Function at 0x4a2686
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0x4c0
mov eax, 0x4e8894
call fcn.004b5417
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x444], edi
cmp dword [ebp + 8], ebx
jne 0x4a30f1
mov eax, dword [ebp + 0xc]
mov ecx, 0x138f
cmp eax, ecx
ja 0x4a2d61
je 0x4a2d22
mov ecx, eax
sub ecx, 8
je 0x4a2d14
sub ecx, 0x1380
je 0x4a2846
dec ecx
je 0x4a277c
dec ecx
je 0x4a2760
sub ecx, 4
jne 0x4a2d90
push str.license_link
lea eax, [ebp - 0x468]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
mov dword [ebp - 4], 0xa
mov ecx, eax
call fcn.0040c8a0
push eax
lea ecx, [ebp - 0x43c]
call fcn.0042b420
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x468]
call fcn.0040d610
cmp dword [ebp - 0x424], 8
mov eax, dword [ebp - 0x438]
jae 0x4a273f
lea eax, [ebp - 0x438]
push 9
push eax
call fcn.0045f557
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040d590
jmp 0x4a30f1
xor eax, eax
cmp dword [esi + 0x338], ebx
lea ecx, [esi + 0x2bc]
setne al
push eax
call fcn.0047e2c3
jmp 0x4a30f1
lea edi, [esi + 0xa4]
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a30f1
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a27b5
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
call fcn.00469dee
add eax, 0x1a4
jmp 0x4a282e
lea eax, [ebp - 0x430]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp - 0x428]
sub edi, dword [ebp - 0x430]
push 0xffffffffffffffff
push 0x62
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x430]
add edi, eax
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x424]
add dword [ebp - 0x490], eax
mov dword [ebp - 0x498], eax
push 0x54
lea eax, [ebp - 0x49c]
push eax
push ebx
lea ecx, [esi + 0xa4]
mov dword [ebp - 0x494], edi
call fcn.00467d65
push ebx
push ebx
call fcn.00469dee
add eax, 0x1c4
push eax
lea ecx, [esi + 0x714]
call fcn.0049e98f
mov ecx, esi
call fcn.0049e9cd
jmp 0x4a30f1
mov ecx, esi
call fcn.004a1ffd
test al, al
je 0x4a2d00
mov ecx, esi
call fcn.004a20a6
test al, al
je 0x4a2d00
lea edi, [esi + 0xa0]
push 1
mov ecx, edi
call fcn.0047f1a7
cmp dword [esi + 0x1e0], ebx
je 0x4a28e3
cmp byte [0x53fe3c], bl
je 0x4a2896
push ebx
push ebx
mov ecx, esi
call fcn.004a098f
push str.MainDlg528
jmp 0x4a2d05
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x4a28cd
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a28cd
mov eax, dword [esi + 4]
push eax
push 0x1389
push 0x111
push eax
call edi
push ebx
push ebx
push 0x5f5
push dword [esi + 4]
call edi
push str.MainDlg537
jmp 0x4a2d05
mov eax, dword [esi + 0x3d8]
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
cmp byte [esi + 0x98], bl
jne 0x4a28fe
cmp eax, ebx
je 0x4a2903
mov dword [0x536610], eax
cmp byte [0x53fe3c], bl
je 0x4a2984
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x484]
mov edi, 0x53fda0
push eax
mov ecx, edi
call fcn.0046fad7
mov dword [ebp - 4], ebx
push dword [eax]
call fcn.0043ee36
neg al
sbb al, al
inc al
pop ecx
mov byte [ebp - 0x43d], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a2974
push 0x72
push ebx
mov ecx, esi
call fcn.004a098f
push str.MainDlg557
mov ecx, 0x53ff20
call fcn.00428d50
jmp 0x4a30f1
push 0xa
push dword [esi + 0x664]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4a29b8
lea eax, [ebp - 0x48c]
push eax
mov ecx, edi
call fcn.0047cdb4
mov dword [ebp - 4], 1
mov eax, dword [eax]
push ebx
mov edi, 0x53fda0
push eax
mov ecx, edi
call fcn.0048b477
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.0040d610
lea eax, [ebp - 0x478]
push eax
mov ecx, edi
call fcn.0046fad7
mov dword [ebp - 4], 2
push dword [eax]
call fcn.0049ebcb
neg al
sbb al, al
inc al
pop ecx
mov byte [ebp - 0x43d], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a2b71
cmp byte [0x53fe3c], bl
je 0x4a2b06
push str.NEED_REBOOT
lea eax, [ebp - 0x458]
push eax
mov ecx, edi
call fcn.0047d67a
mov dword [ebp - 4], 3
mov eax, dword [eax]
push ebx
push 1
push eax
push 0x50243c
mov ecx, edi
call fcn.0047d611
push eax
push ebx
call fcn.0047f037
add esp, 0x14
dec eax
neg eax
sbb al, al
inc al
mov byte [ebp - 0x43d], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a2ae9
push 0x104
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.__TSinstall
cmp dword [0x53fedc], ebx
jne 0x4a2a8b
mov eax, 0x50ea8c
push eax
push str.post
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push str.__s____s_s
push eax
call fcn.0046783d
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push str.360ts
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
push 2
push 1
call fcn.0049e745
add esp, 0xc
jmp 0x4a2b67
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x4a2b67
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
push str.ERROR_NOTWRITEABLE
lea eax, [ebp - 0x47c]
push eax
mov ecx, edi
call fcn.0047d67a
mov dword [ebp - 4], 4
mov eax, dword [eax]
push ebx
push ebx
push eax
push 0x50243c
mov ecx, edi
call fcn.0047d611
push eax
push dword [esi + 4]
call fcn.0047f037
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.0040d610
push str.MainDlg598
jmp 0x4a2d05
push str.MainDlg603
mov ecx, 0x53ff20
mov dword [esi + 0x9c], 1
call fcn.00444b0f
lea eax, [ebp - 0x460]
push eax
mov ecx, edi
call fcn.0046fad7
mov dword [ebp - 4], 5
push dword [eax]
push dword [esi + 4]
call fcn.0048dc12
mov ecx, eax
call fcn.0049b1a5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x460]
call fcn.0040d610
call fcn.0048dc12
mov eax, dword [eax + 0x84]
push ebx
lea ecx, [esi + 0x25c]
mov dword [esi + 0x710], eax
call fcn.0047e2c3
push ebx
lea ecx, [esi + 0x2bc]
call fcn.00476835
push 1
lea ecx, [esi + 0x564]
call fcn.00476835
push ebx
lea ecx, [esi + 0x3ac]
call fcn.00476835
push ebx
lea ecx, [esi + 0x3f8]
call fcn.00476835
push ebx
cmp byte [0x53fe3c], bl
je 0x4a2c29
lea ecx, [esi + 0x30c]
call fcn.00476835
lea ecx, [esi + 0x358]
jmp 0x4a2c77
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
lea ecx, [esi + 0x714]
call fcn.00476835
push ebx
lea ecx, [esi + 0x76c]
call fcn.00476835
push ebx
lea ecx, [esi + 0x5b8]
call fcn.00476835
push ebx
lea ecx, [esi + 0x60c]
call fcn.00476835
push ebx
lea ecx, [esi + 0x44c]
call fcn.00476835
lea ecx, [esi + 0x498]
push ebx
call fcn.00476835
push 0xffffffffffffffff
push 0x110
lea edi, [esi + 0x4ec]
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
push eax
push ebx
mov ecx, edi
call fcn.00476e98
push 1
mov ecx, edi
call fcn.00476aca
push 0xffffffffffffffff
push 0x16e
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
push 0xffffffffffffffff
push 0x228
mov edi, eax
call fcn.0046894f
mov ecx, eax
call fcn.00467dc7
push 2
push edi
push eax
push ebx
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x4a30f1
push str.MainDlg518
mov ecx, 0x53ff20
call fcn.00444b0f
jmp 0x4a30f1
push ebx
push ebx
mov ecx, esi
call fcn.004a098f
jmp 0x4a30f1
push str.privacy_link
lea eax, [ebp - 0x488]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
mov dword [ebp - 4], 0xd
mov ecx, eax
call fcn.0040c8a0
push eax
lea ecx, [ebp - 0x43c]
call fcn.0042b420
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x488]
jmp 0x4a2725
mov ecx, eax
sub ecx, 0x1390
je 0x4a2f0f
sub ecx, 4
je 0x4a2f03
dec ecx
je 0x4a2ef0
sub ecx, 3
je 0x4a2e89
sub ecx, 0xec67
je 0x4a2e0c
add eax, 0xffffd8f0
push eax
lea eax, [ebp - 0x444]
mov edi, 0x53fda0
push eax
mov ecx, edi
call fcn.0049f834
mov dword [ebp - 4], 0x15
mov eax, dword [ebp - 0x444]
cmp dword [eax - 0xc], ebx
je 0x4a2df8
push eax
mov ecx, edi
call fcn.004a0b8d
cmp byte [0x53fe3f], bl
jne 0x4a2df8
lea eax, [ebp - 0x450]
push eax
mov ecx, edi
call fcn.00484bb5
mov byte [ebp - 4], 0x16
mov eax, dword [eax]
push 1
push eax
mov ecx, esi
call fcn.004a16fe
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x450]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
call fcn.0040d610
jmp 0x4a30f1
shr edi, 0x10
cmp di, bx
jbe 0x4a30f1
lea eax, [ebp - 0x430]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
movzx eax, word [ebp - 0x444]
mov dword [ebp - 0x448], eax
movzx eax, di
fild dword [ebp - 0x448]
mov dword [ebp - 0x448], eax
fild dword [ebp - 0x448]
fdivp st(1)
fmul qword [0x4f8e48]
call fcn.004b6356
push eax
lea ecx, [esi + 0x4ec]
call fcn.00476a7f
cmp word [ebp - 0x444], di
jne 0x4a30f1
push ebx
push 0xc8
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4a30f1
push str.privacy_link
lea eax, [ebp - 0x470]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
mov dword [ebp - 4], 0x10
push str.cloudanalysis
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0x11
mov ecx, eax
call fcn.0040c8a0
push eax
lea ecx, [ebp - 0x43c]
call fcn.0042b420
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x480]
call fcn.0040d610
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x470]
jmp 0x4a2725
cmp dword [esi + 0x478], ebx
setne al
mov byte [0x53fe68], al
jmp 0x4a30f1
mov byte [esi + 0x98], 1
jmp 0x4a30f1
cmp byte [0x53fe3f], bl
jne 0x4a30f1
lea eax, [ebp - 0x430]
push eax
lea ecx, [esi + 0x76c]
call fcn.0047b182
lea edi, [esi + 4]
lea eax, [ebp - 0x430]
push eax
mov ecx, edi
mov dword [ebp - 0x46c], edi
call fcn.0048575e
push 0x2c
lea eax, [ebp - 0x4c8]
push ebx
push eax
call fcn.004b47e0
mov eax, 0x100
add esp, 0xc
mov dword [ebp - 0x4cc], 0x30
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
call fcn.0043a60d
mov byte [ebp - 0x449], al
mov dword [ebp - 0x444], ebx
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x444]
call fcn.0049e7f0
mov esi, dword [0x53fdd0]
sub esi, dword [0x53fdcc]
mov dword [ebp - 0x448], ebx
sar esi, 2
cmp esi, ebx
jle 0x4a30be
mov edi, 0x53fda0
push dword [ebp - 0x448]
lea eax, [ebp - 0x474]
push eax
mov ecx, edi
call fcn.004a0d1f
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov ecx, dword [ebp - 0x448]
push eax
add ecx, 0x2710
push ecx
push ebx
push dword [ebp - 0x444]
call dword [sym.imp.USER32.dll_AppendMenuW]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x474]
call fcn.0040d610
lea eax, [ebp - 0x464]
push eax
mov ecx, edi
call fcn.00484bb5
mov dword [ebp - 0x454], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x448]
lea eax, [ebp - 0x45c]
push eax
mov ecx, edi
call fcn.0049f834
mov byte [ebp - 4], 9
push dword [ebp - 0x454]
push eax
call fcn.0043f9fa
pop ecx
pop ecx
mov byte [ebp - 0x43d], al
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x45c]
call fcn.0040d610
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x464]
call fcn.0040d610
cmp byte [ebp - 0x43d], bl
je 0x4a307e
mov eax, dword [ebp - 0x448]
push 8
add eax, 0x2710
push eax
push dword [ebp - 0x444]
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp byte [ebp - 0x449], bl
je 0x4a30a6
lea eax, [ebp - 0x4cc]
push eax
mov eax, dword [ebp - 0x448]
push ebx
add eax, 0x2710
push eax
push dword [ebp - 0x444]
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
inc dword [ebp - 0x448]
cmp dword [ebp - 0x448], esi
jl 0x4a2fb6
mov edi, dword [ebp - 0x46c]
push ebx
push dword [edi]
lea ecx, [ebp - 0x444]
push dword [ebp - 0x424]
push dword [ebp - 0x430]
push 2
call fcn.0049eada
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x444], ebx
je 0x4a30f1
lea ecx, [ebp - 0x444]
call fcn.0049e832
call fcn.004b549a
ret 0xc