Function at 0x46d3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475c07
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x4922f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5f8], ecx
mov eax, dword [ebp - 0x5f8]
mov ecx, dword [eax]
mov dword [ebp - 0x5fc], ecx
mov edx, dword [ebp - 0x5fc]
sub edx, 1
mov dword [ebp - 0x5fc], edx
cmp dword [ebp - 0x5fc], 5
ja case.default.0x46d3fe
mov eax, dword [ebp - 0x5fc]
jmp dword [eax*4 + 0x46e084]
push 0x484408
lea ecx, [ebp - 0x28]
call fcn.00401650
mov dword [ebp - 4], 0
push str.Mailru_installCheck
lea ecx, [ebp - 0x44]
call fcn.00401650
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x600], eax
mov edx, dword [ebp - 0x600]
mov dword [ebp - 0x604], edx
mov byte [ebp - 4], 2
push 0x484404
mov eax, dword [ebp - 0x604]
push eax
call fcn.00402d40
add esp, 8
mov ecx, dword [ebp - 0x5f8]
mov byte [ecx + 0x59], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.004016d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004016d0
jmp case.default.0x46d3fe
push 0x484428
lea ecx, [ebp - 0x7c]
call fcn.00401650
mov dword [ebp - 4], 3
push str.Yandex_installFullCheck
lea ecx, [ebp - 0x98]
call fcn.00401650
mov byte [ebp - 4], 4
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0xb4]
push edx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x60c], eax
mov byte [ebp - 4], 5
push 0x484424
mov ecx, dword [ebp - 0x60c]
push ecx
call fcn.00402d40
add esp, 8
mov byte [0x495a79], al
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb4]
call fcn.004016d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.004016d0
movzx edx, byte [0x495a79]
test edx, edx
jne 0x46d753
push 0x48444c
lea ecx, [ebp - 0xd0]
call fcn.00401650
mov dword [ebp - 4], 6
push str.Yandex_agreeBarCheck
lea ecx, [ebp - 0xec]
call fcn.00401650
mov byte [ebp - 4], 7
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xec]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x610], eax
mov ecx, dword [ebp - 0x610]
mov dword [ebp - 0x614], ecx
mov byte [ebp - 4], 8
push 0x484448
mov edx, dword [ebp - 0x614]
push edx
call fcn.00402d40
add esp, 8
mov byte [0x495a7a], al
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x108]
call fcn.004016d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xec]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.004016d0
push 0x484470
lea ecx, [ebp - 0x124]
call fcn.00401650
mov dword [ebp - 4], 9
push str.Yandex_agreeHomeCheck
lea ecx, [ebp - 0x140]
call fcn.00401650
mov byte [ebp - 4], 0xa
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x15c]
push eax
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x618], eax
mov ecx, dword [ebp - 0x618]
mov dword [ebp - 0x61c], ecx
mov byte [ebp - 4], 0xb
push 0x48446c
mov edx, dword [ebp - 0x61c]
push edx
call fcn.00402d40
add esp, 8
mov byte [0x495a7b], al
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x15c]
call fcn.004016d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x140]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.004016d0
push 0x484494
lea ecx, [ebp - 0x178]
call fcn.00401650
mov dword [ebp - 4], 0xc
push str.Yandex_agreeSearchCheck
lea ecx, [ebp - 0x194]
call fcn.00401650
mov byte [ebp - 4], 0xd
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x178]
push ecx
lea edx, [ebp - 0x194]
push edx
lea eax, [ebp - 0x1b0]
push eax
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x620], eax
mov ecx, dword [ebp - 0x620]
mov dword [ebp - 0x624], ecx
mov byte [ebp - 4], 0xe
push 0x484490
mov edx, dword [ebp - 0x624]
push edx
call fcn.00402d40
add esp, 8
mov byte [0x495a88], al
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1b0]
call fcn.004016d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x194]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.004016d0
movzx eax, byte [0x495a79]
movzx ecx, byte [0x495a7a]
or eax, ecx
movzx edx, byte [0x495a7b]
or eax, edx
movzx ecx, byte [0x495a88]
or eax, ecx
mov edx, dword [ebp - 0x5f8]
mov byte [edx + 0x59], al
jmp case.default.0x46d3fe
push 0x4844b8
lea ecx, [ebp - 0x1cc]
call fcn.00401650
mov dword [ebp - 4], 0xf
push str.BabylonGarbage_downloadCheck
lea ecx, [ebp - 0x1e8]
call fcn.00401650
mov byte [ebp - 4], 0x10
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1cc]
push ecx
lea edx, [ebp - 0x1e8]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x628], eax
mov ecx, dword [ebp - 0x628]
mov dword [ebp - 0x62c], ecx
mov byte [ebp - 4], 0x11
push 0x4844b4
mov edx, dword [ebp - 0x62c]
push edx
call fcn.00402d40
add esp, 8
mov byte [0x495a89], al
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x204]
call fcn.004016d0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1e8]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1cc]
call fcn.004016d0
push 0x4844e4
lea ecx, [ebp - 0x220]
call fcn.00401650
mov dword [ebp - 4], 0x12
push str.BabylonGarbage_installToolbarCheck
lea ecx, [ebp - 0x23c]
call fcn.00401650
mov byte [ebp - 4], 0x13
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x258]
push eax
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x630], eax
mov ecx, dword [ebp - 0x630]
mov dword [ebp - 0x634], ecx
mov byte [ebp - 4], 0x14
push 0x4844e0
mov edx, dword [ebp - 0x634]
push edx
call fcn.00402d40
add esp, 8
mov byte [0x495a8a], al
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x258]
call fcn.004016d0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x23c]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.004016d0
push 0x484514
lea ecx, [ebp - 0x274]
call fcn.00401650
mov dword [ebp - 4], 0x15
push str.BabylonGarbage_installSearchCheck
lea ecx, [ebp - 0x290]
call fcn.00401650
mov byte [ebp - 4], 0x16
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x274]
push ecx
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x2ac]
push eax
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x638], eax
mov ecx, dword [ebp - 0x638]
mov dword [ebp - 0x63c], ecx
mov byte [ebp - 4], 0x17
push 0x484510
mov edx, dword [ebp - 0x63c]
push edx
call fcn.00402d40
add esp, 8
mov byte [0x495a8b], al
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x2ac]
call fcn.004016d0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x290]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x274]
call fcn.004016d0
push 0x484544
lea ecx, [ebp - 0x2c8]
call fcn.00401650
mov dword [ebp - 4], 0x18
push str.BabylonGarbage_installHpCheck
lea ecx, [ebp - 0x2e4]
call fcn.00401650
mov byte [ebp - 4], 0x19
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c8]
push ecx
lea edx, [ebp - 0x2e4]
push edx
lea eax, [ebp - 0x300]
push eax
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x640], eax
mov ecx, dword [ebp - 0x640]
mov dword [ebp - 0x644], ecx
mov byte [ebp - 4], 0x1a
push 0x484540
mov edx, dword [ebp - 0x644]
push edx
call fcn.00402d40
add esp, 8
mov byte [0x495a8c], al
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x300]
call fcn.004016d0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2e4]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c8]
call fcn.004016d0
mov eax, dword [ebp - 0x5f8]
mov cl, byte [0x495a89]
mov byte [eax + 0x59], cl
jmp case.default.0x46d3fe
push 0x484570
lea ecx, [ebp - 0x31c]
call fcn.00401650
mov dword [ebp - 4], 0x1b
push str.Babylones_installCheck
lea ecx, [ebp - 0x338]
call fcn.00401650
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x338]
push ecx
lea edx, [ebp - 0x354]
push edx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x64c], eax
mov byte [ebp - 4], 0x1d
push 0x48456c
mov ecx, dword [ebp - 0x64c]
push ecx
call fcn.00402d40
add esp, 8
mov byte [0x495a8d], al
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x354]
call fcn.004016d0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x338]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.004016d0
push 0x484594
lea ecx, [ebp - 0x370]
call fcn.00401650
mov dword [ebp - 4], 0x1e
push str.Babylones_installSearchCheck
lea ecx, [ebp - 0x38c]
call fcn.00401650
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0x38c]
push ecx
lea edx, [ebp - 0x3a8]
push edx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x654], eax
mov byte [ebp - 4], 0x20
push 0x484590
mov ecx, dword [ebp - 0x654]
push ecx
call fcn.00402d40
add esp, 8
mov byte [0x495a8e], al
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3a8]
call fcn.004016d0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x38c]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x370]
call fcn.004016d0
push 0x4845c0
lea ecx, [ebp - 0x3c4]
call fcn.00401650
mov dword [ebp - 4], 0x21
push str.Babylones_installHpCheck
lea ecx, [ebp - 0x3e0]
call fcn.00401650
mov byte [ebp - 4], 0x22
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x3e0]
push ecx
lea edx, [ebp - 0x3fc]
push edx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x65c], eax
mov byte [ebp - 4], 0x23
push 0x4845bc
mov ecx, dword [ebp - 0x65c]
push ecx
call fcn.00402d40
add esp, 8
mov byte [0x495a8f], al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x3fc]
call fcn.004016d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x3e0]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.004016d0
push 0x4845e8
lea ecx, [ebp - 0x418]
call fcn.00401650
mov dword [ebp - 4], 0x24
push str.Babylones_rvtCheck
lea ecx, [ebp - 0x434]
call fcn.00401650
mov byte [ebp - 4], 0x25
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x450]
push edx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x664], eax
mov byte [ebp - 4], 0x26
push 0x4845e4
mov ecx, dword [ebp - 0x664]
push ecx
call fcn.00402d40
add esp, 8
mov byte [0x495a90], al
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x450]
call fcn.004016d0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x434]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.004016d0
mov edx, dword [ebp - 0x5f8]
mov al, byte [0x495a8d]
mov byte [edx + 0x59], al
jmp case.default.0x46d3fe
push 0x484608
lea ecx, [ebp - 0x46c]
call fcn.00401650
mov dword [ebp - 4], 0x27
push str.whitesmokeInstallCheck
lea ecx, [ebp - 0x488]
call fcn.00401650
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x46c]
push edx
lea eax, [ebp - 0x488]
push eax
lea ecx, [ebp - 0x4a4]
push ecx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x668], eax
mov edx, dword [ebp - 0x668]
mov dword [ebp - 0x66c], edx
mov byte [ebp - 4], 0x29
push 0x484604
mov eax, dword [ebp - 0x66c]
push eax
call fcn.00402d40
add esp, 8
mov byte [0x495a91], al
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x4a4]
call fcn.004016d0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x488]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.004016d0
push 0x48462c
lea ecx, [ebp - 0x4c0]
call fcn.00401650
mov dword [ebp - 4], 0x2a
push str.whitesmokeInstallToolbarCheck
lea ecx, [ebp - 0x4dc]
call fcn.00401650
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x4c0]
push edx
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x670], eax
mov edx, dword [ebp - 0x670]
mov dword [ebp - 0x674], edx
mov byte [ebp - 4], 0x2c
push 0x484628
mov eax, dword [ebp - 0x674]
push eax
call fcn.00402d40
add esp, 8
mov byte [0x495a92], al
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x4f8]
call fcn.004016d0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x4dc]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c0]
call fcn.004016d0
push 0x484658
lea ecx, [ebp - 0x514]
call fcn.00401650
mov dword [ebp - 4], 0x2d
push str.whitesmokeInstallSearchCheck
lea ecx, [ebp - 0x530]
call fcn.00401650
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x54c]
push ecx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x678], eax
mov edx, dword [ebp - 0x678]
mov dword [ebp - 0x67c], edx
mov byte [ebp - 4], 0x2f
push 0x484654
mov eax, dword [ebp - 0x67c]
push eax
call fcn.00402d40
add esp, 8
mov byte [0x495a93], al
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x54c]
call fcn.004016d0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x530]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x514]
call fcn.004016d0
push 0x484684
lea ecx, [ebp - 0x568]
call fcn.00401650
mov dword [ebp - 4], 0x30
push str.whitesmokeInstallHpCheck
lea ecx, [ebp - 0x584]
call fcn.00401650
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x584]
push eax
lea ecx, [ebp - 0x5a0]
push ecx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x680], eax
mov edx, dword [ebp - 0x680]
mov dword [ebp - 0x684], edx
mov byte [ebp - 4], 0x32
push 0x484680
mov eax, dword [ebp - 0x684]
push eax
call fcn.00402d40
add esp, 8
mov byte [0x495a94], al
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x5a0]
call fcn.004016d0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x584]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x568]
call fcn.004016d0
push str.checked
lea ecx, [ebp - 0x5bc]
call fcn.00401650
mov dword [ebp - 4], 0x33
push str.pagerageInstallRadio
lea ecx, [ebp - 0x5d8]
call fcn.00401650
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x5bc]
push edx
lea eax, [ebp - 0x5d8]
push eax
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.0046d2b0
add esp, 0x10
mov dword [ebp - 0x688], eax
mov edx, dword [ebp - 0x688]
mov dword [ebp - 0x68c], edx
mov byte [ebp - 4], 0x35
push 0x4846a8
mov eax, dword [ebp - 0x68c]
push eax
call fcn.00402d40
add esp, 8
mov byte [0x495a95], al
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x5f4]
call fcn.004016d0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x5d8]
call fcn.004016d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.004016d0
movzx ecx, byte [0x495a91]
movzx edx, byte [0x495a95]
or ecx, edx
mov eax, dword [ebp - 0x5f8]
mov byte [eax + 0x59], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4