Function at 0x464694
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2518
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x24ac], 0
and dword [ebp - 0x24a8], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x24bc]
push eax
lea eax, [ebp - 0x24a8]
push eax
lea eax, [ebp - 0x24b8]
push eax
push str.hasupdate
mov ebx, str.Softwarehao123JuziBrowser
push ebx
mov esi, 0x80000001
push esi
mov dword [ebp - 0x24b8], 1
mov dword [ebp - 0x24bc], 4
call edi
test eax, eax
jne 0x4649d6
cmp dword [ebp - 0x24a8], eax
je 0x4649d6
cmp dword [ebp + 8], eax
je 0x464724
push str.hasupdate
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x8c], ax
lea eax, [ebp - 0x8a]
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x24b4]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x24b0]
push eax
push str.chkupdate
push ebx
push esi
mov dword [ebp - 0x24b0], 1
mov dword [ebp - 0x24b4], 0x7e
call edi
test eax, eax
jne 0x4649d6
xor edi, edi
cmp word [ebp - 0x8c], di
je 0x4649d6
cmp dword [ebp + 8], edi
je 0x46479a
push str.chkupdate
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.00596530
add esp, 0xc
push str.Installer
push 0x63c268
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.Update.exe
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4649d6
xor eax, eax
push 0x7e
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push edi
push eax
call fcn.00596530
add esp, 0xc
lea edx, [ebp - 0x10c]
lea ecx, [ebp - 0x414]
call fcn.0046fe2f
lea eax, [ebp - 0x10c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x46482b
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x61fb14
call fcn.005965b0
xor eax, eax
push 0x7e
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00596530
push 0x3f
push 0xf0
lea ebx, [ebp - 0x20c]
mov ecx, 0x61faf0
call fcn.0046fd60
mov eax, ebx
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0058f69a
add esp, 0x28
test eax, eax
jne 0x4649d6
push 0x7e
mov word [ebp - 0x18c], ax
lea eax, [ebp - 0x18a]
push edi
push eax
call fcn.00596530
add esp, 0xc
push 0x3f
pop ebx
lea esi, [ebp - 0x18c]
lea edi, [ebp - 0x414]
call fcn.00475e02
test eax, eax
je 0x4649d6
xor eax, eax
cmp ax, word [0x63f288]
jne 0x4648dd
call fcn.00404168
jmp 0x4648e2
mov eax, 0x63f288
lea ecx, [ebp - 0x18c]
push ecx
push eax
call fcn.00475ebf
pop ecx
pop ecx
test eax, eax
jge 0x4649d6
xor eax, eax
push 0x208e
mov word [ebp - 0x24a4], ax
xor esi, esi
lea eax, [ebp - 0x24a2]
push esi
push eax
call fcn.00596530
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
xor eax, eax
cmp dword [ebp + 8], esi
push str._upparm:
sete al
push eax
push str._upquit:
push 0x63c060
push str._uppath:
lea eax, [ebp - 0x414]
push eax
push str.__s___s__s___s_d__s_s
lea eax, [ebp - 0x24a4]
push 0x1047
push eax
call fcn.0058f42f
push 0x40
lea eax, [ebp - 0x2510]
push esi
push eax
call fcn.00596530
xor eax, eax
mov dword [ebp - 0x24cc], esi
lea edi, [ebp - 0x24c8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x34
stosd dword es:[edi], eax
lea eax, [ebp - 0x24cc]
push eax
lea eax, [ebp - 0x2514]
push eax
push esi
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
push esi
lea eax, [ebp - 0x24a4]
push eax
push esi
mov dword [ebp - 0x2514], 0x44
mov dword [ebp - 0x24e8], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4649d6
push dword [ebp - 0x24c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24cc]
call esi
mov dword [ebp - 0x24ac], edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24ac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret 4