Function at 0x412089
Capabilities:
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x254
mov eax, 0x46be40
call fcn.004437b0
lea eax, [ebp - 0x258]
push eax
call fcn.00413206
push ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x228], esp
push 0x474f2c
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360DrvMgr.exe
push edi
push eax
mov byte [ebp - 4], 1
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123fd
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 2
call fcn.00413274
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041245f
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.Path
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push edi
push eax
mov byte [ebp - 4], 3
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123fd
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 4
call fcn.00413274
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041245f
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.PathSub
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push edi
push eax
mov byte [ebp - 4], 5
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123fd
push eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x258]
call fcn.00413274
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041245f
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push 0x474f2c
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push str.Software360DrvMgrInstallPath
push eax
mov byte [ebp - 4], 7
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123fd
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 8
call fcn.00413274
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041245f
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.UninstallString
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360DrvMgr
push eax
mov byte [ebp - 4], 9
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123fd
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0xa
call fcn.00413274
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041245f
mov ebx, dword [ebp - 0x24c]
lea edi, [ebp - 0x258]
lea esi, [ebp - 0x234]
call fcn.0041378b
jmp 0x4123b4
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0043e1d0
mov dword [ebp - 0x25c], esi
add esp, 0xc
lea esi, [ebp - 0x234]
mov dword [ebp - 0x260], 1
call fcn.004137ab
mov edi, dword [eax + 8]
call fcn.004137ab
mov ebx, dword [eax + 4]
call fcn.004137ab
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x260]
push ecx
push edi
push ebx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4123a9
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00402ad3
push 0x5c
push 0x2f
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0xb
call fcn.0040892b
mov edi, 0x4767b0
jmp 0x412325
lea eax, [ebp - 0x224]
push eax
call fcn.00412ff8
push edi
xor ecx, ecx
lea esi, [ebp - 0x224]
call fcn.004068db
cmp eax, 0xffffffff
jne 0x412319
lea eax, [ebp - 0x220]
push eax
mov eax, esi
push eax
call fcn.004132fd
test eax, eax
je 0x412397
mov ecx, dword [ebp - 0x224]
mov eax, dword [ecx - 0xc]
lea esi, [ebp - 0x234]
lea edi, [eax + eax + 2]
mov dword [ebp - 0x22c], ecx
call fcn.004137ab
mov ebx, dword [eax + 8]
call fcn.004137ab
mov eax, dword [eax + 4]
mov dword [ebp - 0x228], eax
call fcn.004137ab
push edi
push dword [ebp - 0x22c]
push 1
push ebx
push dword [ebp - 0x228]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.004031f6
lea esi, [ebp - 0x234]
call fcn.004137d3
mov ebx, dword [ebp - 0x248]
lea edi, [ebp - 0x258]
lea esi, [ebp - 0x23c]
call fcn.0041378b
mov edi, esi
lea esi, [ebp - 0x234]
call fcn.00413471
test al, al
je 0x41227b
lea esi, [ebp - 0x258]
call fcn.004133e9
push dword [ebp - 0x258]
call fcn.0043b14a
pop ecx
call fcn.00443833
ret