Function at 0x438bf0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x440aeb
push eax
mov eax, 0x182c
mov dword fs:[0], esp
call fcn.00439c20
push edi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_4
mov ax, word [0x44ffe8]
mov ecx, 0x103
mov word [esp + 0x420], ax
xor eax, eax
lea edi, [esp + 0x422]
lea edx, [esp + 0x420]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x420]
mov dword [esp + 8], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea eax, [esp + 8]
push ecx
push edx
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun360Disabled
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x438e7f
push 4
lea ecx, [esp + 0x424]
push str.rem
push ecx
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x438e7f
mov dx, word [0x44ffe8]
mov ecx, 0x103
lea edi, [esp + 0x12]
mov word [esp + 0x10], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, 0x22
cmp word [esp + 0x428], ax
jne 0x438d8d
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
test eax, eax
je 0x438e36
mov ecx, str.safemon360Tray.exe___start
mov word [esp + 0x12], 0
test ecx, ecx
je 0x438e36
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x830]
push str.safemon360Tray.exe___start
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x438d7a
lea edx, [esp + 0x830]
push 0x800
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x830]
push str.safemon360Tray.exe___start
lea edx, [esp + 0x834]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x830]
push 0x206
lea ecx, [esp + 0x16]
push eax
push ecx
jmp 0x438e2d
push 0x206
push str.safemon360Tray.exe___start
lea edx, [esp + 0x1a]
jmp 0x438e2c
lea eax, [esp + 0x10]
test eax, eax
je 0x438e36
mov ecx, str.safemon360Tray.exe__start
mov word [esp + 0x10], 0
test ecx, ecx
je 0x438e36
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x830]
push str.safemon360Tray.exe__start
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x438e1e
lea edx, [esp + 0x830]
push 0x800
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x830]
push str.safemon360Tray.exe__start
lea edx, [esp + 0x834]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x830]
push 0x206
lea ecx, [esp + 0x14]
push eax
push ecx
jmp 0x438e2d
push 0x206
push str.safemon360Tray.exe__start
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x428]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x438e7f
lea ecx, [esp + 4]
mov dword [esp + 0x1838], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 1
pop edi
mov ecx, dword [esp + 0x182c]
mov dword fs:[0], ecx
add esp, 0x1838
ret
lea ecx, [esp + 4]
mov dword [esp + 0x1838], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1830]
xor eax, eax
pop edi
mov dword fs:[0], ecx
add esp, 0x1838
ret