Function at 0x4a24c6
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0x4c0
mov eax, 0x4e85c2
call fcn.004b5257
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x444], edi
cmp dword [ebp + 8], ebx
jne 0x4a2f31
mov eax, dword [ebp + 0xc]
mov ecx, 0x138f
cmp eax, ecx
ja 0x4a2ba1
je 0x4a2b62
mov ecx, eax
sub ecx, 8
je 0x4a2b54
sub ecx, 0x1380
je 0x4a2686
dec ecx
je 0x4a25bc
dec ecx
je 0x4a25a0
sub ecx, 4
jne 0x4a2bd0
push str.license_link
lea eax, [ebp - 0x468]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
mov dword [ebp - 4], 0xa
mov ecx, eax
call fcn.0040c8a0
push eax
lea ecx, [ebp - 0x43c]
call fcn.0042b420
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x468]
call fcn.0040d610
cmp dword [ebp - 0x424], 8
mov eax, dword [ebp - 0x438]
jae 0x4a257f
lea eax, [ebp - 0x438]
push 9
push eax
call fcn.0045f557
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040d590
jmp 0x4a2f31
xor eax, eax
cmp dword [esi + 0x338], ebx
lea ecx, [esi + 0x2bc]
setne al
push eax
call fcn.0047e2c3
jmp 0x4a2f31
lea edi, [esi + 0xa4]
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a2f31
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a25f5
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
call fcn.00469dee
add eax, 0x1a4
jmp 0x4a266e
lea eax, [ebp - 0x430]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp - 0x428]
sub edi, dword [ebp - 0x430]
push 0xffffffffffffffff
push 0x62
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x430]
add edi, eax
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x424]
add dword [ebp - 0x490], eax
mov dword [ebp - 0x498], eax
push 0x54
lea eax, [ebp - 0x49c]
push eax
push ebx
lea ecx, [esi + 0xa4]
mov dword [ebp - 0x494], edi
call fcn.00467d65
push ebx
push ebx
call fcn.00469dee
add eax, 0x1c4
push eax
lea ecx, [esi + 0x714]
call fcn.0049e7bc
mov ecx, esi
call fcn.0049e7fa
jmp 0x4a2f31
mov ecx, esi
call fcn.004a1e28
test al, al
je 0x4a2b40
mov ecx, esi
call fcn.004a1ed1
test al, al
je 0x4a2b40
lea edi, [esi + 0xa0]
push 1
mov ecx, edi
call fcn.0047f1a7
cmp dword [esi + 0x1e0], ebx
je 0x4a2723
cmp byte [0x53fe3c], bl
je 0x4a26d6
push ebx
push ebx
mov ecx, esi
call fcn.004a07bc
push str.MainDlg528
jmp 0x4a2b45
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x4a270d
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a270d
mov eax, dword [esi + 4]
push eax
push 0x1389
push 0x111
push eax
call edi
push ebx
push ebx
push 0x5f5
push dword [esi + 4]
call edi
push str.MainDlg537
jmp 0x4a2b45
mov eax, dword [esi + 0x3d8]
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
cmp byte [esi + 0x98], bl
jne 0x4a273e
cmp eax, ebx
je 0x4a2743
mov dword [0x536610], eax
cmp byte [0x53fe3c], bl
je 0x4a27c4
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x484]
mov edi, 0x53fda0
push eax
mov ecx, edi
call fcn.0046fad7
mov dword [ebp - 4], ebx
push dword [eax]
call fcn.0043ee36
neg al
sbb al, al
inc al
pop ecx
mov byte [ebp - 0x43d], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a27b4
push 0x72
push ebx
mov ecx, esi
call fcn.004a07bc
push str.MainDlg557
mov ecx, 0x53ff20
call fcn.00428d50
jmp 0x4a2f31
push 0xa
push dword [esi + 0x664]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4a27f8
lea eax, [ebp - 0x48c]
push eax
mov ecx, edi
call fcn.0047cdb4
mov dword [ebp - 4], 1
mov eax, dword [eax]
push ebx
mov edi, 0x53fda0
push eax
mov ecx, edi
call fcn.0048b477
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.0040d610
lea eax, [ebp - 0x478]
push eax
mov ecx, edi
call fcn.0046fad7
mov dword [ebp - 4], 2
push dword [eax]
call fcn.0049e9f8
neg al
sbb al, al
inc al
pop ecx
mov byte [ebp - 0x43d], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a29b1
cmp byte [0x53fe3c], bl
je 0x4a2946
push str.NEED_REBOOT
lea eax, [ebp - 0x458]
push eax
mov ecx, edi
call fcn.0047d67a
mov dword [ebp - 4], 3
mov eax, dword [eax]
push ebx
push 1
push eax
push 0x50243c
mov ecx, edi
call fcn.0047d611
push eax
push ebx
call fcn.0047f037
add esp, 0x14
dec eax
neg eax
sbb al, al
inc al
mov byte [ebp - 0x43d], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a2929
push 0x104
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.__TSinstall
cmp dword [0x53fedc], ebx
jne 0x4a28cb
mov eax, 0x50ea0c
push eax
push str.post
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push str.__s____s_s
push eax
call fcn.0046783d
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push str.360ts
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
push 2
push 1
call fcn.0049e572
add esp, 0xc
jmp 0x4a29a7
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x4a29a7
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
push str.ERROR_NOTWRITEABLE
lea eax, [ebp - 0x47c]
push eax
mov ecx, edi
call fcn.0047d67a
mov dword [ebp - 4], 4
mov eax, dword [eax]
push ebx
push ebx
push eax
push 0x50243c
mov ecx, edi
call fcn.0047d611
push eax
push dword [esi + 4]
call fcn.0047f037
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.0040d610
push str.MainDlg598
jmp 0x4a2b45
push str.MainDlg603
mov ecx, 0x53ff20
mov dword [esi + 0x9c], 1
call fcn.00444b0f
lea eax, [ebp - 0x460]
push eax
mov ecx, edi
call fcn.0046fad7
mov dword [ebp - 4], 5
push dword [eax]
push dword [esi + 4]
call fcn.0048dc12
mov ecx, eax
call fcn.0049afd3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x460]
call fcn.0040d610
call fcn.0048dc12
mov eax, dword [eax + 0x84]
push ebx
lea ecx, [esi + 0x25c]
mov dword [esi + 0x710], eax
call fcn.0047e2c3
push ebx
lea ecx, [esi + 0x2bc]
call fcn.00476835
push 1
lea ecx, [esi + 0x564]
call fcn.00476835
push ebx
lea ecx, [esi + 0x3ac]
call fcn.00476835
push ebx
lea ecx, [esi + 0x3f8]
call fcn.00476835
push ebx
cmp byte [0x53fe3c], bl
je 0x4a2a69
lea ecx, [esi + 0x30c]
call fcn.00476835
lea ecx, [esi + 0x358]
jmp 0x4a2ab7
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
lea ecx, [esi + 0x714]
call fcn.00476835
push ebx
lea ecx, [esi + 0x76c]
call fcn.00476835
push ebx
lea ecx, [esi + 0x5b8]
call fcn.00476835
push ebx
lea ecx, [esi + 0x60c]
call fcn.00476835
push ebx
lea ecx, [esi + 0x44c]
call fcn.00476835
lea ecx, [esi + 0x498]
push ebx
call fcn.00476835
push 0xffffffffffffffff
push 0x110
lea edi, [esi + 0x4ec]
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
push eax
push ebx
mov ecx, edi
call fcn.00476e98
push 1
mov ecx, edi
call fcn.00476aca
push 0xffffffffffffffff
push 0x16e
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
push 0xffffffffffffffff
push 0x228
mov edi, eax
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
push 2
push edi
push eax
push ebx
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x4a2f31
push str.MainDlg518
mov ecx, 0x53ff20
call fcn.00444b0f
jmp 0x4a2f31
push ebx
push ebx
mov ecx, esi
call fcn.004a07bc
jmp 0x4a2f31
push str.privacy_link
lea eax, [ebp - 0x488]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
mov dword [ebp - 4], 0xd
mov ecx, eax
call fcn.0040c8a0
push eax
lea ecx, [ebp - 0x43c]
call fcn.0042b420
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x488]
jmp 0x4a2565
mov ecx, eax
sub ecx, 0x1390
je 0x4a2d4f
sub ecx, 4
je 0x4a2d43
dec ecx
je 0x4a2d30
sub ecx, 3
je 0x4a2cc9
sub ecx, 0xec67
je 0x4a2c4c
add eax, 0xffffd8f0
push eax
lea eax, [ebp - 0x444]
mov edi, 0x53fda0
push eax
mov ecx, edi
call fcn.0049f661
mov dword [ebp - 4], 0x15
mov eax, dword [ebp - 0x444]
cmp dword [eax - 0xc], ebx
je 0x4a2c38
push eax
mov ecx, edi
call fcn.004a09ba
cmp byte [0x53fe3f], bl
jne 0x4a2c38
lea eax, [ebp - 0x450]
push eax
mov ecx, edi
call fcn.00484bb5
mov byte [ebp - 4], 0x16
mov eax, dword [eax]
push 1
push eax
mov ecx, esi
call fcn.004a152b
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x450]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
call fcn.0040d610
jmp 0x4a2f31
shr edi, 0x10
cmp di, bx
jbe 0x4a2f31
lea eax, [ebp - 0x430]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
movzx eax, word [ebp - 0x444]
mov dword [ebp - 0x448], eax
movzx eax, di
fild dword [ebp - 0x448]
mov dword [ebp - 0x448], eax
fild dword [ebp - 0x448]
fdivp st(1)
fmul qword [0x4f8e48]
call fcn.004b6196
push eax
lea ecx, [esi + 0x4ec]
call fcn.00476a7f
cmp word [ebp - 0x444], di
jne 0x4a2f31
push ebx
push 0xc8
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4a2f31
push str.privacy_link
lea eax, [ebp - 0x470]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
mov dword [ebp - 4], 0x10
push str.cloudanalysis
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0x11
mov ecx, eax
call fcn.0040c8a0
push eax
lea ecx, [ebp - 0x43c]
call fcn.0042b420
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x480]
call fcn.0040d610
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x470]
jmp 0x4a2565
cmp dword [esi + 0x478], ebx
setne al
mov byte [0x53fe68], al
jmp 0x4a2f31
mov byte [esi + 0x98], 1
jmp 0x4a2f31
cmp byte [0x53fe3f], bl
jne 0x4a2f31
lea eax, [ebp - 0x430]
push eax
lea ecx, [esi + 0x76c]
call fcn.0047b182
lea edi, [esi + 4]
lea eax, [ebp - 0x430]
push eax
mov ecx, edi
mov dword [ebp - 0x46c], edi
call fcn.0048575e
push 0x2c
lea eax, [ebp - 0x4c8]
push ebx
push eax
call fcn.004b4620
mov eax, 0x100
add esp, 0xc
mov dword [ebp - 0x4cc], 0x30
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
call fcn.0043a60d
mov byte [ebp - 0x449], al
mov dword [ebp - 0x444], ebx
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x444]
call fcn.0049e61d
mov esi, dword [0x53fdd0]
sub esi, dword [0x53fdcc]
mov dword [ebp - 0x448], ebx
sar esi, 2
cmp esi, ebx
jle 0x4a2efe
mov edi, 0x53fda0
push dword [ebp - 0x448]
lea eax, [ebp - 0x474]
push eax
mov ecx, edi
call fcn.004a0b4c
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov ecx, dword [ebp - 0x448]
push eax
add ecx, 0x2710
push ecx
push ebx
push dword [ebp - 0x444]
call dword [sym.imp.USER32.dll_AppendMenuW]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x474]
call fcn.0040d610
lea eax, [ebp - 0x464]
push eax
mov ecx, edi
call fcn.00484bb5
mov dword [ebp - 0x454], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x448]
lea eax, [ebp - 0x45c]
push eax
mov ecx, edi
call fcn.0049f661
mov byte [ebp - 4], 9
push dword [ebp - 0x454]
push eax
call fcn.0043f9fa
pop ecx
pop ecx
mov byte [ebp - 0x43d], al
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x45c]
call fcn.0040d610
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x464]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a2ebe
mov eax, dword [ebp - 0x448]
push 8
add eax, 0x2710
push eax
push dword [ebp - 0x444]
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp byte [ebp - 0x449], bl
je 0x4a2ee6
lea eax, [ebp - 0x4cc]
push eax
mov eax, dword [ebp - 0x448]
push ebx
add eax, 0x2710
push eax
push dword [ebp - 0x444]
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
inc dword [ebp - 0x448]
cmp dword [ebp - 0x448], esi
jl 0x4a2df6
mov edi, dword [ebp - 0x46c]
push ebx
push dword [edi]
lea ecx, [ebp - 0x444]
push dword [ebp - 0x424]
push dword [ebp - 0x430]
push 2
call fcn.0049e907
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x444], ebx
je 0x4a2f31
lea ecx, [ebp - 0x444]
call fcn.0049e65f
call fcn.004b52da
ret 0xc