Function at 0x4110d0
Capabilities:
Delete registry value
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4aaa2c
mov eax, dword fs:[0]
push eax
sub esp, 0x858
mov eax, dword [0x4c97a0]
xor eax, esp
mov dword [esp + 0x850], eax
push ebx
push esi
push edi
mov eax, dword [0x4c97a0]
xor eax, esp
push eax
lea eax, [esp + 0x868]
mov dword fs:[0], eax
push 0x40e
mov edi, ecx
xor esi, esi
lea ecx, [esp + 0x452]
xor eax, eax
push esi
push ecx
mov word [esp + 0x458], ax
call fcn.0048dc10
add esp, 0xc
mov eax, 1
push 0x40e
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x42]
xor edx, edx
push esi
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], esi
mov word [esp + 0x48], dx
call fcn.0048dc10
mov edx, dword [edi + 0x800]
add esp, 0xc
push 0x208
lea ecx, [esp + 0x450]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x4b42e8
lea eax, [esp + 0x450]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x450]
call fcn.0046c8c0
lea ebx, [esp + 0x14]
mov dword [esp + 0x870], esi
call fcn.0045fb50
mov ebx, eax
call fcn.0045fa60
lea ecx, [esp + 0x14]
call fcn.0045c8c0
sub eax, 1
je 0x41146d
sub eax, 1
je 0x41143e
sub eax, 1
je 0x4113fc
mov esi, dword [esp + 0x14]
mov eax, 0x4d02a0
call fcn.0045ca20
mov eax, dword [esp + 0x14]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push str.SavePath
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov dword [esp + 0x870], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411243
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
cmp dword [edi + 0x3b8], ebx
je 0x411255
mov dword [esp + 0x28], 1
push 4
lea ecx, [esp + 0x2c]
push ecx
push 4
push str.SaveFile
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [edi + 0x450], ebx
je 0x411281
mov dword [esp + 0x1c], 1
jmp 0x411292
mov edx, dword [edi + 0x580]
neg edx
sbb edx, edx
and edx, 2
mov dword [esp + 0x1c], edx
push 4
lea eax, [esp + 0x20]
push eax
push 4
push str.Silent
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [edi + 0x534], ebx
je 0x4112b8
mov dword [esp + 0x24], ebx
push 4
lea ecx, [esp + 0x28]
push ecx
push 4
push str.DownAndInstall
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [edi + 0x5cc], ebx
jne 0x411310
mov dword [esp + 0x18], ebx
call fcn.004121b0
test eax, eax
je 0x411301
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.CloseUpdate
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [edi + 0x664], ebx
je 0x411325
call fcn.00460a10
jmp 0x41134d
cmp dword [esp + 0x18], 1
jne 0x4112de
call fcn.00411fd0
push 4
lea edx, [esp + 0x1c]
push edx
jmp 0x4112ee
push 4
lea ecx, [esp + 0x3c]
push ecx
push 4
push str.UseAIRestore
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x50], ebx
call esi
mov eax, 0x4d0ea0
call fcn.0045c760
mov eax, dword [edi + 0x804]
push 0x208
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [edi + 0x618], ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x411385
lea ecx, [esp + 0x3c]
push ecx
call edi
test eax, eax
jle 0x411385
mov dword [esp + 0x20], 1
push 4
lea edx, [esp + 0x24]
push edx
push 4
push str.pathtype
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [esp + 0x20], 1
jne 0x4113dd
lea eax, [esp + 0x3c]
push eax
call edi
test eax, eax
jle 0x4113dd
lea ecx, [esp + 0x3c]
push ecx
call edi
add eax, eax
push eax
lea edx, [esp + 0x40]
push edx
push 1
push str.netpath
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, 1
jmp 0x4114e6
push str.netpath
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov eax, 1
jmp 0x4114e6
lea eax, [esp + 0x34]
push eax
mov ecx, 0x9d8a
call fcn.0046c8c0
mov byte [esp + 0x870], 3
mov eax, dword [eax]
push 0
push eax
call fcn.004786d0
mov byte [esp + 0x878], 0
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4114ad
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x9d89
call fcn.0046c8c0
mov byte [esp + 0x870], 1
mov eax, dword [eax]
push 0
push eax
call fcn.004786d0
mov byte [esp + 0x878], 0
mov eax, dword [esp + 0x34]
jmp 0x41149a
lea ecx, [esp + 0x30]
push ecx
mov ecx, 0x9d88
call fcn.0046c8c0
mov byte [esp + 0x870], 2
mov eax, dword [eax]
push 0
push eax
call fcn.004786d0
mov byte [esp + 0x878], 0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
add esp, 8
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4114b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x870], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4114e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x868]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x850]
xor ecx, esp
call fcn.0048b133
mov esp, ebp
pop ebp
ret