Function at 0x420dd0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov eax, 0x282c
call fcn.00456620
mov eax, 4
push ebx
push ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x283c]
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
push str.UserID
push str.Software360Safe
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [esi], 1
ja 0x420e24
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x282c
ret
mov dx, word [0x473258]
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], dx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.MSVCRT.dll_wcsncpy]
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 1
test eax, eax
je 0x420ef2
mov ecx, str.360OEMlogo.bmp
mov word [esp + 0x1c], 0
test ecx, ecx
je 0x420ef2
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x83c]
push str.360OEMlogo.bmp
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x420ede
lea edx, [esp + 0x83c]
push 0x800
push edx
push 0
call ebx
lea eax, [esp + 0x83c]
push eax
call ebp
lea ecx, [esp + 0x83c]
push str.360OEMlogo.bmp
lea edx, [esp + 0x840]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x83c]
push 0x208
lea ecx, [esp + 0x20]
push eax
push ecx
jmp 0x420eed
push 0x208
lea edx, [esp + 0x20]
push str.360OEMlogo.bmp
push edx
call esi
add esp, 0xc
mov ax, word [0x473258]
mov ecx, 0x103
mov word [esp + 0x42c], ax
xor eax, eax
lea edi, [esp + 0x42e]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x42c]
test ecx, ecx
stosw word es:[edi], ax
je 0x420fb3
mov edx, str.360OEMlogo.png
mov word [esp + 0x42c], 0
test edx, edx
je 0x420fb3
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x83c]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x420f9c
lea eax, [esp + 0x83c]
push 0x800
push eax
push 0
call ebx
lea ecx, [esp + 0x83c]
push ecx
call ebp
lea edx, [esp + 0x83c]
push str.360OEMlogo.png
lea eax, [esp + 0x840]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x83c]
push 0x208
lea edx, [esp + 0x430]
push ecx
push edx
jmp 0x420fae
push 0x208
lea eax, [esp + 0x430]
push str.360OEMlogo.png
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x1c]
test ecx, ecx
je 0x42107d
lea edx, [esp + 0x83c]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x83c]
test edx, edx
rep stosd dword es:[edi], eax
je 0x42107d
mov ecx, 0x400
lea edi, [esp + 0x183c]
mov word [esp + 0x83c], ax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x421050
lea ecx, [esp + 0x183c]
push 0x800
push ecx
push 0
call ebx
lea edx, [esp + 0x183c]
push edx
call ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x183c]
push eax
lea edx, [esp + 0x1840]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x183c]
push 0x400
lea ecx, [esp + 0x840]
push eax
push ecx
jmp 0x421062
lea edx, [esp + 0x1c]
push 0x400
lea eax, [esp + 0x840]
push edx
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x83c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421160
lea edx, [esp + 0x42c]
test edx, edx
je 0x421153
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x83c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x83c]
test eax, eax
je 0x421153
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x183c]
mov word [esp + 0x83c], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x42c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x421127
lea edx, [esp + 0x183c]
push 0x800
push edx
push 0
call ebx
lea eax, [esp + 0x183c]
push eax
call ebp
lea ecx, [esp + 0x42c]
lea edx, [esp + 0x183c]
push ecx
lea eax, [esp + 0x1840]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x183c]
push 0x400
lea edx, [esp + 0x840]
push ecx
push edx
jmp 0x42113c
lea eax, [esp + 0x42c]
push 0x400
lea ecx, [esp + 0x840]
push eax
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x83c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421160
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x282c
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x282c
ret