Function at 0x6360381b
Capabilities:
Create thread
Get file version info
Query or enumerate registry value
Terminate thread

Disassembly:
push ebp
lea ebp, [esp - 0x1c0]
sub esp, 0x240
mov eax, dword [0x6362e4e0]
push ebx
mov ebx, dword [ebp + 0x1c8]
xor eax, ebp
cmp dword [ebp + 0x1cc], 1
push esi
mov dword [ebp + 0x1bc], eax
push edi
jne 0x63603b62
push 0x63631380
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x50], 0xf
call fcn.63601f60
lea eax, [ebp - 0x70]
push eax
push 0x20019
push esi
push str.SoftwarePIPIjfcheck
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x636038c0
push 4
pop eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push str.loadmethod
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x104
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
lea eax, [ebp + 0xb8]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [ebp + 0xb8]
push eax
call fcn.63614d4a
lea eax, [ebp + 0xb8]
mov dword [esp], str.maxthon.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
je 0x63603917
mov dword [0x636313c0], 2
jmp 0x63603a50
lea eax, [ebp + 0xb8]
push str.iexplore.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
je 0x6360393e
xor eax, eax
inc eax
mov dword [0x636313c0], eax
mov dword [ebp - 0x74], eax
jmp 0x63603a50
lea eax, [ebp + 0xb8]
push str.regsvr32.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.jfcachemgr
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.pipiplayer
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str..tmp
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.firefox
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.ttraveler.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.theworld.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.myie.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.360se.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
lea eax, [ebp + 0xb8]
push str.opera.exe
push eax
call fcn.63614c98
test eax, eax
pop ecx
pop ecx
jne 0x63603a4a
cmp dword [ebp - 0x7c], esi
mov dword [0x636313c0], esi
jne 0x63603a50
xor edi, edi
jmp 0x63603b40
mov dword [0x636313c0], esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xb8]
push eax
mov dword [0x636313c4], esi
mov dword [ebp - 0x6c], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, esi
mov dword [ebp - 0x6c], eax
je 0x63603ab8
push eax
call fcn.6361576d
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x6c]
lea eax, [ebp + 0xb8]
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x63603ab1
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x636248b0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x63603ab1
mov eax, dword [ebp - 0x80]
movzx eax, byte [eax + 0xa]
mov dword [0x636313c4], eax
push edi
call fcn.63615565
pop ecx
lea eax, [ebp - 0x68]
push eax
call fcn.6360925e
mov dword [esp], 0x63624598
push ebx
push 0x6362e088
mov ecx, 0x6362f2b8
mov dword [0x636313b4], eax
call fcn.63601964
push ebx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [ebp - 0x74], esi
je 0x63603b52
push 0x720
call fcn.63615772
cmp eax, esi
pop ecx
je 0x63603b01
mov ecx, eax
call fcn.6360eec7
jmp 0x63603b03
xor eax, eax
push esi
push esi
push eax
push 0x636129bc
push esi
push esi
mov dword [0x63630738], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x6363073c], eax
jne 0x63603b52
mov ecx, dword [0x63630738]
cmp ecx, esi
je 0x63603b31
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x63630738], esi
mov dword [0x6363073c], esi
or edi, 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x68]
call fcn.63602ab8
mov eax, edi
jmp 0x63603bf9
push esi
push 1
lea ecx, [ebp - 0x68]
call fcn.63602ab8
jmp 0x63603bf6
xor esi, esi
cmp dword [ebp + 0x1cc], esi
jne 0x63603bf6
mov ecx, dword [0x63630738]
cmp ecx, esi
mov edi, 0x1f4
je 0x63603bd5
cmp dword [0x6363073c], esi
je 0x63603bd5
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x63603b9d
mov eax, edi
dec edi
test eax, eax
jle 0x63603ba5
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x63630738], esi
jne 0x63603b8e
push 0x32
push dword [0x6363073c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x63630738], esi
je 0x63603bc9
push 1
push dword [0x6363073c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x6363073c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x6362f2b8
mov dword [0x63630738], esi
mov dword [0x6363073c], esi
call fcn.63601d7f
push 0x63631380
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.636151ae
add ebp, 0x1c0
leave
ret 0xc