Function at 0x461d10
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Create process on windows
Create thread
Delete registry value
Enumerate processes
Self delete

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d99ad
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x738
mov eax, dword [0x56b06c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x6f8], edx
push 0x57383c
mov dword [ebp - 0x740], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4231d0
push 0x16
call fcn.004b9f65
push 3
push 0
call fcn.004ba117
push 0x4231d0
call fcn.004b47bf
add esp, 0x14
push 0x4231d0
call fcn.004a9047
add esp, 4
push 0x4231d0
call fcn.004a8d75
add esp, 4
push 0x4231d0
call fcn.004b1e08
add esp, 4
push 0x4230e0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov word [ebp - 0x738], 0
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x730], 0
call fcn.0046d980
mov dword [ebp - 0x734], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x72c], 0
mov dword [ebp - 0x728], 0
call fcn.0046dd00
mov dword [ebp - 0x72c], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x724], 0
mov dword [ebp - 0x720], 0
call fcn.0046df80
mov dword [ebp - 0x724], eax
mov byte [ebp - 4], 2
push 0
push 0
mov dword [ebp - 0x71c], fcn.00409000
mov dword [ebp - 0x710], 0
mov dword [ebp - 0x70c], 0
call fcn.0046e220
mov dword [ebp - 0x710], eax
lea eax, [ebp - 0x718]
push eax
mov dword [ebp - 0x718], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x714], eax
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
mov esi, eax
push 2
mov dword [ebp - 0x6e8], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x744], edi
push 0x228
lea eax, [ebp - 0x6dc]
mov byte [ebp - 4], 4
push 0
push eax
mov dword [ebp - 0x6e0], 0x22c
call fcn.004a9e70
add esp, 0xc
lea eax, [ebp - 0x6e0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x461f56
cmp dword [ebp - 0x6d8], esi
jne 0x461f44
push dword [ebp - 0x6c8]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x244], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x461f2f
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x46203a
mov byte [ebp - 4], 4
test esi, esi
je 0x461f3e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x6e8]
lea eax, [ebp - 0x6e0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x461ee7
xor eax, eax
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 7
mov word [ebp - 0x2d0], ax
test edi, edi
je 0x461f7e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], str.chrome.exe
mov dword [ebp - 0x238], str._firefox.exe
xor edi, edi
mov dword [ebp - 0x234], str.opera.exe
mov dword [ebp - 0x230], str.iexplore.exe
mov dword [ebp - 0x22c], str.YandexBrowserApplication_browser.exe
mov dword [ebp - 0x6e8], eax
nop
push 1
mov byte [ebp - 4], 7
call fcn.0047148e
mov esi, eax
mov dword [ebp - 0x744], esi
push ecx
mov ecx, esp
mov byte [ebp - 4], 9
mov dword [ecx + 4], esi
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 4]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2d0]
mov edx, dword [ebp - 0x6e8]
call fcn.00464430
add esp, 8
mov byte [ebp - 0x6e2], al
mov byte [ebp - 4], 0xa
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x46201b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp byte [ebp - 0x6e2], 0
mov byte [ebp - 4], 6
jne 0x46209b
add dword [ebp - 0x6e8], 4
inc edi
cmp edi, 5
jb 0x461fc0
jmp 0x4620bd
xor eax, eax
mov dword [ebp - 0x2c0], 0
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x2bc], 7
mov word [ebp - 0x2d0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x462060
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00412c70
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test edi, edi
je 0x461f7e
push edi
call esi
jmp 0x461f7e
push SysReAllocStringLen
sub esp, 0x18
mov ecx, esp
call fcn.00423450
lea edx, [ebp - 0x2d0]
mov ecx, str.ParentBrowserPath
call fcn.004238f0
add esp, 0x1c
xor eax, eax
mov byte [ebp - 0x6ea], 0
mov byte [ebp - 0x6eb], 0
mov byte [ebp - 0x6fd], 0
mov byte [ebp - 0x6fc], 0
mov byte [ebp - 0x6fe], 0
mov byte [ebp - 0x6fb], 0
mov byte [ebp - 0x6ee], 0
mov byte [ebp - 0x6f1], 0
mov byte [ebp - 0x701], 0
mov byte [ebp - 0x6e1], 0
mov byte [ebp - 0x6e3], 0
mov byte [ebp - 0x6fa], 0
mov byte [ebp - 0x6f9], 0
mov byte [ebp - 0x700], 0
mov byte [ebp - 0x6ed], 0
mov byte [ebp - 0x6ff], 0
mov byte [ebp - 0x6f0], 0
mov byte [ebp - 0x6e9], 0
mov byte [ebp - 0x6ef], 0
mov byte [ebp - 0x6ec], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x738]
mov byte [ebp - 0x740], al
mov byte [ebp - 0x705], al
lea eax, [ebp - 0x6ea]
push eax
push str.permachine
call fcn.0046d6b0
lea eax, [ebp - 0x6eb]
push eax
push str.peruser
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6fd]
push eax
push str.nodesktop
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6fc]
push eax
push str.nowizardfocus
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6fb]
push eax
push str.norestart
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6ee]
push eax
push str.silent
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6f1]
push eax
push str.launchdisk
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x701]
push eax
push str.install
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6e1]
push eax
push str.uninstall
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6e3]
push eax
push str.nolicence
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6fe]
push eax
push str.hidewizard
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6fa]
push eax
push str.startDisk
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6f9]
push eax
push str.retranslate
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x700]
push eax
push str.silentinauditmode
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6ed]
push eax
push str.delayautostart
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6ff]
push eax
push str.hidewizardcomplete
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
push dword [ebp - 0x6f8]
lea ecx, [ebp - 0x738]
push str.nosendtelemetry
call fcn.0046d6b0
lea eax, [ebp - 0x6f0]
push eax
push str.uselocalinstaller
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6e9]
push eax
push str.upgrade
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x740]
push eax
push str.authorize
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6ef]
push eax
push str.upgradeFromDisk1
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x6ec]
push eax
push str.installtelemost
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
lea eax, [ebp - 0x705]
push eax
push str.setautoproxy
lea ecx, [ebp - 0x738]
call fcn.0046d6b0
xor eax, eax
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 7
mov word [ebp - 0x2a0], ax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], 7
mov word [ebp - 0x270], ax
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], 7
mov word [ebp - 0x2b8], ax
sub esp, 0x28
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ecx], 0x54c164
mov dword [ecx + 4], 0x45ee20
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 8], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 9], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0xa], al
push 0
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x738]
push str.sendreport
call fcn.0046cf70
sub esp, 0x28
lea eax, [ebp - 0x2a0]
mov ecx, esp
push 0
mov dword [ecx], 0x54c180
mov dword [ecx + 4], 0x45ef90
mov dword [ecx + 8], eax
lea eax, [ebp - 0x73c]
mov dword [ecx + 0xc], eax
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x14], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x18], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x738]
push str.userpid
call fcn.0046cf70
sub esp, 0x28
lea eax, [ebp - 0x270]
mov ecx, esp
push 0
mov dword [ecx], 0x54c19c
mov dword [ecx + 4], 0x45f030
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x738]
push str.settoken
call fcn.0046cf70
sub esp, 0x28
lea eax, [ebp - 0x2b8]
mov ecx, esp
push 0
mov dword [ecx], 0x54c19c
mov dword [ecx + 4], 0x45f030
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x738]
push str.dstr
call fcn.0046cf70
sub esp, 0x28
lea eax, [ebp - 0x288]
mov ecx, esp
push 0
mov dword [ecx], 0x54c19c
mov dword [ecx + 4], 0x45f030
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x6e1]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x738]
push 0x54be18
call fcn.0046cf70
xor esi, esi
lea ecx, [ebp - 0x738]
mov byte [ebp - 4], 0xf
call fcn.0046c050
cmp dword [ebp - 0x718], 1
jne 0x4625ed
lea ecx, [ebp - 0x4b0]
call fcn.00445e10
mov byte [ebp - 4], 0x10
call fcn.0043f480
mov cl, al
lea eax, [esi + 2]
test cl, cl
je 0x4625b5
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
lea eax, [esi + 7]
mov byte [ebp - 0x6e2], 1
cmp dword [ebp - 0x230], esi
jne 0x4625bc
mov byte [ebp - 0x6e2], 0
test al, 1
je 0x4625cb
lea ecx, [ebp - 0x240]
call fcn.00408f70
cmp byte [ebp - 0x6e2], 0
je 0x4625de
mov ecx, 0x70bd
call fcn.0044cdb0
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0xf
call fcn.00445e70
mov al, byte [ebp - 0x6eb]
test al, al
je 0x462633
cmp byte [ebp - 0x6ea], 0
je 0x462625
mov ecx, dword [0x57396c]
test ecx, ecx
je 0x46261e
mov eax, dword [ecx]
push 0x54be20
push ecx
call dword [eax + 4]
mov al, byte [ebp - 0x6eb]
add esp, 8
mov byte [ebp - 0x6ea], 0
test al, al
je 0x462633
mov ecx, 0x70d6
call fcn.0044cdb0
cmp byte [ebp - 0x6ff], 0
mov edi, 1
je 0x46264d
mov dword [ebp - 0x6e8], 2
jmp 0x46265d
cmp byte [ebp - 0x6fe], 0
cmovne esi, edi
mov dword [ebp - 0x6e8], esi
push 0x118
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x11c
push 0
push eax
call fcn.004a9e70
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x2c], 1
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x4627f7
push 0x118
push eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x11c
push eax
call fcn.004a9e70
add esp, 0xc
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x138], 2
mov dword [ebp - 0x2c], 1
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x4627f7
cmp byte [ebp - 0x6ee], al
jne 0x4627ae
mov edx, 0x474
lea ecx, [ebp - 0x240]
call fcn.00431560
mov esi, eax
mov edx, 0x4ec
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2e8]
call fcn.00431560
cmp dword [esi + 0x14], 8
jb 0x462784
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x46278c
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
lea ecx, [ebp - 0x240]
call fcn.0040a8a0
lea ecx, [ebp - 0x2b8]
call fcn.0040a8a0
lea ecx, [ebp - 0x270]
call fcn.0040a8a0
lea ecx, [ebp - 0x2a0]
call fcn.0040a8a0
lea ecx, [ebp - 0x288]
call fcn.0040a8a0
lea ecx, [ebp - 0x2d0]
call fcn.0040a8a0
lea ecx, [ebp - 0x738]
call fcn.0046d850
mov eax, edi
jmp 0x463a5d
push 0
mov edx, edi
mov ecx, 6
call fcn.004232c0
add esp, 4
test al, al
je 0x4628d0
mov edx, 2
push 0
lea ecx, [edx + 4]
call fcn.004232c0
add esp, 4
test al, al
jne 0x4628d0
call fcn.00461ae0
test al, al
jne 0x4628d0
cmp byte [ebp - 0x6ee], al
jne 0x4627ae
mov edx, 0x474
lea ecx, [ebp - 0x240]
call fcn.00431560
mov esi, eax
mov edx, 0x4ed
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2e8]
call fcn.00431560
cmp dword [esi + 0x14], 8
jb 0x462871
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x462879
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2e8]
mov esi, eax
call fcn.0040a8a0
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0xf
call fcn.0040a8a0
cmp esi, 1
jne 0x4627ae
mov edx, 0x4ee
lea ecx, [ebp - 0x2e8]
call fcn.00431560
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.0045e660
lea ecx, [ebp - 0x2e8]
jmp 0x4627a9
lea ecx, [ebp - 0x738]
call fcn.0046bd30
cmp byte [ebp - 0x737], 0
mov esi, eax
jne 0x4630a3
cmp dword [ebp - 0x278], 0
jne 0x4629d2
mov dl, 1
lea ecx, [ebp - 0x258]
call fcn.00421e30
cmp dword [ebp - 0x244], 0x10
lea eax, [ebp - 0x258]
mov dword [ebp - 0x2f0], 0
cmovae eax, dword [ebp - 0x258]
mov dword [ebp - 0x2ec], 0xf
mov byte [ebp - 0x300], 0
xor ecx, ecx
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d4], 7
mov word [ebp - 0x2e8], cx
push ecx
push eax
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x16
call fcn.00421360
lea eax, [ebp - 0x2e8]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x240]
call fcn.004119e0
lea ecx, [ebp - 0x300]
call fcn.004214a0
mov byte [ebp - 4], 0x18
lea edx, [ebp - 0x240]
cmp dword [ebp - 0x22c], 8
cmovae edx, dword [ebp - 0x240]
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4629a0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x288]
call fcn.00412c70
lea ecx, [ebp - 0x240]
call fcn.0040a8a0
lea ecx, [ebp - 0x258]
call fcn.00408f70
xor esi, esi
mov eax, 2
cmp byte [ebp - 0x6ea], 0
cmovne esi, eax
cmp byte [ebp - 0x6eb], 0
je 0x4629ef
or esi, 0x40
cmp byte [ebp - 0x6fd], 0
je 0x4629fb
or esi, 1
cmp byte [ebp - 0x6fc], 0
je 0x462a07
or esi, 8
cmp byte [ebp - 0x6fb], 0
je 0x462a13
or esi, 4
cmp byte [ebp - 0x700], 0
je 0x462a1f
or esi, 0x10
cmp byte [ebp - 0x6ed], 0
je 0x462a2b
or esi, 0x20
xor eax, eax
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 7
mov word [ebp - 0x318], ax
mov byte [ebp - 4], 0x19
cmp byte [ebp - 0x6fa], al
je 0x463067
lea ecx, [ebp - 0x4b0]
call fcn.00445e10
mov byte [ebp - 4], 0x1a
call fcn.0043f480
cmp dword [ebp - 0x260], 0
jne 0x462c97
call fcn.0042b290
add eax, 0x48
lea ecx, [ebp - 0x240]
push eax
call fcn.004119e0
push 0xa
push str.config.xml
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1b
call fcn.00413720
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x258], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x248], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x22c]
cmp edx, 8
jb 0x462b11
mov ecx, dword [ebp - 0x240]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462b07
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463a7b
push edx
push ecx
call fcn.004835cc
add esp, 8
xor eax, eax
mov dword [ebp - 0x230], 0
cmp dword [ebp - 0x244], 8
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x258]
cmovae eax, dword [ebp - 0x258]
push eax
mov dword [ebp - 0x22c], 7
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x244]
test eax, eax
setne al
mov byte [ebp - 0x6e2], al
cmp edx, 8
jb 0x462b9a
mov ecx, dword [ebp - 0x258]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462b8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463a80
push edx
push ecx
call fcn.004835cc
mov al, byte [ebp - 0x6e2]
add esp, 8
test al, al
jne 0x462c97
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x240]
call fcn.00408f70
test esi, esi
je 0x462c97
mov ecx, 0x70be
call fcn.0044cdb0
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x6e8], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
lea eax, [ebp - 0x6e8]
mov byte [ebp - 4], 0x1c
push eax
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x2e8]
call fcn.004602a0
add esp, 4
lea ecx, [ebp - 0x318]
push eax
call fcn.00421020
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.00408f70
push SysReAllocStringLen
sub esp, 0x18
mov ecx, esp
call fcn.00423450
mov edx, dword [ebp - 0x6e8]
mov ecx, str.ALState
call fcn.00423bd0
add esp, 0x1c
cmp dword [ebp - 0x308], 0
je 0x462c8d
mov ecx, 0x70bf
call fcn.0044cdb0
mov dl, byte [ebp - 0x6e3]
lea ecx, [ebp - 0x318]
push 0
push 0
push 1
push 0
push 1
call fcn.00461610
add esp, 0x14
jmp 0x462c97
mov ecx, 0x70c0
call fcn.0044cdb0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1d
call fcn.00423450
cmp dword [eax + 0x14], 8
jb 0x462ccc
mov eax, dword [eax]
push 0x2001f
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x24c]
call fcn.00427c40
mov edx, dword [ebp - 0x22c]
test eax, eax
sete al
mov byte [ebp - 0x6e2], al
cmp edx, 8
jb 0x462d33
mov ecx, dword [ebp - 0x240]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462d23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463a85
push edx
push ecx
call fcn.004835cc
mov al, byte [ebp - 0x6e2]
add esp, 8
mov esi, dword [ebp - 0x24c]
test al, al
je 0x462d49
push str.ParentBrowserPath
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [ebp - 4], 0x1a
test esi, esi
je 0x462d58
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push SysReAllocStringLen
sub esp, 0x18
mov ecx, esp
call fcn.00423450
mov edx, edi
mov ecx, str.DiskStartAfterSetup
call fcn.00423bd0
add esp, 0x1c
cmp byte [ebp - 0x6ec], 0
je 0x462d97
lea edx, [ebp - 0x318]
lea ecx, [ebp - 0x270]
call fcn.00447510
mov byte [ebp - 0x6ec], 0
lea eax, [ebp - 0x498]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x240]
call fcn.00408f70
test esi, esi
jne 0x462ddc
sub esp, 0x18
mov ecx, esp
call fcn.00423450
mov edx, SysReAllocStringLen
mov ecx, str.SetupID
call fcn.00423820
add esp, 0x18
jmp 0x462e46
lea eax, [ebp - 0x498]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.004a81f0
add esp, 8
mov esi, eax
push SysReAllocStringLen
sub esp, 0x18
mov byte [ebp - 4], 0x1f
mov ecx, esp
call fcn.00423450
mov edx, esi
mov ecx, str.SetupID
call fcn.004238f0
add esp, 0x1c
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.00408f70
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x240]
call fcn.00408f70
test esi, esi
jne 0x462e8b
sub esp, 0x18
mov ecx, esp
call fcn.00423450
mov edx, SysReAllocStringLen
mov ecx, str.SetupDDate
call fcn.00423820
add esp, 0x18
jmp 0x462ef5
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.004a81f0
add esp, 8
mov esi, eax
push SysReAllocStringLen
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
call fcn.00423450
mov edx, esi
mov ecx, str.SetupDDate
call fcn.004238f0
add esp, 0x1c
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.00408f70
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x240]
call fcn.00408f70
test esi, esi
jne 0x462f3a
sub esp, 0x18
mov ecx, esp
call fcn.00423450
mov edx, SysReAllocStringLen
mov ecx, str.SetupSrc
call fcn.00423820
add esp, 0x18
jmp 0x462fa4
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.004a81f0
add esp, 8
mov esi, eax
push SysReAllocStringLen
sub esp, 0x18
mov byte [ebp - 4], 0x23
mov ecx, esp
call fcn.00423450
mov edx, esi
mov ecx, str.SetupSrc
call fcn.004238f0
add esp, 0x1c
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.00408f70
push dword [ebp - 0x705]
mov dl, byte [ebp - 0x6e3]
lea ecx, [ebp - 0x270]
push 1
push 0
push dword [ebp - 0x740]
push 0
call fcn.00461610
add esp, 0x14
lea ecx, [ebp - 0x240]
mov edi, eax
lea eax, [ebp - 0x450]
push eax
call fcn.0040ac40
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x240]
call fcn.00408f70
test esi, esi
je 0x463051
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040ac40
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.004a81f0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x463027
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0x5415c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
lea ecx, [ebp - 0x240]
call fcn.00408f70
lea ecx, [ebp - 0x4b0]
call fcn.00445e70
lea ecx, [ebp - 0x318]
jmp 0x4627a9
cmp byte [ebp - 0x6f9], 0
je 0x4630ec
push dword [ebp - 0x705]
mov dl, byte [ebp - 0x6e3]
lea ecx, [ebp - 0x270]
push 0
push 0
push 0
push 1
call fcn.00461610
add esp, 0x14
mov esi, eax
lea ecx, [ebp - 0x318]
call fcn.0040a8a0
lea ecx, [ebp - 0x2b8]
call fcn.0040a8a0
lea ecx, [ebp - 0x270]
call fcn.0040a8a0
lea ecx, [ebp - 0x2a0]
call fcn.0040a8a0
lea ecx, [ebp - 0x288]
call fcn.0040a8a0
lea ecx, [ebp - 0x2d0]
call fcn.0040a8a0
lea ecx, [ebp - 0x738]
call fcn.0046d850
mov eax, esi
jmp 0x463a5d
cmp byte [ebp - 0x6ec], 0
je 0x463106
lea edx, [ebp - 0x318]
lea ecx, [ebp - 0x270]
call fcn.00447510
mov edi, dword [ebp - 0x6e8]
test edi, edi
je 0x46317e
push reloc.OLEAUT32.dll_SysReAllocString
sub esp, 0x18
mov dword [ebp - 0x6f8], 0
mov ecx, esp
call fcn.00423450
lea edx, [ebp - 0x6f8]
mov ecx, str.GlobalState
call fcn.00423cb0
add esp, 0x1c
cmp edi, 1
jne 0x46314c
mov edi, dword [ebp - 0x6f8]
or edi, 1
jmp 0x46315a
cmp edi, 2
mov edi, dword [ebp - 0x6f8]
jne 0x463160
or edi, 2
mov dword [ebp - 0x6f8], edi
push reloc.OLEAUT32.dll_SysReAllocString
sub esp, 0x18
mov ecx, esp
call fcn.00423450
mov edx, edi
mov ecx, str.GlobalState
call fcn.00423bd0
add esp, 0x1c
cmp dword [ebp - 0x2a8], 0
je 0x46334a
push reloc.OLEAUT32.dll_SysReAllocString
sub esp, 0x18
mov ecx, esp
call fcn.00423450
lea edx, [ebp - 0x2b8]
mov ecx, str.TempUpdateChannel
call fcn.004238f0
add esp, 0x1c
lea edi, [ebp - 0x2b8]
cmp dword [ebp - 0x2a4], 8
cmovae edi, dword [ebp - 0x2b8]
cmp dword [ebp - 0x2a8], 7
jne 0x463366
mov ecx, str.browser
mov edx, 7
sub edi, ecx
nop word [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x463366
add ecx, 2
sub edx, 1
jne 0x4631e0
lea eax, [ebp - 0x238]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x238], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ecx
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x6f8], 0
push eax
push 0x400
lea ecx, [ebp - 0x74c]
call fcn.0041d6b0
mov byte [ebp - 4], 0x25
movzx eax, word [ebp - 0x232]
mov ecx, dword [ebp - 0x748]
mov edx, dword [ebp - 0x74c]
sub ecx, edx
push eax
movzx eax, word [ebp - 0x236]
push eax
movzx eax, word [ebp - 0x238]
sar ecx, 1
push eax
push str._d__02d__02d
lea eax, [ecx + ecx]
push eax
push edx
call fcn.00420f60
add esp, 0x18
test eax, eax
js 0x4632b6
push dword [ebp - 0x74c]
lea ecx, [ebp - 0x2e8]
call fcn.0041df20
push SysReAllocStringLen
sub esp, 0x18
mov byte [ebp - 4], 0x26
mov ecx, esp
call fcn.00423450
lea edx, [ebp - 0x2e8]
mov ecx, str.SetupDDate
call fcn.004238f0
add esp, 0x1c
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
push str.Yandex.Browser
lea ecx, [ebp - 0x2e8]
call fcn.0041df20
push SysReAllocStringLen
sub esp, 0x18
mov byte [ebp - 4], 0x27
mov ecx, esp
call fcn.00423450
lea edx, [ebp - 0x2e8]
mov ecx, str.SetupSrc
call fcn.004238f0
add esp, 0x1c
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
mov ecx, str.SetupID
call fcn.00424040
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x74c]
test ecx, ecx
je 0x463366
mov eax, dword [ebp - 0x744]
sub eax, ecx
sar eax, 1
lea edx, [eax + eax]
mov eax, ecx
cmp edx, 0x1000
jb 0x46333e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463a8a
push edx
push ecx
call fcn.004835cc
add esp, 8
jmp 0x463366
sub esp, 0x18
mov ecx, esp
call fcn.00423450
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, str.TempUpdateChannel
call fcn.00423820
add esp, 0x18
cmp byte [ebp - 0x6ee], 0
je 0x463568
mov ecx, 0x6e5d
call fcn.0044cdb0
cmp byte [ebp - 0x6e9], 0
je 0x463390
mov ecx, 0x6ed1
call fcn.0044cdb0
mov ecx, 0x6ef6
call fcn.0044cdb0
lea ecx, [ebp - 0x438]
call fcn.0045e7c0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x434]
mov eax, dword [ebp - 0x73c]
cmp dword [ebp - 0x28c], 8
push dword [ebp - 0x290]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x2a0]
cmovae eax, dword [ebp - 0x2a0]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x6f1]
lea ecx, [ebp - 0x418]
cmp dword [ebp - 0x25c], 8
push dword [ebp - 0x260]
mov byte [ebp - 0x41c], al
lea eax, [ebp - 0x270]
cmovae eax, dword [ebp - 0x270]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x6e3]
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 0x3d0], al
mov edx, esi
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x3cc], eax
mov al, byte [ebp - 0x6ed]
mov byte [ebp - 0x3c8], al
call fcn.00461970
push eax
lea ecx, [ebp - 0x400]
call fcn.00421020
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
cmp dword [ebp - 0x3ec], 8
lea eax, [ebp - 0x400]
push dword [ebp - 0x3f0]
cmovae eax, dword [ebp - 0x400]
lea ecx, [ebp - 0x3e8]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x6f0]
lea ecx, [ebp - 0x3c4]
cmp dword [ebp - 0x274], 8
push dword [ebp - 0x278]
mov byte [ebp - 0x3c7], al
mov al, byte [ebp - 0x6e9]
mov byte [ebp - 0x3c6], al
lea eax, [ebp - 0x288]
cmovae eax, dword [ebp - 0x288]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x6ef]
lea ecx, [ebp - 0x158]
mov byte [ebp - 0x3c5], al
mov al, byte [ebp - 0x705]
push 1
mov byte [ebp - 0x3ac], al
lea eax, [ebp - 0x438]
push 0
push eax
push 0
call fcn.00443a00
lea eax, [ebp - 0x150]
push eax
push 0
lea eax, [ebp - 0x158]
push eax
push 0x42b4c0
push 0
push 0
call fcn.004ba82b
add esp, 0x18
mov dword [ebp - 0x154], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x154]
xor esi, esi
mov dword [ebp - 0x6e8], esi
test eax, eax
je 0x46353f
lea ecx, [ebp - 0x6e8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov esi, dword [ebp - 0x6e8]
lea ecx, [ebp - 0x158]
call fcn.00443e20
test esi, esi
je 0x463558
mov ecx, 0x6ebf
call fcn.0044cdb0
lea ecx, [ebp - 0x438]
call fcn.004440a0
jmp 0x463098
lea ecx, [ebp - 0x318]
call fcn.0040a8a0
mov dword [ebp - 4], 0xe
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call edi
push 2
push 0
mov dword [ebp - 0x248], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x244], eax
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0x2a
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x748]
mov dword [ebp - 0x748], 8
push eax
mov dword [ebp - 0x744], 0x34
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
sub esp, 0xc
call fcn.0046bae0
call fcn.0046b910
mov ecx, 0x6e5d
mov byte [ebp - 4], 0x2b
call fcn.0044cdb0
cmp byte [ebp - 0x6e9], 0
je 0x4635f9
mov ecx, 0x6ed1
call fcn.0044cdb0
lea ecx, [ebp - 0x3a8]
call fcn.0045e7c0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x3a4]
mov eax, dword [ebp - 0x73c]
cmp dword [ebp - 0x28c], 8
push dword [ebp - 0x290]
mov dword [ebp - 0x3a8], eax
lea eax, [ebp - 0x2a0]
cmovae eax, dword [ebp - 0x2a0]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x6f1]
lea ecx, [ebp - 0x388]
cmp dword [ebp - 0x25c], 8
push dword [ebp - 0x260]
mov byte [ebp - 0x38c], al
lea eax, [ebp - 0x270]
cmovae eax, dword [ebp - 0x270]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x6e3]
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 0x340], al
mov edx, esi
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x33c], eax
call fcn.00461970
push eax
lea ecx, [ebp - 0x370]
call fcn.00421020
lea ecx, [ebp - 0x2e8]
call fcn.0040a8a0
cmp dword [ebp - 0x35c], 8
lea eax, [ebp - 0x370]
push dword [ebp - 0x360]
cmovae eax, dword [ebp - 0x370]
lea ecx, [ebp - 0x358]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x6ed]
lea ecx, [ebp - 0x334]
cmp dword [ebp - 0x274], 8
push dword [ebp - 0x278]
mov byte [ebp - 0x338], al
mov al, byte [ebp - 0x6f0]
mov byte [ebp - 0x337], al
mov al, byte [ebp - 0x6e9]
mov byte [ebp - 0x336], al
mov al, byte [ebp - 0x6ef]
mov byte [ebp - 0x335], al
lea eax, [ebp - 0x288]
cmovae eax, dword [ebp - 0x288]
push eax
call fcn.00412c70
mov al, byte [ebp - 0x705]
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 0x31c], al
call fcn.0045e980
lea ecx, [ebp - 0x3a8]
mov dword [ebp - 0x6e8], eax
call fcn.004440a0
mov dword [ebp - 4], 0x2a
jmp 0x463784
mov eax, dword [0x573818]
add eax, 0x10
push eax
mov dword [ebp - 0x6f8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x573968]
test esi, esi
je 0x4637eb
cmp dword [esi + 4], 0
jle 0x4637b9
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x573968]
test esi, esi
je 0x4637eb
mov eax, dword [esi]
test eax, eax
je 0x4637d2
push eax
call fcn.004b4845
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004835cc
add esp, 8
push dword [ebp - 0x6f8]
mov dword [0x573968], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x573964]
test esi, esi
je 0x463849
mov eax, dword [esi]
test eax, eax
je 0x463820
push eax
call fcn.004b4845
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x463837
push eax
call fcn.004b4845
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.004835cc
add esp, 8
mov esi, dword [0x57395c]
test esi, esi
je 0x46387b
cmp dword [esi], 0
je 0x46387b
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x463865
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x463858
mov esi, dword [0x56c014]
mov ecx, dword [0x56c018]
cmp esi, ecx
jae 0x4638aa
nop dword [eax + eax]
mov eax, dword [esi]
test eax, eax
je 0x4638a3
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x56c018]
add esi, 4
cmp esi, ecx
jb 0x463890
mov ecx, 0x573930
call fcn.0046e4b0
cmp dword [ebp - 0x244], 0
jl 0x4638cd
call edi
cmp dword [ebp - 0x248], eax
jne 0x4638cd
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x2b8]
call fcn.0040a8a0
lea ecx, [ebp - 0x270]
call fcn.0040a8a0
lea ecx, [ebp - 0x2a0]
call fcn.0040a8a0
lea ecx, [ebp - 0x288]
call fcn.0040a8a0
lea ecx, [ebp - 0x2d0]
call fcn.0040a8a0
lea ecx, [ebp - 0x738]
call fcn.0046d850
mov eax, dword [ebp - 0x6e8]
jmp 0x463a5d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0048358b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
int3