Function at 0x437040
Capabilities:
Check os version
Create directory
Create process on windows
Get common file path
Get session user name
Get startup folder
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ab7ba
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x185c
call fcn.00492e50
mov eax, dword [0x4e42d0]
xor eax, esp
mov dword [esp + 0x1858], eax
push ebx
push esi
push edi
mov eax, dword [0x4e42d0]
xor eax, esp
push eax
lea eax, [esp + 0x1870]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esi, [eax + 0xa0]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
push esi
push eax
mov ebx, 0x4bd158
mov dword [esp + 0x18], esi
call fcn.00404f20
lea ecx, [esp + 0x48]
push esi
push ecx
mov ebx, 0x4bdf5c
mov dword [esp + 0x1888], 0
call fcn.00404f20
lea edx, [esp + 0x48]
push esi
push edx
mov ebx, str.uninst.exe
mov byte [esp + 0x1890], 1
call fcn.00404f20
mov byte [esp + 0x1890], 2
mov eax, dword [esi]
push 0x5c
push eax
call fcn.00490c12
add esp, 0x20
test eax, eax
jne 0x4370f7
or eax, 0xffffffff
jmp 0x4370fb
sub eax, dword [esi]
sar eax, 1
lea ecx, [esp + 0x30]
mov edx, esi
call fcn.00405a30
push 1
push 0x19
lea eax, [esp + 0x45c]
push eax
mov byte [esp + 0x1884], 3
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
call esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x4be090
call fcn.00402b20
lea edx, [esp + 0x3c]
push edx
mov ecx, 0x4c28d8
mov byte [esp + 0x187c], 4
call fcn.00402b20
push 0
mov byte [esp + 0x187c], 5
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x454]
push eax
push ecx
xor edx, edx
mov ecx, 0x4c28f4
call fcn.0043dc60
test eax, eax
jne 0x43719a
mov edi, dword [esp + 0x1c]
add edi, 0xa4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1389
call fcn.00407ec0
push 1
push 0x1a
lea edx, [esp + 0x254]
push edx
push 0
call esi
test eax, eax
je 0x4371de
lea edi, [esp + 0x24c]
add edi, 0xfffffffe
jmp 0x4371c0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4371c0
mov ecx, 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x24c]
push eax
push ecx
mov edx, str.Baofeng.StormPlayer.WIN7APPID_BF9_NINE
xor ecx, ecx
call fcn.0043dc60
test eax, eax
jne 0x43721e
mov edi, dword [esp + 0x1c]
add edi, 0xa4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138b
call fcn.00407ec0
push 0x104
lea edx, [esp + 0x458]
push 0
push edx
call fcn.00493520
add esp, 0xc
push 1
push 0x17
lea eax, [esp + 0x45c]
push eax
push 0
call esi
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x458]
call fcn.00402b20
push 5
push 0x4c2958
lea ebx, [esp + 0x30]
mov byte [esp + 0x1880], 6
call fcn.00409bd0
mov edx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edx
call edi
push 7
push 0x4c2964
call fcn.00409bd0
mov eax, dword [esp + 0x28]
push 0
push eax
call edi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4372bb
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
push eax
push ecx
mov edx, str.Baofeng.StormPlayer.WIN7APPID_BF9_NINE
mov ecx, 0x4c28f4
call fcn.0043dc60
test eax, eax
jne 0x4372d8
mov esi, dword [esp + 0x1c]
lea edi, [esi + 0xa4]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138c
call fcn.00407ec0
jmp 0x4372dc
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x437302
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x3c]
push eax
push edx
xor edx, edx
mov ecx, 0x4c2974
call fcn.0043dc60
test eax, eax
jne 0x437319
lea edi, [esi + 0xa4]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138e
call fcn.00407ec0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x48], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x48]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, 6
ja 0x437352
jne 0x437475
cmp dword [esp + 0x4c], 1
jb 0x437475
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
push str.CurrentMajorVersionNumber
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov edi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], edi
call ebx
cmp dword [esp + 0x18], 0xa
jae 0x43747a
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x250]
call fcn.00402b20
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
mov ebx, 0x4ba360
mov byte [esp + 0x1880], 7
call fcn.00404f20
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ebx, eax
mov byte [esp + 0x1888], 8
call fcn.00404e70
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x1878], 9
call fcn.00405000
mov byte [esp + 0x1878], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437414
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 7
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43743c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0
push ecx
push str.taskbarpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0x1878], 6
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4375dc
mov edi, 4
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push str.CurrentMajorVersionNumber
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call ebx
cmp dword [esp + 0x18], 0xa
jb 0x4375e8
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x250]
call fcn.00402b20
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x38]
push eax
mov ebx, str.User_PinnedTaskBar_
mov byte [esp + 0x1880], 0xa
call fcn.00404f20
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ebx, eax
mov byte [esp + 0x1888], 0xb
call fcn.00404e70
add esp, 0x10
mov byte [esp + 0x1878], 0xc
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.004097e0
mov byte [esp + 0x1878], 0xe
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43753c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 0xf
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437564
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push 0
push ecx
call fcn.00492b2c
add esp, 8
cmp eax, 0xffffffff
je 0x437584
push str.File_ACCESS.C_exists_n
call fcn.004911e5
jmp 0x437595
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x24c]
push edx
call fcn.00401ca0
mov byte [esp + 0x187c], 0xa
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4375c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 6
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4375e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
push ecx
push 0x4ba358
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsStormPlayer9.exe
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004052a0
add esp, 8
test al, al
jne 0x43761f
lea edi, [esi + 0xa4]
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x138f
call fcn.00407ec0
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
sub eax, 0x10
call fcn.004050f0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437646
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x4c28f4
push str.DisplayName
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer9
call fcn.004052a0
add esp, 8
test al, al
jne 0x437678
lea edi, [esi + 0xa4]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1390
call fcn.00407ec0
mov ecx, dword [esp + 0x38]
push ecx
push str.UninstallString
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer9
call fcn.004052a0
add esp, 8
test al, al
jne 0x4376aa
lea edi, [esi + 0xa4]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1391
call fcn.00407ec0
mov edx, dword [esp + 0x2c]
push edx
push str.DisplayIcon
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer9
call fcn.004052a0
add esp, 8
test al, al
jne 0x4376dc
lea edi, [esi + 0xa4]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1392
call fcn.00407ec0
push str.9.06.0912.1111
push str.DisplayVersion
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer9
call fcn.004052a0
add esp, 8
test al, al
jne 0x43770e
lea edi, [esi + 0xa4]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1393
call fcn.00407ec0
push str.http:__www.Baofeng.com
push str.URLInfoAbout
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer9
call fcn.004052a0
add esp, 8
test al, al
jne 0x437740
lea edi, [esi + 0xa4]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1394
call fcn.00407ec0
push 0x4c2ad0
push str.Publisher
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer9
call fcn.004052a0
add esp, 8
test al, al
jne 0x437772
lea edi, [esi + 0xa4]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1395
call fcn.00407ec0
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.InstallActiveFlag
push str.SoftwareBaofengVideoStormPlayer9UserConfig
push SysReAllocString
mov dword [esp + 0x2c], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
cmp ebx, 5
jne 0x437874
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x18], 0x202
call esi
push str.SoftwareBaofengVideoStormPlayer9UserConfig
push str.CURRENT_USER
push str._s_s
lea eax, [esp + 0x870]
push 0x800
push eax
call fcn.00490c40
add esp, 0x14
push 0xf003f
lea ecx, [esp + 0x48]
push ecx
push 2
lea edi, [esp + 0x870]
call fcn.00405b90
test eax, eax
je 0x437870
push 4
lea edx, [esp + 0x18]
push edx
push 4
push str.InstallActiveFlag
push str.SoftwareBaofengVideoStormPlayer9UserConfig
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x660]
push ecx
mov dword [esp + 0x3c], 0x202
call esi
push str.SoftwareBaofengVideoStormPlayer9UserConfig
push str.CURRENT_USER
push str._s_s
lea edx, [esp + 0x1070]
push 0x800
push edx
call fcn.00490c40
add esp, 0x14
push 2
lea eax, [esp + 0x660]
push eax
push 3
lea edi, [esp + 0x1070]
call fcn.00405b90
mov esi, dword [esp + 0x1c]
test ebx, ebx
sete al
test al, al
jne 0x437894
lea edi, [esi + 0xa4]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1396
call fcn.00407ec0
cmp dword [esi + 0x14], 0
je 0x4378d7
push 1
mov ebx, str.InstallType
mov esi, str.SoftwareBaofengVideoStormPlayer9UserConfig
call fcn.004051f0
add esp, 4
test al, al
jne 0x4378cd
mov edi, dword [esp + 0x1c]
add edi, 0xa4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1398
call fcn.00407ec0
mov esi, dword [esp + 0x1c]
cmp dword [esi + 0x14], 0
jne 0x43790a
push 1
mov ebx, str.AutoRun
mov esi, str.SoftwareBaofengVideoStormPlayer9ConfigRepairAutoRun
call fcn.004051f0
add esp, 4
test al, al
jne 0x43790a
mov edi, dword [esp + 0x1c]
add edi, 0xa4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1399
call fcn.00407ec0
mov ebx, str.FirstHideBox
mov edi, str.SoftwareBaofengVideoStormPlayer9UserConfig
call fcn.00405180
mov ebx, str.BHDNewZoom
mov edi, str.SoftwareBaofengVideoStormPlayer9UserConfigDirectShow
call fcn.00405180
mov byte [esp + 0x1878], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437950
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 4
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437978
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 3
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4379a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4379c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 1
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4379f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1878], 0
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437a18
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1878], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437a43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1870]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1858]
xor ecx, esp
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret 4