Function at 0x427366
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2acc]
mov eax, 0x2acc
call fcn.00467130
push 0xffffffffffffffff
push 0x488284
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x2ac8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x4c4f30
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], esi
call fcn.00401ce4
mov ebx, 0x800
xor edi, edi
push ebx
lea eax, [ebp]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004670a0
add esp, 0xc
push 0x2711
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], ebx
call fcn.004029f9
mov ecx, dword [esi + 4]
mov byte [ebp - 4], 1
call fcn.0044c754
mov ecx, eax
call fcn.0042dd05
test eax, eax
jne 0x4274d2
mov ecx, dword [esi + 4]
call fcn.0044c754
mov ecx, eax
call fcn.0042dd11
mov ecx, dword [esi + 4]
call fcn.0044c754
mov ecx, eax
call fcn.0042dd0d
push eax
lea ecx, [ebp - 0x10]
call fcn.00401d13
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
jne 0x4274de
xor eax, eax
push 0x1fe
mov word [ebp + 0x2800], ax
lea eax, [ebp + 0x2802]
push edi
push eax
call fcn.004670a0
push edi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x2800]
push eax
mov esi, str.frompid
push esi
push str.http:__www.360.cn
mov dword [ebp - 0x18], 0x100
call fcn.00423d46
lea eax, [ebp + 0x2800]
push eax
call fcn.004673c7
add esp, 0x28
test eax, eax
jne 0x42749f
push edi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x2800]
push eax
push esi
push str.http:__www.360safe.com
call fcn.00423d46
add esp, 0x18
lea eax, [ebp + 0x2800]
push eax
call fcn.004673c7
pop ecx
test eax, eax
jne 0x4274c1
push dword [ebp - 0x28]
lea eax, [ebp + 0x2800]
push eax
call fcn.004689b2
pop ecx
pop ecx
lea eax, [ebp + 0x2800]
push eax
lea ecx, [ebp - 0x10]
call fcn.004025eb
jmp 0x4274de
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401d13
push ebx
lea eax, [ebp + 0x1000]
push edi
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp - 0x20]
push eax
push str.PrePartner
mov edi, str.SOFTWARE360SafeCoop
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebx
lea eax, [ebp + 0x2000]
push 0
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x2000]
push eax
lea eax, [ebp - 0x20]
push eax
push str.PartnerName
push edi
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebx
lea eax, [ebp + 0x800]
push 0
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x800]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x492b5c
push edi
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebx
lea eax, [ebp + 0x1800]
push 0
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x1800]
push eax
lea eax, [ebp - 0x20]
push eax
push str.registtime
push edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
call ebx
push 0x4c4f30
lea ecx, [ebp - 0x18]
call fcn.00401ce4
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
mov byte [ebp - 4], 2
call fcn.0044c6bb
test eax, eax
jne 0x4275db
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401d13
jmp 0x42762e
xor eax, eax
push 0xc6
push eax
mov word [ebp + 0x2a00], ax
lea eax, [ebp + 0x2a02]
push eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x24], 0x64
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x2a00]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x492b30
push edi
push esi
call ebx
lea eax, [ebp + 0x2a00]
push eax
lea ecx, [ebp - 0x18]
call fcn.004025eb
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp + 0x1000]
push eax
call fcn.004673c7
pop ecx
test eax, eax
jne 0x427664
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 0xc]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add eax, eax
push eax
push ecx
push 1
push str.PrePartner
push edi
push esi
call ebx
jmp 0x4276c3
push str._Installed
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040d822
lea ecx, [ebp + 0x2000]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 3
call fcn.0040d822
mov ecx, dword [ebp - 0x2c]
add esp, 0x18
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004023e9
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx - 0xc]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add eax, eax
push eax
push ecx
push 1
push str.PrePartner
push edi
push esi
call ebx
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004023e9
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
call fcn.0044c754
mov ecx, eax
call fcn.0042dd05
test eax, eax
je 0x4276f2
lea eax, [ebp + 0x2000]
push eax
call fcn.004673c7
pop ecx
add eax, eax
push eax
lea eax, [ebp + 0x2000]
push eax
jmp 0x4276fc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push 1
push str.PartnerName
push edi
push esi
call ebx
lea eax, [ebp + 0x800]
push eax
call fcn.004673c7
pop ecx
add eax, eax
push eax
lea eax, [ebp + 0x800]
push eax
push 1
push 0x492b5c
push edi
push esi
call ebx
lea eax, [ebp + 0x1800]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004029f9
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004080bb
lea ecx, [ebp - 0x1c]
call fcn.00408131
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x427765
add eax, eax
push eax
push ecx
push 1
push str.registtime
push edi
push esi
call ebx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push 0x492b30
push edi
push esi
call ebx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2ac8]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x2acc
leave
ret