Function at 0x416070
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x241c
call fcn.0044f150
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x2418], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x201e]
push ecx
mov word [esp + 0x2020], ax
call fcn.0044e220
push 0x800
lea edx, [esp + 0x1024]
push 0
push edx
call fcn.0044e220
push 0x800
lea eax, [esp + 0x830]
push 0
push eax
call fcn.0044e220
push 0x800
lea ecx, [esp + 0x183c]
push 0
push ecx
call fcn.0044e220
push 0x800
lea edx, [esp + 0x48]
push 0
push edx
call fcn.0044e220
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0x3c
push 1
push 0x1a
lea eax, [esp + 0x201c]
push eax
push 0
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.360Safe
lea ecx, [esp + 0x2018]
push ecx
lea edx, [esp + 0x81c]
push edx
call ebx
lea eax, [esp + 0x814]
push eax
call fcn.00435a40
add esp, 4
push 1
push 0x1a
lea ecx, [esp + 0x201c]
push ecx
push 0
call esi
push str.360SoftMgr
lea edx, [esp + 0x2018]
push edx
lea eax, [esp + 0x181c]
push eax
call ebx
lea ecx, [esp + 0x1814]
push ecx
call fcn.00435a40
add esp, 4
push 1
push 0x23
lea edx, [esp + 0x101c]
push edx
push 0
call esi
push str.360safe_scancache
lea eax, [esp + 0x1018]
push eax
lea ecx, [esp + 0x81c]
push ecx
call ebx
lea edx, [esp + 0x814]
push edx
call fcn.00435a40
mov ecx, dword [edi + 0xc]
add esp, 4
call fcn.00432ec0
mov esi, eax
test esi, esi
je 0x4162f7
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
push esi
call ecx
test eax, eax
jne 0x4161f3
mov edx, dword [esi]
mov eax, dword [edx + 0x38]
push esi
call eax
test eax, eax
jne 0x4161f3
push str.360WD
lea ecx, [esp + 0x2018]
push ecx
lea edx, [esp + 0x1c]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
jmp 0x4162ef
lea eax, [esp + 0x2014]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416200
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2012], 0x5c
jne 0x41623d
lea eax, [esp + 0x2014]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416224
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x2012], cx
lea edx, [esp + 0x2014]
push 0x5c
push edx
call fcn.0044e29a
add esp, 8
test eax, eax
je 0x416279
xor ecx, ecx
push str.LocalLow360WD
lea edx, [esp + 0x2018]
mov word [eax], cx
push edx
lea eax, [esp + 0x1c]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call fcn.00435a40
add esp, 4
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x2226]
push eax
mov dword [esp + 0x1c], 1
mov word [esp + 0x2228], dx
call fcn.0044e220
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2220]
push edx
lea eax, [esp + 0x18]
push eax
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4162f7
push str.360safe
lea ecx, [esp + 0x2220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x221c]
push edx
call fcn.00435a40
add esp, 4
mov ecx, dword [esp + 0x2424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044e20c
add esp, 0x241c
ret