Function at 0x47652a
Capabilities:
Check for time delay via gettickcount
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov ecx, 0x4c2a3c
mov ebx, edx
call fcn.00403706
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, str.SetDllDirectoryA
mov ecx, 0x490fb0
mov dword [0x4c2ab8], eax
call fcn.00445c1c
test eax, eax
je 0x47656a
push 0x48f13b
call eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [0x4c4384], eax
call fcn.0041e56d
mov edx, str.execblk
mov ecx, 0x4c6298
call fcn.0041e474
call fcn.00488dcb
call fcn.0043fb2d
call fcn.00445744
and dword [ebp - 0x28], 0
and dword [ebp - 0x18], 0
mov dword [0x4c492c], eax
mov dword [0x4c81dc], eax
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x24], fcn.0042978f
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x14], fcn.00419d44
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov ecx, eax
mov dword [0x4c5f00], eax
call fcn.00444474
call fcn.004460f3
mov eax, 0x4c66a8
cdq
push edx
push eax
mov ecx, 0x1000
call fcn.0045351a
call fcn.00453ecd
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
call fcn.0042cdce
cmp ebx, 2
mov esi, dword [ebp + 8]
mov byte [ebp - 1], 0
jl 0x476624
lea edi, [esi + 4]
mov eax, dword [edi]
push str._ANSI
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476624
dec ebx
mov esi, edi
mov byte [ebp - 1], 1
mov cl, byte [ebp - 1]
call fcn.004690f9
cmp ebx, 3
jl 0x47666d
mov eax, dword [esi + 4]
push str._AUTOMATION
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47666d
push 0x75
pop eax
mov dword [0x4c81d4], 1
mov word [0x4b98f0], ax
add esi, 8
mov edx, dword [esi]
push 0xd
mov ecx, 0x4b9900
call fcn.00411c90
dec ebx
dec ebx
jmp 0x476672
call fcn.004615ce
cmp ebx, 2
jl 0x476713
lea edi, [esi + 4]
mov eax, dword [edi]
push str._MINIMIZED
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47669b
dec ebx
mov esi, edi
mov byte [0x4c8069], 1
cmp ebx, 2
jle 0x476713
mov eax, dword [esi + 4]
push str._AUTOUPDATE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476713
cmp ebx, 3
mov edi, dword [esi + 8]
mov byte [ebp + 0xb], 1
mov dword [ebp - 8], 0x1a
jle 0x4766f8
mov eax, dword [esi + 0xc]
push str._NORUN
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4766e7
mov byte [ebp + 0xb], al
call fcn.00457286
dec ebx
sub esi, 4
cmp ebx, 3
jle 0x4766f8
push dword [esi + 0xc]
call sub.MSVCRT.dll__wtoi
pop ecx
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov dl, byte [ebp + 0xb]
mov ecx, edi
xor esi, esi
call fcn.004542e7
test al, al
je 0x47670c
inc esi
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push dword [ebp - 0x10]
mov ecx, 0x4c61f8
call fcn.0044f66f
mov dword [0x4c6200], 0x490b48
call fcn.00446138
call fcn.0048d24b
cmp ebx, 2
mov byte [ebp - 8], 0
jl 0x4767a2
lea edi, [esi + 4]
mov eax, dword [edi]
push str._RECOVER
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4767a2
and dword [ebp + 8], eax
mov dl, 1
lea ecx, [ebp + 8]
mov byte [ebp - 8], 1
mov byte [0x4c76ac], 1
call fcn.00474a80
mov ecx, eax
call fcn.00444521
cmp ebx, 3
jne 0x47679f
push 1
add esi, 8
mov eax, dword [esi]
push 0x4a3498
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x47679f
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
call fcn.00453b79
xor ebx, ebx
inc ebx
jmp 0x4767a2
dec ebx
mov esi, edi
call fcn.00429780
lea ecx, [ebp - 0x38]
call fcn.00461595
mov byte [ebp + 0xb], 0
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0
call fcn.004528ac
call fcn.0041634e
call fcn.004717a1
mov ecx, 0x4c80e0
call fcn.0043b2d0
push eax
call fcn.0043fb2d
mov edi, 0x4c5cf8
add esp, 4
mov ecx, edi
call fcn.004695cd
push edi
push str.Settings_path:___s__n
call fcn.0043fb2d
add esp, 8
call fcn.0046a61c
call fcn.00471d4b
inc dword [0x4c8a64]
cmp dword [0x4c8964], 0x44363be
je 0x476854
push 0xa
pop ecx
xor eax, eax
mov edi, 0x4c89d0
rep stosd dword es:[edi], eax
push 0xa
pop ecx
mov edi, 0x4c89a8
rep stosd dword es:[edi], eax
call fcn.00471dd4
xor eax, eax
push eax
push 0x3e8
push 2
push eax
push eax
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push eax
push str.Sent_WM_SETTINGCHANGE_return___u
call fcn.00488f98
pop ecx
pop ecx
xor edi, edi
cmp dword [0x4c8964], edi
jne 0x476868
mov dword [0x4c8334], 1
cmp byte [0x4c82f3], 0
jne 0x476886
mov eax, dword [0x4c8334]
cmp eax, 1
je 0x476880
cmp eax, 0xa
jne 0x476886
mov dword [0x4c8334], edi
mov dword [0x4b518c], edi
call fcn.00413561
mov eax, dword [0x4c8934]
mov dword [0x4c2a70], eax
mov eax, dword [0x4c8938]
mov dword [0x4c2a74], eax
mov eax, dword [0x4c893c]
mov dword [0x4c2a68], eax
mov eax, dword [0x4c8940]
mov dword [0x4c2a6c], eax
mov eax, dword [0x4c8504]
mov dword [0x4c2a60], eax
mov eax, dword [0x4c8508]
mov dword [0x4c2a64], eax
mov eax, dword [0x4c85fc]
mov dword [0x4c2a58], eax
mov eax, dword [0x4c8600]
mov dword [0x4c2a5c], eax
mov eax, dword [0x4c86f4]
mov dword [0x4c2a50], eax
mov eax, dword [0x4c86f8]
mov dword [0x4c2a54], eax
mov eax, dword [0x4c87ec]
mov dword [0x4c2a48], eax
mov eax, dword [0x4c87f0]
xor edx, edx
xor cl, cl
mov dword [0x4c2a4c], eax
call fcn.0047634c
lea ecx, [ebp - 0x20]
call fcn.0041c6ca
call fcn.004196e2
call fcn.004621b9
call fcn.0042ac0a
lea ecx, [ebp - 0x30]
call fcn.0042cd8b
cmp ebx, 2
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], edi
jl 0x4769a6
mov eax, dword [esi + 4]
push str._UNINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4769a6
dec ebx
mov byte [ebp - 1], al
mov byte [ebp + 0xb], al
add esi, 8
cmp ebx, 2
jl 0x476996
mov eax, dword [esi]
push 0x4a4d84
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47697d
mov byte [ebp - 1], 1
dec ebx
add esi, 4
jmp 0x47695b
mov eax, dword [esi]
push str._REMSETTINGS
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476996
mov byte [ebp + 0xb], 1
jmp 0x476977
mov dl, byte [ebp + 0xb]
mov cl, byte [ebp - 1]
call fcn.004661b4
jmp 0x4770e0
cmp ebx, 1
jle 0x476d6e
cmp ebx, 2
jl 0x4769d9
lea edi, [esi + 4]
mov eax, dword [edi]
push str._BIGDUMP
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4769d9
mov byte [0x4c644c], 1
dec ebx
mov esi, edi
jmp 0x476d43
cmp ebx, 3
jl 0x476a01
mov eax, dword [esi + 4]
push str._DIRECTORY
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476a01
add esi, 8
mov eax, dword [esi]
mov dword [0x4c81cc], eax
jmp 0x476d41
cmp ebx, 2
jl 0x476a41
lea edi, [esi + 4]
mov eax, dword [edi]
push str._HIDE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476a25
mov byte [0x4c6205], 1
jmp 0x4769d1
mov eax, dword [edi]
push str._NOCANDY
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476a41
mov byte [0x4c7b75], 1
jmp 0x4769d1
cmp ebx, 3
jl 0x476aaa
mov eax, dword [esi + 4]
push str._CANDY
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x476d5f
mov eax, dword [esi + 4]
push str._LAUNCHBUNDLEDURL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476a84
add esi, 8
push dword [esi]
lea ecx, [ebp - 0x38]
call fcn.0046159f
jmp 0x476d41
mov eax, dword [esi + 4]
push str._LAUNCHBUNDLEDURLTYPE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476aaa
add esi, 8
push dword [esi]
lea ecx, [ebp - 0x38]
call fcn.004615b6
jmp 0x476d41
cmp ebx, 2
jl 0x476af8
lea edi, [esi + 4]
mov eax, dword [edi]
push str._NOINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476ad8
mov dword [0x4c81f8], 0x63be
mov byte [ebp + 0xb], 1
jmp 0x4769d1
mov eax, dword [edi]
push str._UPDATEINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476af8
mov byte [ebp + 0xb], 1
mov byte [ebp - 3], 1
jmp 0x4769d1
cmp ebx, 5
jl 0x476c3c
mov eax, dword [esi + 4]
push str._DOWNLOADINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476c3c
mov eax, dword [esi + 8]
push dword [esi + 0xc]
mov dword [ebp - 0x40], eax
call sub.MSVCRT.dll__wtoi
add esi, 0x10
sub ebx, 4
cmp ebx, 1
mov dword [ebp - 0x3c], eax
mov eax, dword [esi]
pop ecx
mov dword [0x4c7ba4], eax
mov dword [ebp - 0xc], ebx
jle 0x476b69
lea edi, [esi + 4]
mov ecx, dword [edi]
cmp word [ecx], 0x2f
je 0x476b69
call fcn.0043acd1
push eax
push str.toolbar_pair_key:__S_n
mov dword [0x4c7b9c], eax
call fcn.0043fb2d
add esp, 8
dec ebx
mov dword [ebp - 0xc], ebx
mov esi, edi
mov ecx, dword [ebp - 0x40]
mov byte [0x4c7b94], 0
test ecx, ecx
je 0x476c33
cmp word [ecx], 0
je 0x476c33
mov edx, 0x4c7b8c
call fcn.0046972f
test al, al
je 0x476c33
push 0x1c
pop ecx
mov dword [0x4b7850], 0x4c7b8c
call fcn.00444a95
mov ebx, eax
push 7
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x49acfc
call fcn.004123ce
push eax
lea ecx, [ebx + 4]
mov dword [0x4b9d0c], eax
call fcn.004019c6
mov eax, dword [ebp - 0x3c]
push 0
mov dword [0x4b9d08], 0x45fd75
push 0
mov dword [ebx], eax
mov ecx, dword [0x4b7850]
push str.offer_urls
lea edi, [ebx + 0x10]
call fcn.00403bc6
mov ecx, eax
call fcn.0040376a
mov ecx, eax
call fcn.00444cdf
push eax
mov ecx, edi
call fcn.00410d67
mov edi, dword [edi]
mov ecx, edi
test edi, edi
jne 0x476c15
mov ecx, 0x48f13b
push 0x4b9d08
push 1
push ebx
mov edx, fcn.0046538f
call fcn.0045fced
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 1
jmp 0x476d43
cmp ebx, 2
jl 0x476d0f
lea edi, [esi + 4]
mov eax, dword [edi]
push str._PERFORMINSTALL
push eax
mov dword [ebp - 0x3c], edi
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476cf3
cmp ebx, 3
jl 0x476c75
push dword [esi + 8]
call sub.MSVCRT.dll__wtoi
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x476c7c
mov dword [ebp - 0xc], 0x100
cmp ebx, 4
jl 0x476c86
mov edi, dword [esi + 0xc]
jmp 0x476c88
xor edi, edi
cmp ebx, 5
jl 0x476ca8
cmp byte [0x4c806a], 0
je 0x476ca8
push dword [esi + 0x10]
call sub.MSVCRT.dll__wtol
pop ecx
mov edx, eax
mov cl, 1
call fcn.0047634c
mov ecx, edi
test edi, edi
jne 0x476cb3
mov ecx, 0x48e94c
mov eax, dword [ebp - 0xc]
push ecx
or eax, 0x80
push eax
push str.INSTALLDEBUG:__PERFORMINSTALL_with_flags___d__and_path___s__n
call fcn.0043fb2d
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
mov byte [ebp - 1], 1
call fcn.00465f02
test al, al
je 0x476ceb
mov dword [ebp - 0x10], 1
call fcn.00457286
mov edi, dword [ebp - 0x3c]
mov eax, dword [edi]
push str._BRINGTOFRONT
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476d0f
mov byte [ebp - 2], 1
jmp 0x4769d1
cmp ebx, 3
jl 0x476d4c
mov eax, dword [esi + 4]
push str._LOGFILE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476d4c
add esi, 8
mov ecx, dword [esi]
call fcn.004891c4
push dword [esi]
push str.Log_file_set_to_path:__s__n
call fcn.0043fb2d
add esp, 8
dec ebx
dec ebx
cmp ebx, 1
jg 0x4769af
cmp byte [ebp - 1], 0
je 0x476d6e
call fcn.00460b77
push dword [ebp - 0x10]
jmp 0x47670d
mov ecx, dword [esi + 8]
call fcn.0043fb2d
push 0
jmp 0x47670d
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
call fcn.004719db
test al, al
jne 0x476dac
call fcn.0042cdf9
cmp byte [ebp - 0x20], 0
je 0x476d99
cmp dword [ebp - 0x14], 0
je 0x476d99
lea ecx, [ebp - 0x20]
call dword [ebp - 0x14]
cmp byte [ebp - 0x30], 0
je 0x477107
cmp dword [ebp - 0x24], 0
jmp 0x4770ff
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x58
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x60
pop ecx
cmp eax, ecx
mov dword [0x4c81c4], eax
jg 0x476dd1
mov dword [0x4c81c4], ecx
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.004718e1
call fcn.00457225
call fcn.00464dee
call fcn.004621b9
call fcn.0046160d
or byte [ebp + 0xb], al
jne 0x476e15
push edi
push edi
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
call fcn.00465f02
test al, al
je 0x476e23
push edi
jmp 0x47670d
cmp byte [ebp - 3], 0
je 0x476e23
push edi
push 0x8000
jmp 0x476dfb
cmp ebx, 1
jle 0x476e30
mov eax, dword [esi + 4]
mov dword [0x4c81d0], eax
mov dl, byte [ebp + 0xb]
mov cl, byte [ebp - 8]
call fcn.00471d7e
push 0x63be
push 1
push 2
pop ebx
push ebx
push ebx
push str.Version__d._d._d__svn__u__n
call fcn.0043fb2d
add esp, 0x14
call fcn.004616b4
mov byte [0x4c8068], al
call fcn.00437d3c
cmp byte [0x4c82cb], 0
je 0x476e82
xor ecx, ecx
call fcn.00420b5a
test eax, eax
je 0x476e82
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4c806c], eax
mov eax, dword [0x4c835c]
cmp eax, 6
mov ecx, eax
jle 0x476e91
push 6
pop ecx
cmp ecx, edi
jge 0x476e97
xor ecx, ecx
xor eax, eax
inc eax
shl eax, cl
mov dword [0x4b5fc8], eax
call fcn.00429592
push 0x28
call fcn.00444d68
pop ecx
cmp eax, edi
je 0x476ebb
mov ecx, eax
call fcn.00404a55
jmp 0x476ebd
xor eax, eax
mov ecx, eax
mov dword [0x4c2ac0], eax
call fcn.0042b1cc
call fcn.004295a3
cmp byte [0x4c82f9], 0
je 0x476edd
mov dword [0x4c8220], edi
call fcn.0046969c
mov byte [0x4c7f34], al
call fcn.00469af8
mov ecx, dword [0x4c8964]
cmp ecx, edi
jne 0x476f05
cmp dword [0x4c50fc], edi
je 0x476f0d
mov byte [0x4c82f3], 1
cmp ecx, 0x2445034
jae 0x476f1d
cmp byte [0x4c831f], 0
je 0x476f1d
mov byte [0x4c831e], 1
cmp ecx, 0x3022e66
jae 0x476f36
mov ecx, dword [0x4c4420]
call fcn.00422a92
mov ecx, dword [0x4c8964]
cmp ecx, 0x3060000
jae 0x476f6b
movzx eax, byte [0x4b52be]
sub eax, edi
je 0x476f64
dec eax
je 0x476f5b
dec eax
je 0x476f5b
dec eax
jne 0x476f6b
mov byte [0x4b52be], 0xa
jmp 0x476f6b
mov byte [0x4b52be], 0xf
jmp 0x476f6b
mov byte [0x4b52be], 5
cmp ecx, 0x3022f33
jae 0x476f82
cmp dword [0x4c49a8], ebx
jne 0x476f82
mov byte [0x4c49b2], 1
and dword [0x4ca454], 0xbfffffff
mov dword [0x4c8964], 0x44363be
call fcn.004124a8
call fcn.00471da0
mov ecx, dword [0x4c2a18]
call fcn.004198e8
call fcn.004132ce
cmp dword [0x4c81d4], 1
je 0x476fc3
xor dl, dl
lea ecx, [ebp + 8]
call fcn.00474a80
lea ecx, [ebp - 0x108]
call fcn.00473bae
push 0x4c82a8
lea ecx, [ebp - 0x108]
call fcn.00471407
push 0x18
call fcn.00444d68
pop ecx
cmp eax, edi
je 0x476ffe
push dword [0x4c8074]
mov ecx, eax
call fcn.0041e658
mov dword [0x4c8070], eax
jmp 0x477004
mov dword [0x4c8070], edi
mov esi, 0x4c8a7c
mov eax, dword [esi]
cmp eax, edi
je 0x47702e
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x477012
sub eax, edx
sar eax, 1
je 0x47702e
mov edx, esi
mov ecx, 0x4c892c
call fcn.0045512a
add esi, 0x20
cmp esi, 0x4c8abc
jl 0x477009
lea ecx, [ebp - 0x38]
call fcn.0046344a
cmp byte [ebp - 2], 0
je 0x47705b
cmp dword [0x4c81d4], edi
jne 0x47705b
push dword [ebp - 0x104]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.0042660e
test al, al
je 0x47706f
push str.IPv6_is_installed
call fcn.00488f98
pop ecx
call fcn.00429592
lea ecx, [ebp - 0x50]
call fcn.00413b58
test al, al
je 0x47709b
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.Got_Teredo_Address:__V
movsd dword es:[edi], dword [esi]
call fcn.00488f98
add esp, 0x14
xor edi, edi
call fcn.004295a3
xor edx, edx
mov ecx, 0x10a
call fcn.00470b11
call fcn.0043fb2d
mov ecx, 0x4c61f8
call fcn.0044ed6c
call fcn.0043fb2d
lea ecx, [ebp - 0x30]
call fcn.0042978f
lea ecx, [ebp - 0x20]
call fcn.00419d44
call fcn.0043fb2d
lea ecx, [ebp - 0x108]
call fcn.0044eeb1
call fcn.0042cdf9
cmp byte [ebp - 0x20], 0
je 0x4770f6
cmp dword [ebp - 0x14], edi
je 0x4770f6
lea ecx, [ebp - 0x20]
call dword [ebp - 0x14]
cmp byte [ebp - 0x30], 0
je 0x477107
cmp dword [ebp - 0x24], edi
je 0x477107
lea ecx, [ebp - 0x30]
call dword [ebp - 0x24]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4