Function at 0x407c80
Capabilities:
Check for time delay via gettickcount
Identify system language via api
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x457762
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x18], edi
call fcn.0042d67b
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x407cd5
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov dword [esp + 0xf8], edi
call fcn.0042d67b
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x407d06
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov byte [esp + 0xf8], 1
call fcn.0042d67b
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x407d38
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0xf8], 2
call fcn.0042d67b
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x407d6a
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
lea esi, [esp + 0x98]
call fcn.00406c30
mov byte [esp + 0xf8], 4
call fcn.0042d67b
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x407da8
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
call fcn.0042d67b
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x407dd2
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
xor ebx, ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
lea esi, [esp + 0x5c]
call fcn.00402060
lea ecx, [esp + 0x48]
mov byte [esp + 0xf8], 6
call fcn.004301af
push str.Setup.ini
lea ecx, [esp + 0x2c]
push ecx
push 0x470130
lea ecx, [esp + 0x24]
mov byte [esp + 0x104], 7
call fcn.00405060
mov byte [esp + 0xf8], 8
cmp dword [esp + 0x18], edi
jne 0x40839d
lea edx, [esp + 0x2c]
push edx
push str._dtid
push 0x470130
call fcn.00403330
push ebx
push str._local
push 0x470130
call fcn.00403330
test eax, eax
jne 0x407e65
cmp dword [0x4701e8], 3
jne 0x407e75
push 2
push 0x45c67c
lea ecx, [esp + 0x34]
call fcn.00401630
push 0x4701d8
lea ecx, [esp + 0x9c]
call fcn.0040f0a0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0xbc]
call fcn.0040f0a0
lea ecx, [esp + 0x9c]
push ecx
call fcn.004183b0
lea edx, [esp + 0x18]
add esp, 4
push edx
call fcn.00419be0
add esp, 4
push eax
lea ecx, [esp + 0xb4]
mov byte [esp + 0xfc], 9
call fcn.0040f0a0
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ef1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [esp + 0xb4], ax
mov eax, dword [0x4701e0]
test eax, eax
je 0x407f18
push str.Make_Install_API_call
push 1
push eax
call fcn.00417320
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 1
mov ebx, eax
mov dword [esp + 0x74], esi
nop
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x9c]
call fcn.00409bc0
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
jne 0x407f5c
push 0xbb8
call edi
inc esi
mov dword [esp + 0x74], esi
cmp esi, 0x14
jbe 0x407f30
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
mov dword [esp + 0x68], eax
mov eax, dword [0x4701e0]
test eax, eax
je 0x407ff4
mov ecx, str.succeeded
test ebp, ebp
jne 0x407f83
mov ecx, str.failed
push ecx
push str.Installed_API_call__s
push 1
push eax
call fcn.00417320
add esp, 0x10
test ebp, ebp
je 0x407ff8
mov ebx, dword [esp + 0x38]
shr ebx, 0x10
test bl, bl
je 0x407fc2
mov edx, dword [0x4701e0]
push 0x45d0f8
push str._t_t_t_t___Server_proceed_flag:__s
push 0
push edx
call fcn.00417320
add esp, 0x10
test bl, bl
jne 0x407ff4
mov eax, dword [esp + 0x30]
mov ecx, dword [0x4701e0]
push eax
push str._t_t_t_t___Manifest_URL:__s
push 0
push ecx
call fcn.00417320
mov edx, dword [esp + 0x44]
mov eax, dword [0x4701e0]
push edx
push str._t_t_t_t___MSI_Arguments:__s
push 0
push eax
call fcn.00417320
add esp, 0x20
test ebp, ebp
jne 0x408001
push 0x14
push str.installAPICallFailed
jmp 0x408013
mov ecx, dword [esp + 0x38]
shr ecx, 0x10
test cl, cl
je 0x40801d
push 0xf
push str.blockedByServer
mov ecx, 0x4701f0
call fcn.00401d70
push str.Setup.ini
lea edx, [esp + 0x18]
push edx
push 0x470130
lea ecx, [esp + 0x24]
call fcn.00405060
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408055
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x18], 0
jne 0x408399
mov ecx, dword [esp + 0x30]
cmp dword [ecx - 0xc], 0
je 0x40810f
push 0
push str._local
push 0x470130
call fcn.00403330
test eax, eax
jne 0x40810f
cmp dword [0x4701e8], 3
je 0x40810f
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
push eax
call fcn.00401f90
add esp, 4
push 0
lea esi, [eax + 0x10]
push esi
push 0
call sub.urlmon.dll_IsValidURL
test eax, eax
lea eax, [esi - 0x10]
setne bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4080ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x408135
mov ecx, dword [0x4701f0]
cmp dword [ecx - 0xc], 0
jne 0x4080ed
push str.manifestDownloadFailed
mov ecx, 0x4701f0
call fcn.00401e60
mov eax, dword [0x4701e0]
test eax, eax
je 0x408423
mov edx, dword [esp + 0x30]
push edx
push str.Remote_Manifest_Path___s__is_invalid_URL_
push 1
push eax
call fcn.00417320
add esp, 0x10
mov ebx, dword [esp + 0x38]
mov eax, dword [0x4701e0]
test eax, eax
je 0x408427
push str.Trying_to_use_internal_Manifest
push 1
push eax
call fcn.00417320
add esp, 0xc
jmp 0x408427
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
call fcn.00411050
mov edi, eax
test edi, edi
jne 0x408180
mov eax, dword [0x4701f0]
cmp dword [eax - 0xc], edi
jne 0x408161
push str.manifestDownloadFailed
mov ecx, 0x4701f0
call fcn.00401e60
mov eax, dword [0x4701e0]
test eax, eax
je 0x408423
push str.Failed_to_download_manifest_file__Downloader_instance_unavailable_
push 1
push eax
call fcn.00417320
add esp, 0xc
jmp 0x40810f
push 0x8a
lea ecx, [esp + 0x18]
push ecx
call fcn.00402c60
mov byte [esp + 0xf8], 0xa
mov eax, dword [eax]
push str.Setup.ini
push eax
lea edx, [esp + 0x44]
push edx
call fcn.0040f030
mov byte [esp + 0x104], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4081d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4701d4]
mov edx, dword [ecx]
mov eax, dword [esp + 0x3c]
mov edx, dword [edx + 0x17c]
push eax
call edx
mov eax, dword [0x4701e0]
test eax, eax
je 0x408202
push str.Begin_downloads_of_Manifest.
push 1
push eax
call fcn.00417320
add esp, 0xc
push str.Setup.ini
lea eax, [esp + 0x1c]
push eax
push 0x470130
xor ecx, ecx
call fcn.00405060
mov esi, eax
push 0
lea ecx, [esp + 0x18]
mov bl, 0xb
push ecx
mov byte [esp + 0x100], bl
call fcn.00409950
push 0
mov byte [esp + 0xfc], 0xc
mov edx, dword [0x4701d4]
mov esi, dword [esi]
mov ecx, dword [esp + 0x34]
mov eax, dword [eax]
push edx
push 0x402170
push 0x1770
push 1
push esi
push ecx
push eax
mov eax, edi
call fcn.00411090
mov edi, eax
mov byte [esp + 0xf8], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408287
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4082af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [0x470124], 0
je 0x408351
push str.userCanceled
mov ecx, 0x4701f0
call fcn.00401e60
mov eax, dword [0x4701e0]
test eax, eax
je 0x4082e4
push str.User_canceled
push 1
push eax
call fcn.00417320
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.00402040
lea ecx, [esp + 0x48]
mov byte [esp + 0xf8], 6
call fcn.00430401
lea eax, [esp + 0x5c]
call fcn.00407970
lea esi, [esp + 0x30]
call fcn.00406df0
lea ecx, [esp + 0x98]
push ecx
mov byte [esp + 0xfc], 3
call fcn.00406d00
lea ecx, [esp + 0x40]
call fcn.00402040
lea ecx, [esp + 0x1c]
call fcn.00402040
lea ecx, [esp + 0x3c]
call fcn.00402040
lea ecx, [esp + 0x2c]
call fcn.00402040
or eax, 0xffffffff
jmp 0x409226
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4701e0]
sub eax, ebp
mov dword [esp + 0x6c], eax
test ecx, ecx
je 0x408386
mov eax, str.succeeded
test edi, edi
jne 0x408375
mov eax, str.failed
push eax
push str.Download_of_Manifest__s
push 1
push ecx
call fcn.00417320
add esp, 0x10
mov esi, dword [0x4701d4]
call fcn.0040f470
test edi, edi
je 0x40810f
mov ebx, dword [esp + 0x38]
push 0
push str._local
push 0x470130
call fcn.00403330
test eax, eax
jne 0x408113
cmp dword [0x4701e8], 3
je 0x408113
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x90]
push ecx
push str._trgb
push 0x470130
call fcn.00403330
lea edx, [esp + 0x8c]
push edx
push str._orgb
push 0x470130
call fcn.00403330
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x8c]
call fcn.0040f0a0
mov ecx, ebx
shr ecx, 0x10
test cl, cl
je 0x4086a5
mov esi, dword [0x4701d4]
call fcn.0040f520
jmp 0x409057
mov ebx, dword [esp + 0x38]
push 0x4701dc
push str._type
push 0x470130
call fcn.00403330
mov eax, dword [0x4701dc]
mov ecx, 0x4606a4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40846b
test dx, dx
je 0x408467
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40846b
add eax, 4
add ecx, 4
test dx, dx
jne 0x408445
xor eax, eax
jmp 0x408470
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
xor edx, edx
test al, al
setne dl
push 0x45dd94
add edx, 0x81
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x4084a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x28]
jmp 0x4084ac
mov ebp, dword [esp + 0x28]
push ebp
mov edi, eax
call fcn.00409240
mov esi, eax
test esi, esi
je 0x408682
cmp dword [0x4701e0], 0
je 0x408514
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00403230
mov byte [esp + 0x100], 0xd
mov ecx, dword [eax]
mov edx, dword [0x4701e0]
push ecx
push esi
push str.Error:_Extracting_Binary_Recourse_fails_with_Error_Code__d__s_
push 1
push edx
call fcn.00417320
mov byte [esp + 0x114], 8
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x1c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408514
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4701f0]
cmp dword [ecx - 0xc], 0
jne 0x408531
push 0xd
push str.internalError
mov ecx, 0x4701f0
call fcn.00401d70
mov esi, dword [0x4701d4]
call fcn.0040f520
lea eax, [ebp - 0x10]
mov byte [esp + 0xf8], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408560
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x48]
mov byte [esp + 0xf8], 6
call fcn.00430401
lea eax, [esp + 0x5c]
call fcn.00407970
mov byte [esp + 0xf8], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4085a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4085c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x98]
push ecx
mov byte [esp + 0xfc], 3
call fcn.00406d00
mov byte [esp + 0xf8], 2
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4085ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408627
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 0
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40864f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xf8], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40867a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
jmp 0x409226
mov eax, dword [0x4701e0]
test eax, eax
je 0x4083c7
push ebp
push str.Internal_Manifest_is_extracted_to___s_
push 1
push eax
call fcn.00417320
add esp, 0x10
jmp 0x4083c7
test bl, bl
je 0x4086fd
mov edx, ebx
shr edx, 8
test dl, dl
jne 0x4086fd
push ebp
push 0
push str.DefaultOffer
push str.Startup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
je 0x4086f3
mov eax, dword [0x4701e0]
test eax, eax
je 0x4086e3
push str.Offer_is_denied_by_DefaultOffer_value.
push 1
push eax
call fcn.00417320
add esp, 0xc
mov esi, dword [0x4701d4]
call fcn.0040f520
jmp 0x409057
mov ecx, 0x4701f0
call fcn.00401b90
shr ebx, 8
test bl, bl
je 0x408d29
push str.CmdLine
push str.Product
lea eax, [esp + 0x1c]
push ebp
push eax
call fcn.00420b30
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xfc], 0xe
call fcn.0040f0a0
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40875a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x34]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x40878b
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 0xc], 0
je 0x40877d
push 0x45c8c0
lea ecx, [esp + 0x20]
call fcn.0040d630
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.00401630
push str.guid
lea ecx, [esp + 0x1c]
call fcn.00401ea0
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0xfc], 0xf
call fcn.0040ac50
add esp, 4
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
mov byte [esp + 0x100], 0x10
call fcn.00419240
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xfc], 0x11
call fcn.0040f0a0
mov byte [esp + 0xf8], 0x10
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408806
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 0xf
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40882e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.dtid
lea ecx, [esp + 0x1c]
call fcn.00401ea0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x104], 0x12
call fcn.00418fd0
mov ecx, dword [eax]
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp dword [ecx - 0xc], 0
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4088ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4088d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40898c
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4088ec
cmp eax, 8
jge 0x4088fa
push 0x45c67c
lea ecx, [esp + 0x30]
call fcn.0040d630
push str.dtid
lea ecx, [esp + 0x1c]
call fcn.00401ea0
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x18]
mov bl, 0x13
push eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
mov byte [esp + 0x100], bl
call fcn.00419240
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xfc], 0x14
call fcn.0040f0a0
mov byte [esp + 0xf8], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408964
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40898c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4089a6
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
push ecx
push str._trgb
push 0x470130
mov byte [esp + 0x104], 0x15
call fcn.00403330
push str.trgb
lea ecx, [esp + 0x24]
call fcn.00401ea0
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
mov bl, 0x16
push eax
lea ecx, [esp + 0x28]
lea edx, [esp + 0x24]
mov byte [esp + 0x100], bl
call fcn.00419240
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xfc], 0x17
call fcn.0040f0a0
mov byte [esp + 0xf8], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 0x15
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push ecx
push str._psv
push 0x470130
call fcn.00403330
push 0x45dd0c
lea ecx, [esp + 0x24]
call fcn.00401ea0
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
mov bl, 0x18
push eax
lea ecx, [esp + 0x28]
lea edx, [esp + 0x24]
mov byte [esp + 0x100], bl
call fcn.00419240
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xfc], 0x19
call fcn.0040f0a0
mov byte [esp + 0xf8], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ae2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 0x15
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x45dd14
lea ecx, [esp + 0x18]
call fcn.00401ea0
push 0x45dd1c
lea ecx, [esp + 0x24]
mov byte [esp + 0xfc], 0x1a
call fcn.00401ea0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
mov bl, 0x1b
lea ecx, [esp + 0x28]
lea edx, [esp + 0x24]
mov byte [esp + 0x100], bl
call fcn.00419240
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xfc], 0x1c
call fcn.0040f0a0
mov byte [esp + 0xf8], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 0x1a
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408bb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 0x15
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408bda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x45d474
push str.Reporting
lea ecx, [esp + 0x2c]
push ebp
push ecx
call fcn.00420b30
add esp, 0x10
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xfc], 0x1d
call fcn.0040f0a0
mov byte [esp + 0xf8], 0x15
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408c2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x40]
cmp dword [esi - 0xc], 0
jne 0x408c58
mov eax, dword [0x4701e0]
test eax, eax
je 0x408ceb
push str.Warning:_Manifest_doesnt_contain_Reporting_URL
push 1
push eax
call fcn.00417320
add esp, 0xc
jmp 0x408ceb
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408c72
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
lea ecx, [esp + 0x18]
push str.REPORTINGURL__s_
push ecx
mov byte [esp + 0x104], 0x1e
call fcn.0040f030
mov edx, dword [esp + 0x28]
add esp, 0xc
cmp dword [edx - 0xc], 0
je 0x408cb5
push 0x45c8c0
lea ecx, [esp + 0x20]
call fcn.0040d630
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.00401630
add esi, 0xfffffff0
mov byte [esp + 0xf8], 0x15
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408ceb
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
push str.CmdLine
push str.Product
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408d29
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x90]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x48], esp
mov esi, esp
push eax
call fcn.00401f90
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esi], eax
call fcn.004096e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0x50], 1
mov dword [esp + 0x44], eax
jne 0x408ec8
push 0
push 0
call fcn.00405470
mov esi, eax
push 0x4606a4
push 0x4701dc
mov dword [esp + 0x28], esi
call fcn.0040df10
add esp, 8
test al, al
je 0x408e9f
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408da9
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
push str._trga
push 0x470130
mov byte [esp + 0x104], 0x1f
call fcn.00403330
mov ebx, dword [esp + 0x14]
push ecx
add ebx, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push ebx
call fcn.00401f90
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esi], eax
call fcn.004096e0
mov ebp, dword [esp + 0x50]
xor esi, esi
add ebp, 0xffffffff
js 0x408e70
test esi, esi
jl 0x408e9a
cmp esi, dword [esp + 0x50]
jge 0x408e9a
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + esi*4]
push ecx
sub eax, 0x10
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00401f90
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00409550
push eax
lea eax, [esp + 0x28]
push eax
push 0x470130
call fcn.0040c2e0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408e6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc esi
cmp esi, ebp
jle 0x408e05
mov byte [esp + 0xf8], 8
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408fd3
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
jmp 0x408fd3
call fcn.0042d54b
push esi
lea eax, [esp + 0x28]
push eax
push 0x470130
call fcn.0040c2e0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x408fc7
mov dword [esp + 0x20], 0xffffffff
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408eea
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov byte [esp + 0xf8], 0x20
mov ebx, dword [esp + 0x50]
xor esi, esi
add ebx, 0xffffffff
mov edi, 2
js 0x408f9a
mov ebp, dword [esp + 0x20]
cmp esi, ebx
jne 0x408f25
cmp ebp, 0xffffffff
jne 0x408f25
xor edi, edi
test esi, esi
jl 0x408e9a
cmp esi, dword [esp + 0x50]
jge 0x408e9a
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + esi*4]
push edi
push eax
call fcn.00405470
cmp eax, 0xffffffff
je 0x408f8d
push eax
lea edx, [esp + 0x28]
push edx
push 0x470130
call fcn.0040c2e0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408f7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x4701f0
lea ecx, [esp + 0x1c]
xor ebp, ebp
call fcn.0040f0a0
lea edi, [ebp + 3]
inc esi
cmp esi, ebx
jle 0x408f1c
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
cmp dword [ebp - 0xc], 0
je 0x408faf
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4701f0
call fcn.0040f0a0
lea eax, [ebp - 0x10]
mov byte [esp + 0xf8], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408fd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x44]
cmp dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x70], eax
je 0x409057
mov esi, dword [0x4701d4]
call fcn.0040f470
mov eax, dword [0x4701f0]
mov ecx, str.offerExtended
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409026
test dx, dx
je 0x409022
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409026
add eax, 4
add ecx, 4
test dx, dx
jne 0x409000
xor eax, eax
jmp 0x40902b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x409044
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x60]
call fcn.0040b350
jmp 0x409053
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.0040b570
mov dword [esp + 0x20], eax
push 0
push str._noreporting
push 0x470130
call fcn.00403330
test eax, eax
jne 0x4090e0
mov ecx, dword [esp + 0x20]
push 1
lea edx, [esp + 0xc8]
push edx
mov dword [esp + 0x9c], ecx
call fcn.0041a1c0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xc8]
push ecx
mov byte [esp + 0x100], 0x21
call fcn.0041a350
lea edx, [esp + 0xc4]
push edx
call fcn.0041a3e0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0xc8]
push ecx
call fcn.0041b700
lea edx, [esp + 0xc4]
push edx
call fcn.0041a840
lea ecx, [esp + 0xc4]
mov byte [esp + 0xf8], 8
call fcn.0041a290
mov byte [esp + 0xf8], 7
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409108
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x48]
mov byte [esp + 0xf8], 6
call fcn.00430401
lea eax, [esp + 0x5c]
call fcn.00407970
mov byte [esp + 0xf8], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40914a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40916a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x98]
push ecx
mov byte [esp + 0xfc], 3
call fcn.00406d00
mov byte [esp + 0xf8], 2
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4091a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4091cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 0
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4091f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xf8], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409222
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe8
ret