Function at 0x41fad4
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5754
call fcn.00432710
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
cmp dword [esi + 0x1514], 1
jne 0x420212
xor edi, edi
cmp dword [esi + 0x14f4], edi
jne 0x420212
push dword [esi + 0x3c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x420212
push ebx
mov ebx, str.option
push dword [esi + 0x3c]
push edi
push 0x463d70
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xc], eax
mov word [ebp - 0xa24], di
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xa22]
push str.Software360360se5
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x463d38
lea eax, [ebp - 0xa24]
push 0x3ff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x41fb7d
mov eax, dword [ebp - 8]
add esi, 0x38
add eax, 0x3c
mov ecx, esi
push eax
call fcn.00404768
jmp 0x41fbe8
mov eax, dword [ebp - 8]
add esi, 0x38
add eax, 0x40
mov ecx, esi
push eax
call fcn.00404768
push 0x464b38
lea ecx, [ebp - 0xc]
call fcn.00404707
mov eax, dword [ebp - 0xc]
push 1
pop ecx
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax - 8]
shl edx, 1
push edx
push eax
push ecx
lea eax, [ebp - 0xa24]
push 0x464b20
push eax
push SysReAllocString
call edi
lea eax, [ebp - 0x14]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464b0c
push eax
push SysReAllocString
call edi
lea ecx, [ebp - 0xc]
call fcn.00404beb
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 1
push 0x464af4
push ebx
call edi
push dword [esi]
mov dword [ebp - 0x18], eax
push 1
push 0x464ad8
push ebx
call edi
push dword [esi]
mov dword [ebp - 0x10], eax
push 1
push 0x464abc
push ebx
call edi
push dword [esi]
mov dword [ebp - 0xc], eax
push 1
push 0x464aa0
push ebx
call edi
push dword [esi]
mov dword [ebp - 0x14], eax
push 0
push 0x464a88
push ebx
call edi
mov ecx, dword [ebp - 0x14]
and word [ebp - 0x36c4], 0
lea edi, [ebp - 0x36c2]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*4]
mov ecx, 0x823
lea eax, [eax + eax + 0x25]
mov dword [ebp - 0x1c], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 8]
stosw word es:[edi], ax
mov edi, 0x1047
lea eax, [ebp - 0x36c4]
push edi
push eax
call fcn.0041e741
lea eax, [ebp - 0x36c4]
push 0x467084
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x41fcb1
push str.hao.360.cn
lea eax, [ebp - 0x36c4]
push edi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0xc
lea eax, [ebp - 0x36c4]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [ebp - 0x36c4]
push eax
mov ecx, 0x467050
call fcn.00404264
and word [ebp - 0x224], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 8]
add eax, 0x3c
push dword [eax]
lea eax, [ebp - 0x224]
push 0x104
push eax
push 0x467084
push 0x464640
push 0x464634
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x224], 0
je 0x41fe0a
and word [ebp - 0xc2c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xc2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.Software360360se5
push 0x464260
lea eax, [ebp - 0xc2c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [ebp - 8]
add esp, 0x10
lea edi, [eax + 0x14f8]
lea eax, [ebp - 0x224]
test eax, eax
je 0x41fd78
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x224]
push ecx
push eax
mov ecx, edi
call fcn.00404cc7
and word [ebp - 0xe34], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xe32]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
mov edi, SysReAllocString
push eax
lea eax, [ebp - 0xe34]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc2c]
push 0x464640
push eax
push edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x18], 0x206
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41fde2
cmp word [ebp - 0xe34], ax
jne 0x41fe0f
mov eax, dword [ebp - 8]
add eax, 0x14f8
mov eax, dword [eax]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
lea eax, [ebp - 0xc2c]
push 0x464640
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x41fe0f
mov edi, SysReAllocString
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.004208be
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.00420fed
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.00420998
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.0042134c
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.00420cd9
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.00420e8a
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464a74
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 0
push 0x464a60
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464a60
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 0
push 0x464a44
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464a44
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 0
push 0x464a24
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464a24
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 1
push 0x464a08
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464a08
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 1
push 0x4649f4
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x4649f4
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 1
push 0x4649d4
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x4649d4
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 1
push 0x4649c0
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x4649ac
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 0
push 0x464998
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464998
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 0
push 0x46497c
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464968
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 1
push 0x464950
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464950
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 1
push 0x46493c
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x46493c
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi]
push 0
push 0x464924
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
mov dword [ebp - 4], eax
jne 0x4200de
push dword [esi]
push 0
push 0x464904
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov dword [ebp - 4], eax
je 0x4200fe
cmp eax, 0x32
jge 0x42009a
push 0x32
pop eax
mov dword [ebp - 4], eax
mov ecx, 0x190
cmp eax, ecx
jle 0x4200a6
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x4648f0
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0xa24]
push 0x464924
mov dword [ebp - 4], 1
push eax
jmp 0x4200f7
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0x4648d8
mov dword [ebp - 4], 0x186a0
push 0x464884
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
and word [ebp - 0x1634], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1632]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.Software360360se5
push 0x46485c
lea eax, [ebp - 0x1634]
push 0x3ff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
xor edi, edi
mov eax, dword [0x43c4ec]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push 0x4644f8
push eax
call fcn.00409c93
add esp, 0xc
push dword [esi]
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0x46484c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x420189
lea eax, [ebp - 4]
push 4
push eax
push 4
push dword [ebp - 0xc]
lea eax, [ebp - 0x1634]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0xc]
call fcn.00404beb
inc edi
cmp edi, 0xf
jle 0x420138
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.00421c88
push dword [esi]
mov ecx, dword [ebp - 8]
call fcn.0042065f
and word [ebp - 0x5754], 0
mov ecx, 0x823
xor eax, eax
lea edi, [ebp - 0x5752]
push dword [esi]
mov esi, 0x463d5c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x5754]
push 0x104
push eax
push 0x467084
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x5754]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x5754]
push eax
push 1
lea eax, [ebp - 0xa24]
push esi
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ebx
pop edi
pop esi
leave
ret