Function at 0x4063e0
Capabilities:
Check if file exists
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49b028
mov eax, dword fs:[0]
push eax
sub esp, 0x3d8
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x3d0], eax
push ebx
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x3e8]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x34], edi
call fcn.00405c00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
test eax, eax
je 0x406443
mov edi, 1
mov dword [esp + 0x34], edi
call fcn.004038e0
push 0x517e14
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esi + 0x40]
push 0x517e14
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, ebx
je 0x406473
mov eax, dword [0x5185d0]
cmp eax, esi
jae 0x406473
inc eax
jmp 0x406475
xor eax, eax
mov dword [0x5185d0], eax
cmp edi, ebx
jne 0x406486
cmp eax, ebx
jne 0x40776c
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x144], eax
mov dword [esp + 0x140], ebx
mov word [esp + 0x130], cx
mov dword [esp + 0x3f0], ebx
xor edx, edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], ebx
mov word [esp + 0x60], dx
mov byte [esp + 0x3f0], 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
push str.compete
mov word [esi + 4], cx
call fcn.00402bd0
mov byte [esp + 0x40c], 2
mov byte [esp + 0x40c], 1
lea edi, [esp + 0xcc]
call fcn.0043aae0
mov byte [esp + 0x3f0], 3
lea edx, [esp + 0x14]
push edx
mov ecx, 0x4a5b20
call fcn.004087d0
mov byte [esp + 0x3f0], 4
push 0x25
lea ecx, [esp + 0x130]
call fcn.0040cda0
add esp, 4
test eax, eax
je 0x406819
mov dword [esp + 0x80], ebx
call fcn.00409f80
test eax, eax
je 0x40656c
lea eax, [esp + 0x78]
push eax
call fcn.0040a010
test eax, eax
je 0x40656c
lea ecx, [esp + 0x84]
push ecx
call dword [esp + 0x7c]
test eax, eax
je 0x40656c
mov dword [esp + 0x80], 1
mov byte [esp + 0x3f0], 5
push 8
push str.drivers
lea eax, [esp + 0x134]
call fcn.004037d0
lea edx, [esp + 0xd8]
push edx
mov edi, 0x4a5a68
lea ecx, [esp + 0x130]
call fcn.00402db0
add esp, 4
mov byte [esp + 0x3f0], 6
call fcn.00409f80
test eax, eax
lea eax, [esp + 0xd8]
je 0x4065c4
push 0xe
push 0x4a5a6c
jmp 0x4065cb
push 0xc
push str.360bprot.sys
call fcn.004037d0
cmp dword [esp + 0xf0], 8
mov edi, dword [esp + 0xdc]
jae 0x4065e8
lea edi, [esp + 0xdc]
lea ecx, [esp + 0x5c]
call fcn.0040cae0
test eax, eax
jne 0x406605
push 7
push str.0.0.0.0
lea esi, [esp + 0x64]
call fcn.00402bd0
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x80]
mov edi, 7
xor ecx, ecx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0x40c], 7
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push esp
push 0xb
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.360bprotver
mov word [esi + 4], ax
call fcn.00402bd0
mov byte [esp + 0x428], 8
mov byte [esp + 0x428], 6
lea ecx, [esp + 0xe8]
call fcn.0043b220
cmp dword [esp + 0x74], 8
mov eax, dword [esp + 0x60]
jae 0x406683
lea eax, [esp + 0x60]
push eax
push str.360bprotver:_s
lea edi, [esp + 0x1c]
call fcn.00408430
lea ecx, [esp + 0x9c]
push ecx
mov edi, 0x4a5ad0
lea ecx, [esp + 0x138]
call fcn.00402db0
add esp, 0xc
mov byte [esp + 0x3f0], 9
cmp dword [esp + 0xac], 8
mov edi, dword [esp + 0x98]
jae 0x4066ce
lea edi, [esp + 0x98]
lea ecx, [esp + 0x5c]
call fcn.0040cae0
test eax, eax
jne 0x4066eb
push 7
push str.0.0.0.0
lea esi, [esp + 0x64]
call fcn.00402bd0
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x80]
mov edi, 7
xor edx, edx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push ecx
mov word [eax + 4], dx
call fcn.00402a90
mov byte [esp + 0x40c], 0xa
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 0xb
xor edx, edx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.hookportver
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x428], 0xb
mov byte [esp + 0x428], 9
lea ecx, [esp + 0xe8]
call fcn.0043b220
cmp dword [esp + 0x74], 8
mov eax, dword [esp + 0x60]
jae 0x406769
lea eax, [esp + 0x60]
push eax
push str.hookportver:_s
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov byte [esp + 0x3f0], 6
mov esi, 8
cmp dword [esp + 0xac], esi
jb 0x4067a1
mov eax, dword [esp + 0x98]
push eax
call fcn.00471eaf
add esp, 4
mov edi, 7
xor ecx, ecx
mov dword [esp + 0xac], edi
mov dword [esp + 0xa8], ebx
mov word [esp + 0x98], cx
mov byte [esp + 0x3f0], 5
cmp dword [esp + 0xf0], esi
jb 0x4067df
mov edx, dword [esp + 0xdc]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0xf0], edi
mov dword [esp + 0xec], ebx
mov word [esp + 0xdc], ax
mov byte [esp + 0x3f0], 4
cmp dword [esp + 0x80], ebx
je 0x40681e
mov ecx, dword [esp + 0x84]
push ecx
call dword [esp + 0x80]
jmp 0x40681e
mov esi, 8
lea edx, [esp + 0x94]
push edx
call fcn.00405860
push eax
call fcn.00426590
mov byte [esp + 0x3f0], 0xc
push 0xffffffffffffffff
push ebx
push eax
lea eax, [esp + 0x68]
call fcn.00402a90
mov byte [esp + 0x3f0], 4
cmp dword [esp + 0xac], esi
jb 0x406867
mov eax, dword [esp + 0x98]
push eax
call fcn.00471eaf
add esp, 4
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0xb8], cx
mov edi, 7
push ebx
lea ecx, [esp + 0x80]
xor edx, edx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push ecx
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd0], ebx
mov word [eax + 4], dx
call fcn.00402a90
mov byte [esp + 0x40c], 0xd
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 6
xor edx, edx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.datver
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x428], 0xe
mov byte [esp + 0x428], 4
lea ecx, [esp + 0xe8]
call fcn.0043b220
cmp dword [esp + 0x74], 8
mov eax, dword [esp + 0x60]
jae 0x4068fd
lea eax, [esp + 0x60]
push eax
push str.datver:_s
lea edi, [esp + 0x1c]
call fcn.00408430
mov esi, 7
xor eax, eax
add esp, 8
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1cc], ebx
mov word [esp + 0x1bc], ax
mov byte [esp + 0x3f0], 0xf
xor ecx, ecx
mov dword [esp + 0x17c], esi
mov dword [esp + 0x178], ebx
mov word [esp + 0x168], cx
mov byte [esp + 0x3f0], 0x10
lea edi, [esp + 0x164]
call fcn.0040e270
test eax, eax
je 0x4069ec
cmp dword [esp + 0x17c], 8
mov edi, dword [esp + 0x168]
jae 0x406980
lea edi, [esp + 0x168]
lea ecx, [esp + 0x1b8]
call fcn.0040cae0
test eax, eax
je 0x4069ec
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1dc]
xor edx, edx
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], ebx
push ecx
mov word [eax + 4], dx
call fcn.00402a90
mov byte [esp + 0x40c], 0x11
sub esp, 0x1c
mov edx, str.brover
mov eax, esp
mov dword [esp + 0x54], esp
call fcn.004028a0
mov byte [esp + 0x428], 0x12
mov byte [esp + 0x428], 0x10
lea ecx, [esp + 0xe8]
call fcn.0043b220
xor edx, edx
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov word [esp + 0xf8], dx
mov byte [esp + 0x3f0], 0x13
lea ecx, [esp + 0xf4]
call fcn.0040ef40
test eax, eax
je 0x406cd2
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x118]
mov edi, 7
xor ecx, ecx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0x40c], 0x14
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], esp
push 3
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push 0x4a5b14
mov word [esi + 4], ax
call fcn.00402bd0
mov byte [esp + 0x428], 0x15
mov byte [esp + 0x428], 0x13
lea ecx, [esp + 0xe8]
call fcn.0043b220
cmp dword [esp + 0x10c], 8
mov eax, dword [esp + 0xf8]
jae 0x406aa7
lea eax, [esp + 0xf8]
push eax
push str.pid:_s
lea edi, [esp + 0x1c]
call fcn.00408430
sub esp, 0x14
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x118]
mov edi, 7
xor ecx, ecx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0x40c], 0x16
mov byte [esp + 0x40c], 0x13
call fcn.0040f030
add esp, 0x1c
cmp eax, ebx
je 0x406cd2
xor esi, esi
xor eax, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], ax
mov byte [esp + 0x3f0], 0x17
lea ecx, [esp + 0x78]
call fcn.0040de70
test eax, eax
je 0x406c56
lea ecx, [esp + 0x78]
push ecx
or ecx, 0xffffffff
lea edi, [esp + 0x20]
mov dword [esp + 0x20], 0x5c
call fcn.00407fb0
cmp eax, 0xffffffff
je 0x406c56
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x7c]
push ecx
mov ecx, eax
xor edx, edx
call fcn.00407d90
mov byte [esp + 0x3f0], 0x18
push 0xffffffffffffffff
push ebx
push eax
lea eax, [esp + 0x84]
call fcn.00402a90
mov byte [esp + 0x3f0], 0x17
lea esi, [esp + 0x40]
call fcn.00428ca0
lea edx, [esp + 0xd8]
push edx
mov edi, str.360secore.exe
lea ecx, [esp + 0x7c]
call fcn.00402db0
add esp, 4
mov byte [esp + 0x3f0], 0x19
lea eax, [esp + 0x94]
push eax
mov edi, 0x4a5f38
lea ecx, [esp + 0x7c]
call fcn.00402db0
add esp, 4
mov byte [esp + 0x3f0], 0x1a
cmp dword [esp + 0xac], 8
mov eax, dword [esp + 0x98]
jae 0x406bec
lea eax, [esp + 0x98]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
je 0x406c03
mov dword [esp + 0x18], 1
jmp 0x406c2a
cmp dword [esp + 0xf0], 8
mov eax, dword [esp + 0xdc]
jae 0x406c1b
lea eax, [esp + 0xdc]
push eax
call esi
test eax, eax
je 0x406c2a
mov dword [esp + 0x18], 2
mov byte [esp + 0x3f0], 0x19
lea esi, [esp + 0x94]
call fcn.00428ca0
mov byte [esp + 0x3f0], 0x17
lea esi, [esp + 0xd8]
call fcn.00428ca0
mov esi, dword [esp + 0x18]
sub esp, 0x1c
mov edx, 0x4a5f50
mov eax, esp
mov dword [esp + 0x34], esp
call fcn.004028a0
mov byte [esp + 0x40c], 0x1b
lea ecx, [esp + 0xcc]
push ecx
mov byte [esp + 0x410], 0x17
mov ecx, esi
call fcn.0043b320
push esi
push str.cef:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov byte [esp + 0x3f0], 0x13
cmp dword [esp + 0x90], 8
jb 0x406cb9
mov edx, dword [esp + 0x7c]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], ax
mov dword [esp + 0x1c], ebx
call fcn.004010d0
push eax
lea ecx, [esp + 0x114]
call fcn.00456e50
mov byte [esp + 0x3f0], 0x1c
call fcn.0041ff00
test eax, eax
je 0x406d14
push 2
push 0x4a5f6c
lea eax, [esp + 0x118]
mov dword [esp + 0x24], 1
call fcn.004037d0
mov eax, dword [esp + 0x124]
cmp eax, ebx
je 0x406dc8
dec eax
push eax
or eax, 0xffffffff
lea esi, [esp + 0x114]
call fcn.00402c80
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
mov edx, esi
mov edi, 7
xor ecx, ecx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0x40c], 0x1d
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x5c], esp
push 3
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push 0x4a5f74
mov word [esi + 4], ax
call fcn.00402bd0
mov byte [esp + 0x428], 0x1e
mov byte [esp + 0x428], 0x1c
lea ecx, [esp + 0xe8]
call fcn.0043b220
cmp dword [esp + 0x128], 8
mov eax, dword [esp + 0x114]
jae 0x406db6
lea eax, [esp + 0x114]
push eax
push str.799:_s
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
push 0x206
lea edx, [esp + 0x1da]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x1e0], cx
call fcn.00476ef0
add esp, 0xc
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.00401000
push 0x103
lea edi, [esp + 0x1d8]
call fcn.00431e70
test eax, eax
je 0x406e78
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
cmp esi, ebx
je 0x406e78
sub esp, 0x1c
mov edx, esi
mov eax, esp
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], esp
call fcn.004028a0
mov byte [esp + 0x40c], 0x1f
sub esp, 0x1c
mov edx, 0x4a5f90
mov eax, esp
mov dword [esp + 0x58], esp
call fcn.004028a0
mov byte [esp + 0x428], 0x20
mov byte [esp + 0x428], 0x1c
lea ecx, [esp + 0xe8]
call fcn.0043b220
push esi
push str.500:_s
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x18], ebx
jne 0x406f1f
push ebx
call fcn.0040f530
add esp, 4
mov esi, eax
sub esp, 0x1c
mov edx, 0x4a5fac
mov dword [esp + 0x3c], esp
mov eax, esp
cmp esi, ebx
je 0x406ee7
mov edi, 1
call fcn.004028a0
mov byte [esp + 0x40c], 0x21
lea ecx, [esp + 0xcc]
push ecx
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b320
push edi
push str.501:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406f31
call fcn.004028a0
mov byte [esp + 0x40c], 0x22
lea edx, [esp + 0xcc]
push edx
mov byte [esp + 0x410], 0x1c
mov ecx, ebx
call fcn.0043b320
push ebx
push str.501:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
jmp 0x406f39
push str.360se.exe
push esi
call fcn.0047221c
add esp, 8
test eax, eax
je 0x406f39
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x24], ebx
je 0x406f70
call fcn.0040eb60
test eax, eax
je 0x406f70
cmp dword [esp + 0x1c], ebx
jne 0x406f70
push ebx
push ebx
push ebx
push 0x407bb0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 1
jmp 0x406f74
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x1c]
push eax
push str.360qpesv
call fcn.00439040
add esp, 8
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0xc
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push str.qpesvrunning
test eax, eax
jne 0x406fdd
mov edi, dword [esp + 0x40]
xor ecx, ecx
mov word [esi + 4], cx
call fcn.00402bd0
mov byte [esp + 0x40c], 0x23
lea edx, [esp + 0xcc]
push edx
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b480
push edi
push str.qpesvrunning:_d
jmp 0x4070cb
xor eax, eax
mov edi, 1
mov word [esi + 4], ax
call fcn.00402bd0
mov byte [esp + 0x40c], 0x24
lea ecx, [esp + 0xcc]
push ecx
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b320
push edi
push str.qpesvrunning:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
call fcn.0041ff00
test eax, eax
jne 0x4070d7
call fcn.00405860
cmp byte [eax + 0x354], bl
je 0x4070d7
push 0x4a601c
push 0x4a6020
call fcn.00405860
mov ecx, eax
add ecx, 0x354
call fcn.00427ed0
test eax, eax
je 0x4070d7
call fcn.004393b0
sub esp, 0x1c
test eax, eax
mov edx, str.qpesvunins
mov dword [esp + 0x3c], esp
mov eax, esp
je 0x40709f
mov esi, 1
call fcn.004028a0
mov byte [esp + 0x40c], 0x25
lea edx, [esp + 0xcc]
push edx
mov byte [esp + 0x410], 0x1c
mov ecx, esi
call fcn.0043b320
push esi
jmp 0x4070c6
xor esi, esi
call fcn.004028a0
mov byte [esp + 0x40c], 0x26
lea eax, [esp + 0xcc]
push eax
mov byte [esp + 0x410], 0x1c
mov ecx, esi
call fcn.0043b320
push ebx
push str.qpesvunins:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov eax, 4
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
push str.bprot
push str.SYSTEMCurrentControlSetServices360bpsvc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], ebx
mov dword [esp + 0x54], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x407155
cmp dword [esp + 0x3c], ebx
jne 0x407155
sub esp, 0x1c
lea esi, [eax + 0xa]
mov edx, str.bprotrunning
mov eax, esp
mov dword [esp + 0x3c], esp
call fcn.004028a0
mov byte [esp + 0x40c], 0x27
lea ecx, [esp + 0xcc]
push ecx
mov byte [esp + 0x410], 0x1c
mov ecx, esi
call fcn.0043b320
push esi
jmp 0x4071e4
lea edx, [esp + 0x1c]
push edx
push str.360bprot
call fcn.00439040
add esp, 8
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0xc
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push str.bprotrunning
test eax, eax
jne 0x4071b4
mov edi, dword [esp + 0x40]
mov word [esi + 4], ax
call fcn.00402bd0
mov byte [esp + 0x40c], 0x28
lea ecx, [esp + 0xcc]
push ecx
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b480
push edi
jmp 0x4071e4
xor edx, edx
mov edi, 1
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x40c], 0x29
lea eax, [esp + 0xcc]
push eax
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b320
push edi
push str.bprotrunning:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
lea ecx, [esp + 0x38]
push ecx
push 0x4a6bbc
call fcn.0040e930
add esp, 8
test eax, eax
je 0x407269
mov edi, dword [esp + 0x38]
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 3
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x4a609c
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x40c], 0x2a
lea eax, [esp + 0xcc]
push eax
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b480
mov ecx, dword [esp + 0x38]
push ecx
push str.die:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
call fcn.0040eb60
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 4
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x4a59d0
test eax, eax
je 0x4072be
xor edx, edx
mov edi, 1
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x40c], 0x2b
lea eax, [esp + 0xcc]
push eax
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b320
push edi
jmp 0x4072eb
xor ecx, ecx
xor edi, edi
mov word [esi + 4], cx
call fcn.00402bd0
mov byte [esp + 0x40c], 0x2c
lea edx, [esp + 0xcc]
push edx
mov byte [esp + 0x410], 0x1c
mov ecx, edi
call fcn.0043b320
push ebx
push str.lock:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
cmp dword [0x5185d0], ebx
jne 0x407341
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x4a5b1c
mov byte [ecx + 4], bl
call fcn.00403290
mov byte [esp + 0x40c], 0x2d
mov byte [esp + 0x40c], 0x1c
lea esi, [esp + 0xcc]
call fcn.0043acf0
cmp dword [0x5120d0], ebx
je 0x407794
call fcn.00405860
cmp byte [eax + 0x354], bl
je 0x407384
push 0x4a60cc
push 0x4a6020
call fcn.00405860
mov ecx, eax
add ecx, 0x354
call fcn.00427ed0
test eax, eax
je 0x407384
mov dword [0x5185cc], 1
mov dword [0x5120d0], ebx
mov esi, dword [esp + 0x18]
cmp esi, ebx
je 0x407399
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 7
xor eax, eax
mov dword [esp + 0x160], edi
mov dword [esp + 0x15c], ebx
mov word [esp + 0x14c], ax
mov byte [esp + 0x3f0], 0x2e
lea ecx, [esp + 0x148]
call fcn.0041f9e0
test eax, eax
je 0x4073fd
cmp dword [esp + 0x160], 8
mov eax, dword [esp + 0x14c]
jae 0x4073e6
lea eax, [esp + 0x14c]
push eax
push 0x4a60d0
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov edi, 7
xor ecx, ecx
mov dword [esp + 0x1b4], edi
mov dword [esp + 0x1b0], ebx
mov word [esp + 0x1a0], cx
mov byte [esp + 0x3f0], 0x2f
lea ecx, [esp + 0x19c]
call fcn.0041fb30
test eax, eax
je 0x40745c
cmp dword [esp + 0x1b4], 8
mov eax, dword [esp + 0x1a0]
jae 0x407445
lea eax, [esp + 0x1a0]
push eax
push str.m2:_s
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov edi, 7
xor edx, edx
mov dword [esp + 0x198], edi
mov dword [esp + 0x194], ebx
mov word [esp + 0x184], dx
mov byte [esp + 0x3f0], 0x30
lea esi, [esp + 0x180]
call fcn.0040cbc0
test eax, eax
je 0x4074bb
cmp dword [esp + 0x198], 8
mov eax, dword [esp + 0x184]
jae 0x4074a4
lea eax, [esp + 0x184]
push eax
push str.ver:_s
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov edi, 7
mov eax, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x30]
push edx
push 0x4a59c8
push str.SYSTEMCurrentControlSetServices360bpsvc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x48], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x407513
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x407513
push eax
push str.ins_time:_d
lea edi, [esp + 0x1c]
call fcn.00408430
add esp, 8
mov edi, 7
cmp dword [esp + 0x34], ebx
je 0x40754d
call fcn.00405c00
push ecx
mov esi, eax
mov eax, esp
mov dword [esp + 0x24], esp
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.00408350
mov byte [esp + 0x3f4], 0x31
mov eax, dword [esi]
add eax, 4
mov byte [esp + 0x3f4], 0x30
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x3f0], 0x2f
mov esi, 8
cmp dword [esp + 0x198], esi
jb 0x407573
mov eax, dword [esp + 0x184]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0x198], edi
mov dword [esp + 0x194], ebx
mov word [esp + 0x184], cx
mov byte [esp + 0x3f0], 0x2e
cmp dword [esp + 0x1b4], esi
jb 0x4075ac
mov edx, dword [esp + 0x1a0]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x1b4], edi
mov dword [esp + 0x1b0], ebx
mov word [esp + 0x1a0], ax
mov byte [esp + 0x3f0], 0x1c
cmp dword [esp + 0x160], esi
jb 0x4075e5
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.00471eaf
add esp, 4
xor edx, edx
mov dword [esp + 0x160], edi
mov dword [esp + 0x15c], ebx
mov word [esp + 0x14c], dx
mov byte [esp + 0x3f0], 0x13
cmp dword [esp + 0x128], esi
jb 0x40761e
mov eax, dword [esp + 0x114]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0x128], edi
mov dword [esp + 0x124], ebx
mov word [esp + 0x114], cx
mov byte [esp + 0x3f0], 0x10
cmp dword [esp + 0x10c], esi
jb 0x407657
mov edx, dword [esp + 0xf8]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], ebx
mov word [esp + 0xf8], ax
mov byte [esp + 0x3f0], 0xf
cmp dword [esp + 0x17c], esi
jb 0x407690
mov ecx, dword [esp + 0x168]
push ecx
call fcn.00471eaf
add esp, 4
xor edx, edx
mov dword [esp + 0x17c], edi
mov dword [esp + 0x178], ebx
mov word [esp + 0x168], dx
mov byte [esp + 0x3f0], 4
cmp dword [esp + 0x1d0], esi
jb 0x4076c9
mov eax, dword [esp + 0x1bc]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0x1d0], edi
mov dword [esp + 0x1cc], ebx
mov word [esp + 0x1bc], cx
mov byte [esp + 0x3f0], 3
lea ecx, [esp + 0x14]
call fcn.00404e20
mov byte [esp + 0x3f0], 1
lea edx, [esp + 0xb0]
push edx
call fcn.0043ac50
mov byte [esp + 0x3f0], bl
cmp dword [esp + 0x74], esi
jb 0x407721
mov eax, dword [esp + 0x60]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov word [esp + 0x60], cx
mov dword [esp + 0x3f0], 0xffffffff
cmp dword [esp + 0x144], esi
jb 0x407754
mov edx, dword [esp + 0x130]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x144], edi
mov dword [esp + 0x140], ebx
mov word [esp + 0x130], ax
xor eax, eax
mov ecx, dword [esp + 0x3e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3d0]
xor ecx, esp
call fcn.00471eba
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0x24], ebx
je 0x40738a
cmp dword [0x5185cc], ebx
je 0x40738a
mov esi, dword [esp + 0x18]
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x4077c7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
call fcn.004089c0
jmp 0x40738e