Function at 0x435b30
Capabilities:
Check for time delay via gettickcount
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x48a2ca
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x4afe78]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4afe78]
xor eax, esp
push eax
lea eax, [esp + 0x848]
mov dword fs:[0], eax
mov eax, dword [esp + 0x858]
mov esi, dword [esp + 0x860]
xor ebx, ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], ebx
call fcn.0044dc57
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x435b9d
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov dword [esp + 0x850], ebx
call fcn.0044dc57
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x435bce
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x2c], edi
mov eax, dword [edi - 0xc]
mov byte [esp + 0x850], 1
cmp eax, ebx
jne 0x435c42
push 0x800
lea ecx, [esp + 0x48]
push ebx
push ecx
call fcn.0046e0a0
add esp, 0xc
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x40], 0x400
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x44]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x435c20
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x34]
call fcn.00401840
mov edi, dword [esp + 0x2c]
push str.ListURL
lea edx, [esp + 0x20]
push str.UPDATEINFO
push edx
call fcn.0040d630
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
push eax
mov byte [esp + 0x860], 2
call fcn.00401660
add eax, 0x10
add esp, 0x10
mov dword [esp + 0x30], eax
push 0x492a94
push 0x492a90
lea ecx, [esp + 0x38]
mov byte [esp + 0x858], 3
call fcn.00403660
push 0x494f18
mov ecx, 0x4b1280
call fcn.004543fc
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00401660
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push str.freelic
mov ecx, 0x4b1280
mov byte [esp + 0x854], 4
call fcn.004543fc
mov eax, dword [eax]
push eax
push str._lic_
lea ecx, [esp + 0x1c]
call fcn.00403660
push str.3.80
push str._ver_
lea ecx, [esp + 0x1c]
call fcn.00403660
push esi
push str._guid_
lea ecx, [esp + 0x1c]
call fcn.00403660
push edi
push str._host_
lea ecx, [esp + 0x1c]
call fcn.00403660
mov eax, dword [esp + 0x30]
push eax
push str._url_
lea ecx, [esp + 0x1c]
call fcn.00403660
push 0x492454
mov ecx, 0x4b1280
call fcn.004543fc
mov eax, dword [eax]
push eax
push str._updatetm_
lea ecx, [esp + 0x1c]
call fcn.00403660
call fcn.0044dc57
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x435d5a
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov ecx, dword [0x4b1470]
push ecx
lea edx, [esp + 0x28]
push 0x48f8e0
push edx
mov byte [esp + 0x85c], 5
call fcn.00403ac0
mov eax, dword [esp + 0x30]
add esp, 0xc
push eax
push str._updatecount_
lea ecx, [esp + 0x1c]
call fcn.00403660
lea ecx, [esp + 0x14]
call fcn.004092d0
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 0xc]
cmp eax, ebx
je 0x43626b
cmp dword [0x4ae384], 1
jne 0x436113
mov ebp, dword [esp + 0x14]
add ebp, 0xfffffff0
push ebp
call fcn.00401660
add eax, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
push eax
mov byte [esp + 0x858], 6
call fcn.00401660
lea esi, [eax + 0x10]
add esp, 8
mov dword [esp + 0x18], esi
mov eax, dword [esi - 0xc]
cmp eax, 0xa
mov bl, 7
mov byte [esp + 0x850], bl
jl 0x435e70
lea edx, [esi + 0x14]
push 0x48f918
push edx
call fcn.0046dc11
add esp, 8
test eax, eax
je 0x435e70
sub eax, esi
sar eax, 1
test eax, eax
jle 0x435e70
push eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
call fcn.004093d0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x854], 8
call fcn.00401ab0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x850], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435e6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0xa
jl 0x435edb
lea ecx, [esi + 0x14]
push 0x48ef18
push ecx
call fcn.0046dc11
add esp, 8
test eax, eax
je 0x435edb
sub eax, esi
sar eax, 1
test eax, eax
jle 0x435edb
push eax
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x20]
call fcn.004093d0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x854], 9
call fcn.00401ab0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x850], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435edb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
call fcn.004092d0
lea ecx, [esp + 0x20]
call fcn.004092d0
mov esi, dword [esp + 0x18]
push esi
push str.http:__www.qupdater.com_mng
lea ecx, [esp + 0x28]
call fcn.00403660
mov edi, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
push 1
lea ecx, [esp + 0x44]
push edi
push ecx
call fcn.0040cc20
add esp, 0x14
mov eax, dword [esp + 0x38]
cmp dword [eax - 0xc], 0
mov byte [esp + 0x850], 0xa
je 0x4360a8
add eax, 0xfffffff0
push eax
call fcn.00401660
mov edx, dword [esp + 0x38]
add eax, 0x10
mov dword [edx], eax
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x850], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435f6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x850], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435f8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x850], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435fb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x850], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435fda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x850], 3
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435ffc
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x850], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436024
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x850], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43604c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x850], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436074
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x850], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43609f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
jmp 0x436370
add eax, 0xfffffff0
mov byte [esp + 0x850], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4360cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x850], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4360ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x850], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0040dad0
test eax, eax
jne 0x43626b
push str.55555
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00403ce0
mov eax, dword [eax]
push eax
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x864], 0xb
call fcn.0040ad60
add esp, 0x14
mov eax, dword [esp + 0x28]
mov bl, 0xd
add eax, 0xfffffff0
mov byte [esp + 0x850], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436175
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [esp + 0x40]
mov esi, eax
push ecx
push esi
call dword [sym.imp.USER32.dll_GetPropW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call ebp
sub eax, edi
cmp eax, 0xea60
jbe 0x436243
mov edx, dword [esp + 0x14]
push 0
push 0xffffffffffffffff
push 1
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0040cc20
add esp, 0x14
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], 0
mov byte [esp + 0x850], 0xe
je 0x4361d9
mov edi, dword [esp + 0x40]
call ebp
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_SetPropW]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
push eax
call fcn.00401660
mov esi, dword [esp + 0x38]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x850], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x436219
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov byte [esp + 0x850], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43627b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x43627b
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov byte [esp + 0x850], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43626b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x34]
push 0x495308
mov ecx, esi
call fcn.00401bd0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x850], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4362a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x850], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4362cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x850], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4362f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x850], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43631b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x850], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436343
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x850], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43636e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x848]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.0046dc02
add esp, 0x840
ret