Function at 0x433110
Capabilities:
Accept command line arguments
Check os version
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536184
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 8
push eax
mov dword [ebp - 0x428], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x551300
push 0
call fcn.004ee095
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x551304
call fcn.0043d8f0
add esp, 8
mov ecx, 0x599518
push 0
push dword [0x59544c]
push 0
call fcn.00431ee0
lea ecx, [ebp - 0x448]
call fcn.00410d20
mov dword [ebp - 4], 0
call fcn.00431c60
mov ecx, eax
call fcn.0048ad80
mov eax, dword [0x5995e4]
test al, 1
jne 0x4331fe
or eax, 1
mov dword [0x5995e4], eax
mov ecx, 0x5995e0
mov byte [ebp - 4], 1
call fcn.00444e30
push 0x549600
call fcn.0049bcd2
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x5995e0
call fcn.00444e80
push esi
call fcn.00431ba0
mov ecx, eax
call fcn.00425f10
push esi
push str.lpstrCmdLine_s
call fcn.0043d8f0
add esp, 8
call fcn.00431ba0
mov ecx, eax
call fcn.004276d0
push eax
call fcn.00444710
mov ecx, 0x599554
call fcn.004117d0
test eax, eax
jne 0x433265
push str.CheckSingleInstance_failed__exit
call fcn.0043d8f0
add esp, 4
push 0
push 0
push 0x551394
push 0
call fcn.00444720
jmp 0x433762
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 2
push eax
call fcn.00475ea5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x444]
push eax
push 0x42ead0
push 0x5995d8
call fcn.00476e7d
add esp, 0x10
test eax, eax
je 0x433955
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 4
push eax
call fcn.00475edf
mov ecx, dword [0x5995d4]
add esp, 4
mov byte [ebp - 4], 0
call fcn.00426cd0
test eax, eax
jne 0x4332f6
call fcn.004312e0
test eax, eax
jne 0x4332f6
push eax
push eax
push 0x5513b0
push eax
call fcn.00444720
jmp 0x433762
call fcn.00431ba0
mov ecx, eax
call fcn.004259b0
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 7
push eax
call fcn.00475ea5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x444]
push eax
push 0x42ead0
push 0x5995d8
call fcn.00476e7d
add esp, 0x10
test eax, eax
je 0x433939
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 9
push eax
call fcn.00475edf
mov ecx, dword [0x5995d4]
add esp, 4
mov byte [ebp - 4], 0
call fcn.004277b0
sub esp, 0x28
test eax, eax
mov eax, esp
mov dword [ebp - 0x430], esp
mov dword [eax + 0x24], 0
je 0x433482
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0xd
push eax
call fcn.00475ea5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x438]
push eax
push 0x41d9f0
push 0x594e2c
call fcn.00476e7d
add esp, 0x10
test eax, eax
je 0x43345e
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0xf
push eax
call fcn.00475edf
add esp, 4
mov byte [ebp - 4], 0xc
push 0
push 0
push str.update_1
jmp 0x4334f2
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x10
push eax
call fcn.00475f21
add esp, 4
mov byte [ebp - 4], 0xe
test al, al
je 0x433987
jmp 0x433971
mov byte [ebp - 0x421], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x13
push eax
call fcn.00475ea5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x421]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x438]
push eax
push 0x41d9f0
push 0x594e2c
call fcn.00476e7d
add esp, 0x10
test eax, eax
je 0x43391d
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x15
push eax
call fcn.00475edf
add esp, 4
mov byte [ebp - 4], 0x12
push 0
push 0
push str.install_1
mov ecx, dword [0x594e28]
mov byte [ebp - 4], 0
call fcn.0041a530
call fcn.00432000
test eax, eax
jne 0x433524
mov ecx, 0x599554
call fcn.00411e20
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x433762
push 0x110
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0x114
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jae 0x433586
call fcn.00431ba0
mov ecx, eax
call fcn.004276d0
test eax, eax
jne 0x433762
push 0x40
push str.S_MRHr_g
push 0x5512ec
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x433762
call fcn.004327b0
test eax, eax
jne 0x4335ca
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x430], esp
mov dword [eax + 0x24], 0
push 0
push 0
lea ecx, [ebp - 0x421]
mov byte [ebp - 4], 0x18
call fcn.0042fa90
push eax
call fcn.00420f40
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.0041a530
jmp 0x433762
push dword [ebp + 0x14]
push esi
call fcn.004347a0
add esp, 8
cmp dword [0x590204], 0
jne 0x433762
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
call fcn.004226c0
test eax, eax
je 0x433633
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x433762
push eax
jmp 0x43375c
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004c0d00
mov esi, dword [ebp - 0x43c]
lea eax, [ebp - 0x440]
add esp, 0xc
mov dword [ebp - 0x440], 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push str.oem_f
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433757
mov eax, dword [ebp - 0x430]
cmp eax, 1
je 0x433698
cmp eax, 2
jne 0x433757
mov eax, dword [ebp - 0x440]
test eax, eax
je 0x43374e
test al, 1
jne 0x433757
shr eax, 1
cmp word [ebp + eax*2 - 0x422], 0
jne 0x433757
mov ax, word [ebp - 0x420]
cmp ax, 0x31
jne 0x433757
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4336dd
push esi
call edi
push 0x20206
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
call fcn.004226c0
test eax, eax
je 0x433728
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x433762
push eax
call edi
jmp 0x433762
mov esi, dword [ebp - 0x43c]
push 4
push 0x550cb0
push 1
push 0
push str.oem_f
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x433762
push esi
call edi
jmp 0x433762
xor eax, eax
mov word [ebp - 0x420], ax
test esi, esi
je 0x433762
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x5995e4]
test al, 1
jne 0x433792
or eax, 1
mov dword [0x5995e4], eax
mov ecx, 0x5995e0
mov byte [ebp - 4], 0x19
call fcn.00444e30
push 0x549600
call fcn.0049bcd2
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x5995e0
call fcn.00445330
call fcn.00431c60
mov ecx, eax
call fcn.0048af50
call fcn.00431d20
mov ecx, eax
call fcn.0043aef0
mov ecx, 0x599554
call fcn.00411e20
mov edi, dword [0x595470]
add edi, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x599550]
test esi, esi
je 0x433820
cmp dword [esi + 4], 0
jle 0x4337ee
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x599550]
test esi, esi
je 0x433820
mov eax, dword [esi]
test eax, eax
je 0x433807
push eax
call fcn.004dc357
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.0049b8c9
add esp, 8
push edi
mov dword [0x599550], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x59954c]
test esi, esi
je 0x433879
mov eax, dword [esi]
test eax, eax
je 0x433850
push eax
call fcn.004dc357
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x433867
push eax
call fcn.004dc357
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.0049b8c9
add esp, 8
mov esi, dword [0x599544]
test esi, esi
je 0x4338ab
cmp dword [esi], 0
je 0x4338ab
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x433895
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x433888
mov esi, dword [0x5954d8]
mov ecx, dword [0x5954dc]
cmp esi, ecx
jae 0x4338da
nop dword [eax + eax]
mov eax, dword [esi]
test eax, eax
je 0x4338d3
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x5954dc]
add esi, 4
cmp esi, ecx
jb 0x4338c0
mov ecx, 0x599518
call fcn.00434d30
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x448]
call fcn.00410d60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0x16
push eax
call fcn.00475f21
add esp, 4
mov byte [ebp - 4], 0x14
jmp 0x433475
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 0xa
push eax
call fcn.00475f21
add esp, 4
mov byte [ebp - 4], 8
jmp 0x433475
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 5
push eax
call fcn.00475f21
add esp, 4
mov byte [ebp - 4], 3
jmp 0x433475
sub esp, 8
lea eax, [ebp - 0x42c]
mov ecx, esp
push eax
call fcn.0040bca0
call fcn.0040e0a0
call fcn.00476f4e
int3