Function at 0x460ab0
Capabilities:
Check for time delay via gettickcount
Create directory
Delete registry value
Initialize winsock library
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55b168
mov eax, dword fs:[0]
push eax
sub esp, 0xc58
mov eax, dword [0x5c04b4]
xor eax, esp
mov dword [esp + 0xc50], eax
push ebx
push esi
push edi
mov eax, dword [0x5c04b4]
xor eax, esp
push eax
lea eax, [esp + 0xc68]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x78], edi
mov dword [edi + 0x9da4], 0
mov byte [edi + 0x9da8], 0
call fcn.0054f890
lea eax, [esp + 0x88]
mov dword [esp + 0x88], 0
push eax
push 0x20019
push 0
push str..DEFAULT
push reloc.WS2_32.dll_closesocket
call dword [0x5c0060]
test eax, eax
jne 0x460b47
push dword [esp + 0x88]
call dword [0x5c00ac]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 4
call dword [sym.imp.MSVCR120.dll_rand]
mov dword [edi + 0x9e30], eax
lea eax, [esp + 0x374]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.0051ab90
mov eax, dword [0x5c6dd0]
test eax, eax
je 0x460b93
mov dword [eax + 0x18], 0x7d0
call fcn.00519420
mov eax, dword [edi + 0x14]
mov dword [edi + 0x24], eax
push 0x5c
mov dword [edi + 0x98a0], 0x4608d0
mov dword [edi + 0x98a4], edi
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x460c1d
push 0x5c
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [0x5c0018]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x2c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0xea60
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [eax], 5
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
push 0x50
mov dword [edi + 0x94f4], esi
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x5c], eax
mov dword [esp + 0xc70], 0
test eax, eax
je 0x460c4c
mov ecx, eax
call fcn.004df460
mov esi, eax
jmp 0x460c4e
xor esi, esi
mov dword [esp + 0xc70], 0xffffffff
test esi, esi
je 0x460d14
push 6
lea eax, [esp + 0x508]
mov dword [esi + 0x24], 0x5c07bc
push eax
mov ecx, esi
mov dword [esp + 0x50c], 0x58ffb8
mov dword [esp + 0x510], 0x240
mov dword [esp + 0x514], 0x58fd10
mov dword [esp + 0x518], 0x2a5
mov dword [esp + 0x51c], 0x590550
mov dword [esp + 0x520], 0x709
mov dword [esp + 0x524], 0x5901f8
mov dword [esp + 0x528], 0x358
mov dword [esp + 0x52c], 0x58f220
mov dword [esp + 0x530], 0x4d7
mov dword [esp + 0x534], 0x58ed60
mov dword [esp + 0x538], 0x4bd
call fcn.004efff0
test al, al
jne 0x460d0d
push ecx
mov ecx, esi
call fcn.004df4f0
xor esi, esi
jmp 0x460d14
mov dword [esi + 0x2c], vtable.WinCatalogStoreImpl.0
lea edx, [esp + 0x5c]
mov dword [edi + 0x9a84], esi
lea ecx, [edi + 0x9a68]
mov dword [esp + 0x5c], 8
call fcn.0050c140
test al, al
jne 0x460d49
mov dword [edi + 0x9a68], 0
mov dword [edi + 0x9a6c], 0
lea esi, [edi + 0x1fd4]
mov ecx, esi
call fcn.004a38c0
push ecx
mov ecx, edi
call fcn.00487290
push ecx
push dword [edi + 0x333c]
call fcn.00436600
lea eax, [esp + 0x1c]
mov edx, str.SoftwareESETESET_SecurityCurrentVersionInfo
push 0x2001f
push eax
mov ecx, reloc.WS2_32.dll_bind
call fcn.00518680
mov ebx, dword [0x5c00fc]
add esp, 8
test al, al
je 0x460ee2
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0x60]
mov dword [esp + 0x40], 0x102
push eax
push 0
push str.UniqueId
push esi
call dword [0x5c0058]
test eax, eax
je 0x460dc9
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
call esi
jmp 0x460e35
mov eax, dword [esp + 0x58]
cmp eax, 1
je 0x460de3
cmp eax, 2
je 0x460de3
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xd
call esi
jmp 0x460e35
cmp dword [esp + 0x38], 0x102
jbe 0x460df9
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x7a
call esi
jmp 0x460e35
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x7c8]
push eax
lea eax, [esp + 0x60]
push eax
push 0
push str.UniqueId
push esi
call dword [0x5c0058]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
test al, al
jne 0x460ed2
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.MSVCR120.dll__time64]
mov ecx, eax
mov dword [esp + 0x84], edx
add esp, 4
mov edx, str.TESEk
mov eax, 1
lock xadd dword [edx], eax
inc eax
cdq
or edx, ecx
lea ecx, [esp + 0x8cc]
push edx
push eax
call fcn.004d2b30
add esp, 8
lea eax, [esp + 0x7c4]
push 0x81
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x8d8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
lea ecx, [esp + 0x7c4]
mov word [esp + 0x8c4], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x460ea1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0x7c8]
push eax
push 1
push 0
push str.UniqueId
push dword [esp + 0x30]
call ebx
push eax
call esi
push dword [esp + 0x1c]
call dword [0x5c00ac]
lea esi, [edi + 0x1fd4]
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5c0090]
test eax, eax
je 0x460f11
cmp dword [esp + 0x64], 0
mov edx, str.SOFTWAREWow6432NodeMicrosoftSoftGrid4.5ClientAppFSServiceInclusions
setne al
test al, al
jne 0x460f16
mov edx, str.SOFTWAREMicrosoftSoftGrid4.5ClientAppFSServiceInclusions
lea eax, [esp + 0x1c]
mov ecx, reloc.WS2_32.dll_bind
push 0x20006
push eax
call fcn.00518680
add esp, 8
test al, al
je 0x460f58
push 0xa
push str.ekrn
push 1
push 0
push 0x5753bc
push dword [esp + 0x30]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x1c]
call dword [0x5c00ac]
test byte [edi + 0x9e58], 8
je 0x460f68
mov ecx, edi
call fcn.0046f0c0
push ecx
lea eax, [edi + 0xa074]
mov ecx, edi
mov dword [eax], 0
push eax
lea eax, [edi + 0x9e74]
push eax
call fcn.004a7df0
push 0
push 0
push str.plugins.01000600.settings.EKRN_CFG.ProxyFallbackEnabled
lea eax, [esp + 0xf0]
mov ecx, edi
push eax
call fcn.00448c90
mov dword [esp + 0xc70], 1
cmp dword [esp + 0xe4], 3
jne 0x460fc0
cmp dword [esp + 0xec], 1
sete byte [0x5c6da4]
mov dword [esp + 0xc70], 0xffffffff
lea ecx, [esp + 0xe4]
call fcn.00440820
mov ecx, edi
call fcn.0048b7d0
mov ecx, esi
call fcn.004a0cd0
call fcn.00487640
mov esi, dword [0x5c6b7c]
test esi, esi
je 0x46104d
cmp dword [esi + 0x170], 0
jne 0x46104d
lea ebx, [esi + 0x16c]
mov eax, 1
lock xadd dword [ebx], eax
call fcn.0050a830
movzx edx, ax
mov eax, dword [esi + 0x58]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x461029
push edx
push 0x4650
call ecx
add esp, 8
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
jne 0x46104d
cmp dword [esi + 0x170], 0
je 0x46104d
mov ecx, esi
call fcn.004f5900
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov ebx, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
push 0x14
call ebx
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0xc70], 2
test eax, eax
je 0x461076
mov ecx, eax
call fcn.004b4af0
jmp 0x461078
xor eax, eax
mov dword [esp + 0xc70], 0xffffffff
mov ecx, edi
mov dword [edi + 0x95f0], eax
call fcn.0048abb0
mov ecx, edi
call fcn.0048ac60
push edi
push 0x48a640
push 0x5868c4
call fcn.0048ad10
push 0x18
call ebx
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
mov dword [esp + 0xc70], 3
test esi, esi
je 0x4610cc
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x4610ce
xor esi, esi
mov dword [esp + 0xc70], 0xffffffff
mov ecx, dword [0x5c0518]
mov dword [edi + 0xc], esi
cmp ecx, 0xffffffff
jne 0x4610fe
mov ecx, str.Boeing
call fcn.0050c4f0
xor ecx, ecx
test al, al
setne cl
mov dword [0x5c0518], ecx
test ecx, ecx
jne 0x461113
call fcn.00486740
mov ecx, edi
call fcn.0049bcc0
call fcn.004a8180
push 0x24
call ebx
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0xc70], 4
test eax, eax
je 0x461136
mov ecx, eax
call fcn.0045b190
jmp 0x461138
xor eax, eax
mov dword [esp + 0xc70], 0xffffffff
mov esi, dword [edi + 0x9e28]
mov dword [edi + 0x9e28], eax
test esi, esi
je 0x461164
mov ecx, esi
call fcn.0045b290
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, edi
call fcn.0046b040
mov ecx, dword [edi + 0x21f8]
mov eax, ecx
test eax, eax
jle 0x461178
dec eax
lea eax, [eax + eax*4]
lea ebx, [eax*4 + 0x68]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
test ecx, ecx
jle 0x4611af
mov ecx, dword [edi + 0x21f4]
mov edx, dword [edi + 0x21f8]
lea ebx, [ebx]
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add ebx, dword [eax + 0x1c]
dec edx
jne 0x4611a0
mov dword [esp + 0x24], ebx
lea eax, [esp + 0xa0]
mov dword [esp + 0xb8], 0x2c
push eax
mov dword [esp + 0xc0], 0x31524b45
mov dword [esp + 0xc4], 0x49554745
mov dword [esp + 0xd0], 0x483510
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd8], 0x4846a0
mov dword [esp + 0xdc], edi
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xc8], 1
mov dword [esp + 0xe0], 0x4846c0
mov dword [esp + 0xe4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5c0090]
test eax, eax
je 0x461265
cmp dword [esp + 0xa0], 0
je 0x461265
mov eax, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
push 0x70
call eax
add esp, 4
mov dword [esp + 0x7c], eax
mov dword [esp + 0xc70], 5
test eax, eax
je 0x46128f
mov ecx, eax
call fcn.00513ce0
mov esi, eax
jmp 0x461291
mov eax, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
push 0x70
call eax
add esp, 4
mov dword [esp + 0x7c], eax
mov dword [esp + 0xc70], 6
test eax, eax
je 0x46128f
mov ecx, eax
call fcn.00513e70
mov esi, eax
jmp 0x461291
xor esi, esi
mov dword [esp + 0xc70], 0xffffffff
test esi, esi
je 0x4612bb
mov eax, dword [esi]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x4612bd
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor esi, esi
mov dword [edi + 0x1db0], esi
test esi, esi
jne 0x4613bf
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [edi + 0x1c], 1
push dword [edi + 0x9a70]
call ebx
mov eax, dword [edi + 0x1c98]
test eax, eax
je 0x4612f4
push esi
push esi
push esi
push eax
call dword [0x5c0134]
lea eax, [esp + 0x4c]
mov edx, str.SoftwareESETESET_SecurityCurrentVersionInfo
push 0x20019
push eax
mov ecx, reloc.WS2_32.dll_bind
xor esi, esi
call fcn.00518680
add esp, 8
test al, al
je 0x461351
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0xac]
push eax
mov edx, str.PackageTag
call fcn.00518850
add esp, 4
test al, al
je 0x461340
mov esi, dword [esp + 0xac]
xor esi, 0x9234f34a
push dword [esp + 0x4c]
call dword [0x5c00ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [edi + 0x961c]
test ecx, ecx
je 0x461364
cmp ecx, esi
je 0x461364
call fcn.0050c6c0
mov eax, dword [edi + 0x21e0]
test eax, eax
je 0x46137a
cmp dword [eax], 0
jbe 0x46137a
mov eax, dword [eax + 4]
push dword [eax]
call ebx
mov esi, dword [edi + 0x21ec]
test esi, esi
je 0x4613b8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x4613a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x2c], eax
push esi
call dword [0x5c001c]
mov dword [edi + 0x21ec], 0
xor eax, eax
jmp 0x4624ab
push 0x68
lea eax, [esp + 0x108]
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [edi + 0x21f8]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x104], ebx
mov dword [esp + 0x110], 0x54
mov dword [esp + 0x118], eax
mov dword [esp + 0x114], 0x14
call esi
mov dword [esp + 0x11c], eax
call esi
mov dword [esp + 0x120], eax
call esi
mov dword [esp + 0x124], eax
call esi
mov dword [esp + 0x128], eax
call esi
mov dword [esp + 0x12c], eax
call esi
mov dword [esp + 0x130], eax
call esi
mov dword [esp + 0x138], eax
call esi
mov dword [esp + 0x13c], eax
call esi
mov dword [esp + 0x140], eax
call esi
mov dword [esp + 0x144], eax
call esi
mov dword [esp + 0x150], eax
call esi
mov ecx, dword [edi + 0x1db0]
mov dword [esp + 0x10c], eax
test ecx, ecx
je 0x46148a
mov eax, dword [ecx]
lea edx, [esp + 0x104]
push 0x54
push edx
push 0
call dword [eax + 0x18]
xor esi, esi
cmp dword [edi + 0x21f8], esi
jle 0x46150c
lea ebx, [esi + 0x54]
jmp 0x4614a0
mov eax, dword [edi + 0x21f4]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x160], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x1db0]
mov dword [esp + 0x168], eax
mov eax, dword [edi + 0x21f4]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 0x1c]
add dword [esp + 0x20], eax
mov dword [esp + 0x15c], eax
test ecx, ecx
je 0x4614fc
mov eax, dword [ecx]
lea edx, [esp + 0x158]
push 0x14
push edx
push ebx
call dword [eax + 0x18]
inc esi
add ebx, 0x14
cmp esi, dword [edi + 0x21f8]
jl 0x4614a0
mov ebx, dword [esp + 0x24]
lea eax, [esi + esi*4]
mov byte [esp + 0x17], 0
shl eax, 2
lea ecx, [esp + 0x17]
sub ebx, eax
mov dword [esp + 0x6c], 0
push ecx
sub ebx, 0x54
mov dword [esp + 0x74], 0
push ebx
lea ecx, [esp + 0x74]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x34], eax
call fcn.00471990
mov dword [esp + 0xc70], 7
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x6c]
sub eax, esi
mov ecx, dword [edi + 0x1db0]
test ecx, ecx
je 0x461575
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x30]
push esi
add eax, 0x54
push eax
call dword [edx + 0x18]
mov dword [esp + 0xc70], 0xffffffff
test esi, esi
je 0x4615a6
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
xor ecx, ecx
cmp dword [edi + 0x21f8], ecx
jle 0x4615db
mov edx, dword [edi + 0x21f4]
jmp 0x4615c0
mov eax, dword [edx]
cmp dword [eax + 0x10], 0x1000600
je 0x4617f0
inc ecx
add edx, 4
cmp ecx, dword [edi + 0x21f8]
jl 0x4615c0
xor esi, esi
push 0
push 0
push 0
push 0
push 0
push 0x10004
push 0
push 0
mov ecx, esi
call fcn.004a7bf0
mov ecx, dword [0x5c0518]
mov byte [esi + 0x50], 1
cmp ecx, 0xffffffff
jne 0x46161d
mov ecx, str.Boeing
call fcn.0050c4f0
xor ecx, ecx
test al, al
setne cl
mov dword [0x5c0518], ecx
test ecx, ecx
jne 0x461746
lea eax, [esp + 0x28]
push eax
push 0x40
lea eax, [esp + 0x544]
push eax
push 0xf0000b0
call fcn.0046f310
xor ecx, ecx
cmp dword [edi + 0x21f8], ecx
jle 0x46166b
mov edx, dword [edi + 0x21f4]
mov edi, edi
mov eax, dword [edx]
cmp dword [eax + 0x10], 0x1000600
je 0x4617fe
inc ecx
add edx, 4
cmp ecx, dword [edi + 0x21f8]
jl 0x461650
xor eax, eax
push 1
lea ecx, [esp + 0x540]
push ecx
push str.virlog.dat
push 1
push eax
mov ecx, edi
call fcn.0049e9d0
lea eax, [esp + 0x28]
push eax
push 0x40
lea eax, [esp + 0x544]
push eax
push 0xf0000af
call fcn.0046f310
xor ecx, ecx
cmp dword [edi + 0x21f8], ecx
jle 0x4616cb
mov edx, dword [edi + 0x21f4]
nop
mov eax, dword [edx]
cmp dword [eax + 0x10], 0x1000600
je 0x46180c
inc ecx
add edx, 4
cmp ecx, dword [edi + 0x21f8]
jl 0x4616b0
xor eax, eax
push 8
lea ecx, [esp + 0x540]
push ecx
push str.warnlog.dat
push 2
push eax
mov ecx, edi
call fcn.0049e9d0
lea eax, [esp + 0x28]
push eax
push 0x40
lea eax, [esp + 0x544]
push eax
push 0xf0000b1
call fcn.0046f310
xor ecx, ecx
cmp dword [edi + 0x21f8], ecx
jle 0x46172b
mov edx, dword [edi + 0x21f4]
nop
mov eax, dword [edx]
cmp dword [eax + 0x10], 0x1000600
je 0x46181a
inc ecx
add edx, 4
cmp ecx, dword [edi + 0x21f8]
jl 0x461710
xor eax, eax
push 5
lea ecx, [esp + 0x540]
push ecx
push str.eScan_
push 3
push eax
mov ecx, edi
call fcn.0049e9d0
mov ecx, dword [0x5c0514]
cmp ecx, 0xffffffff
jne 0x461768
mov ecx, str.StartupCD
call fcn.0050c4f0
xor ecx, ecx
test al, al
setne cl
mov dword [0x5c0514], ecx
test ecx, ecx
je 0x461799
push 0x12000000
push 0
push 0xf000051
push 0xf000050
push 0xf00004f
push 0xf00004e
push ecx
push 0
push 0x300
push 0
push ecx
mov ecx, edi
call fcn.0046b550
mov esi, dword [0x5c6b7c]
test esi, esi
je 0x461828
cmp dword [esi + 0x170], 0
jne 0x461828
lea ecx, [esi + 0x16c]
mov eax, 1
lock xadd dword [ecx], eax
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
jne 0x461870
cmp dword [esi + 0x170], 0
je 0x461870
mov ecx, esi
call fcn.004f5900
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x461870
mov eax, dword [edi + 0x21f4]
mov esi, dword [eax + ecx*4]
jmp 0x4615dd
mov eax, dword [edi + 0x21f4]
mov eax, dword [eax + ecx*4]
jmp 0x46166d
mov eax, dword [edi + 0x21f4]
mov eax, dword [eax + ecx*4]
jmp 0x4616cd
mov eax, dword [edi + 0x21f4]
mov eax, dword [eax + ecx*4]
jmp 0x46172d
push 0x1200003a
push 0
push 0x18e
push ecx
push 0x18d
push 0x18c
push 5
push 0x400
push 2
push ecx
mov ecx, edi
call fcn.0046b350
push 0
push 0
push 0
push 0xf000034
push closesocket
push 0
push 0
push 0x1000600
mov ecx, edi
call fcn.004adbd0
mov ecx, edi
call fcn.0046aa40
lea ecx, [edi + 0x20]
call fcn.0047ec90
lea edx, [edi + 0x9624]
mov dword [edx + 8], 0
lea ecx, [edx + 0xc]
mov eax, dword [ecx]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
mov ebx, dword [eax + 4]
mov esi, ebx
cmp byte [ebx + 0xd], 0
jne 0x4618d0
mov edi, ecx
push dword [esi + 8]
mov ecx, edi
call fcn.00471ef0
mov esi, dword [esi]
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ebx, esi
cmp byte [esi + 0xd], 0
je 0x4618a6
mov edi, dword [esp + 0x78]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov eax, dword [ecx]
mov dword [eax + 8], eax
mov dword [ecx + 4], 0
mov ecx, edx
mov word [edx + 4], 0
call fcn.005064a0
mov ecx, dword [0x5c0514]
mov dword [edi + 0x983c], 0x4608a0
mov dword [edi + 0x9840], edi
cmp ecx, 0xffffffff
jne 0x461924
mov ecx, str.StartupCD
call fcn.0050c4f0
xor ecx, ecx
test al, al
setne cl
mov dword [0x5c0514], ecx
test ecx, ecx
mov ecx, edi
sete bl
call fcn.0049a490
test bl, bl
je 0x461b10
push 0xf68
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x7c], eax
mov dword [esp + 0xc70], 8
test eax, eax
je 0x461962
mov ecx, eax
call fcn.0048dfe0
jmp 0x461964
xor eax, eax
mov dword [esp + 0xc70], 0xffffffff
mov ecx, eax
mov dword [edi + 0x9da4], eax
call fcn.00428160
call fcn.0050ad90
mov ecx, dword [edi + 0x9da4]
mov dword [ecx + 8], eax
lea eax, [esp + 0x28c]
mov ecx, dword [edi + 0x9da4]
push eax
call fcn.0048f1c0
mov esi, eax
add edi, 0x1ccc
mov ecx, 0x39
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x78]
mov ecx, edi
push 0
push 0
mov eax, dword [edi + 0x9da4]
mov eax, dword [eax + 0x650]
mov dword [edi + 0x33dc], eax
call fcn.0049b110
mov ecx, edi
call fcn.0049be40
mov ecx, edi
call fcn.0049a080
test al, al
je 0x461a20
push 0
push 0x6ddd00
push 0x961
push dword [edi + 0x1c98]
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
push 0x49a2c0
push 0
push 0
call dword [0x5c00f8]
test eax, eax
je 0x461b22
push eax
call dword [0x5c001c]
jmp 0x461b22
mov esi, dword [edi + 0x9da4]
mov eax, dword [esi + 0x654]
and eax, 0xff
cmp eax, 1
je 0x461a3b
cmp eax, 2
jne 0x461a8e
cmp word [esi + 0x10], 0
je 0x461a8e
mov eax, dword [esi + 0x654]
and eax, 0xf000
cmp eax, 0x1000
je 0x461a69
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 8]
mov ecx, edi
call fcn.00499110
jmp 0x461b22
test esi, esi
je 0x461a82
mov eax, dword [esi + 0x654]
mov ecx, esi
push 0
and eax, 0xffffff00
push eax
call fcn.0042ea00
mov ecx, edi
call fcn.00499110
jmp 0x461b22
cmp byte [esi + 0x654], 3
jne 0x461ad6
push 0
call dword [sym.imp.MSVCR120.dll__time64]
add esp, 4
cmp edx, dword [esi + 0x694]
jl 0x461b09
jg 0x461ab4
cmp eax, dword [esi + 0x690]
jbe 0x461b09
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 0x690], 0
mov dword [esi + 0x694], 0
mov byte [esi + 0x654], 0
call dword [eax + 0x38]
mov byte [esp + 0x20], 0
mov eax, dword [edi + 0x9da4]
mov eax, dword [eax + 0x654]
and eax, 0xf000
cmp eax, 0x1000
je 0x461b22
cmp dword [0x5c6138], 0
je 0x461b22
push dword [esp + 0x20]
mov cl, 1
call fcn.0048ee80
jmp 0x461b22
mov byte [esp + 0x20], 1
jmp 0x461adb
push 0
push 0
mov ecx, edi
call fcn.0049b110
mov ecx, edi
call fcn.0049be40
lea ecx, [edi + 0xa088]
call fcn.004b9eb0
mov ecx, edi
call fcn.00495cb0
xor esi, esi
cmp dword [edi + 0x21f8], esi
jle 0x461b79
mov edi, edi
mov eax, dword [edi + 0x21f4]
mov ebx, dword [eax + esi*4]
cmp dword [ebx + 0x10], 0x1000600
je 0x461b70
push 0
push 0
push 0
push 0
push 0
push 0x10004
push 0
push 0
mov ecx, ebx
call fcn.004a7bf0
mov byte [ebx + 0x50], 1
inc esi
cmp esi, dword [edi + 0x21f8]
jl 0x461b40
mov ecx, dword [edi + 0x1db0]
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [edi + 0x94f4]
mov edx, 0x4608b0
push 0
push edi
call fcn.0051e670
mov eax, dword [edi + 0x21dc]
add esp, 8
test eax, eax
je 0x461bab
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [edi + 0x220e], 0
mov ecx, edi
push 1
je 0x461bcc
mov dword [esp + 0xa8], 0x8a000000
lea eax, [esp + 0xa8]
jmp 0x461bde
mov dword [esp + 0xac], 0xca000000
lea eax, [esp + 0xac]
push eax
call fcn.00496130
mov ecx, edi
call fcn.0046cb60
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0
push 0x20019
push eax
mov edx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov ecx, reloc.WS2_32.dll_bind
call fcn.00518680
movzx esi, al
add esp, 8
neg esi
lea eax, [esp + 0x5bc]
sbb esi, esi
and esi, dword [esp + 0x60]
test eax, eax
je 0x461cef
xor eax, eax
mov word [esp + 0x5bc], ax
test esi, esi
je 0x461cef
cmp eax, str.AppDataDir
je 0x461cef
mov ebx, dword [0x5c0058]
lea eax, [esp + 0x34]
push eax
push 0
lea eax, [esp + 0x94]
mov dword [esp + 0x3c], 0x208
push eax
push 0
push str.AppDataDir
push esi
call ebx
test eax, eax
jne 0x461cd9
mov eax, dword [esp + 0x8c]
cmp eax, 1
je 0x461c99
cmp eax, 2
je 0x461c99
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ax, word [esp + 0x5bc]
setne bl
jmp 0x461cf1
cmp dword [esp + 0x34], 0x208
jbe 0x461cba
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ax, word [esp + 0x5bc]
setne bl
jmp 0x461cf1
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x5c0]
push eax
lea eax, [esp + 0x94]
push eax
push 0
push str.AppDataDir
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ax, word [esp + 0x5bc]
setne bl
jmp 0x461cf1
xor bl, bl
test esi, esi
je 0x461d03
push esi
call dword [0x5c00ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
je 0x461f07
lea ecx, [esp + 0x5bc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461d15
mov esi, dword [sym.imp.MSVCR120.dll_wcsncpy_s]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x461d8a
lea eax, [ecx + 8]
cmp eax, 0x104
ja 0x461d5b
push str.Charon_
lea eax, [esp + 0x5c0]
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
jmp 0x461d8a
mov eax, 0x103
sub eax, ecx
push eax
mov eax, 0x104
sub eax, ecx
push str.Charon_
push eax
lea eax, [esp + 0x5c8]
lea eax, [eax + ecx*2]
push eax
call esi
add esp, 0x10
xor eax, eax
mov word [esp + 0x7c2], ax
push 0
lea eax, [esp + 0x5c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x5bc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461da4
sub ecx, edx
lea eax, [esp + 0x5bc]
sar ecx, 1
cmp ecx, 0x104
jae 0x461ddb
push eax
lea eax, [esp + 0xa58]
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
jmp 0x461dfd
push 0x103
push eax
lea eax, [esp + 0xa5c]
push 0x104
push eax
call esi
add esp, 0x10
xor eax, eax
mov word [esp + 0xc5a], ax
mov esi, dword [0x5c6b7c]
test esi, esi
je 0x461edb
cmp dword [esi + 0x170], 0
jne 0x461edb
lea ecx, [esi + 0x16c]
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 8]
test eax, eax
je 0x461e4d
lea ecx, [esp + 0xa54]
push ecx
push 0x2af8
call eax
add esp, 8
lea ecx, [esi + 0x16c]
mov ebx, eax
jmp 0x461e52
mov ebx, 0x1b67
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
jne 0x461e76
cmp dword [esi + 0x170], 0
je 0x461e76
mov ecx, esi
call fcn.004f5900
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
test ebx, ebx
jne 0x461edb
cmp dword [edi + 0x21ec], 0
lea ebx, [edi + 0x21e0]
jne 0x461f07
push 0xc
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x461ed4
mov eax, dword [0x5c60f4]
test eax, eax
je 0x461eac
call eax
mov dword [esi + 8], eax
lea eax, [esp + 0xf4]
mov dword [esi], 0x448d00
push eax
push 0
push esi
push 0x505940
push 0
push 0
mov dword [esi + 4], ebx
call dword [0x5c00f8]
mov dword [ebx + 0xc], eax
jmp 0x461f07
xor eax, eax
mov dword [ebx + 0xc], eax
jmp 0x461f07
cmp dword [edi + 0x9620], 0x101
jge 0x461f07
push 0
push 0
push 0
push 0xf00002f
push closesocket
push 0
push 0
push 0x1000601
mov ecx, edi
call fcn.004adbd0
mov ecx, edi
call fcn.00486eb0
mov ecx, edi
call fcn.00495cb0
mov ecx, edi
call fcn.0046d550
lea ecx, [edi + 0x98c4]
call fcn.004c9980
call fcn.0046dc90
xor eax, eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
call fcn.0043f510
push dword [esp + 0x94]
lea eax, [esp + 0x958]
push dword [esp + 0x94]
push str.HIPS:_P_u_R_u
push 0xffffffffffffffff
push 0x80
push eax
call dword [sym.imp.MSVCR120.dll__snwprintf_s]
add esp, 0x18
lea eax, [esp + 0x954]
push 0
push 0
push 0
push ecx
push 5
push eax
push 0
push 0
push 0
push 0x1000600
mov ecx, edi
call fcn.004ada60
mov ecx, edi
call fcn.004b8130
mov ecx, dword [edi + 0x94f4]
lea esi, [edi + 0x9b08]
push 0
push esi
mov edx, 0x4cdba0
call fcn.0051e670
mov ecx, dword [edi + 0x94f4]
mov edx, 0x4cdbc0
push 0
push esi
call fcn.0051e670
add esp, 0x10
test byte [edi + 0x9e58], 8
je 0x461fe8
mov eax, dword [edi + 0x9a78]
test eax, eax
je 0x461fe8
push 1
push eax
call dword [0x5c0118]
push 0
push 0
push 0
push 0
call dword [0x5c0018]
mov dword [edi + 0x9df0], eax
test eax, eax
je 0x46207a
mov dword [edi + 0x9dc0], 0x459c70
mov edx, 0x459d30
mov dword [edi + 0x9dd8], edi
mov dword [edi + 0x9dc4], 0x459c90
mov dword [edi + 0x9ddc], edi
mov dword [edi + 0x9dc8], 0x459cb0
mov dword [edi + 0x9de0], edi
mov dword [edi + 0x9dcc], 0x459cd0
mov dword [edi + 0x9de4], edi
mov dword [edi + 0x9dd0], 0x459cf0
mov dword [edi + 0x9de8], edi
mov dword [edi + 0x9dd4], 0x459d10
mov dword [edi + 0x9dec], edi
mov ecx, dword [edi + 0x94f4]
push 0
push edi
call fcn.0051e670
add esp, 8
lea eax, [esp + 0x18]
mov edx, str.SoftwareESETESET_SecurityCurrentVersionInfo
push 0x2001b
push eax
mov ecx, reloc.WS2_32.dll_bind
xor ebx, ebx
call fcn.00518680
add esp, 8
test al, al
je 0x462146
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x40]
push eax
push ebx
lea eax, [esp + 0x70]
mov dword [esp + 0x48], 4
push eax
push ebx
push str.InstallationStatus
push esi
call dword [0x5c0058]
test eax, eax
jne 0x46211e
cmp dword [esp + 0x68], 4
je 0x4620d3
push 0xd
jmp 0x46211f
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 4
push eax
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x70]
push eax
push 0
push str.InstallationStatus
push esi
call dword [0x5c0058]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x462125
mov ebx, dword [esp + 0xb0]
push str.InstallationStatus
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x18]
call dword [0x5c00ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x462146
mov ecx, edi
call fcn.004ab5c0
jmp 0x4622d1
call fcn.00489c70
test al, al
je 0x4622d1
lea eax, [esp + 0x3c]
mov dword [esp + 0x48], 0
push eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x40], 0
push eax
call fcn.0054f8bc
test eax, eax
jne 0x4622d1
xor esi, esi
cmp dword [esp + 0x48], esi
jbe 0x4622c8
mov ebx, dword [0x5c03e4]
lea esp, [esp]
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
mov eax, dword [esp + 0x40]
lea eax, [eax + esi*8]
push eax
call fcn.0054f8c4
test eax, eax
jne 0x4622bd
mov eax, dword [0x5c704c]
test al, 1
jne 0x462246
or eax, 1
mov dword [0x5c704c], eax
mov dword [esp + 0xc70], 9
lea eax, [esp + 0x16c]
push eax
mov dword [esp + 0x170], 0x11c
call ebx
test eax, eax
je 0x46221f
push 0x11c
lea eax, [esp + 0x170]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 0x16c], 0x114
lea eax, [esp + 0x16c]
push eax
call ebx
test eax, eax
je 0x46221f
xor al, al
jmp 0x462236
mov eax, dword [esp + 0x170]
cmp eax, 6
ja 0x462234
jne 0x46221b
mov eax, dword [esp + 0x174]
mov al, 1
mov byte [0x5c7050], al
mov dword [esp + 0xc70], 0xffffffff
cmp byte [0x5c7050], 0
mov eax, dword [esp + 0x30]
je 0x462259
cmp dword [eax + 0x28], 0
je 0x4622b7
lea ecx, [esp + 0x50]
push ecx
push dword [eax + 0x28]
call fcn.0054f9ac
cmp eax, 1
jne 0x4622b3
push dword [esp + 0x50]
mov edx, dword [0x5c001c]
lea ecx, [esp + 0xfc]
call fcn.004722c0
add esp, 4
mov dword [esp + 0xc70], 0xa
mov ecx, edi
push 0
push dword [esp + 0x54]
call fcn.004984b0
mov dword [esp + 0xc70], 0xffffffff
lea ecx, [esp + 0xf8]
call fcn.004725d0
mov eax, dword [esp + 0x30]
push eax
call fcn.0054f8cc
inc esi
cmp esi, dword [esp + 0x48]
jb 0x462190
push dword [esp + 0x3c]
call fcn.0054f8cc
push 1
push 0x573978
mov byte [edi + 0x9e34], 0
push dword [0x5c080c]
call dword [0x5c0128]
mov ecx, edi
mov dword [edi + 0x9e38], eax
call fcn.0046f4b0
lea eax, [esp + 0x18]
mov edx, str.SoftwareESETESET_SecurityCurrentVersionInfo
push 0x2001b
push eax
mov ecx, reloc.WS2_32.dll_bind
call fcn.00518680
add esp, 8
test al, al
je 0x4623cd
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x44]
mov ebx, dword [0x5c0058]
push eax
push 0
lea eax, [esp + 0x5c]
mov dword [esp + 0x4c], 4
push eax
push 0
push str.ScheduleFirstScan
push esi
call ebx
test eax, eax
je 0x462351
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4623bc
cmp dword [esp + 0x54], 4
je 0x462362
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4623bc
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 4
push eax
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push str.ScheduleFirstScan
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call ebx
test esi, esi
jne 0x4623bc
xor eax, eax
mov ecx, edi
cmp eax, dword [esp + 0xb4]
sbb eax, eax
neg eax
push eax
call fcn.004b8580
push str.ScheduleFirstScan
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call ebx
push dword [esp + 0x18]
call dword [0x5c00ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.MSVCR120.dll_rand]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
and eax, 0x7fff
add eax, 0x4e20
push 0
lea eax, [eax + eax*2]
add eax, eax
push eax
push 0x95f
push dword [edi + 0x1c98]
call esi
mov ecx, edi
call fcn.0048b050
mov ecx, dword [0x5c0514]
cmp ecx, 0xffffffff
jne 0x462421
mov ecx, str.StartupCD
call fcn.0050c4f0
xor ecx, ecx
test al, al
setne cl
mov dword [0x5c0514], ecx
test ecx, ecx
jne 0x462438
push ecx
push 0x1388
push 0x963
push dword [edi + 0x1c98]
call esi
mov ecx, edi
call fcn.00470930
xor eax, eax
push eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
lea eax, [esp + 0x9c]
push 8
push eax
push 0x67
mov dword [esp + 0xa8], 8
call dword [0x5c0148]
test eax, eax
jne 0x4624a6
mov eax, dword [esp + 0x9c]
shr eax, 0xa
and al, 1
je 0x4624a6
push 0x12000029
push 0
push 0
push 0
push 0xf0000e6
push 0xf0000e5
push ecx
push 0x1a
push 0x400
push 1
push ecx
mov ecx, edi
call fcn.0046b550
mov eax, 1
mov ecx, dword [esp + 0xc68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc50]
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret