Function at 0x42f6a0
Capabilities:
Accept command line arguments
Check os version
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527b4e
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
push 6
push 0
mov dword [ebp - 0x43c], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 8
push eax
mov dword [ebp - 0x424], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x542bec
push 0
call fcn.004dfbd5
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x542bf0
call fcn.0043a240
add esp, 8
mov ecx, 0x591630
push 0
push dword [0x58d56c]
push 0
call fcn.0042e460
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
call fcn.0041f3a0
test eax, eax
je 0x42f797
mov eax, dword [ebp - 0x438]
test eax, eax
je 0x42f8c6
push eax
jmp 0x42f8c0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004b2720
mov esi, dword [ebp - 0x438]
lea eax, [ebp - 0x42c]
add esp, 0xc
mov dword [ebp - 0x42c], 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.oem_f
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42f8bb
mov eax, dword [ebp - 0x424]
cmp eax, 1
je 0x42f7fc
cmp eax, 2
jne 0x42f8bb
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42f8b2
test al, 1
jne 0x42f8bb
shr eax, 1
cmp word [ebp + eax*2 - 0x422], 0
jne 0x42f8bb
mov ax, word [ebp - 0x420]
cmp ax, 0x31
jne 0x42f8bb
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42f841
push esi
call edi
push 0x20206
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
call fcn.0041f3a0
test eax, eax
je 0x42f88c
mov eax, dword [ebp - 0x438]
test eax, eax
je 0x42f8c6
push eax
call edi
jmp 0x42f8c6
mov esi, dword [ebp - 0x438]
push 4
push 0x542608
push 1
push 0
push str.oem_f
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x42f8c6
push esi
call edi
jmp 0x42f8c6
xor eax, eax
mov word [ebp - 0x420], ax
test esi, esi
je 0x42f8c6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x440]
call fcn.0040da80
mov dword [ebp - 4], 0
call fcn.0042e140
mov ecx, eax
call fcn.00487b40
mov eax, dword [0x5916f8]
test al, 1
jne 0x42f914
or eax, 1
mov dword [0x5916f8], eax
mov ecx, 0x5916f4
mov byte [ebp - 4], 1
call fcn.00441700
push 0x5387b0
call fcn.00498abc
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x5916f4
call fcn.00441750
push ebx
call fcn.0042e030
mov ecx, eax
call fcn.00422c90
push ebx
push str.lpstrCmdLine_s
call fcn.0043a240
add esp, 8
call fcn.0042e030
mov ecx, eax
call fcn.004242c0
push eax
call fcn.004410a0
mov ecx, 0x59166c
call fcn.0040e530
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test eax, eax
jne 0x42f981
push str.CheckSingleInstance_failed__exit
call fcn.0043a240
add esp, 4
push 0
push 0
push 0x542c7c
push 0
call fcn.004410b0
jmp 0x42fe03
call fcn.0042d770
test eax, eax
jne 0x42f99c
push eax
push eax
push 0x542c98
push eax
call fcn.004410b0
jmp 0x42fe03
call fcn.0042e030
mov ecx, eax
call fcn.00422730
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.00417730
push str.bizhi
call fcn.0041dbd0
mov ecx, eax
call fcn.004177f0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b2720
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x58d56c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.004176a0
mov edx, dword [0x5916f0]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test edx, edx
jne 0x42fa6c
push 0x588310
call ebx
cmp dword [0x5916f0], 0
jne 0x42fa53
push 0x1c
call fcn.004436d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x424], esi
test esi, esi
je 0x42fa4b
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call edi
jmp 0x42fa4d
xor esi, esi
mov dword [0x5916f0], esi
push 0x588310
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x5916f0]
test edx, edx
jne 0x42fa6c
xor ecx, ecx
jmp 0x42faca
mov ecx, dword [0x5916ec]
test ecx, ecx
jne 0x42faca
mov eax, dword [edx]
push edx
call dword [eax]
cmp dword [0x5916ec], 0
jne 0x42fab9
push 0x64
call fcn.004436d0
add esp, 4
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x42faa7
mov ecx, eax
call fcn.00421cf0
mov ecx, eax
jmp 0x42faa9
xor ecx, ecx
mov byte [ebp - 4], 0
xchg dword [ebp - 0x424], eax
mov dword [0x5916ec], ecx
mov eax, dword [0x5916f0]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, dword [0x5916ec]
call fcn.004243a0
sub esp, 0x28
test eax, eax
mov eax, esp
mov dword [ebp - 0x42c], esp
mov dword [eax + 0x24], 0
je 0x42fbc0
mov ecx, dword [0x58cf54]
mov byte [ebp - 4], 3
test ecx, ecx
jne 0x42fb56
push 0x587e74
call ebx
cmp dword [0x58cf54], 0
jne 0x42fb33
push 0x1c
call fcn.004436d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x424], esi
test esi, esi
je 0x42fb2b
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call edi
jmp 0x42fb2d
xor esi, esi
mov dword [0x58cf54], esi
push 0x587e74
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x58cf54]
test ecx, ecx
jne 0x42fb56
xor eax, eax
push eax
push eax
push str.update_1
jmp 0x42fc88
mov eax, dword [0x58cf50]
test eax, eax
jne 0x42fbb2
mov eax, dword [ecx]
push ecx
call dword [eax]
cmp dword [0x58cf50], 0
jne 0x42fba2
push 0x20
call fcn.004436d0
add esp, 4
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x42fb90
mov ecx, eax
call fcn.00415ef0
mov ecx, eax
jmp 0x42fb92
xor ecx, ecx
mov byte [ebp - 4], 3
xchg dword [ebp - 0x424], eax
mov dword [0x58cf50], ecx
mov eax, dword [0x58cf54]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [0x58cf50]
push 0
push 0
push str.update_1
jmp 0x42fc88
mov ecx, dword [0x58cf54]
mov byte [ebp - 4], 5
test ecx, ecx
jne 0x42fc23
push 0x587e74
call ebx
cmp dword [0x58cf54], 0
jne 0x42fc0a
push 0x1c
call fcn.004436d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x424], esi
test esi, esi
je 0x42fc02
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call edi
jmp 0x42fc04
xor esi, esi
mov dword [0x58cf54], esi
push 0x587e74
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x58cf54]
test ecx, ecx
jne 0x42fc23
xor eax, eax
jmp 0x42fc7f
mov eax, dword [0x58cf50]
test eax, eax
jne 0x42fc7f
mov eax, dword [ecx]
push ecx
call dword [eax]
cmp dword [0x58cf50], 0
jne 0x42fc6f
push 0x20
call fcn.004436d0
add esp, 4
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x42fc5d
mov ecx, eax
call fcn.00415ef0
mov ecx, eax
jmp 0x42fc5f
xor ecx, ecx
mov byte [ebp - 4], 5
xchg dword [ebp - 0x424], eax
mov dword [0x58cf50], ecx
mov eax, dword [0x58cf54]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [0x58cf50]
push 0
push 0
push str.install_1
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00417290
call fcn.0042e580
test eax, eax
jne 0x42fcb6
mov ecx, 0x59166c
call fcn.0040eb80
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42fe03
push 0x110
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0x114
push 0
push eax
call fcn.004b2720
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jae 0x42fdb8
call fcn.0042e030
mov ecx, eax
call fcn.004242c0
test eax, eax
jne 0x42fe03
lea ecx, [ebp - 0x47c]
call fcn.00441d50
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
mov eax, dword [ebp - 0x468]
test eax, eax
jne 0x42fd48
call fcn.0046d8f2
mov dword [ebp - 0x468], eax
test eax, eax
jne 0x42fd48
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x47c]
call fcn.00441e20
jmp 0x42fe03
push 0
push 0
push eax
call fcn.0046d9f4
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x474], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x587084
mov dword [ebp - 0x470], eax
call ebx
mov eax, dword [0x58709c]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x474]
push 0x587084
mov dword [0x58709c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x431250
push esi
push 0xf2
push dword [0x59401c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [ebp - 0x47c]
call fcn.00441e20
jmp 0x42fe03
call fcn.0042ed40
test eax, eax
jne 0x42fdf2
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x43c], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.install_file_fail
mov byte [ebp - 4], 7
call fcn.0041dbd0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00417290
jmp 0x42fe03
push dword [ebp + 0x14]
push dword [ebp - 0x43c]
call fcn.00430dd0
add esp, 8
mov eax, dword [0x5916f8]
test al, 1
jne 0x42fe33
or eax, 1
mov dword [0x5916f8], eax
mov ecx, 0x5916f4
mov byte [ebp - 4], 8
call fcn.00441700
push 0x5387b0
call fcn.00498abc
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x5916f4
call fcn.00441c00
call fcn.0042e140
mov ecx, eax
call fcn.00487d10
call fcn.0042e250
mov ecx, eax
call fcn.004377e0
mov ecx, 0x59166c
call fcn.0040eb80
mov edi, dword [0x58d58c]
add edi, 0x10
push edi
call ebx
mov esi, dword [0x591668]
test esi, esi
je 0x42febd
cmp dword [esi + 4], 0
jle 0x42fe8b
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x591668]
test esi, esi
je 0x42febd
mov eax, dword [esi]
test eax, eax
je 0x42fea4
push eax
call fcn.004cdd77
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004986b3
add esp, 8
push edi
mov dword [0x591668], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x591664]
test esi, esi
je 0x42ff16
mov eax, dword [esi]
test eax, eax
je 0x42feed
push eax
call fcn.004cdd77
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x42ff04
push eax
call fcn.004cdd77
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.004986b3
add esp, 8
mov esi, dword [0x59165c]
test esi, esi
je 0x42ff48
cmp dword [esi], 0
je 0x42ff48
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x42ff32
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x42ff25
mov esi, dword [0x58d5f4]
mov ecx, dword [0x58d5f8]
cmp esi, ecx
jae 0x42ff72
mov eax, dword [esi]
test eax, eax
je 0x42ff6b
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x58d5f8]
add esi, 4
cmp esi, ecx
jb 0x42ff58
mov ecx, 0x591630
call fcn.004313b0
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x440]
call fcn.0040dac0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret