Function at 0x410292
Capabilities:
Accept command line arguments
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov ecx, str.Path
push ebx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xac], ecx
mov eax, reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov ecx, str.UninstallString
mov edx, str.ImagePath
push esi
push edi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
mov dword [ebp - 0xbc], ebx
mov byte [ebp - 0xb8], 1
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
mov dword [ebp - 0xa8], ebx
mov byte [ebp - 0xa4], 1
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], str.SoftwareMicrosoftWindowsCurrentVersionUninstallQQPCMgr
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], str.QQPCMgr.exe
mov byte [ebp - 0x90], 2
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], str.BaiduAn.exe
mov byte [ebp - 0x7c], 4
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 0x429140
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], str.BaiduSd.exe
mov byte [ebp - 0x68], 4
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], str.SYSTEMCurrentControlSet_servicesBDSGRTP
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x54], 4
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], str.SYSTEMCurrentControlSet_servicesBaiduHips
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x40], 4
mov dword [ebp - 0x3c], SysStringLen
mov dword [ebp - 0x38], str.CLSID91B5E4DE_4C97_41CD_9F94_84BFAABB7371LocalServer32
mov dword [ebp - 0x34], 0x42a560
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x2c], 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], str.SoftwareMicrosoftWindowsCurrentVersionUninstallKingsoft_Internet_Security
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], str.kismain.exe
mov byte [ebp - 0x18], 8
mov byte [ebp - 1], bl
lea esi, [ebp - 0xc4]
mov dword [ebp - 0xc], 9
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x2d2]
mov word [ebp - 0x2d4], bx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 1
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4104a1
cmp word [ebp - 0x2d4], bx
je 0x4104a1
cmp word [ebp - 0x2d4], 0x22
jne 0x410468
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp edi, ebx
je 0x410468
cmp dword [ebp - 8], ebx
je 0x410461
push dword [edi]
lea eax, [ebp - 0x2d4]
push 0x4260b8
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esi + 8]
cmp edi, ebx
je 0x41048a
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2d4]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4104a1
mov al, byte [esi + 0xc]
or byte [ebp - 1], al
add esi, 0x14
dec dword [ebp - 0xc]
jne 0x4103c6
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret