Function at 0x409590
Capabilities:
Create process on windows
Get common file path
Persist via run registry key
Query environment variable
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ec
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4ec], ecx
push 0x3f6
lea eax, [ebp - 0x484]
push eax
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 4]
call fcn.00408aa0
lea ecx, [ebp - 4]
call fcn.0040aa90
test eax, eax
je 0x409685
push 0x43636c
push 0x43638c
push 0x441210
lea ecx, [ebp - 0x488]
push ecx
call fcn.004083c0
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.004083c0
lea ecx, [ebp - 0x488]
call fcn.00403180
lea ecx, [ebp - 0x24]
call fcn.00403510
lea eax, [ebp - 0x4a4]
push eax
call fcn.00420560
add esp, 4
mov ecx, eax
call fcn.00401550
push eax
lea ecx, [ebp - 0x24]
call fcn.00402c60
lea ecx, [ebp - 0x4a4]
call fcn.00401130
push 1
lea ecx, [ebp - 0x24]
call fcn.00403550
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.00403550
push eax
push 0x436390
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.CSetupFinishPage::OnWizardFinish__start_YY.exe
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.00403180
lea ecx, [ebp - 0x20]
call fcn.00403180
push 0x3eb
lea ecx, [ebp - 0x4a8]
push ecx
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 8]
call fcn.00408aa0
lea ecx, [ebp - 8]
call fcn.0040aa90
test eax, eax
je 0x409770
push str.yylauncher.exe
push 0x436420
push 0x441210
lea edx, [ebp - 0x4ac]
push edx
call fcn.004083c0
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.004083c0
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 0x48]
call fcn.004020d0
lea ecx, [ebp - 0x4b0]
call fcn.00403180
lea ecx, [ebp - 0x4ac]
call fcn.00403180
lea ecx, [ebp - 0x28]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x409768
push 0x4364a8
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x48]
call fcn.00402110
shl eax, 1
push eax
lea ecx, [ebp - 0x48]
call fcn.00401550
push eax
push 1
push 0
push 0x436528
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x48]
call fcn.00401130
push 0x3f4
lea ecx, [ebp - 0x4b4]
push ecx
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 0x10]
call fcn.00408aa0
lea ecx, [ebp - 0x10]
call fcn.0040aa90
test eax, eax
je 0x409845
push 0x436424
push 0x4364a4
push str.4.13.0.4
push 0x436544
push 0x441210
lea edx, [ebp - 0x4b8]
push edx
call fcn.004083c0
push eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.004083c0
push eax
lea ecx, [ebp - 0x4c0]
push ecx
call fcn.004083c0
push eax
lea edx, [ebp - 0x50]
push edx
call fcn.004083c0
lea ecx, [ebp - 0x4c0]
call fcn.00403180
lea ecx, [ebp - 0x4bc]
call fcn.00403180
lea ecx, [ebp - 0x4b8]
call fcn.00403180
push 5
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.00403550
push eax
push 0x436548
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.CSetupFinishPage::OnWizardFinish__view_releaseNote.txt.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x50]
call fcn.00403180
push 0x3f5
lea eax, [ebp - 0x4c4]
push eax
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 0x1c]
call fcn.00408aa0
lea ecx, [ebp - 0x1c]
call fcn.0040aa90
test eax, eax
je 0x4099bf
push str.CSetupFinishPage::OnWizardFinish__collect_offical_website.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x58]
push ecx
push 6
mov edx, dword [ebp - 0x4ec]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x4099bf
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4099bf
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
call fcn.00404910
push 0
push 0
push 2
push 0
push 0
push 0x1f01ff
push 0x436640
push 0x436654
lea ecx, [ebp - 0x268]
push ecx
lea edx, [ebp - 0x4c8]
push edx
call fcn.004083c0
push eax
lea eax, [ebp - 0x4cc]
push eax
call fcn.004083c0
mov ecx, eax
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x264], eax
lea ecx, [ebp - 0x4cc]
call fcn.00403180
lea ecx, [ebp - 0x4c8]
call fcn.00403180
cmp dword [ebp - 0x264], 0xffffffff
je 0x4099aa
push 0x436658
lea ecx, [ebp - 0x270]
call fcn.00404910
lea ecx, [ebp - 0x270]
call fcn.00403530
shl eax, 1
mov dword [ebp - 0x26c], eax
push 0
lea ecx, [ebp - 0x274]
push ecx
mov edx, dword [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x270]
call fcn.00403550
push eax
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x270]
call fcn.00403180
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x268]
call fcn.00403180
call fcn.004106c0
mov ecx, eax
call fcn.00410760
movzx eax, al
test eax, eax
jne 0x4099ea
push 5
push 0
push 0
push str.http:__www.duowan.com__yy
push 0x436700
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.installstat.exe
push 0x43672c
push 0x436730
push 0x436744
push 0x441210
lea ecx, [ebp - 0x4d0]
push ecx
call fcn.004083c0
push eax
lea edx, [ebp - 0x4d4]
push edx
call fcn.004083c0
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.004083c0
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.004083c0
lea ecx, [ebp - 0x4d8]
call fcn.00403180
lea ecx, [ebp - 0x4d4]
call fcn.00403180
lea ecx, [ebp - 0x4d0]
call fcn.00403180
lea ecx, [ebp - 0xc]
call fcn.00403510
push 1
push 0x436748
push str.__s_di_
lea edx, [ebp - 0xc]
push edx
call fcn.0040a010
add esp, 0x10
push 0
mov ecx, 0x441210
call fcn.00403550
push eax
lea ecx, [ebp - 0xc]
call fcn.00403550
push eax
lea ecx, [ebp - 0x18]
call fcn.00403550
push eax
push 0x436774
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push str.CSetupFinishPage::OnWizardFinish__run__s_parameter_is__s.
call fcn.004010c0
add esp, 0xc
push str.yyrun.exe
push 0x436808
push 0x43680c
push 0x436820
push 0x441210
lea edx, [ebp - 0x4dc]
push edx
call fcn.004083c0
push eax
lea eax, [ebp - 0x4e0]
push eax
call fcn.004083c0
push eax
lea ecx, [ebp - 0x4e4]
push ecx
call fcn.004083c0
push eax
lea edx, [ebp - 0x14]
push edx
call fcn.004083c0
lea ecx, [ebp - 0x4e4]
call fcn.00403180
lea ecx, [ebp - 0x4e0]
call fcn.00403180
lea ecx, [ebp - 0x4dc]
call fcn.00403180
push 0
mov ecx, 0x441210
call fcn.00403550
push eax
push 0x436824
lea ecx, [ebp - 0x14]
call fcn.00403550
push eax
push 0x436830
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
push eax
push str.CSetupFinishPage::OnWizardFinish__run__s_parameter_is__reg.
call fcn.004010c0
add esp, 8
xor ecx, ecx
je 0x409bf2
xor edx, edx
mov word [ebp - 0x480], dx
push 0x206
push 0
lea eax, [ebp - 0x47e]
push eax
call fcn.00423050
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x480]
push ecx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [ebp - 0x480]
push edx
lea ecx, [ebp - 0x278]
call fcn.00404910
push str.installer_duowanyy.exe
lea ecx, [ebp - 0x278]
call fcn.004049b0
push 0
push 0
push 0x4368f4
lea ecx, [ebp - 0x278]
call fcn.00403550
push eax
push 0x436908
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.CSetupFinishPage::OnWizardFinish__run_installer_duowanyy.exe__360_.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x278]
call fcn.00403180
mov dword [ebp - 0x4e8], 0
lea ecx, [ebp - 0x14]
call fcn.00403180
lea ecx, [ebp - 0xc]
call fcn.00403180
lea ecx, [ebp - 0x18]
call fcn.00403180
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00422e00
mov esp, ebp
pop ebp
ret