Function at 0x428f9a
Capabilities:
Accept command line arguments
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x258]
sub esp, 0x2d8
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x254], eax
mov eax, 0x80000002
mov ecx, str.Path
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x64], ecx
mov ecx, str.UninstallString
mov edx, str.ImagePath
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x5c], 1
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], str.SoftwareMicrosoftWindowsCurrentVersionUninstallQQPCMgr
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], str.QQPCMgr.exe
mov byte [ebp - 0x48], 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x5e2d78
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], str.BaiduAn.exe
mov byte [ebp - 0x34], 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], str.BaiduSd.exe
mov byte [ebp - 0x20], 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], str.SYSTEMCurrentControlSet_servicesBDSGRTP
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], str.SYSTEMCurrentControlSet_servicesBaiduHips
mov dword [ebp], edx
mov dword [ebp + 4], ebx
mov byte [ebp + 8], 4
mov dword [ebp + 0xc], 0x80000000
mov dword [ebp + 0x10], str.CLSID91B5E4DE_4C97_41CD_9F94_84BFAABB7371LocalServer32
mov dword [ebp + 0x14], 0x5d0be4
mov dword [ebp + 0x18], ebx
mov byte [ebp + 0x1c], 4
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], str.SoftwareMicrosoftWindowsCurrentVersionUninstallKingsoft_Internet_Security
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], str.kismain.exe
mov byte [ebp + 0x30], 8
mov byte [ebp + 0x47], bl
lea esi, [ebp - 0x7c]
mov dword [ebp + 0x3c], 9
xor eax, eax
mov edi, 0x208
push edi
mov word [ebp + 0x48], ax
lea eax, [ebp + 0x4a]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x34]
push eax
push dword [esi + 4]
mov dword [ebp + 0x34], 1
push dword [esi]
mov dword [ebp + 0x38], edi
push dword [esi - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x429162
cmp ax, word [ebp + 0x48]
je 0x429162
push 0x22
pop eax
cmp ax, word [ebp + 0x48]
jne 0x429132
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x48]
push eax
mov dword [ebp + 0x40], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp edi, ebx
je 0x429132
cmp dword [ebp + 0x40], ebx
je 0x42912b
push dword [edi]
lea eax, [ebp + 0x48]
push 0x5db9e0
push 0x104
push eax
call fcn.0058f42f
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esi + 8]
cmp edi, ebx
je 0x42914e
lea eax, [ebp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
lea eax, [ebp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x429162
mov al, byte [esi + 0xc]
or byte [ebp + 0x47], al
add esi, 0x14
dec dword [ebp + 0x3c]
jne 0x4290a7
mov ecx, dword [ebp + 0x254]
mov al, byte [ebp + 0x47]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
add ebp, 0x258
leave
ret