Function at 0x47514f
Capabilities:
Check for time delay via gettickcount
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov ecx, 0x4c0934
mov ebx, edx
call fcn.004038d9
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, str.SetDllDirectoryA
mov ecx, 0x48ffa0
mov dword [0x4c09b0], eax
call fcn.00444ab7
test eax, eax
je 0x47518f
push 0x48e143
call eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [0x4c2264], eax
call fcn.0041da44
mov edx, str.execblk
mov ecx, 0x4c4158
call fcn.0041d94b
call fcn.004873f0
call fcn.00447082
call fcn.004445b6
and dword [ebp - 0x28], 0
and dword [ebp - 0x18], 0
mov dword [0x4c280c], eax
mov dword [0x4c60b4], eax
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x24], fcn.004288f0
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x14], fcn.00419282
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov ecx, eax
mov dword [0x4c3dc8], eax
call fcn.004432fe
call fcn.00444f8e
mov eax, 0x4c4568
cdq
push edx
push eax
mov ecx, 0x1000
call fcn.0045227c
call fcn.00452c2f
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
call fcn.0042bf01
cmp ebx, 2
mov esi, dword [ebp + 8]
mov byte [ebp - 1], 0
jl 0x475249
lea edi, [esi + 4]
mov eax, dword [edi]
push str._ANSI
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x475249
dec ebx
mov esi, edi
mov byte [ebp - 1], 1
mov cl, byte [ebp - 1]
call fcn.00467d9a
cmp ebx, 3
jl 0x475292
mov eax, dword [esi + 4]
push str._AUTOMATION
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x475292
push 0x75
pop eax
mov dword [0x4c60ac], 1
mov word [0x4b7890], ax
add esi, 8
mov edx, dword [esi]
push 0xd
mov ecx, 0x4b78a0
call fcn.00411960
dec ebx
dec ebx
jmp 0x475297
call fcn.00460355
cmp ebx, 2
jl 0x475338
lea edi, [esi + 4]
mov eax, dword [edi]
push str._MINIMIZED
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4752c0
dec ebx
mov esi, edi
mov byte [0x4c5f41], 1
cmp ebx, 2
jle 0x475338
mov eax, dword [esi + 4]
push str._AUTOUPDATE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x475338
cmp ebx, 3
mov edi, dword [esi + 8]
mov byte [ebp + 0xb], 1
mov dword [ebp - 8], 0x1a
jle 0x47531d
mov eax, dword [esi + 0xc]
push str._NORUN
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47530c
mov byte [ebp + 0xb], al
call fcn.00455f86
dec ebx
sub esi, 4
cmp ebx, 3
jle 0x47531d
push dword [esi + 0xc]
call sub.MSVCRT.dll__wtoi
pop ecx
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov dl, byte [ebp + 0xb]
mov ecx, edi
xor esi, esi
call fcn.0045306d
test al, al
je 0x475331
inc esi
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push dword [ebp - 0x10]
mov ecx, 0x4c40b8
call fcn.0044e3da
mov dword [0x4c40c0], 0x48fb38
call fcn.00444fd6
call fcn.0048b80d
cmp ebx, 2
mov byte [ebp - 8], 0
jl 0x4753c7
lea edi, [esi + 4]
mov eax, dword [edi]
push str._RECOVER
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4753c7
and dword [ebp + 8], eax
mov dl, 1
lea ecx, [ebp + 8]
mov byte [ebp - 8], 1
mov byte [0x4c556c], 1
call fcn.004732d6
mov ecx, eax
call fcn.004433ab
cmp ebx, 3
jne 0x4753c4
push 1
add esi, 8
mov eax, dword [esi]
push 0x4a23a0
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x4753c4
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
call fcn.004528db
xor ebx, ebx
inc ebx
jmp 0x4753c7
dec ebx
mov esi, edi
call fcn.004288e1
lea ecx, [ebp - 0x38]
call fcn.0046031c
mov byte [ebp + 0xb], 0
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0
call fcn.0045160e
call fcn.00415cae
push 2
push 2
push 0x4a3134
push 0x30
mov edi, 0x4c6038
push edi
call fcn.0043b5e6
push 0x5cde
push edi
push str._s__build__d_
push 0x40
mov edi, 0x4c5fb8
push edi
call fcn.0043b5e6
add esp, 0x28
mov ecx, edi
call fcn.0043a258
push eax
call fcn.00447082
mov edi, 0x4c3bc0
add esp, 4
mov ecx, edi
call fcn.00468254
push edi
push str.Settings_path:___s__n
call fcn.00447082
add esp, 8
call fcn.0046924e
call fcn.00470977
inc dword [0x4c693c]
cmp dword [0x4c683c], 0x4415cde
je 0x4754a2
push 0xa
pop ecx
xor eax, eax
mov edi, 0x4c68a8
rep stosd dword es:[edi], eax
push 0xa
pop ecx
mov edi, 0x4c6880
rep stosd dword es:[edi], eax
call fcn.004709cc
xor eax, eax
push eax
push 0x3e8
push 2
push eax
push eax
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push eax
push str.Sent_WM_SETTINGCHANGE_return___u
call fcn.004875bd
pop ecx
pop ecx
xor edi, edi
cmp dword [0x4c683c], edi
jne 0x4754b6
mov dword [0x4c620c], 1
cmp byte [0x4c61cb], 0
jne 0x4754d4
mov eax, dword [0x4c620c]
cmp eax, 1
je 0x4754ce
cmp eax, 0xa
jne 0x4754d4
mov dword [0x4c620c], edi
mov dword [0x4b318c], edi
call fcn.00413226
mov eax, dword [0x4c680c]
mov dword [0x4c0968], eax
mov eax, dword [0x4c6810]
mov dword [0x4c096c], eax
mov eax, dword [0x4c6814]
mov dword [0x4c0960], eax
mov eax, dword [0x4c6818]
mov dword [0x4c0964], eax
mov eax, dword [0x4c63dc]
mov dword [0x4c0958], eax
mov eax, dword [0x4c63e0]
mov dword [0x4c095c], eax
mov eax, dword [0x4c64d4]
mov dword [0x4c0950], eax
mov eax, dword [0x4c64d8]
mov dword [0x4c0954], eax
mov eax, dword [0x4c65cc]
mov dword [0x4c0948], eax
mov eax, dword [0x4c65d0]
mov dword [0x4c094c], eax
mov eax, dword [0x4c66c4]
mov dword [0x4c0940], eax
mov eax, dword [0x4c66c8]
xor edx, edx
xor cl, cl
mov dword [0x4c0944], eax
call fcn.00474f73
lea ecx, [ebp - 0x20]
call fcn.0041bb67
call fcn.00418c2d
call fcn.00460eb8
call fcn.00429d61
lea ecx, [ebp - 0x30]
call fcn.0042bebe
cmp ebx, 2
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], edi
jl 0x4755f4
mov eax, dword [esi + 4]
push str._UNINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4755f4
dec ebx
mov byte [ebp - 1], al
mov byte [ebp + 0xb], al
add esi, 8
cmp ebx, 2
jl 0x4755e4
mov eax, dword [esi]
push 0x4a3c00
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4755cb
mov byte [ebp - 1], 1
dec ebx
add esi, 4
jmp 0x4755a9
mov eax, dword [esi]
push str._REMSETTINGS
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4755e4
mov byte [ebp + 0xb], 1
jmp 0x4755c5
mov dl, byte [ebp + 0xb]
mov cl, byte [ebp - 1]
call fcn.00464e05
jmp 0x475cdb
cmp ebx, 1
jle 0x47596e
cmp ebx, 2
jl 0x475627
lea edi, [esi + 4]
mov eax, dword [edi]
push str._BIGDUMP
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x475627
mov byte [0x4c430c], 1
dec ebx
mov esi, edi
jmp 0x475952
cmp ebx, 3
jl 0x47564f
mov eax, dword [esi + 4]
push str._DIRECTORY
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47564f
add esi, 8
mov eax, dword [esi]
mov dword [0x4c60a4], eax
jmp 0x475950
cmp ebx, 2
jl 0x475707
lea edi, [esi + 4]
mov eax, dword [edi]
push str._HIDE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x475677
mov byte [0x4c40c5], 1
jmp 0x47561f
mov eax, dword [edi]
push str._LAUNCHBUNDLEDURL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47569c
add esi, 8
push dword [esi]
lea ecx, [ebp - 0x38]
call fcn.00460326
jmp 0x475950
mov eax, dword [edi]
push str._LAUNCHBUNDLEDURLTYPE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4756c1
add esi, 8
push dword [esi]
lea ecx, [ebp - 0x38]
call fcn.0046033d
jmp 0x475950
mov eax, dword [edi]
push str._NOINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4756e7
mov dword [0x4c60d0], 0x5cde
mov byte [ebp + 0xb], 1
jmp 0x47561f
mov eax, dword [edi]
push str._UPDATEINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x475707
mov byte [ebp + 0xb], 1
mov byte [ebp - 3], 1
jmp 0x47561f
cmp ebx, 5
jl 0x47584b
mov eax, dword [esi + 4]
push str._DOWNLOADINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47584b
mov eax, dword [esi + 8]
push dword [esi + 0xc]
mov dword [ebp - 0x40], eax
call sub.MSVCRT.dll__wtoi
add esi, 0x10
sub ebx, 4
cmp ebx, 1
mov dword [ebp - 0x3c], eax
mov eax, dword [esi]
pop ecx
mov dword [0x4c5a64], eax
mov dword [ebp - 0xc], ebx
jle 0x475778
lea edi, [esi + 4]
mov ecx, dword [edi]
cmp word [ecx], 0x2f
je 0x475778
call fcn.00439c59
push eax
push str.toolbar_pair_key:__S_n
mov dword [0x4c5a5c], eax
call fcn.00447082
add esp, 8
dec ebx
mov dword [ebp - 0xc], ebx
mov esi, edi
mov ecx, dword [ebp - 0x40]
mov byte [0x4c5a54], 0
test ecx, ecx
je 0x475842
cmp word [ecx], 0
je 0x475842
mov edx, 0x4c5a4c
call fcn.004683b6
test al, al
je 0x475842
push 0x1c
pop ecx
mov dword [0x4b57f8], 0x4c5a4c
call fcn.0044394c
mov ebx, eax
push 7
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x499bfc
call fcn.0041209e
push eax
lea ecx, [ebx + 4]
mov dword [0x4b7c64], eax
call fcn.00401b6f
mov eax, dword [ebp - 0x3c]
push 0
mov dword [0x4b7c60], 0x45e9c0
push 0
mov dword [ebx], eax
mov ecx, dword [0x4b57f8]
push str.offer_urls
lea edi, [ebx + 0x10]
call fcn.00403d72
mov ecx, eax
call fcn.0040393d
mov ecx, eax
call fcn.00443b96
push eax
mov ecx, edi
call fcn.00410a4c
mov edi, dword [edi]
mov ecx, edi
test edi, edi
jne 0x475824
mov ecx, 0x48e143
push 0x4b7c60
push 1
push ebx
mov edx, fcn.00463fcb
call fcn.0045e938
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 1
jmp 0x475952
cmp ebx, 2
jl 0x47591e
lea edi, [esi + 4]
mov eax, dword [edi]
push str._PERFORMINSTALL
push eax
mov dword [ebp - 0x3c], edi
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x475902
cmp ebx, 3
jl 0x475884
push dword [esi + 8]
call sub.MSVCRT.dll__wtoi
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x47588b
mov dword [ebp - 0xc], 0x100
cmp ebx, 4
jl 0x475895
mov edi, dword [esi + 0xc]
jmp 0x475897
xor edi, edi
cmp ebx, 5
jl 0x4758b7
cmp byte [0x4c5f42], 0
je 0x4758b7
push dword [esi + 0x10]
call sub.MSVCRT.dll__wtol
pop ecx
mov edx, eax
mov cl, 1
call fcn.00474f73
mov ecx, edi
test edi, edi
jne 0x4758c2
mov ecx, 0x492538
mov eax, dword [ebp - 0xc]
push ecx
or eax, 0x80
push eax
push str.INSTALLDEBUG:__PERFORMINSTALL_with_flags___d__and_path___s__n
call fcn.00447082
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
mov byte [ebp - 1], 1
call fcn.00464b51
test al, al
je 0x4758fa
mov dword [ebp - 0x10], 1
call fcn.00455f86
mov edi, dword [ebp - 0x3c]
mov eax, dword [edi]
push str._BRINGTOFRONT
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47591e
mov byte [ebp - 2], 1
jmp 0x47561f
cmp ebx, 3
jl 0x47595b
mov eax, dword [esi + 4]
push str._LOGFILE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47595b
add esi, 8
mov ecx, dword [esi]
call fcn.004877e9
push dword [esi]
push str.Log_file_set_to_path:__s__n
call fcn.00447082
add esp, 8
dec ebx
dec ebx
cmp ebx, 1
jg 0x4755fd
cmp byte [ebp - 1], 0
je 0x47596e
call fcn.0045f902
push dword [ebp - 0x10]
jmp 0x475332
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
call fcn.00470607
test al, al
jne 0x4759ac
call fcn.0042bf2c
cmp byte [ebp - 0x20], 0
je 0x475999
cmp dword [ebp - 0x14], 0
je 0x475999
lea ecx, [ebp - 0x20]
call dword [ebp - 0x14]
cmp byte [ebp - 0x30], 0
je 0x475d02
cmp dword [ebp - 0x24], 0
jmp 0x475cfa
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x58
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x60
pop ecx
cmp eax, ecx
mov dword [0x4c609c], eax
jg 0x4759d1
mov dword [0x4c609c], ecx
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.0047050d
call fcn.00455f25
call fcn.00463a38
call fcn.00460eb8
call fcn.00460394
or byte [ebp + 0xb], al
jne 0x475a15
push edi
push edi
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
call fcn.00464b51
test al, al
je 0x475a23
push edi
jmp 0x475332
cmp byte [ebp - 3], 0
je 0x475a23
push edi
push 0x8000
jmp 0x4759fb
cmp ebx, 1
jle 0x475a30
mov eax, dword [esi + 4]
mov dword [0x4c60a8], eax
mov dl, byte [ebp + 0xb]
mov cl, byte [ebp - 8]
call fcn.004709aa
push 0x5cde
push edi
push 2
pop ebx
push ebx
push ebx
push str.Version__d._d._d__svn__u__n
call fcn.00447082
add esp, 0x14
call fcn.0046042d
mov byte [0x4c5f40], al
call fcn.00436cbe
cmp byte [0x4c61a3], 0
je 0x475a81
xor ecx, ecx
call fcn.0041fdc7
test eax, eax
je 0x475a81
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4c5f44], eax
mov eax, dword [0x4c6234]
cmp eax, 6
jle 0x475a8e
push 6
pop eax
cmp eax, edi
jge 0x475a94
xor eax, eax
xor edx, edx
inc edx
mov ecx, eax
shl edx, cl
mov dword [0x4b3fb0], edx
call fcn.00428703
push 0x28
call fcn.00443c1f
pop ecx
cmp eax, edi
je 0x475abb
mov ecx, eax
call fcn.00404b03
jmp 0x475abd
xor eax, eax
mov ecx, eax
mov dword [0x4c09b8], eax
call fcn.0042a323
call fcn.00428714
cmp byte [0x4c61d1], 0
je 0x475add
mov dword [0x4c60f8], edi
call fcn.00468323
mov byte [0x4c5e0c], al
call fcn.00468762
mov ecx, dword [0x4c683c]
cmp ecx, edi
jne 0x475b05
cmp dword [0x4c2fc4], edi
je 0x475b0d
mov byte [0x4c61cb], 1
cmp ecx, 0x2445034
jae 0x475b1d
cmp byte [0x4c61f7], 0
je 0x475b1d
mov byte [0x4c61f6], 1
cmp ecx, 0x3022e66
jae 0x475b36
mov ecx, dword [0x4c2300]
call fcn.00421cee
mov ecx, dword [0x4c683c]
cmp ecx, 0x3060000
jae 0x475b6b
movzx eax, byte [0x4b32be]
sub eax, edi
je 0x475b64
dec eax
je 0x475b5b
dec eax
je 0x475b5b
dec eax
jne 0x475b6b
mov byte [0x4b32be], 0xa
jmp 0x475b6b
mov byte [0x4b32be], 0xf
jmp 0x475b6b
mov byte [0x4b32be], 5
cmp ecx, 0x3022f33
jae 0x475b82
cmp dword [0x4c2870], ebx
jne 0x475b82
mov byte [0x4c287a], 1
and dword [0x4c8324], 0xbfffffff
mov dword [0x4c683c], 0x4415cde
call fcn.00412178
mov ecx, dword [0x4c0910]
call fcn.00418e33
call fcn.00412f93
cmp dword [0x4c60ac], 1
je 0x475bbe
xor dl, dl
lea ecx, [ebp + 8]
call fcn.004732d6
lea ecx, [ebp - 0x108]
call fcn.004725ca
push 0x4c6180
lea ecx, [ebp - 0x108]
call fcn.0047007f
push 0x18
call fcn.00443c1f
pop ecx
cmp eax, edi
je 0x475bf9
push dword [0x4c5f4c]
mov ecx, eax
call fcn.0041db2f
mov dword [0x4c5f48], eax
jmp 0x475bff
mov dword [0x4c5f48], edi
mov esi, 0x4c6954
mov eax, dword [esi]
cmp eax, edi
je 0x475c29
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x475c0d
sub eax, edx
sar eax, 1
je 0x475c29
mov edx, esi
mov ecx, 0x4c6804
call fcn.00453ec1
add esi, 0x20
cmp esi, 0x4c6994
jl 0x475c04
lea ecx, [ebp - 0x38]
call fcn.00462099
cmp byte [ebp - 2], 0
je 0x475c56
cmp dword [0x4c60ac], edi
jne 0x475c56
push dword [ebp - 0x104]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.0042577b
test al, al
je 0x475c6a
push str.IPv6_is_installed
call fcn.004875bd
pop ecx
call fcn.00428703
lea ecx, [ebp - 0x50]
call fcn.0041381d
test al, al
je 0x475c96
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.Got_Teredo_Address:__V
movsd dword es:[edi], dword [esi]
call fcn.004875bd
add esp, 0x14
xor edi, edi
call fcn.00428714
xor edx, edx
mov ecx, 0x10a
call fcn.0046f789
call fcn.00447082
mov ecx, 0x4c40b8
call fcn.0044dada
call fcn.00447082
lea ecx, [ebp - 0x30]
call fcn.004288f0
lea ecx, [ebp - 0x20]
call fcn.00419282
call fcn.00447082
lea ecx, [ebp - 0x108]
call fcn.0044dc1f
call fcn.0042bf2c
cmp byte [ebp - 0x20], 0
je 0x475cf1
cmp dword [ebp - 0x14], edi
je 0x475cf1
lea ecx, [ebp - 0x20]
call dword [ebp - 0x14]
cmp byte [ebp - 0x30], 0
je 0x475d02
cmp dword [ebp - 0x24], edi
je 0x475d02
lea ecx, [ebp - 0x30]
call dword [ebp - 0x24]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4