Function at 0x47dc0f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x6c
mov eax, 0x4b26f5
call fcn.004952b6
mov eax, dword [ebp + 8]
push str.Global360SoftMgr.ShellExt.Event
xor edi, edi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
push edi
push 0x100002
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x60], edi
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
mov dword [ebp - 0x58], esi
cmp esi, edi
je 0x47de23
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push esi
call ebx
push 0x14
pop edi
cmp eax, 0x102
je 0x47dc70
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
dec edi
test edi, edi
jg 0x47dc57
push 0x10
pop ecx
mov esi, str.Global360SoftMgr.ShellExt.Share
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x54]
push eax
mov esi, 0x4d8
push esi
xor edi, edi
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x70], eax
cmp eax, edi
je 0x47de1a
push esi
push edi
push edi
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x47de11
push str.taskbarpin
push 0x20
push esi
call fcn.00491f5c
add esp, 0xc
cmp dword [ebp - 0x68], 0
mov edi, 0x104
je 0x47dce6
push dword [ebp - 0x68]
lea eax, [esi + 0x40]
push edi
push eax
call fcn.00491f5c
add esp, 0xc
push 0x4c4788
lea eax, [esi + 0x248]
push edi
push eax
call fcn.00491f5c
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [esi + 0x450], 0
and dword [esi + 0x454], 0
add esp, 0xc
call edi
push eax
push str.ret__d
lea eax, [esi + 0x458]
push 0x20
push eax
call fcn.0049170e
add esp, 0x10
call edi
push eax
push str.pid__d
push 0x20
lea edi, [esi + 0x498]
push edi
call fcn.0049170e
add esp, 0x10
lea eax, [ebp - 0x5c]
push eax
lea ecx, [esi + 0x458]
call fcn.00405a20
and dword [ebp - 4], 0
mov edx, edi
mov edi, dword [ebp - 0x78]
call fcn.004059e0
lea ecx, [esi + 0x40]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
test di, di
jne 0x47dd66
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push str.softmgrext_share_valid_path
push str.SOFTWARE360safe_softmgr
mov edi, SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x32
pop esi
push 0
push dword [ebp - 0x58]
call ebx
cmp eax, 0x102
je 0x47ddc7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 0x58]
call ebx
dec esi
test esi, esi
jg 0x47ddac
and dword [ebp - 0x64], 0
push 4
pop eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x5c]
mov esi, str.SOFTWARE360SoftMgr
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x47de09
cmp dword [ebp - 0x64], 1
push dword [ebp - 0x5c]
sete al
push esi
push edi
mov dword [ebp - 0x60], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [ebp - 0x5c]
call fcn.00406090
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
call fcn.00495339
ret