Function at 0x42ffc0
Capabilities:
Check if file exists
Delete file
Download url
Query or enumerate registry value
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58e448
mov eax, dword fs:[0]
push eax
sub esp, 0x684
mov eax, dword [0x5f4760]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x678], ebx
lea esi, [ebx + 4]
mov dword [ebp - 0x684], esi
movzx eax, byte [ebx + 0x18]
push eax
mov ecx, dword [esi]
push ecx
mov edx, dword [ebx]
push edx
push str.DoDownload_url:__s__save_path:__s__Https2Http_d
mov ecx, 0x603b54
call fcn.0040af00
add esp, 0x10
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x67c], esp
push esi
push eax
call fcn.00406380
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004306f0
add esp, 8
test eax, eax
jne 0x43009b
mov edi, 0x5d2d34
lea esi, [ebp - 0x678]
call fcn.004065f0
mov ebx, 1
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x678]
push ecx
push 0x5d70d8
push str.tempdir_error
push str.notifyconsole
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [0x604815], bl
mov dword [ebp - 4], 0xffffffff
mov edx, esi
push edx
call fcn.00403090
xor eax, eax
jmp 0x430649
cmp byte [0x604815], 0
je 0x4300f3
mov edi, 0x5d2d34
lea esi, [ebp - 0x680]
call fcn.004065f0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x680]
push eax
push 0x5d70fc
push str.tempdir_error
push str.notifyconsole
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [0x604815], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
push ecx
call fcn.00403090
mov esi, dword [ebp - 0x684]
mov edi, 1
test byte [0x604e00], 1
jne 0x43012c
or dword [0x604e00], edi
mov dword [ebp - 4], 3
push 0x604dfc
call fcn.004030f0
push 0x590bc0
call fcn.004a444f
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [0x604dfc]
cmp dword [edx - 0xc], 0
jne 0x4301d4
mov byte [ebp - 0x418], 0
push 0x3ff
push 0
lea eax, [ebp - 0x417]
push eax
call fcn.004add60
add esp, 0xc
mov dword [ebp - 0x680], edi
mov dword [ebp - 0x67c], 0x400
lea ecx, [ebp - 0x67c]
push ecx
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x680]
push eax
push 0x5d2be4
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4301d4
cmp dword [ebp - 0x680], edi
jne 0x4301d4
cmp dword [ebp - 0x67c], eax
jbe 0x4301d4
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x4301d4
lea edx, [ebp - 0x418]
mov ebx, 0x604dfc
call fcn.00403440
mov ebx, dword [ebp - 0x678]
mov esi, dword [ebp - 0x684]
xor edi, edi
mov ecx, dword [0x604dfc]
cmp dword [ecx - 0xc], edi
je 0x4301e8
call fcn.0042f240
mov edi, eax
push str..tmp
lea edx, [ebp - 0x674]
push edx
mov ecx, esi
call fcn.0040a9e0
add esp, 8
mov dword [ebp - 4], 4
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
mov eax, dword [ebp - 0x674]
push eax
call esi
xor esi, esi
mov dword [ebp - 0x68c], esi
cmp byte [ebx + 0x18], 0
je 0x4302a4
push ecx
lea edx, [ebp - 0x674]
mov ecx, esp
mov dword [ebp - 0x684], esp
push edx
push ecx
cmp dword [0x604344], esi
je 0x430272
call fcn.00406380
mov byte [ebp - 4], 5
push ecx
mov eax, esp
mov dword [ebp - 0x67c], esp
push ebx
push eax
call fcn.00406380
mov byte [ebp - 4], 6
push 1
mov byte [ebp - 4], 4
call fcn.0042ff10
add esp, 0xc
mov esi, eax
jmp 0x4305cf
call fcn.00406380
mov byte [ebp - 4], 7
push ecx
mov eax, esp
mov dword [ebp - 0x67c], esp
push ebx
push eax
call fcn.00406380
mov byte [ebp - 4], 8
push 0
mov byte [ebp - 4], 4
call fcn.0042ff10
add esp, 0xc
mov esi, eax
jmp 0x4305cf
cmp dword [0x604340], 2
jne 0x43041a
cmp dword [0x604344], esi
je 0x43041a
mov byte [ebp - 4], 9
mov ecx, 0x6038b8
call fcn.0042f4b0
test eax, eax
je 0x4303d0
push 0x658
push 0
lea ecx, [ebp - 0x670]
push ecx
call fcn.004add60
add esp, 0xc
push 0x103
mov edx, dword [0x60432c]
push edx
lea eax, [ebp - 0x164]
push eax
call fcn.004a5b40
add esp, 0xc
movzx ecx, word [0x604330]
mov dword [ebp - 0x60], ecx
push 0x1f
mov edx, dword [0x604334]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.004a5b40
add esp, 0xc
push 0x1f
mov ecx, dword [0x604338]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.004a5b40
add esp, 0xc
mov eax, dword [ebx]
push 0x3ff
push eax
lea eax, [ebp - 0x670]
push eax
call fcn.004a5b40
add esp, 0xc
push 0x103
mov ecx, dword [ebp - 0x674]
push ecx
lea edx, [ebp - 0x270]
push edx
call fcn.004a5b40
add esp, 0xc
mov dword [ebp - 0x16c], 0x1e
mov dword [ebp - 0x168], 3
mov dword [ebp - 0x1c], 0x42f710
lea eax, [ebp - 0x670]
push eax
call dword [0x6038c0]
add esp, 4
test eax, eax
jne 0x4303b0
mov esi, 1
mov dword [ebp - 0x68c], esi
mov dword [ebp - 4], 4
jmp 0x4305cf
mov ecx, dword [ebx]
push ecx
push str.Libcurl_download__s_failed.
mov ebx, 3
mov ecx, 0x604408
call fcn.00446e90
add esp, 8
mov ebx, dword [ebp - 0x678]
mov dword [ebp - 4], 4
jmp 0x4305cf
test edi, edi
je 0x430458
mov eax, dword [0x604328]
test eax, eax
je 0x43042c
cmp eax, 1
jne 0x430458
mov ecx, dword [ebx]
cmp dword [0x604344], esi
je 0x430447
mov edx, dword [ebp - 0x674]
push edx
call fcn.0042f7f0
add esp, 4
jmp 0x43048c
mov eax, dword [ebp - 0x674]
push eax
call fcn.0042f7f0
add esp, 4
jmp 0x43048c
mov eax, dword [0x604328]
test eax, eax
je 0x430466
cmp eax, 2
jne 0x43048e
mov ecx, dword [ebx]
cmp dword [0x604344], esi
je 0x43047b
mov edx, dword [ebp - 0x674]
push edx
push 1
jmp 0x430484
mov eax, dword [ebp - 0x674]
push eax
push 0
call fcn.0042fab0
add esp, 8
mov esi, eax
mov eax, dword [0x604328]
test eax, eax
je 0x43049c
cmp eax, 2
jne 0x4304da
test esi, esi
je 0x4304b1
mov ecx, dword [ebp - 0x674]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4304da
mov ecx, dword [ebx]
cmp dword [0x604344], 0
je 0x4304c7
mov edx, dword [ebp - 0x674]
push edx
push 1
jmp 0x4304d0
mov eax, dword [ebp - 0x674]
push eax
push 0
call fcn.0042fab0
mov esi, eax
add esp, 8
mov eax, dword [0x604328]
test eax, eax
je 0x4304ec
cmp eax, 3
jne 0x4305cf
test esi, esi
je 0x430505
mov ecx, dword [ebp - 0x674]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4305cf
mov dword [ebp - method.EntUrlCallback.virtual_0], vtable.EntUrlCallback.0
mov dword [ebp - 0x684], 0
mov byte [ebp - 4], 0xb
mov eax, dword [ebx]
lea edx, [ebp - 0x688]
push edx
push 0
mov ecx, dword [ebp - 0x674]
push ecx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov edi, eax
cmp edi, 0x8007000e
je 0x4305a4
cmp edi, 0x800c0008
je 0x43059d
test edi, edi
je 0x430596
lea edx, [ebp - 0x678]
push edx
call fcn.004030f0
mov byte [ebp - 4], 0xc
push edi
mov eax, dword [ebx]
push eax
push str.URLDownloadToFileA__s_return:__d
lea edi, [ebp - 0x678]
call fcn.00402e20
add esp, 0xc
mov ecx, dword [ebp - 0x678]
push ecx
mov ecx, 0x603b54
call fcn.0040af00
add esp, 4
mov byte [ebp - 4], 0xb
mov edx, edi
push edx
call fcn.00403090
jmp 0x4305c1
mov esi, 1
jmp 0x4305c1
push str.Cannot_access_server_data.
jmp 0x4305a9
push str.Out_of_memory_error.
mov ebx, 3
mov ecx, 0x604408
call fcn.00446e90
mov ebx, dword [ebp - 0x678]
add esp, 4
mov byte [ebp - 4], 4
mov dword [ebp - method.EntUrlCallback.virtual_0], vtable.EntUrlCallback.0
test esi, esi
je 0x430625
mov eax, dword [ebp - 0x674]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x430625
push 0x78
add ebx, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x684], esp
push ebx
push ecx
call fcn.00406380
mov byte [ebp - 4], 0xd
push ecx
mov edx, esp
mov dword [ebp - 0x67c], esp
lea eax, [ebp - 0x674]
push eax
push edx
call fcn.00406380
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 4
call fcn.0040b930
add esp, 0xc
jmp 0x430634
mov ecx, dword [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x674]
push edx
call fcn.00403090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a314d
mov esp, ebp
pop ebp
ret