Function at 0x456e80
Capabilities:
Delete registry value
Persist via run registry key
Persist via screensaver registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x38], 0
mov esi, ecx
mov dword [ebp - 0x34], 7
push eax
push 0x5010a0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x48], ax
call fcn.00403e30
cmp dword [ebp - 0x38], 0
jne 0x456ede
lea eax, [ebp - 0x48]
mov edx, str.Software360360huabao
push eax
push str.InstallPath
mov ecx, SysReAllocString
call fcn.0040ffe0
add esp, 8
lea edi, [esi + 0x6d8]
lea eax, [ebp - 0x20]
cmp edi, eax
je 0x456f05
mov ecx, edi
call fcn.00402e70
movups xmm0, xmmword [ebp - 0x48]
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x38]
movq qword [edi + 0x10], xmm0
jmp 0x456f3f
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x456f3f
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x456f35
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45767b
push edx
push ecx
call fcn.004bdd39
add esp, 8
push str.360huabao.scr
mov edx, edi
lea ecx, [ebp - 0xc0]
call fcn.004048c0
xor eax, eax
mov dword [ebp - 0x80], 0
add esp, 4
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x7c], 7
mov edx, str.Control_PanelDesktop
mov ecx, SysReAllocString
push eax
push str.SCRNSAVE.EXE
call fcn.0040ffe0
cmp dword [ebp - 0x7c], 8
lea eax, [ebp - 0x90]
cmovae eax, dword [ebp - 0x90]
push eax
push 0x17e
push str.UnInstallUtil::DeleteReg
push str.__s__d___DeleteReg_strPath_s
call fcn.0041f720
mov edx, dword [ebp - 0x80]
lea ecx, [ebp - 0x90]
add esp, 0x18
cmp dword [ebp - 0x7c], 8
cmovae ecx, dword [ebp - 0x90]
push 0xd
push str.360huabao.scr
push ecx
call fcn.00404b10
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
cmp eax, 0xffffffff
je 0x45702e
push 0x2001f
push str.Control_PanelDesktop
push SysReAllocString
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
call fcn.0041f9b0
test eax, eax
je 0x457018
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x45702e
push eax
jmp 0x45702c
mov ebx, dword [ebp - 0x3c]
push str.SCRNSAVE.EXE
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test ebx, ebx
je 0x45702e
push ebx
call esi
mov eax, dword [ebp - 0x4c]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp byte [eax + 0x740], 0
jne 0x4570ed
push 0x2001f
push str.Software360
push SysReAllocString
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.0041f9b0
test eax, eax
jne 0x457081
push 0x50ba50
lea ecx, [ebp - 0x54]
call fcn.0041f7a0
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x45708b
push eax
call esi
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
call fcn.0041f9b0
test eax, eax
je 0x4570ce
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x457282
push eax
call esi
jmp 0x457282
mov edi, dword [ebp - 0x3c]
push 0x50ba50
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x457282
push edi
call esi
jmp 0x457282
push str.360huabao.exe__hb:5__from:2
mov edx, edi
lea ecx, [ebp - 0x20]
call fcn.004048c0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
add esp, 4
cmp dword [ebp - 0xc], 8
cmovae ecx, dword [ebp - 0x20]
add eax, eax
push eax
push ecx
push 1
push 0x50ba50
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call ebx
push 4
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 2
push eax
push 4
push str.install_model
push str.Software360360huabao
push SysReAllocString
call ebx
push 0xa
xor eax, eax
mov dword [ebp - 0x38], 0
push str.360hb_core
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.00403e30
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmovae ecx, dword [ebp - 0x48]
add eax, eax
push eax
push ecx
push 1
push 0x508bc0
push str.Software360360huabao
push SysReAllocString
call ebx
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x4571c6
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4571bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457680
push edx
push ecx
call fcn.004bdd39
add esp, 8
push 7
xor eax, eax
mov dword [ebp - 0x38], 0
push str.360safe
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.00403e30
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmovae ecx, dword [ebp - 0x48]
add eax, eax
push eax
push ecx
push 1
push 0x505cf4
push str.Software360360huabao
push SysReAllocString
call ebx
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x457248
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45723e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457685
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0xc]
cmp edx, 8
jb 0x457282
mov ecx, dword [ebp - 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x457278
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45768a
push edx
push ecx
call fcn.004bdd39
add esp, 8
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push SysReAllocString
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.0041f9b0
test eax, eax
jne 0x4572bf
push 0x50ba50
lea ecx, [ebp - 0x54]
call fcn.0041f7a0
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4572c9
push eax
call esi
push 0
call fcn.004c82ab
mov edi, eax
lea esi, [ebp - 6]
add esp, 4
mov ecx, edi
nop word [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x4572e0
mov word [ebp - 0xa8], cx
xor eax, eax
lea ecx, [ebp - 6]
mov dword [ebp - 0x98], eax
mov edx, 7
mov dword [ebp - 0x94], edx
cmp esi, ecx
je 0x457340
mov eax, ecx
lea ecx, [ebp - 0xa8]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.00403e30
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
cmp edx, 8
lea ecx, [ebp - 0xa8]
cmovae ecx, dword [ebp - 0xa8]
add eax, eax
push eax
push ecx
push 1
push str.hbuninstalltime
push str.Software360
push SysReAllocString
call ebx
push 8
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], edi
push eax
push 0xb
push str.uninst_last_time
push str.Software_fbd30ee5_8150_549e_9aed_fd9d444307
push SysReAllocString
mov dword [ebp - 0x4c], 0
call ebx
xor eax, eax
mov dword [ebp - 0x68], 0
mov word [ebp - 0x78], ax
mov edx, str.Software_fbd30ee5_8150_549e_9aed_fd9d444307
lea eax, [ebp - 0x78]
mov dword [ebp - 0x64], 7
push eax
push str.uninst_times
mov ecx, SysReAllocString
call fcn.0040ffe0
sub esp, 0x10
lea eax, [ebp - 0x78]
mov ecx, esp
push eax
call fcn.00402f60
call fcn.00410440
add esp, 0x18
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x48]
test al, al
je 0x4575f7
push 0
push 0x50102d
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.00404000
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
mov esi, dword [ebp - 0x68]
cmovae eax, dword [ebp - 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push esi
push eax
push 0
push 0xfde9
call edi
mov ebx, eax
push 0
test esi, esi
jne 0x457475
push 0x50102d
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
call fcn.00404000
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x4574b7
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x457469
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45768f
push edx
push ecx
call fcn.004bdd39
add esp, 8
jmp 0x4574b7
push ebx
lea ecx, [ebp - 0x48]
call fcn.00403040
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x48]
push 0
cmovae ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 8
push 0
cmovae eax, dword [ebp - 0x78]
push ebx
push ecx
push esi
push eax
push 0
push 0xfde9
call edi
movups xmm0, xmmword [ebp - 0x48]
movups xmmword [ebp - 0x60], xmm0
movq xmm0, qword [ebp - 0x38]
movq qword [ebp - 0x50], xmm0
cmp dword [ebp - 0x4c], 0x10
lea eax, [ebp - 0x60]
mov byte [ebp - 0x48], 0
cmovae eax, dword [ebp - 0x60]
push eax
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
call fcn.004c54ad
mov edx, dword [ebp - 0x4c]
add esp, 4
mov esi, eax
cmp edx, 0x10
jb 0x457513
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x457509
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457694
push edx
push ecx
call fcn.004bdd39
add esp, 8
add esi, 1
lea ecx, [ebp - 6]
jns 0x457550
neg esi
nop dword [eax]
mov eax, 0xcccccccd
sub ecx, 2
mul esi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub esi, eax
add esi, 0x30
mov word [ecx], si
mov esi, edx
test esi, esi
jne 0x457520
add ecx, 0xfffffffe
mov eax, 0x2d
mov word [ecx], ax
jmp 0x457570
mov eax, 0xcccccccd
sub ecx, 2
mul esi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub esi, eax
add esi, 0x30
mov word [ecx], si
mov esi, edx
test esi, esi
jne 0x457550
xor esi, esi
xor eax, eax
mov word [ebp - 0x48], si
mov edx, 7
lea esi, [ebp - 6]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp ecx, esi
je 0x4575a0
mov eax, esi
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x48]
call fcn.00403e30
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
cmp edx, 8
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
add eax, eax
push eax
push ecx
push 1
push str.uninst_times
push str.Software_fbd30ee5_8150_549e_9aed_fd9d444307
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x457641
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x457637
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457699
jmp 0x457637
push 1
xor eax, eax
mov dword [ebp - 0x34], 7
push 0x508e08
mov word [ebp - 0x48], ax
call fcn.00403e30
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmovae ecx, dword [ebp - 0x48]
add eax, eax
push eax
push ecx
push 1
push str.uninst_times
push str.Software_fbd30ee5_8150_549e_9aed_fd9d444307
push SysReAllocString
call ebx
jmp 0x4575c5
push edx
push ecx
call fcn.004bdd39
add esp, 8
lea ecx, [ebp - 0x78]
call fcn.00402e70
lea ecx, [ebp - 0xa8]
call fcn.00402e70
lea ecx, [ebp - 0x90]
call fcn.00402e70
lea ecx, [ebp - 0xc0]
call fcn.00402e70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
int3