Function at 0x40362d
Capabilities:
Check for time delay via gettickcount
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov esi, 0x437c00
push esi
push dword [0x4310c4]
mov edi, eax
add edi, 0x3e8
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
push 0x80000000
push esi
call fcn.00405cd9
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], ebx
mov dword [0x40a00c], ebx
jne 0x40368d
mov eax, str.Error_launching_installer
jmp 0x4038d2
push esi
call fcn.00406066
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [0x429cf0], eax
mov esi, eax
jle 0x4037cc
mov eax, dword [0x431128]
neg eax
sbb eax, eax
and eax, 0x7e00
add eax, 0x200
cmp esi, eax
mov ebx, esi
jl 0x4036c6
mov ebx, eax
push ebx
push 0x418128
call fcn.004033b0
test eax, eax
je 0x40385b
xor eax, eax
cmp dword [0x431128], eax
jne 0x40375e
push 0x1c
push 0x418128
lea eax, [ebp - 0x2c]
push eax
call fcn.00405cb9
mov ecx, dword [ebp - 0x2c]
test ecx, 0xffffffe0
jne 0x403794
cmp dword [ebp - 0x28], 0xdeadbeef
jne 0x403794
cmp dword [ebp - 0x1c], 0x74736e49
jne 0x403794
cmp dword [ebp - 0x20], 0x74666f73
jne 0x403794
cmp dword [ebp - 0x24], 0x6c6c754e
jne 0x403794
mov eax, dword [ebp - 0x14]
cmp eax, esi
jg 0x40382d
or dword [ebp + 8], ecx
test byte [ebp + 8], 8
mov edx, dword [0x429ce8]
mov dword [0x431128], edx
jne 0x403750
test byte [ebp + 8], 4
jne 0x4037bd
inc dword [ebp - 8]
lea esi, [eax - 4]
cmp ebx, esi
jbe 0x403794
mov ebx, esi
jmp 0x403794
test byte [ebp + 8], 2
jne 0x403794
cmp dword [ebp - 4], eax
jne 0x403843
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x403794
push str.verifying_installer:__d__
push 0x403324
push 0
push 0x6f
push dword [0x4310c4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebp - 4], eax
cmp esi, dword [0x429cf0]
jge 0x4037ad
push ebx
push 0x418128
push dword [ebp - 0xc]
call fcn.0040137e
mov dword [ebp - 0xc], eax
add dword [0x429ce8], ebx
sub esi, ebx
test esi, esi
jg 0x4036ab
cmp dword [ebp - 4], 0
je 0x4037cc
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor edi, edi
cmp dword [0x431128], edi
je 0x40382d
cmp dword [ebp - 8], edi
je 0x4037fd
push dword [0x429ce8]
call fcn.004033e2
push 4
lea eax, [ebp - 8]
push eax
call fcn.004033b0
test eax, eax
je 0x40382d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x40382d
push dword [ebp - 0x18]
call fcn.00405c1a
mov esi, eax
mov eax, dword [0x431128]
add eax, 0x1c
push eax
call fcn.004033e2
push dword [ebp - 0x18]
push esi
push edi
push 0xffffffffffffffff
call fcn.004033f9
cmp eax, dword [ebp - 0x18]
je 0x40386c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, str.The_installer_you_are_trying_to_use_is_corrupted_or_incomplete._nThis_could_be_the_result_of_a_damaged_disk__a_failed_download_or_a_virus._n_nYou_may_want_to_contact_the_author_of_this_installer_to_obtain_a_new_copy._n_nIt_may_be_possible_to_skip_this_check_using_the__NCRC_command_line_switch_n_NOT_RECOMMENDED_.
jmp 0x4038d2
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
xor eax, eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x403837
jmp 0x403794
cmp dword [ebp - 4], 0
je 0x40382d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x40382d
test byte [ebp + 8], 2
mov dword [0x4310c8], esi
je 0x40387b
or dword [esi], 8
mov eax, dword [esi]
and eax, 0x18
test byte [ebp + 8], 0x10
mov dword [0x431160], eax
je 0x40388f
or byte [esi + 1], 4
test byte [ebp - 0x2c], 1
mov eax, dword [esi]
mov dword [0x431124], eax
je 0x4038a2
inc dword [0x431120]
push 8
lea eax, [esi + 0x44]
pop ecx
sub eax, 8
add dword [eax], esi
dec ecx
jne 0x4038a8
push 1
push edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
push 0x40
add esi, 4
push esi
push 0x4310e0
call fcn.00405cb9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4