Function at 0x42f6c0
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb44
mov eax, dword [0x4c97a0]
xor eax, esp
mov dword [esp + 0xb40], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4d01e8], eax
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
mov esi, eax
add esi, 0x10
push 0x9cb3
mov dword [esp + 0x14], esi
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x42f731
lea eax, [esp + 0x10]
push eax
mov eax, 0x9cb3
call fcn.0046c580
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.00468430
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42f75f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f77b
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
call fcn.0042f450
test eax, eax
je 0x42f796
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call fcn.0042f620
call fcn.0042f5c0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jbe 0x42f82f
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x42f7c2
lea edi, [esp + 0x14]
call fcn.0042eec0
test eax, eax
je 0x42f7c2
cmp dword [esp + 0x14], 0
jne 0x42f82f
lea eax, [esp + 0x10]
push eax
mov ecx, 0x9c5c
call fcn.0046c8c0
mov ecx, dword [eax]
push str.wWinMain
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f806
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430791
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x430791
mov ecx, ebx
call fcn.0042eaf0
cmp dword [0x4d01c8], 0
jne 0x42f915
cmp dword [0x4d01cc], 0
jne 0x42f915
cmp dword [0x4d01d4], 0
jne 0x42f915
cmp dword [0x4d01d8], 0
jne 0x42f915
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.lastpopwndtime
call fcn.0046c8c0
lea edx, [esp + 0x10]
push edx
mov ebx, 0x4d0cf4
call fcn.0044f460
mov edi, dword [eax]
lea ecx, [esp + 0x10]
call fcn.004710f0
lea eax, [esp + 0x10]
push eax
mov ecx, str.lastpopwndreboottime
call fcn.0046c8c0
lea ecx, [esp + 0x10]
push ecx
call fcn.0044f460
mov esi, dword [eax]
lea ecx, [esp + 0x10]
call fcn.004710f0
push 0
call fcn.0048c4ce
add esp, 4
mov ebx, eax
test esi, esi
jne 0x42f8d3
push 0x4b3258
lea edx, [esp + 0x18]
push edx
jmp 0x42f904
push esi
call fcn.004457a0
add esp, 4
test eax, eax
jne 0x42f8ec
push 0x4b3280
lea eax, [esp + 0x18]
push eax
jmp 0x42f904
sub ebx, edi
cmp ebx, 0x708
jbe 0x42fa33
push 0x4b32b0
lea ecx, [esp + 0x18]
push ecx
call fcn.00468430
add esp, 8
lea ecx, [esp + 0x14]
call fcn.004710f0
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.360LeakCheckAutoStartWnd
push 1
push 0
call edi
mov dword [0x4d01e0], eax
test eax, eax
je 0x42fa9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42fa9a
lea eax, [esp + 0x10]
push eax
mov ecx, 0x9c60
call fcn.0046c8c0
mov ecx, dword [eax]
push str.wWinMain
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f988
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42f9a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push str.360LeakFixer
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x42fa53
cmp dword [0x4d01c8], 0
je 0x42fa53
cmp dword [0x4d01cc], 0
je 0x42fa53
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x9d1e
call fcn.0046c8c0
mov edx, dword [0x4d01cc]
mov ecx, dword [0x4d01c8]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00468430
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.004710f0
lea ecx, [esp + 0x10]
call fcn.004710f0
mov ecx, dword [0x4d01cc]
mov edx, dword [0x4d01c8]
push ecx
push edx
push 0x4f1
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x430791
lea edx, [esp + 0x14]
push 0x4b32f4
push edx
call fcn.00468430
add esp, 8
lea ecx, [esp + 0x14]
call fcn.004710f0
jmp 0x430791
lea eax, [esp + 0x10]
push eax
mov ecx, 0x9d1d
call fcn.0046c8c0
mov ecx, dword [0x4d01cc]
mov edx, dword [0x4d01c8]
mov eax, dword [eax]
push esi
push ecx
push edx
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00468430
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x42f7fa
call fcn.0042e7d0
push eax
call fcn.0047a140
cmp dword [0x4d01d8], 0
je 0x42fc37
lea ecx, [esp + 0x14]
push str.no_load_360base___start_360leakfixer.exe_by_360tray.exe_with_startmainwnd_commandline.
push ecx
call fcn.00468430
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42fae4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push 0x4d08dc
push ecx
mov ebx, str.360Base.dll
call fcn.00461a70
mov esi, dword [eax]
add esp, 8
push 0
push 1
mov ecx, esi
call fcn.004607d0
test eax, eax
jne 0x42fb1f
push 1
call fcn.0048ab80
push eax
push esi
call fcn.0048ad90
add esp, 0xc
jmp 0x42fb26
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42fb46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push 0x4d08dc
push ecx
mov ebx, str.moduleszlibleak.dat
call fcn.00461a70
mov esi, dword [eax]
lea edx, [esp + 0x1c]
push 0x4d08dc
push edx
mov ebx, str.libleak.dat
call fcn.00461a70
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.004386b0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fb9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fbbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [0x4d2040], 0
je 0x42fd0d
lea ecx, [esp + 0x10]
push 0x4d08dc
push ecx
mov ebx, str.moduleszlibleak_64.dat
call fcn.00461a70
mov esi, dword [eax]
lea edx, [esp + 0x1c]
push 0x4d08dc
push edx
mov ebx, str.libleak_64.dat
call fcn.00461a70
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.004386b0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fc21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x42fc78
cmp dword [0x4d01cc], 0
je 0x42fc49
cmp dword [0x4d01c8], 0
jne 0x42fc52
cmp dword [0x4d01d4], 0
je 0x42fc8d
lea ecx, [esp + 0x14]
push str.no_load_360base___start_360leakfixer.exe_by_360safe.exe_or_start_with_startmainwnd_commandline.
push ecx
call fcn.00468430
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42fd0d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42fd0d
lea ecx, [esp + 0x14]
push 0x4d08dc
push ecx
mov ebx, str.360Base.dll
call fcn.00461a70
mov esi, dword [eax]
add esp, 8
call fcn.00457fe0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42fccb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push str.load_360base___
push ecx
call fcn.00468430
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42fcfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.360LeakFixer_UseZlib_Mutex
push 1
push 0
call edi
mov dword [0x4d01e4], eax
push 0x4d02a0
call fcn.00436e30
cmp dword [0x4d01d8], 0
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
je 0x42ffac
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.cptinst_s
call fcn.0046c8c0
lea ebx, [esp + 0x10]
mov edi, 0x4d0d14
call fcn.0044c130
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
call fcn.0044ae20
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fd76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.cptproc_s
call fcn.0046c8c0
lea ebx, [esp + 0x10]
mov edi, 0x4d0d14
call fcn.0044c130
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
call fcn.0044ae20
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fdc2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
mov edi, 1
xor ebx, ebx
mov dword [esp + 0x1c], edi
cmp dword [eax - 0xc], ebx
jne 0x42fddf
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], ebx
je 0x42fdfa
push eax
call fcn.0044af60
test eax, eax
jne 0x42fdfa
mov ecx, dword [esp + 0x20]
call fcn.0044b550
mov dword [esp + 0x1c], ebx
test eax, eax
je 0x42fdfe
mov dword [esp + 0x1c], edi
push 4
lea edx, [esp + 0x20]
push edx
push 4
push str.competition
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fe38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42fe58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, 0x4d02a0
call fcn.004364b0
test eax, eax
je 0x42ffa6
cmp dword [0x4d0da8], ebx
jne 0x42ffac
mov ecx, dword [0x4d01e0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push edx
mov dword [0x4d01e0], ebx
call fcn.004457e0
add esp, 4
lea eax, [esp + 0x28]
push eax
mov ecx, str.lastclearhotfixdate
call fcn.0046c8c0
mov dword [esp + 0x20], edi
lea ebx, [esp + 0x28]
mov edi, 0x4d0d14
call fcn.0044c130
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.00460cb0
test eax, eax
je 0x42ff02
call fcn.00478320
test eax, eax
jne 0x42ff02
lea edx, [esp + 0x10]
push edx
mov ecx, str.savefile
call fcn.0046c8c0
lea eax, [esp + 0x10]
push eax
mov ebx, 0x4d0cf4
mov dword [esp + 0x24], 3
call fcn.0044f460
cmp dword [eax], 0
mov byte [esp + 0x27], 1
je 0x42ff07
mov byte [esp + 0x27], 0
mov ebx, dword [esp + 0x20]
test bl, 2
je 0x42ff1c
lea ecx, [esp + 0x10]
and ebx, 0xfffffffd
call fcn.004710f0
test bl, 1
je 0x42ff2a
lea ecx, [esp + 0x28]
call fcn.004710f0
cmp byte [esp + 0x27], 0
je 0x42ff89
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.lastclearhotfixdate
push str.SOFTWARE360SafeLeak
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edx, dword [0x4d08dc]
push edx
lea edi, [esp + 0x44]
call fcn.00460320
push 0
push 0
push 0
call fcn.00436450
neg eax
sbb eax, eax
and eax, 0x17bb00
add eax, 0x2a300
push eax
xor ecx, ecx
mov edx, edi
call fcn.0045da60
mov esi, edi
call fcn.0040e790
mov ecx, 0x4d02a0
call fcn.00435c60
call fcn.0047e850
lea ecx, [esp + 0x1c]
call fcn.004710f0
jmp 0x430791
mov dword [0x4d0da8], ebx
mov ecx, 0x4d02a0
call fcn.00434990
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.004348d0
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x742]
push edx
mov word [esp + 0x744], cx
call fcn.0048dc10
add esp, 0xc
push 0x104
lea eax, [esp + 0x73c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...360leakfixplugin.dll
lea ecx, [esp + 0x73c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x738]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x73c]
push eax
push 1
push str.ImagePath
push str.Software360safe360krnlsvcleakfix
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x14]
push 0x4d08dc
push ecx
mov ebx, str.MiniUI.dll
call fcn.00461a70
mov esi, dword [eax]
add esp, 8
push 0
push 1
mov ecx, esi
call fcn.004607d0
test eax, eax
jne 0x43009b
push 1
call fcn.0048ab80
push eax
push esi
call fcn.0048ad90
add esp, 0xc
jmp 0x4300a2
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4300c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x94a]
push edx
mov word [esp + 0x94c], cx
call fcn.0048dc10
mov eax, dword [0x4d08dc]
add esp, 0xc
push str.I18N.dll
push eax
lea ecx, [esp + 0x948]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x940]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43037b
mov eax, dword [0x4d08dc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43037b
lea esi, [esp + 0x940]
call fcn.00462990
test eax, eax
je 0x43037b
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
mov ebx, dword [0x4d08dc]
add eax, 0x10
mov dword [esp + 0x34], eax
xor eax, eax
mov edi, esi
lea esi, [esp + 0x34]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call fcn.00434840
test eax, eax
je 0x43035b
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x43035b
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push eax
call edx
lea esi, [esp + 0x20]
mov dword [0x4d01ec], eax
call fcn.0046f080
mov edx, esi
lea ecx, [esp + 0x34]
call fcn.004346f0
mov esi, dword [esp + 0x20]
mov ecx, esi
lea ebx, [esp + 0x1c]
call fcn.00460b30
cmp dword [0x4d01ec], 1
mov edi, dword [esp + 0x1c]
jne 0x430295
call fcn.00462990
test eax, eax
je 0x430295
cmp dword [edi - 0xc], 0
jle 0x430295
mov eax, ebx
push eax
mov ecx, str.1.0.0.1003
call fcn.00460cb0
test eax, eax
jl 0x430295
xor edi, edi
xor esi, esi
xor ecx, ecx
push 0xc6
push ecx
lea edx, [esp + 0x67a]
push edx
mov word [esp + 0x67c], cx
call fcn.0048dc10
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
add esp, 0xc
push 0x64
lea edx, [esp + 0x674]
push edx
push esi
push eax
mov eax, dword [ecx + 0x30]
call eax
test eax, eax
je 0x43024a
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ecx
lea ecx, [esp + 0x678]
call fcn.0046c8c0
push 0x4d2048
call fcn.00434630
inc edi
inc esi
cmp esi, 3
jl 0x4301f0
test edi, edi
jne 0x43032f
push ecx
mov edx, esp
mov dword [esp + 0x18], esp
push edx
mov ecx, 0x4b367c
call fcn.0046c8c0
push 0x4d2048
call fcn.00434630
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push eax
mov ecx, 0x4b3688
call fcn.0046c8c0
push 0x4d2048
call fcn.00434630
jmp 0x43032f
cmp dword [0x4d01ec], 2
jne 0x430349
call fcn.00462990
test eax, eax
je 0x430349
cmp dword [edi - 0xc], 0
jle 0x430349
lea ecx, [esp + 0x1c]
push ecx
mov ecx, str.1.0.0.1002
call fcn.00460cb0
test eax, eax
jl 0x430349
xor esi, esi
mov edi, edi
xor edx, edx
push 0xc6
push edx
lea eax, [esp + 0x67a]
push eax
mov word [esp + 0x67c], dx
call fcn.0048dc10
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
add esp, 0xc
push 0x64
lea edx, [esp + 0x674]
push edx
push esi
push eax
mov eax, dword [ecx + 0x30]
call eax
test eax, eax
je 0x430329
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ecx
lea ecx, [esp + 0x678]
call fcn.0046c8c0
push 0x4d2048
call fcn.00434630
inc esi
cmp esi, 3
jl 0x4302d0
lea edx, [esp + 0x34]
push edx
call fcn.00433eb0
test eax, eax
je 0x430349
push eax
push 0x4ce640
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ecx, [esp + 0x1c]
call fcn.004710f0
lea ecx, [esp + 0x20]
call fcn.004710f0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43037b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
add eax, 0x10
push 0x9dca
mov dword [esp + 0x14], eax
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4303b4
lea edx, [esp + 0x10]
push edx
mov eax, 0x9dca
call fcn.0046c580
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
add eax, 0x10
push 0x9dc9
mov dword [esp + 0x2c], eax
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4303ec
lea eax, [esp + 0x28]
push eax
mov eax, 0x9dc9
call fcn.0046c580
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
add eax, 0x10
push 0x9dc8
mov dword [esp + 0x34], eax
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x430425
lea edx, [esp + 0x30]
push edx
mov eax, 0x9dc8
call fcn.0046c580
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
add eax, 0x10
push 0x9dc7
mov dword [esp + 0x30], eax
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x43045d
lea eax, [esp + 0x2c]
push eax
mov eax, 0x9dc7
call fcn.0046c580
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
add eax, 0x10
push 0x9dc6
mov dword [esp + 0x20], eax
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x430496
lea edx, [esp + 0x1c]
push edx
mov eax, 0x9dc6
call fcn.0046c580
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
add eax, 0x10
push 0x9dc5
mov dword [esp + 0x24], eax
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4304ce
lea eax, [esp + 0x20]
push eax
mov eax, 0x9dc5
call fcn.0046c580
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
mov ebx, eax
add ebx, 0x10
push 0x9dc4
mov dword [esp + 0x18], ebx
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x43050d
lea edx, [esp + 0x14]
push edx
mov eax, 0x9dc4
call fcn.0046c580
mov ebx, dword [esp + 0x14]
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
mov edi, eax
add edi, 0x10
push 0x9dc3
mov dword [esp + 0x18], edi
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x43054b
lea eax, [esp + 0x14]
push eax
mov eax, 0x9dc3
call fcn.0046c580
mov edi, dword [esp + 0x14]
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
mov esi, eax
add esi, 0x10
push 0x9dc2
mov dword [esp + 0x18], esi
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x43058a
lea edx, [esp + 0x14]
push edx
mov eax, 0x9dc2
call fcn.0046c580
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push ebx
mov eax, edi
mov ecx, esi
call fcn.00433c50
add esi, 0xfffffff0
add esp, 0x1c
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4305d1
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4305ed
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
add ebx, 0xfffffff0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430609
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430629
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430649
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430669
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430689
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4306a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4306c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x4d2048
call fcn.00433820
mov ecx, dword [0x4d2090]
push ecx
lea edx, [esp + 0x18]
push 0x4b36ac
push edx
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43070c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push 0x4d08dc
push ecx
mov ebx, str.360Util.dll
call fcn.00461a70
mov edx, dword [eax]
push edx
call fcn.004337d0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43074b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [0x4d0290], 0
jne 0x43076c
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [0x4d08dc]
call fcn.0047deb0
mov dword [0x4d0290], eax
call fcn.0047f5c0
call fcn.0042e8a0
mov dword [esp + 0x10], eax
call fcn.004336b0
mov ecx, dword [0x4d01e0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0047e850
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
mov esi, eax
add esi, 0x10
push 0x9c77
mov dword [esp + 0x18], esi
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4307d0
lea edx, [esp + 0x14]
push edx
mov eax, 0x9c77
call fcn.0046c580
mov esi, dword [esp + 0x14]
push str.wWinMain
lea eax, [esp + 0x18]
push esi
push eax
call fcn.00468430
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430803
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43081f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0xb4c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048b133
mov esp, ebp
pop ebp
ret 0x10