Function at 0x432fd0
Capabilities:
Create thread
Delete registry value
Persist via run registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x49d735
mov eax, dword fs:[0]
push eax
mov eax, 0x2d40
call fcn.00454e50
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x2d3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c1bd8]
xor eax, esp
push eax
lea eax, [esp + 0x2d54]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2d64]
push ebp
push str._Setup_Cmd_Line___s
mov dword [esp + 0x44], ebp
call fcn.0040cd20
push 0x498
xor edi, edi
lea eax, [esp + 0xf18]
push edi
mov esi, 1
push eax
mov dword [esp + 0x68], esi
call fcn.00454ce0
mov edx, dword [0x4c44d8]
mov eax, dword [edx + 0xc]
add esp, 0x14
mov ecx, 0x4c44d8
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov edx, dword [0x4c44d8]
mov eax, dword [edx + 0xc]
mov ecx, 0x4c44d8
mov dword [esp + 0x2d5c], edi
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
push 0x206
lea edx, [esp + 0x273e]
xor ecx, ecx
push edi
push edx
mov byte [esp + 0x2d68], 1
mov word [esp + 0x2744], cx
call fcn.00454ce0
add esp, 0xc
push 0x104
lea eax, [esp + 0x273c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4a4a54
push ebp
call fcn.00454de6
add esp, 8
test eax, eax
jne 0x4330e0
push 0x4a4a4c
push ebp
call fcn.00454de6
add esp, 8
mov byte [esp + 0x17], 0
test eax, eax
je 0x4330e5
mov byte [esp + 0x17], 1
push str._reinst
push ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x433112
push 0x4a4a1c
mov dword [esp + 0x34], esi
call fcn.0040cd20
add esp, 4
mov edx, dword [0x4c44d8]
mov eax, dword [edx + 0xc]
mov ecx, 0x4c44d8
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
movzx ecx, byte [esp + 0x17]
push ecx
push str._Setup_Check_param__s_and__Silent___d
mov byte [esp + 0x2d64], 2
call fcn.0040cd20
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x2744]
push eax
mov dword [esp + 0x68], edi
call fcn.00421c80
add esp, 0x10
test al, al
je 0x433194
mov bl, byte [esp + 0x58]
test bl, 1
je 0x433179
push str._Setup_I_am_a_silent_installer
call fcn.0040cd20
add esp, 4
mov byte [esp + 0x17], 1
test bl, 0x40
je 0x433194
push str._Setup_I_am_a_2in1_installer
call fcn.0040cd20
mov edi, 1
add esp, 4
mov dword [esp + 0x60], edi
push 1
push str.SOFTWARE360SD
lea ecx, [esp + 0x9ac]
call fcn.00410b80
lea ecx, [esp + 0x9a4]
mov byte [esp + 0x2d5c], 3
call fcn.00410b00
test eax, eax
je 0x4331d8
push str._Setup_Find_setupkilled___turn_to_silent_mode
call fcn.0040cd20
add esp, 4
cmp dword [esp + 0x30], 0
jne 0x4331d8
mov byte [esp + 0x17], 1
lea ecx, [esp + 0xa0]
call fcn.0043a350
push 0
push edi
lea ecx, [esp + 0xa8]
mov byte [esp + 0x2d64], 4
call fcn.0043c0f0
movzx ecx, byte [esp + 0x17]
push ecx
lea ecx, [esp + 0xa4]
call fcn.004346e0
lea ecx, [esp + 0xa0]
call fcn.00438360
test eax, eax
setne bl
lea ecx, [esp + 0x40]
mov byte [esp + 0x1f], bl
call fcn.00446c40
mov byte [esp + 0x2d5c], 5
test bl, bl
je 0x433286
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0xa4]
call fcn.0042e1c0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x2d60], 6
call fcn.00446fc0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x2d5c], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433291
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x433291
push 0
lea ecx, [esp + 0x44]
call fcn.00446fc0
lea ecx, [esp + 0x40]
call fcn.00447180
test eax, eax
je 0x433369
push 0x4a48bc
call fcn.0040cd20
add esp, 4
lea ecx, [esp + 0x40]
mov byte [esp + 0x2d5c], 4
call fcn.00446df0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2d5c], 3
call fcn.0043a550
lea ecx, [esp + 0x9a4]
mov byte [esp + 0x2d5c], 2
call fcn.00410bc0
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x2d5c], 1
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43330c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x2d5c], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433334
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x2d5c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43335f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x43458e
push 0x4a488c
call fcn.0040cd20
push 0xc6
xor ebx, ebx
lea edx, [esp + 0x163a]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x1640], cx
call fcn.00454ce0
push 0x206
lea ecx, [esp + 0x1b1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x1b24], ax
call fcn.00454ce0
push 0x206
lea eax, [esp + 0x2142]
xor edx, edx
push ebx
push eax
mov word [esp + 0x2148], dx
call fcn.00454ce0
push 0x206
lea edx, [esp + 0x192e]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x1934], cx
call fcn.00454ce0
push 0x206
lea ecx, [esp + 0x1f52]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x6c], ebx
mov word [esp + 0x1f58], ax
call fcn.00454ce0
add esp, 0x40
push 0x206
lea eax, [esp + 0x2536]
xor edx, edx
push ebx
push eax
mov word [esp + 0x253c], dx
call fcn.00454ce0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xa4]
xor edi, edi
call fcn.00426960
mov esi, dword [esp + 0x18]
push 3
push esi
push 0x4a4884
mov byte [esp + 0x2d68], 7
call fcn.0045600f
add esp, 0xc
test eax, eax
jne 0x433476
push esi
push 0x4a485c
call fcn.0040cd20
add esp, 8
lea edi, [ebx + 1]
jmp 0x433537
push 0x208
lea edx, [esp + 0x1d14]
push ebx
push edx
call fcn.00454ce0
lea eax, [esp + 0x2744]
push 0x5c
push eax
call fcn.004541d4
add esp, 0x14
cmp eax, ebx
je 0x4334b5
add eax, 2
push eax
push 0x208
lea ecx, [esp + 0x1d18]
push ecx
call fcn.0040d2b0
lea edx, [esp + 0x1d10]
push 0x5f
push edx
call fcn.00453ab2
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x433537
push 0x80
lea eax, [esp + 0x15b4]
push ebx
push eax
call fcn.00454ce0
add esp, 0xc
add esi, 2
push esi
push 0x80
lea ecx, [esp + 0x15b8]
push ecx
call fcn.0040d2b0
push str..exe
lea edx, [esp + 0x15b4]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, ebx
je 0x433515
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0x15b0]
push edx
lea ecx, [esp + 0x1c]
call fcn.0040ee40
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0xa4]
call fcn.00431970
push ebx
push 0x64
lea ecx, [esp + 0x1638]
push ecx
push str._pid
push ebp
call fcn.00421a10
add esp, 0x14
cmp eax, ebx
jg 0x43357a
push ebx
push 0x64
lea edx, [esp + 0x1638]
push edx
push str._partner
push ebp
call fcn.00421a10
xor ecx, ecx
add esp, 0x14
cmp eax, ebx
setg cl
mov eax, ecx
cmp eax, ebx
je 0x4335d2
lea edx, [esp + 0x1630]
push edx
lea ecx, [esp + 0x1c]
call fcn.0040ee40
mov esi, dword [esp + 0x18]
cmp esi, ebx
jne 0x433597
xor eax, eax
jmp 0x4335af
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4335a0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0xd0]
call fcn.0040df70
lea eax, [esp + 0x1630]
push eax
push str._Setup_Partner_s
call fcn.0040cd20
add esp, 8
cmp byte [esp + 0x17], 0
je 0x43374c
cmp edi, ebx
jne 0x43373f
lea ecx, [esp + 0x2c]
push ecx
push 1
push ebx
push str.SOFTWARE360SD
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x43374c
xor eax, eax
jmp 0x433610
movzx ecx, word [eax + 0x4a3ac4]
mov word [esp + eax + 0x2530], cx
add eax, 2
cmp cx, bx
jne 0x433610
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1f1c]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x3c]
push ecx
push ebx
lea edx, [esp + 0x2540]
push edx
push eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x43372e
push 0x4a47d8
call fcn.0040cd20
add esp, 4
mov ecx, 0x4a47d4
lea eax, [esp + 0x1f18]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4336a6
cmp dx, bx
je 0x4336a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4336a6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x433680
xor eax, eax
jmp 0x4336ab
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x43372e
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._Setup_silent_mode_and_itype2__exit_at_once
call fcn.0040cd20
add esp, 4
lea ecx, [esp + 0x18]
call fcn.0040da70
lea ecx, [esp + 0x40]
mov byte [esp + 0x2d5c], 4
call fcn.00446df0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2d5c], 3
call fcn.0043a550
lea ecx, [esp + 0x9a4]
mov byte [esp + 0x2d5c], 2
call fcn.00410bc0
lea ecx, [esp + 0x20]
call fcn.0040da70
lea ecx, [esp + 0x28]
call fcn.0040da70
lea ecx, [esp + 0x24]
call fcn.0040da70
mov eax, 1
jmp 0x43458e
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], ebx
jmp 0x43374c
push str._Setup_Pid
call fcn.0040cd20
add esp, 4
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0xa4]
call fcn.00426900
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x2d60], 8
call fcn.0040e240
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0x2d5c], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433797
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xa0]
call fcn.004347c0
test al, al
jne 0x433927
push 0x4a4708
call fcn.0040cd20
mov edi, dword [esp + 0x24]
add esp, 4
cmp byte [esp + 0x17], 0
jne 0x43384a
mov edx, dword [0x4c44f8]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [esp + 0x1b0c]
push ecx
push 0xed
push edx
call esi
push 1
push edi
lea eax, [esp + 0x1b10]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x43384a
push 0x206
lea edx, [esp + 0x232e]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x2334], cx
call fcn.00454ce0
mov ecx, dword [0x4c44f8]
add esp, 0xc
push 0x104
lea eax, [esp + 0x232c]
push eax
push 0x102
push ecx
call esi
lea edx, [esp + 0x2328]
push edx
call fcn.00422b30
add esp, 4
push 0x206
lea ecx, [esp + 0x1d16]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x1d1c], ax
call fcn.00454ce0
mov ebp, dword [esp + 0x24]
push 1
push ebp
lea edx, [esp + 0x1d24]
push str.http:__stat.sd.360.cn_setupfail.htm_pid_scase_d
push edx
call fcn.00421760
add esp, 0x1c
push ebx
push ebx
lea eax, [esp + 0x1d18]
push eax
push 0x422140
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x4338c2
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4338bb
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
mov byte [esp + 0x2d5c], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4338e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x2d5c], 4
call fcn.00446df0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2d5c], 3
call fcn.0043a550
lea ecx, [esp + 0x9a4]
mov byte [esp + 0x2d5c], 2
call fcn.00410bc0
lea eax, [edi - 0x10]
jmp 0x4332eb
call fcn.004115c0
push 0x206
lea edx, [esp + 0x2b4e]
mov edi, eax
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x5c], edi
mov word [esp + 0x2b54], cx
call fcn.00454ce0
push 0x206
lea ecx, [esp + 0x2952]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x2958], ax
call fcn.00454ce0
add esp, 0x18
cmp dword [esp + 0x60], ebx
jne 0x433af4
mov esi, dword [esp + 0xd0]
mov edx, edi
xor bl, bl
neg edx
sbb edx, edx
and edx, 0x20
add edx, 0x20
push edx
push esi
push str._Setup_Require_run_on__dbit_OS__and_now_run_on__dbit_OS
call fcn.0040cd20
add esp, 0xc
cmp esi, 0x20
jne 0x4339ad
test edi, edi
je 0x4339bd
lea edi, [esi + 0x20]
mov bl, 1
jmp 0x4339c5
cmp esi, 0x40
jne 0x4339bd
test edi, edi
jne 0x4339bd
lea edi, [esi - 0x20]
mov bl, 1
jmp 0x4339c5
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x54]
push 0x104
lea eax, [esp + 0x2944]
push eax
lea ecx, [esp + 0xa8]
call fcn.00436420
test bl, bl
je 0x433af4
cmp byte [esp + 0x17], 0
jne 0x433a8d
mov edx, dword [0x4c44f8]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [esp + 0x1904]
push ecx
push 0xef
push edx
call ebx
push edi
push esi
lea eax, [esp + 0x1908]
push eax
lea ecx, [esp + 0x1b14]
push ecx
call fcn.00421760
mov eax, dword [0x4c44f8]
add esp, 0x10
push 0x104
lea edx, [esp + 0x1904]
push edx
push 0xea
push eax
call ebx
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x1904]
push edx
lea eax, [esp + 0x2128]
push eax
call fcn.00421760
add esp, 0xc
push 0x40
lea ecx, [esp + 0x2124]
push ecx
lea edx, [esp + 0x1b10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x2940]
push eax
call fcn.00413ec0
add esp, 4
lea ecx, [esp + 0x18]
call fcn.0040da70
lea ecx, [esp + 0x40]
mov byte [esp + 0x2d5c], 4
call fcn.00446df0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2d5c], 3
call fcn.0043a550
lea ecx, [esp + 0x9a4]
mov byte [esp + 0x2d5c], 2
call fcn.00410bc0
lea ecx, [esp + 0x20]
call fcn.0040da70
lea ecx, [esp + 0x28]
call fcn.0040da70
lea ecx, [esp + 0x24]
call fcn.0040da70
mov eax, 1
jmp 0x43458e
cmp byte [esp + 0x1f], 0
jne 0x433bb1
call fcn.0042c590
test eax, eax
je 0x433bb1
cmp byte [esp + 0x17], 0
jne 0x433a8d
mov edx, dword [0x4c44f8]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [esp + 0x1904]
push ecx
push 0x10c
push edx
call esi
mov edi, dword [esp + 0x20]
push edi
lea eax, [esp + 0x1904]
push eax
lea ecx, [esp + 0x1b10]
push 0x208
push ecx
call fcn.0040d340
mov eax, dword [0x4c44f8]
add esp, 0x10
push 0x104
lea edx, [esp + 0x1904]
push edx
push 0xea
push eax
call esi
push edi
lea ecx, [esp + 0x1904]
push ecx
lea edx, [esp + 0x2128]
push 0x208
push edx
call fcn.0040d340
add esp, 0x10
push 0x40
lea eax, [esp + 0x2124]
push eax
lea ecx, [esp + 0x1b10]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x433a8d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004124d0
mov ebx, dword [esp + 0x24]
mov ebp, dword [sym.imp.USER32.dll_LoadStringW]
add esp, 4
test eax, eax
setne al
test al, al
jne 0x433c21
push str._Setup_Not_admin_User
call fcn.0040cd20
add esp, 4
cmp byte [esp + 0x17], 0
jne 0x433a8d
mov eax, dword [0x4c44f8]
push 0x104
lea edx, [esp + 0x1b0c]
push edx
push 0xe4
push eax
call ebp
push 0x24
push ebx
lea ecx, [esp + 0x1b10]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x433a8d
lea edx, [esp + 0x2c]
push edx
push 0xf003f
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetServices360AvFlt
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x433cca
xor eax, eax
jmp 0x433c50
movzx ecx, word [eax + str.DeleteFlag]
mov word [esp + eax + 0x2530], cx
add eax, 2
cmp cx, di
jne 0x433c50
mov eax, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x3c]
push edx
push edi
lea eax, [esp + 0x2540]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x433cbb
push str._Setup_Delete_DeleteFlag
call fcn.0040cd20
mov eax, dword [esp + 0x30]
add esp, 4
lea edx, [esp + 0x2530]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], edi
mov dl, byte [esp + 0x1f]
mov al, byte [esp + 0x17]
lea ecx, [esp + 0x28]
push ecx
push str._360safe.exe_
lea ecx, [esp + 0xa8]
mov dword [esp + 0xf18], edi
mov byte [esp + 0xf15], dl
mov byte [esp + 0xf14], al
call fcn.00437b40
test al, al
je 0x433d2c
mov edx, dword [esp + 0x28]
push edx
push str._Setup_Find_360safe:___s_
call fcn.0040cd20
mov eax, dword [esp + 0x30]
push 0x104
push eax
lea ecx, [esp + 0x11ac]
push ecx
call fcn.00455578
add esp, 0x14
jmp 0x433d43
push str._Setup_Not_find_360safe
call fcn.0040cd20
add esp, 4
xor edx, edx
mov word [esp + 0x119c], dx
push 0x206
lea ecx, [esp + 0x16fe]
xor eax, eax
push edi
push ecx
mov word [esp + 0x1704], ax
call fcn.00454ce0
mov eax, dword [esp + 0x48]
push 1
push 0x104
lea edx, [esp + 0x170c]
push edx
push 0x4a4534
push eax
call fcn.00421a10
mov esi, eax
add esp, 0x20
cmp esi, edi
jle 0x433e5d
mov ecx, 0x5c
mov dword [esp + 0x5c], 1
cmp cx, word [esp + esi*2 + 0x16f6]
jne 0x433dad
dec esi
xor edx, edx
mov word [esp + esi*2 + 0x16f8], dx
lea eax, [esp + 0x16f8]
push eax
call fcn.0042a3c0
add esp, 4
test al, al
je 0x433e53
push str.360sd
lea ecx, [esp + 0x16fc]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, edi
je 0x433e0f
push 6
lea edx, [esp + esi*2 + 0x16f0]
push str.360sd
push edx
call fcn.0045600f
add esp, 0xc
test eax, eax
je 0x433e5d
lea eax, [esp + 0x16f8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x433e01
jmp 0x433e2c
lea eax, [esp + 0x16f8]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x433e20
mov ecx, dword [str.360sd]
mov edx, dword [0x4a3930]
mov dword [eax], ecx
mov ecx, dword [0x4a3934]
mov dword [eax + 4], edx
mov dx, word [0x4a3938]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
jmp 0x433e5d
xor eax, eax
mov word [esp + 0x16f8], ax
mov ecx, dword [esp + 0x18]
push 0x40
push ecx
lea edx, [esp + 0xf1c]
push edx
call fcn.00455578
add esp, 0xc
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0xbb4]
call fcn.004444f0
mov byte [esp + 0x2d5c], 9
cmp dword [esp + 0x30], edi
je 0x433ea9
lea ecx, [esp + 0x16f8]
push ecx
lea ecx, [esp + 0x28]
call fcn.0040ee40
jmp 0x433edd
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0xa4]
call fcn.00438a70
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d60], 0xa
call fcn.0040e240
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2d5c], 9
call fcn.0040da70
mov edi, dword [esp + 0x24]
push edi
push 0x4a450c
call fcn.0040cd20
push 0x104
lea eax, [esp + 0xfa0]
push edi
push eax
call fcn.00455578
add esp, 0x14
cmp byte [esp + 0x1f], 0
lea ecx, [esp + 0xf0c]
mov dword [esp + 0xbf4], ecx
jne 0x4340ca
cmp dword [esp + 0x50], 0
je 0x4340ca
cmp dword [esp + 0x30], 0
jne 0x4340ca
lea edx, [esp + 0x2c]
push edx
push 1
push 0
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUNONCE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [esp + 0x2c]
je 0x433f5a
test eax, eax
je 0x4340ca
xor ecx, ecx
lea edx, [esp + 0x38]
push edx
mov word [esp + 0x1f1c], cx
lea ecx, [esp + 0x1f1c]
push ecx
lea edx, [esp + 0x3c]
push edx
xor esi, esi
push esi
push str.sdel
push eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433fa3
cmp word [esp + 0x1f18], ax
jne 0x433fef
xor eax, eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x1f1c]
push edx
mov word [esp + 0x1f20], ax
lea eax, [esp + 0x3c]
push eax
push 0
push str.Delete360sd
push ecx
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433ff4
cmp word [esp + 0x1f18], ax
je 0x433ff4
mov esi, 1
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], 0
test esi, esi
je 0x4340ca
cmp byte [esp + 0x17], 0
jne 0x4340a4
mov ecx, dword [0x4c44f8]
push 0x104
lea eax, [esp + 0x1904]
push eax
push 0xf4
push ecx
call ebp
push ebx
lea edx, [esp + 0x1904]
push edx
lea eax, [esp + 0x1b10]
push eax
call fcn.00421760
mov edx, dword [0x4c44f8]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1904]
push ecx
push 0xea
push edx
call ebp
push ebx
lea eax, [esp + 0x1904]
push eax
lea ecx, [esp + 0x2128]
push ecx
call fcn.00421760
add esp, 0xc
push 0x144
lea edx, [esp + 0x2124]
push edx
lea eax, [esp + 0x1b10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x4340ca
push 0x4a4448
call fcn.0040cd20
add esp, 4
lea ecx, [esp + 0xbb0]
mov byte [esp + 0x2d5c], 7
call fcn.00444010
jmp 0x433a8d
lea ecx, [esp + 0xbb0]
call fcn.0043f2d0
test al, al
jne 0x4340e1
push str._Setup_Extract_7z.Cab_failed__exit_at_once
jmp 0x4340a9
cmp byte [esp + 0x17], 0
jne 0x434118
push 0x104
lea ecx, [esp + 0x2b4c]
push ebx
push ecx
call fcn.00455578
lea edx, [esp + 0x294c]
push edx
lea eax, [esp + 0x2b58]
push eax
call fcn.00432520
add esp, 0x14
cmp eax, 1
je 0x4340b1
lea ecx, [esp + 0xbb0]
call fcn.004433e0
cmp eax, 1
jne 0x434133
push str._Setup_Run_OnInit_functions_and_return_STOP_symbol__exit_at_once
jmp 0x4340a9
xor esi, esi
push esi
push str.SOFTWARE360SD
lea ecx, [esp + 0x13ac]
call fcn.00410b80
cmp byte [esp + 0x17], 0
mov ebp, dword [esp + 0x30]
mov bl, 0xb
mov byte [esp + 0x2d5c], bl
jne 0x4342aa
cmp ebp, esi
jne 0x4342b2
mov dword [esp + 0x68], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
lea ecx, [esp + 0x68]
push ecx
mov bl, 0xd
mov ecx, 0x4c4118
mov byte [esp + 0x2d60], bl
call fcn.0042df90
mov edx, dword [0x4c44f8]
push edx
call fcn.00448830
add esp, 4
lea ecx, [esp + 0x19c]
call fcn.004319f0
push edi
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x2d60], 0xe
call fcn.004319b0
lea ecx, [esp + 0xf0c]
push esi
lea eax, [esp + 0xbb4]
mov dword [esp + 0x664], ecx
push esi
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x664], eax
call fcn.0042e350
test eax, eax
jne 0x434249
lea ecx, [esp + 0x19c]
mov byte [esp + 0x2d5c], bl
call fcn.0042f0f0
lea ecx, [esp + 0x68]
call fcn.0042b130
lea ecx, [esp + 0x13a4]
mov byte [esp + 0x2d5c], 9
call fcn.00410bc0
lea ecx, [esp + 0xbb0]
mov byte [esp + 0x2d5c], 7
call fcn.00444010
jmp 0x433a8d
mov edx, dword [esp + 0x1a0]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
lea ecx, [esp + 0x1a4]
call fcn.00423e40
lea ecx, [esp + 0x68]
call fcn.0042acf0
mov esi, eax
push esi
push 0x4a4344
call fcn.0040cd20
add esp, 8
mov ecx, 0x4c4118
call fcn.0042e590
lea ecx, [esp + 0x19c]
mov byte [esp + 0x2d5c], bl
call fcn.0042f0f0
lea ecx, [esp + 0x68]
call fcn.0042b130
jmp 0x434507
cmp ebp, esi
je 0x434358
lea ecx, [esp + 0x30]
call fcn.0040da50
mov byte [esp + 0x2d5c], 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00412080
lea ecx, [esp + 0x34]
push ecx
push eax
mov dword [esp + 0x48], eax
call fcn.004181c0
lea edx, [esp + 0x48]
push edx
call fcn.0044fa70
add esp, 0x10
test eax, eax
jne 0x434348
mov eax, dword [esp + 0x30]
push eax
call fcn.00451120
add esp, 4
test eax, eax
jne 0x434348
mov ecx, dword [esp + 0x30]
push ecx
push 0x4a4314
call fcn.0040cd20
add esp, 8
lea ecx, [esp + 0x30]
call fcn.0040da70
lea ecx, [esp + 0x13a4]
mov byte [esp + 0x2d5c], 9
call fcn.00410bc0
lea ecx, [esp + 0xbb0]
mov byte [esp + 0x2d5c], 7
call fcn.00444010
jmp 0x433a8d
lea ecx, [esp + 0x30]
mov byte [esp + 0x2d5c], bl
call fcn.0040da70
cmp byte [esp + 0x1f], 0
jne 0x43449c
push 0x206
lea eax, [esp + 0x1d16]
xor edx, edx
push esi
push eax
mov word [esp + 0x1d1c], dx
call fcn.00454ce0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1d14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x1d10]
push edx
call fcn.00421aa0
add esp, 4
test eax, eax
jne 0x434469
push 0x206
push eax
lea ecx, [esp + 0x2332]
push ecx
mov word [esp + 0x2334], ax
call fcn.00454ce0
mov edx, dword [esp + 0x24]
push 2
push edx
push str.http:__stat.sd.360.cn_setupfail.htm_pid_scase_d
lea eax, [esp + 0x2340]
push 0x208
push eax
call fcn.0040d340
add esp, 0x20
push 0
push 0
lea ecx, [esp + 0x2330]
push ecx
push 0x422140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x43442f
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x434428
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4a42e8
call fcn.0040cd20
add esp, 4
lea ecx, [esp + 0x13a4]
mov byte [esp + 0x2d5c], 9
call fcn.00410bc0
lea ecx, [esp + 0xbb0]
mov byte [esp + 0x2d5c], 7
call fcn.00444010
jmp 0x433a8d
cmp dword [esp + 0x5c], esi
je 0x43449c
xor edx, edx
cmp dx, word [esp + 0x16f8]
jne 0x434482
push 0x4a42c0
jmp 0x434434
lea eax, [esp + 0x16f8]
push eax
push 0x208
lea ecx, [esp + 0xf9c]
push ecx
call fcn.0040d2b0
lea edx, [esp + 0xf94]
push edx
push str._Setup_SilentInstPath_s
call fcn.0040cd20
add esp, 8
lea eax, [esp + 0xf94]
push eax
lea ecx, [esp + 0xa4]
call fcn.0043a7a0
test eax, eax
je 0x4344ee
cmp ebp, esi
je 0x4344d5
mov byte [esp + 0xf0c], 1
push ebp
lea ecx, [esp + 0xf10]
push ecx
lea ecx, [esp + 0xbb8]
call fcn.00446500
mov esi, eax
jmp 0x434507
lea edx, [esp + 0xf94]
push edx
push 0x4a4260
call fcn.0040cd20
mov esi, dword [esp + 0x5c]
add esp, 8
lea ecx, [esp + 0x13a4]
mov byte [esp + 0x2d5c], 9
call fcn.00410bc0
lea ecx, [esp + 0xbb0]
mov byte [esp + 0x2d5c], 7
call fcn.00444010
lea ecx, [esp + 0x18]
call fcn.0040da70
lea ecx, [esp + 0x40]
mov byte [esp + 0x2d5c], 4
call fcn.00446df0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2d5c], 3
call fcn.0043a550
lea ecx, [esp + 0x9a4]
mov byte [esp + 0x2d5c], 2
call fcn.00410bc0
lea ecx, [esp + 0x20]
call fcn.0040da70
lea ecx, [esp + 0x28]
call fcn.0040da70
lea ecx, [esp + 0x24]
call fcn.0040da70
mov eax, esi
mov ecx, dword [esp + 0x2d54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d3c]
xor ecx, esp
call fcn.00454cc7
add esp, 0x2d4c
ret