Function at 0x4ab210
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Enumerate processes
Self delete

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x687716
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x580
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x540], edx
push 0x7aa598
mov dword [ebp - 0x580], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x46cbf0
push 0x16
call fcn.0065e825
push 3
push 0
call fcn.0065e9d7
push 0x46cbf0
call fcn.00658e37
add esp, 0x14
push 0x46cbf0
call fcn.0064c3c7
add esp, 4
push 0x46cbf0
call fcn.0064c0ff
add esp, 4
push 0x46cbf0
call fcn.00655b38
add esp, 4
push 0x46cb00
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov word [ebp - 0x574], 0
mov dword [ebp - 0x570], 0
mov dword [ebp - 0x56c], 0
call fcn.004b6240
mov dword [ebp - 0x570], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x564], 0
call fcn.004b64c0
mov dword [ebp - 0x568], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 0
call fcn.004696a0
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 2
push 0
push 0
mov dword [ebp - 0x558], fcn.0044fac0
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x548], 0
call fcn.004b6680
mov dword [ebp - 0x54c], eax
lea eax, [ebp - 0x554]
push eax
mov dword [ebp - 0x554], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x550], eax
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
mov esi, eax
push 2
mov dword [ebp - 0x530], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x2ec], edi
push 0x228
lea eax, [ebp - 0x524]
mov byte [ebp - 4], 4
push 0
push eax
mov dword [ebp - 0x528], 0x22c
call fcn.0064cc00
add esp, 0xc
lea eax, [ebp - 0x528]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4ab456
cmp dword [ebp - 0x520], esi
jne 0x4ab444
push dword [ebp - 0x510]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x22c], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x4ab42f
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x4ab53a
mov byte [ebp - 4], 4
test esi, esi
je 0x4ab43e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x530]
lea eax, [ebp - 0x528]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4ab3e7
xor eax, eax
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
test edi, edi
je 0x4ab47e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], 0x7745bc
mov dword [ebp - 0x2e0], str._firefox.exe
xor edi, edi
mov dword [ebp - 0x2dc], str.opera.exe
mov dword [ebp - 0x2d8], str.iexplore.exe
mov dword [ebp - 0x2d4], str.YandexBrowserApplication_browser.exe
mov dword [ebp - 0x530], eax
nop
push 1
mov byte [ebp - 4], 7
call fcn.005fe0d9
mov esi, eax
mov dword [ebp - 0x2ec], esi
push ecx
mov ecx, esp
mov byte [ebp - 4], 9
mov dword [ecx + 4], esi
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 4]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x288]
mov edx, dword [ebp - 0x530]
call fcn.004ad120
add esp, 8
mov byte [ebp - 0x535], al
mov byte [ebp - 4], 0xa
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x4ab51b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp byte [ebp - 0x535], 0
mov byte [ebp - 4], 6
jne 0x4ab59b
add dword [ebp - 0x530], 4
inc edi
cmp edi, 5
jb 0x4ab4c0
jmp 0x4ab5bd
xor eax, eax
mov dword [ebp - 0x278], 0
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ab560
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.00459550
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test edi, edi
je 0x4ab47e
push edi
call esi
jmp 0x4ab47e
push reloc.WS2_32.dll_accept
sub esp, 0x18
mov ecx, esp
call fcn.0046ce70
lea edx, [ebp - 0x288]
mov ecx, str.ParentBrowserPath
call fcn.0046d250
add esp, 0x1c
xor eax, eax
mov byte [ebp - 0x532], 0
mov byte [ebp - 0x531], 0
mov byte [ebp - 0x594], 0
mov byte [ebp - 0x590], 0
mov byte [ebp - 0x53b], 0
mov byte [ebp - 0x58c], 0
mov byte [ebp - 0x534], 0
mov byte [ebp - 0x536], 0
mov byte [ebp - 0x541], 0
mov byte [ebp - 0x529], 0
mov byte [ebp - 0x52a], 0
mov byte [ebp - 0x53a], 0
mov byte [ebp - 0x539], 0
mov byte [ebp - 0x588], 0
mov byte [ebp - 0x57c], 0
mov byte [ebp - 0x53c], 0
mov byte [ebp - 0x537], 0
mov byte [ebp - 0x52b], 0
mov byte [ebp - 0x538], 0
mov byte [ebp - 0x533], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 7
mov word [ebp - 0x2a0], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x574]
mov byte [ebp - 0x580], al
mov byte [ebp - 0x578], al
lea eax, [ebp - 0x532]
push eax
push str.permachine
call fcn.004b5ff0
lea eax, [ebp - 0x531]
push eax
push str.peruser
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x594]
push eax
push str.nodesktop
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x590]
push eax
push str.nowizardfocus
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x58c]
push eax
push str.norestart
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x534]
push eax
push str.silent
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x536]
push eax
push str.launchdisk
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x541]
push eax
push str.install
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x529]
push eax
push str.uninstall
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x52a]
push eax
push str.nolicence
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x53b]
push eax
push str.hidewizard
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x53a]
push eax
push str.startDisk
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x539]
push eax
push str.retranslate
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x588]
push eax
push str.silentinauditmode
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x57c]
push eax
push str.delayautostart
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x53c]
push eax
push str.hidewizardcomplete
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
push dword [ebp - 0x540]
lea ecx, [ebp - 0x574]
push str.nosendtelemetry
call fcn.004b5ff0
lea eax, [ebp - 0x537]
push eax
push str.uselocalinstaller
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x52b]
push eax
push str.upgrade
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x580]
push eax
push str.authorize
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x538]
push eax
push str.upgradeFromDisk1
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x533]
push eax
push str.installtelemost
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
lea eax, [ebp - 0x578]
push eax
push str.setautoproxy
lea ecx, [ebp - 0x574]
call fcn.004b5ff0
xor eax, eax
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 7
mov word [ebp - 0x2d0], ax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], 7
mov word [ebp - 0x270], ax
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], 7
mov word [ebp - 0x2b8], ax
sub esp, 0x28
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ecx], 0x7751a8
mov dword [ecx + 4], 0x4a81d0
mov al, byte [ebp - 0x529]
mov byte [ecx + 8], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 9], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xa], al
push 0
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.sendreport
call fcn.004b59b0
sub esp, 0x28
lea eax, [ebp - 0x2d0]
mov ecx, esp
push 0
mov dword [ecx], 0x77518c
mov dword [ecx + 4], 0x4a82d0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x584]
mov dword [ecx + 0xc], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x18], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.userpid
call fcn.004b59b0
sub esp, 0x28
lea eax, [ebp - 0x270]
mov ecx, esp
push 0
mov dword [ecx], 0x7751c4
mov dword [ecx + 4], 0x4a8370
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.settoken
call fcn.004b59b0
sub esp, 0x28
lea eax, [ebp - 0x2b8]
mov ecx, esp
push 0
mov dword [ecx], 0x7751c4
mov dword [ecx + 4], 0x4a8370
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.dstr
call fcn.004b59b0
sub esp, 0x28
lea eax, [ebp - 0x2a0]
mov ecx, esp
push 0
mov dword [ecx], 0x7751c4
mov dword [ecx + 4], 0x4a8370
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push 0x774e38
call fcn.004b59b0
xor esi, esi
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0xf
call fcn.004b4bf0
cmp dword [ebp - 0x554], 1
jne 0x4abaed
lea ecx, [ebp - 0x98]
call fcn.0048bb50
mov byte [ebp - 4], 0x10
call fcn.00485670
mov cl, al
lea eax, [esi + 2]
test cl, cl
je 0x4abab5
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x240]
call fcn.004518d0
lea eax, [esi + 7]
mov byte [ebp - 0x535], 1
cmp dword [ebp - 0x230], esi
jne 0x4ababc
mov byte [ebp - 0x535], 0
test al, 1
je 0x4abacb
lea ecx, [ebp - 0x240]
call fcn.0044fa30
cmp byte [ebp - 0x535], 0
je 0x4abade
mov ecx, 0x70bd
call fcn.00497160
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xf
call fcn.0048bbb0
mov al, byte [ebp - 0x531]
test al, al
je 0x4abb33
cmp byte [ebp - 0x532], 0
je 0x4abb25
mov ecx, dword [0x7aa7a8]
test ecx, ecx
je 0x4abb1e
mov eax, dword [ecx]
push 0x774e40
push ecx
call dword [eax + 4]
mov al, byte [ebp - 0x531]
add esp, 8
mov byte [ebp - 0x532], 0
test al, al
je 0x4abb33
mov ecx, 0x70d6
call fcn.00497160
cmp byte [ebp - 0x53c], 0
mov edi, 1
je 0x4abb46
lea esi, [edi + 1]
jmp 0x4abb50
cmp byte [ebp - 0x53b], 0
cmovne esi, edi
push 0x118
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x11c
push 0
push eax
call fcn.0064cc00
add esp, 0xc
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x2c], 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x10
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x33
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x4abde8
push 0x118
push eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x11c
push eax
call fcn.0064cc00
add esp, 0xc
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x138], 2
mov dword [ebp - 0x2c], 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x10
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x33
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x4abde8
cmp byte [ebp - 0x534], al
jne 0x4abcbb
mov edx, 0x474
lea ecx, [ebp - 0x240]
call fcn.00478590
mov esi, eax
mov edx, 0x4ec
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x258]
call fcn.00478590
cmp dword [esi + 0x14], 8
jb 0x4abc91
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x4abc99
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
mov eax, dword [ebp - 0x550]
test eax, eax
je 0x4abd0d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x550], 0
lea ecx, [ebp - 0x54c]
call fcn.004b66d0
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x560]
mov esi, dword [ebp - 0x560]
push dword [esi + 4]
call fcn.004b65a0
mov eax, dword [ebp - 0x560]
push 0x2c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x560]
mov dword [eax], esi
mov eax, dword [ebp - 0x560]
mov dword [eax + 8], esi
push dword [ebp - 0x560]
mov dword [ebp - 0x55c], 0
call fcn.006113da
add esp, 8
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x568]
mov esi, dword [ebp - 0x568]
push dword [esi + 4]
call fcn.004b64e0
mov eax, dword [ebp - 0x568]
push 0x28
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x568]
mov dword [eax], esi
mov eax, dword [ebp - 0x568]
mov dword [eax + 8], esi
push dword [ebp - 0x568]
mov dword [ebp - 0x564], 0
call fcn.006113da
mov eax, dword [ebp - 0x570]
lea ecx, [ebp - 0x570]
add esp, 8
push eax
push dword [eax]
lea eax, [ebp - 0x22c]
push eax
call fcn.004b6310
push 0x50
push dword [ebp - 0x570]
call fcn.006113da
add esp, 8
mov eax, edi
jmp 0x4aca4b
push 0
mov edx, edi
mov ecx, 6
call fcn.0046cce0
add esp, 4
test al, al
je 0x4abf86
mov edx, 2
push 0
lea ecx, [edx + 4]
call fcn.0046cce0
add esp, 4
test al, al
jne 0x4abf86
call fcn.004ab030
test al, al
jne 0x4abf86
cmp byte [ebp - 0x534], al
jne 0x4abebd
mov edx, 0x474
lea ecx, [ebp - 0x240]
call fcn.00478590
mov esi, eax
mov edx, 0x4ed
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x258]
call fcn.00478590
cmp dword [esi + 0x14], 8
jb 0x4abe62
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x4abe6a
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x258]
mov esi, eax
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0xf
call fcn.00453390
cmp esi, 1
jne 0x4abebd
mov edx, 0x4ee
lea ecx, [ebp - 0x258]
call fcn.00478590
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.004a6c00
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
mov eax, dword [ebp - 0x550]
test eax, eax
je 0x4abf0f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x550], 0
lea ecx, [ebp - 0x54c]
call fcn.004b66d0
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x560]
mov esi, dword [ebp - 0x560]
push dword [esi + 4]
call fcn.004b65a0
mov eax, dword [ebp - 0x560]
push 0x2c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x560]
mov dword [eax], esi
mov eax, dword [ebp - 0x560]
mov dword [eax + 8], esi
push dword [ebp - 0x560]
mov dword [ebp - 0x55c], 0
call fcn.0044fc50
add esp, 8
lea ecx, [ebp - 0x568]
call fcn.004b6530
lea ecx, [ebp - 0x570]
call fcn.004b6490
mov eax, edi
jmp 0x4aca4b
lea ecx, [ebp - 0x574]
call fcn.004b48e0
cmp byte [ebp - 0x573], 0
mov dword [ebp - 0x540], eax
je 0x4abfed
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
lea ecx, [ebp - 0x574]
call fcn.004b6100
mov eax, dword [ebp - 0x540]
jmp 0x4aca4b
cmp dword [ebp - 0x290], 0
jne 0x4ac04c
mov dl, 1
lea ecx, [ebp - 0x240]
call fcn.0046bb10
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x17
call fcn.0044fa20
mov edx, eax
lea ecx, [ebp - 0x258]
call fcn.0046b1e0
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00458230
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00464910
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
call fcn.0044fa30
push dword [ebp - 0x57c]
mov dl, byte [ebp - 0x531]
push dword [ebp - 0x588]
mov cl, byte [ebp - 0x532]
push dword [ebp - 0x58c]
push dword [ebp - 0x590]
push dword [ebp - 0x594]
call fcn.004aafe0
add esp, 0x14
mov dword [ebp - 0x540], eax
lea ecx, [ebp - 0x2e8]
call fcn.00451510
mov byte [ebp - 4], 0x19
cmp byte [ebp - 0x53a], 0
je 0x4ac465
lea ecx, [ebp - 0x98]
call fcn.0048bb50
mov byte [ebp - 4], 0x1a
call fcn.00485670
cmp dword [ebp - 0x260], 0
jne 0x4ac1b1
call fcn.004aaa70
test al, al
jne 0x4ac1b1
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x240]
call fcn.004518d0
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x240]
call fcn.0044fa30
test esi, esi
je 0x4ac1b1
mov ecx, 0x70be
call fcn.00497160
lea eax, [ebp - 0x98]
mov dword [ebp - 0x530], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.004518d0
lea eax, [ebp - 0x530]
mov byte [ebp - 4], 0x1b
push eax
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x258]
call fcn.004a9510
add esp, 4
lea ecx, [ebp - 0x2e8]
push eax
call fcn.0046abd0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
mov edx, dword [ebp - 0x530]
mov ecx, str.ALState
call fcn.0046d5e0
cmp dword [ebp - 0x2d8], 0
je 0x4ac1a7
mov ecx, 0x70bf
call fcn.00497160
mov dl, byte [ebp - 0x52a]
lea ecx, [ebp - 0x2e8]
push 0
push 0
push 1
push 0
push 1
call fcn.004aab50
add esp, 0x14
jmp 0x4ac1b1
mov ecx, 0x70c0
call fcn.00497160
call fcn.0046d940
mov edx, edi
mov ecx, str.DiskStartAfterSetup
call fcn.0046d5e0
cmp byte [ebp - 0x533], 0
je 0x4ac1e3
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x270]
call fcn.0048cc80
mov byte [ebp - 0x533], 0
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7b40
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
jne 0x4ac213
mov ecx, str.SetupID
call fcn.0046da20
jmp 0x4ac263
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7b40
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x1c
push eax
call fcn.00635db0
add esp, 8
mov edx, eax
mov byte [ebp - 4], 0x1d
mov ecx, str.SetupID
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7b60
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
jne 0x4ac293
mov ecx, str.SetupDDate
call fcn.0046da20
jmp 0x4ac2e3
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7b60
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x1e
push eax
call fcn.00635db0
add esp, 8
mov edx, eax
mov byte [ebp - 4], 0x1f
mov ecx, str.SetupDDate
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7b80
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
jne 0x4ac313
mov ecx, str.SetupSrc
call fcn.0046da20
jmp 0x4ac363
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7b80
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x20
push eax
call fcn.00635db0
add esp, 8
mov edx, eax
mov byte [ebp - 4], 0x21
mov ecx, str.SetupSrc
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
push dword [ebp - 0x578]
mov dl, byte [ebp - 0x52a]
lea ecx, [ebp - 0x270]
push 1
push 0
push dword [ebp - 0x580]
push 0
call fcn.004aab50
add esp, 0x14
lea ecx, [ebp - 0x98]
mov edi, eax
lea eax, [ebp - 0x258]
push eax
call fcn.00489500
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
je 0x4ac406
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.00489500
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x22
push eax
call fcn.00635db0
add esp, 8
mov ecx, eax
push 1
push 0
push 0
call fcn.00458230
push eax
push 0x76b26c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
call fcn.0044fa30
lea ecx, [ebp - 0x98]
call fcn.0048bbb0
lea ecx, [ebp - 0x2e8]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
lea ecx, [ebp - 0x574]
call fcn.004b6100
mov eax, edi
jmp 0x4aca4b
cmp byte [ebp - 0x539], 0
je 0x4ac4e6
push dword [ebp - 0x578]
mov dl, byte [ebp - 0x52a]
lea ecx, [ebp - 0x270]
push 0
push 0
push 0
push 1
call fcn.004aab50
add esp, 0x14
mov esi, eax
lea ecx, [ebp - 0x2e8]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
lea ecx, [ebp - 0x574]
call fcn.004b6100
mov eax, esi
jmp 0x4aca4b
cmp byte [ebp - 0x533], 0
je 0x4ac500
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x270]
call fcn.0048cc80
test esi, esi
je 0x4ac53a
lea edx, [ebp - 0x530]
mov dword [ebp - 0x530], 0
call fcn.0046d6a0
mov edx, dword [ebp - 0x530]
cmp esi, 1
jne 0x4ac528
or edx, esi
jmp 0x4ac52f
cmp esi, 2
jne 0x4ac535
or edx, esi
mov dword [ebp - 0x530], edx
call fcn.0046d670
cmp dword [ebp - 0x2a8], 0
je 0x4ac667
lea edx, [ebp - 0x2b8]
call fcn.0046d640
push str.browser
lea ecx, [ebp - 0x2b8]
call fcn.00469b00
test al, al
je 0x4ac66c
lea eax, [ebp - 0x2f8]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x2f8], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ecx
lea eax, [ebp - 0x530]
mov dword [ebp - 0x530], 0
push eax
push 0x400
lea ecx, [ebp - 0x234]
call fcn.00464120
mov byte [ebp - 4], 0x23
movzx eax, word [ebp - 0x2f2]
mov ecx, dword [ebp - 0x230]
mov edx, dword [ebp - 0x234]
sub ecx, edx
push eax
movzx eax, word [ebp - 0x2f6]
push eax
movzx eax, word [ebp - 0x2f8]
sar ecx, 1
push eax
push str._d__02d__02d
lea eax, [ecx + ecx]
push eax
push edx
call fcn.0046ab10
add esp, 0x18
test eax, eax
js 0x4ac619
push dword [ebp - 0x234]
lea ecx, [ebp - 0x258]
call fcn.00464940
lea edx, [ebp - 0x258]
mov byte [ebp - 4], 0x24
mov ecx, str.SetupDDate
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x23
call fcn.00453390
push str.Yandex.Browser
lea ecx, [ebp - 0x258]
call fcn.00464940
lea edx, [ebp - 0x258]
mov byte [ebp - 4], 0x25
mov ecx, str.SetupSrc
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x23
call fcn.00453390
mov ecx, str.SetupID
call fcn.0046da20
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0x19
call fcn.00453330
jmp 0x4ac66c
call fcn.0046d610
cmp byte [ebp - 0x534], 0
je 0x4ac78f
mov ecx, 0x6e5d
call fcn.00497160
cmp byte [ebp - 0x52b], 0
je 0x4ac696
mov ecx, 0x6ed1
call fcn.00497160
mov ecx, 0x6ef6
call fcn.00497160
lea ecx, [ebp - 0xb0]
call fcn.004a7ba0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x536]
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x94], al
lea eax, [ebp - 0x270]
push eax
call fcn.00458240
mov al, byte [ebp - 0x52a]
lea ecx, [ebp - 0x258]
mov edx, dword [ebp - 0x540]
mov byte [ebp - 0x48], al
mov al, byte [ebp - 0x57c]
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], al
call fcn.004aaed0
push eax
lea ecx, [ebp - 0x78]
call fcn.0046abd0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x60]
call fcn.00458240
mov al, byte [ebp - 0x537]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x3f], al
mov al, byte [ebp - 0x52b]
mov byte [ebp - 0x3e], al
lea eax, [ebp - 0x2a0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x538]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 0x3d], al
mov al, byte [ebp - 0x578]
mov byte [ebp - 0x24], al
call fcn.004aae30
mov esi, eax
test esi, esi
je 0x4ac77f
mov ecx, 0x6ebf
call fcn.00497160
lea ecx, [ebp - 0xb0]
call fcn.00489b70
jmp 0x4ac492
lea ecx, [ebp - 0x2e8]
call fcn.00453390
push ecx
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0xe
call fcn.00471b20
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0x28
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.004b4760
sub esp, 0xc
call fcn.004b4660
call fcn.004b4490
mov ecx, 0x6e5d
mov byte [ebp - 4], 0x29
call fcn.00497160
cmp byte [ebp - 0x52b], 0
je 0x4ac7f2
mov ecx, 0x6ed1
call fcn.00497160
lea ecx, [ebp - 0xb0]
call fcn.004a7ba0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x536]
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x94], al
lea eax, [ebp - 0x270]
push eax
call fcn.00458240
mov al, byte [ebp - 0x52a]
lea ecx, [ebp - 0x258]
mov edx, dword [ebp - 0x540]
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], esi
call fcn.004aaed0
push eax
lea ecx, [ebp - 0x78]
call fcn.0046abd0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x60]
call fcn.00458240
mov al, byte [ebp - 0x57c]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x40], al
mov al, byte [ebp - 0x537]
mov byte [ebp - 0x3f], al
mov al, byte [ebp - 0x52b]
mov byte [ebp - 0x3e], al
mov al, byte [ebp - 0x538]
mov byte [ebp - 0x3d], al
lea eax, [ebp - 0x2a0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x578]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 0x24], al
call fcn.004a7d60
lea ecx, [ebp - 0xb0]
mov esi, eax
call fcn.00489b70
jmp 0x4ac8ec
mov dword [ebp - 4], 0x28
call fcn.004ae7a0
lea ecx, [ebp - 0x230]
call fcn.00471b40
jmp 0x4ac49d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00611399
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret