Function at 0x41204a
Capabilities:
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x254
mov eax, 0x46bdf0
call fcn.00443760
lea eax, [ebp - 0x258]
push eax
call fcn.004131c5
push ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x228], esp
push 0x474f2c
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360DrvMgr.exe
push edi
push eax
mov byte [ebp - 4], 1
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123be
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 2
call fcn.00413233
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.00412420
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.Path
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push edi
push eax
mov byte [ebp - 4], 3
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123be
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 4
call fcn.00413233
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.00412420
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.PathSub
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push edi
push eax
mov byte [ebp - 4], 5
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123be
push eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x258]
call fcn.00413233
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.00412420
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push 0x474f2c
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push str.Software360DrvMgrInstallPath
push eax
mov byte [ebp - 4], 7
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123be
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 8
call fcn.00413233
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.00412420
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.UninstallString
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360DrvMgr
push eax
mov byte [ebp - 4], 9
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004123be
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0xa
call fcn.00413233
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.00412420
mov ebx, dword [ebp - 0x24c]
lea edi, [ebp - 0x258]
lea esi, [ebp - 0x234]
call fcn.0041374a
jmp 0x412375
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0043e180
mov dword [ebp - 0x25c], esi
add esp, 0xc
lea esi, [ebp - 0x234]
mov dword [ebp - 0x260], 1
call fcn.0041376a
mov edi, dword [eax + 8]
call fcn.0041376a
mov ebx, dword [eax + 4]
call fcn.0041376a
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x260]
push ecx
push edi
push ebx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41236a
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00402ad3
push 0x5c
push 0x2f
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0xb
call fcn.004088eb
mov edi, 0x4767a8
jmp 0x4122e6
lea eax, [ebp - 0x224]
push eax
call fcn.00412fb7
push edi
xor ecx, ecx
lea esi, [ebp - 0x224]
call fcn.00406890
cmp eax, 0xffffffff
jne 0x4122da
lea eax, [ebp - 0x220]
push eax
mov eax, esi
push eax
call fcn.004132bc
test eax, eax
je 0x412358
mov ecx, dword [ebp - 0x224]
mov eax, dword [ecx - 0xc]
lea esi, [ebp - 0x234]
lea edi, [eax + eax + 2]
mov dword [ebp - 0x22c], ecx
call fcn.0041376a
mov ebx, dword [eax + 8]
call fcn.0041376a
mov eax, dword [eax + 4]
mov dword [ebp - 0x228], eax
call fcn.0041376a
push edi
push dword [ebp - 0x22c]
push 1
push ebx
push dword [ebp - 0x228]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.004031f6
lea esi, [ebp - 0x234]
call fcn.00413792
mov ebx, dword [ebp - 0x248]
lea edi, [ebp - 0x258]
lea esi, [ebp - 0x23c]
call fcn.0041374a
mov edi, esi
lea esi, [ebp - 0x234]
call fcn.00413430
test al, al
je 0x41223c
lea esi, [ebp - 0x258]
call fcn.004133a8
push dword [ebp - 0x258]
call fcn.0043b0f8
pop ecx
call fcn.004437e3
ret