Function at 0x401110
Capabilities:
Check os version
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0xa44
mov ecx, 0x41
xor eax, eax
push esi
push edi
mov edi, str.C:_temp_nsj1F.tmp_
push 0x104
push str.C:_temp_nsj1F.tmp_
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dl, byte [eax + str.C:_temp_nsj1F.tmp_]
lea ecx, [eax + str.C:_temp_nsj1F.tmp_]
cmp dl, 0x5c
je 0x40115b
mov edx, eax
dec eax
test edx, edx
jle 0x40115b
mov byte [ecx], 0
mov dl, byte [ecx - 1]
dec ecx
cmp dl, 0x5c
jne 0x401148
mov edi, dword [esp + 0xa58]
mov esi, str.setup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40118d
test cl, cl
je 0x401189
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40118d
add eax, 2
add esi, 2
test cl, cl
jne 0x401169
xor eax, eax
jmp 0x401192
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4011b5
call fcn.00401990
call fcn.00401950
call fcn.004020e0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401368
mov esi, 0x40d280
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4011e0
test cl, cl
je 0x4011dc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4011e0
add eax, 2
add esi, 2
test cl, cl
jne 0x4011bc
xor eax, eax
jmp 0x4011e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40122b
mov ecx, 0x82
lea edi, [esp + 0x11c]
rep stosd dword es:[edi], eax
push str.C:_temp_nsj1F.tmp_
lea eax, [esp + 0x120]
push str._sQvodPlayer.exe
push eax
call fcn.0040362b
lea ecx, [esp + 0x128]
push ecx
call fcn.00401980
add esp, 0x10
xor eax, eax
pop edi
pop esi
add esp, 0xa44
ret 0x10
mov esi, 0x40d268
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401256
test cl, cl
je 0x401252
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401256
add eax, 2
add esi, 2
test cl, cl
jne 0x401232
xor eax, eax
jmp 0x40125b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401295
call fcn.00401990
push 1
call fcn.00401c60
add esp, 4
call fcn.00401e40
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004020e0
call fcn.00402450
pop edi
xor eax, eax
pop esi
add esp, 0xa44
ret 0x10
mov esi, str.resetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4012c0
test cl, cl
je 0x4012bc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4012c0
add eax, 2
add esi, 2
test cl, cl
jne 0x40129c
xor eax, eax
jmp 0x4012c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40130c
call fcn.00401990
push 1
call fcn.00401c60
add esp, 4
call fcn.00401e40
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004020e0
push str.C:_temp_nsj1F.tmp_
call fcn.00402130
add esp, 4
call fcn.00402450
pop edi
xor eax, eax
pop esi
add esp, 0xa44
ret 0x10
mov esi, str.nbsetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401337
test cl, cl
je 0x401333
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401337
add eax, 2
add esi, 2
test cl, cl
jne 0x401313
xor eax, eax
jmp 0x40133c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401385
call fcn.00401e40
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push 1
call fcn.00401c60
add esp, 4
call fcn.004020e0
push 0x3e8
call esi
push str.C:_temp_nsj1F.tmp_
call fcn.00402130
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0xa44
ret 0x10
mov esi, str.nbrun
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4013b0
test cl, cl
je 0x4013ac
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4013b0
add eax, 2
add esi, 2
test cl, cl
jne 0x40138c
xor eax, eax
jmp 0x4013b5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4013d1
push eax
push 1
call fcn.00401e90
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0xa44
ret 0x10
mov esi, str.setupdate
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4013fc
test cl, cl
je 0x4013f8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4013fc
add eax, 2
add esi, 2
test cl, cl
jne 0x4013d8
xor eax, eax
jmp 0x401401
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401417
call fcn.00401a00
pop edi
xor eax, eax
pop esi
add esp, 0xa44
ret 0x10
mov esi, str.Google
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401442
test cl, cl
je 0x40143e
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401442
add eax, 2
add esi, 2
test cl, cl
jne 0x40141e
xor eax, eax
jmp 0x401447
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40158d
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push str.C:_temp_nsj1F.tmp_
lea eax, [esp + 0x1c]
push str._sgtapi_signed.dll
push eax
call fcn.0040362b
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov esi, 1
test edi, edi
mov dword [esp + 8], 0
je 0x4014b4
push str.ToolbarCompatibilityCheck
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4014ad
lea edx, [esp + 8]
push edx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push 0x40d208
push eax
call fcn.0040362b
mov edi, str.google.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.C:_temp_nsj1F.tmp_
mov esi, edi
mov edx, ecx
mov edi, str.C:_temp_nsj1F.tmp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.00401000
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push str.check
push str.GOOGLE
call fcn.004010e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 8]
push ecx
push 0x40d208
push edx
call fcn.0040362b
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push str.checkerr
push str.GOOGLE
call fcn.004010e0
mov dword [esp + 0x10], 0x40a168
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401937
push eax
call fcn.00403612
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0xa44
ret 0x10
mov esi, str.WriteIni
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4015b8
test cl, cl
je 0x4015b4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4015b8
add eax, 2
add esi, 2
test cl, cl
jne 0x401594
xor eax, eax
jmp 0x4015bd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4018e5
mov ecx, 0x82
lea edi, [esp + 0x11c]
rep stosd dword es:[edi], eax
push str.C:_temp_nsj1F.tmp_
lea eax, [esp + 0x120]
push str._sqvod1.ini
push eax
call fcn.0040362b
add esp, 0xc
lea ecx, [esp + 0x11c]
push ecx
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x634]
call fcn.00403250
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x11c]
lea edx, [esp + 0x11c]
push 0x208
push edx
rep stosd dword es:[edi], eax
push str.Insertpath
push str.Insert
lea ecx, [esp + 0x644]
call fcn.004032d0
test eax, eax
jne 0x40168c
push str.SoftwareQvodPlayer_
push 0x80000002
lea ecx, [esp + 0x430]
call fcn.00403290
lea eax, [esp + 0x11c]
push 0x208
push eax
push str.Insertpath
push str.Insert
lea ecx, [esp + 0x438]
call fcn.004032d0
lea ecx, [esp + 0x428]
mov esi, eax
call fcn.004032c0
test esi, esi
je 0x4016a4
mov al, byte [esp + 0x11c]
test al, al
je 0x4016a4
lea ecx, [esp + 0x11c]
push ecx
jmp 0x401730
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push edx
mov esi, 5
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4016c4
mov esi, dword [esp + 0x1c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x11c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, 6
mov byte [esp + 0x327], 0
jl 0x40170b
lea ecx, [esp + 0x324]
lea edx, [esp + 0x11c]
push ecx
push str._sQvodPlayer
push edx
jmp 0x401720
lea eax, [esp + 0x324]
lea ecx, [esp + 0x11c]
push eax
push str._sProgram_FilesQvodPlayer
push ecx
call fcn.0040362b
add esp, 0xc
lea edx, [esp + 0x11c]
push edx
push str.State
push str.Field_3
lea ecx, [esp + 0x14]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x11c]
push 0x208
rep stosd dword es:[edi], eax
lea eax, [esp + 0x120]
lea ecx, [esp + 0x638]
push eax
push str.defaultsavepath
push str.Option
call fcn.004032d0
test eax, eax
jne 0x4017c5
push str.SoftwareQvodPlayer_
push 0x80000002
lea ecx, [esp + 0x430]
call fcn.00403290
lea ecx, [esp + 0x11c]
push 0x208
push ecx
push str.defaultsavepath
push str.Option
lea ecx, [esp + 0x438]
call fcn.004032d0
lea ecx, [esp + 0x428]
mov esi, eax
call fcn.004032c0
test esi, esi
je 0x4017da
mov al, byte [esp + 0x11c]
test al, al
je 0x4017da
lea edx, [esp + 0x11c]
push edx
jmp 0x401831
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x324]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x324]
push eax
call fcn.00403110
add esp, 4
test eax, eax
je 0x40182c
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x324]
push ecx
push str._sMedia_
push edx
call fcn.0040362b
add esp, 0xc
lea eax, [esp + 0x18]
push eax
jmp 0x401831
push str.C:Media_
push str.State
push str.Field_4
lea ecx, [esp + 0x14]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x11c]
push 0x40fdb4
rep stosd dword es:[edi], eax
push 0x80000001
lea ecx, [esp + 0x848]
call fcn.00403290
lea ecx, [esp + 0x11c]
push 0x208
push ecx
push str.QvodPlayer
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x850]
call fcn.004032d0
push 0x40d0e8
push str.State
push str.Field_8
lea ecx, [esp + 0x14]
test eax, eax
call fcn.004010e0
lea ecx, [esp + 0x840]
call fcn.004032c0
lea ecx, [esp + 0x634]
call fcn.004032c0
mov eax, dword [esp + 0xc]
mov dword [esp + 8], 0x40a168
test eax, eax
je 0x401937
push eax
call fcn.00403612
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0xa44
ret 0x10
mov esi, str.space
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401910
test cl, cl
je 0x40190c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401910
add eax, 2
add esi, 2
test cl, cl
jne 0x4018ec
xor eax, eax
jmp 0x401915
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401937
mov ecx, 0x41
lea edi, [esp + 0x324]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x324]
push eax
call fcn.00403110
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0xa44
ret 0x10