Function at 0x41f920
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov eax, 0x282c
call fcn.00439c20
mov eax, 4
push ebx
push ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push esi
lea eax, [esp + 0x10]
push edi
lea esi, [ecx + 0x60]
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
push str.UserID
push str.Software360Safe
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [esi], 1
ja 0x41f970
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x282c
ret
mov dx, word [0x44ffe8]
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], dx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.MSVCRT.dll_wcsncpy]
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 1
test eax, eax
je 0x41fa3e
mov ecx, str.360OEMlogo.bmp
mov word [esp + 0x1c], 0
test ecx, ecx
je 0x41fa3e
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x83c]
push str.360OEMlogo.bmp
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x41fa2a
lea edx, [esp + 0x83c]
push 0x800
push edx
push 0
call ebx
lea eax, [esp + 0x83c]
push eax
call ebp
lea ecx, [esp + 0x83c]
push str.360OEMlogo.bmp
lea edx, [esp + 0x840]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x83c]
push 0x208
lea ecx, [esp + 0x20]
push eax
push ecx
jmp 0x41fa39
push 0x208
lea edx, [esp + 0x20]
push str.360OEMlogo.bmp
push edx
call esi
add esp, 0xc
mov ax, word [0x44ffe8]
mov ecx, 0x103
mov word [esp + 0x42c], ax
xor eax, eax
lea edi, [esp + 0x42e]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x42c]
test ecx, ecx
stosw word es:[edi], ax
je 0x41faff
mov edx, str.360OEMlogo.png
mov word [esp + 0x42c], 0
test edx, edx
je 0x41faff
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x83c]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x41fae8
lea eax, [esp + 0x83c]
push 0x800
push eax
push 0
call ebx
lea ecx, [esp + 0x83c]
push ecx
call ebp
lea edx, [esp + 0x83c]
push str.360OEMlogo.png
lea eax, [esp + 0x840]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x83c]
push 0x208
lea edx, [esp + 0x430]
push ecx
push edx
jmp 0x41fafa
push 0x208
lea eax, [esp + 0x430]
push str.360OEMlogo.png
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x1c]
test ecx, ecx
je 0x41fbc9
lea edx, [esp + 0x83c]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x83c]
test edx, edx
rep stosd dword es:[edi], eax
je 0x41fbc9
mov ecx, 0x400
lea edi, [esp + 0x183c]
mov word [esp + 0x83c], ax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x41fb9c
lea ecx, [esp + 0x183c]
push 0x800
push ecx
push 0
call ebx
lea edx, [esp + 0x183c]
push edx
call ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x183c]
push eax
lea edx, [esp + 0x1840]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x183c]
push 0x400
lea ecx, [esp + 0x840]
push eax
push ecx
jmp 0x41fbae
lea edx, [esp + 0x1c]
push 0x400
lea eax, [esp + 0x840]
push edx
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x83c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41fcac
lea edx, [esp + 0x42c]
test edx, edx
je 0x41fc9f
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x83c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x83c]
test eax, eax
je 0x41fc9f
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x183c]
mov word [esp + 0x83c], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x42c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x41fc73
lea edx, [esp + 0x183c]
push 0x800
push edx
push 0
call ebx
lea eax, [esp + 0x183c]
push eax
call ebp
lea ecx, [esp + 0x42c]
lea edx, [esp + 0x183c]
push ecx
lea eax, [esp + 0x1840]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x183c]
push 0x400
lea edx, [esp + 0x840]
push ecx
push edx
jmp 0x41fc88
lea eax, [esp + 0x42c]
push 0x400
lea ecx, [esp + 0x840]
push eax
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x83c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41fcac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x282c
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x282c
ret