Function at 0x4034c0
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4a4
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x4a0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
push 0xffffffffffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x10], edi
call sub.IMM32.dll_ImmDisableIME
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea esi, [esp + 0x20]
mov dword [esp + 0x20], edi
call fcn.0045cb8c
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 8
mov dword [esp + 0x44], 0x404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00405270
lea ebx, [esp + 0x64]
mov dword [esp + 0x64], 0x417
mov dword [esp + 0x68], 0x418
mov dword [esp + 0x6c], 0x4a
mov dword [esp + 0x70], 0x18
mov dword [esp + 0x74], 2
mov dword [esp + 0x78], 0x219
mov dword [esp + 0x7c], 0x464
mov dword [esp + 0x80], 0x465
mov dword [esp + 0x84], 0x466
mov dword [esp + 0x88], 0x467
mov dword [esp + 0x8c], 0x468
call fcn.00403210
lea eax, [esp + 0x4c]
push edi
push eax
call fcn.0045b262
mov eax, dword [esp + 0x54]
add esp, 8
cmp dword [eax - 0xc], edi
je 0x4035d4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403690
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.360base.dll
call fcn.00403270
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call fcn.00407d50
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
push eax
push str._d__s
call fcn.00401f50
mov edx, str.msgcenter
mov ecx, eax
call fcn.00401fd0
lea edx, [esp + 0x1c]
add esp, 0xc
push edx
mov ecx, 0x50fe3c
call fcn.00403270
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call fcn.004051e0
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
push eax
push str._d__s
call fcn.00401f50
mov edx, str.msgcenter
mov ecx, eax
call fcn.00401fd0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403670
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403690
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004019e0
mov ebx, eax
cmp dword [ebx + 4], edi
jne 0x4036db
mov edi, dword [ebx]
cmp dword [edi - 0xc], 0
jle 0x4036db
test edi, edi
je 0x4036db
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4036db
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0045afbc
add esp, 4
test eax, eax
jne 0x4036cf
call fcn.0045a980
test eax, eax
je 0x4036db
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x4036f9
push str.Initialize
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4036f9
call eax
jmp 0x4037b8
lea ecx, [esp + 0x3c]
push ecx
mov ecx, str.CrashReport.dll
call fcn.00403270
mov edi, dword [eax]
add esp, 4
call fcn.004019e0
mov esi, eax
test edi, edi
jne 0x40371c
xor eax, eax
jmp 0x403730
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403721
sub eax, edx
sar eax, 1
mov ebx, eax
push edi
mov eax, esi
call fcn.00408500
cmp dword [esi + 4], 0
jne 0x40377f
mov edi, dword [esi]
cmp dword [edi - 0xc], 0
jle 0x40377f
test edi, edi
je 0x40377f
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40377f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0045afbc
add esp, 4
test eax, eax
jne 0x403773
call fcn.0045a980
test eax, eax
je 0x40377f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
mov esi, dword [esi + 4]
test esi, esi
je 0x403798
push str.Initialize
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403798
call eax
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4037b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call edi
push eax
push str.MultiTip_CmdLine__s_
call fcn.00401f50
mov edx, str.MultiTip
mov ecx, eax
call fcn.00401fd0
push 0x208
lea ecx, [esp + 0x2ac]
push 0
push ecx
call fcn.004d7710
mov eax, dword [esp + 0x2c]
add esp, 0x14
push 0x104
lea edx, [esp + 0x2a4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4039f9
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0045b262
mov edx, dword [esp + 0x1c]
add esp, 8
push edx
lea eax, [esp + 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4039d9
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x9a]
push edx
mov word [esp + 0x9c], cx
call fcn.004d7710
add esp, 0xc
push 0
push 0x1a
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4039d9
push str.360safeSoftMgrMultiTip.exe
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x90]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4038ec
lea eax, [esp + 0x90]
call fcn.00407da0
test eax, eax
je 0x4038ec
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x94]
call fcn.004085e0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x2a4]
call fcn.004085e0
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x14]
mov ebx, 3
call fcn.0045bdf7
add esp, 4
test eax, eax
jg 0x4038f0
mov byte [esp + 0x1f], 0
jmp 0x4038f5
mov ebx, dword [esp + 0xc]
mov byte [esp + 0x1f], 1
test bl, 2
je 0x403906
lea ecx, [esp + 0x10]
and ebx, 0xfffffffd
call fcn.004087f0
test bl, 1
je 0x403914
lea ecx, [esp + 0x3c]
call fcn.004087f0
cmp byte [esp + 0x1f], 0
je 0x4039d9
push 0
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x2a8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0x90]
call fcn.00407da0
test eax, eax
je 0x4039d9
call edi
push eax
push str.run_appdata_MultiTip_CmdLine__s_
call fcn.00401f50
mov edx, str._Stat2016__MultiTip
mov ecx, eax
call fcn.00401fd0
mov edx, dword [ebp + 0x14]
add esp, 8
push edx
call edi
push eax
push 0x514be8
lea ecx, [esp + 0x9c]
call fcn.00405060
cmp eax, 0x20
jle 0x4039d9
call fcn.00405000
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x14]
call fcn.004087f0
lea ecx, [esp + 0x4c]
call fcn.004087f0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4039bd
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push eax
call edx
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4a0]
xor ecx, esp
call fcn.004cb38b
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4039f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0045d7fe
test eax, eax
je 0x403a4a
lea ecx, [esp + 0xc]
push ecx
mov ecx, str.360netbase.dll
call fcn.00403270
mov esi, dword [eax]
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403a2a
push esi
call fcn.0045d7bb
add esp, 4
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403a4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call edi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.0045dcb0
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str._tb:1
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e4a2
test eax, eax
je 0x403a86
xor ebx, ebx
push ebx
push 0x54f084
call fcn.0040a710
jmp 0x403a94
push 1
push 0x54f084
call fcn.0040a710
xor ebx, ebx
cmp dword [0x54f088], ebx
jne 0x403aec
push str.init_sites_error
call fcn.00401f50
mov edx, str.MultiTip
mov ecx, eax
call fcn.00401fd0
mov edi, dword [esp + 0x2c]
add esp, 4
test edi, edi
je 0x403ad3
mov ebx, dword [esp + 0x2c]
call fcn.00404e40
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004cc15e
add esp, 4
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x404725
lea eax, [esp + 0xc]
push str.CommonBase.dll
push eax
call fcn.0045b533
mov ecx, dword [eax]
push ecx
call fcn.0045e851
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403b26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, str.360SoftMgr_core.config
lea edx, [esp + 0xc]
call fcn.004385a0
mov ecx, dword [eax]
push ecx
call fcn.0045e8e0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403b5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x60], 1
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call sub.gdiplus.dll_GdiplusStartup
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._Message
call fcn.004085e0
lea ecx, [esp + 0x28]
push ecx
call fcn.0045e45a
test eax, eax
jne 0x4043dd
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str._SafeCloud
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e45a
test eax, eax
jne 0x4043dd
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str._JSMessage
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e45a
test eax, eax
jne 0x4043dd
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._DebugScript
call fcn.004085e0
lea ecx, [esp + 0x28]
push ecx
call fcn.0045e45a
test eax, eax
je 0x403cb8
call fcn.00402fb0
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str._DebugScript
call fcn.004085e0
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str._functional
call fcn.004085e0
lea ecx, [esp + 0x28]
push ecx
call fcn.0045e4a2
push ecx
mov edx, esp
mov dword [esp + 0x1c], esp
push edx
mov ecx, str._timeout
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.00404c50
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, str._force_pop
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e4a2
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str._EncodeScript
call fcn.004085e0
lea ecx, [esp + 0x28]
push ecx
call fcn.0045e4a2
call fcn.00410fd0
mov ecx, ebx
call fcn.004087f0
jmp 0x4046b9
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str._func
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e45a
test eax, eax
je 0x403db6
mov ebx, str.360safe_softmgr_
lea ecx, [esp + 0x10]
call fcn.0045b5a4
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str._func
call fcn.004085e0
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
push edx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00404990
mov ecx, ebx
call fcn.004087f0
lea ecx, [esp + 0x10]
push ecx
mov edx, str..dat
call fcn.004048f0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403da8
lea esi, [esp + 0x14]
call fcn.00404790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
call fcn.00402360
add esp, 4
mov edi, eax
xor esi, esi
call fcn.00402cd0
test eax, eax
je 0x403d6e
mov esi, 1
push esi
push edi
push str.__safetype___d____safe_is_lite___d
lea edi, [esp + 0x20]
call fcn.00404c30
mov eax, dword [esp + 0x1c]
add esp, 0xc
push 0
push eax
push 0x510170
push ecx
call fcn.00410fd0
mov ecx, dword [esp + 0x24]
add esp, 4
mov edx, eax
call fcn.00416a80
mov eax, edi
call fcn.0042afc0
lea ecx, [esp + 0x10]
call fcn.004087f0
jmp 0x4046b9
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str._soda
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e45a
test eax, eax
je 0x403fad
call fcn.00402fb0
test eax, eax
je 0x4046b9
push str.Q360SoftManagerSrvPushPopupMutex_SODASVC
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4046b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x403f15
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._soda
call fcn.004085e0
lea ebx, [esp + 0x40]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
mov ecx, ebx
push ecx
mov ecx, 0x5101dc
call fcn.004047b0
test eax, eax
jne 0x403efc
push 0x208
push eax
lea edx, [esp + 0x98]
push edx
call fcn.004d7710
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x514b40
push str.SOFTWARE360SoftMgr_reader
push SysReAllocString
mov dword [esp + 0x30], 1
mov dword [esp + 0x24], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x403eaa
push str...msgcentermsgcenter.bin
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x403edb
mov ebx, str.360safeSoftMgr_readermsgcentermsgcenter.bin
lea ecx, [esp + 0x48]
call fcn.0045b5a4
mov ecx, dword [eax]
lea edx, [esp + 0x90]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x403ec1
lea ecx, [esp + 0x48]
call fcn.004087f0
push 1
lea ecx, [esp + 0x94]
push ecx
push str.soda_svc
push ecx
call fcn.00410fd0
add esp, 4
xor ecx, ecx
mov edx, eax
call fcn.00416a80
lea ecx, [esp + 0x3c]
call fcn.004087f0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4046b9
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
push str._soda.007
push str.soda.msgcenter.org
mov esi, 0x32
call ebx
test eax, eax
jne 0x403f55
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jle 0x403f51
push 0x14
call edi
push str._soda.007
push str.soda.msgcenter.org
call ebx
dec esi
test eax, eax
je 0x403f36
jmp 0x403f55
test eax, eax
je 0x403f9d
mov esi, dword [esp + 0x48]
mov ecx, esi
mov dword [esp + 0x3c], 0x534f4441
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x403f66
sub ecx, edi
sar ecx, 1
lea edx, [ecx + ecx + 2]
lea ecx, [esp + 0xc]
push ecx
push 0x7d0
push 0
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x48]
push edx
push 0
push 0x4a
push eax
mov dword [esp + 0x60], esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4046b9
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str._webapp
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e45a
test eax, eax
je 0x4040d5
push str.Q360SoftMgr.WebApp.Mutex
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x4046b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40404b
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._webapp
call fcn.004085e0
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
push eax
mov ecx, 0x5101dc
call fcn.004047b0
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.004087f0
test bl, bl
je 0x4040c9
call fcn.00410fd0
mov ecx, eax
call fcn.00412260
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4046b9
mov ebx, dword [esp + 0x48]
test ebx, ebx
je 0x4040c9
mov eax, ebx
lea edx, [eax + 2]
jmp 0x404060
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404060
sub eax, edx
sar eax, 1
je 0x4040c9
push str._webapp.007
push str.MsgSrvPushTipClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4040c9
mov ecx, ebx
mov dword [esp + 0x3c], 1
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x404092
sub ecx, esi
sar ecx, 1
lea edx, [esp + 0xc]
push edx
push 0x7d0
lea ecx, [ecx + ecx + 2]
push 0
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x48]
push ecx
push 0
push 0x4a
push eax
mov dword [esp + 0x60], ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4046b9
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str._DecodeScript
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e45a
push ecx
mov dword [esp + 0x10], esp
test eax, eax
je 0x404125
mov ecx, esp
push ecx
mov ecx, str._DecodeScript
call fcn.004085e0
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
call fcn.00410fd0
mov ecx, ebx
call fcn.004087f0
jmp 0x4046b9
mov edx, esp
push edx
mov ecx, str._publicity
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e45a
test eax, eax
je 0x404183
call fcn.00402fb0
test eax, eax
je 0x4046b9
push ecx
mov dword [esp + 0x10], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, str._publicity
call fcn.004085e0
lea ecx, [esp + 0x2c]
call fcn.0045e4f5
push ecx
call fcn.00410fd0
add esp, 4
push eax
call fcn.00416080
jmp 0x4046b9
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str._svc
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e4a2
test eax, eax
je 0x404231
lea ecx, [esp + 0x14]
push str.safesvr.exe
push ecx
call fcn.0045b533
mov edx, dword [esp + 0x1c]
add esp, 8
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4041ea
mov ecx, dword [esp + 0x14]
push ebx
push str._svc
push 0x514be8
call fcn.00405060
lea ecx, [esp + 0x14]
call fcn.004087f0
jmp 0x4046b9
call fcn.00402fb0
test eax, eax
je 0x404223
push str.Q360SoftManagerSrvPushPopupMutex_SVC
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, ebx
je 0x404223
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40421c
call fcn.00410fd0
push eax
call fcn.004164d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.004087f0
jmp 0x4046b9
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._KTGB
call fcn.004085e0
lea ecx, [esp + 0x28]
push ecx
call fcn.0045e45a
test eax, eax
je 0x40433c
call fcn.00402fb0
test eax, eax
je 0x4046b9
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push str._newsld_svc.007
push str.MsgSrvPushTipClass
call esi
test eax, eax
jne 0x4042ea
mov ebx, str.360safeSoftMgrMultiTip.exe
lea ecx, [esp + 0xc]
call fcn.0045b5a4
mov eax, dword [eax]
push 0
push str._svc
push 0x514be8
mov ecx, eax
call fcn.00405060
cmp eax, 0x20
lea ecx, [esp + 0xc]
setg bl
call fcn.004087f0
test bl, bl
je 0x4046b9
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
push str._newsld_svc.007
push str.MsgSrvPushTipClass
call esi
test eax, eax
jne 0x4042ea
push 0x3e8
call edi
push str._newsld_svc.007
push str.MsgSrvPushTipClass
call esi
test eax, eax
je 0x4046b9
mov edi, dword [esp + 0x48]
mov ecx, edi
mov dword [esp + 0x3c], 1
lea esi, [ecx + 2]
jmp 0x404300
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x404300
sub ecx, esi
sar ecx, 1
lea edx, [ecx + ecx + 2]
lea ecx, [esp + 0xc]
push ecx
push 0x7d0
push 0
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x48]
push edx
push 0
push 0x4a
push eax
mov dword [esp + 0x60], edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x4046b9
call fcn.00402fb0
test eax, eax
je 0x4046b9
push 0x208
lea eax, [esp + 0x94]
push 0
push eax
call fcn.004d7710
mov edx, dword [esp + 0x24]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x94]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4046b9
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x4046b9
push str.webapp.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4046b9
lea ecx, [esp + 0xc]
push str.360speedld.exe
push ecx
call fcn.0045b533
mov ecx, dword [eax]
add esp, 8
push 5
push str._loadnews__subscribe
push 0x514be8
call fcn.00405060
lea ecx, [esp + 0xc]
call fcn.004087f0
jmp 0x4046b9
mov edx, dword [0x54d210]
mov eax, dword [edx + 0xc]
mov ecx, 0x54d210
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
add eax, 0x10
push ecx
mov ecx, str._Message
mov dword [esp + 0x18], eax
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e45a
test eax, eax
je 0x404472
call fcn.00402fb0
cmp eax, ebx
je 0x4044e4
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._Message
call fcn.004085e0
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
lea edi, [esp + 0x10]
call fcn.00407fc0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404508
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x404508
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str._JSMessage
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e45a
test eax, eax
je 0x4044aa
call fcn.00403180
cmp eax, ebx
je 0x4044e4
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._JSMessage
jmp 0x4044c0
call fcn.004030b0
cmp eax, ebx
je 0x4044e4
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str._SafeCloud
call fcn.004085e0
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
lea edi, [esp + 0x10]
call fcn.00407fc0
mov ecx, ebx
call fcn.004087f0
jmp 0x404508
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str._force_pop
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e4a2
test eax, eax
je 0x404699
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, 0x510028
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e45a
test eax, eax
je 0x404555
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, 0x510028
call fcn.004085e0
lea ecx, [esp + 0x28]
push ecx
call fcn.00404c50
test eax, eax
jbe 0x404555
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
mov edi, 1
push edx
mov ecx, str._nomutex
mov dword [esp + 0x20], edi
call fcn.004085e0
lea eax, [esp + 0x28]
push eax
call fcn.0045e4a2
test eax, eax
je 0x404586
mov dword [esp + 0x18], 0
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str._nochecktoday
call fcn.004085e0
lea edx, [esp + 0x28]
push edx
call fcn.0045e4a2
test eax, eax
je 0x4045a8
xor edi, edi
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, str._package
call fcn.004085e0
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.0045e4f5
mov ecx, dword [esp + 0x18]
mov esi, dword [eax]
push edi
push ecx
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
push edx
mov ecx, str._disable_popcloud
call fcn.004085e0
lea eax, [esp + 0x30]
push eax
call fcn.0045e4a2
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, str._functional
call fcn.004085e0
lea edx, [esp + 0x34]
push edx
call fcn.0045e4a2
push ecx
mov edi, eax
mov eax, esp
mov dword [esp + 0x28], esp
push eax
mov ecx, str._cache
call fcn.004085e0
lea ecx, [esp + 0x34]
push ecx
call fcn.0045e4a2
push eax
push ecx
mov edx, esp
mov dword [esp + 0x2c], esp
push edx
mov ecx, str._timeout
call fcn.004085e0
lea eax, [esp + 0x38]
push eax
call fcn.00404c50
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push ecx
mov ecx, str._force_pop
call fcn.004085e0
lea edx, [esp + 0x3c]
push edx
call fcn.0045e4a2
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
call fcn.00410fd0
add esp, 4
push eax
mov edx, esi
mov ecx, edi
call fcn.004116e0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404699
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4046b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x50]
push ecx
call sub.gdiplus.dll_GdiplusShutdown
lea edi, [esp + 0xc]
call fcn.00438a10
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4046dc
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
push esi
call eax
call fcn.00405000
call dword [sym.imp.ole32.dll_CoUninitialize]
test esi, esi
je 0x4046f3
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov edi, dword [esp + 0x28]
test edi, edi
je 0x404711
mov ebx, dword [esp + 0x2c]
call fcn.00404e40
mov eax, dword [esp + 0x28]
push eax
call fcn.004cc15e
add esp, 4
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404731
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404751
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40476d
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push eax
call edx
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x4ac]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004cb38b
mov esp, ebp
pop ebp
ret 0x10