Function at 0x42c390
Capabilities:
Persist via app paths registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xab4
mov eax, dword [0x47fa30]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xab4], ecx
mov eax, dword [ebp + 8]
mov byte [eax], 0
xor ecx, ecx
mov word [ebp - 0x670], cx
push 0x208
push 0
lea edx, [ebp - 0x66e]
push edx
call fcn.00450ec0
add esp, 0xc
push str.JPEG_file_.jpg_.jpeg_.jpg_.jpeg_PNG_file_.png_.pngBitmap_file_.bmp_.bmpAll_files_._.
push 0x46c774
push 0x104
lea eax, [ebp - 0x670]
push eax
call fcn.00454e6e
add esp, 0x10
lea ecx, [ebp - 0x670]
push ecx
call fcn.0042bb40
add esp, 4
xor edx, edx
mov word [ebp - 0x460], dx
push 0x208
push 0
lea eax, [ebp - 0x45e]
push eax
call fcn.00450ec0
add esp, 0xc
push 0x46c77c
push 0x46c784
push 0x104
lea ecx, [ebp - 0x460]
push ecx
call fcn.00454e6e
add esp, 0x10
xor edx, edx
mov word [ebp - 0x24c], dx
xor eax, eax
mov dword [ebp - 0x24a], eax
mov dword [ebp - 0x246], eax
mov dword [ebp - 0x242], eax
mov dword [ebp - 0x23e], eax
mov dword [ebp - 0x23a], eax
mov dword [ebp - 0x236], eax
mov dword [ebp - 0x232], eax
mov dword [ebp - 0x22e], eax
mov dword [ebp - 0x22a], eax
mov word [ebp - 0x226], ax
mov dword [ebp - 0x224], 2
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x674]
push edx
call fcn.0042ba00
add esp, 8
mov eax, dword [ebp - 0x674]
push eax
push 0x46c78c
push 0x14
lea ecx, [ebp - 0x24c]
push ecx
call fcn.00454e6e
add esp, 0x10
xor edx, edx
mov word [ebp - 0x888], dx
push 0x208
push 0
lea eax, [ebp - 0x886]
push eax
call fcn.00450ec0
add esp, 0xc
push str.Option
push str.SoftwareCatchScreen
push str._s_s
push 0x104
lea ecx, [ebp - 0x888]
push ecx
call fcn.00454e6e
add esp, 0x14
xor edx, edx
mov word [ebp - 0x220], dx
push 0x208
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.00450ec0
add esp, 0xc
lea ecx, [ebp - 0xab0]
push ecx
call fcn.0042c7c0
add esp, 4
mov ecx, eax
call fcn.0043a170
push eax
push 0x104
lea edx, [ebp - 0x220]
push edx
call fcn.00454e6e
add esp, 0xc
lea ecx, [ebp - 0xab0]
call fcn.004107a0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x224]
push eax
push 0x80802
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x460]
push ecx
mov edx, dword [ebp - 0xab4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bc10
add esp, 0x24
test eax, eax
je 0x42c796
mov edx, dword [ebp + 8]
mov byte [edx], 1
push 0x208
push 0
lea eax, [ebp - 0xaa0]
push eax
call fcn.00450ec0
add esp, 0xc
mov dword [ebp - 0x88c], 1
mov dword [ebp - 0x890], 0x208
lea ecx, [ebp - 0x890]
push ecx
lea edx, [ebp - 0xaa0]
push edx
lea eax, [ebp - 0x88c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42c663
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0xaac]
call fcn.00410490
lea edx, [ebp - 0xaa0]
push edx
lea ecx, [ebp - 0xaac]
call fcn.0042e2e0
cmp eax, 0xffffffff
je 0x42c658
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0xaac]
call fcn.004107a0
lea ecx, [ebp - 0x674]
call fcn.004107a0
jmp 0x42c7a1
lea ecx, [ebp - 0xaac]
call fcn.004107a0
push 4
lea eax, [ebp - 0x224]
push eax
push 4
push str.SaveAsIndexEx
lea ecx, [ebp - 0x888]
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x2e
lea edx, [ebp - 0x220]
push edx
call fcn.0042d3f0
add esp, 8
mov dword [ebp - 0xaa8], eax
cmp dword [ebp - 0xaa8], 0
je 0x42c6e6
mov eax, dword [ebp - 0xaa8]
add eax, 2
mov dword [ebp - 0xaa8], eax
mov ecx, dword [ebp - 0xaa8]
push ecx
call fcn.00454fb2
add esp, 4
shl eax, 1
push eax
mov edx, dword [ebp - 0xaa8]
push edx
push 1
push str.SaveDefExtend
lea eax, [ebp - 0x888]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0xab4]
add ecx, 4
call fcn.0042e060
mov dword [ebp - 0x894], eax
mov ecx, dword [ebp - 0xab4]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 0xab4]
mov ecx, dword [eax + 0x88]
call fcn.00435c70
mov ecx, dword [ebp - 0xab4]
mov ecx, dword [ecx + 0x80]
call fcn.00416ab0
push eax
mov edx, dword [ebp - 0xab4]
mov eax, dword [edx + 0x2c]
push eax
call fcn.0043be00
add esp, 8
mov dword [ebp - 0xaa4], eax
mov ecx, dword [ebp - 0x894]
push ecx
mov edx, dword [ebp - 0xaa4]
push edx
lea eax, [ebp - 0x220]
push eax
call fcn.0042c180
add esp, 0xc
cmp dword [ebp - 0xaa4], 0
je 0x42c772
mov ecx, dword [ebp - 0xaa4]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0x894]
push edx
mov ecx, dword [ebp - 0xab4]
add ecx, 4
call fcn.0042e080
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x674]
call fcn.004107a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450655
mov esp, ebp
pop ebp
ret 4