Function at 0x417d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3b0]
push ebx
push esi
push edi
mov esi, 0x208
push esi
mov dword [ebp - 0x74], eax
xor edi, edi
lea eax, [ebp + 0x19c]
push edi
push eax
call fcn.0044c960
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0x19c]
add esp, 0xc
test eax, eax
je 0x417e66
xor ecx, ecx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
cmp ecx, eax
je 0x417e66
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418017
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push str.Path
push dword [ebp - 0x70]
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x80], esi
call ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp + 0x19c]
je 0x417e54
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp + 0x19c]
push eax
call fcn.0044cbfc
pop ecx
mov dword [ebp - 0x70], eax
jmp 0x417e69
mov dword [ebp - 0x70], edi
cmp dword [ebp - 0x70], edi
je 0x418017
xor eax, eax
cmp ax, word [ebp + 0x19c]
je 0x418017
cmp dword [ebp + 0x3b4], edi
je 0x417ec8
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.0044c960
add esp, 0xc
push 0x104
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp - 0x70]
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
neg eax
sbb eax, eax
inc eax
je 0x418011
lea eax, [ebp + 0x19c]
push str.360leakfixer.exe
push eax
call fcn.00417d1c
pop ecx
test eax, eax
pop ecx
lea eax, [ebp + 0x19c]
je 0x417f3b
push str.safemonpedrver.dll
push eax
call fcn.00417d1c
pop ecx
pop ecx
mov esi, 0x80
test eax, eax
jne 0x417efd
mov esi, edi
lea eax, [ebp + 0x19c]
push str.safemonFreeSaaS.tpi
push eax
call fcn.00417d1c
pop ecx
pop ecx
test eax, eax
je 0x417f33
lea eax, [ebp + 0x19c]
push str.safemon_saasver.dll
push eax
call fcn.00417d1c
pop ecx
pop ecx
test eax, eax
je 0x417f33
or esi, 0x20
jmp 0x418013
or esi, 1
jmp 0x418013
push str.hipsver.dll
push eax
call fcn.00417d1c
pop ecx
pop ecx
test eax, eax
je 0x418011
lea eax, [ebp + 0x19c]
push str.safemon360Cactus.tpi
push eax
call fcn.00417d1c
pop ecx
pop ecx
test eax, eax
je 0x41800c
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.0044c960
lea eax, [ebp - 0x6c]
add esp, 0xc
test eax, eax
je 0x417fee
xor ecx, ecx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
cmp ecx, eax
je 0x417fee
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417fee
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push str.Path
push dword [ebp - 0x70]
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], esi
call ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp - 0x6c]
je 0x417fe4
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x6c]
push eax
call fcn.0044cbfc
pop ecx
lea eax, [ebp - 0x6c]
push str.360SkinMgr.exe
push eax
call fcn.00417d1c
mov esi, eax
neg esi
sbb esi, esi
pop ecx
and esi, 4
pop ecx
add esi, 6
jmp 0x418013
push 0x10
pop esi
jmp 0x418013
mov esi, edi
mov eax, esi
jmp 0x418019
xor eax, eax
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3a8
leave
ret