Function at 0x432340
Capabilities:
Accept command line arguments
Check if file exists
Create thread
Delete file
Delete registry key
Delete registry value
Get common file path
Get startup folder
Move file
Persist via run registry key
Read .ini file
Resolve function by parsing pe exports
Terminate thread
Write file to startup folder

Disassembly:
push 0xffffffffffffffff
push 0x5a3797
mov eax, dword fs:[0]
push eax
sub esp, 0x56c
mov eax, dword [0x61ac94]
xor eax, esp
mov dword [esp + 0x568], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61ac94]
xor eax, esp
push eax
lea eax, [esp + 0x580]
mov dword fs:[0], eax
push str._uninstall
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push eax
call ebp
mov ebx, eax
test ebx, ebx
je 0x432fda
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
push eax
mov ecx, esi
call fcn.00418d30
push eax
mov dword [esp + 0x44], eax
call fcn.00473ce0
add esp, 4
test eax, eax
je 0x432443
push 0x5e8ee8
lea ecx, [esp + 0x28]
call fcn.0040e080
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x58c], 0
call edi
push eax
call fcn.00478ab0
add esp, 8
cmp dword [esp + 0x40], 0xffffffff
mov edi, eax
je 0x432403
lea ecx, [esp + 0x40]
push ecx
call fcn.004872a0
add esp, 4
test eax, eax
jne 0x43244d
test edi, edi
je 0x432418
mov edx, dword [esp + 0x24]
push edx
call fcn.00488450
add esp, 4
test eax, eax
jne 0x43244d
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x588], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432443
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x432fdc
mov ecx, esi
call fcn.00425e90
test eax, eax
je 0x4325f4
xor eax, eax
lea edx, [esp + 0x44]
xor ecx, ecx
push edx
mov word [esp + 0x48], cx
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov word [esp + 0x56], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x76]
push ecx
mov word [esp + 0x78], ax
call fcn.004e5fc0
movzx edx, word [esp + 0x56]
movzx eax, word [esp + 0x52]
movzx ecx, word [esp + 0x50]
push edx
push eax
push ecx
push str._04hd__02hd__02hd
lea edx, [esp + 0x88]
push 0x80
push edx
call fcn.0041c900
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x11a]
push ecx
mov word [esp + 0x11c], ax
call fcn.004e5fc0
lea edx, [esp + 0x50]
push edx
call fcn.0040e820
mov eax, dword [eax]
add esp, 0x34
push eax
push 0x40
lea eax, [esp + 0xf4]
push eax
push 0x5e8ee8
push str.mark
push str.UninstDefTip
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x20]
call fcn.0040c150
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x70]
push edx
call fcn.004e8728
add esp, 8
test eax, eax
je 0x4325f4
lea ecx, [esp + 0x54]
call fcn.00429070
lea eax, [esp + 0x54]
push eax
push 0
push 0x12c
mov ecx, esi
mov byte [esp + 0x594], 1
call fcn.00431ba0
test eax, eax
je 0x4325e3
push 0
push 0
lea ecx, [esp + 0x37c]
call fcn.00446480
lea ecx, [esp + 0x374]
mov byte [esp + 0x588], 2
call fcn.0049b3e0
lea ecx, [esp + 0x20]
push ecx
call fcn.0040e820
mov eax, dword [eax]
add esp, 4
push eax
lea edx, [esp + 0x70]
push edx
push str.mark
push str.UninstDefTip
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 0x20]
call fcn.0040c150
lea ecx, [esp + 0x374]
mov byte [esp + 0x588], 1
call fcn.0041dc80
lea ecx, [esp + 0x54]
mov byte [esp + 0x588], 0
call fcn.00426050
lea ecx, [esp + 0x24]
call fcn.0040c150
mov eax, 1
jmp 0x432fdc
lea ecx, [esp + 0x54]
mov byte [esp + 0x588], 0
call fcn.00426050
push str._hwnd
push ebx
call ebp
xor ebp, ebp
mov dword [esp + 0x1c], ebp
cmp eax, ebp
je 0x432616
add eax, 0xc
push eax
call fcn.004e65e9
add esp, 4
mov dword [esp + 0x1c], eax
call fcn.004a581f
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x432630
push 0x80004005
call fcn.0040b390
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x588], 3
call fcn.004a581f
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x432662
push 0x80004005
call fcn.0040b390
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x20]
push str.IDS_UNINSTALL_TITLE
push ecx
mov byte [esp + 0x590], 4
call fcn.005214a0
add esp, 8
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x58c], 5
call fcn.0040cb00
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x588], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4326c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x34]
call fcn.00496510
mov bl, 6
push ebp
mov byte [esp + 0x58c], bl
call fcn.00418df0
add esp, 4
mov ecx, esi
call fcn.004190a0
test eax, eax
je 0x432785
lea ecx, [esp + 0x20]
push str.IDS_UNINST_BOOTINI
push ecx
call fcn.005214a0
add esp, 8
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x58c], 7
call fcn.0040cb00
lea ecx, [esp + 0x20]
mov byte [esp + 0x588], bl
call fcn.0040c150
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push 0x124
push edx
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x432785
push 1
call fcn.00418df0
add esp, 4
lea ecx, [esp + 0x34]
mov byte [esp + 0x588], 4
call fcn.00496520
lea ecx, [esp + 0x2c]
call fcn.0040c150
lea ecx, [esp + 0x30]
call fcn.0040c150
lea ecx, [esp + 0x24]
call fcn.0040c150
mov eax, 1
jmp 0x432fdc
mov ebx, 1
push ebx
mov ecx, esi
mov dword [esp + 0x2c], ebp
xor edi, edi
call fcn.0042bc70
test eax, eax
jne 0x4327b0
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov edi, ebx
call fcn.0042e0e0
mov ebp, dword [esp + 0x28]
jmp 0x4327d5
call fcn.004781a0
test eax, eax
je 0x4327d5
mov ecx, esi
call fcn.004277a0
test eax, eax
je 0x4327d3
mov ecx, esi
call fcn.00419010
test al, al
je 0x4327d3
mov ebp, ebx
jmp 0x4327d5
xor ebp, ebp
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call fcn.0040c120
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push ebp
mov ecx, esi
mov byte [esp + 0x594], 8
call fcn.0042d850
test eax, eax
jne 0x432849
push ebx
call fcn.00418df0
add esp, 4
lea ecx, [esp + 0x28]
call fcn.0040c150
lea ecx, [esp + 0x34]
mov byte [esp + 0x588], 4
call fcn.00496520
lea ecx, [esp + 0x2c]
call fcn.0040c150
lea ecx, [esp + 0x30]
call fcn.0040c150
lea ecx, [esp + 0x24]
call fcn.0040c150
mov eax, ebx
jmp 0x432fdc
call fcn.00416a60
mov ecx, eax
call fcn.004157e0
cmp eax, 2
jne 0x4328cf
push 4
call fcn.00416a60
mov ecx, eax
call fcn.00416620
test eax, eax
je 0x4328cf
push 0
lea ecx, [esp + 0x378]
call fcn.0043c5c0
push ebx
lea ecx, [esp + 0x378]
mov byte [esp + 0x58c], 9
call fcn.0043c9f0
test eax, eax
jne 0x4328bb
push ebx
mov dword [esi + 0xa4], ebx
call fcn.00418df0
add esp, 4
lea ecx, [esp + 0x374]
mov byte [esp + 0x588], 8
call fcn.0043c840
jmp 0x43280d
lea ecx, [esp + 0x374]
mov byte [esp + 0x588], 8
call fcn.0043c840
call fcn.00418bf0
test eax, eax
je 0x4328df
mov ecx, esi
call fcn.00421aa0
push 0
call fcn.00474270
lea ecx, [esp + 0x3c]
push 0
push ecx
call fcn.0040e2c0
mov edx, dword [esp + 0x44]
push edx
push str._supdatecfg.ini
lea eax, [esi + 0xa8]
push 0x104
mov bl, 0xa
push eax
mov byte [esp + 0x5a4], bl
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
push 0
mov ecx, esi
call fcn.00427020
call fcn.004739a0
mov ecx, esi
call fcn.004277a0
test eax, eax
jne 0x43293f
test edi, edi
jne 0x43293f
test ebp, ebp
je 0x432a30
call fcn.004781a0
test eax, eax
jne 0x43295d
push str.RULE_360SD
push str.SYSTEMCurrentControlSetServices360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test edi, edi
je 0x432a30
test ebp, ebp
je 0x432a30
call fcn.00478410
test eax, eax
je 0x432a30
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0040e2c0
push 0x5be5c4
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x59c], 0xb
call fcn.0040d150
mov eax, dword [eax]
add esp, 0x14
push eax
mov ecx, esi
call fcn.0041cb90
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.0040c150
lea ecx, [esp + 0x14]
mov byte [esp + 0x588], bl
call fcn.0040c150
test edi, edi
jne 0x432a2e
push 1
mov ecx, esi
call fcn.00427e90
test eax, eax
je 0x432a30
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0040e2c0
push str.360tray.tmp
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x59c], 0xc
call fcn.0040d150
mov eax, dword [eax]
add esp, 0x14
push eax
push 0x5bbfb0
push str.tray
push str.protect
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 0x14]
call fcn.0040c150
lea ecx, [esp + 0x18]
mov byte [esp + 0x588], bl
call fcn.0040c150
xor ebp, ebp
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0x468
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
test ebp, ebp
je 0x432a8a
call fcn.00478410
test eax, eax
jne 0x432a8a
call fcn.00472f30
mov ecx, esi
test eax, eax
jne 0x432a81
push str._disablesp_5
call fcn.00424800
test eax, eax
jne 0x432a8a
lea ecx, [esp + 0x38]
call fcn.0040c150
lea ecx, [esp + 0x28]
call fcn.0040c150
jmp 0x43274f
push 1
call fcn.00427e90
jmp 0x432a66
push 1
mov ecx, esi
call fcn.0042fd80
lea ecx, [esp + 0x3c]
call fcn.0040c120
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x58c], 0xd
call fcn.00478090
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 4
test eax, eax
je 0x432ace
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x432c3b
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SYSTEMCurrentControlSetServicesBAPIDRV
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x104
lea edx, [esp + 0x378]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x374]
push eax
lea ecx, [esp + 0x20]
call fcn.0040e080
push str.driversBAPIDRV.sys
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x594], 0xe
call fcn.0040d150
mov eax, dword [eax]
add esp, 0xc
push eax
call ebp
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0040c150
test bl, bl
je 0x432b67
push str.driversBAPIDRV.sys
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040d150
mov eax, dword [eax]
add esp, 0xc
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x14]
call fcn.0040c150
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0
call fcn.004890c0
push str.driversBAPIDRV64.sys
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0040d150
mov eax, dword [eax]
add esp, 0x10
push eax
call ebp
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0040c150
test bl, bl
je 0x432bd4
push str.driversBAPIDRV64.sys
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0040d150
mov eax, dword [eax]
add esp, 0xc
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x14]
call fcn.0040c150
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00489100
push str.driversqutmipc.sys
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0040d150
mov eax, dword [eax]
add esp, 0x10
push eax
call ebp
lea ecx, [esp + 0x14]
call fcn.0040c150
push str.driversqutmdrv.sys
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040d150
mov eax, dword [eax]
add esp, 0xc
push eax
call ebp
lea ecx, [esp + 0x14]
call fcn.0040c150
lea ecx, [esp + 0x1c]
mov byte [esp + 0x588], 0xd
call fcn.0040c150
jmp 0x432c41
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x5c0c00
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call ebx
push 0x5c0c00
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SOFTWARE360Safe_tpiSdAdBlock
push reloc.OLEAUT32.dll_SysReAllocString
call edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x176]
push ecx
mov word [esp + 0x178], ax
call fcn.004e5fc0
add esp, 0xc
push 1
push 7
lea edx, [esp + 0x174]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x16c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432cc0
sub eax, edx
sar eax, 1
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x170]
push 0x5bda1c
push edx
call fcn.004e6b29
lea eax, [esp + 0x178]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432cf6
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 0x14]
push str.SD.Product
push eax
call fcn.005214a0
mov eax, dword [eax]
mov ecx, 0x104
sub ecx, edi
push ecx
push eax
lea edx, [esp + 0x17c]
push edx
call fcn.004e6b29
add esp, 0x14
lea ecx, [esp + 0x14]
call fcn.0040c150
lea eax, [esp + 0x16c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432d44
sub eax, edx
sar eax, 1
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x170]
push str..lnk
push edx
call fcn.004e6b29
add esp, 0xc
lea eax, [esp + 0x16c]
push eax
call ebp
lea ecx, [esp + 0x18]
push ecx
call fcn.004237c0
push str.customSelected.dat
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x598], 0xf
call fcn.0040d150
mov eax, dword [eax]
add esp, 0x10
push eax
call ebp
lea ecx, [esp + 0x14]
call fcn.0040c150
lea ecx, [esp + 0x18]
mov byte [esp + 0x588], 0xd
call fcn.0040c150
call fcn.00478410
test eax, eax
jne 0x432dd7
push str.SYSTEMCurrentControlSetServices360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.004a3840
mov ecx, eax
call fcn.004a2890
call fcn.004a3840
mov ecx, eax
call fcn.004a2860
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x429b20
push 0
push 0
call edi
mov ebp, eax
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0040e2c0
push 0x5be5c4
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x59c], 0x10
call fcn.0040d150
mov eax, dword [eax]
push eax
call fcn.00418970
add esp, 0x18
lea ecx, [esp + 0x14]
call fcn.0040c150
lea ecx, [esp + 0x18]
mov byte [esp + 0x588], 0xd
call fcn.0040c150
lea edx, [esp + 0x18]
push 0
push edx
call fcn.0040e2c0
push str.360sd.dat
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x59c], 0x11
call fcn.0040d150
mov eax, dword [eax]
push eax
call fcn.00418970
add esp, 0x18
lea ecx, [esp + 0x14]
call fcn.0040c150
lea ecx, [esp + 0x18]
mov byte [esp + 0x588], 0xd
call fcn.0040c150
call fcn.004a3840
mov ecx, eax
call fcn.004a2a50
call fcn.00418b70
test eax, eax
je 0x432f2c
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0040e2c0
push str.360sdToasts.exe
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x59c], 0x12
call fcn.0040d150
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x588], 0x14
call fcn.0040c150
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0040e2c0
mov eax, dword [eax]
mov ecx, dword [esp + 0x20]
push 0
push eax
push str._uninstall
push ecx
mov byte [esp + 0x5a0], 0x15
call fcn.00476eb0
add esp, 0x18
lea ecx, [esp + 0x1c]
call fcn.0040c150
lea ecx, [esp + 0x18]
mov byte [esp + 0x588], 0xd
call fcn.0040c150
mov ecx, esi
call fcn.00427860
push 8
call fcn.004a3ce6
add esp, 4
push 0
push 0
push eax
push 0x42e350
push 0
push 0
mov dword [eax], esi
mov dword [eax + 4], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
push 0x2710
push edi
call ebx
cmp eax, 0x102
je 0x432f72
cmp eax, 0xffffffff
jne 0x432f82
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.004244d0
mov edx, dword [esp + 0x20]
push edx
mov ecx, esi
call fcn.0042b820
push 1
mov ecx, esi
call fcn.00425370
push 0x2710
push ebp
call ebx
cmp eax, 0xffffffff
je 0x432fb2
cmp eax, 0x102
jne 0x432fbb
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x3c]
mov dword [esi + 0xa4], 0
call fcn.0040c150
jmp 0x432a6a
xor eax, eax
mov ecx, dword [esp + 0x580]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x568]
xor ecx, esp
call fcn.004e5fb0
add esp, 0x578
ret