Function at 0x47668e
Capabilities:
Check for time delay via gettickcount
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov ecx, 0x4c3a5c
mov ebx, edx
call fcn.00403706
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, str.SetDllDirectoryA
mov ecx, 0x491fb0
mov dword [0x4c3ad8], eax
call fcn.00445bc7
test eax, eax
je 0x4766ce
push 0x49013b
call eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [0x4c53a4], eax
call fcn.0041e595
mov edx, str.execblk
mov ecx, 0x4c72b8
call fcn.0041e49c
call fcn.00488f2a
call fcn.00458e5e
call fcn.004456ef
and dword [ebp - 0x28], 0
and dword [ebp - 0x18], 0
mov dword [0x4c594c], eax
mov dword [0x4c921c], eax
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x24], fcn.0042977c
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x14], fcn.00419d33
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov ecx, eax
mov dword [0x4c6f20], eax
call fcn.0044441f
call fcn.0044609e
mov eax, 0x4c76c8
cdq
push edx
push eax
mov ecx, 0x1000
call fcn.00453511
call fcn.00453ec4
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
call fcn.0042cdbb
cmp ebx, 2
mov esi, dword [ebp + 8]
mov byte [ebp - 1], 0
jl 0x476788
lea edi, [esi + 4]
mov eax, dword [edi]
push str._ANSI
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476788
dec ebx
mov esi, edi
mov byte [ebp - 1], 1
mov cl, byte [ebp - 1]
call fcn.004692d8
cmp ebx, 3
jl 0x4767d1
mov eax, dword [esi + 4]
push str._AUTOMATION
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4767d1
push 0x75
pop eax
mov dword [0x4c9214], 1
mov word [0x4ba8e8], ax
add esi, 8
mov edx, dword [esi]
push 0xd
mov ecx, 0x4ba8f8
call fcn.00411c42
dec ebx
dec ebx
jmp 0x4767d6
call fcn.00461765
cmp ebx, 2
jl 0x476877
lea edi, [esi + 4]
mov eax, dword [edi]
push str._MINIMIZED
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4767ff
dec ebx
mov esi, edi
mov byte [0x4c90a9], 1
cmp ebx, 2
jle 0x476877
mov eax, dword [esi + 4]
push str._AUTOUPDATE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476877
cmp ebx, 3
mov edi, dword [esi + 8]
mov byte [ebp + 0xb], 1
mov dword [ebp - 8], 0x1a
jle 0x47685c
mov eax, dword [esi + 0xc]
push str._NORUN
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x47684b
mov byte [ebp + 0xb], al
call fcn.00457271
dec ebx
sub esi, 4
cmp ebx, 3
jle 0x47685c
push dword [esi + 0xc]
call sub.MSVCRT.dll__wtoi
pop ecx
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov dl, byte [ebp + 0xb]
mov ecx, edi
xor esi, esi
call fcn.004542de
test al, al
je 0x476870
inc esi
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push dword [ebp - 0x10]
mov ecx, 0x4c7218
call fcn.0044f66c
mov dword [0x4c7220], 0x491b48
call fcn.004460e3
call fcn.0048d3aa
cmp ebx, 2
mov byte [ebp - 8], 0
jl 0x476906
lea edi, [esi + 4]
mov eax, dword [edi]
push str._RECOVER
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476906
and dword [ebp + 8], eax
mov dl, 1
lea ecx, [ebp + 8]
mov byte [ebp - 8], 1
mov byte [0x4c86cc], 1
call fcn.00474be4
mov ecx, eax
call fcn.004444cc
cmp ebx, 3
jne 0x476903
push 1
add esi, 8
mov eax, dword [esi]
push 0x4a4528
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x476903
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
call fcn.00453b70
xor ebx, ebx
inc ebx
jmp 0x476906
dec ebx
mov esi, edi
call fcn.0042976d
lea ecx, [ebp - 0x38]
call fcn.0046172c
mov byte [ebp + 0xb], 0
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0
call fcn.004528bf
call fcn.0041631d
call fcn.00471924
mov ecx, 0x4c9120
call fcn.0043b2f1
push eax
call fcn.00458e5e
mov edi, 0x4c6d18
add esp, 4
mov ecx, edi
call fcn.004697a4
push edi
push str.Settings_path:___s__n
call fcn.00458e5e
add esp, 8
call fcn.0046a7f1
call fcn.00471ece
inc dword [0x4c9aa4]
cmp dword [0x4c99a4], 0x443622a
je 0x4769b8
push 0xa
pop ecx
xor eax, eax
mov edi, 0x4c9a10
rep stosd dword es:[edi], eax
push 0xa
pop ecx
mov edi, 0x4c99e8
rep stosd dword es:[edi], eax
call fcn.00471f38
xor eax, eax
push eax
push 0x3e8
push 2
push eax
push eax
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push eax
push str.Sent_WM_SETTINGCHANGE_return___u
call fcn.004890f7
pop ecx
pop ecx
xor edi, edi
cmp dword [0x4c99a4], edi
jne 0x4769cc
mov dword [0x4c9374], 1
cmp byte [0x4c9333], 0
jne 0x4769ea
mov eax, dword [0x4c9374]
cmp eax, 1
je 0x4769e4
cmp eax, 0xa
jne 0x4769ea
mov dword [0x4c9374], edi
mov dword [0x4b618c], edi
call fcn.00413513
mov eax, dword [0x4c9974]
mov dword [0x4c3a90], eax
mov eax, dword [0x4c9978]
mov dword [0x4c3a94], eax
mov eax, dword [0x4c997c]
mov dword [0x4c3a88], eax
mov eax, dword [0x4c9980]
mov dword [0x4c3a8c], eax
mov eax, dword [0x4c9544]
mov dword [0x4c3a80], eax
mov eax, dword [0x4c9548]
mov dword [0x4c3a84], eax
mov eax, dword [0x4c963c]
mov dword [0x4c3a78], eax
mov eax, dword [0x4c9640]
mov dword [0x4c3a7c], eax
mov eax, dword [0x4c9734]
mov dword [0x4c3a70], eax
mov eax, dword [0x4c9738]
mov dword [0x4c3a74], eax
mov eax, dword [0x4c982c]
mov dword [0x4c3a68], eax
mov eax, dword [0x4c9830]
xor edx, edx
xor cl, cl
mov dword [0x4c3a6c], eax
call fcn.004764b2
lea ecx, [ebp - 0x20]
call fcn.0041c6b6
call fcn.004196cd
call fcn.004622df
call fcn.0042abf7
lea ecx, [ebp - 0x30]
call fcn.0042cd78
cmp ebx, 2
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], edi
jl 0x476b0a
mov eax, dword [esi + 4]
push str._UNINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476b0a
dec ebx
mov byte [ebp - 1], al
mov byte [ebp + 0xb], al
add esi, 8
cmp ebx, 2
jl 0x476afa
mov eax, dword [esi]
push 0x4a5df0
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476ae1
mov byte [ebp - 1], 1
dec ebx
add esi, 4
jmp 0x476abf
mov eax, dword [esi]
push str._REMSETTINGS
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476afa
mov byte [ebp + 0xb], 1
jmp 0x476adb
mov dl, byte [ebp + 0xb]
mov cl, byte [ebp - 1]
call fcn.00466346
jmp 0x4771f7
cmp ebx, 1
jle 0x476e84
cmp ebx, 2
jl 0x476b3d
lea edi, [esi + 4]
mov eax, dword [edi]
push str._BIGDUMP
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476b3d
mov byte [0x4c746c], 1
dec ebx
mov esi, edi
jmp 0x476e68
cmp ebx, 3
jl 0x476b65
mov eax, dword [esi + 4]
push str._DIRECTORY
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476b65
add esi, 8
mov eax, dword [esi]
mov dword [0x4c920c], eax
jmp 0x476e66
cmp ebx, 2
jl 0x476c1d
lea edi, [esi + 4]
mov eax, dword [edi]
push str._HIDE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476b8d
mov byte [0x4c7225], 1
jmp 0x476b35
mov eax, dword [edi]
push str._LAUNCHBUNDLEDURL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476bb2
add esi, 8
push dword [esi]
lea ecx, [ebp - 0x38]
call fcn.00461736
jmp 0x476e66
mov eax, dword [edi]
push str._LAUNCHBUNDLEDURLTYPE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476bd7
add esi, 8
push dword [esi]
lea ecx, [ebp - 0x38]
call fcn.0046174d
jmp 0x476e66
mov eax, dword [edi]
push str._NOINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476bfd
mov dword [0x4c9238], 0x622a
mov byte [ebp + 0xb], 1
jmp 0x476b35
mov eax, dword [edi]
push str._UPDATEINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476c1d
mov byte [ebp + 0xb], 1
mov byte [ebp - 3], 1
jmp 0x476b35
cmp ebx, 5
jl 0x476d61
mov eax, dword [esi + 4]
push str._DOWNLOADINSTALL
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476d61
mov eax, dword [esi + 8]
push dword [esi + 0xc]
mov dword [ebp - 0x40], eax
call sub.MSVCRT.dll__wtoi
add esi, 0x10
sub ebx, 4
cmp ebx, 1
mov dword [ebp - 0x3c], eax
mov eax, dword [esi]
pop ecx
mov dword [0x4c8bc4], eax
mov dword [ebp - 0xc], ebx
jle 0x476c8e
lea edi, [esi + 4]
mov ecx, dword [edi]
cmp word [ecx], 0x2f
je 0x476c8e
call fcn.0043acf2
push eax
push str.toolbar_pair_key:__S_n
mov dword [0x4c8bbc], eax
call fcn.00458e5e
add esp, 8
dec ebx
mov dword [ebp - 0xc], ebx
mov esi, edi
mov ecx, dword [ebp - 0x40]
mov byte [0x4c8bb4], 0
test ecx, ecx
je 0x476d58
cmp word [ecx], 0
je 0x476d58
mov edx, 0x4c8bac
call fcn.00469906
test al, al
je 0x476d58
push 0x1c
pop ecx
mov dword [0x4b8850], 0x4c8bac
call fcn.00444a40
mov ebx, eax
push 7
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x49bd04
call fcn.00412380
push eax
lea ecx, [ebx + 4]
mov dword [0x4bad04], eax
call fcn.004019c6
mov eax, dword [ebp - 0x3c]
push 0
mov dword [0x4bad00], 0x45fdce
push 0
mov dword [ebx], eax
mov ecx, dword [0x4b8850]
push str.offer_urls
lea edi, [ebx + 0x10]
call fcn.00403be5
mov ecx, eax
call fcn.0040376a
mov ecx, eax
call fcn.00444c8a
push eax
mov ecx, edi
call fcn.00410d4d
mov edi, dword [edi]
mov ecx, edi
test edi, edi
jne 0x476d3a
mov ecx, 0x49013b
push 0x4bad00
push 1
push ebx
mov edx, fcn.004654b6
call fcn.0045fd46
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 1
jmp 0x476e68
cmp ebx, 2
jl 0x476e34
lea edi, [esi + 4]
mov eax, dword [edi]
push str._PERFORMINSTALL
push eax
mov dword [ebp - 0x3c], edi
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476e18
cmp ebx, 3
jl 0x476d9a
push dword [esi + 8]
call sub.MSVCRT.dll__wtoi
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x476da1
mov dword [ebp - 0xc], 0x100
cmp ebx, 4
jl 0x476dab
mov edi, dword [esi + 0xc]
jmp 0x476dad
xor edi, edi
cmp ebx, 5
jl 0x476dcd
cmp byte [0x4c90aa], 0
je 0x476dcd
push dword [esi + 0x10]
call sub.MSVCRT.dll__wtol
pop ecx
mov edx, eax
mov cl, 1
call fcn.004764b2
mov ecx, edi
test edi, edi
jne 0x476dd8
mov ecx, 0x4945b8
mov eax, dword [ebp - 0xc]
push ecx
or eax, 0x80
push eax
push str.INSTALLDEBUG:__PERFORMINSTALL_with_flags___d__and_path___s__n
call fcn.00458e5e
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
mov byte [ebp - 1], 1
call fcn.00466094
test al, al
je 0x476e10
mov dword [ebp - 0x10], 1
call fcn.00457271
mov edi, dword [ebp - 0x3c]
mov eax, dword [edi]
push str._BRINGTOFRONT
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476e34
mov byte [ebp - 2], 1
jmp 0x476b35
cmp ebx, 3
jl 0x476e71
mov eax, dword [esi + 4]
push str._LOGFILE
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x476e71
add esi, 8
mov ecx, dword [esi]
call fcn.00489323
push dword [esi]
push str.Log_file_set_to_path:__s__n
call fcn.00458e5e
add esp, 8
dec ebx
dec ebx
cmp ebx, 1
jg 0x476b13
cmp byte [ebp - 1], 0
je 0x476e84
call fcn.00460d0f
push dword [ebp - 0x10]
jmp 0x476871
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
call fcn.00471b5e
test al, al
jne 0x476ec2
call fcn.0042cde6
cmp byte [ebp - 0x20], 0
je 0x476eaf
cmp dword [ebp - 0x14], 0
je 0x476eaf
lea ecx, [ebp - 0x20]
call dword [ebp - 0x14]
cmp byte [ebp - 0x30], 0
je 0x47721e
cmp dword [ebp - 0x24], 0
jmp 0x477216
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x58
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x60
pop ecx
cmp eax, ecx
mov dword [0x4c9204], eax
jg 0x476ee7
mov dword [0x4c9204], ecx
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.00471a64
call fcn.00457210
call fcn.00464f15
call fcn.004622df
call fcn.004617a4
or byte [ebp + 0xb], al
jne 0x476f2b
push edi
push edi
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov edx, esi
mov ecx, ebx
call fcn.00466094
test al, al
je 0x476f39
push edi
jmp 0x476871
cmp byte [ebp - 3], 0
je 0x476f39
push edi
push 0x8000
jmp 0x476f11
cmp ebx, 1
jle 0x476f46
mov eax, dword [esi + 4]
mov dword [0x4c9210], eax
mov dl, byte [ebp + 0xb]
mov cl, byte [ebp - 8]
call fcn.00471f01
push 0x622a
push 1
push 2
pop ebx
push ebx
push ebx
push str.Version__d._d._d__svn__u__n
call fcn.00458e5e
add esp, 0x14
call fcn.0046184b
mov byte [0x4c90a8], al
call fcn.00437d5d
cmp byte [0x4c930b], 0
je 0x476f98
xor ecx, ecx
call fcn.00420b82
test eax, eax
je 0x476f98
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4c90ac], eax
mov eax, dword [0x4c939c]
cmp eax, 6
jle 0x476fa5
push 6
pop eax
cmp eax, edi
jge 0x476fab
xor eax, eax
xor edx, edx
inc edx
mov ecx, eax
shl edx, cl
mov dword [0x4b6fc8], edx
call fcn.0042957f
push 0x28
call fcn.00444d13
pop ecx
cmp eax, edi
je 0x476fd2
mov ecx, eax
call fcn.00404a74
jmp 0x476fd4
xor eax, eax
mov ecx, eax
mov dword [0x4c3ae0], eax
call fcn.0042b1b9
call fcn.00429590
cmp byte [0x4c9339], 0
je 0x476ff4
mov dword [0x4c9260], edi
call fcn.00469873
mov byte [0x4c8f74], al
call fcn.00469ccd
mov ecx, dword [0x4c99a4]
cmp ecx, edi
jne 0x47701c
cmp dword [0x4c611c], edi
je 0x477024
mov byte [0x4c9333], 1
cmp ecx, 0x2445034
jae 0x477034
cmp byte [0x4c935f], 0
je 0x477034
mov byte [0x4c935e], 1
cmp ecx, 0x3022e66
jae 0x47704d
mov ecx, dword [0x4c5440]
call fcn.00422aba
mov ecx, dword [0x4c99a4]
cmp ecx, 0x3060000
jae 0x477082
movzx eax, byte [0x4b62be]
sub eax, edi
je 0x47707b
dec eax
je 0x477072
dec eax
je 0x477072
dec eax
jne 0x477082
mov byte [0x4b62be], 0xa
jmp 0x477082
mov byte [0x4b62be], 0xf
jmp 0x477082
mov byte [0x4b62be], 5
cmp ecx, 0x3022f33
jae 0x477099
cmp dword [0x4c59c8], ebx
jne 0x477099
mov byte [0x4c59d2], 1
and dword [0x4cb494], 0xbfffffff
mov dword [0x4c99a4], 0x443622a
call fcn.0041245a
call fcn.00471f23
mov ecx, dword [0x4c3a38]
call fcn.004198d7
call fcn.00413280
cmp dword [0x4c9214], 1
je 0x4770da
xor dl, dl
lea ecx, [ebp + 8]
call fcn.00474be4
lea ecx, [ebp - 0x108]
call fcn.00473d12
push 0x4c92e8
lea ecx, [ebp - 0x108]
call fcn.0047158a
push 0x18
call fcn.00444d13
pop ecx
cmp eax, edi
je 0x477115
push dword [0x4c90b4]
mov ecx, eax
call fcn.0041e680
mov dword [0x4c90b0], eax
jmp 0x47711b
mov dword [0x4c90b0], edi
mov esi, 0x4c9abc
mov eax, dword [esi]
cmp eax, edi
je 0x477145
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x477129
sub eax, edx
sar eax, 1
je 0x477145
mov edx, esi
mov ecx, 0x4c996c
call fcn.00455115
add esi, 0x20
cmp esi, 0x4c9afc
jl 0x477120
lea ecx, [ebp - 0x38]
call fcn.0046356a
cmp byte [ebp - 2], 0
je 0x477172
cmp dword [0x4c9214], edi
jne 0x477172
push dword [ebp - 0x104]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.00426635
test al, al
je 0x477186
push str.IPv6_is_installed
call fcn.004890f7
pop ecx
call fcn.0042957f
lea ecx, [ebp - 0x50]
call fcn.00413b0a
test al, al
je 0x4771b2
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.Got_Teredo_Address:__V
movsd dword es:[edi], dword [esi]
call fcn.004890f7
add esp, 0x14
xor edi, edi
call fcn.00429590
xor edx, edx
mov ecx, 0x10a
call fcn.00470c94
call fcn.00458e5e
mov ecx, 0x4c7218
call fcn.0044ed69
call fcn.00458e5e
lea ecx, [ebp - 0x30]
call fcn.0042977c
lea ecx, [ebp - 0x20]
call fcn.00419d33
call fcn.00458e5e
lea ecx, [ebp - 0x108]
call fcn.0044eeae
call fcn.0042cde6
cmp byte [ebp - 0x20], 0
je 0x47720d
cmp dword [ebp - 0x14], edi
je 0x47720d
lea ecx, [ebp - 0x20]
call dword [ebp - 0x14]
cmp byte [ebp - 0x30], 0
je 0x47721e
cmp dword [ebp - 0x24], edi
je 0x47721e
lea ecx, [ebp - 0x30]
call dword [ebp - 0x24]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4