Function at 0x401110
Capabilities:
Check os version
Get common file path
Get file version info
Persist via run registry key

Disassembly:
sub esp, 0x94c
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
mov edi, 0x40dff4
push 0x104
xor ebx, ebx
push 0x40dff4
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dl, byte [eax + 0x40dff4]
lea ecx, [eax + 0x40dff4]
cmp dl, 0x5c
je 0x40115d
mov edx, eax
dec eax
test edx, edx
jle 0x40115d
mov byte [ecx], bl
mov dl, byte [ecx - 1]
dec ecx
cmp dl, 0x5c
jne 0x40114b
mov edi, dword [esp + 0x964]
mov esi, str.setup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40118f
cmp cl, bl
je 0x40118b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40118f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40116b
xor eax, eax
jmp 0x401194
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4011da
call fcn.00401e10
call fcn.00401dd0
call fcn.00402570
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40dff4
call fcn.004025c0
add esp, 4
call fcn.004038f0
call fcn.00403a10
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x94c
ret 0x10
mov esi, 0x40d468
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401205
cmp cl, bl
je 0x401201
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401205
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4011e1
xor eax, eax
jmp 0x40120a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40124a
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x40dff4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._sQvodPlayer.exe
push eax
call fcn.00404144
lea ecx, [esp + 0x34]
push ecx
call fcn.00401e00
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, 0x40d450
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401275
cmp cl, bl
je 0x401271
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401275
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401251
xor eax, eax
jmp 0x40127a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4012b5
call fcn.00401e10
push 1
call fcn.004020e0
add esp, 4
call fcn.004022d0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402570
call fcn.00402930
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.resetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4012e0
cmp cl, bl
je 0x4012dc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4012e0
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4012bc
xor eax, eax
jmp 0x4012e5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40132d
call fcn.00401e10
push 1
call fcn.004020e0
add esp, 4
call fcn.004022d0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402570
push 0x40dff4
call fcn.004025c0
add esp, 4
call fcn.00402930
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.nbsetup
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401358
cmp cl, bl
je 0x401354
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401358
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401334
xor eax, eax
jmp 0x40135d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4013a7
call fcn.004022d0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push 1
call fcn.004020e0
add esp, 4
call fcn.00402570
push 0x3e8
call esi
push 0x40dff4
call fcn.004025c0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.nbrun
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4013d2
cmp cl, bl
je 0x4013ce
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4013d2
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4013ae
xor eax, eax
jmp 0x4013d7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4013f4
push ebx
push 1
call fcn.00402320
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.setupdate
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40141f
cmp cl, bl
je 0x40141b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40141f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4013fb
xor eax, eax
jmp 0x401424
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40143b
call fcn.00401e80
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.Google
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401466
cmp cl, bl
je 0x401462
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401466
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401442
xor eax, eax
jmp 0x40146b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4015b9
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
push 0x40dff4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x338]
push str._sgtapi_signed.dll
push eax
call fcn.00404144
add esp, 0xc
lea ecx, [esp + 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov esi, 1
cmp edi, ebx
mov dword [esp + 0x14], ebx
je 0x4014df
push str.ToolbarCompatibilityCheck
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4014d8
lea edx, [esp + 0x14]
push edx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x338]
push 0x40d3f0
push eax
call fcn.00404144
mov edi, str.google.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40dff4
mov esi, edi
mov edx, ecx
mov edi, 0x40dff4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00401000
lea eax, [esp + 0x334]
lea ecx, [esp + 0xc]
push eax
push str.check
push str.GOOGLE
call fcn.004010e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
lea edx, [esp + 0x334]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x40d3f0
push edx
call fcn.00404144
add esp, 0xc
lea eax, [esp + 0x334]
lea ecx, [esp + 0xc]
push eax
push str.checkerr
push str.GOOGLE
call fcn.004010e0
mov dword [esp + 0xc], 0x40a190
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x401db5
jmp 0x401dac
mov esi, str.WriteIni
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4015e4
cmp cl, bl
je 0x4015e0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4015e4
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4015c0
xor eax, eax
jmp 0x4015e9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401892
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x40dff4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._sqvod1.ini
push eax
call fcn.00404144
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
lea ecx, [esp + 0x540]
call fcn.00403aa0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
push 0x208
push edx
rep stosd dword es:[edi], eax
push str.Insertpath
push str.Insert
lea ecx, [esp + 0x550]
call fcn.00403b20
test eax, eax
je 0x401670
cmp byte [esp + 0x28], bl
je 0x401670
lea eax, [esp + 0x28]
push eax
jmp 0x4016f8
lea ecx, [esp + 0x334]
mov dword [esp + 0x334], 0x94
push ecx
mov esi, 5
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401699
mov esi, dword [esp + 0x338]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x230]
push 0x104
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, 6
mov byte [esp + 0x233], bl
jl 0x4016d9
lea eax, [esp + 0x230]
lea ecx, [esp + 0x28]
push eax
push str._sQvodPlayer
push ecx
jmp 0x4016eb
lea edx, [esp + 0x230]
lea eax, [esp + 0x28]
push edx
push str._sProgram_FilesQvodPlayer
push eax
call fcn.00404144
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push str.State
push str.Field_3
lea ecx, [esp + 0x18]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x28]
push 0x208
push edx
rep stosd dword es:[edi], eax
push str.defaultsavepath
push str.Option
lea ecx, [esp + 0x550]
call fcn.00403b20
cmp eax, ebx
jne 0x401784
push str.SoftwareQvodPlayer_
push 0x80000002
lea ecx, [esp + 0x33c]
call fcn.00403ae0
lea eax, [esp + 0x28]
push 0x208
push eax
push str.defaultsavepath
push str.Option
lea ecx, [esp + 0x344]
call fcn.00403b20
lea ecx, [esp + 0x334]
mov esi, eax
call fcn.00403b10
cmp esi, ebx
je 0x401791
cmp byte [esp + 0x28], bl
je 0x401791
lea ecx, [esp + 0x28]
push ecx
jmp 0x4017f1
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x230]
lea edx, [esp + 0x230]
rep stosd dword es:[edi], eax
push edx
call fcn.004037b0
add esp, 4
test eax, eax
je 0x4017ec
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x230]
lea ecx, [esp + 0x334]
push eax
push str._sMedia_
push ecx
call fcn.00404144
add esp, 0xc
lea edx, [esp + 0x334]
push edx
jmp 0x4017f1
push str.C:Media_
push str.State
push str.Field_4
lea ecx, [esp + 0x18]
call fcn.004010e0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x40dff0
rep stosd dword es:[edi], eax
push 0x80000001
lea ecx, [esp + 0x754]
call fcn.00403ae0
lea eax, [esp + 0x28]
push 0x208
push eax
push str.QvodPlayer
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x75c]
call fcn.00403b20
push 0x40d2d0
push str.State
push str.Field_8
lea ecx, [esp + 0x18]
test eax, eax
call fcn.004010e0
lea ecx, [esp + 0x74c]
call fcn.00403b10
lea ecx, [esp + 0x540]
call fcn.00403b10
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40a190
cmp eax, ebx
je 0x401db5
jmp 0x401dac
mov esi, str.Updateini
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4018bd
cmp cl, bl
je 0x4018b9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4018bd
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401899
xor eax, eax
jmp 0x4018c2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4019a9
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x40dff4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._sQvodCfg.ini
push eax
call fcn.00404144
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
lea ecx, [esp + 0x540]
call fcn.00403aa0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push ebx
rep stosd dword es:[edi], eax
push str.Update
push str.Option
lea ecx, [esp + 0x54c]
call fcn.00403c20
mov esi, eax
cmp esi, 2
jle 0x40194c
push ebx
push str.Update
push str.Option
lea ecx, [esp + 0x54c]
xor esi, esi
call fcn.00403ce0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push esi
lea edx, [esp + 0x2c]
push 0x40d3f0
rep stosd dword es:[edi], eax
push edx
call fcn.00404144
add esp, 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push str.update
push str.QVODTERMINAL
call fcn.004010e0
lea ecx, [esp + 0x540]
call fcn.00403b10
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40a190
cmp eax, ebx
je 0x401db5
jmp 0x401dac
mov esi, str.space
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4019d4
cmp cl, bl
je 0x4019d0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4019d4
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4019b0
xor eax, eax
jmp 0x4019d9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401a0b
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x230]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x230]
push eax
call fcn.004037b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x94c
ret 0x10
mov esi, str.writett
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401a36
cmp cl, bl
je 0x401a32
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401a36
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401a12
xor eax, eax
jmp 0x401a3b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401b61
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x40dff4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push str._stt.ini
push eax
call fcn.00404144
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401000
push str.SoftwareTENCENTTTraveler
push 0x80000001
lea ecx, [esp + 0x754]
call fcn.00403ae0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x334]
lea edx, [esp + 0x334]
push 0x104
push edx
rep stosd dword es:[edi], eax
push 0x40d250
push 0x40dff0
lea ecx, [esp + 0x75c]
call fcn.00403b20
test eax, eax
je 0x401b3c
lea edi, [esp + 0x334]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0x334]
lea edx, [esp + ecx + 0x334]
cmp al, 0x5c
je 0x401af6
mov eax, ecx
dec ecx
test eax, eax
jle 0x401af6
mov byte [edx], bl
mov al, byte [edx - 1]
dec edx
cmp al, 0x5c
jne 0x401ae5
mov byte [edx], bl
lea edi, [esp + 0x334]
or ecx, 0xffffffff
xor eax, eax
dec edx
repne scasb al, byte es:[edi]
mov al, byte [edx]
not ecx
dec ecx
cmp al, 0x5c
je 0x401b21
mov eax, ecx
dec ecx
test eax, eax
jle 0x401b21
mov byte [edx], bl
mov al, byte [edx - 1]
dec edx
cmp al, 0x5c
jne 0x401b10
lea ecx, [esp + 0x334]
push ecx
push str.path
push 0x40d244
lea ecx, [esp + 0x18]
call fcn.004010e0
lea ecx, [esp + 0x74c]
call fcn.00403b10
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], 0x40a190
cmp eax, ebx
je 0x401db5
jmp 0x401dac
mov esi, str.qvodv
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401b8c
cmp cl, bl
je 0x401b88
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401b8c
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401b68
xor eax, eax
jmp 0x401b91
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401d0c
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x334]
push 0x40dff4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x338]
push str._sqvod3_u.ini
push eax
call fcn.00404144
add esp, 0xc
lea ecx, [esp + 0x334]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401000
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x40dff4
lea edx, [esp + 0x2c]
push str._sQvodTerminal.exe
rep stosd dword es:[edi], eax
push edx
call fcn.00404144
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.00404100
add esp, 0x14
cmp eax, 0xffffffff
je 0x401cf3
lea ecx, [esp + 0x24]
lea edx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x2c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call fcn.00403fdf
add esp, 4
mov esi, eax
lea eax, [esp + 0x28]
push esi
push edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push edx
push str.VarFileInfoTranslation
push esi
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401cf3
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x230]
xor edx, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x238]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.00404144
add esp, 0x10
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
lea eax, [esp + 0x230]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401cf3
mov ecx, dword [esp + 0x14]
push 0x40d1d0
push ecx
call fcn.00404080
mov edx, dword [esp + 0x1c]
push 0x40d1cc
push edx
mov esi, eax
call fcn.00404080
add esp, 0x10
cmp esi, ebx
jne 0x401cdb
cmp eax, ebx
je 0x401cf3
push 0x40d2d0
push str.State
push str.Field_1
lea ecx, [esp + 0x28]
call fcn.004010e0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], 0x40a190
cmp eax, ebx
je 0x401db5
jmp 0x401dac
push str.Write360
push edi
call fcn.00404080
add esp, 8
test eax, eax
je 0x401db5
add edi, 9
push ebp
push edi
call fcn.00403fed
mov esi, eax
call fcn.00403a40
cdq
mov ecx, 0x64
lea edi, [esp + 0x238]
idiv ecx
mov ecx, 0x41
xor eax, eax
push 0x40dff4
push str._splugs.ini
rep stosd dword es:[edi], eax
mov ebp, edx
lea edx, [esp + 0x240]
push edx
call fcn.00404144
add esp, 0x10
lea eax, [esp + 0x234]
lea ecx, [esp + 0x10]
push eax
call fcn.00401000
cmp ebp, esi
pop ebp
jge 0x401d84
push 0x40d1a8
jmp 0x401d89
push 0x40d2d0
push str.State
push str.Field_14
lea ecx, [esp + 0x18]
call fcn.004010e0
mov dword [esp + 0xc], 0x40a190
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x401db5
push eax
call fcn.00403fd4
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x94c
ret 0x10