Function at 0x4094d0
Capabilities:
Create process on windows
Get common file path
Persist via run registry key
Query environment variable
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ec
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4ec], ecx
push 0x3f6
lea eax, [ebp - 0x484]
push eax
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403200
mov ecx, eax
call fcn.00412ea0
push eax
lea ecx, [ebp - 4]
call fcn.00408360
lea ecx, [ebp - 4]
call fcn.0040a800
test eax, eax
je 0x4095c5
push 0x436250
push 0x436270
push 0x441210
lea ecx, [ebp - 0x488]
push ecx
call fcn.00408280
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.00408280
lea ecx, [ebp - 0x488]
call fcn.00403160
lea ecx, [ebp - 0x24]
call fcn.004034f0
lea eax, [ebp - 0x4a4]
push eax
call fcn.00420280
add esp, 4
mov ecx, eax
call fcn.00401550
push eax
lea ecx, [ebp - 0x24]
call fcn.00402c60
lea ecx, [ebp - 0x4a4]
call fcn.00401130
push 1
lea ecx, [ebp - 0x24]
call fcn.00412ea0
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.00412ea0
push eax
push 0x436274
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.CSetupFinishPage::OnWizardFinish__start_YY.exe
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.00403160
lea ecx, [ebp - 0x20]
call fcn.00403160
push 0x3eb
lea ecx, [ebp - 0x4a8]
push ecx
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403200
mov ecx, eax
call fcn.00412ea0
push eax
lea ecx, [ebp - 8]
call fcn.00408360
lea ecx, [ebp - 8]
call fcn.0040a800
test eax, eax
je 0x4096b0
push str.yylauncher.exe
push 0x436300
push 0x441210
lea edx, [ebp - 0x4ac]
push edx
call fcn.00408280
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00408280
mov ecx, eax
call fcn.00412ea0
push eax
lea ecx, [ebp - 0x48]
call fcn.004020d0
lea ecx, [ebp - 0x4b0]
call fcn.00403160
lea ecx, [ebp - 0x4ac]
call fcn.00403160
lea ecx, [ebp - 0x28]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x4096a8
push 0x436388
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x48]
call fcn.004024e0
shl eax, 1
push eax
lea ecx, [ebp - 0x48]
call fcn.00401550
push eax
push 1
push 0
push 0x436408
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x48]
call fcn.00401130
push 0x3f4
lea ecx, [ebp - 0x4b4]
push ecx
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403200
mov ecx, eax
call fcn.00412ea0
push eax
lea ecx, [ebp - 0x10]
call fcn.00408360
lea ecx, [ebp - 0x10]
call fcn.0040a800
test eax, eax
je 0x409785
push 0x436304
push 0x436384
push str.4.9.0.2
push 0x436420
push 0x441210
lea edx, [ebp - 0x4b8]
push edx
call fcn.00408280
push eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.00408280
push eax
lea ecx, [ebp - 0x4c0]
push ecx
call fcn.00408280
push eax
lea edx, [ebp - 0x50]
push edx
call fcn.00408280
lea ecx, [ebp - 0x4c0]
call fcn.00403160
lea ecx, [ebp - 0x4bc]
call fcn.00403160
lea ecx, [ebp - 0x4b8]
call fcn.00403160
push 5
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.00412ea0
push eax
push 0x436424
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.CSetupFinishPage::OnWizardFinish__view_releaseNote.txt.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x50]
call fcn.00403160
push 0x3f5
lea eax, [ebp - 0x4c4]
push eax
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403200
mov ecx, eax
call fcn.00412ea0
push eax
lea ecx, [ebp - 0x1c]
call fcn.00408360
lea ecx, [ebp - 0x1c]
call fcn.0040a800
test eax, eax
je 0x4098ff
push str.CSetupFinishPage::OnWizardFinish__collect_offical_website.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x58]
push ecx
push 6
mov edx, dword [ebp - 0x4ec]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x4098ff
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4098ff
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
call fcn.00404880
push 0
push 0
push 2
push 0
push 0
push 0x1f01ff
push 0x436518
push 0x43652c
lea ecx, [ebp - 0x268]
push ecx
lea edx, [ebp - 0x4c8]
push edx
call fcn.00408280
push eax
lea eax, [ebp - 0x4cc]
push eax
call fcn.00408280
mov ecx, eax
call fcn.00412ea0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x264], eax
lea ecx, [ebp - 0x4cc]
call fcn.00403160
lea ecx, [ebp - 0x4c8]
call fcn.00403160
cmp dword [ebp - 0x264], 0xffffffff
je 0x4098ea
push 0x436530
lea ecx, [ebp - 0x270]
call fcn.00404880
lea ecx, [ebp - 0x270]
call fcn.00403510
shl eax, 1
mov dword [ebp - 0x26c], eax
push 0
lea ecx, [ebp - 0x274]
push ecx
mov edx, dword [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x270]
call fcn.00412ea0
push eax
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x270]
call fcn.00403160
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x268]
call fcn.00403160
push 5
push 0
push 0
push str.http:__www.duowan.com__yy
push 0x4365d8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.installstat.exe
push 0x436604
push 0x436608
push 0x436618
push 0x441210
lea eax, [ebp - 0x4d0]
push eax
call fcn.00408280
push eax
lea ecx, [ebp - 0x4d4]
push ecx
call fcn.00408280
push eax
lea edx, [ebp - 0x4d8]
push edx
call fcn.00408280
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00408280
lea ecx, [ebp - 0x4d8]
call fcn.00403160
lea ecx, [ebp - 0x4d4]
call fcn.00403160
lea ecx, [ebp - 0x4d0]
call fcn.00403160
lea ecx, [ebp - 0xc]
call fcn.004034f0
push 1
push 0x43661c
push str.__s_di_
lea ecx, [ebp - 0xc]
push ecx
call fcn.00409da0
add esp, 0x10
push 0
mov ecx, 0x441210
call fcn.00412ea0
push eax
lea ecx, [ebp - 0xc]
call fcn.00412ea0
push eax
lea ecx, [ebp - 0x18]
call fcn.00412ea0
push eax
push 0x436644
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
push str.CSetupFinishPage::OnWizardFinish__run__s_parameter_is__s.
call fcn.004010c0
add esp, 0xc
push str.yyrun.exe
push 0x4366d8
push 0x4366dc
push 0x4366ec
push 0x441210
lea ecx, [ebp - 0x4dc]
push ecx
call fcn.00408280
push eax
lea edx, [ebp - 0x4e0]
push edx
call fcn.00408280
push eax
lea eax, [ebp - 0x4e4]
push eax
call fcn.00408280
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00408280
lea ecx, [ebp - 0x4e4]
call fcn.00403160
lea ecx, [ebp - 0x4e0]
call fcn.00403160
lea ecx, [ebp - 0x4dc]
call fcn.00403160
push 0
mov ecx, 0x441210
call fcn.00412ea0
push eax
push 0x4366f0
lea ecx, [ebp - 0x14]
call fcn.00412ea0
push eax
push 0x4366fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x14]
push edx
push str.CSetupFinishPage::OnWizardFinish__run__s_parameter_is__reg.
call fcn.004010c0
add esp, 8
xor eax, eax
je 0x409b1f
xor ecx, ecx
mov word [ebp - 0x480], cx
push 0x206
push 0
lea edx, [ebp - 0x47e]
push edx
call fcn.00422d40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x480]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x480]
push ecx
lea ecx, [ebp - 0x278]
call fcn.00404880
push str.installer_duowanyy.exe
lea ecx, [ebp - 0x278]
call fcn.00404920
push 0
push 0
push 0x4367bc
lea ecx, [ebp - 0x278]
call fcn.00412ea0
push eax
push 0x4367d0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.CSetupFinishPage::OnWizardFinish__run_installer_duowanyy.exe__360_.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x278]
call fcn.00403160
mov dword [ebp - 0x4e8], 0
lea ecx, [ebp - 0x14]
call fcn.00403160
lea ecx, [ebp - 0xc]
call fcn.00403160
lea ecx, [ebp - 0x18]
call fcn.00403160
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00422af0
mov esp, ebp
pop ebp
ret