Function at 0x438db0
Capabilities:
Check if file exists
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6b04
mov eax, dword fs:[0]
push eax
sub esp, 0xc50
mov eax, dword [0x527494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.00408340
mov ecx, eax
test ecx, ecx
je 0x439824
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc44], eax
mov dword [ebp - 4], 0
mov dword [ebp - method.mf_bind_t_class_CInstaller__class_CInstaller___void_.virtual_0], vtable.mf_bind_t_class_CInstaller__class_CInstaller___void_.0
mov dword [ebp - 0xc3c], 0x4382f0
mov dword [ebp - 0xc38], ebx
lea eax, [ebp - 0xc40]
mov byte [ebp - 4], 1
push eax
call fcn.00442350
add esp, 4
mov byte [ebp - 4], 0
call fcn.00432b20
mov esi, eax
call fcn.00432b30
mov ecx, eax
call fcn.00432c30
mov ecx, dword [esi]
push dword [eax]
push esi
call dword [ecx + 0x2c]
push eax
push str.install_type:_d__install_version:_s
call fcn.00434210
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc2c], 0x438300
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], 0
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 2
push eax
call fcn.00442350
add esp, 0x10
mov byte [ebp - 4], 0
lea edi, [ebx + 4]
push edi
call fcn.00432b30
mov ecx, eax
call fcn.00432c40
push eax
call fcn.004468c0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc2c], 0x438300
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], 2
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 3
push eax
call fcn.00442350
mov esi, dword [edi]
lea ecx, [ebp - 0xc58]
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.00442870
push esi
lea ecx, [ebp - 0xc58]
mov byte [ebp - 4], 4
call fcn.00442e50
lea ecx, [ebp - 0xc58]
call fcn.00443160
lea ecx, [ebp - 0xc58]
mov byte [ebp - 4], 0
call fcn.00442980
push str.remove_all_pending_files
call fcn.00434210
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc2c], 0x438300
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], 3
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 5
push eax
call fcn.00442350
push str..tmp
push dword [edi]
mov byte [ebp - 4], 0
call fcn.004086a0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc2c], 0x438300
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], 4
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 6
push eax
call fcn.00442350
push dword [edi]
mov byte [ebp - 4], 0
push str.remove_all_.tmp_files_in__s
call fcn.00434210
push str.update
lea eax, [ebp - 0xc38]
push edi
push eax
call fcn.00432270
push dword [eax]
mov byte [ebp - 4], 7
call fcn.00407f70
mov edx, dword [ebp - 0xc38]
or esi, 0xffffffff
add esp, 0x2c
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x438ff5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.update
lea eax, [ebp - 0xc38]
push edi
push eax
call fcn.00432270
push dword [eax]
mov byte [ebp - 4], 8
push str.Delete_directory_recursively:__s
call fcn.00434210
mov edx, dword [ebp - 0xc38]
add esp, 0x14
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43903b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc2c], 0x438300
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], 5
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 9
push eax
call fcn.00442350
add esp, 4
mov byte [ebp - 4], 0
mov ecx, ebx
call fcn.00437340
test al, 1
jne 0x439093
push 0xf
push str.copy_file_fail
lea ecx, [ebp - 0xc44]
call fcn.00437130
xor esi, esi
lea eax, [ebp - 0x218]
push 0x208
push esi
push eax
mov dword [ebp - 0xc48], esi
call fcn.0046f230
add esp, 0xc
lea eax, [ebp - 0x218]
push str.UtilsCefHelper.dll
push dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439129
lea eax, [ebp - 0x218]
push eax
call fcn.0044da60
add esp, 4
test eax, eax
je 0x439129
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x439129
push 0x4f7f10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x439129
push str.3.2623.1401.0
call eax
push eax
mov esi, 1
push str.install_cef_nRet_d
mov dword [ebp - 0xc48], esi
call fcn.00434210
add esp, 8
test esi, esi
jne 0x43913a
push str.install_cef_fail
call fcn.00434210
add esp, 4
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc2c], 0x438300
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], 0x5d
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 0xa
push eax
call fcn.00442350
push str.start_call_program
mov byte [ebp - 4], 0
call fcn.00434210
mov eax, dword [edi]
add esp, 8
push dword [eax - 0xc]
push eax
call fcn.00432b30
mov ecx, eax
call fcn.00432c40
mov ecx, eax
call fcn.0043add0
mov eax, dword [edi]
push dword [eax - 0xc]
push eax
call fcn.00432b30
mov ecx, eax
call fcn.00432c40
mov ecx, eax
call fcn.0043b600
push dword [edi]
call fcn.00447b20
add esp, 4
call fcn.00421af0
mov ecx, eax
call fcn.0041b9c0
push 0x208
push 0
test eax, eax
je 0x439222
lea eax, [ebp - 0x218]
push eax
call fcn.0046f230
add esp, 0xc
lea eax, [ebp - 0x218]
push str.UtilsBirdHelper.exe
push dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.helper
call fcn.00434210
add esp, 4
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push 0
push 0
push 1
push 1
push 0x4f0df4
push eax
call fcn.00431b70
jmp 0x4392ad
lea eax, [ebp - 0x420]
push eax
call fcn.0046f230
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
add esp, 0xc
push str.config.set
push dword [edi]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
push 0x4f7474
push str.open
push 0x4f7478
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x800
lea eax, [ebp - 0xc20]
push 0
push eax
call fcn.0046f230
add esp, 0xc
lea eax, [ebp - 0xc20]
push str.360wpsrv.exe
push dword [edi]
push eax
call esi
push str.autorun
call fcn.00434210
add esp, 4
lea eax, [ebp - 0xc20]
lea ecx, [ebx + 0x6c]
push 0x3c
push 0
push 0
push eax
push 1
call fcn.00445820
test eax, eax
jne 0x4392c9
push 0x11
push str.set_autorun_fail
lea ecx, [ebp - 0xc44]
mov dword [ebp - 0xc48], eax
call fcn.00437130
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc2c], 0x438300
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], 0x60
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 0xb
push eax
call fcn.00442350
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebx + 0x7c], 0
je 0x439405
call fcn.00408340
mov ecx, eax
test ecx, ecx
je 0x43982e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc34], eax
push str.birdwallpaper
lea ecx, [ebp - 0xc34]
mov byte [ebp - 4], 0xc
call fcn.004077d0
test al, al
jne 0x439355
push 0xd
push str.birdwallpaper
lea ecx, [ebp - 0xc34]
call fcn.004071e0
mov edi, dword [ebp - 0xc34]
mov byte [ebp - 4], 0xd
mov eax, dword [edi - 0xc]
add eax, eax
push eax
push edi
push 1
push 0x4f7c30
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x4393e5
call fcn.00408340
mov ecx, eax
test ecx, ecx
je 0x439838
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc38], eax
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc38]
push str.write_ProductName_fail_:_d
push eax
call fcn.00405be0
mov esi, dword [ebp - 0xc38]
push esi
call fcn.00434210
add esp, 0x10
mov byte [ebp - 4], 0xd
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4393e5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x439408
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x439408
or edi, 0xffffffff
mov ecx, ebx
call fcn.004399d0
test eax, eax
jne 0x43942b
push 0x14
push str.write_path_reg_fail
lea ecx, [ebp - 0xc44]
mov dword [ebp - 0xc48], eax
call fcn.00437130
mov ecx, dword [0x52a9c0]
test ecx, ecx
jne 0x43948f
push 0x526154
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x52a9c0], 0
jne 0x43947e
push 0x1c
call fcn.0042ea10
add esp, 4
mov dword [ebp - 0xc38], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x43946c
mov ecx, eax
call fcn.00425380
mov ecx, eax
jmp 0x43946e
xor ecx, ecx
mov byte [ebp - 4], 0
xchg dword [ebp - 0xc38], eax
mov dword [0x52a9c0], ecx
push 0x526154
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52a9c0]
call fcn.00425cb0
test eax, eax
je 0x439581
call fcn.00421af0
mov ecx, eax
call fcn.0041ad30
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00407900
lea esi, [eax + 0x10]
mov dword [ebp - 0xc38], esi
push str.deskhelp
push esi
mov byte [ebp - 4], 0x10
call fcn.0048a71a
add esp, 0xc
test eax, eax
je 0x439566
push 1
push dword [ebx + 0x7c]
push ecx
mov edi, esp
mov dword [ebp - 0xc34], edi
mov eax, dword [ebx + 4]
sub eax, 0x10
push eax
call fcn.00407900
add esp, 4
lea ecx, [ebp - 0xc2c]
add eax, 0x10
mov dword [edi], eax
call fcn.00447e80
lea ecx, [ebp - 0xc2c]
mov byte [ebp - 4], 0x11
call fcn.00448be0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc54], 0x438300
mov dword [ebp - 0xc50], ebx
mov dword [ebp - 0xc4c], 0x61
lea eax, [ebp - 0xc58]
mov byte [ebp - 4], 0x12
push eax
call fcn.00442350
add esp, 4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xc2c]
call fcn.00448500
lea ecx, [ebp - 0xc2c]
call fcn.00448050
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x439581
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0xc54], 0x438300
mov dword [ebp - 0xc50], ebx
mov dword [ebp - 0xc4c], 0x62
lea eax, [ebp - 0xc58]
mov byte [ebp - 4], 0x13
push eax
call fcn.00442350
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0
push 0
push eax
call fcn.0046f230
add esp, 0x10
lea eax, [ebp - 0x218]
push str.ComputerZ.set
push dword [ebx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
push 0
push str.hide
push str.installbridge
call esi
lea eax, [ebp - 0x218]
push eax
push 0
push str.source
push str.installbridge
call esi
push str.install_end.
call fcn.00434210
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xc44]
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0xc58], 0x4382d0
mov dword [ebp - 0xc54], ebx
mov dword [ebp - 0xc4c], eax
lea eax, [ebp - 0xc5c]
mov byte [ebp - 4], 0x14
push eax
call fcn.00442350
add esp, 8
mov byte [ebp - 4], 0
call fcn.00421af0
mov ecx, eax
call fcn.0041af10
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00407900
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0xc38], esi
mov edx, dword [esi - 0xc]
mov byte [ebp - 4], 0x15
mov dword [ebp - 0xc34], edx
test edx, edx
js 0x439842
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4396c8
push edx
lea ecx, [ebp - 0xc38]
call fcn.00406f40
mov esi, dword [ebp - 0xc38]
mov edx, dword [ebp - 0xc34]
lea eax, [edx + 1]
push eax
push esi
call fcn.0049c56f
mov eax, dword [ebp - 0xc34]
add esp, 8
cmp eax, dword [esi - 8]
jg 0x439842
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], ecx
jl 0x439716
push str.zhushou
push esi
call fcn.0046f690
add esp, 8
test eax, eax
je 0x439716
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x439716
call fcn.00417860
test eax, eax
je 0x43975c
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0046f230
add esp, 0xc
lea eax, [ebp - 0x420]
push str.lpiWpSvc.dll
push dword [ebx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0
push 0x4f0df4
lea eax, [ebp - 0x420]
push 0x4f7c9c
push eax
call fcn.00416890
add esp, 0x10
mov eax, edi
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x439777
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, ebx
call fcn.00437790
push dword [ebx + 4]
lea ecx, [ebx + 0x80]
call fcn.00445ce0
lea ecx, [ebx + 0x80]
call fcn.00445fa0
push str.real_install_end.
call fcn.00434210
lea esi, [ebx + 0x9c]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
add esp, 4
mov dword [ebp - 0xc38], esi
test esi, esi
je 0x4397c3
mov eax, dword [esi]
push esi
call dword [eax]
mov ecx, dword [ebx + 0x68]
mov byte [ebp - 4], 0x16
test ecx, ecx
je 0x4397d4
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
mov byte [ebp - 4], 0x17
test esi, esi
je 0x4397e2
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov edx, dword [ebp - 0xc44]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x439804
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004621f8
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00405a80
push 0x80004005
call fcn.00405a80
push 0x80004005
call fcn.00405a80
push 0x80070057
call fcn.00405a80
int3