Function at 0x41ecc0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x47e55d
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov eax, dword [0x4a1014]
mov edi, ecx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [edi + 8]
mov dword [esp + 0x26c], 0
call fcn.00440930
mov edx, dword [0x4a1014]
push 0x2711
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], edx
call fcn.0041cf30
mov ecx, dword [edi + 8]
mov byte [esp + 0x268], 1
call fcn.00424940
mov ecx, eax
call fcn.00424970
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jl 0x41ed69
mov esi, eax
lea eax, [esi - 0xc]
push eax
mov dword [esp + 0x1c], esi
call ebx
jmp 0x41ed81
mov ecx, dword [0x4a1014]
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0041ca80
mov esi, dword [esp + 0x18]
cmp dword [esi - 8], 0
mov byte [esp + 0x268], 2
jne 0x41eda1
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
call fcn.0041ca20
mov esi, dword [esp + 0x18]
mov eax, dword [0x4a1014]
push 0x2850
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], eax
call fcn.0041cf30
mov eax, dword [esp + 0x24]
mov byte [esp + 0x268], 3
mov ecx, 0x4871e4
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41edf6
test dx, dx
je 0x41edf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41edf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41edd0
xor eax, eax
jmp 0x41edfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41ee63
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x5a]
push edx
mov word [esp + 0x5c], cx
call fcn.00461880
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x4871dc
push str.SOFTWARE360desktop
push SysReAllocString
mov dword [esp + 0x38], 1
mov dword [esp + 0x2c], 0x103
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jl 0x41ee63
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041ca80
mov esi, dword [esp + 0x18]
mov eax, dword [esi - 8]
lea ecx, [eax + eax]
push ecx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x4871dc
push str.Software360Desktop
push SysReAllocString
call esi
mov ecx, dword [edi + 8]
call fcn.00424940
mov ecx, eax
call fcn.004249d0
mov edx, dword [eax]
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push str.JoinUserExperience
push str.Software360Desktop
push SysReAllocString
mov dword [esp + 0x40], edx
call esi
push 4
lea ecx, [esp + 0x2c]
push ecx
push 4
push str.JoinUserExperience
push str.Software360WallPaper
push SysReAllocString
call esi
push 4
lea edx, [esp + 0x2c]
push edx
push 4
push str.JoinUserExperience
push str.Software360gamebox
push SysReAllocString
call esi
mov ecx, dword [edi + 8]
call fcn.0043f500
mov eax, dword [eax]
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
push str.CreateDesktopShortcut
push str.Software360Desktop
push SysReAllocString
mov dword [esp + 0x4c], eax
call esi
mov ecx, dword [edi + 8]
call fcn.0043f520
mov edx, dword [eax]
push 4
lea eax, [esp + 0x40]
push eax
push 4
push str.StartMenu
push str.Software360Desktop
push SysReAllocString
mov dword [esp + 0x54], edx
call esi
mov ecx, dword [edi + 8]
call fcn.0043f510
mov ecx, dword [eax]
push 4
lea edx, [esp + 0x3c]
push edx
push 4
push str.QuickLaunch
push str.Software360Desktop
push SysReAllocString
mov dword [esp + 0x50], ecx
call esi
mov ecx, dword [edi + 8]
call fcn.0043f530
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x41ef7d
mov ebp, eax
lea eax, [ebp - 0xc]
push eax
mov dword [esp + 0x24], ebp
call ebx
jmp 0x41ef95
mov ecx, dword [0x4a1014]
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x24]
call fcn.0041ca80
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp - 8]
lea edx, [eax + eax]
push edx
push ebp
push 1
push str.Version
push str.SOFTWARE360Desktop
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x280], 4
call esi
mov ecx, dword [edi + 8]
call fcn.0043f6d0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push eax
call edx
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
je 0x41f02e
push str.Bin360Desktop.exe
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0041dfe0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
lea edx, [ecx + ecx]
push edx
push eax
push 1
push str.uac0
push str.SOFTWARE360Desktop
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a1010]
je 0x41f02e
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x41f02e
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00461ef0
add esp, 4
push 0x486b40
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Bin_addapp.html
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.0041dfe0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
push 1
push 0x491898
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push SysReAllocString
call esi
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x4a1014]
mov dword [esp + 0x14], eax
movzx ecx, word [esp + 0x4a]
movzx edx, word [esp + 0x48]
movzx eax, word [esp + 0x46]
push ecx
movzx ecx, word [esp + 0x46]
push edx
movzx edx, word [esp + 0x48]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push str._04d_02d_02d_02d_02d
push eax
mov byte [esp + 0x284], 6
call fcn.0041dfb0
mov edi, dword [esp + 0x30]
mov ecx, dword [edi - 8]
add esp, 0x1c
add ecx, ecx
push ecx
push edi
push 1
push str.UpdateTime
push str.Software360Desktop
push SysReAllocString
call esi
lea edx, [edi - 0xc]
cmp edx, dword [0x4a1010]
je 0x41f0f8
lea esi, [edi - 0xc]
push esi
call ebx
test eax, eax
jg 0x41f0f8
push esi
call fcn.00461ef0
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a1010]
je 0x41f121
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x41f121
mov edx, dword [esp + 0x2c]
add edx, 0xfffffff4
push edx
call fcn.00461ef0
add esp, 4
lea eax, [ebp - 0xc]
cmp eax, dword [0x4a1010]
je 0x41f13f
lea esi, [ebp - 0xc]
push esi
call ebx
test eax, eax
jg 0x41f13f
push esi
call fcn.00461ef0
add esp, 4
mov esi, dword [esp + 0x24]
lea ecx, [esi - 0xc]
cmp ecx, dword [0x4a1010]
je 0x41f161
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x41f161
push esi
call fcn.00461ef0
add esp, 4
mov esi, dword [esp + 0x18]
lea edx, [esi - 0xc]
cmp edx, dword [0x4a1010]
je 0x41f183
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x41f183
push esi
call fcn.00461ef0
add esp, 4
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a1010]
je 0x41f1a5
lea esi, [eax - 0xc]
push esi
call ebx
test eax, eax
jg 0x41f1a5
push esi
call fcn.00461ef0
add esp, 4
mov eax, dword [esp + 0x1c]
lea edx, [eax - 0xc]
cmp edx, dword [0x4a1010]
je 0x41f1ce
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x41f1ce
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff4
push eax
call fcn.00461ef0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.00461862
add esp, 0x258
ret