Function at 0x41d310
Capabilities:
Check if file exists
Create directory
Delete file
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x424aaa
push eax
mov eax, 0x1280
mov dword fs:[0], esp
call fcn.00422620
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x24], esi
call fcn.00405520
test eax, eax
je 0x41d74b
push 0x42f1ac
lea ecx, [esp + 0x1c]
call fcn.004221c8
xor ebx, ebx
push 0x42f1ac
lea ecx, [esp + 0x14]
mov dword [esp + 0x129c], ebx
call fcn.004221c8
push 0x42f1ac
lea ecx, [esp + 0x18]
mov byte [esp + 0x129c], 1
call fcn.004221c8
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xc7a]
mov word [esp + 0xc78], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 4]
mov byte [esp + 0x1298], 2
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
push str.lname
push str.links
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x208
call fcn.00406170
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push eax
push ecx
push ebx
push str.lver
push str.links
call fcn.00406170
mov eax, dword [esi + 4]
lea edx, [esp + 0x3c]
push eax
push edx
push ebx
push 0x42e5f8
push str.links
call fcn.00406170
mov eax, dword [esp + 0x54]
add esp, 0x3c
cmp dword [eax - 8], ebx
je 0x41d716
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 8], ebx
je 0x41d716
mov eax, dword [esp + 0x14]
cmp dword [eax - 8], ebx
je 0x41d716
push eax
call fcn.00406050
add esp, 4
test eax, eax
je 0x41d716
lea edx, [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
push str.links.dll
push str.Software360safeUpdate
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x41d716
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x45a]
mov word [esp + 0x458], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x86a]
mov word [esp + 0x868], bx
rep stosd dword es:[edi], eax
push str.links
lea ecx, [esp + 0x45c]
push 0x40f
push ecx
stosw word es:[edi], ax
call fcn.00405320
lea edx, [esp + 0x464]
push edx
call fcn.00404dd0
add esp, 0x10
test al, al
jne 0x41d4fa
lea eax, [esp + 0x458]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, 0x208
lea eax, [esp + 0x458]
cmp word [eax], bx
je 0x41d513
add eax, 2
dec ecx
jne 0x41d506
jmp 0x41d561
cmp ecx, ebx
je 0x41d561
lea edx, [esp + 0x1c]
test edx, edx
je 0x41d528
mov eax, 0x208
sub eax, ecx
jmp 0x41d52c
mov eax, dword [esp + 0x1c]
mov edx, 0x208
sub edx, eax
lea eax, [esp + eax*2 + 0x458]
je 0x41d561
mov esi, str.linksdll.cab
sub esi, eax
mov cx, word [esi + eax]
cmp cx, bx
je 0x41d557
mov word [eax], cx
add eax, 2
dec edx
jne 0x41d543
jmp 0x41d55b
cmp edx, ebx
jne 0x41d55e
sub eax, 2
mov word [eax], bx
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x458]
push eax
call ebp
push str.linkslinks.dll
lea ecx, [esp + 0x86c]
push 0x40f
push ecx
call fcn.00405320
lea edx, [esp + 0x874]
push edx
call fcn.00404d60
add esp, 0x10
test al, al
je 0x41d5a6
lea eax, [esp + 0x868]
push eax
call ebp
lea ecx, [esp + 0x234]
call fcn.0040f0f0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x458]
push ecx
push edx
lea ecx, [esp + 0x23c]
mov byte [esp + 0x12a0], 3
xor edi, edi
call fcn.0040f320
test eax, eax
je 0x41d69a
lea edx, [esp + 0x868]
lea ecx, [esp + 0xe80]
mov esi, 0x208
lea eax, [esp + 0xe80]
sub edx, ecx
mov cx, word [edx + eax]
cmp cx, bx
je 0x41d60d
mov word [eax], cx
add eax, 2
dec esi
jne 0x41d5f9
jmp 0x41d611
cmp esi, ebx
jne 0x41d614
sub eax, 2
lea edx, [esp + 0xe80]
mov word [eax], bx
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x41d67e
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0xe80]
push eax
call esi
test eax, eax
je 0x41d67e
lea ecx, [esp + 0xe80]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x41d67e
lea edx, [esp + 0xe80]
lea eax, [esp + 0x458]
push edx
push eax
call fcn.00402310
add esp, 8
test eax, eax
je 0x41d67e
lea ecx, [esp + 0x868]
push ecx
call esi
test eax, eax
je 0x41d67e
mov edi, 1
mov edx, dword [esp + 0x10]
push edx
push str.links.dll
push str.Software360safeUpdate
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00405e90
add esp, 0x10
lea eax, [esp + 0x458]
push eax
call ebp
cmp edi, ebx
je 0x41d702
push 0x14
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov byte [esp + 0x1298], 4
je 0x41d6cd
mov ecx, eax
call fcn.004211a0
mov esi, eax
jmp 0x41d6cf
xor esi, esi
lea ecx, [esp + 0x868]
mov byte [esp + 0x1298], 3
push ecx
mov ecx, esi
call fcn.004211f0
cmp esi, ebx
mov edi, eax
je 0x41d6f4
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
cmp edi, ebx
jne 0x41d766
lea eax, [esp + 0x868]
push eax
call ebp
lea ecx, [esp + 0x234]
mov byte [esp + 0x1298], 2
call fcn.0040f140
lea ecx, [esp + 0x14]
mov byte [esp + 0x1298], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x1298], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x1298], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x1290]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x128c
ret
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x868]
push ecx
lea ecx, [edx + 8]
call sub.MFC42u.DLL_CString::operator_2
lea eax, [esp + 0xc78]
push 0x104
lea ecx, [esp + 0x86c]
push eax
push ecx
call fcn.00404e00
add esp, 0xc
test eax, eax
je 0x41d702
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x2c]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
push str.links.dll
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [esp + 0xc78]
lea eax, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x41d702
lea ecx, [esp + 0xc78]
push ecx
push str.links.dll
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00405e90
add esp, 0x10
lea ecx, [esp + 0x234]
mov byte [esp + 0x1298], 2
call fcn.0040f140
lea ecx, [esp + 0x14]
mov byte [esp + 0x1298], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x1298], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x1298], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 1
jmp 0x41d74d