Function at 0x412267
Capabilities:
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x254
mov eax, 0x46bfa0
call fcn.00443910
lea eax, [ebp - 0x258]
push eax
call fcn.004133e2
push ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x228], esp
push 0x474f2c
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360DrvMgr.exe
push edi
push eax
mov byte [ebp - 4], 1
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004125db
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 2
call fcn.00413450
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041263d
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.Path
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push edi
push eax
mov byte [ebp - 4], 3
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004125db
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 4
call fcn.00413450
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041263d
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.PathSub
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push edi
push eax
mov byte [ebp - 4], 5
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004125db
push eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x258]
call fcn.00413450
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041263d
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push 0x474f2c
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push str.Software360DrvMgrInstallPath
push eax
mov byte [ebp - 4], 7
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004125db
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 8
call fcn.00413450
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041263d
push ecx
mov eax, esp
mov dword [ebp - 0x228], esp
push str.UninstallString
push eax
call fcn.00402ad3
push ecx
mov eax, esp
mov dword [ebp - 0x22c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360DrvMgr
push eax
mov byte [ebp - 4], 9
call fcn.00402ad3
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], bl
call fcn.004125db
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0xa
call fcn.00413450
lea esi, [ebp - 0x240]
mov byte [ebp - 4], bl
call fcn.0041263d
mov ebx, dword [ebp - 0x24c]
lea edi, [ebp - 0x258]
lea esi, [ebp - 0x234]
call fcn.00413967
jmp 0x412592
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0043e330
mov dword [ebp - 0x25c], esi
add esp, 0xc
lea esi, [ebp - 0x234]
mov dword [ebp - 0x260], 1
call fcn.00413987
mov edi, dword [eax + 8]
call fcn.00413987
mov ebx, dword [eax + 4]
call fcn.00413987
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x260]
push ecx
push edi
push ebx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x412587
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00402ad3
push 0x5c
push 0x2f
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0xb
call fcn.00408baf
mov edi, 0x476838
jmp 0x412503
lea eax, [ebp - 0x224]
push eax
call fcn.004131d4
push edi
xor ecx, ecx
lea esi, [ebp - 0x224]
call fcn.00406a54
cmp eax, 0xffffffff
jne 0x4124f7
lea eax, [ebp - 0x220]
push eax
mov eax, esi
push eax
call fcn.004134d9
test eax, eax
je 0x412575
mov ecx, dword [ebp - 0x224]
mov eax, dword [ecx - 0xc]
lea esi, [ebp - 0x234]
lea edi, [eax + eax + 2]
mov dword [ebp - 0x22c], ecx
call fcn.00413987
mov ebx, dword [eax + 8]
call fcn.00413987
mov eax, dword [eax + 4]
mov dword [ebp - 0x228], eax
call fcn.00413987
push edi
push dword [ebp - 0x22c]
push 1
push ebx
push dword [ebp - 0x228]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.004031f6
lea esi, [ebp - 0x234]
call fcn.004139af
mov ebx, dword [ebp - 0x248]
lea edi, [ebp - 0x258]
lea esi, [ebp - 0x23c]
call fcn.00413967
mov edi, esi
lea esi, [ebp - 0x234]
call fcn.0041364d
test al, al
je 0x412459
lea esi, [ebp - 0x258]
call fcn.004135c5
push dword [ebp - 0x258]
call fcn.0043b2ae
pop ecx
call fcn.00443993
ret