Function at 0x63605aae
Capabilities:
Create thread
Get file version info
Query or enumerate registry value
Terminate thread

Disassembly:
push ebp
lea ebp, [esp - 0x1dc]
sub esp, 0x25c
mov eax, dword [0x6363a530]
push ebx
mov ebx, dword [ebp + 0x1e4]
xor eax, ebp
cmp dword [ebp + 0x1e8], 1
push esi
mov dword [ebp + 0x1d8], eax
push edi
jne 0x63605e78
push 0x6363e188
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push 0xf
pop edi
push esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x50], edi
call fcn.63603692
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], edi
call fcn.63603692
lea eax, [ebp - 0x70]
push eax
push 0x20019
push esi
push str.SoftwarePIPIjfcheck
push SysReAllocString
mov dword [0x6363b5a4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63605b64
push 4
pop eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push str.loadmethod
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x104
push edi
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
lea eax, [ebp + 0xd4]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [ebp + 0xd4]
push eax
call fcn.6361cfba
lea eax, [ebp + 0xd4]
mov dword [esp], str.explorer.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605e21
lea eax, [ebp + 0xd4]
push str.maxthon.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
je 0x63605bd6
mov dword [0x6363e5f0], 2
jmp 0x63605d0d
lea eax, [ebp + 0xd4]
push str.iexplore.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
je 0x63605bfd
xor eax, eax
inc eax
mov dword [0x6363e5f0], eax
mov dword [ebp - 0x74], eax
jmp 0x63605d0d
lea eax, [ebp + 0xd4]
push str.regsvr32.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.jfcachemgr
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.pipiplayer
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str..tmp
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.firefox
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.ttraveler.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.theworld.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.myie.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.360se.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
lea eax, [ebp + 0xd4]
push str.opera.exe
push eax
call fcn.6361cf08
test eax, eax
pop ecx
pop ecx
jne 0x63605d07
cmp dword [ebp - 0x78], esi
mov dword [0x6363e5f0], esi
jne 0x63605d0d
jmp 0x63605e21
mov dword [0x6363e5f0], esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xd4]
push eax
mov dword [0x6363e5f4], esi
mov dword [ebp - 0x6c], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, esi
mov dword [ebp - 0x6c], eax
je 0x63605d75
push eax
call fcn.6361d9eb
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x6c]
lea eax, [ebp + 0xd4]
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x63605d6e
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x63630080
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x63605d6e
mov eax, dword [ebp - 0x80]
movzx eax, byte [eax + 0xa]
mov dword [0x6363e5f4], eax
push edi
call fcn.6361d7d5
pop ecx
cmp dword [0x6363e5f4], 8
mov dword [0x6363e5f8], esi
jl 0x63605d8e
call fcn.63611ebe
mov dword [0x6363e5f8], eax
push 0x6362f624
push ebx
push 0x6363a0b8
mov ecx, 0x6363b5b0
call fcn.63601cea
push ebx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.636121c1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.6360e02b
pop ecx
pop ecx
mov dword [0x6363e5e4], eax
call fcn.63608ac9
cmp dword [ebp - 0x74], esi
je 0x63605e3e
push 0x524
call fcn.6361d7da
cmp eax, esi
pop ecx
je 0x63605de5
mov ecx, eax
call fcn.6361466f
jmp 0x63605de7
xor eax, eax
push esi
push esi
push eax
push 0x6361ab21
push esi
push esi
mov dword [0x6363d0fc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x6363d100], eax
jne 0x63605e3e
mov ecx, dword [0x6363d0fc]
cmp ecx, esi
je 0x63605e15
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x6363d0fc], esi
mov dword [0x6363d100], esi
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.636044f0
push esi
push 1
lea ecx, [ebp - 0x68]
call fcn.636044f0
xor eax, eax
jmp 0x63605f2b
cmp dword [0x6363b5a8], esi
jne 0x63605e5d
push 0x636108ef
push 0x7d0
push esi
push esi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x6363b5a8], eax
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.636044f0
push esi
push 1
lea ecx, [ebp - 0x68]
call fcn.636044f0
jmp 0x63605f28
xor esi, esi
cmp dword [ebp + 0x1e8], esi
jne 0x63605f28
mov eax, dword [0x6363b5a8]
cmp eax, esi
je 0x63605e9d
push eax
push esi
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x6363b5a8], esi
mov ecx, dword [0x6363d0fc]
cmp ecx, esi
mov edi, 0x1f4
je 0x63605f02
cmp dword [0x6363d100], esi
je 0x63605f02
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x63605eca
mov eax, edi
dec edi
test eax, eax
jle 0x63605ed2
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x6363d0fc], esi
jne 0x63605ebb
push 0x32
push dword [0x6363d100]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x6363d0fc], esi
je 0x63605ef6
push 1
push dword [0x6363d100]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x6363d100]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6363d0fc], esi
mov dword [0x6363d100], esi
call fcn.63608af3
mov ecx, 0x6363b5b0
call fcn.63602d0d
push 0x6363e188
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1d8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6361d41e
add ebp, 0x1dc
leave
ret 0xc