Function at 0x10003645
Capabilities:
Delete file
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.100051ce
test eax, eax
pop ecx
je 0x10003ea6
cmp dword [0x10011fa8], 2
je 0x10003ea6
call fcn.1000523f
mov dword [ebp - 8], eax
mov eax, dword [0x10011d6c]
cmp eax, dword [0x1000d2c8]
je 0x10003730
mov esi, 0x1000d1f4
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x1000d1e4
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 7
mov esi, str.Mismatched_software_version
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
push 0xf
mov esi, 0x1000d188
pop ecx
lea edi, [ebp - 0x128]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xf
mov esi, 0x1000d148
pop ecx
lea edi, [ebp - 0xe8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x13
mov esi, str.Operation_system_version_NOT_supported__please_get_the_appropriate_version__
pop ecx
lea edi, [ebp - 0x1c0]
rep movsd dword es:[edi], dword [esi]
mov ax, word [0x10011fb0]
xor ebx, ebx
cmp ax, bx
movsb byte es:[edi], byte [esi]
jne 0x10003704
push dword [0x1000d2c4]
lea eax, [ebp - 0x40]
push 0x40
push eax
lea eax, [ebp - 0x128]
jmp 0x100037e4
push dword [0x1000d2c4]
cmp ax, 1
push 0x40
jne 0x10003721
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xe8]
jmp 0x100037e4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c0]
jmp 0x100037e4
cmp eax, 2
jne 0x10003805
push 0x10011f9c
call fcn.10009fc9
test eax, eax
pop ecx
jne 0x10003805
push 8
mov esi, 0x1000d0d4
pop edx
lea edi, [ebp - 0x84]
mov ecx, edx
push 6
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, edx
mov esi, 0x1000d0b0
lea edi, [ebp - 0xa8]
mov ax, word [0x10011fb0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop ecx
mov esi, str.User_Privilege_Limited_
lea edi, [ebp - 0x2c]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x1000d088
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x1000d078
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.User_Privilege
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp ax, bx
movsb byte es:[edi], byte [esi]
jne 0x100037c3
push dword [0x1000d2c4]
lea eax, [ebp - 0x40]
push 0x40
push eax
lea eax, [ebp - 0x84]
jmp 0x100037e4
push dword [0x1000d2c4]
cmp ax, 1
push 0x40
jne 0x100037dd
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xa8]
jmp 0x100037e4
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.10008e40
add esp, 0x14
cmp dword [0x10011fa8], 1
jne 0x10003ea6
call fcn.100054f8
jmp 0x10003ea6
mov eax, dword [section..data]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10007dab
pop ecx
lea eax, [ebp - 0xc]
pop ecx
push 1
push ecx
mov ecx, esp
push eax
call fcn.100042f1
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.100042f1
call fcn.10007cf7
add esp, 0xc
cmp eax, 1
jne 0x1000386f
xor ebx, ebx
push str.CdnUp
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x10003e96
push ebx
push ebx
push 0x659
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x10003e96
cmp eax, 4
jne 0x1000392f
push 5
mov esi, 0x1000d048
pop ecx
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 5
mov esi, 0x1000d030
pop ecx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 8
mov esi, str.Higher_Verions_has_been_installed_
pop ecx
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x1000d000
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x1000cff4
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Version_Notify
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ax, word [0x10011fb0]
xor ebx, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp ax, bx
movsb byte es:[edi], byte [esi]
jne 0x100038ed
push dword [0x1000d2c4]
lea eax, [ebp - 0x4c]
push 0x40
push eax
lea eax, [ebp - 0x7c]
jmp 0x1000390e
push dword [0x1000d2c4]
cmp ax, 1
push 0x40
jne 0x10003904
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
jmp 0x1000390e
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xa8]
push eax
push ebx
call fcn.10008e40
add esp, 0x14
cmp dword [0x10011fa8], 1
jne 0x10003e96
call fcn.100054f8
jmp 0x10003e96
push 0x40
xor ebx, ebx
pop edx
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x60f]
mov byte [ebp - 0x610], bl
mov byte [ebp - 0x304], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x303]
mov byte [ebp - 0x50c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x50b]
mov byte [ebp - 0x408], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x407]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x610]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10003a1e
lea eax, [ebp - 0x304]
push esi
push eax
lea eax, [ebp - 0x610]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x10003a1e
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x50c]
push eax
call fcn.1000a8f0
lea eax, [ebp - 0x50c]
push str.uninrest.exe
push eax
call fcn.1000a900
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea eax, [ebp - 0x50c]
push eax
call edi
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.1000a8f0
lea eax, [ebp - 0x408]
push str.uninrest.ini
push eax
call fcn.1000a900
add esp, 0x10
lea eax, [ebp - 0x408]
push eax
call edi
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.10002402
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10003a5d
push str.uninsrest
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 8], ebx
je 0x10003a5d
push dword [ebp + 8]
call edi
mov dword [ebp + 8], ebx
cmp dword [0x10011fa8], ebx
jne 0x10003b0e
mov eax, dword [section..data]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.1000507d
test eax, eax
pop ecx
je 0x10003aac
cmp dword [0x1000d2c4], 1
jne 0x10003a91
call fcn.10005109
test eax, eax
jne 0x10003aac
lea ecx, [ebp - 4]
call fcn.100025df
cmp dword [ebp + 8], ebx
je 0x10003e96
push dword [ebp + 8]
call edi
jmp 0x10003e93
lea ecx, [ebp - 4]
call fcn.100025df
cmp dword [0x10011fa8], ebx
jne 0x10003b0e
cmp dword [0x1000d2c4], 1
jne 0x10003b0e
lea ecx, [ebp - 0x30]
call fcn.10003f36
mov dword [ebp - 0x30], 0x1000b240
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x10011ed8
call fcn.10004139
mov eax, dword [0x10011ee0]
push ebx
push 0x10004173
push dword [ebp - 4]
push 0xc9
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
je 0x10003a99
call fcn.10005574
mov dword [ebp - 4], eax
call fcn.100084d1
cmp dword [ebp - 8], ebx
je 0x10003d25
cmp dword [ebp - 4], ebx
je 0x10003d25
cmp eax, ebx
jne 0x10003d25
call fcn.100052ee
call fcn.10005393
call fcn.10007ae9
push str.KwUnSelf
push str.Console
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xf003f
push str.SoftwareCNNICCdnClientConsole
push 0x80000001
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.10002402
test eax, eax
jne 0x10003bae
push str.EnableIntRes
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.EnableAutoMatch
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.EnableRestore
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 4], ebx
je 0x10003bae
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
push 0xf003f
push str.SOFTWAREMicrosoftInternet_ExplorerAdvancedOptionsCDNCLIENTIDNKW
push 0x80000002
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.10002402
test eax, eax
jne 0x10003c00
push str.RESOLUTION
lea ecx, [ebp - 8]
call fcn.10002440
push str.MATCH
lea ecx, [ebp - 8]
call fcn.10002440
push str.RESTORE
lea ecx, [ebp - 8]
call fcn.10002440
cmp dword [ebp - 8], ebx
je 0x10003c0d
push dword [ebp - 8]
call edi
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
je 0x10003c0d
push dword [ebp - 8]
call edi
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x10003c17
push dword [ebp - 4]
call edi
push 0x100123cc
call fcn.10007b59
push esi
mov edi, 0x100124d0
push ebx
push edi
call fcn.1000a550
add esp, 0x10
push esi
push edi
push 0x100123cc
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push esi
mov edi, 0x100128e0
push ebx
push edi
mov dword [0x10012afc], eax
call fcn.1000a550
add esp, 0xc
push esi
push edi
push 0x100127dc
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call fcn.100055cc
mov esi, eax
call fcn.10006b48
call fcn.10005e42
mov edi, eax
call fcn.10008131
call fcn.10008033
test eax, eax
je 0x10003c86
call fcn.10007f67
cmp dword [0x10011fa8], ebx
jne 0x10003cab
call fcn.10006407
mov dword [ebp - 4], eax
call fcn.1000660d
mov dword [ebp - 8], eax
call fcn.10007f62
cmp dword [0x10011fa8], ebx
je 0x10003cb4
cmp dword [0x10011fa8], 3
jne 0x10003cbc
call fcn.10006883
mov dword [ebp - 0x14], eax
cmp dword [0x10011fa8], ebx
jne 0x10003cdb
cmp esi, ebx
je 0x10003ce9
cmp edi, ebx
je 0x10003ce9
cmp dword [ebp - 4], ebx
je 0x10003ce9
cmp dword [ebp - 8], ebx
je 0x10003ce9
cmp dword [ebp - 0x14], ebx
jmp 0x10003ce1
cmp esi, ebx
je 0x10003ce9
cmp edi, ebx
mov dword [0x10011fac], ebx
jne 0x10003cf3
mov dword [0x10011fac], 1
call fcn.10006a99
call fcn.10008302
call fcn.10007288
call fcn.10007f12
call fcn.10005455
push eax
call fcn.100073c7
test eax, eax
pop ecx
jne 0x10003e85
call fcn.10007311
jmp 0x10003e85
push 6
mov esi, 0x1000cf38
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 6
mov esi, 0x1000cf1c
pop ecx
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 8
cmp dword [0x10011d6c], 0x3e7
movsb byte es:[edi], byte [esi]
pop edx
mov esi, str.Chinese_Navigation_Install_Program
mov ecx, edx
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, edx
mov esi, 0x1000ced4
lea edi, [ebp - 0x170]
push 0xf
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, edx
mov esi, 0x1000ceb0
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop ecx
mov esi, str.Initialization_failed__the_install_program_will_be_shut_down.
lea edi, [ebp - 0x200]
push 0x11
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, edx
mov esi, 0x1000ce4c
lea edi, [ebp - 0xd0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, edx
mov esi, 0x1000ce28
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop ecx
mov esi, 0x1000cde0
lea edi, [ebp - 0x1bc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
je 0x10003e27
cmp dword [0x10011fb4], ebx
je 0x10003e27
cmp eax, ebx
jne 0x10003e27
mov ax, word [0x10011fb0]
cmp ax, bx
jne 0x10003dfe
push dword [0x1000d2c4]
lea eax, [ebp - 0x30]
push 0x40
push eax
lea eax, [ebp - 0x170]
jmp 0x10003e6d
push dword [0x1000d2c4]
cmp ax, 1
push 0x40
jne 0x10003e18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x14c]
jmp 0x10003e6d
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x200]
jmp 0x10003e6d
mov ax, word [0x10011fb0]
cmp ax, bx
jne 0x10003e46
push dword [0x1000d2c4]
lea eax, [ebp - 0x30]
push 0x40
push eax
lea eax, [ebp - 0xd0]
jmp 0x10003e6d
push dword [0x1000d2c4]
cmp ax, 1
push 0x40
jne 0x10003e60
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x110]
jmp 0x10003e6d
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push ebx
call fcn.10008e40
add esp, 0x14
cmp dword [0x10011fa8], 1
jne 0x10003e85
call fcn.100054f8
cmp dword [ebp + 8], ebx
je 0x10003e96
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
lea ecx, [ebp - 0xc]
call fcn.100025df
lea ecx, [ebp - 0x10]
call fcn.100025df
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4