Function at 0x41cf9a
Capabilities:
Check if file exists
Delete registry key
Persist via app paths registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24c4
call fcn.00432300
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x18]
lea eax, [esi + 0x4c]
push eax
call fcn.004046c1
and word [ebp - 0x22c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x30]
push str.5.0.0.1
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x103
call fcn.00423f51
pop ecx
test eax, eax
pop ecx
jge 0x41d22a
cmp dword [esi + 4], 6
jg 0x41d21a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20]
push eax
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41d21a
push ebx
mov ebx, str.360se3
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
pop ecx
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 8]
push eax
call fcn.00404707
lea eax, [ebp - 0x14]
push edi
push eax
lea ecx, [ebp - 8]
call fcn.00404803
push dword [ebp - 0x18]
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [ebp - 0x22c]
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x41d209
push ebx
push dword [ebp - 0x14]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x41d209
push dword [esi + 0x3c]
lea ebx, [esi + 0x3c]
push eax
push str.IE6Mode
push str.option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
and word [ebp - 0x24c4], 0
mov dword [ebp - 0x10], eax
mov ecx, 0x823
xor eax, eax
lea edi, [ebp - 0x24c2]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0xc]
stosw word es:[edi], ax
call fcn.004046c1
cmp dword [ebp - 0x10], 1
jne 0x41d0d2
lea eax, [esi + 0x40]
lea ecx, [ebp - 0xc]
push eax
call fcn.00404768
push dword [ebp - 0xc]
lea eax, [ebp - 0x24c4]
mov ebx, str.MSavePath
push 0x104
push eax
push 0x466054
push ebx
push str.option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x24c4]
lea ecx, [ebp - 4]
push eax
call fcn.00404707
push 0
lea ecx, [ebp - 4]
push dword [ebp - 8]
call fcn.00404a42
cmp eax, 0xffffffff
je 0x41d1ec
and word [ebp - 0x434], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x432]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.Software360360se5
push str._sdefaultoption
lea eax, [ebp - 0x434]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add esp, 0x10
mov eax, dword [eax - 8]
sub eax, dword [ecx - 8]
lea ecx, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404803
push eax
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00423692
push eax
lea ecx, [ebp - 4]
call fcn.00404768
lea ecx, [ebp - 0x10]
call fcn.00404beb
lea ecx, [ebp - 0x24]
call fcn.00404beb
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41d1aa
push dword [ebp - 4]
call fcn.004240c1
pop ecx
push dword [ebp - 4]
lea eax, [ebp - 0x24c4]
push eax
call fcn.004243be
pop ecx
pop ecx
push dword [ebp - 0xc]
push dword [ebp - 4]
push ebx
push str.option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
lea eax, [ebp - 0x434]
push ebx
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x22c]
push eax
call fcn.004241da
pop ecx
lea ecx, [ebp - 4]
call fcn.00404beb
lea ecx, [ebp - 0xc]
call fcn.00404beb
lea ecx, [ebp - 0x14]
call fcn.00404beb
lea ecx, [ebp - 8]
call fcn.00404beb
pop ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_5.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, esi
call fcn.0041d24d
lea ecx, [ebp - 0x18]
call fcn.00404beb
pop edi
pop esi
leave
ret