Function at 0x490ee3
Capabilities:
Check for time delay via gettickcount
Check if file exists
Create thread
Delete registry value
Get common file path
Read .ini file

Disassembly:
push 0x458
mov eax, 0x5337e7
call fcn.004fc737
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x434], esi
call fcn.0048fec5
push str.Global360connect_mutex
lea eax, [ebp - 0x42c]
push eax
call fcn.004056ee
lea eax, [ebp - 0x42c]
mov edi, 0x594714
mov dword [ebp - 4], esi
call fcn.00404477
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
call fcn.00405521
push esi
call fcn.0046a2c0
mov dword [esp], 0x593d60
call fcn.0043c0f6
test al, al
je 0x490f56
mov eax, dword [ebx + 4]
mov dword [0x593d9c], eax
call fcn.00491b94
push str.ManExit
push str.SOFTWARE360Safe_stat
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xffffffffffffffff
push str.360InternationTray_shared.xml
call fcn.0046a5db
pop ecx
pop ecx
lea edi, [ebx + 0x454]
mov ecx, edi
call fcn.00428dae
cmp eax, esi
jl 0x490f93
mov byte [edi + 0x18], 1
xor ecx, ecx
cmp eax, esi
setge cl
mov eax, ecx
cmp eax, esi
je 0x490fa7
mov eax, ebx
call fcn.004996d2
mov eax, dword [ebx + 4]
mov dword [0x5937f0], eax
lea eax, [ebx + 0x6c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call fcn.00444ab1
call fcn.004885a9
cmp dword [0x593700], 1
jne 0x490fe3
cmp dword [0x59370c], esi
je 0x490fe3
call fcn.004d31b0
call fcn.0048caab
lea eax, [ebp - 0x42c]
push eax
push esi
push esi
push 0x48c73d
push esi
push esi
mov dword [ebp - 0x42c], esi
mov byte [0x593776], 0
call fcn.004f5629
add esp, 0x18
mov dword [0x5887d0], eax
call fcn.0048cbf2
cmp dword [0x5887d0], 0xffffffff
je 0x491027
or dword [ebx + 0x52c], 2
lea edi, [ebx + 0x24]
push edi
lea eax, [ebx + 0x370]
push eax
call fcn.0047a946
mov eax, dword [edi]
push 0x594818
push str.CLSID_IPCS_DDMANAGE.1
mov ecx, edi
call dword [eax + 0x30]
lea eax, [ebx + 0x2f8]
push 1
mov ecx, ebx
mov dword [ebx + 0x364], edi
mov dword [0x593798], eax
call fcn.00496c5b
mov ecx, ebx
call fcn.00497492
call fcn.00405ac9
test al, al
je 0x4910d8
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.004f18b0
add esp, 0xc
push str.ipc360hvm.dll
push 0x593e48
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call fcn.004059c6
pop ecx
cmp eax, esi
je 0x4910d8
push str.GetCpuInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x4910d8
lea ecx, [ebp - 0x42c]
push ecx
mov dword [ebp - 0x42c], esi
call eax
pop ecx
call fcn.004ac4bb
mov esi, ebx
call fcn.004977df
cmp dword [0x590dac], 0
je 0x4910f3
push ebx
call fcn.0049c92c
push 0
push ecx
call int.0040b2f7
add esp, 4
call fcn.0047795e
cmp eax, 1
jne 0x491112
mov dword [0x588764], 0x2932e00
call fcn.0044f12b
push 0x13
mov esi, ebx
call fcn.0049cd22
lea ecx, [ebp - 0x450]
call fcn.004270bb
lea ecx, [ebp - 0x428]
push 0x54a33c
push ecx
mov edi, eax
mov dword [ebp - 4], 1
call fcn.00405a46
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x450]
add eax, 0xfffffff0
call fcn.00405521
push dword [ebp - 0x428]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x493e0
push str.AutoRunFirst
mov edi, str.Test
push edi
call esi
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], eax
push 0x325aa0
push str.AutoRunFirstLater
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x588740], eax
push 0x517b60
push str.AutoRunVdb
push edi
call esi
push dword [ebp - 0x428]
mov dword [ebp - 0x458], eax
push 0x7d0
push str.AutoRunVdbForce
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x588754], eax
push 0x1499700
push str.AutoRunPackage
push edi
call esi
push dword [ebp - 0x428]
mov dword [ebp - 0x454], eax
push 0x467ee0
push str.AutoRunModule
push edi
call esi
push dword [ebp - 0x428]
mov dword [ebp - 0x43c], eax
push 0x2dc6c0
push str.AutoOnlieChkFirst
push edi
call esi
push dword [ebp - 0x428]
mov dword [ebp - 0x460], eax
push 0x1499700
push str.AutoOnlieChkLater
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x588744], eax
push 0x36ee80
push str.AutoOnlieChkSkip
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x588748], eax
push 0x927c0
push str.LastTrashCleanCheck
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x58874c], eax
push 0x36ee80
push str.NextTrashCleanCheck
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x588750], eax
push 0x401640
push str.StartRecycleBinCheck
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x58875c], eax
push 0x493e00
push str.StartDesktopOrganizerCheck
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x588760], eax
push dword [0x588764]
push str.PopTipRePeat
push edi
call esi
push dword [ebp - 0x428]
mov dword [0x588764], eax
push dword [0x588768]
push str.StartDuplicateCleaner
push edi
call esi
cmp dword [ebp - 0x428], 0
mov dword [0x588768], eax
je 0x4912e7
push dword [ebp - 0x428]
call fcn.0049f382
mov eax, 0x593e48
call fcn.0044a435
mov edi, dword [sym.imp.USER32.dll_SetTimer]
test al, al
jne 0x491310
xor esi, esi
push esi
push dword [0x58874c]
push 0x709
push dword [ebx + 4]
call edi
jmp 0x491312
xor esi, esi
mov eax, dword [ebp - 0x42c]
lea ecx, [eax - 0x2710]
push esi
cmp ecx, 0x46cd0
ja 0x49132a
push eax
jmp 0x49132f
push 0x493e0
push 0x3e8
push dword [ebx + 4]
call edi
mov eax, dword [ebp - 0x458]
lea ecx, [eax - 0x2710]
push esi
cmp ecx, 0x515450
ja 0x491351
push eax
jmp 0x491356
push 0x517b60
push 0x3ed
push dword [ebx + 4]
call edi
mov eax, dword [ebp - 0x454]
lea ecx, [eax - 0x2710]
push esi
cmp ecx, 0x1496ff0
ja 0x491378
push eax
jmp 0x49137d
push 0x1499700
push 0x3ee
push dword [ebx + 4]
call edi
cmp dword [0x593800], esi
je 0x4913b6
mov eax, dword [ebp - 0x460]
lea ecx, [eax - 0x2710]
push esi
cmp ecx, 0x2d9fb0
ja 0x4913a7
push eax
jmp 0x4913ac
push 0x2dc6c0
push 0x455
push dword [ebx + 4]
call edi
mov eax, dword [ebp - 0x43c]
lea ecx, [eax - 0x2710]
push esi
cmp ecx, 0x4657d0
ja 0x4913ce
push eax
jmp 0x4913d3
push 0x467ee0
push 0x3ef
push dword [ebx + 4]
call edi
call fcn.0040cd57
test al, al
je 0x4913f6
push esi
push 0x4e20
push 0x3f6
push dword [ebx + 4]
call edi
push esi
push 0x1499700
push 0x3e9
push dword [ebx + 4]
call edi
push esi
push 0xea60
push 0x3ea
push dword [ebx + 4]
call edi
push esi
push 0xea60
push 0xbb9
push dword [ebx + 4]
call edi
push esi
push 0xbb8
push 0x3f2
push dword [ebx + 4]
call edi
push esi
push 0x1388
push 0x3f4
push dword [ebx + 4]
call edi
push esi
push 0xdbba0
push 0x5dc
push dword [ebx + 4]
call edi
mov dword [ebp - 0x448], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x927c0
ja 0x491499
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x491499
cmp dword [ebp - 0x448], esi
jne 0x491499
push esi
push 0xbb8
push 0x3eb
push dword [ebx + 4]
call edi
call fcn.0048f2ad
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], edx
call fcn.0044ff8c
sub eax, dword [ebp - 0x444]
mov dword [ebp - 0x460], edx
push eax
call fcn.004fb13a
cmp eax, 5
pop ecx
jl 0x49150b
mov dword [ebp - 0x42c], 0xea60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x927c0
jae 0x4914fa
mov ecx, 0x927c0
sub ecx, eax
mov eax, 0xea60
mov dword [ebp - 0x42c], ecx
cmp ecx, eax
jae 0x4914fa
mov dword [ebp - 0x42c], eax
push esi
push dword [ebp - 0x42c]
push 0x3f0
push dword [ebx + 4]
call edi
push esi
push 0x2bf20
push 0x3f3
push dword [ebx + 4]
call edi
lea edi, [ebx + 0x490]
call fcn.004a3b7d
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2e0], eax
call fcn.0049a050
mov dword [ebx + 0x12c], eax
cmp eax, esi
je 0x49154f
call fcn.00410cdd
test al, al
je 0x49154f
push 1
push ebx
call fcn.0049a07d
xor edi, edi
push edi
lea eax, [ebx + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, ebx
call fcn.0049ab32
cmp dword [ebx + 0x4cc], edi
je 0x491575
mov eax, ebx
call fcn.0049adf7
mov eax, ebx
call fcn.0049ae3f
cmp dword [ebx + 0x4d4], edi
je 0x49158b
mov esi, ebx
call fcn.0049aec6
mov esi, ebx
call fcn.0049b191
cmp dword [ebx + 0x4dc], edi
je 0x4915a1
mov eax, ebx
call fcn.0049b2a7
lea esi, [ebx + 0x514]
cmp dword [esi], edi
jne 0x4915b7
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
lea esi, [ebx + 0x518]
cmp dword [esi], edi
jne 0x4915cd
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov dword [ebx + 0x640], 0x80000001
call fcn.00490e78
test al, al
jne 0x49199f
mov eax, dword [0x59366c]
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x43c], edi
lea esi, [ebp - 0x444]
mov byte [ebp - 4], 4
call fcn.00418775
test al, al
je 0x49161f
mov ecx, esi
mov dword [ebp - 0x43c], SysStringLen
call fcn.00406275
lea eax, [ebx + 0x640]
push eax
call fcn.0040673b
lea esi, [ebx + 0x644]
cmp dword [esi], edi
jne 0x491657
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x491657
cmp eax, edi
je 0x491657
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
je 0x491657
cmp eax, edi
je 0x491657
mov dword [esi], SysStringLen
mov byte [esi + 4], 0
call fcn.00406a3d
test al, al
je 0x491665
call fcn.00406e59
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x444]
cmp dword [0x59366c], eax
je 0x49167e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
lea esi, [ebx + 0x65c]
call fcn.004aa7af
test al, al
je 0x4916c4
call fcn.004aafa7
test al, al
je 0x4916c4
call fcn.004aafd8
test al, al
je 0x4919bb
call int.0040b2f7
call fcn.0048f197
test al, al
jne 0x4916be
mov eax, esi
call fcn.004aacdb
push esi
call fcn.004aae75
xor esi, esi
push esi
push 0x1b7740
push 0x4a6
push dword [ebx + 4]
call edi
cmp dword [0x5937ec], esi
je 0x4916ee
push esi
push 0xbb8
push 0x70c
push dword [ebx + 4]
call edi
or dword [ebx + 0x52c], 1
push esi
push 0x2710
push 0x5e3
push dword [ebx + 4]
call edi
push esi
push dword [0x5885cc]
push 0x456
push dword [ebx + 4]
call edi
push esi
push 0x493e0
push 0x6a4
push dword [ebx + 4]
call edi
push esi
push dword [0x588728]
push 0x45a
push dword [ebx + 4]
call edi
push esi
push 0x1b7740
push 0x45d
push dword [ebx + 4]
call edi
push esi
push dword [0x58872c]
push 0x45e
push dword [ebx + 4]
call edi
push esi
push dword [0x588730]
push 0x45f
push dword [ebx + 4]
call edi
push esi
push dword [0x588734]
push 0x460
push dword [ebx + 4]
call edi
push esi
push 0xdbba0
push 0x70e
push dword [ebx + 4]
call edi
push esi
push 0x493e0
push 0x710
push dword [ebx + 4]
call edi
mov eax, 0x593e48
call fcn.0044a435
test al, al
je 0x4917b8
push esi
push 0x7530
push 0x70f
push dword [ebx + 4]
call edi
mov eax, dword [0x58874c]
mov ecx, 0x927c0
mov edx, 0x1d4c0
cmp eax, ecx
ja 0x4917cf
cmp eax, edx
jae 0x4917d6
mov eax, ecx
mov dword [0x58874c], eax
mov ecx, dword [0x588750]
cmp ecx, 0x36ee80
ja 0x4917e8
cmp ecx, edx
jae 0x4917f2
mov dword [0x588750], 0x36ee80
mov ecx, dword [0x588754]
mov edx, 0x7d0
cmp ecx, edx
ja 0x491809
cmp ecx, 0x2710
jae 0x49180f
mov dword [0x588754], edx
push esi
push eax
push 0x457
push dword [ebx + 4]
call edi
call fcn.00475c98
test al, al
je 0x49182d
push esi
push dword [ebx + 4]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
call fcn.0043a0be
test al, al
je 0x491868
cmp dword [0x593800], esi
je 0x491868
lea eax, [ebp - 0x43c]
push eax
call fcn.00484912
pop ecx
push dword [eax]
mov dword [ebp - 0x434], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 0x42d], 1
test eax, eax
jne 0x49186f
mov byte [ebp - 0x42d], 0
test byte [ebp - 0x434], 1
je 0x491886
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
call fcn.00405521
cmp byte [ebp - 0x42d], 0
je 0x4918a0
push esi
push dword [0x58875c]
push 0x45b
push dword [ebx + 4]
call edi
call fcn.0043a19f
test al, al
je 0x4918f8
push str.DesktopPlus.exe
call fcn.00410b35
pop ecx
cmp eax, 0xffffffff
jne 0x4918f8
push str.DesktopPlus64.exe
call fcn.00410b35
pop ecx
cmp eax, 0xffffffff
jne 0x4918f8
push esi
push ecx
call int.0040b2f7
add esp, 4
call fcn.0047795e
cmp eax, 1
je 0x4918f8
call fcn.004495b1
cmp eax, 7
jbe 0x4918f8
push esi
push dword [0x588760]
push 0x461
push dword [ebx + 4]
call edi
lea esi, [ebx + 0x6f0]
mov ecx, esi
call fcn.0048dbef
push 0x3f4
mov eax, esi
call fcn.0048dd81
lea esi, [ebp - 0x44c]
mov byte [ebx + 0x94c], al
mov dword [ebp - 0x44c], 1
call fcn.0043703b
cmp dword [ebp - 0x44c], 1
push ebx
sete al
mov byte [ebx + 0x11a0], al
call fcn.004a29e4
test al, al
je 0x491953
mov edi, ebx
call fcn.004a28b6
mov edi, dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x593800], 0
je 0x491967
lea esi, [ebx + 0x11c0]
call fcn.00440eb2
call fcn.004a2a4f
test al, al
je 0x491a68
call int.0040b2f7
mov esi, eax
cmp byte [esi + 0x270], 0
jne 0x491989
call fcn.0040b0c3
cmp dword [esi], 0
je 0x4919c9
mov esi, dword [esi + 0x258]
test esi, esi
je 0x4919c9
push 0
call esi
pop ecx
jmp 0x4919cc
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x3e8
push 0x4b1
push dword [ebx + 4]
call edi
jmp 0x491684
xor esi, esi
push esi
call fcn.004aaf5b
pop ecx
jmp 0x4916c6
xor eax, eax
inc eax
test eax, eax
jne 0x491a68
call fcn.004a2ad7
test eax, eax
jne 0x491a68
push 0x206
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x491a68
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x434], eax
push str.360TotalSecurityDesktopPlusDesktopPlus.exe
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x434]
push 0x54823c
push eax
mov byte [ebp - 4], 5
call fcn.0040450f
push esi
push 5
push esi
mov esi, dword [ebp - 0x434]
mov eax, esi
call fcn.0044972a
add esp, 0x1c
lea eax, [esi - 0x10]
call fcn.00405521
push 0
push 0x927c0
push 0x70b
push dword [ebx + 4]
call edi
push 0
push dword [0x588768]
push 0x70d
push dword [ebx + 4]
call edi
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
call fcn.00405521
xor eax, eax
call fcn.004fc7ba
ret 4