Function at 0x405e98
Capabilities:
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x45b480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edx, ecx
call fcn.00413d6a
cmp eax, 0x60001
jb 0x406696
cmp eax, 0x60002
je 0x406696
test edx, edx
je 0x405ed8
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00405967
mov dword [ebp - 0x448], eax
test eax, eax
jne 0x405ef3
call fcn.0041390d
mov ebx, eax
jmp 0x406137
call fcn.00402506
push eax
lea ecx, [ebp - 0x440]
call fcn.00402331
call fcn.00402506
push eax
lea ecx, [ebp - 0x43c]
call fcn.00402331
lea edx, [ebp - 0x43c]
lea ecx, [ebp - 0x440]
call fcn.00404931
mov ebx, eax
test ebx, ebx
jne 0x40611b
mov edx, 0x454658
lea ecx, [ebp - 0x430]
call fcn.00414cd0
mov edi, dword [ebp - 0x430]
lea ecx, [ebp - 0x43c]
push edi
call fcn.00401831
test eax, eax
je 0x406113
mov ecx, dword [ebp - 0x440]
lea edx, [ebp - 0x434]
and dword [ebp - 0x434], 0
call fcn.00404b07
mov ebx, eax
test ebx, ebx
jne 0x406113
cmp dword [ebp - 0x434], eax
jne 0x405f8e
mov ebx, 0x80004005
jmp 0x406113
call fcn.00402506
push eax
lea ecx, [ebp - 0x410]
call fcn.00402331
lea edx, [ebp - 0x410]
mov ecx, str._SystemDrive_360SysRt360PatchMgr.exe
call fcn.00414098
mov esi, dword [ebp - 0x410]
mov ebx, eax
test ebx, ebx
je 0x405fcf
jle 0x40610b
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40610b
cmp dword [esi - 0xc], 0
jne 0x405fdf
mov ebx, 0x80004005
jmp 0x40610b
mov ecx, esi
call fcn.00413841
call fcn.00402506
push eax
lea ecx, [ebp - 0x434]
call fcn.00402331
lea edx, [ebp - 0x434]
xor ecx, ecx
call fcn.004141aa
mov ebx, eax
test ebx, ebx
je 0x40601e
jle 0x4060fd
movzx ebx, bx
or ebx, 0x80070000
jmp 0x4060fd
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x12000000
push 3
push 0
push 5
push SysReAllocStringLen
push dword [ebp - 0x434]
call ebx
mov edi, eax
mov dword [ebp - 0x438], edi
cmp edi, 0xffffffff
jne 0x406057
call fcn.0041390d
mov ebx, eax
jmp 0x4060ec
xor eax, eax
push eax
push 0x12000080
push 2
push eax
push eax
push 0x40000000
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x418], eax
jmp 0x4060be
cmp dword [ebp - 0x40c], 0
je 0x406150
push 0
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4060da
mov eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x424]
jne 0x406149
push 0
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push edi
call ebx
test eax, eax
jne 0x406079
call fcn.0041390d
mov ebx, eax
lea ecx, [ebp - 0x418]
call fcn.00411dea
lea ecx, [ebp - 0x438]
call fcn.00411dea
mov edi, dword [ebp - 0x430]
mov ecx, dword [ebp - 0x434]
lea ecx, [ecx - 0x10]
call fcn.004025d7
lea ecx, [esi - 0x10]
call fcn.004025d7
lea ecx, [edi - 0x10]
call fcn.004025d7
mov ecx, dword [ebp - 0x43c]
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov ecx, dword [ebp - 0x440]
lea ecx, [ecx - 0x10]
call fcn.004025d7
lea ecx, [ebp - 0x448]
call fcn.0041136e
mov eax, ebx
jmp 0x40669b
mov ebx, 0x80004005
jmp 0x4060e1
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x418]
call fcn.00411dea
lea ecx, [ebp - 0x438]
call fcn.00411dea
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov ebx, eax
test ebx, ebx
jne 0x406189
mov ebx, 0x80004005
jmp 0x4060f7
sub ebx, 2
lea ecx, [ebp - 0x424]
mov eax, ebx
mov dword [ebp - 0x414], ebx
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.00411308
mov ecx, ebx
call fcn.004017c9
lea ebx, [eax*2 + 0x240]
mov dword [ebp - 0x418], ebx
test bl, 7
je 0x4061ca
and ebx, 0xfffffff8
add ebx, 8
mov dword [ebp - 0x418], ebx
call fcn.00402506
push eax
lea ecx, [ebp - 0x438]
call fcn.00402331
push ebx
lea ecx, [ebp - 0x438]
call fcn.0040281d
mov ebx, eax
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
mov dword [ebp - 0x40c], ebx
push ecx
mov ecx, eax
mov dword [ebp - 0x444], eax
mov dword [ebx], 3
mov edi, esp
call fcn.00402227
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.004057ec
mov ebx, eax
pop ecx
test ebx, ebx
je 0x406235
jle 0x406678
movzx ebx, bx
or ebx, 0x80070000
jmp 0x406678
mov edi, dword [ebp - 0x40c]
push ecx
mov ecx, esi
lea eax, [edi + 0x14]
push eax
call fcn.004136da
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x406678
push dword [ebp - 0x414]
lea eax, [edi + 0x24]
push 0x104
push eax
call fcn.004451a0
add esp, 0xc
test eax, eax
je 0x406278
mov ebx, 0x8000ffff
jmp 0x406678
mov dword [ebp - 0x414], edi
mov edi, dword [ebp - 0x418]
mov ebx, edi
and ebx, 0xfffffff8
je 0x4062a6
mov esi, dword [ebp - 0x414]
mov ecx, esi
call fcn.00404f18
add esi, 8
sub ebx, 8
jne 0x406291
mov esi, dword [ebp - 0x410]
and dword [ebp - 0x42c], 0
lea eax, [ebp - 0x43c]
and dword [ebp - 0x41c], 0
lea ecx, [ebp - 0x414]
push eax
mov edx, str.BCD00000000Objects_
call fcn.0040cb4e
pop ecx
lea ecx, [ebp - 0x42c]
push ecx
push 0x20019
push 4
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x414]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.004025d7
test ebx, ebx
jne 0x406384
lea eax, [ebp - 0x430]
mov edx, str.BCD00000000Objects_
push eax
lea ecx, [ebp - 0x414]
call fcn.0040cb4e
pop ecx
xor edx, edx
lea ecx, [ebp - 0x41c]
push edx
push ecx
push edx
push 0x2001f
push 4
push edx
push edx
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0x414]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.004025d7
test ebx, ebx
jne 0x406384
mov edx, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x42c]
call fcn.004147bc
mov ebx, eax
test ebx, ebx
jne 0x406384
push edi
push dword [ebp - 0x40c]
push 3
push eax
push str.Custom
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
je 0x406398
jle 0x40663a
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40663a
push str.360Fix
push ecx
mov ecx, dword [ebp - 0x41c]
mov edx, str.Elements12000004
call fcn.004145f1
pop ecx
pop ecx
lea ecx, [ebp - 0x458]
call fcn.0040460f
mov ebx, eax
test ebx, ebx
jne 0x40663a
call fcn.00402506
push eax
lea ecx, [ebp - 0x410]
call fcn.00402331
and dword [ebp - 0x420], ebx
lea edx, [ebp - 0x458]
push str.Elements14000008
lea ecx, [ebp - 0x418]
call fcn.00414cd0
push eax
mov edx, str.BCD00000000Objects_
lea ecx, [ebp - 0x424]
call fcn.0040cb4e
pop ecx
mov edx, eax
lea ecx, [ebp - 0x414]
call fcn.00401ec9
pop ecx
lea ecx, [ebp - 0x420]
push ecx
push 0x2001f
push 4
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x414]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.004025d7
test ebx, ebx
jne 0x40647b
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x410]
push eax
mov edx, str.Element
call fcn.00414467
mov ebx, eax
pop ecx
test ebx, ebx
je 0x406491
jle 0x406486
movzx ebx, bx
or ebx, 0x80070000
mov edi, dword [ebp - 0x410]
jmp 0x406613
mov edi, dword [ebp - 0x410]
mov ecx, edi
mov edx, dword [ebp - 0x430]
call fcn.00414bb4
test eax, eax
jne 0x40657a
mov ecx, dword [ebp - 0x430]
lea ecx, [ecx - 0x10]
call fcn.00402227
add eax, 0x10
lea ecx, [ebp - 0x40c]
push 0
mov dword [ebp - 0x40c], eax
call fcn.00401c04
mov eax, dword [ebp - 0x40c]
lea ecx, [ebp - 0x40c]
mov ebx, dword [edi - 0xc]
mov eax, dword [eax - 0xc]
add ebx, eax
push ebx
mov dword [ebp - 0x424], eax
call fcn.00402070
push ebx
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x414], eax
call fcn.004020f5
mov ecx, dword [edi - 0xc]
mov eax, dword [ebp - 0x414]
add ecx, ecx
push ecx
mov ecx, dword [ebp - 0x424]
push edi
lea eax, [eax + ecx*2]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x40c]
add esp, 0xc
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 7
push 0
push str.Element
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
je 0x40656c
jle 0x406559
movzx ebx, bx
or ebx, 0x80070000
mov ecx, dword [ebp - 0x40c]
lea ecx, [ecx - 0x10]
call fcn.004025d7
jmp 0x406613
mov ecx, dword [ebp - 0x40c]
lea ecx, [ecx - 0x10]
call fcn.004025d7
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x428]
xor ecx, ecx
push ecx
push eax
push ecx
push 0x20206
push 4
push ecx
push ecx
push dword [0x47e730]
mov dword [ebp - 0x428], ecx
push dword [0x45b4bc]
call ebx
test eax, eax
jne 0x4065f3
xor ecx, ecx
lea eax, [ebp - 0x410]
push ecx
push eax
push ecx
push 0x20006
push 5
push ecx
push ecx
push 0x44cea8
push dword [ebp - 0x428]
mov dword [ebp - 0x410], ecx
call ebx
cmp dword [ebp - 0x410], 0
je 0x4065f3
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp - 0x428], ebx
je 0x406613
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
and dword [ebp - 0x428], eax
cmp dword [ebp - 0x420], 0
je 0x406632
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
and dword [ebp - 0x420], eax
lea ecx, [edi - 0x10]
call fcn.004025d7
cmp dword [ebp - 0x41c], 0
je 0x406659
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
and dword [ebp - 0x41c], eax
cmp dword [ebp - 0x42c], 0
je 0x406678
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
and dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x438]
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov ecx, dword [ebp - 0x444]
call fcn.004025d7
jmp 0x4060f7
mov eax, 0x80004001
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004488a4
leave
ret