Function at 0x401110
Capabilities:
Check os version
Get common file path
Get file version info
Persist via run registry key

Disassembly:
sub esp, 0x94c
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
mov edi, str.C:9CdvdPlayInst_
push 0x104
xor ebx, ebx
push str.C:9CdvdPlayInst_
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dl, byte [eax + str.C:9CdvdPlayInst_]
lea ecx, [eax + str.C:9CdvdPlayInst_]
cmp dl, 0x5c
je 0x40115d
mov edx, eax
dec eax
test edx, edx
jle 0x40115d
mov byte [ecx], bl
mov dl, byte [ecx - 1]
dec ecx
cmp dl, 0x5c
jne 0x40114b
mov edi, dword [esp + 0x964]
mov esi, str.setup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40118f
cmp cl, bl
je 0x40118b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40118f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40116b
xor eax, eax
jmp 0x401194
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4011d5
call fcn.00401c00
call fcn.00401bc0
call fcn.00402350
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:9CdvdPlayInst_
call fcn.004023a0
add esp, 4
call fcn.004036e0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x94c
ret 0x10
mov esi, 0x40e400
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401200
cmp cl, bl
je 0x4011fc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401200
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4011dc
xor eax, eax
jmp 0x401205
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401245
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push str.C:9CdvdPlayInst_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._sQvodPlayer.exe
push eax
call fcn.00403e14
lea ecx, [esp + 0x34]
push ecx
call fcn.00401bf0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, 0x40e3e8
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401270
cmp cl, bl
je 0x40126c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401270
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40124c
xor eax, eax
jmp 0x401275
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4012b0
call fcn.00401c00
push 1
call fcn.00401ed0
add esp, 4
call fcn.004020b0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402350
call fcn.00402730
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.resetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4012db
cmp cl, bl
je 0x4012d7
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4012db
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4012b7
xor eax, eax
jmp 0x4012e0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401328
call fcn.00401c00
push 1
call fcn.00401ed0
add esp, 4
call fcn.004020b0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402350
push str.C:9CdvdPlayInst_
call fcn.004023a0
add esp, 4
call fcn.00402730
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.nbsetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401353
cmp cl, bl
je 0x40134f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401353
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40132f
xor eax, eax
jmp 0x401358
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4013a2
call fcn.004020b0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push 1
call fcn.00401ed0
add esp, 4
call fcn.00402350
push 0x3e8
call esi
push str.C:9CdvdPlayInst_
call fcn.004023a0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.nbrun
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4013cd
cmp cl, bl
je 0x4013c9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4013cd
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4013a9
xor eax, eax
jmp 0x4013d2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4013ef
push ebx
push 1
call fcn.00402100
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.setupdate
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40141a
cmp cl, bl
je 0x401416
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40141a
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4013f6
xor eax, eax
jmp 0x40141f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401436
call fcn.00401c70
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.Google
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401461
cmp cl, bl
je 0x40145d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401461
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40143d
xor eax, eax
jmp 0x401466
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4015b4
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
push str.C:9CdvdPlayInst_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x338]
push str._sgtapi_signed.dll
push eax
call fcn.00403e14
add esp, 0xc
lea ecx, [esp + 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov esi, 1
cmp edi, ebx
mov dword [esp + 0x14], ebx
je 0x4014da
push str.ToolbarCompatibilityCheck
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4014d3
lea edx, [esp + 0x14]
push edx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x338]
push 0x40e388
push eax
call fcn.00403e14
mov edi, str.google.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.C:9CdvdPlayInst_
mov esi, edi
mov edx, ecx
mov edi, str.C:9CdvdPlayInst_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00401000
lea eax, [esp + 0x334]
lea ecx, [esp + 0xc]
push eax
push str.check
push str.GOOGLE
call fcn.004010e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
lea edx, [esp + 0x334]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x40e388
push edx
call fcn.00403e14
add esp, 0xc
lea eax, [esp + 0x334]
lea ecx, [esp + 0xc]
push eax
push str.checkerr
push str.GOOGLE
call fcn.004010e0
mov dword [esp + 0xc], 0x40b188
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x401bb1
jmp 0x401ba8
mov esi, str.WriteIni
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4015df
cmp cl, bl
je 0x4015db
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4015df
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4015bb
xor eax, eax
jmp 0x4015e4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40188d
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push str.C:9CdvdPlayInst_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._sqvod1.ini
push eax
call fcn.00403e14
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
lea ecx, [esp + 0x540]
call fcn.00403800
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
push 0x208
push edx
rep stosd dword es:[edi], eax
push str.Insertpath
push str.Insert
lea ecx, [esp + 0x550]
call fcn.00403880
test eax, eax
je 0x40166b
cmp byte [esp + 0x28], bl
je 0x40166b
lea eax, [esp + 0x28]
push eax
jmp 0x4016f3
lea ecx, [esp + 0x334]
mov dword [esp + 0x334], 0x94
push ecx
mov esi, 5
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401694
mov esi, dword [esp + 0x338]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x230]
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, 6
mov byte [esp + 0x233], bl
jl 0x4016d4
lea eax, [esp + 0x230]
lea ecx, [esp + 0x28]
push eax
push str._sQvodPlayer
push ecx
jmp 0x4016e6
lea edx, [esp + 0x230]
lea eax, [esp + 0x28]
push edx
push str._sProgram_FilesQvodPlayer
push eax
call fcn.00403e14
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push str.State
push str.Field_3
lea ecx, [esp + 0x18]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
push 0x208
push edx
rep stosd dword es:[edi], eax
push str.defaultsavepath
push str.Option
lea ecx, [esp + 0x550]
call fcn.00403880
cmp eax, ebx
jne 0x40177f
push str.SoftwareQvodPlayer_
push 0x80000002
lea ecx, [esp + 0x33c]
call fcn.00403840
lea eax, [esp + 0x28]
push 0x208
push eax
push str.defaultsavepath
push str.Option
lea ecx, [esp + 0x344]
call fcn.00403880
lea ecx, [esp + 0x334]
mov esi, eax
call fcn.00403870
cmp esi, ebx
je 0x40178c
cmp byte [esp + 0x28], bl
je 0x40178c
lea ecx, [esp + 0x28]
push ecx
jmp 0x4017ec
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x230]
lea edx, [esp + 0x230]
rep stosd dword es:[edi], eax
push edx
call fcn.004035a0
add esp, 4
test eax, eax
je 0x4017e7
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x230]
lea ecx, [esp + 0x334]
push eax
push str._sMedia_
push ecx
call fcn.00403e14
add esp, 0xc
lea edx, [esp + 0x334]
push edx
jmp 0x4017ec
push str.C:Media_
push str.State
push str.Field_4
lea ecx, [esp + 0x18]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x410f9c
rep stosd dword es:[edi], eax
push 0x80000001
lea ecx, [esp + 0x754]
call fcn.00403840
lea eax, [esp + 0x28]
push 0x208
push eax
push str.QvodPlayer
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x75c]
call fcn.00403880
push 0x40e268
push str.State
push str.Field_8
lea ecx, [esp + 0x18]
test eax, eax
call fcn.004010e0
lea ecx, [esp + 0x74c]
call fcn.00403870
lea ecx, [esp + 0x540]
call fcn.00403870
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40b188
cmp eax, ebx
je 0x401bb1
jmp 0x401ba8
mov esi, str.Updateini
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4018b8
cmp cl, bl
je 0x4018b4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4018b8
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401894
xor eax, eax
jmp 0x4018bd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4019a4
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push str.C:9CdvdPlayInst_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._sQvodCfg.ini
push eax
call fcn.00403e14
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
lea ecx, [esp + 0x540]
call fcn.00403800
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push ebx
rep stosd dword es:[edi], eax
push str.Update
push str.Option
lea ecx, [esp + 0x54c]
call fcn.00403980
mov esi, eax
cmp esi, 2
jle 0x401947
push ebx
push str.Update
push str.Option
lea ecx, [esp + 0x54c]
xor esi, esi
call fcn.00403a40
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push esi
lea edx, [esp + 0x2c]
push 0x40e388
rep stosd dword es:[edi], eax
push edx
call fcn.00403e14
add esp, 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push str.update
push str.QVODTERMINAL
call fcn.004010e0
lea ecx, [esp + 0x540]
call fcn.00403870
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40b188
cmp eax, ebx
je 0x401bb1
jmp 0x401ba8
mov esi, str.space
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4019cf
cmp cl, bl
je 0x4019cb
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4019cf
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4019ab
xor eax, eax
jmp 0x4019d4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401a06
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x230]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x230]
push eax
call fcn.004035a0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.qvodv
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401a31
cmp cl, bl
je 0x401a2d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401a31
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401a0d
xor eax, eax
jmp 0x401a36
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401bb1
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x334]
push str.C:9CdvdPlayInst_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x338]
push str._sqvod3_u.ini
push eax
call fcn.00403e14
add esp, 0xc
lea ecx, [esp + 0x334]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401000
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push str.C:9CdvdPlayInst_
lea edx, [esp + 0x2c]
push str._sQvodTerminal.exe
rep stosd dword es:[edi], eax
push edx
call fcn.00403e14
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.00403dd0
add esp, 0x14
cmp eax, 0xffffffff
je 0x401b98
lea ecx, [esp + 0x24]
lea edx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x2c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call fcn.00403d3f
add esp, 4
mov esi, eax
lea eax, [esp + 0x28]
push esi
push edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push edx
push str.VarFileInfoTranslation
push esi
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401b98
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x230]
xor edx, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x238]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.00403e14
add esp, 0x10
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
lea eax, [esp + 0x230]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401b98
mov ecx, dword [esp + 0x14]
push 0x40e1a8
push ecx
call fcn.00403d50
mov edx, dword [esp + 0x1c]
push 0x40e1a4
push edx
mov esi, eax
call fcn.00403d50
add esp, 0x10
cmp esi, ebx
jne 0x401b80
cmp eax, ebx
je 0x401b98
push 0x40e268
push str.State
push str.Field_1
lea ecx, [esp + 0x28]
call fcn.004010e0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], 0x40b188
cmp eax, ebx
je 0x401bb1
push eax
call fcn.00403d34
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10