Function at 0x4649ed
Capabilities:
Check if file exists
Parse url
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c054b
mov eax, dword fs:[0]
push eax
mov eax, 0x1a44
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x19bc], eax
mov eax, dword [ebp + 0xc]
push 0x7e
mov dword [ebp - 0x1998], eax
pop esi
xor eax, eax
xor ebx, ebx
push esi
mov word [ebp - 0x310], ax
lea eax, [ebp - 0x30e]
push ebx
push eax
mov dword [ebp - 0x19a8], ebx
call fcn.00596530
lea eax, [ebp - 0x310]
add esp, 0xc
push eax
call fcn.00428b69
pop ecx
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push ebx
lea eax, [ebp - 0x210]
push 0x40
push eax
call fcn.00428a33
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push ebx
push eax
call fcn.00596530
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea eax, [ebp - 0x19c8]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x19cc]
push eax
push 0x5df64c
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x19cc], 1
mov dword [ebp - 0x19c8], esi
call edi
xor eax, eax
push esi
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x28e]
push ebx
push eax
call fcn.00596530
lea eax, [ebp - 0x290]
add esp, 0xc
push eax
call fcn.00428b8d
pop ecx
xor eax, eax
push esi
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x40
push eax
call fcn.00429311
pop ecx
pop ecx
push 4
pop esi
lea eax, [ebp - 0x19b8]
push eax
lea eax, [ebp - 0x198c]
push eax
lea eax, [ebp - 0x19b4]
push eax
push str.ucount
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsJzbstall.exe
push 0x80000002
mov dword [ebp - 0x198c], ebx
mov dword [ebp - 0x19b4], esi
mov dword [ebp - 0x19b8], esi
call edi
test eax, eax
jne 0x464b7d
cmp dword [ebp - 0x19b4], esi
je 0x464b83
mov dword [ebp - 0x198c], ebx
mov eax, 0x7fff
cmp dword [ebp - 0x198c], eax
jbe 0x464b96
mov dword [ebp - 0x198c], eax
lea eax, [ebp - 0x19c4]
push eax
lea eax, [ebp - 0x1994]
push eax
lea eax, [ebp - 0x19a0]
push eax
push str.dhlastcktm
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x1994], ebx
mov dword [ebp - 0x19a0], esi
mov dword [ebp - 0x19c4], esi
call edi
test eax, eax
jne 0x464bda
cmp dword [ebp - 0x19a0], esi
je 0x464be0
mov dword [ebp - 0x1994], ebx
push ebx
call fcn.005901bf
pop ecx
push esi
mov dword [ebp - 0x19a4], eax
lea eax, [ebp - 0x19a4]
push eax
push esi
push str.dhlastcktm
push str.Softwarehao123JuziBrowser
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0x1994]
mov dword [ebp - 0x19f0], eax
lea eax, [ebp - 0x19f0]
push eax
mov dword [ebp - 0x19b0], ebx
xor edi, edi
mov dword [ebp - 0x19ec], ebx
call fcn.005904c8
pop ecx
cmp eax, ebx
je 0x464c39
mov edi, dword [eax + 0xc]
mov eax, dword [ebp - 0x19a4]
mov dword [ebp - 0x19f8], eax
lea eax, [ebp - 0x19f8]
push eax
xor esi, esi
mov dword [ebp - 0x19f4], ebx
call fcn.005904c8
pop ecx
cmp eax, ebx
je 0x464c61
mov esi, dword [eax + 0xc]
cmp edi, esi
je 0x464c6f
mov dword [ebp - 0x19b0], 1
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x518], ax
lea eax, [ebp - 0x516]
push ebx
push eax
mov dword [ebp - 0x199c], ebx
call fcn.00596530
add esp, 0xc
push str.Installer
push 0x63c268
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.hao123VOLService.exe
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x464cd8
mov dword [ebp - 0x199c], 1
push 0x465219
push 0x463f12
push 2
push 0xc
lea eax, [ebp - 0x1a10]
push eax
call fcn.00594bb4
lea eax, [ebp - 0x1a10]
push eax
mov dword [ebp - 4], ebx
call fcn.0042b9c1
pop ecx
xor eax, eax
push esi
mov word [ebp - 0x720], ax
lea eax, [ebp - 0x71e]
push ebx
push eax
call fcn.00596530
mov eax, dword [ebp - 0x1a08]
add esp, 0xc
call fcn.0042e11e
cmp eax, ebx
je 0x464d4a
cmp word [eax], bx
je 0x464d4a
lea ecx, [ebp - 0x720]
push ecx
push str.__src
push eax
mov edi, 0x103
call fcn.00425518
add esp, 0xc
lea eax, [ebp - 0x19e4]
push eax
call fcn.00440517
lea eax, [ebp - 0x19e4]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1a08]
push eax
call fcn.0042e174
mov eax, dword [ebp - 0x19d4]
sub eax, dword [ebp - 0x19d8]
pop ecx
cdq
push 0x1c
pop ecx
idiv ecx
mov edi, 0x63696c
mov ecx, edi
mov esi, eax
mov eax, dword [0x63696c]
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x197c], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1988], eax
lea eax, [ebp - 0x1988]
push eax
mov byte [ebp - 4], 2
push 1
cmp esi, ebx
je 0x464dbe
lea eax, [ebp - 0x720]
push eax
jmp 0x464dc3
push 0x5e62bc
call fcn.00426c3c
mov eax, dword [0x63696c]
add esp, 0xc
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1990], eax
mov byte [ebp - 4], 3
mov eax, dword [0x63696c]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x19ac], esi
mov byte [ebp - 4], 4
cmp dword [ebp - 0x197c], ebx
jne 0x464efc
xor eax, eax
push 0x200
mov word [ebp - 0x928], ax
lea eax, [ebp - 0x926]
push ebx
push eax
call fcn.00596530
add esp, 0xc
xor eax, eax
push 0x1048
mov word [ebp - 0x1978], ax
lea eax, [ebp - 0x1976]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push 0x38
lea eax, [ebp - 0x1a48]
push ebx
push eax
mov dword [ebp - 0x1a4c], 0x3c
call fcn.00596530
lea eax, [ebp - 0x928]
add esp, 0xc
mov dword [ebp - 0x1a3c], eax
lea eax, [ebp - 0x1978]
push ebx
lea esi, [ebp - 0x19e4]
mov dword [ebp - 0x1a38], 0x104
mov dword [ebp - 0x1a20], eax
mov dword [ebp - 0x1a1c], 0x824
call fcn.00404e8b
mov eax, dword [eax + 0x14]
push ebx
mov dword [ebp - 0x1984], eax
call fcn.00404e8b
cmp dword [eax + 0x18], 8
jb 0x464eaf
mov eax, dword [eax + 4]
jmp 0x464eb2
add eax, 4
lea ecx, [ebp - 0x1a4c]
push ecx
push ebx
push dword [ebp - 0x1984]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
lea eax, [ebp - 0x1990]
push eax
push 1
push dword [ebp - 0x1a00]
call fcn.00426c3c
add esp, 0xc
lea eax, [ebp - 0x19ac]
push eax
lea eax, [ebp - 0x928]
push 1
push eax
call fcn.00426c3c
mov esi, dword [ebp - 0x19ac]
add esp, 0xc
mov eax, dword [0x63696c]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1984], eax
mov byte [ebp - 4], 5
mov eax, 0x6baf08
cmp word [0x6baf08], bx
jne 0x464f26
mov eax, 0x5d0700
lea ecx, [ebp - 0x1984]
push ecx
push ebx
push eax
call fcn.00426c3c
xor eax, eax
add esp, 0xc
cmp dword [0x6b4490], ebx
mov ecx, edi
setne al
mov dword [ebp - 0x19c0], eax
mov eax, dword [0x63696c]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1980], eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x197c], ebx
je 0x464f73
mov dword [ebp - 0x197c], 0x5e62bc
jmp 0x464f7f
mov eax, dword [ebp - 0x1990]
mov dword [ebp - 0x197c], eax
xor eax, eax
cmp ax, word [0x63f288]
jne 0x464f93
call fcn.00404168
mov edi, eax
jmp 0x464f98
mov edi, 0x63f288
push dword [0x6b4484]
push ecx
push ebx
push ebx
call fcn.0042b3a5
add esp, 0xc
push eax
push ebx
push 1
call fcn.0042b3a5
pop ecx
pop ecx
push eax
call fcn.004096fe
push eax
call fcn.00409729
push eax
push dword [ebp - 0x1988]
lea eax, [ebp - 0x290]
push dword [ebp - 0x1984]
push eax
push esi
push dword [ebp - 0x197c]
call fcn.0042b23b
movzx eax, al
push eax
push dword [ebp - 0x19c0]
push dword [ebp - 0x199c]
push dword [ebp - 0x19b0]
push dword [ebp - 0x198c]
push 6
pop eax
call fcn.0042959b
push eax
push ecx
push 5
pop eax
call fcn.0042959b
pop ecx
push eax
push 4
pop eax
call fcn.0042959b
push eax
push ecx
push 3
pop eax
call fcn.0042959b
pop ecx
push eax
push 2
pop eax
call fcn.0042959b
push eax
xor eax, eax
push ecx
inc eax
call fcn.0042959b
pop ecx
push eax
call fcn.0042b0ef
movzx eax, al
push eax
call fcn.0042942a
movzx eax, al
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004292bd
movzx eax, al
push eax
call fcn.00428f9a
movzx eax, al
push eax
call fcn.00429189
movzx eax, al
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x310]
push eax
push edi
push str.ver_scid_smid_sumid_sos_dsafe_die_dflash_sfop_dh_dch1_dch2_dch3_dch4_dch5_dch6_dch7_dch8_dch9_dch10_dds_dop1_sop2_sop3_sop4_sop5_sdb_dsd1_dsd2_dsd3_d
lea eax, [ebp - 0x1980]
call fcn.00404f66
add esp, 0x7c
push dword [ebp - 0x1980]
lea eax, [ebp - 0x197c]
push eax
call fcn.0047f351
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov edi, dword [ebp - 0x197c]
cmp edi, ebx
je 0x465112
push str.aT6Qrs8Ht_Z_r6__T9_QAz
lea eax, [ebp - 0x197c]
push eax
call fcn.0041891d
xor eax, eax
push 0x7e
mov word [ebp - 0x190], ax
lea eax, [ebp - 0x18e]
push ebx
push eax
call fcn.00596530
mov edi, dword [ebp - 0x197c]
mov eax, dword [edi - 0xc]
add esp, 0xc
push 0x3f
push eax
lea ebx, [ebp - 0x190]
mov ecx, edi
call fcn.0046fd60
pop ecx
pop ecx
test eax, eax
je 0x465110
mov eax, ebx
push eax
push dword [ebp - 0x1998]
call fcn.00407af8
xor ebx, ebx
mov eax, dword [ebp - 0x1998]
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
jne 0x465132
lea eax, [edi - 0x10]
call fcn.00407b6b
mov eax, dword [ebp - 0x1980]
add eax, 0xfffffff0
jmp 0x46518f
push 4
push str.ck
lea eax, [ebp - 0x1980]
call fcn.0040a5cb
mov eax, dword [ebp - 0x1998]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x1980]
call fcn.0040a5cb
mov ebx, dword [ebp - 0x1980]
mov eax, dword [ebp - 0x19bc]
push ebx
push str.http:__update.123juzi.net_update.php
push 0x5e9d1c
call fcn.00404f66
add esp, 0xc
lea eax, [edi - 0x10]
mov dword [ebp - 0x19a8], 1
call fcn.00407b6b
lea eax, [ebx - 0x10]
call fcn.00407b6b
mov eax, dword [ebp - 0x1984]
add eax, 0xfffffff0
call fcn.00407b6b
lea eax, [esi - 0x10]
call fcn.00407b6b
mov eax, dword [ebp - 0x1990]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1988]
add eax, 0xfffffff0
call fcn.00407b6b
lea esi, [ebp - 0x19e4]
call fcn.00404ef6
push dword [ebp - 0x19e4]
call fcn.0058f3c4
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x465219
push 2
push 0xc
lea eax, [ebp - 0x1a10]
push eax
call fcn.00594c77
mov eax, dword [ebp - 0x19a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058f3cf
leave
ret 8