Function at 0x45ee00
Capabilities:
Check if file exists
Enumerate files on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0xa8]
push edi
mov dword [ebp - 0x390], esi
call fcn.0040e9e0
cmp dword [ebp - 0x94], 8
lea eax, [ebp - 0xa8]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0xa8]
push eax
call ebx
test eax, eax
jne 0x45ee63
cmp dword [ebp - 0x94], 8
lea ecx, [ebp - 0xa8]
cmovae ecx, dword [ebp - 0xa8]
call fcn.0040f420
sub esp, 0x18
lea eax, [esi + 0xd8]
mov ecx, esp
push eax
call fcn.004032f0
lea ecx, [ebp - 0x138]
call fcn.00402070
push 0
call fcn.004c82ab
add esp, 0x1c
push eax
call fcn.004cd8a1
add esp, 4
call fcn.004cd880
mov ecx, eax
lea esi, [ebp - 6]
test ecx, ecx
jns 0x45eed0
neg ecx
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x45eea2
add esi, 0xfffffffe
mov eax, 0x2d
mov word [esi], ax
jmp 0x45eef0
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x45eed0
xor eax, eax
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
lea eax, [ebp - 6]
mov dword [ebp - 0x34], 7
cmp esi, eax
je 0x45ef19
sub eax, esi
lea ecx, [ebp - 0x48]
sar eax, 1
push eax
push esi
call fcn.00403e30
push 0xb
push str.hbthemedll_
push 0
lea ecx, [ebp - 0x48]
call fcn.004057c0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xc0], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x34]
movq qword [ebp - 0xb0], xmm0
cmp edx, 8
jb 0x45ef8e
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45ef84
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f685
push edx
push ecx
call fcn.004bdd39
add esp, 8
lea eax, [ebp - 0xc0]
push eax
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x48]
call fcn.004195e0
mov esi, eax
add esp, 4
mov edx, dword [esi + 0x14]
mov eax, edx
mov ecx, dword [esi + 0x10]
sub eax, ecx
cmp eax, 4
jb 0x45efe7
lea ebx, [ecx + 4]
mov edi, esi
mov dword [esi + 0x10], ebx
cmp edx, 8
jb 0x45efc6
mov edi, dword [esi]
push 8
lea eax, [edi + ecx*2]
push str..cab
push eax
call fcn.004c0040
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2], ax
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x45f006
push 4
push str..cab
mov byte [ebp - 0x38c], 0
mov ecx, esi
push dword [ebp - 0x38c]
push 4
call fcn.00404fc0
mov esi, eax
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x120], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x110], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x45f06a
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f060
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f68a
push edx
push ecx
call fcn.004bdd39
add esp, 8
lea ecx, [ebp - 0x20]
call fcn.0040e9e0
cmp dword [ebp - 0xac], 8
lea ecx, [ebp - 0xc0]
push dword [ebp - 0xb0]
cmovae ecx, dword [ebp - 0xc0]
push ecx
mov ecx, eax
call fcn.00403f90
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x34]
mov eax, edx
mov ecx, dword [ebp - 0x38]
sub eax, ecx
cmp eax, 1
jb 0x45f0f5
cmp edx, 8
lea esi, [ebp - 0x48]
push 2
cmovae esi, dword [ebp - 0x48]
lea edi, [ecx + 1]
push 0x5010bc
mov dword [ebp - 0x38], edi
lea eax, [esi + ecx*2]
push eax
call fcn.004c0040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
lea eax, [ebp - 0x48]
jmp 0x45f113
push 1
push 0x5010bc
mov byte [ebp - 0x38c], 0
lea ecx, [ebp - 0x48]
push dword [ebp - 0x38c]
push 1
call fcn.00404fc0
movups xmm0, xmmword [eax]
xor ecx, ecx
movups xmmword [ebp - 0xd8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x45f177
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f16d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f68f
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
cmp edx, 8
jb 0x45f1c5
mov ecx, dword [ebp - 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f1bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f68f
push edx
push ecx
call fcn.004bdd39
add esp, 8
push 6
xor eax, eax
mov dword [ebp - 0x38], 0
push str.theme_
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.00403e30
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x78]
call fcn.00415a50
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x45f22d
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f223
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f694
push edx
push ecx
call fcn.004bdd39
add esp, 8
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
cmovae eax, dword [ebp - 0x78]
push eax
call ebx
test eax, eax
jne 0x45f24f
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x78]
cmovae ecx, dword [ebp - 0x78]
call fcn.0040f420
push 6
xor eax, eax
mov dword [ebp - 0x38], 0
push str.theme_
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.00403e30
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x390]
add eax, 0xf0
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0045f6a0
mov edx, dword [ebp - 0x34]
mov esi, eax
cmp edx, 8
jb 0x45f2dc
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f2d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f699
push edx
push ecx
call fcn.004bdd39
add esp, 8
test esi, esi
je 0x45f2ff
push 0x2e1
push str.UpgradeMgr::DownloadThemeDllImpl
push str.__s__d___DownloadResAndUnPack_failed
call fcn.0041f720
add esp, 0xc
or edi, 0xffffffff
jmp 0x45f633
push str.theme.
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0xf0]
call fcn.004048c0
xor eax, eax
mov dword [ebp - 0x34], 7
add esp, 4
mov word [ebp - 0x48], ax
xor ebx, ebx
lea ecx, [ebp - 0x388]
cmp dword [ebp - 0xdc], 8
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x38], ebx
cmovae eax, dword [ebp - 0xf0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45f36c
push 0xbf9
push str.DownloadResImpl::GetDllVersion
push str.__s__d___DownloadThemeDllImpl_INVALID_HANDLE_VALUE
call fcn.0041f720
add esp, 0xc
jmp 0x45f3c9
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x388], 0x10
je 0x45f385
cmp word [ebp - 0x35c], 0x2e
jne 0x45f395
lea eax, [ebp - 0x388]
push eax
push esi
call edi
test eax, eax
jne 0x45f372
jmp 0x45f3c2
lea ecx, [ebp - 0x35c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f3a0
sub ecx, edx
lea eax, [ebp - 0x35c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00403e30
mov ebx, dword [ebp - 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
movups xmm0, xmmword [ebp - 0x48]
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
movups xmmword [ebp - 0x60], xmm0
movq xmm0, qword [ebp - 0x38]
push eax
movq qword [ebp - 0x50], xmm0
call fcn.00402f60
mov cl, 1
call fcn.004110c0
test ebx, ebx
jne 0x45f402
add esp, 0x18
lea edi, [ebx - 2]
jmp 0x45f620
lea eax, [ebp - 0x60]
push eax
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x108]
call fcn.004195e0
xor eax, eax
mov dword [ebp - 0x80], 0
add esp, 0x1c
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x7c], 7
mov edx, str.Software360360huabaohuabao
mov ecx, SysReAllocString
push eax
push str.hb_theme_dll_ver
call fcn.0040ffe0
add esp, 8
lea ecx, [ebp - 0x60]
test eax, eax
jne 0x45f4ba
cmp dword [ebp - 0x4c], 8
mov eax, dword [ebp - 0x50]
cmovae ecx, dword [ebp - 0x60]
add eax, eax
push eax
push ecx
push 1
push str.hb_theme_dll_ver
push str.Software360360huabaohuabao
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x45f55a
push 0x2f1
push str.UpgradeMgr::DownloadThemeDllImpl
push str.__s__d___DownloadThemeDllImpl_SetRegValue_failed
call fcn.0041f720
sub esp, 0xc
lea eax, [ebp - 0x108]
mov ecx, esp
push eax
call fcn.00402f60
mov cl, 1
call fcn.004110c0
add esp, 0x18
mov edi, 0xfffffffa
jmp 0x45f60a
cmp dword [ebp - 0x7c], 8
lea edx, [ebp - 0x90]
cmovae edx, dword [ebp - 0x90]
cmp dword [ebp - 0x4c], 8
cmovae ecx, dword [ebp - 0x60]
call fcn.00410930
test eax, eax
lea eax, [ebp - 0x90]
setne bl
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402f60
call fcn.004153a0
add esp, 0x18
test al, al
je 0x45f502
cmp al, 1
jne 0x45f55a
cmp bl, al
jne 0x45f55a
lea eax, [ebp - 0x60]
mov edx, str.Software360360huabaohuabao
push eax
push str.hb_theme_dll_ver
mov ecx, SysReAllocString
call fcn.004100f0
add esp, 8
test eax, eax
jne 0x45f55a
push 0x2fb
push str.UpgradeMgr::DownloadThemeDllImpl
push str.__s__d___DownloadThemeDllImpl_SetRegValue_cover_failed
call fcn.0041f720
sub esp, 0xc
lea eax, [ebp - 0x108]
mov ecx, esp
push eax
call fcn.00402f60
mov cl, 1
call fcn.004110c0
add esp, 0x18
mov edi, 0xfffffff9
jmp 0x45f60a
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.360hbtheme.dll
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x3c], xmm0
call fcn.00402f10
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x3c]
call fcn.00414ed0
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00402e70
lea ecx, [ebp - 0x3c]
call fcn.00415650
push 0x306
push str.UpgradeMgr::DownloadThemeDllImpl
push str.__s__d___DownloadThemeDllImpl_finish
call fcn.0041f720
mov esi, dword [ebp - 0x3c]
add esp, 0xc
xor edi, edi
test esi, esi
je 0x45f60a
mov edx, dword [ebp - 0x38]
push ecx
mov ecx, esi
call fcn.004058e0
mov ecx, dword [ebp - 0x34]
mov eax, 0x2aaaaaab
sub ecx, esi
add esp, 4
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x45f600
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f699
push ecx
push esi
call fcn.004bdd39
add esp, 8
lea ecx, [ebp - 0x90]
call fcn.00402e70
lea ecx, [ebp - 0x108]
call fcn.00402e70
lea ecx, [ebp - 0x60]
call fcn.00402e70
lea ecx, [ebp - 0xf0]
call fcn.00402e70
lea ecx, [ebp - 0x78]
call fcn.00402e70
lea ecx, [ebp - 0xd8]
call fcn.00402e70
lea ecx, [ebp - 0x120]
call fcn.00402e70
lea ecx, [ebp - 0xc0]
call fcn.00402e70
lea ecx, [ebp - 0x138]
call fcn.00402e70
lea ecx, [ebp - 0xa8]
call fcn.00402e70
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
call fcn.004c8da3
int3