Function at 0x42e240
Capabilities:
Access peb ldr_data
Get process heap force flags
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x474d41
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0x2dc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x2f4]
mov dword fs:[0], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebp, ebp
mov dword [esp + 0x1c], 0x490608
mov dword [0x490614], ebp
mov dword [0x490624], ebp
mov dword [0x490628], ebp
mov dword [0x49062c], ebp
mov dword [0x490630], eax
mov dword [0x490634], ebp
mov dword [0x490638], ebp
mov dword [esp + 0x2fc], ebp
fldz
mov edx, dword [0x48e57c]
fst qword [0x490650]
mov eax, dword [edx + 0xc]
fstp qword [0x490658]
mov ecx, 0x48e57c
mov dword [0x490608], 0x47d484
mov dword [0x49060c], 0x47d4a4
mov dword [0x490610], 0x47d4e0
call eax
add eax, 0x10
mov dword [0x4906b4], eax
mov ebx, 1
mov byte [esp + 0x2fc], bl
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x4906c4], eax
mov byte [esp + 0x2fc], 2
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x4906c8], eax
mov byte [esp + 0x2fc], 3
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x4908e0], eax
mov byte [esp + 0x2fc], 4
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x490b08], eax
mov byte [esp + 0x2fc], 5
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x490b0c], eax
mov byte [esp + 0x2fc], 6
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x490b10], eax
push 0x490b14
mov byte [esp + 0x300], 7
call fcn.0042a060
push 0x490b34
mov byte [esp + 0x300], 8
call fcn.0042a060
push 0x490b54
mov byte [esp + 0x300], 9
call fcn.0042a060
push 0x490b74
mov byte [esp + 0x300], 0xa
call fcn.0042a060
mov dword [0x490b98], ebp
mov dword [0x490b9c], ebp
mov dword [0x490ba0], ebp
mov dword [0x490ba4], ebp
mov dword [0x490ba8], ebp
push 0x490bac
mov byte [esp + 0x300], 0xe
call fcn.0042c8e0
push 0x490bc4
mov byte [esp + 0x300], 0xf
call fcn.00458070
push 0x490be4
mov byte [esp + 0x300], 0x10
call fcn.0042a060
push 0x490c04
mov byte [esp + 0x300], 0x11
call fcn.0042a060
push 0x491268
mov byte [esp + 0x300], 0x12
call fcn.0042cee0
mov byte [esp + 0x2fc], 0x13
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x4912b0], eax
mov byte [esp + 0x2fc], 0x14
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x4912b4], eax
mov byte [esp + 0x2fc], 0x15
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
add eax, 0x10
mov dword [0x4912b8], eax
push 0x491384
mov byte [esp + 0x300], 0x16
call fcn.004442c0
mov esi, 0x49139c
mov byte [esp + 0x2fc], 0x17
call fcn.00440480
push 0x4917c0
call fcn.0042c8e0
push 0x4917d8
mov byte [esp + 0x300], 0x18
call fcn.0042a060
push 0x4917f8
mov byte [esp + 0x300], 0x19
call fcn.0042a060
mov byte [esp + 0x2fc], 0x1a
mov dword [0x490660], ebp
fldz
mov dword [0x490664], ebp
fstp qword [0x4906a0]
mov dword [0x490668], ebp
mov dword [0x49066c], ebp
mov dword [0x490670], ebp
mov dword [0x490674], ebp
mov dword [0x4917bc], ebp
mov dword [0x4906b8], ebp
mov dword [0x490678], ebp
mov dword [0x490b94], ebp
mov dword [0x4908d4], ebp
mov dword [0x4908d8], ebp
mov dword [0x49069c], ebp
mov dword [0x4917ac], ebp
mov dword [0x4917b0], ebp
mov dword [0x4917b4], ebp
mov dword [0x4908dc], ebp
mov dword [0x4908e4], ebp
mov dword [0x490c24], ebp
call fcn.0042d840
push 0xc6
lea edx, [esp + 0x26]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0x2c], cx
call fcn.00462160
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
push str.lastscantime
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0xc8
call esi
test eax, eax
jne 0x42e61f
cmp dword [esp + 0x14], ebp
jbe 0x42e61f
lea edx, [esp + 0x20]
mov edi, 0x4906c4
call fcn.00454900
mov edi, 0x208
push edi
push ebp
push 0x4906cc
call fcn.00462160
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x4908e8
lea ecx, [esp + 0x1c]
push ecx
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push SysReAllocStringLen
mov dword [esp + 0x30], edi
call esi
test eax, eax
jne 0x42e68c
push 0x4908e8
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
push 0x4908e8
push 0x4908e8
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push str.hotfix
push 0x4908e8
push 0x4906cc
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x206
lea eax, [esp + 0xee]
xor edx, edx
push ebp
push eax
mov word [esp + 0xf4], dx
call fcn.00462160
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0x1c]
push eax
push str.SavePath
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edi
call esi
lea ecx, [esp + 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x42e70a
lea eax, [esp + 0xe8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x42e6f3
sub eax, edx
lea edx, [esp + 0xe8]
push edx
jmp 0x42e724
mov eax, 0x4906cc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x42e712
sub eax, edx
push 0x4906cc
sar eax, 1
mov ebx, eax
mov eax, 0x4906c8
call fcn.00454860
mov eax, dword [0x4906c8]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, 0x490608
mov ecx, dword [esp + 0x2f4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2dc]
xor ecx, esp
call fcn.00460259
add esp, 0x2ec
ret