Function at 0x4311a0
Capabilities:
Accept command line arguments
Check os version
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d9e4
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5867ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 8
push eax
mov dword [ebp - 0x428], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x547300
push 0
call fcn.004e5925
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x547304
call fcn.0043b940
add esp, 8
mov ecx, 0x58e510
push 0
push dword [0x58a44c]
push 0
call fcn.0042ff70
lea ecx, [ebp - 0x448]
call fcn.0040f0d0
mov dword [ebp - 4], 0
call fcn.0042fcf0
mov ecx, eax
call fcn.004889a0
mov eax, dword [0x58e5dc]
test al, 1
jne 0x43128e
or eax, 1
mov dword [0x58e5dc], eax
mov ecx, 0x58e5d8
mov byte [ebp - 4], 1
call fcn.00442e80
push 0x53f780
call fcn.004998f2
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x58e5d8
call fcn.00442ed0
push esi
call fcn.0042fc30
mov ecx, eax
call fcn.004242d0
push esi
push str.lpstrCmdLine_s
call fcn.0043b940
add esp, 8
call fcn.0042fc30
mov ecx, eax
call fcn.00425a90
push eax
call fcn.00442760
mov ecx, 0x58e54c
call fcn.0040fb80
test eax, eax
jne 0x4312f5
push str.CheckSingleInstance_failed__exit
call fcn.0043b940
add esp, 4
push 0
push 0
push 0x547394
push 0
call fcn.00442770
jmp 0x4317f2
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 2
push eax
call fcn.00473ac5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x444]
push eax
push 0x42cb60
push 0x58e5d0
call fcn.00474a9b
add esp, 0x10
test eax, eax
je 0x4319e5
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 4
push eax
call fcn.00473aff
mov ecx, dword [0x58e5cc]
add esp, 4
mov byte [ebp - 4], 0
call fcn.00425090
test eax, eax
jne 0x431386
call fcn.0042f370
test eax, eax
jne 0x431386
push eax
push eax
push 0x5473b0
push eax
call fcn.00442770
jmp 0x4317f2
call fcn.0042fc30
mov ecx, eax
call fcn.00423d70
push eax
call fcn.0041f300
mov ecx, eax
call fcn.00418d90
push str.bizhi
call fcn.0041f300
mov ecx, eax
call fcn.00418e50
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b8590
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x58a44c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.0041f300
mov ecx, eax
call fcn.00418d00
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 7
push eax
call fcn.00473ac5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x444]
push eax
push 0x42cb60
push 0x58e5d0
call fcn.00474a9b
add esp, 0x10
test eax, eax
je 0x4319c9
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 9
push eax
call fcn.00473aff
mov ecx, dword [0x58e5cc]
add esp, 4
mov byte [ebp - 4], 0
call fcn.00425b70
sub esp, 0x28
test eax, eax
mov eax, esp
mov dword [ebp - 0x430], esp
mov dword [eax + 0x24], 0
je 0x431512
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0xd
push eax
call fcn.00473ac5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x438]
push eax
push 0x41bdb0
push 0x589e2c
call fcn.00474a9b
add esp, 0x10
test eax, eax
je 0x4314ee
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0xf
push eax
call fcn.00473aff
add esp, 4
mov byte [ebp - 4], 0xc
push 0
push 0
push str.update_1
jmp 0x431582
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x10
push eax
call fcn.00473b41
add esp, 4
mov byte [ebp - 4], 0xe
test al, al
je 0x431a17
jmp 0x431a01
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x13
push eax
call fcn.00473ac5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x438]
push eax
push 0x41bdb0
push 0x589e2c
call fcn.00474a9b
add esp, 0x10
test eax, eax
je 0x4319ad
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x15
push eax
call fcn.00473aff
add esp, 4
mov byte [ebp - 4], 0x12
push 0
push 0
push str.install_1
mov ecx, dword [0x589e28]
mov byte [ebp - 4], 0
call fcn.004188f0
call fcn.00430090
test eax, eax
jne 0x4315b4
mov ecx, 0x58e54c
call fcn.004101d0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4317f2
push 0x110
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0x114
push 0
push eax
call fcn.004b8590
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jae 0x431616
call fcn.0042fc30
mov ecx, eax
call fcn.00425a90
test eax, eax
jne 0x4317f2
push 0x40
push str.S_MRHr_g
push 0x5472ec
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4317f2
call fcn.00430840
test eax, eax
jne 0x43165a
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x430], esp
mov dword [eax + 0x24], 0
push 0
push 0
lea ecx, [ebp - 0x421]
mov byte [ebp - 4], 0x18
call fcn.0042db20
push eax
call fcn.0041f300
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.004188f0
jmp 0x4317f2
push dword [ebp + 0x14]
push esi
call fcn.00432830
add esp, 8
cmp dword [0x585204], 0
jne 0x4317f2
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
call fcn.00420a80
test eax, eax
je 0x4316c3
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x4317f2
push eax
jmp 0x4317ec
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004b8590
mov esi, dword [ebp - 0x43c]
lea eax, [ebp - 0x440]
add esp, 0xc
mov dword [ebp - 0x440], 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push str.oem_f
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4317e7
mov eax, dword [ebp - 0x430]
cmp eax, 1
je 0x431728
cmp eax, 2
jne 0x4317e7
mov eax, dword [ebp - 0x440]
test eax, eax
je 0x4317de
test al, 1
jne 0x4317e7
shr eax, 1
cmp word [ebp + eax*2 - 0x422], 0
jne 0x4317e7
mov ax, word [ebp - 0x420]
cmp ax, 0x31
jne 0x4317e7
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43176d
push esi
call edi
push 0x20206
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
call fcn.00420a80
test eax, eax
je 0x4317b8
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x4317f2
push eax
call edi
jmp 0x4317f2
mov esi, dword [ebp - 0x43c]
push 4
push 0x546cb0
push 1
push 0
push str.oem_f
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x4317f2
push esi
call edi
jmp 0x4317f2
xor eax, eax
mov word [ebp - 0x420], ax
test esi, esi
je 0x4317f2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x58e5dc]
test al, 1
jne 0x431822
or eax, 1
mov dword [0x58e5dc], eax
mov ecx, 0x58e5d8
mov byte [ebp - 4], 0x19
call fcn.00442e80
push 0x53f780
call fcn.004998f2
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x58e5d8
call fcn.00443380
call fcn.0042fcf0
mov ecx, eax
call fcn.00488b70
call fcn.0042fdb0
mov ecx, eax
call fcn.00438f40
mov ecx, 0x58e54c
call fcn.004101d0
mov edi, dword [0x58a46c]
add edi, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x58e548]
test esi, esi
je 0x4318b0
cmp dword [esi + 4], 0
jle 0x43187e
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x58e548]
test esi, esi
je 0x4318b0
mov eax, dword [esi]
test eax, eax
je 0x431897
push eax
call fcn.004d3be7
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004994e9
add esp, 8
push edi
mov dword [0x58e548], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x58e544]
test esi, esi
je 0x431909
mov eax, dword [esi]
test eax, eax
je 0x4318e0
push eax
call fcn.004d3be7
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4318f7
push eax
call fcn.004d3be7
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.004994e9
add esp, 8
mov esi, dword [0x58e53c]
test esi, esi
je 0x43193b
cmp dword [esi], 0
je 0x43193b
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x431925
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x431918
mov esi, dword [0x58a4d4]
mov ecx, dword [0x58a4d8]
cmp esi, ecx
jae 0x43196a
nop dword [eax + eax]
mov eax, dword [esi]
test eax, eax
je 0x431963
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x58a4d8]
add esi, 4
cmp esi, ecx
jb 0x431950
mov ecx, 0x58e510
call fcn.00432da0
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x448]
call fcn.0040f110
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004994d8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x16
push eax
call fcn.00473b41
add esp, 4
mov byte [ebp - 4], 0x14
jmp 0x431505
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0xa
push eax
call fcn.00473b41
add esp, 4
mov byte [ebp - 4], 8
jmp 0x431505
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 5
push eax
call fcn.00473b41
add esp, 4
mov byte [ebp - 4], 3
jmp 0x431505
sub esp, 8
lea eax, [ebp - 0x42c]
mov ecx, esp
push eax
call fcn.0040a040
call fcn.0040c450
call fcn.00474b6c
int3