Function at 0x4344ca
Capabilities:
Check for time delay via gettickcount
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create reverse shell
Parse pe header
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
sub esp, 0x10c
lea ebp, [esp - 4]
mov eax, dword [0x4ff5d0]
xor eax, ebp
mov dword [ebp + 0x10c], eax
push 0x360
mov eax, 0x4c167a
call fcn.004943c6
mov esi, ecx
push str.install_thread:_entering
lea ecx, [ebp - 0x14]
call fcn.00472340
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.00411af0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00472320
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [esi + 0x1f4]
mov ecx, edi
mov dword [esi + 0xb54], eax
mov dword [ebp - 0xa0], edi
call fcn.004253eb
and dword [esi + 0xb6c], 0
xor ebx, ebx
inc ebx
push ebx
mov ecx, edi
call fcn.00420220
and dword [ebp - 0x88], 0
and dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x5c], ebx
call fcn.004734f0
mov eax, dword [esi + 0x730]
mov dword [ebp - 4], ebx
cmp eax, dword [esi + 0x734]
je 0x43463b
lea edi, [eax + 0x84]
cmp dword [edi - 0x78], 0
lea eax, [edi - 0x7c]
mov dword [ebp - 0x90], eax
je 0x4345b0
mov ecx, edi
call fcn.004720a0
test eax, eax
je 0x4345b0
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.0040d604
pop ecx
pop ecx
test al, al
jne 0x4345c6
add edi, 0xd0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x734]
jne 0x434582
jmp 0x43463b
cmp dword [esi + 0x5e0], 0
je 0x434624
push str.install_thread:_closing_browsers
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
mov ecx, esi
call fcn.004276c1
push str.install_thread:_back_from_closing_browsers
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
push dword [ebp - 0x90]
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xbc], ebx
call fcn.004735a0
push str.install_thread:_here1
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
mov edi, dword [esi + 0x730]
cmp edi, dword [esi + 0x734]
je 0x4346df
add edi, 0x84
cmp dword [edi - 0x78], 0
je 0x4346cb
mov ecx, edi
call fcn.004720a0
test eax, eax
je 0x4346cb
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.0040d64c
pop ecx
pop ecx
test al, al
je 0x4346cb
inc dword [ebp - 0x88]
lea eax, [edi - 0x20]
push str.post
push eax
call fcn.0040d604
pop ecx
pop ecx
test al, al
lea eax, [edi - 0x7c]
lea ecx, [ebp - 0xd0]
push eax
je 0x4346c6
call fcn.004735f0
jmp 0x4346cb
call fcn.004735a0
add edi, 0xd0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x734]
jne 0x434676
mov edi, str.install_thread:_here2
push edi
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 5
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
cmp dword [ebp - 0xc0], 0
jle 0x4369db
push edi
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 6
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
mov eax, dword [esi + 0x24]
test eax, eax
je 0x434c5e
lea ecx, [esi + 0x64]
cmp byte [ecx + 7], 0xff
lea edx, [esi + 8]
jne 0x434750
mov ecx, dword [ecx]
push ecx
push edx
call eax
pop ecx
pop ecx
test eax, eax
jne 0x434c5e
push str.install_thread:_here3
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 7
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
mov eax, dword [esi + 0xb30]
cmp eax, 1
jb 0x434c53
push eax
push 0x2c
lea eax, [ebp - 0xa8]
push eax
lea ecx, [esi + 0x628]
call fcn.00472cc0
lea eax, [ebp - 0xa8]
push eax
lea ecx, [esi + 0x794]
mov byte [ebp - 4], 8
call fcn.0042d941
add eax, 4
push eax
lea eax, [ebp - 0x1c]
push str.actioncancelvalue
push eax
call fcn.00472c70
add esp, 0xc
mov edx, dword [esi]
push 1
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call dword [edx + 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.00472320
push str.actionpageviewvaluecancel
lea ecx, [ebp - 0x14]
call fcn.00472340
mov eax, dword [esi]
push 0xa
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xa
call dword [eax + 0x10]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00472320
push str.overinstall
lea ecx, [ebp - 0x14]
call fcn.00472340
cmp dword [esi + 0x4c], 0
mov byte [ebp - 4], 0xb
jne 0x434c38
lea ebx, [esi + 0x598]
mov ecx, ebx
call fcn.0040d59a
test al, al
jne 0x434c38
push ebx
lea ecx, [ebp - 0x24]
call fcn.00472280
cmp byte [ebp - 0x1d], 0xff
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x24]
jne 0x434861
mov eax, dword [ebp - 0x24]
push 0x4d39c8
push eax
call fcn.00493420
pop ecx
test eax, eax
lea eax, [esi + 0x15c]
pop ecx
push eax
lea eax, [ebp - 0x1c]
jne 0x434890
push str._distcode
push eax
call fcn.00472c70
add esp, 0xc
mov byte [ebp - 4], 0xd
jmp 0x4348a2
push 0x4d47b0
push eax
call fcn.00472c70
add esp, 0xc
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x24]
call fcn.00472880
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00472320
lea eax, [esi + 0x1a4]
push eax
lea eax, [ebp - 0x1c]
push 0x4d47a8
push eax
call fcn.00472c70
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
call fcn.00472880
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00472320
lea eax, [esi + 0x18c]
push eax
lea eax, [ebp - 0x1c]
push str.li
push eax
call fcn.00472c70
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x10
call fcn.00472880
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00472320
lea ecx, [ebp - 0x84]
call fcn.00472090
mov eax, dword [esi + 0xb30]
mov byte [ebp - 4], 0x11
cmp eax, 1
jb 0x434961
push eax
push 0x2c
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x628]
call fcn.00472cc0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x12
call fcn.004723d0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00472320
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c]
push str.cancelled
push eax
call fcn.00472c70
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x13
call fcn.00472880
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00472320
lea ecx, [ebp - 0x38]
call fcn.00472090
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.00472090
mov edi, dword [esi + 0x730]
mov byte [ebp - 4], 0x15
cmp edi, dword [esi + 0x734]
je 0x434ab1
mov ebx, 0x4d3f6c
cmp dword [edi + 8], 0
je 0x434a2d
lea ecx, [ebp - 0x38]
call fcn.0040d59a
test al, al
jne 0x4349fd
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00472c20
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x16
call fcn.004723d0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.00472320
push edi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00472bd0
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x17
call fcn.004723d0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x15
call fcn.00472320
cmp dword [edi + 0xc], 0
je 0x434a9f
lea ecx, [ebp - 0x40]
call fcn.0040d59a
test al, al
jne 0x434a6f
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00472c20
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x18
call fcn.004723d0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x15
call fcn.00472320
push edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.00472bd0
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x19
call fcn.004723d0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x15
call fcn.00472320
add edi, 0xd0
cmp edi, dword [esi + 0x734]
jne 0x4349c1
lea ecx, [ebp - 0x38]
call fcn.0040d59a
test al, al
je 0x434aca
push str.none
lea ecx, [ebp - 0x38]
call fcn.00472470
lea ecx, [ebp - 0x40]
call fcn.0040d59a
test al, al
je 0x434ae3
push str.none
lea ecx, [ebp - 0x40]
call fcn.00472470
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xb0]
push str.displayedoffer
push eax
call fcn.00472c70
push str.acceptedoffer
push eax
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00472c20
lea ecx, [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00472bd0
add esp, 0x24
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1c
call fcn.00472880
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1b
call fcn.00472320
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x1a
call fcn.00472320
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x15
call fcn.00472320
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push str.action
push eax
call fcn.00472c70
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1d
call fcn.00472880
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.00472320
push 0x38
xor edi, edi
lea eax, [ebp - 0x358]
push edi
push eax
call fcn.00493d40
add esp, 0xc
cmp byte [ebp - 0x1d], 0xff
mov dword [ebp - 0x35c], 0x3c
mov dword [ebp - 0x358], 0x440
mov dword [ebp - 0x354], edi
mov dword [ebp - 0x350], str.open
lea eax, [ebp - 0x24]
jne 0x434bcc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34c], eax
lea eax, [ebp - 0x35c]
push eax
mov dword [ebp - 0x348], edi
mov dword [ebp - 0x344], edi
mov dword [ebp - 0x340], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x434c05
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.00472320
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x11
call fcn.00472320
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xc
call fcn.00472320
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xb
call fcn.00472320
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00472320
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00472320
and dword [ebp - 0x5c], 0
mov dword [esi + 0x14], 1
push str.install_thread:_here4
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
cmp dword [ebp - 0x5c], 0
je 0x4369db
push 0x4d7bc8
lea ecx, [ebp - 0x14]
call fcn.00472340
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00472320
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0xc0]
jge 0x4369db
mov eax, dword [esi + 0xb6c]
push dword [ebp - 0x8c]
and dword [esi + 0xb78], 0
lea ecx, [ebp - 0xd0]
mov dword [esi + 0xb68], eax
call fcn.004737d0
push eax
lea ecx, [ebp - 0xd0]
call fcn.00473650
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
add eax, 0x4c
push str.main
push eax
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x434d2b
mov eax, dword [ebp - 0xc0]
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffec
add eax, 0x64
jmp 0x434d51
cmp dword [ebp - 0xbc], 0
fild dword [ebp - 0x88]
fld1
fdivrp st(1)
je 0x434d46
fmul qword [0x4d7bb8]
jmp 0x434d4c
fmul qword [0x4d4008]
call fcn.00497fb0
and dword [ebp - 0x50], 0
mov dword [esi + 0xb78], eax
mov ebx, dword [ebp - 0x68]
add ebx, 0x3c
push ebx
lea ecx, [esi + 0x71c]
mov byte [ebp - 4], 0x20
call fcn.0042b53c
test eax, eax
je 0x434d8c
push ebx
lea ecx, [esi + 0x71c]
call fcn.0042da0b
push dword [eax + 0x34]
lea ecx, [ebp - 0x50]
call fcn.004299c7
mov edi, dword [ebp - 0x68]
cmp dword [edi + 4], 0
je 0x43683a
lea eax, [edi + 0x4c]
push str.main
push eax
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x434ebe
push str.clean
lea ecx, [ebp - 0xd8]
call fcn.00472340
mov eax, dword [esi + 0x664]
mov byte [ebp - 4], 0x21
cmp eax, 1
jne 0x434dd7
push str.over
jmp 0x434de1
cmp eax, 0xffffffff
jne 0x434dec
push str.under
lea ecx, [ebp - 0xd8]
call fcn.00472470
push ebx
lea eax, [ebp - 0x36c]
push str.actioninstallerstartedvalue
push eax
call fcn.00472c70
push str.installtype
push eax
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x22
call fcn.00472c20
lea ecx, [ebp - 0xd8]
push ecx
push eax
lea eax, [ebp - 0x308]
push eax
mov byte [ebp - 4], 0x23
call fcn.00472bd0
push str.webuserid
push eax
lea eax, [ebp - 0x2f8]
push eax
mov byte [ebp - 4], 0x24
call fcn.00472c20
lea ecx, [esi + 0x16c]
push ecx
push eax
lea eax, [ebp - 0x2e8]
push eax
mov byte [ebp - 4], 0x25
call fcn.00472bd0
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x26
call dword [edx + 0x10]
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x25
call fcn.00472320
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x24
call fcn.00472320
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0x23
call fcn.00472320
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0x22
call fcn.00472320
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x21
call fcn.00472320
lea ecx, [ebp - 0xd8]
jmp 0x434f33
push ebx
lea eax, [ebp - 0x290]
push str.actioninstallerstartedvalue
push eax
call fcn.00472c70
push str.webuserid
push eax
lea eax, [ebp - 0x1e4]
push eax
mov byte [ebp - 4], 0x27
call fcn.00472c20
lea ecx, [esi + 0x16c]
push ecx
push eax
lea eax, [ebp - 0x2e0]
push eax
mov byte [ebp - 4], 0x28
call fcn.00472bd0
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x29
call dword [edx + 0x10]
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x28
call fcn.00472320
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 0x27
call fcn.00472320
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x20
call fcn.00472320
lea ecx, [ebp - 0x98]
call fcn.00472090
lea eax, [edi + 0x54]
push 0x4d21a0
push eax
mov byte [ebp - 4], 0x2a
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x435352
push str.install_thread:_pkg__rp
lea ecx, [ebp - 0x144]
call fcn.00472340
lea eax, [ebp - 0x144]
push eax
mov byte [ebp - 4], 0x2b
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x2a
call fcn.00472320
push ebx
lea ecx, [esi + 0x708]
call fcn.004174c0
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x310]
push eax
mov ecx, esi
call fcn.00425423
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x1f4]
push eax
mov byte [ebp - 4], 0x2c
call fcn.00472c20
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x2d
jne 0x434fd5
mov eax, dword [eax]
push 0x4d23fc
push eax
call fcn.00494eaf
pop ecx
pop ecx
lea ecx, [ebp - 0x1f4]
mov ebx, eax
mov byte [ebp - 4], 0x2c
call fcn.00472320
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x2a
call fcn.00472320
test ebx, ebx
je 0x43515f
push str.StubInstall1_r_n
push ebx
call fcn.004965fb
push str.AlwaysUseDefInstallPath1_r_n
push ebx
call fcn.004965fb
add esp, 0x10
lea ecx, [esi + 0x15c]
call fcn.0040d59a
test al, al
jne 0x43506a
push 1
lea ecx, [esi + 0x15c]
call fcn.00472db0
push eax
push str.DistCode_s_r_n
push ebx
call fcn.004965fb
add esp, 0xc
push 1
lea ecx, [esi + 0x15c]
call fcn.00472db0
push eax
push str.OrigCode_s_r_n
push ebx
call fcn.004965fb
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov edi, dword [eax]
jmp 0x4350b8
mov ecx, edi
call fcn.0040d59a
test al, al
jne 0x43509f
push 0
lea ecx, [edi + 8]
call fcn.00472db0
push eax
push 0
mov ecx, edi
call fcn.00472db0
push eax
push str._s_s_r_n
push ebx
call fcn.004965fb
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [edi + 8]
call fcn.00472e40
push 0xffffffffffffffff
mov ecx, edi
call fcn.00472e40
mov eax, dword [ebp - 0x60]
add edi, 0x10
cmp edi, dword [eax + 4]
jne 0x435071
push ebx
call fcn.00494a18
pop ecx
lea eax, [ebp - 0x2f0]
push eax
mov ecx, esi
call fcn.00425423
mov edi, eax
push str.__cfg
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x2e
call fcn.00472340
push edi
push eax
lea eax, [ebp - 0x2a0]
push eax
mov byte [ebp - 4], 0x2f
call fcn.00472bd0
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x204]
push eax
mov byte [ebp - 4], 0x30
call fcn.00472c20
add esp, 0x18
push eax
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x31
call fcn.004723d0
lea ecx, [ebp - 0x204]
mov byte [ebp - 4], 0x30
call fcn.00472320
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0x2f
call fcn.00472320
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x2e
call fcn.00472320
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 0x2a
call fcn.00472320
mov eax, dword [ebp - 0x68]
add eax, 0x7c
push str..manifest
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00472c20
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x32
jne 0x435186
mov eax, dword [eax]
push 0x4d23fc
push eax
call fcn.00494eaf
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
mov edi, eax
mov byte [ebp - 4], 0x2a
call fcn.00472320
test edi, edi
je 0x43531f
push str.__xml_version_1.0__encoding_UTF_8__standalone_yes____r_n
push edi
call fcn.004965fb
push str._assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0___r_n
push edi
call fcn.004965fb
push str._____assemblyIdentity_r_n
push edi
call fcn.004965fb
push str.________version_1.0.0.0__r_n
push edi
call fcn.004965fb
push str.________processorArchitecture_X86__r_n
push edi
call fcn.004965fb
push str.________name_rnmininst.exe__r_n
push edi
call fcn.004965fb
push str.________type_win32__r_n
push edi
call fcn.004965fb
push str._______r_n
push edi
call fcn.004965fb
add esp, 0x40
push str._____description_RealPlayer_Installer__description__r_n
push edi
call fcn.004965fb
push str._____dependency__r_n
push edi
call fcn.004965fb
push str._________dependentAssembly__r_n
push edi
call fcn.004965fb
push str._____________assemblyIdentity_r_n
push edi
call fcn.004965fb
push str.________________type_win32__r_n
push edi
call fcn.004965fb
push str.________________name_Microsoft.Windows.Common_Controls__r_n
push edi
call fcn.004965fb
push str.________________version_6.0.0.0__r_n
push edi
call fcn.004965fb
push str.________________processorArchitecture_X86__r_n
push edi
call fcn.004965fb
add esp, 0x40
push str.________________publicKeyToken_6595b64144ccf1df__r_n
push edi
call fcn.004965fb
push str.________________language___r_n
push edi
call fcn.004965fb
push str._______________r_n
push edi
call fcn.004965fb
push str.__________dependentAssembly__r_n
push edi
call fcn.004965fb
push str.______dependency__r_n
push edi
call fcn.004965fb
push str._____trustInfo_xmlns_urn:schemas_microsoft_com:asm.v3___r_n
push edi
call fcn.004965fb
push str._________security__r_n
push edi
call fcn.004965fb
push str._____________requestedPrivileges__r_n
push edi
call fcn.004965fb
add esp, 0x40
push str._________________requestedExecutionLevel_r_n
push edi
call fcn.004965fb
push str.____________________level_requireAdministrator__r_n
push edi
call fcn.004965fb
push str.____________________uiAccess_false__r_n
push edi
call fcn.004965fb
push str.___________________r_n
push edi
call fcn.004965fb
push str.______________requestedPrivileges__r_n
push edi
call fcn.004965fb
push str.__________security__r_n
push edi
call fcn.004965fb
push str.______trustInfo__r_n
push edi
call fcn.004965fb
push str.__assembly__r_n
push edi
call fcn.004965fb
add esp, 0x40
push edi
call fcn.00494a18
pop ecx
push str.install_thread:_end_of_RP_package_setup
lea ecx, [ebp - 0x154]
call fcn.00472340
lea eax, [ebp - 0x154]
push eax
mov byte [ebp - 4], 0x33
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x2a
call fcn.00472320
mov edi, dword [ebp - 0x68]
lea eax, [edi + 0x3c]
push 0x4d7680
push eax
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x43549d
lea ecx, [ebp - 0x24]
call fcn.00472090
lea eax, [ebp - 0x24]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1c
push ebx
mov byte [ebp - 4], 0x34
call fcn.0040e228
add esp, 0x14
lea ecx, [ebp - 0x24]
test eax, eax
je 0x436860
push str.The_Weather_ChannelDesktop_
call fcn.004727a0
cmp byte [ebp - 0x1d], 0xff
lea eax, [ebp - 0x24]
jne 0x4353aa
mov eax, dword [ebp - 0x24]
push ebx
push eax
call fcn.0040e521
pop ecx
pop ecx
push str.apps.ini
lea ecx, [ebp - 0x24]
call fcn.004727a0
lea eax, [ebp - 0xfc]
push eax
call fcn.004936d3
lea eax, [ebp - 0xfc]
push eax
call fcn.004936ac
push 0xff
mov ebx, eax
lea eax, [ebp + 0xd]
push 0
push eax
mov byte [ebp + 0xc], 0
call fcn.00493d40
push ebx
call fcn.00496201
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00494820
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
call fcn.00494920
add esp, 0x24
test eax, eax
je 0x435433
lea eax, [ebp + ebx + 0xc]
cmp byte [eax], 0xd
jne 0x43541c
mov byte [eax], 0
cmp byte [eax], 0xa
jne 0x435424
mov byte [eax], 0
lea eax, [ebp + 0xc]
push eax
inc ebx
call fcn.00494920
pop ecx
cmp ebx, eax
jb 0x435410
cmp byte [ebp - 0x1d], 0xff
lea eax, [ebp - 0x24]
jne 0x43543f
mov eax, dword [ebp - 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x4d7650
push str.SoftwareThe_Weather_ChannelAppsAppData
call ebx
cmp byte [ebp - 0x1d], 0xff
lea eax, [ebp - 0x24]
jne 0x435462
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x4d7620
push str.SoftwareThe_Weather_ChannelAppsAppData
call ebx
cmp byte [ebp - 0x1d], 0xff
lea eax, [ebp - 0x24]
jne 0x43547f
mov eax, dword [ebp - 0x24]
push eax
push 0x4d761c
push str.initialLaunch
push str.SoftwareThe_Weather_ChannelAppsAppDataSetup
call ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x2a
call fcn.00472320
push str.install_thread:_here6
lea ecx, [ebp - 0x164]
call fcn.00472340
lea eax, [ebp - 0x164]
push eax
mov byte [ebp - 4], 0x35
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 0x2a
call fcn.00472320
lea ecx, [edi + 0x7c]
mov dword [ebp - 0x60], ecx
call fcn.004720a0
test eax, eax
je 0x436819
push str.install_thread:_here7
lea ecx, [ebp - 0x174]
call fcn.00472340
lea eax, [ebp - 0x174]
push eax
mov byte [ebp - 4], 0x36
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x2a
call fcn.00472320
mov dword [esi + 0xb84], 1
mov dword [esi + 0xb88], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb7c], eax
mov ebx, 0x4d1e68
push ebx
lea eax, [edi + 0x84]
push eax
lea eax, [ebp - 0x364]
push eax
call fcn.00472c20
lea ecx, [edi + 0x8c]
push ecx
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 0x37
call fcn.00472bd0
push ebx
push eax
lea eax, [ebp - 0x2b0]
push eax
mov byte [ebp - 4], 0x38
call fcn.00472c20
lea ecx, [ebp - 0x98]
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 4], 0x39
call fcn.00472bd0
add esp, 0x30
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x3b
call fcn.00472320
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0x3c
call fcn.00472320
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 0x3d
call fcn.00472320
lea eax, [edi + 0x3c]
cmp byte [eax + 7], 0xff
mov dword [ebp - 0x44], eax
jne 0x4355c6
mov eax, dword [eax]
push str.chrhlpr
push eax
call fcn.00493420
pop ecx
pop ecx
test eax, eax
je 0x43566f
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xc0]
jge 0x43566f
push eax
lea ecx, [ebp - 0xd0]
call fcn.004737d0
push eax
lea ecx, [ebp - 0xd0]
call fcn.00473650
mov edi, dword [eax]
push dword [ebp - 0x44]
lea ebx, [edi + 0x3c]
push ebx
call fcn.0040d622
pop ecx
pop ecx
test al, al
je 0x43565f
push str.main
add edi, 0x4c
push edi
call fcn.0040d64c
pop ecx
pop ecx
test al, al
je 0x43565f
push ebx
lea eax, [ebp - 0x1cc]
push str.__pkg
push eax
call fcn.00472c70
add esp, 0xc
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x3e
call fcn.00472880
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 0x3d
call fcn.00472320
inc dword [ebp - 0x2c]
mov edi, dword [ebp - 0x68]
mov ebx, 0x4d1e68
jmp 0x4355df
xor eax, eax
push eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.004183e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x3f
call fcn.004723d0
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x3d
call fcn.00472320
push ebx
push dword [ebp - 0x60]
lea eax, [ebp - 0x250]
push eax
call fcn.00472c20
lea ecx, [ebp - 0x74]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x40
call fcn.00472bd0
add esp, 0x18
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x42
call fcn.00472320
cmp dword [esi + 0xbb8], 0
je 0x4357f5
push str.install_thread:_here7
lea ecx, [ebp - 0x194]
call fcn.00472340
lea eax, [ebp - 0x194]
push eax
mov byte [ebp - 4], 0x43
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0x42
call fcn.00472320
xor ebx, ebx
push ebx
push ebx
mov eax, 0x104
push eax
push eax
push 0xff
push 6
push 3
push str..pipe_realnetworks.installer.pipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x64], eax
cmp eax, 0xffffffff
je 0x4368bd
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x435769
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x436924
lea eax, [edi + 0xbc]
push 0x4e6290
push eax
mov dword [ebp - 0x118], ebx
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x4357ba
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x300]
push 0x4d1a1c
push eax
call fcn.00472c70
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x46
call fcn.004723d0
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x42
call fcn.00472320
cmp byte [ebp - 0x39], 0xff
lea eax, [ebp - 0x40]
jne 0x4357c6
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
push ebx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x40]
call fcn.004720a0
inc eax
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x30], 1
xor ebx, ebx
jmp 0x435eab
push str.install_thread:_here8
lea ecx, [ebp - 0x1a4]
call fcn.00472340
lea eax, [ebp - 0x1a4]
push eax
mov byte [ebp - 4], 0x47
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0x42
call fcn.00472320
mov ecx, dword [ebp - 0x60]
push 3
lea eax, [ebp - 0x260]
push eax
call fcn.00472ab0
push 0x4d7580
push eax
mov byte [ebp - 4], 0x48
call fcn.0040d604
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
mov bl, al
mov byte [ebp - 4], 0x42
call fcn.00472320
test bl, bl
je 0x435d72
push str.install_thread:_msi_install
lea ecx, [ebp - 0x1b4]
call fcn.00472340
lea eax, [ebp - 0x1b4]
push eax
mov byte [ebp - 4], 0x49
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0x42
call fcn.00472320
xor ebx, ebx
push ebx
push 2
call sub.msi.dll_MsiSetPropertyW
push esi
push 0x20034a3
push 0x429c14
mov dword [esi + 0xb70], ebx
call sub.msi.dll_MsiSetInstallLevel
lea ecx, [ebp - 0x58]
mov dword [0x501738], eax
call fcn.00472090
mov edi, dword [ebp - 0x44]
push 0x4d7560
push edi
mov byte [ebp - 4], 0x4a
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x435bca
lea eax, [esi + 0x15c]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00472280
lea eax, [esi + 0x7c]
push eax
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x4b
call fcn.00472280
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x4c
call fcn.0040d59a
test al, al
je 0x435921
push 0x4d755c
lea ecx, [ebp - 0xf0]
call fcn.00472470
lea ecx, [ebp - 0x12c]
call fcn.0040d59a
test al, al
je 0x435940
push 0x4d755c
lea ecx, [ebp - 0x12c]
call fcn.00472470
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x320]
push str._DISTCODE
push eax
call fcn.00472c70
push str._ORIGINCODE
push eax
lea eax, [ebp - 0x270]
push eax
mov byte [ebp - 4], 0x4d
call fcn.00472c20
lea ecx, [esi + 0x74]
push ecx
push eax
lea eax, [ebp - 0x2d0]
push eax
mov byte [ebp - 4], 0x4e
call fcn.00472bd0
add esp, 0x24
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x4f
call fcn.004723d0
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x4e
call fcn.00472320
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x4d
call fcn.00472320
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0x4c
call fcn.00472320
push str.DefInstallPath
lea ecx, [ebp - 0x1bc]
call fcn.00472340
mov ebx, 0x4d7560
push ebx
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 0x50
call fcn.00472340
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [esi + 0x708]
mov byte [ebp - 4], 0x51
call fcn.004174c0
lea ecx, [ebp - 0x1bc]
push ecx
mov ecx, eax
call fcn.00414e60
test eax, eax
lea ecx, [ebp - 0x1c4]
setne byte [ebp - 0x25]
mov byte [ebp - 4], 0x50
call fcn.00472320
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0x4c
call fcn.00472320
cmp byte [ebp - 0x25], 0
je 0x435b10
push str.DefInstallPath
lea ecx, [ebp - 0x14c]
call fcn.00472340
push ebx
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x52
call fcn.00472340
lea eax, [ebp - 0x184]
push eax
lea ecx, [esi + 0x708]
mov byte [ebp - 4], 0x53
call fcn.004174c0
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.004162e0
push eax
lea ecx, [ebp - 0x18c]
call fcn.00472280
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x55
call fcn.00472320
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0x56
call fcn.00472320
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x1d4]
push str._INSTALLDIR_
push eax
call fcn.00472c70
push 0x4e6714
push eax
lea eax, [ebp - 0x280]
push eax
mov byte [ebp - 4], 0x57
call fcn.00472c20
add esp, 0x18
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x58
call fcn.00472880
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x57
call fcn.00472320
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 0x56
call fcn.00472320
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x4c
call fcn.00472320
push str._system_appdata_RealNetworks
lea ecx, [ebp - 0x15c]
call fcn.00472340
push 0
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x1dc]
push eax
mov byte [ebp - 4], 0x59
call fcn.004183e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x5a
call fcn.004723d0
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 0x59
call fcn.00472320
cmp byte [ebp - 0x51], 0xff
lea eax, [ebp - 0x58]
jne 0x435b64
mov eax, dword [ebp - 0x58]
push eax
call fcn.004bb89b
lea ecx, [ebp - 0x58]
mov dword [esp], str.RealDownloader
call fcn.004727a0
cmp byte [ebp - 0x51], 0xff
lea eax, [ebp - 0x58]
jne 0x435b85
mov eax, dword [ebp - 0x58]
push eax
call fcn.004bb89b
lea ecx, [ebp - 0x58]
mov dword [esp], str.RealDownloader_log.txt
call fcn.004727a0
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x2c], 0xe97
mov byte [ebp - 4], 0x4c
call fcn.00472320
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x4b
call fcn.00472320
lea ecx, [ebp - 0xf0]
jmp 0x435c7b
push str._temp__
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x2c], 0x1000
call fcn.00472340
push ebx
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1ec]
push eax
mov byte [ebp - 4], 0x5b
call fcn.004183e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x5c
call fcn.004723d0
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 0x5b
call fcn.00472320
cmp byte [ebp - 0x51], 0xff
lea eax, [ebp - 0x58]
jne 0x435c24
mov eax, dword [ebp - 0x58]
push eax
call fcn.004bb89b
pop ecx
lea ecx, [ebp - 0x10c]
call fcn.00472090
cmp byte [edi + 7], 0xff
mov byte [ebp - 4], 0x5d
jne 0x435c42
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x10c]
push str.DLP__s_log.txt
push eax
call fcn.00472ff0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00472880
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x5b
call fcn.00472320
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0x4a
call fcn.00472320
cmp byte [ebp - 0x51], 0xff
lea eax, [ebp - 0x58]
jne 0x435c90
mov eax, dword [ebp - 0x58]
push 2
push eax
push dword [ebp - 0x2c]
call sub.msi.dll_MsiGetComponentPathA
mov edi, dword [ebp - 0x60]
push edi
lea eax, [ebp - 0x20c]
push str.msiexec__i
push eax
call fcn.00472c70
lea ecx, [ebp - 0x74]
push ecx
push eax
lea eax, [ebp - 0x1fc]
push eax
mov byte [ebp - 4], 0x5e
call fcn.00472bd0
add esp, 0x18
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x5f
call fcn.004723d0
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 0x5e
call fcn.00472320
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x4a
call fcn.00472320
cmp byte [ebp - 0x6d], 0xff
lea eax, [ebp - 0x74]
jne 0x435cff
mov eax, dword [ebp - 0x74]
cmp byte [edi + 7], 0xff
jne 0x435d07
mov edi, dword [edi]
push eax
push edi
call sub.msi.dll_MsiOpenDatabaseA
test eax, eax
jne 0x435d1f
inc eax
and dword [ebp - 0x6c], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
jmp 0x435d2e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x7c], eax
push str.install_thread:_end_msi_install
lea ecx, [ebp - 0x16c]
call fcn.00472340
lea eax, [ebp - 0x16c]
push eax
mov byte [ebp - 4], 0x60
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x4a
call fcn.00472320
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x42
call fcn.00472320
mov edi, dword [ebp - 0x68]
jmp 0x4357ee
xor ebx, ebx
cmp dword [ebp - 0x50], ebx
je 0x435e1b
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x435e1b
push str.install_thread:_IRNDownloadPartnerInstall
lea ecx, [ebp - 0x19c]
call fcn.00472340
lea eax, [ebp - 0x19c]
push eax
mov byte [ebp - 4], 0x61
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0x42
call fcn.00472320
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x90]
push edx
mov dword [ebp - 0x90], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x90]
push str.install_thread:_end_IRNDownloadPartnerInstall
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x7c], eax
call fcn.00472340
lea eax, [ebp - 0x17c]
push eax
mov byte [ebp - 4], 0x62
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0x42
call fcn.00472320
jmp 0x435eab
push str.install_thread:_other_install__exe_
lea ecx, [ebp - 0x134]
call fcn.00472340
lea eax, [ebp - 0x134]
push eax
mov byte [ebp - 4], 0x63
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x42
call fcn.00472320
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x40]
push 1
push eax
call fcn.0040def3
add esp, 0xc
test eax, eax
je 0x435e6a
mov dword [ebp - 0x30], 1
jmp 0x435e76
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
push str.install_thread:_end_other_install__exe_
lea ecx, [ebp - 0x13c]
call fcn.00472340
lea eax, [ebp - 0x13c]
push eax
mov byte [ebp - 4], 0x64
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x42
call fcn.00472320
cmp dword [ebp - 0x30], ebx
je 0x435eea
lea eax, [edi + 0x4c]
push str.main
push eax
call fcn.0040d64c
pop ecx
pop ecx
test al, al
je 0x435eea
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x11c], esp
push dword [ebp - 0x44]
call fcn.00472280
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.00429c63
lea ecx, [ebp - 0x21c]
call fcn.00472320
lea eax, [edi + 0xbc]
push 0x4e6290
push eax
call fcn.0040d64c
pop ecx
pop ecx
test al, al
je 0x436093
push str.install_thread:_wait_for_install_to_complete
lea ecx, [ebp - 0xe0]
call fcn.00472340
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x65
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x42
call fcn.00472320
cmp dword [ebp - 0x30], ebx
je 0x436084
mov ecx, dword [ebp - 0x60]
push 3
lea eax, [ebp - 0x22c]
push eax
call fcn.00472ab0
push 0x4d7580
push eax
mov byte [ebp - 4], 0x66
call fcn.0040d604
pop ecx
pop ecx
lea ecx, [ebp - 0x22c]
mov byte [ebp - 0x25], al
mov byte [ebp - 4], 0x42
call fcn.00472320
cmp byte [ebp - 0x25], 0
je 0x435f85
cmp dword [esi + 0xb70], ebx
je 0x435f3e
jmp 0x436084
cmp dword [ebp - 0x78], ebx
je 0x435fc4
push 0x3e8
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x436025
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x78]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x78], ebx
jmp 0x436084
cmp dword [ebp - 0x64], ebx
je 0x436084
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push ebx
push dword [ebp - 0x64]
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
cmp dword [ebp - 0x44], ebx
je 0x436041
push ebx
push ebx
lea eax, [ebp - 0x9c]
push eax
push 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x9c], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x43601a
cmp dword [ebp - 0x9c], ebx
ja 0x436046
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [edi + 0x54]
call fcn.0040d59a
xor ecx, ecx
test al, al
setne cl
push ecx
mov ecx, esi
call fcn.00425ee2
jmp 0x435f3e
mov dword [ebp - 0x5c], ebx
jmp 0x436084
push ebx
lea eax, [ebp - 0x9c]
push eax
push 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp]
mov dword [ebp - 0x6c], eax
xor eax, eax
cmp dword [ebp + 4], ebx
mov dword [ebp - 0x30], 1
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0xb7c]
mov dword [edi + 0x30], eax
lea eax, [edi + 0x3c]
push eax
lea eax, [ebp - 0x4c]
push str.actioninstalledpkgvalue
push eax
call fcn.00472c70
add esp, 0xc
mov byte [ebp - 4], 0x67
cmp dword [ebp - 0x30], ebx
je 0x436731
push str.install_thread:_executed
lea ecx, [ebp - 0xb0]
call fcn.00472340
lea eax, [ebp - 0xb0]
push eax
mov byte [ebp - 4], 0x68
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x67
call fcn.00472320
lea ecx, [edi + 0x34]
call fcn.0040d59a
test al, al
je 0x4360f6
lea ecx, [ebp - 0x4c]
jmp 0x436116
lea eax, [ebp - 0x240]
push eax
push ebx
push 1
lea eax, [edi + 0x34]
push eax
lea ecx, [esi + 0x260]
call fcn.00451d59
lea ecx, [ebp - 0x4c]
test eax, eax
js 0x436129
push str.successtrue
call fcn.004727a0
mov dword [edi + 0x10], 1
jmp 0x436133
push str.successfalse
call fcn.004727a0
push str.exec_valuelaunch_success
lea ecx, [ebp - 0x4c]
call fcn.004727a0
cmp dword [ebp - 0x2c], ebx
je 0x43626b
lea ecx, [ebp - 0xf8]
call fcn.00472090
push dword [ebp - 0x7c]
lea eax, [ebp - 0xf8]
push str.return_value_d
push eax
mov byte [ebp - 4], 0x69
call fcn.00472ff0
add esp, 0xc
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00472880
cmp dword [ebp - 0x7c], ebx
je 0x43625a
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00472280
push str.pkg_downloaded
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x6a
call fcn.004727a0
lea ebx, [esi + 0xb44]
mov ecx, ebx
call fcn.0040d59a
test al, al
je 0x4361c5
mov ebx, str.none
jmp 0x4361cd
cmp byte [ebx + 7], 0xff
jne 0x4361cd
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0xe8]
call fcn.004727a0
mov ecx, dword [ebp - 0x60]
and dword [ebp - 0x44], 0
push 3
lea eax, [ebp - 0x23c]
push eax
call fcn.00472ab0
push 0x4d7580
push eax
mov byte [ebp - 4], 0x6b
call fcn.0040d604
pop ecx
pop ecx
lea ecx, [ebp - 0x23c]
mov bl, al
mov byte [ebp - 4], 0x6a
call fcn.00472320
test bl, bl
je 0x43621b
mov dword [ebp - 0x44], 1
push dword [ebp - 0x44]
lea eax, [ebp - 0xe8]
push eax
push dword [edi + 0xc4]
lea eax, [edi + 0x3c]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x11c], esp
push eax
call fcn.00472280
lea ecx, [esi + 0x260]
call fcn.0044f129
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x69
call fcn.00472320
xor ebx, ebx
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x67
call fcn.00472320
jmp 0x436278
push str.return_valueunknown
lea ecx, [ebp - 0x4c]
call fcn.004727a0
lea ecx, [ebp - 0x14]
call fcn.00472090
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov byte [ebp - 4], 0x6c
push eax
lea eax, [ebp - 0x14]
push str.dltime_d
push eax
call fcn.00472ff0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00472880
lea ecx, [ebp - 0xa8]
call fcn.00472090
mov eax, dword [edi + 0x30]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov byte [ebp - 4], 0x6d
push eax
lea eax, [ebp - 0xa8]
push str.installtime_d
push eax
call fcn.00472ff0
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00472880
lea eax, [edi + 0xac]
push str.player
push eax
call fcn.0040d64c
pop ecx
pop ecx
test al, al
je 0x43633d
lea eax, [edi + 0xb4]
push str.minimized
push eax
call fcn.0040d604
pop ecx
pop ecx
test al, al
jne 0x436335
lea eax, [edi + 0xb4]
push str.restore
push eax
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x43633d
push edi
mov ecx, esi
call fcn.00427c26
mov ecx, esi
call fcn.0042908b
cmp dword [edi + 0x10], ebx
je 0x43670c
lea ecx, [edi + 0x54]
call fcn.0040d59a
test al, al
jne 0x43670c
lea edi, [esi + 0x5a0]
mov ecx, edi
call fcn.0040d59a
test al, al
jne 0x43670c
mov ecx, esi
call fcn.0042621b
test eax, eax
je 0x43670c
push edi
lea eax, [ebp - 0x124]
push eax
mov ecx, esi
call fcn.0042593b
lea eax, [esi + 0x5a8]
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6e
call fcn.0042593b
lea ebx, [esi + 0x5b8]
push 0x4d7304
push ebx
mov byte [ebp - 4], 0x6f
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x436500
lea ecx, [ebp - 0x38]
call fcn.0040d59a
test al, al
je 0x436405
push 0x4d1a1a
lea ecx, [ebp - 0xb8]
call fcn.00472340
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x124]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x70
call fcn.0042629c
lea ecx, [ebp - 0xb8]
jmp 0x4366e8
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x248]
push str.Cookie:
push eax
call fcn.00472c70
add esp, 0xc
push eax
lea eax, [ebp - 0x124]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x71
call fcn.0042629c
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x6f
call fcn.00472320
push 1
push 0x4d3844
push 0x4d1d10
lea ecx, [ebp - 0x38]
call fcn.004732b0
push 1
push 0x4d3f6c
push 0x4e69c8
lea ecx, [ebp - 0x38]
call fcn.004732b0
push edi
lea eax, [ebp - 0x288]
push eax
mov ecx, esi
call fcn.0042593b
push eax
lea eax, [ebp - 0x278]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x72
call fcn.00472c70
push 0x4d72d4
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 0x73
call fcn.00472c20
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 4], 0x74
call fcn.00472bd0
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x75
call dword [edx + 0x10]
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x74
call fcn.00472320
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x73
call fcn.00472320
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x72
call fcn.00472320
lea ecx, [ebp - 0x288]
jmp 0x4366e8
push str.post
push ebx
call fcn.0040d604
pop ecx
pop ecx
test al, al
je 0x4366f1
lea eax, [esi + 0x5c0]
push eax
lea eax, [ebp - 0x84]
push eax
mov ecx, esi
call fcn.0042593b
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 0x76
call fcn.004232d8
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x77
call fcn.0040d59a
test al, al
je 0x436556
push str.none
lea ecx, [ebp - 0x38]
call fcn.00472470
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x298]
push str.Cookie:
push eax
call fcn.00472c70
add esp, 0xc
lea ecx, [esi + 0x5d0]
push ecx
lea ecx, [esi + 0x5c8]
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push edi
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 0x78
call fcn.00423345
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x77
call fcn.00472320
lea ecx, [ebp - 0x84]
call fcn.0040d59a
test al, al
je 0x4365c2
push str.none
lea ecx, [ebp - 0x84]
call fcn.00472470
push 1
push 0x4d3844
push 0x4d1d10
lea ecx, [ebp - 0x38]
call fcn.004732b0
push 1
push 0x4d3f6c
push 0x4e69c8
lea ecx, [ebp - 0x38]
call fcn.004732b0
push edi
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call fcn.0042593b
push eax
lea eax, [ebp - 0x104]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x79
call fcn.00472c70
push 0x4d72d4
push eax
lea eax, [ebp - 0x2d8]
push eax
mov byte [ebp - 4], 0x7a
call fcn.00472c20
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x2c8]
push eax
mov byte [ebp - 4], 0x7b
call fcn.00472bd0
push 0x4d72c8
push eax
lea eax, [ebp - 0x2b8]
push eax
mov byte [ebp - 4], 0x7c
call fcn.00472c20
lea ecx, [ebp - 0x84]
push ecx
push eax
lea eax, [ebp - 0x2a8]
push eax
mov byte [ebp - 4], 0x7d
call fcn.00472bd0
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x7e
call dword [edx + 0x10]
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x7d
call fcn.00472320
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x7c
call fcn.00472320
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0x7b
call fcn.00472320
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0x7a
call fcn.00472320
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x79
call fcn.00472320
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x77
call fcn.00472320
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 0x76
call fcn.004235f1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x6f
call fcn.00472320
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x6e
call fcn.00472320
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0x6d
call fcn.00472320
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x6c
call fcn.00472320
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x67
call fcn.00472320
mov edi, dword [ebp - 0x68]
xor ebx, ebx
jmp 0x4367e0
push str.install_thread:_not_executed
lea ecx, [ebp - 0x1c]
call fcn.00472340
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x7f
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x67
call fcn.00472320
push str.successfalse
lea ecx, [ebp - 0x4c]
call fcn.004727a0
mov eax, dword [ebp - 0x6c]
cmp eax, 0x20
ja 0x4367a5
cmp eax, 0x20
je 0x43679e
dec eax
dec eax
je 0x436797
dec eax
je 0x436790
dec eax
dec eax
je 0x436789
sub eax, 3
jne 0x4367b7
push str.exec_valuenot_enough_memory
jmp 0x4367d8
push str.exec_valueaccess_denied
jmp 0x4367d8
push str.exec_valuepath_not_found
jmp 0x4367d8
push str.exec_valuefile_not_found
jmp 0x4367d8
push str.exec_valuesharing_violation
jmp 0x4367d8
sub eax, 0x483
je 0x4367d3
dec eax
je 0x4367cc
dec eax
je 0x4367c5
sub eax, 0x42
je 0x4367be
push str.exec_valueunknown_error
jmp 0x4367d8
push str.exec_valueuser_canceled
jmp 0x4367d8
push str.exec_valuedll_not_found
jmp 0x4367d8
push str.exec_valuedde_fail
jmp 0x4367d8
push str.exec_valueno_association_found
lea ecx, [ebp - 0x4c]
call fcn.004727a0
mov eax, dword [esi]
push ebx
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, esi
call dword [eax + 0x10]
cmp dword [ebp - 0x30], ebx
je 0x43693a
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x42
call fcn.00472320
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3d
call fcn.00472320
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x2a
call fcn.00472320
mov eax, dword [esi + 0xb78]
add eax, dword [esi + 0xb68]
lea ecx, [ebp - 0x98]
mov dword [esi + 0xb6c], eax
mov byte [ebp - 4], 0x20
call fcn.00472320
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 1
test eax, eax
je 0x43684b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x5c], 0
jne 0x434cbd
jmp 0x4369db
mov byte [ebp - 4], 0x2a
call fcn.00472320
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x20
call fcn.00472320
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x436889
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.00473950
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10c]
xor ecx, ebp
call fcn.00493f43
add ebp, 0x110
leave
ret
push str.actionerrorvaluepipe_creation
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x5c], ebx
call fcn.00472340
mov byte [ebp - 4], 0x44
mov eax, dword [esi]
push ebx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x42
call fcn.00472320
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3d
call fcn.00472320
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x2a
call fcn.00472320
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x20
call fcn.00472320
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x4369db
jmp 0x4369d5
push str.actionerrorvaluepipe_connection
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x5c], ebx
call fcn.00472340
mov byte [ebp - 4], 0x45
jmp 0x4368d1
add edi, 0x3c
push edi
lea eax, [ebp - 0x104]
push str.actionerrorvalue
push eax
call fcn.00472c70
push str._exec
push eax
lea eax, [ebp - 0x114]
push eax
mov byte [ebp - 4], 0x80
call fcn.00472c20
add esp, 0x18
mov edx, dword [esi]
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x81
call dword [edx + 0x10]
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x80
call fcn.00472320
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x67
call fcn.00472320
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 4], 0x42
call fcn.00472320
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3d
call fcn.00472320
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x2a
call fcn.00472320
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x20
call fcn.00472320
mov byte [ebp - 4], 1
cmp dword [ebp - 0x50], ebx
je 0x4369db
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push str.install_thread:_near_end
lea ecx, [ebp - 0x1c]
call fcn.00472340
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x82
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00472320
xor edi, edi
cmp dword [ebp - 0x5c], edi
je 0x436a67
push str.setting_m_bInstalled__TRUE
lea ecx, [ebp - 0x1c]
call fcn.00472340
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x83
call fcn.00411af0
pop ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00472320
mov dword [esi + 0x44], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xa0]
push edi
mov dword [esi + 0xb58], eax
call fcn.00420220
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.00473950
mov eax, esi
jmp 0x43689a
mov ecx, dword [ebp - 0xa0]
push edi
call fcn.00420220
mov ecx, dword [ebp - 0xa0]
call fcn.0042023d
or esi, 0xffffffff
jmp 0x436a51