Function at 0x409d0c
Capabilities:
Delete directory
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1234
call fcn.00412410
and word [ebp - 0x82c], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x82a]
and word [ebp - 0x1234], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1232]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.Software360360se5
push str._sdefaultmain
lea eax, [ebp - 0x1234]
mov ebx, 0x103
push 0x3ff
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], ebx
call esi
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1234]
push str.title
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x409e92
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x41a]
mov word [ebp - 0x41c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x41c]
push eax
push edx
push edx
push 0x19
push edx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409e20
and word [ebp - 0x214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x41c]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
push 0x208
lea eax, [ebp - 0x41c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push edi
push edi
push 0x10
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409e92
mov word [ebp - 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x41c]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [ebp - 0x624], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], 0x417aa0
lea eax, [ebp - 0x624]
xor edi, edi
push eax
mov eax, dword [ebp - 4]
push edi
push edi
push dword [eax - 8]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409f67
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x409f67
cmp dword [eax - 4], edi
je 0x409f25
mov word [ebp - 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push str._s_s
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x409f65
mov word [ebp - 0x41c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push str._s_s
lea eax, [ebp - 0x41c]
push ebx
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.0040bf60
add esp, 0x18
xor edi, edi
add dword [ebp - 4], 0x210
cmp dword [ebp - 4], 0x419990
jl 0x409eb2
lea eax, [ebp - 0x624]
push eax
push edi
push edi
push 2
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov word [ebp - 0xa34], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa32]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push str._s360
lea eax, [ebp - 0xa34]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xa34]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret