Function at 0x4467a0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf5
push str.InstallUtil::StartInstall
push str.__s__d___StartInstall:
mov esi, ecx
call fcn.0041f720
mov eax, dword [esi + 0x720]
add esp, 0xc
cmp eax, 2
jne 0x44680f
cmp dword [esi + 0x73c], 4
mov eax, dword [esi + 4]
push 0
je 0x4467f2
push 0x12c
push 0xc8
push eax
jmp 0x446820
cmp byte [esi + 0x80d], 0
je 0x446805
push 0x3c
push 0xc8
push eax
jmp 0x446820
push 0xa
push 0xc8
push eax
jmp 0x446820
cmp eax, 9
jne 0x446826
push 0
push 0x3c
push 0xc8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
cmp byte [esi + 0x80c], 0
jne 0x446973
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push str.install_model
push str.Software360360huabao
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x446889
cmp dword [esi + 0x720], 5
jne 0x446973
mov dword [esi + 0x720], 7
jmp 0x446973
cmp dword [esi + 0x704], 8
lea edi, [esi + 0x6f0]
mov edx, edi
jb 0x44689c
mov edx, dword [edi]
cmp dword [esi + 0x71c], 8
lea ebx, [esi + 0x708]
mov ecx, ebx
jb 0x4468af
mov ecx, dword [ebx]
call fcn.00410930
test eax, eax
jne 0x4468ca
cmp dword [esi + 0x720], 5
jne 0x44691a
call fcn.004135c0
test al, al
jne 0x446907
cmp dword [esi + 0x720], 5
jne 0x44691a
call fcn.004135c0
test al, al
jne 0x44691a
mov ecx, esi
call fcn.00448e10
test al, al
je 0x44687a
cmp dword [edi + 0x14], 8
jb 0x4468ef
mov edi, dword [edi]
push edi
push 0x111
push str.InstallUtil::StartInstall
push str.__s__d___return_in_IsVersionLower:_s
call fcn.0041f720
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x720]
cmp eax, 5
je 0x446973
cmp eax, 3
je 0x446973
cmp dword [ebp - 8], 2
jne 0x446973
cmp dword [edi + 0x14], 8
jb 0x446938
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x446940
mov ebx, dword [ebx]
mov edx, edi
mov ecx, ebx
call fcn.00410930
test eax, eax
js 0x446973
push str.360hb
lea ecx, [esi + 0x75c]
call fcn.00405760
test al, al
je 0x446973
push 0xe
push str.core_restore_2
lea ecx, [esi + 0x75c]
call fcn.00403e30
cmp dword [esi + 0x720], 6
jne 0x4469b2
mov ecx, esi
call fcn.00445a70
mov ecx, esi
mov byte [esi + 0x740], 1
call fcn.0044a100
mov ecx, esi
call fcn.00448920
mov ecx, esi
call fcn.0044e5c0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push esi
push 0x449320
push 0
push 0
call fcn.004ce8e1
mov edi, eax
add esp, 0x18
mov eax, dword [esi + 0x720]
cmp eax, 2
je 0x446a3c
cmp eax, 9
je 0x446a3c
push 0x2bf20
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0
jne 0x446a35
sub esp, 0x18
lea eax, [esi + 0x6d8]
mov ecx, esp
push eax
call fcn.00402f60
mov cl, 1
call fcn.004110c0
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00448230
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret