Function at 0x410931
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
sub esp, 0x30
push pe_nt_image_headers32
mov eax, 0x45f853
call fcn.00441639
mov dword [ebp + 0x14], ecx
and dword [ebp + 0x2c], 0
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov byte [ebp + 0x33], 1
call fcn.0041f7a6
push eax
lea ecx, [ebp - 0x28]
call fcn.00413d33
mov byte [ebp - 4], 2
call fcn.0041f7a6
push eax
lea ecx, [ebp - 0x5c]
call fcn.00413d33
push 0
mov byte [ebp - 4], 3
call fcn.00442821
push eax
call fcn.00443edd
pop ecx
pop ecx
call fcn.00443eef
push 0x64
pop ecx
cdq
idiv ecx
mov edi, str.name
push edi
lea ecx, [ebp - 0x80]
mov byte [ebp - 0x29], 0
inc edx
mov dword [ebp - 0x34], edx
call fcn.00409e8f
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x74]
lea ecx, [ebp + 4]
mov byte [ebp - 4], 4
mov dword [ebp + 0x2c], esi
call fcn.004061f9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00407b73
lea ecx, [ebp + 4]
push ecx
mov ecx, eax
call fcn.0041849a
test al, al
jne 0x410a0f
push edi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
push 3
pop esi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp - 4], 5
mov dword [ebp + 0x2c], esi
call fcn.0040e1a7
mov ecx, dword [eax]
call fcn.00418404
test al, al
je 0x410a12
mov bl, 1
jmp 0x410a14
push 3
pop esi
xor bl, bl
test byte [ebp + 0x2c], 2
je 0x410a2a
and dword [ebp + 0x2c], 0xfffffffd
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00406581
test byte [ebp + 0x2c], 1
mov dword [ebp - 4], esi
je 0x410a43
and dword [ebp + 0x2c], 0xfffffffe
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.00406581
test bl, bl
je 0x410aa8
push edi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 6
call fcn.0040e1a7
lea ecx, [ebp - 0xa8]
push ecx
mov ecx, dword [eax]
call fcn.0041889f
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 7
jb 0x410a7d
mov eax, dword [eax + 4]
jmp 0x410a80
add eax, 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00407072
push 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.00406581
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00406581
mov edi, str.type
push edi
lea ecx, [ebp - 0x80]
call fcn.00409e8f
or dword [ebp + 0x2c], 4
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x74]
lea ecx, [ebp + 4]
mov byte [ebp - 4], 8
call fcn.004061f9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00407b73
lea ecx, [ebp + 4]
push ecx
mov ecx, eax
call fcn.0041849a
test al, al
jne 0x410b1b
push edi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
or dword [ebp + 0x2c], 8
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp - 4], 9
call fcn.0040e1a7
mov ecx, dword [eax]
call fcn.00418404
test al, al
je 0x410b1b
mov bl, 1
jmp 0x410b1d
xor bl, bl
test byte [ebp + 0x2c], 8
je 0x410b33
and dword [ebp + 0x2c], 0xfffffff7
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00406581
test byte [ebp + 0x2c], 4
mov dword [ebp - 4], esi
je 0x410b4c
and dword [ebp + 0x2c], 0xfffffffb
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.00406581
test bl, bl
je 0x410c5c
push edi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0xa
call fcn.0040e1a7
lea ecx, [ebp - 0xa8]
push ecx
mov ecx, dword [eax]
call fcn.0041889f
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0xb
jb 0x410b8a
mov eax, dword [eax + 4]
jmp 0x410b8d
add eax, 4
push eax
lea ecx, [ebp - 0x5c]
call fcn.00407072
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xa8]
call fcn.00406581
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00406581
lea eax, [ebp + 0xc]
push eax
mov esi, 0x4656ec
push esi
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp + 0xc], ebx
call fcn.00409d66
mov edi, dword [ebp + 0x14]
mov byte [ebp - 4], 0xc
jmp 0x410c37
push ecx
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004035d2
mov ecx, edi
call fcn.0040b670
test al, al
jne 0x410c41
push ecx
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004035d2
call fcn.00406d0c
pop ecx
test al, al
jne 0x410c41
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00409d66
push eax
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0xd
call fcn.00403b35
mov ecx, dword [ebp]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xc
call fcn.0040127b
mov eax, dword [ebp + 0x28]
cmp dword [eax - 0xc], ebx
jne 0x410bd7
jmp 0x410c45
mov byte [ebp + 0x33], 0
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.0040127b
cmp byte [ebp + 0x33], 0
je 0x410c9a
jmp 0x410c5f
mov edi, dword [ebp + 0x14]
mov eax, dword [edi + 0x304]
test eax, eax
jle 0x410c9a
xor esi, esi
test eax, eax
jle 0x410c9a
lea ebx, [edi + 0x2fc]
push dword [ebp - 0x28]
mov ecx, ebx
push esi
call fcn.00403119
mov ecx, eax
call fcn.004033b8
test eax, eax
je 0x410c96
inc esi
cmp esi, dword [edi + 0x304]
jl 0x410c75
jmp 0x410c9a
mov byte [ebp + 0x33], 0
push str.source_whitelist
sub esp, 0x20
lea eax, [ebp + 0x5c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.0040d5a3
lea eax, [ebp - 0x84]
push eax
mov ecx, edi
call fcn.0040e243
cmp byte [ebp + 0x33], 0
mov byte [ebp - 4], 0xe
je 0x410cf3
mov eax, dword [ebp - 0x84]
cmp dword [eax - 0xc], 0
jle 0x410cf3
push ecx
lea eax, [ebp - 0x84]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004035d2
call fcn.0040b271
pop ecx
test al, al
jne 0x410cf3
mov byte [ebp + 0x33], al
push str.source_blacklist
sub esp, 0x20
lea eax, [ebp + 0x5c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.0040d5a3
lea eax, [ebp - 0x88]
push eax
mov ecx, edi
call fcn.0040e243
cmp byte [ebp + 0x33], 0
mov byte [ebp - 4], 0xf
je 0x410d4d
mov eax, dword [ebp - 0x88]
cmp dword [eax - 0xc], 0
jle 0x410d4d
push ecx
lea eax, [ebp - 0x88]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004035d2
call fcn.0040b271
pop ecx
test al, al
je 0x410d4d
mov byte [ebp + 0x33], 0
push str.conflictswith
sub esp, 0x20
lea eax, [ebp + 0x5c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.0040d5a3
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.0040e243
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x10
call fcn.00406d4f
cmp byte [ebp + 0x33], 0
je 0x410eb2
push 0x464ab9
lea ecx, [ebp - 0x3c]
call fcn.00403396
test eax, eax
je 0x411084
mov eax, dword [ebp + 0x14]
xor edi, edi
cmp dword [eax + 0x2c4], edi
jl 0x411084
mov dword [ebp + 0x10], 0x480af0
push dword [ebp + 0x10]
lea ecx, [ebp + 0x28]
call fcn.004035d2
push 0x464ab9
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0x11
call fcn.00403396
test eax, eax
je 0x410e78
lea ecx, [ebp + 0x28]
call fcn.00406d4f
push ecx
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004035d2
push ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x60], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x12
call fcn.004035d2
mov ebx, dword [ebp + 0x14]
mov ecx, ebx
mov byte [ebp - 4], 0x11
call fcn.0040b43d
test al, al
jne 0x410ea3
xor esi, esi
cmp dword [ebx + 0x2d4], esi
jle 0x410e6e
add ebx, 0x2cc
push esi
mov ecx, ebx
call fcn.00403119
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004035d2
push ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x60], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x13
call fcn.004035d2
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 0x11
call fcn.0040b43d
test al, al
jne 0x410e6a
mov eax, dword [ebp + 0x14]
inc esi
cmp esi, dword [eax + 0x2d4]
jl 0x410e25
jmp 0x410e6e
mov byte [ebp + 0x33], 0
cmp byte [ebp + 0x33], 0
je 0x411075
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.0040127b
mov eax, dword [ebp + 0x14]
add dword [ebp + 0x10], 0x9c4
inc edi
cmp edi, dword [eax + 0x2c4]
jle 0x410db1
jmp 0x411084
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
mov byte [ebp + 0x33], 0
call fcn.0040127b
xor esi, esi
xor bl, bl
mov edi, str.criteria
test byte [ebp + 0x2c], 0x20
je 0x410ed0
and dword [ebp + 0x2c], 0xffffffdf
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.00406581
test byte [ebp + 0x2c], 0x10
mov dword [ebp - 4], 0x10
je 0x410eec
and dword [ebp + 0x2c], 0xffffffef
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00406581
test bl, bl
je 0x4114e5
push edi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x16
call fcn.0040e1a7
lea ecx, [ebp - 0x7c]
push ecx
mov ecx, dword [eax]
call fcn.00418c52
push esi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x18
call fcn.00406581
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x70]
mov dword [ebp - 0x20], esi
sar eax, 2
test eax, eax
jbe 0x4114d0
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
lea edi, [ebx - 1]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x7c]
call fcn.00404a68
lea ecx, [ebp - 0xac]
push ecx
mov ecx, dword [eax]
call fcn.00418dd7
push str.type
sub esp, 0x20
lea eax, [ebp - 0xac]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x19
call fcn.0040d5a3
mov ecx, dword [ebp + 0x14]
lea eax, [ebp + 0x20]
push eax
call fcn.0040e243
push 0x465ca0
sub esp, 0x20
lea eax, [ebp - 0xac]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x1a
call fcn.0040d5a3
mov ecx, dword [ebp + 0x14]
lea eax, [ebp + 0x24]
push eax
call fcn.0040e243
push str.name
sub esp, 0x20
lea eax, [ebp - 0xac]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x1b
call fcn.0040d5a3
mov ecx, dword [ebp + 0x14]
lea eax, [ebp + 0x28]
push eax
call fcn.0040e243
push str.data
sub esp, 0x20
lea eax, [ebp - 0xac]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x1c
call fcn.0040d5a3
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0xb0]
push eax
call fcn.0040e243
mov ecx, eax
mov byte [ebp - 4], 0x1d
call fcn.00406d4f
push eax
lea ecx, [ebp + 0x18]
call fcn.004035d2
mov ecx, dword [ebp - 0xb0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x1f
call fcn.0040127b
push str.registry
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
je 0x41104f
push str.registry_localmachine
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x41110e
push esi
push esi
push dword [ebp + 0x24]
push ebx
call fcn.004048b3
add esp, 0x10
cmp eax, 1
je 0x411221
push pe_nt_image_headers32
push esi
push dword [ebp + 0x24]
push ebx
jmp 0x411210
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.0040127b
cmp byte [ebp + 0x33], 0
je 0x410eb2
mov edi, str.criteria
push edi
lea ecx, [ebp - 0x80]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x10
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x74]
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0x14
call fcn.004061f9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00407b73
lea ecx, [ebp + 4]
push ecx
mov ecx, eax
call fcn.0041849a
test al, al
jne 0x410eb2
push edi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x20
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp - 4], 0x15
call fcn.0040e1a7
mov ecx, dword [eax]
call fcn.00418416
test al, al
je 0x410eb2
mov bl, 1
xor esi, esi
jmp 0x410ebb
push str.registry_currentuser
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x411145
push esi
push esi
push dword [ebp + 0x24]
push edi
call fcn.004048b3
add esp, 0x10
cmp eax, 1
je 0x411221
push pe_nt_image_headers32
push esi
push dword [ebp + 0x24]
push edi
jmp 0x411210
push str.registry_currentuser_key
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x411186
push dword [ebp + 0x28]
lea eax, [ebp - 0x24]
push dword [ebp + 0x24]
push edi
push eax
call fcn.004078a2
add esp, 0x10
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x20
call fcn.00406d4f
push esi
push dword [ebp + 0x18]
lea ecx, [ebp - 0x24]
call fcn.00405e76
mov ecx, dword [ebp - 0x24]
jmp 0x4111c5
push str.registry_localmachine_key
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x4111da
push dword [ebp + 0x28]
lea eax, [ebp - 0x1c]
push dword [ebp + 0x24]
push ebx
push eax
call fcn.004078a2
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x21
call fcn.00406d4f
push esi
push dword [ebp + 0x18]
lea ecx, [ebp - 0x1c]
call fcn.00405e76
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
cmp eax, 0xffffffff
jle 0x4113a2
mov byte [ebp + 0x33], 0
jmp 0x411490
push str.registry_classesroot
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x41122a
push esi
push esi
push dword [ebp + 0x24]
push SysReAllocStringLen
call fcn.004048b3
add esp, 0x10
cmp eax, 1
je 0x411221
push pe_nt_image_headers32
push esi
push dword [ebp + 0x24]
push SysReAllocStringLen
call fcn.004048b3
add esp, 0x10
cmp eax, 1
jne 0x411426
mov byte [ebp + 0x33], 0
jmp 0x411495
push str.directory
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x411259
lea eax, [ebp + 0x24]
push eax
call fcn.0040961d
lea eax, [ebp + 0x24]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.004035d2
call fcn.00407745
jmp 0x411286
push str.file
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x411290
lea eax, [ebp + 0x24]
push eax
call fcn.0040961d
lea eax, [ebp + 0x24]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.004035d2
call fcn.0040b111
pop ecx
test al, al
jne 0x411221
jmp 0x411426
push str.file_contents
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x41133a
lea eax, [ebp + 0x24]
push eax
call fcn.0040961d
lea ecx, [ebp + 0x10]
mov dword [esp], 0x464ab9
call fcn.00403d12
push ecx
lea eax, [ebp + 0x24]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x22
call fcn.004035d2
call fcn.0040b111
pop ecx
test al, al
je 0x411332
push ecx
lea eax, [ebp + 0x24]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.004035d2
lea eax, [ebp - 0x8c]
push eax
call fcn.0040d7e8
pop ecx
pop ecx
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x23
call fcn.00403b35
mov ecx, dword [ebp - 0x8c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x22
call fcn.0040127b
push esi
push dword [ebp + 0x18]
lea ecx, [ebp + 0x10]
call fcn.00406d4f
mov ecx, eax
call fcn.00405e76
cmp eax, 0xffffffff
jg 0x411478
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
jmp 0x4113a2
push str.browser
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x41136c
lea eax, [ebp - 0x30]
push 0x96
push eax
call fcn.004088e0
pop ecx
pop ecx
push esi
push dword [ebp - 0x30]
lea ecx, [ebp + 0x24]
call fcn.00405e76
mov ecx, dword [ebp - 0x30]
jmp 0x411396
push str.net_version
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x4113a9
lea eax, [ebp]
push eax
call fcn.004086af
pop ecx
push esi
push dword [ebp]
lea ecx, [ebp + 0x24]
call fcn.00405e76
mov ecx, dword [ebp]
add ecx, 0xfffffff0
cmp eax, 0xffffffff
jle 0x4111d1
call fcn.0040127b
jmp 0x411426
push 0x465fec
lea ecx, [ebp + 0x20]
call fcn.004033b8
test eax, eax
jne 0x411426
lea eax, [ebp - 0x60]
push eax
call fcn.00408809
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x26
call fcn.00406d4f
push eax
lea ecx, [ebp - 0x14]
call fcn.004035d2
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x28
call fcn.0040127b
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp + 0xc]
call fcn.004035d2
mov esi, dword [ebp - 0x14]
push 0
push esi
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x29
call fcn.00406d4f
mov ecx, eax
call fcn.00405e76
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
cmp eax, 0xffffffff
jle 0x411484
call fcn.0040127b
lea ecx, [esi - 0x10]
call fcn.0040127b
xor esi, esi
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x24]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x20]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x18
call fcn.0040cd54
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x70]
inc dword [ebp - 0x20]
sar eax, 2
cmp dword [ebp - 0x20], eax
jb 0x410f43
jmp 0x4114d0
mov ecx, dword [ebp + 0x10]
mov byte [ebp + 0x33], 0
add ecx, 0xfffffff0
jmp 0x411490
mov byte [ebp + 0x33], 0
call fcn.0040127b
lea ecx, [esi - 0x10]
call fcn.0040127b
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x24]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x20]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x18
call fcn.0040cd54
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x10
call fcn.004065cc
push dword [ebp - 0x7c]
call fcn.0041d65f
pop ecx
cmp byte [ebp + 0x33], 0
mov esi, str.offer_visibility_threshold
je 0x411561
push esi
lea ecx, [ebp - 0x80]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x40
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x74]
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0x2a
call fcn.004061f9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00407b73
lea ecx, [ebp + 4]
push ecx
mov ecx, eax
call fcn.0041849a
test al, al
jne 0x411561
push esi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x80
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp - 4], 0x2b
call fcn.0040e1a7
mov ecx, dword [eax]
call fcn.0041840d
test al, al
je 0x411561
mov bl, 1
jmp 0x411563
xor bl, bl
test byte [ebp + 0x2c], 0x80
je 0x41157c
and dword [ebp + 0x2c], 0xffffff7f
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00406581
test byte [ebp + 0x2c], 0x40
mov dword [ebp - 4], 0x10
je 0x411599
and dword [ebp + 0x2c], 0xffffffbf
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.00406581
test bl, bl
je 0x4115dd
push esi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x2c
call fcn.0040e1a7
mov ecx, dword [eax]
call fcn.00418428
call fcn.00442f80
push 0
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 0x10
call fcn.00406581
cmp dword [ebp - 0x34], esi
jle 0x4115dd
mov byte [ebp + 0x33], 0
cmp byte [ebp + 0x33], 0
mov edi, dword [ebp + 0x14]
je 0x4116ac
xor ebx, ebx
cmp dword [edi + 0x31c], ebx
jle 0x41162b
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0xc]
call fcn.004035d2
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x2d
call fcn.00406d4f
push ebx
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x310]
call fcn.00406340
test eax, eax
jne 0x411623
mov byte [ebp + 0x33], al
mov ecx, dword [ebp + 0xc]
jmp 0x41183f
mov esi, str.whitelist
push esi
lea ecx, [ebp - 0x80]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x100
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x74]
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0x2e
call fcn.004061f9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00407b73
lea ecx, [ebp + 4]
push ecx
mov ecx, eax
call fcn.0041849a
test al, al
jne 0x4116b1
push esi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x200
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp - 4], 0x2f
call fcn.0040e1a7
mov ecx, dword [eax]
call fcn.00418404
test al, al
je 0x4116b1
cmp dword [edi + 0x31c], ebx
jne 0x4116b1
mov bl, 1
jmp 0x4116b3
mov esi, str.whitelist
xor bl, bl
test dword [ebp + 0x2c], 0x200
je 0x4116cf
and dword [ebp + 0x2c], 0xfffffdff
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00406581
test dword [ebp + 0x2c], 0x100
mov dword [ebp - 4], 0x10
je 0x4116f2
and dword [ebp + 0x2c], 0xfffffeff
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.00406581
test bl, bl
je 0x41184b
call fcn.0041f7a6
push eax
lea ecx, [ebp + 0x28]
call fcn.00413d33
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x30
call fcn.00409e8f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x31
call fcn.0040e1a7
lea ecx, [ebp - 0xa8]
push ecx
mov ecx, dword [eax]
call fcn.0041889f
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0x32
jb 0x411742
mov eax, dword [eax + 4]
jmp 0x411745
add eax, 4
push eax
lea ecx, [ebp + 0x28]
call fcn.00407072
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0xa8]
call fcn.00406581
push esi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x30
call fcn.00406581
mov eax, dword [ebp + 0x28]
cmp dword [eax - 0xc], esi
je 0x41183c
push 0
mov esi, 0x465f9c
push esi
lea ecx, [ebp + 0x28]
xor bl, bl
call fcn.00405e76
cmp eax, 0xffffffff
jle 0x4117a0
push 0x464ab9
push esi
lea ecx, [ebp + 0x28]
inc bl
call fcn.0040384a
push ecx
lea eax, [ebp + 0x28]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.004035d2
mov ecx, edi
call fcn.0040b532
mov eax, dword [edi + 0x304]
test eax, eax
jle 0x41183c
xor esi, esi
test eax, eax
jle 0x41183c
test esi, esi
jne 0x4117d0
test bl, bl
je 0x4117d2
test esi, esi
jle 0x411817
push esi
lea ecx, [edi + 0x2fc]
call fcn.00403119
push eax
lea ecx, [ebp + 0x10]
call fcn.004035d2
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x33
call fcn.00406d4f
push 0
lea eax, [ebp + 0x10]
push eax
lea ecx, [edi + 0x310]
call fcn.00406340
test eax, eax
je 0x411822
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x30
call fcn.0040127b
inc esi
cmp esi, dword [edi + 0x304]
jl 0x4117c6
jmp 0x41183c
lea ecx, [edi + 0x310]
call fcn.00406ff3
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
mov byte [ebp + 0x33], 0
call fcn.0040127b
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x10
call fcn.0040127b
cmp byte [ebp + 0x33], 0
je 0x411b17
push str.realplayer
lea ecx, [ebp - 0x28]
call fcn.004033b8
test eax, eax
jne 0x41194f
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x34
call fcn.004135e7
push 0
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
mov esi, str.check_offer_rp.dll
push esi
mov byte [ebp - 4], 0x35
call fcn.00403d12
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.http:__cdn.install.oibundles2.com_bundles_RealPlayer_check_offer_rp.dll
mov byte [ebp - 4], 0x36
call fcn.00403d12
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x35
call fcn.004139be
lea eax, [ebp - 0x14]
push str.TEMPPATH
push eax
call fcn.00403ec3
pop ecx
pop ecx
push esi
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x37
call fcn.00403bfe
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040127b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x35
call fcn.0040127b
test esi, esi
je 0x411926
push str._checkRealPlayerEligible_8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411919
push str.R71PAK
push 0x12
call eax
cmp eax, 1
sete byte [ebp + 0x33]
jmp 0x41191d
mov byte [ebp + 0x33], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x41192a
mov byte [ebp + 0x33], 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x34
call fcn.004135f4
mov dword [ebp - 4], 0x10
jmp 0x41194f
cmp byte [ebp + 0x33], 0
je 0x411b17
push 0x465f20
lea ecx, [ebp - 0x28]
call fcn.004033b8
test eax, eax
jne 0x411a7c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x39
call fcn.004135e7
push 0
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.ApnStub.exe
mov byte [ebp - 4], 0x3a
call fcn.00403d12
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.http:__cdn.install.oibundles2.com_bundles_Ask_ApnStub.exe
mov byte [ebp - 4], 0x3b
call fcn.00403d12
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x3a
call fcn.004139be
lea eax, [ebp - 0x34]
push str.TEMPPATH
push eax
call fcn.00403ec3
pop ecx
pop ecx
push str.ApnStub.exe__tbADK
push eax
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x3c
call fcn.00403bfe
add esp, 0xc
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x3e
call fcn.0040127b
lea ecx, [ebp + 0x1f]
call fcn.0042e095
lea esi, [edi + 0x2a0]
push esi
push dword [ebp]
lea ecx, [ebp + 0x1f]
mov byte [ebp - 4], 0x3f
call fcn.00419da9
push 0xbb8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or dword [ebp + 0xc], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x411a2a
cmp dword [ebp + 0xc], 0xffffffff
jne 0x411a2e
mov byte [ebp + 0x33], 0
push dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 0x2a4]
call esi
lea ecx, [ebp + 0x1f]
mov byte [ebp - 4], 0x3e
call fcn.00442ef9
mov ecx, dword [ebp]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x39
call fcn.004135f4
mov dword [ebp - 4], 0x10
jmp 0x411a7c
cmp byte [ebp + 0x33], 0
je 0x411b17
push str.norton
lea ecx, [ebp - 0x28]
call fcn.004033b8
test eax, eax
jne 0x411a9e
mov dword [ebp - 4], 0x10
mov esi, 0x465ea4
push esi
lea ecx, [ebp - 0x80]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x400
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x74]
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0x43
call fcn.004061f9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00407b73
lea ecx, [ebp + 4]
push ecx
mov ecx, eax
call fcn.0041849a
test al, al
jne 0x411b17
push esi
lea ecx, [ebp - 0x58]
call fcn.00409e8f
or dword [ebp + 0x2c], 0x800
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp - 4], 0x44
call fcn.0040e1a7
mov ecx, dword [eax]
call fcn.00418416
test al, al
je 0x411b17
mov bl, 1
jmp 0x411b1e
xor bl, bl
mov esi, 0x465ea4
test dword [ebp + 0x2c], 0x800
je 0x411b3a
and dword [ebp + 0x2c], 0xfffff7ff
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00406581
test dword [ebp + 0x2c], 0x400
mov dword [ebp - 4], 0x10
je 0x411b56
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.00406581
test bl, bl
je 0x411f41
push esi
lea ecx, [ebp - 0xf0]
call fcn.00409e8f
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x45
call fcn.0040e1a7
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [eax]
call fcn.00418c52
push 0
push 1
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x47
call fcn.00406581
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x54]
sar eax, 2
cmp dword [ebp - 0x1c], eax
jae 0x411f2f
push dword [ebp - 0x1c]
call fcn.00404a68
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, dword [eax]
call fcn.00418dd7
push str.type
sub esp, 0x20
lea eax, [ebp - 0xd4]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x48
call fcn.0040d5a3
lea eax, [ebp + 0x20]
push eax
mov ecx, edi
call fcn.0040e243
push 0x465ea0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x49
call fcn.004033b8
test eax, eax
jne 0x411dad
push 0x465c58
sub esp, 0x20
lea eax, [ebp - 0xd4]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.0040d5a3
lea eax, [ebp + 0x18]
push eax
mov ecx, edi
call fcn.0040e243
push str.exe_name
sub esp, 0x20
lea eax, [ebp - 0xd4]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x4a
call fcn.0040d5a3
lea eax, [ebp + 0x10]
push eax
mov ecx, edi
call fcn.0040e243
push str.exe_switches
sub esp, 0x20
lea eax, [ebp - 0xd4]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x4b
call fcn.0040d5a3
lea eax, [ebp + 0x28]
push eax
mov ecx, edi
call fcn.0040e243
push str.result_code
sub esp, 0x20
lea eax, [ebp - 0xd4]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x4c
call fcn.0040d5a3
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.0040e243
push 0x465e38
sub esp, 0x20
lea eax, [ebp - 0xd4]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x4d
call fcn.0040d5a3
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.0040e243
push ecx
lea eax, [ebp + 0x10]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x4e
call fcn.004035d2
mov ecx, dword [0x480698]
call fcn.00408435
lea eax, [ebp - 0x30]
push eax
call fcn.004086af
pop ecx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x4f
call fcn.004033da
push eax
lea ecx, [ebp - 0xa8]
call fcn.00402394
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x50
call fcn.004033da
push eax
lea ecx, [ebp - 0x10c]
call fcn.00402394
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 4], 0x51
call fcn.0040d941
pop ecx
pop ecx
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x10c]
mov bl, al
call fcn.004018b8
push esi
push 1
lea ecx, [ebp - 0xa8]
call fcn.004018b8
test bl, bl
je 0x411dcf
mov byte [ebp + 0x33], 0
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0040127b
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x20]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x47
call fcn.0040cd54
inc dword [ebp - 0x1c]
jmp 0x411b9f
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x52
call fcn.004135e7
push esi
push ecx
lea eax, [ebp + 0x10]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x53
call fcn.004035d2
push ecx
lea eax, [ebp + 0x18]
mov dword [ebp - 0x8c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x54
call fcn.004035d2
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x53
call fcn.004139be
lea eax, [ebp - 0x60]
push str.TEMPPATH
push eax
call fcn.00403ec3
pop ecx
pop ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x55
call fcn.00403ba7
add esp, 0xc
push 0x465e34
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x56
call fcn.00403bfe
add esp, 0xc
lea ecx, [ebp + 0x28]
push ecx
push eax
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x57
call fcn.00403ba7
add esp, 0xc
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x5b
call fcn.0040127b
lea ecx, [ebp + 0x1f]
call fcn.0042e095
lea eax, [ebp - 0x74]
push eax
push dword [ebp]
lea ecx, [ebp + 0x1f]
mov byte [ebp - 4], 0x5c
call fcn.00419da9
push 0xbb8
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or dword [ebp + 0xc], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x411ed8
push dword [ebp - 0x20]
call fcn.00442888
pop ecx
cmp dword [ebp + 0xc], eax
je 0x411edc
mov byte [ebp + 0x33], 0
push dword [ebp - 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x70]
call esi
lea ecx, [ebp + 0x1f]
mov byte [ebp - 4], 0x5b
call fcn.00442ef9
mov ecx, dword [ebp]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x52
call fcn.004135f4
mov dword [ebp - 4], 0x4f
jmp 0x411d68
mov byte [ebp - 4], 0x10
call fcn.004065cc
push dword [ebp - 0x54]
call fcn.0041d65f
pop ecx
cmp byte [ebp + 0x33], 0
je 0x411f87
cmp byte [ebp - 0x29], 0
je 0x411f87
push 1
sub esp, 0x20
lea eax, [ebp + 0x5c]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
mov byte [ebp + 0x33], 0
call fcn.0040d5a3
sub esp, 0x20
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x8c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x5e
call fcn.0040d5a3
mov ecx, edi
mov byte [ebp - 4], 0x10
call fcn.00410178
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x88]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x84]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0
call fcn.0040cd54
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.0040cd54
mov al, byte [ebp + 0x33]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x34
leave
ret 0x40