Function at 0x70228af0
Capabilities:
Accept command line arguments
Allocate thread local storage
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7031626b
mov eax, dword fs:[0]
push eax
sub esp, 0x644
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [0x70359468]
mov edi, ecx
push 0x208
lea eax, [edi + 0x108]
push eax
push 0
mov dword [ebp - 0x64c], edi
mov dword [ebp - 0x630], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea esi, [edi + 0x310]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x40
xor ebx, ebx
lea eax, [edi + 0x558]
push ebx
push eax
call fcn.702e95e0
add esp, 0xc
push 0x40
lea eax, [edi + 0x518]
push ebx
push eax
call fcn.702e95e0
add esp, 0xc
push 0x104
lea eax, [edi + 4]
push eax
mov dword [edi + 0x59c], ebx
mov dword [edi + 0x598], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call esi
cmp eax, ebx
je 0x70228bac
xor ecx, ecx
mov word [eax], cx
push str.Kaspersky
lea ebx, [edi + 0x108]
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x70228bce
mov dword [edi + 0x5a4], 1
jmp 0x70228bdb
mov ecx, edi
call fcn.70228a20
mov dword [edi + 0x5a4], eax
push ebx
call esi
mov ebx, eax
mov dword [ebp - 0x634], ebx
test ebx, ebx
je 0x7022909c
mov edx, ebx
mov ecx, edi
call fcn.702282d0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str.explorer.exe
push ebx
call esi
test eax, eax
jne 0x70228c18
mov dword [edi + 0x5bc], 1
jmp 0x7022904f
push str.360se.exe
push ebx
call esi
test eax, eax
jne 0x70228c3d
mov dword [edi + 0x5cc], 1
mov dword [edi + 0x61c], 2
jmp 0x7022904f
push str.iexplore.exe
push ebx
call esi
test eax, eax
jne 0x70228c6e
mov dword [edi + 0x61c], 1
call fcn.70219050
mov dword [edi + 0x5ac], eax
call fcn.70219140
mov dword [edi + 0x5b0], eax
jmp 0x7022904f
push str.AcroRd32.exe
push ebx
call esi
test eax, eax
jne 0x70228c89
mov dword [edi + 0x5f0], 1
jmp 0x7022904f
push str.Chrome.exe
push ebx
call esi
test eax, eax
jne 0x70228ca4
mov dword [edi + 0x5f4], 1
jmp 0x7022904f
push str.firefox.exe
push ebx
call esi
test eax, eax
jne 0x70228cbf
mov dword [edi + 0x5dc], 1
jmp 0x7022904f
push str.Au_.exe
push ebx
call esi
test eax, eax
jne 0x70228cda
mov dword [edi + 0x5e0], 1
jmp 0x7022904f
push str.opera.exe
push ebx
call esi
test eax, eax
jne 0x70228cf5
mov dword [edi + 0x5e8], 1
jmp 0x7022904f
push str.browser.exe
push ebx
call esi
test eax, eax
jne 0x70228d26
push str.Yandex
lea eax, [edi + 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x70228d26
mov dword [edi + 0x5e4], 1
jmp 0x7022904f
push str.AliIM.exe
push ebx
call esi
test eax, eax
jne 0x70228d41
mov dword [edi + 0x5f8], 1
jmp 0x7022904f
push str.safevideo.exe
push ebx
call esi
test eax, eax
jne 0x70228d5c
mov dword [edi + 0x5fc], 1
jmp 0x7022904f
push str.QQ.exe
push ebx
call esi
test eax, eax
jne 0x70228d77
mov dword [edi + 0x600], 1
jmp 0x7022904f
push str.YY.exe
push ebx
call esi
test eax, eax
jne 0x70228d92
mov dword [edi + 0x604], 1
jmp 0x7022904f
push str.360chrome.exe
push ebx
call esi
test eax, eax
jne 0x70228de8
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x63c], eax
lea edx, [ebp - 0x63c]
push edx
lea eax, [ebp - 0x62c]
push eax
lea eax, [edi + 0x108]
push eax
mov dword [edi + 0x5d0], 1
call fcn.702156d0
mov eax, dword [ebp - 0x62c]
add esp, 0xc
cmp eax, 0x70003
ja 0x70228de4
jb 0x7022904f
xor eax, eax
jmp 0x70228e54
push str.theworld.exe
push ebx
call esi
test eax, eax
jne 0x70228e6b
lea ecx, [ebp - 0x63c]
push ecx
lea edx, [ebp - 0x62c]
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x63c], eax
push edx
lea eax, [edi + 0x108]
push eax
mov dword [edi + 0x5b4], 1
call fcn.702156d0
mov eax, dword [ebp - 0x62c]
add esp, 0xc
cmp eax, 0x60000
ja 0x70228e3a
jb 0x7022904f
xor eax, eax
mov dword [edi + 0x5a8], eax
mov dword [edi + 0x5c0], eax
mov dword [edi + 0x5c4], eax
mov dword [edi + 0x5b8], eax
mov dword [edi + 0x5ec], eax
mov dword [edi + 0x620], eax
mov dword [edi + 0x624], eax
jmp 0x7022904f
push str.winword.exe
push ebx
call esi
test eax, eax
jne 0x70228e86
mov dword [edi + 0x608], 1
jmp 0x7022904f
push str.SGTool.exe
push ebx
call esi
test eax, eax
jne 0x70228ea1
mov dword [edi + 0x60c], 1
jmp 0x7022904f
push str.PinyinUp.exe
push ebx
call esi
test eax, eax
jne 0x70228ebc
mov dword [edi + 0x610], 1
jmp 0x7022904f
push str.ImeUtil.exe
push ebx
call esi
test eax, eax
jne 0x70228ed7
mov dword [edi + 0x614], 1
jmp 0x7022904f
push str.SohuNews.exe
push ebx
call esi
test eax, eax
jne 0x70228ef2
mov dword [edi + 0x618], 1
jmp 0x7022904f
push str.QHSafeTray.exe
push ebx
call esi
test eax, eax
jne 0x70228f0d
mov dword [edi + 0x638], 1
jmp 0x7022904f
push str.spartan_edge.exe
push ebx
call esi
test eax, eax
je 0x70229045
push str.microsoftedgecp.exe
push ebx
call esi
test eax, eax
je 0x70229045
push str.msedge.exe
push ebx
call esi
test eax, eax
jne 0x7022904f
mov dword [edi + 0x640], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
call fcn.70218e40
mov esi, eax
test esi, esi
je 0x70228f9a
cmp word [esi], 0
je 0x70228f9a
push 7
push str.__type
push esi
call fcn.702e5fbe
add esp, 0xc
test eax, eax
je 0x70228f84
push str._prefetch:
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x70228f9a
mov dword [edi + 0x644], 0
mov dword [edi + 0x648], 1
jmp 0x70228fae
mov dword [edi + 0x648], 0
mov dword [edi + 0x644], 1
cmp dword [edi + 0x644], 0
je 0x7022904f
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.702e95e0
add esp, 0xc
lea esi, [ebp - 0x218]
call fcn.70218d60
test eax, eax
je 0x7022904f
lea esi, [edi + 0x108]
push esi
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x7022904f
push str.Edge_SxSApplicationmsedge.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x7022904f
push str.Edge_DevApplicationmsedge.exe
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x7022904f
mov ecx, esi
mov dword [edi + 0x650], 1
call fcn.70218c20
mov dword [edi + 0x64c], eax
jmp 0x7022904f
mov dword [edi + 0x63c], 1
xor esi, esi
cmp dword [str.iexplore.exe], esi
je 0x70229084
mov eax, 0x7035480c
mov edi, edi
mov edx, dword [eax]
push edx
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x70229291
inc esi
cmp dword [esi*4 + 0x7035480c], 0
lea eax, [esi*4 + 0x7035480c]
jne 0x70229060
xor eax, eax
push 0x20
mov dword [edi + 0x5c8], eax
push ebx
lea eax, [edi + 0x558]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
cmp dword [edi + 0x5cc], 0
jne 0x702290ae
cmp dword [edi + 0x5d0], 0
je 0x702290da
call fcn.70227e90
cmp eax, 2
jne 0x702290da
xor eax, eax
cmp dword [edi + 0x5d0], eax
setne al
xor ecx, ecx
cmp dword [edi + 0x5cc], ecx
setne cl
mov dword [edi + 0x5d8], eax
mov dword [edi + 0x5d4], ecx
push 1
push 0x23
lea edx, [edi + 0x868]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ebx, [edi + 0x660]
call fcn.70218a90
lea eax, [edi + 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.70218910
xor esi, esi
add esp, 4
cmp dword [edi + 0x5b8], esi
jne 0x7022914d
cmp dword [edi + 0x5c0], esi
jne 0x7022914d
cmp dword [edi + 0x5a8], esi
jne 0x7022914d
cmp dword [edi + 0x5bc], esi
jne 0x7022914d
cmp dword [edi + 0x5c4], esi
jne 0x7022914d
cmp dword [edi + 0x5f0], esi
jne 0x70229155
cmp dword [edi + 0x644], esi
je 0x7022956b
cmp dword [edi + 0x5f0], esi
je 0x70229168
push str.version.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x7022956b
mov edx, dword [ebp - 0x630]
push 0x208
lea ecx, [ebp - 0x628]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x630]
push ecx
lea edx, [ebp - 0x628]
push edx
mov dword [ebp - 0x630], esi
mov dword [ebp - 0x62c], esi
call fcn.702156d0
add esp, 0xc
test eax, eax
je 0x702291e4
mov eax, dword [ebp - 0x62c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x630]
movzx edx, ax
push edx
shr eax, 0x10
push eax
push str._d._d._d._d
mov ecx, 0x1e
lea ebx, [edi + 0x518]
call fcn.7020db00
add esp, 0x14
xor esi, esi
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x630]
push ecx
lea eax, [edi + 0x108]
push eax
mov dword [ebp - 0x630], esi
mov dword [ebp - 0x62c], esi
call fcn.702156d0
add esp, 0xc
test eax, eax
je 0x70229229
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x62c]
mov dword [edi + 0x598], edx
mov dword [edi + 0x59c], eax
xor eax, eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], eax
mov esi, dword [ebp - 0x634]
cmp esi, eax
je 0x702292e7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
inc eax
cdq
push 2
push edx
push eax
call fcn.702fbce0
mov ebx, eax
add eax, 0x80000000
adc edx, 0
mov dword [ebp - 0x63c], edx
jne 0x702292e5
cmp eax, 0xffffffff
ja 0x702292e5
cmp ebx, 0x400
jg 0x7022929b
push ebx
call fcn.7020c9f0
add esp, 4
test al, al
je 0x7022929b
mov eax, ebx
call fcn.702e98d0
mov dword [ebp - 0x62c], esp
jmp 0x702292b4
mov eax, 1
jmp 0x70229086
mov eax, ebx
lea esi, [ebp - 0x630]
call fcn.7020c990
mov esi, dword [ebp - 0x634]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
je 0x702292e5
mov eax, dword [ebp - 0x62c]
push 0
push 0
push ebx
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x62c]
jmp 0x702292e7
xor eax, eax
mov ecx, dword [edi + 0x5a0]
mov edx, dword [edi + 0x598]
push ecx
mov ecx, dword [edi + 0x59c]
mov ebx, eax
call fcn.70228170
add esp, 4
mov dword [edi + 0x5a0], eax
test esi, esi
je 0x702293ab
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
inc eax
cdq
push 2
push edx
push eax
call fcn.702fbce0
mov ebx, eax
add eax, 0x80000000
adc edx, 0
mov dword [ebp - 0x63c], edx
jne 0x702293ab
cmp eax, 0xffffffff
ja 0x702293ab
cmp ebx, 0x400
jg 0x70229361
push ebx
call fcn.7020c9f0
add esp, 4
test al, al
je 0x70229361
mov eax, ebx
call fcn.702e98d0
mov dword [ebp - 0x62c], esp
jmp 0x7022937a
mov eax, ebx
lea esi, [ebp - 0x630]
call fcn.7020c990
mov esi, dword [ebp - 0x634]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
je 0x702293ab
mov eax, dword [ebp - 0x62c]
push 0
push 0
push ebx
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x62c]
jmp 0x702293ad
xor eax, eax
mov edx, dword [edi + 0x628]
mov ecx, dword [edi + 0x59c]
push edx
mov edx, dword [edi + 0x598]
mov ebx, eax
call fcn.70228220
add esp, 4
mov dword [edi + 0x628], eax
mov eax, 4
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x644]
push ecx
lea edx, [ebp - 0x650]
push edx
push 0x7032a1b0
push str.SOFTWARE360Safe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x644], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x70229428
cmp dword [ebp - 0x644], eax
setne al
mov dword [edi + 0x62c], eax
cmp dword [edi + 0x62c], 0
je 0x70229534
xor esi, esi
push 0x208
mov eax, 1
lea ecx, [ebp - 0x420]
push esi
push ecx
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x634], esi
call fcn.702e95e0
add esp, 0xc
push str..._tcfg.dll
lea eax, [edi + 0x310]
push eax
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x70229503
lea eax, [ebp - 0x420]
call fcn.702b4730
test eax, eax
je 0x70229503
mov esi, dword [0x7036ed10]
test esi, esi
jne 0x702294b3
call fcn.70227ab0
mov esi, eax
mov dword [0x7036ed10], esi
lea eax, [ebp - 0x420]
call fcn.70227a10
push 0x616a6964
lea edi, [ebp - 0x63c]
call fcn.70229a40
add esp, 4
push 0x77647371
lea edi, [ebp - 0x62c]
call fcn.70229a40
add esp, 4
push 0x7773746f
lea edi, [ebp - 0x634]
call fcn.70229a40
mov esi, dword [ebp - 0x634]
mov edi, dword [ebp - 0x64c]
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x62c], ecx
setne cl
xor edx, edx
cmp dword [ebp - 0x63c], edx
setne dl
mov dword [edi + 0x634], ecx
mov dword [edi + 0x630], edx
test esi, esi
jne 0x7022952e
mov esi, 0x1f4
mov dword [edi + 0x654], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp dword [ebp - 0x630], 0
mov dword [edi + 0xa70], eax
je 0x7022956b
lea esp, [esp]
mov eax, dword [ebp - 0x630]
mov esi, dword [eax]
push eax
mov dword [ebp - 0x630], esi
call fcn.702e1dee
add esp, 4
test esi, esi
jne 0x70229550
lea esp, [ebp - 0x660]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret