pop ecx
pop ecx
test eax, eax
je 0x421677
and dword [ebp - 0x9d0], 0
push 4
pop eax
mov dword [ebp - 0x9cc], eax
mov dword [ebp - 0x9c4], eax
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9d0]
push eax
lea eax, [ebp - 0x9cc]
push eax
push str.m2exc
push edi
push esi
call ebx
test eax, eax
jne 0x421137
cmp dword [ebp - 0x9d0], 1
jae 0x421677
push str.360ver
lea eax, [ebp - 0x9d4]
push eax
call fcn.0040291c
and dword [ebp - 4], 0
push str.0.0.0.0
lea eax, [ebp - 0x9d8]
push eax
call fcn.0040291c
lea eax, [ebp - 0x9d8]
push eax
lea esi, [ebp - 0x9d4]
mov byte [ebp - 4], 1
call fcn.0040df96
pop ecx
xor eax, eax
push 0xc6
mov word [ebp - 0xd8], ax
xor esi, esi
lea eax, [ebp - 0xd6]
push esi
push eax
call fcn.0042dec0
add esp, 0xc
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x9cc]
push eax
push 0x4522dc
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x9c4], 0xc8
mov dword [ebp - 0x9cc], 1
call ebx
push 4
pop eax
mov dword [ebp - 0x9dc], eax
mov dword [ebp - 0x9f4], eax
lea eax, [ebp - 0x9f4]
push eax
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x9dc]
push eax
push str.UserID
push str.Software360safe
push SysReAllocString
mov dword [ebp - 0x9ec], esi
call ebx
call fcn.0040814e
mov ebx, 0x800
push ebx
push esi
mov esi, 0x45ecb0
push esi
call fcn.0042dec0
add esp, 0xc
call fcn.004080b2
push eax
push dword [ebp - 0x9ec]
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0x9d8]
lea eax, [ebp - 0x5b0]
push eax
push str.http:__inst.360safe.com_reg_safe_ins.htm_partner_sver_sbid_suid_dm_s
mov eax, ebx
mov edi, esi
call fcn.0040cbc5
add esp, 0x18
cmp dword [0x460560], 0
je 0x421267
push str.typeupdate
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
call fcn.004203a9
mov edi, eax
mov eax, str.nb1
test edi, edi
jne 0x42127c
mov eax, str.nb0
push eax
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push 0xc8
lea eax, [ebp - 0x1a0]
push 0
push eax
call fcn.0042dec0
xor eax, eax
add esp, 0xc
test edi, edi
setne al
add eax, 0x30
mov word [ebp - 0x1a0], ax
lea eax, [ebp - 0x1a0]
push eax
call fcn.0042e151
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x1a0]
push eax
push 1
push str.IsNetBar
push str.SOFTWARE360Safe_safemon
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7b8], ax
lea eax, [ebp - 0x7b6]
push eax
call fcn.0042dec0
add esp, 0xc
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x7b8]
push eax
lea eax, [ebp - 0x9dc]
push eax
push 0x451fec
push str.Software360safeCoop
push edi
mov dword [ebp - 0x9dc], 1
mov dword [ebp - 0x9c4], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x421356
push str.iPartner
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
lea eax, [ebp - 0x7b8]
push eax
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push str.versrc
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push dword [ebp - 0x9d4]
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push str.m2
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
call fcn.00424c30
push eax
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
mov eax, dword [0x45dc04]
mov edi, 0x45dc04
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x9d0], eax
mov byte [ebp - 4], 2
push dword [0x460438]
lea eax, [ebp - 0x9d0]
push dword [0x460434]
push dword [0x460430]
push str._d._d._d
call fcn.0040816c
add esp, 0x10
push str.sysver
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push dword [ebp - 0x9d0]
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push str.ow
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
cmp dword [0x460570], 0
mov eax, 0x4524e4
jne 0x42140f
mov eax, 0x4524ec
push eax
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
mov eax, dword [0x45dc04]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x9c8], eax
mov byte [ebp - 4], 3
call fcn.00407af0
push ecx
push ecx
mov edi, 0x4524f4
fstp qword [esp]
push edi
lea eax, [ebp - 0x9c8]
call fcn.0040816c
add esp, 0xc
push str.hd
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push dword [ebp - 0x9c8]
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push 0x40
lea eax, [ebp - 0xa68]
push 0
push eax
call fcn.0042dec0
add esp, 0xc
lea eax, [ebp - 0xa68]
push eax
mov dword [ebp - 0xa68], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x42149d
fldz
jmp 0x4214e7
mov eax, dword [ebp - 0xa5c]
mov ecx, dword [ebp - 0xa60]
mov dword [ebp - 0x9e4], eax
and dword [ebp - 0x9e4], 0x80000000
and eax, 0x7fffffff
and dword [ebp - 0x9e8], 0
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x9fc], eax
fild qword [ebp - 0xa00]
fild qword [ebp - 0x9e8]
fchs
faddp st(1)
fmul qword [0x453120]
push ecx
push ecx
fstp qword [esp]
push edi
lea eax, [ebp - 0x9c8]
call fcn.0040816c
add esp, 0xc
push str.ra
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push dword [ebp - 0x9c8]
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0xa24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push dword [ebp - 0xa10]
lea eax, [ebp - 0x9c8]
push 0x450918
call fcn.0040816c
pop ecx
pop ecx
push str.pr
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push dword [ebp - 0x9c8]
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
mov eax, dword [0x452520]
mov dword [ebp - 0x3a8], eax
mov eax, dword [0x452524]
push 0x200
mov dword [ebp - 0x3a4], eax
xor edi, edi
lea eax, [ebp - 0x3a0]
push edi
push eax
call fcn.0042dec0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [ebp - 0x3a8]
call fcn.00407d64
pop ecx
push eax
push 0x452528
lea eax, [ebp - 0x9c8]
call fcn.0040816c
pop ecx
pop ecx
push str.dt
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push dword [ebp - 0x9c8]
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
push str.qts
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
lea eax, [ebp - 0x9e4]
push eax
call fcn.004079d4
pop ecx
push dword [eax]
mov eax, ebx
mov ecx, esi
call fcn.0041ba1f
mov eax, dword [ebp - 0x9e4]
add eax, 0xfffffff0
call fcn.00406004
lea eax, [ebp - 0x9f0]
push eax
push edi
push esi
push 0x420ea0
push edi
push edi
mov dword [ebp - 0x9f0], edi
call fcn.0042ea5a
add esp, 0x18
cmp eax, edi
je 0x42163f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c8]
add eax, 0xfffffff0
call fcn.00406004
mov eax, dword [ebp - 0x9d0]
add eax, 0xfffffff0
call fcn.00406004
mov eax, dword [ebp - 0x9d8]
add eax, 0xfffffff0
call fcn.00406004
mov eax, dword [ebp - 0x9d4]
add eax, 0xfffffff0
call fcn.00406004
call fcn.004330ba
ret