Function at 0x405eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e4a7
mov eax, dword fs:[0]
push eax
sub esp, 0x49c
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x428], edx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x430], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0x411242
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x42c], eax
mov dword [0x41e430], 0
mov dword [0x41e434], 0
mov dword [0x41e42c], 0
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], 0
mov byte [ebp - 0x448], 0
call fcn.00402140
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x448]
push eax
mov ecx, 0x41d618
mov dword [ebp - 4], 0
call fcn.00401f70
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x434], 0x10
jb 0x405f82
push dword [ebp - 0x448]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.iSafeUpdateEvent
push 0
push 1
push 0
call edi
mov dword [0x41e43c], eax
test eax, eax
jne 0x406026
call fcn.00405e30
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x64
push str.report.trojanup.error.code._u
push 0x208
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
call dword [sym.imp.isafepxy.dll_public:_static_class_elex::commumod::SCommuMod____cdecl_elex::commumod::SCommuMod::instance_void_]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.isafepxy.dll_public:_static_int___cdecl_elex::commumod::SCommuMod::SendAction_wchar_t_const__]
mov esi, dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
add esp, 0x14
test eax, eax
je 0x406012
push eax
lea eax, [ebp - 0x420]
push eax
push str.SendUpdateAction__s._error_code:_d
push 0xffffffffffffffff
call esi
add esp, 0x10
push str.Create_UpdateEvent_failed
push 0xffffffffffffffff
call esi
add esp, 8
or eax, 0xffffffff
jmp 0x40630a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40605f
call fcn.00405e30
mov edx, 0x65
mov ecx, str.report.trojanup.error.code._u
call fcn.004068c0
push str.UpdateEvent_already_exist
push 0xffffffffffffffff
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
add esp, 8
or eax, 0xffffffff
jmp 0x40630a
push 0
push 0
push 1
push 0
call edi
mov dword [0x41e438], eax
test eax, eax
jne 0x40609e
call fcn.00405e30
mov edx, 0x67
mov ecx, str.report.trojanup.error.code._u
call fcn.004068c0
push str.Create_MonitorEvent_failed
push 0xffffffffffffffff
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
add esp, 8
or eax, 0xffffffff
jmp 0x40630a
push 0x20
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x4060c5
xorps xmm0, xmm0
movq qword [eax], xmm0
movq qword [eax + 8], xmm0
movq qword [eax + 0x10], xmm0
movq qword [eax + 0x18], xmm0
jmp 0x4060c7
xor eax, eax
mov dword [0x41e440], eax
test eax, eax
jne 0x4060fc
call fcn.00405e30
mov edx, 0x66
mov ecx, str.report.trojanup.error.code._u
call fcn.004068c0
push str.Create_Thread_failed
push 0xffffffffffffffff
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
add esp, 8
or eax, 0xffffffff
jmp 0x40630a
cmp dword [esi], 0
je 0x40610e
cmp dword [esi + 0x61c], 0
jne 0x40610e
mov bl, 1
jmp 0x406110
xor bl, bl
mov edx, dword [ebp - 0x430]
mov ecx, dword [ebp - 0x428]
mov byte [ebp - 0x424], bl
push dword [ebp - 0x424]
call fcn.00405d70
add esp, 4
test eax, eax
je 0x406160
call fcn.00405e30
mov edx, 0x68
mov ecx, str.report.trojanup.error.code._u
call fcn.004068c0
push str.StartUpdateThread_failed
push 0xffffffffffffffff
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
add esp, 8
or eax, 0xffffffff
jmp 0x40630a
push 0xffffffffffffffff
push dword [0x41e43c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test bl, bl
je 0x40618f
cmp dword [0x41e434], 0
je 0x40618f
cmp dword [esi + 0x620], 0
jne 0x40618f
call fcn.004040e0
mov dword [esi], 0
call fcn.00405e30
mov eax, dword [0x41e430]
mov edi, dword [0x41e434]
mov dword [ebp - 0x428], eax
mov eax, dword [0x41e42c]
lea ecx, [ebp - 0x460]
mov dword [ebp - 0x424], eax
call fcn.004054c0
xor ebx, ebx
cmp dword [eax + 0x10], ebx
lea ecx, [ebp - 0x460]
sete bl
call fcn.00401740
test edi, edi
je 0x406203
test ebx, ebx
jne 0x406203
mov esi, dword [esi + 0x624]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x424], ebx
jne 0x406215
push dword [ebp - 0x42c]
mov edx, dword [ebp - 0x428]
push eax
mov ecx, esi
call fcn.00401bd0
add esp, 8
jmp 0x40620c
cmp dword [ebp - 0x424], 0
jne 0x406215
test edi, edi
je 0x406215
call fcn.004018d0
cmp dword [0x41e424], 0
mov esi, dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
je 0x406230
push str.GetConnectError___Cannot_connect_server
push 0xffffffffffffffff
call esi
add esp, 8
test edi, edi
jne 0x406308
test ebx, ebx
jne 0x406308
push str.virus.update.error
lea ecx, [ebp - 0x460]
call fcn.00403140
lea ecx, [ebp - 0x478]
mov dword [ebp - 4], 1
call fcn.004054c0
push ecx
mov edx, eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 2
call fcn.00406f10
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 3
call fcn.00406d90
lea ecx, [ebp - 0x4a8]
call fcn.00401dc0
lea ecx, [ebp - 0x478]
call fcn.00401740
lea ecx, [ebp - 0x460]
mov dword [ebp - 4], 0xffffffff
call fcn.00401dc0
lea ecx, [ebp - 0x478]
call fcn.004054c0
cmp dword [eax + 0x14], 0x10
jb 0x4062c3
mov eax, dword [eax]
push eax
push str.Report2Soft365_LastErrorURL__S
push 0xffffffffffffffff
call esi
add esp, 0xc
lea ecx, [ebp - 0x478]
call fcn.00401740
push 0x411242
lea ecx, [ebp - 0x490]
call fcn.00401cc0
lea ecx, [ebp - 0x490]
mov dword [ebp - 4], 4
call fcn.004054a0
lea ecx, [ebp - 0x490]
call fcn.00401740
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c4b2
mov esp, ebp
pop ebp
ret