Function at 0x4ab4f0
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Enumerate processes
Self delete

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x687aa6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x580
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x540], edx
push 0x7aa5b8
mov dword [ebp - 0x580], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x46cbf0
push 0x16
call fcn.0065eb75
push 3
push 0
call fcn.0065ed27
push 0x46cbf0
call fcn.0065918a
add esp, 0x14
push 0x46cbf0
call fcn.0064c717
add esp, 4
push 0x46cbf0
call fcn.0064c44e
add esp, 4
push 0x46cbf0
call fcn.00655e88
add esp, 4
push 0x46cb00
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov word [ebp - 0x574], 0
mov dword [ebp - 0x570], 0
mov dword [ebp - 0x56c], 0
call fcn.004b6520
mov dword [ebp - 0x570], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x564], 0
call fcn.004b67a0
mov dword [ebp - 0x568], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 0
call fcn.004696a0
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 2
push 0
push 0
mov dword [ebp - 0x558], fcn.0044fac0
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x548], 0
call fcn.004b6960
mov dword [ebp - 0x54c], eax
lea eax, [ebp - 0x554]
push eax
mov dword [ebp - 0x554], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x550], eax
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
mov esi, eax
push 2
mov dword [ebp - 0x530], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x2ec], edi
push 0x228
lea eax, [ebp - 0x524]
mov byte [ebp - 4], 4
push 0
push eax
mov dword [ebp - 0x528], 0x22c
call fcn.0064cf50
add esp, 0xc
lea eax, [ebp - 0x528]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4ab736
cmp dword [ebp - 0x520], esi
jne 0x4ab724
push dword [ebp - 0x510]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x22c], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x4ab70f
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x4ab81a
mov byte [ebp - 4], 4
test esi, esi
je 0x4ab71e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x530]
lea eax, [ebp - 0x528]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4ab6c7
xor eax, eax
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
test edi, edi
je 0x4ab75e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], 0x77450c
mov dword [ebp - 0x2e0], str._firefox.exe
xor edi, edi
mov dword [ebp - 0x2dc], str.opera.exe
mov dword [ebp - 0x2d8], str.iexplore.exe
mov dword [ebp - 0x2d4], str.YandexBrowserApplication_browser.exe
mov dword [ebp - 0x530], eax
nop
push 1
mov byte [ebp - 4], 7
call fcn.005fe407
mov esi, eax
mov dword [ebp - 0x2ec], esi
push ecx
mov ecx, esp
mov byte [ebp - 4], 9
mov dword [ecx + 4], esi
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 4]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x288]
mov edx, dword [ebp - 0x530]
call fcn.004ad400
add esp, 8
mov byte [ebp - 0x535], al
mov byte [ebp - 4], 0xa
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x4ab7fb
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp byte [ebp - 0x535], 0
mov byte [ebp - 4], 6
jne 0x4ab87b
add dword [ebp - 0x530], 4
inc edi
cmp edi, 5
jb 0x4ab7a0
jmp 0x4ab89d
xor eax, eax
mov dword [ebp - 0x278], 0
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ab840
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.00459550
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test edi, edi
je 0x4ab75e
push edi
call esi
jmp 0x4ab75e
push reloc.WS2_32.dll_accept
sub esp, 0x18
mov ecx, esp
call fcn.0046ce70
lea edx, [ebp - 0x288]
mov ecx, str.ParentBrowserPath
call fcn.0046d250
add esp, 0x1c
xor eax, eax
mov byte [ebp - 0x532], 0
mov byte [ebp - 0x531], 0
mov byte [ebp - 0x594], 0
mov byte [ebp - 0x590], 0
mov byte [ebp - 0x53b], 0
mov byte [ebp - 0x58c], 0
mov byte [ebp - 0x534], 0
mov byte [ebp - 0x536], 0
mov byte [ebp - 0x541], 0
mov byte [ebp - 0x529], 0
mov byte [ebp - 0x52a], 0
mov byte [ebp - 0x53a], 0
mov byte [ebp - 0x539], 0
mov byte [ebp - 0x588], 0
mov byte [ebp - 0x57c], 0
mov byte [ebp - 0x53c], 0
mov byte [ebp - 0x537], 0
mov byte [ebp - 0x52b], 0
mov byte [ebp - 0x538], 0
mov byte [ebp - 0x533], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 7
mov word [ebp - 0x2a0], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x574]
mov byte [ebp - 0x580], al
mov byte [ebp - 0x578], al
lea eax, [ebp - 0x532]
push eax
push str.permachine
call fcn.004b62d0
lea eax, [ebp - 0x531]
push eax
push str.peruser
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x594]
push eax
push str.nodesktop
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x590]
push eax
push str.nowizardfocus
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x58c]
push eax
push str.norestart
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x534]
push eax
push str.silent
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x536]
push eax
push str.launchdisk
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x541]
push eax
push str.install
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x529]
push eax
push str.uninstall
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x52a]
push eax
push str.nolicence
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x53b]
push eax
push str.hidewizard
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x53a]
push eax
push str.startDisk
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x539]
push eax
push str.retranslate
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x588]
push eax
push str.silentinauditmode
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x57c]
push eax
push str.delayautostart
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x53c]
push eax
push str.hidewizardcomplete
lea ecx, [ebp - 0x574]
call fcn.004b62d0
push dword [ebp - 0x540]
lea ecx, [ebp - 0x574]
push str.nosendtelemetry
call fcn.004b62d0
lea eax, [ebp - 0x537]
push eax
push str.uselocalinstaller
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x52b]
push eax
push str.upgrade
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x580]
push eax
push str.authorize
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x538]
push eax
push str.upgradeFromDisk1
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x533]
push eax
push str.installtelemost
lea ecx, [ebp - 0x574]
call fcn.004b62d0
lea eax, [ebp - 0x578]
push eax
push str.setautoproxy
lea ecx, [ebp - 0x574]
call fcn.004b62d0
xor eax, eax
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 7
mov word [ebp - 0x2d0], ax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], 7
mov word [ebp - 0x270], ax
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], 7
mov word [ebp - 0x2b8], ax
sub esp, 0x28
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ecx], 0x7750f8
mov dword [ecx + 4], 0x4a84a0
mov al, byte [ebp - 0x529]
mov byte [ecx + 8], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 9], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xa], al
push 0
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.sendreport
call fcn.004b5c90
sub esp, 0x28
lea eax, [ebp - 0x2d0]
mov ecx, esp
push 0
mov dword [ecx], 0x7750dc
mov dword [ecx + 4], 0x4a85a0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x584]
mov dword [ecx + 0xc], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x18], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.userpid
call fcn.004b5c90
sub esp, 0x28
lea eax, [ebp - 0x270]
mov ecx, esp
push 0
mov dword [ecx], 0x775114
mov dword [ecx + 4], 0x4a8640
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.settoken
call fcn.004b5c90
sub esp, 0x28
lea eax, [ebp - 0x2b8]
mov ecx, esp
push 0
mov dword [ecx], 0x775114
mov dword [ecx + 4], 0x4a8640
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push str.dstr
call fcn.004b5c90
sub esp, 0x28
lea eax, [ebp - 0x2a0]
mov ecx, esp
push 0
mov dword [ecx], 0x775114
mov dword [ecx + 4], 0x4a8640
mov dword [ecx + 8], eax
mov al, byte [ebp - 0x529]
mov byte [ecx + 0xc], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x10], al
mov al, byte [ebp - 0x529]
mov byte [ecx + 0x14], al
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x574]
push 0x774d88
call fcn.004b5c90
xor esi, esi
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0xf
call fcn.004b4ed0
cmp dword [ebp - 0x554], 1
jne 0x4abdcd
lea ecx, [ebp - 0x98]
call fcn.0048ba20
mov byte [ebp - 4], 0x10
call fcn.00485670
mov cl, al
lea eax, [esi + 2]
test cl, cl
je 0x4abd95
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x240]
call fcn.004518d0
lea eax, [esi + 7]
mov byte [ebp - 0x535], 1
cmp dword [ebp - 0x230], esi
jne 0x4abd9c
mov byte [ebp - 0x535], 0
test al, 1
je 0x4abdab
lea ecx, [ebp - 0x240]
call fcn.0044fa30
cmp byte [ebp - 0x535], 0
je 0x4abdbe
mov ecx, 0x70bd
call fcn.00497430
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xf
call fcn.0048ba80
mov al, byte [ebp - 0x531]
test al, al
je 0x4abe13
cmp byte [ebp - 0x532], 0
je 0x4abe05
mov ecx, dword [0x7aa7c8]
test ecx, ecx
je 0x4abdfe
mov eax, dword [ecx]
push 0x774d90
push ecx
call dword [eax + 4]
mov al, byte [ebp - 0x531]
add esp, 8
mov byte [ebp - 0x532], 0
test al, al
je 0x4abe13
mov ecx, 0x70d6
call fcn.00497430
cmp byte [ebp - 0x53c], 0
mov edi, 1
je 0x4abe26
lea esi, [edi + 1]
jmp 0x4abe30
cmp byte [ebp - 0x53b], 0
cmovne esi, edi
push 0x118
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x11c
push 0
push eax
call fcn.0064cf50
add esp, 0xc
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x2c], 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x10
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x33
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x4ac0c8
push 0x118
push eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x11c
push eax
call fcn.0064cf50
add esp, 0xc
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x138], 2
mov dword [ebp - 0x2c], 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x10
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x33
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x4ac0c8
cmp byte [ebp - 0x534], al
jne 0x4abf9b
mov edx, 0x474
lea ecx, [ebp - 0x240]
call fcn.00478590
mov esi, eax
mov edx, 0x4ec
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x258]
call fcn.00478590
cmp dword [esi + 0x14], 8
jb 0x4abf71
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x4abf79
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
mov eax, dword [ebp - 0x550]
test eax, eax
je 0x4abfed
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x550], 0
lea ecx, [ebp - 0x54c]
call fcn.004b69b0
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x560]
mov esi, dword [ebp - 0x560]
push dword [esi + 4]
call fcn.004b6880
mov eax, dword [ebp - 0x560]
push 0x2c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x560]
mov dword [eax], esi
mov eax, dword [ebp - 0x560]
mov dword [eax + 8], esi
push dword [ebp - 0x560]
mov dword [ebp - 0x55c], 0
call fcn.00611704
add esp, 8
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x568]
mov esi, dword [ebp - 0x568]
push dword [esi + 4]
call fcn.004b67c0
mov eax, dword [ebp - 0x568]
push 0x28
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x568]
mov dword [eax], esi
mov eax, dword [ebp - 0x568]
mov dword [eax + 8], esi
push dword [ebp - 0x568]
mov dword [ebp - 0x564], 0
call fcn.00611704
mov eax, dword [ebp - 0x570]
lea ecx, [ebp - 0x570]
add esp, 8
push eax
push dword [eax]
lea eax, [ebp - 0x22c]
push eax
call fcn.004b65f0
push 0x50
push dword [ebp - 0x570]
call fcn.00611704
add esp, 8
mov eax, edi
jmp 0x4acd2b
push 0
mov edx, edi
mov ecx, 6
call fcn.0046cce0
add esp, 4
test al, al
je 0x4ac266
mov edx, 2
push 0
lea ecx, [edx + 4]
call fcn.0046cce0
add esp, 4
test al, al
jne 0x4ac266
call fcn.004ab310
test al, al
jne 0x4ac266
cmp byte [ebp - 0x534], al
jne 0x4ac19d
mov edx, 0x474
lea ecx, [ebp - 0x240]
call fcn.00478590
mov esi, eax
mov edx, 0x4ed
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x258]
call fcn.00478590
cmp dword [esi + 0x14], 8
jb 0x4ac142
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x4ac14a
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x258]
mov esi, eax
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0xf
call fcn.00453390
cmp esi, 1
jne 0x4ac19d
mov edx, 0x4ee
lea ecx, [ebp - 0x258]
call fcn.00478590
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.004a6ed0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
mov eax, dword [ebp - 0x550]
test eax, eax
je 0x4ac1ef
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x550], 0
lea ecx, [ebp - 0x54c]
call fcn.004b69b0
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x560]
mov esi, dword [ebp - 0x560]
push dword [esi + 4]
call fcn.004b6880
mov eax, dword [ebp - 0x560]
push 0x2c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x560]
mov dword [eax], esi
mov eax, dword [ebp - 0x560]
mov dword [eax + 8], esi
push dword [ebp - 0x560]
mov dword [ebp - 0x55c], 0
call fcn.0044fc50
add esp, 8
lea ecx, [ebp - 0x568]
call fcn.004b6810
lea ecx, [ebp - 0x570]
call fcn.004b6770
mov eax, edi
jmp 0x4acd2b
lea ecx, [ebp - 0x574]
call fcn.004b4bc0
cmp byte [ebp - 0x573], 0
mov dword [ebp - 0x540], eax
je 0x4ac2cd
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
lea ecx, [ebp - 0x574]
call fcn.004b63e0
mov eax, dword [ebp - 0x540]
jmp 0x4acd2b
cmp dword [ebp - 0x290], 0
jne 0x4ac32c
mov dl, 1
lea ecx, [ebp - 0x240]
call fcn.0046bb10
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x17
call fcn.0044fa20
mov edx, eax
lea ecx, [ebp - 0x258]
call fcn.0046b1e0
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00458230
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00464910
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
call fcn.0044fa30
push dword [ebp - 0x57c]
mov dl, byte [ebp - 0x531]
push dword [ebp - 0x588]
mov cl, byte [ebp - 0x532]
push dword [ebp - 0x58c]
push dword [ebp - 0x590]
push dword [ebp - 0x594]
call fcn.004ab2c0
add esp, 0x14
mov dword [ebp - 0x540], eax
lea ecx, [ebp - 0x2e8]
call fcn.00451510
mov byte [ebp - 4], 0x19
cmp byte [ebp - 0x53a], 0
je 0x4ac745
lea ecx, [ebp - 0x98]
call fcn.0048ba20
mov byte [ebp - 4], 0x1a
call fcn.00485670
cmp dword [ebp - 0x260], 0
jne 0x4ac491
call fcn.004aad40
test al, al
jne 0x4ac491
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x240]
call fcn.004518d0
mov esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x240]
call fcn.0044fa30
test esi, esi
je 0x4ac491
mov ecx, 0x70be
call fcn.00497430
lea eax, [ebp - 0x98]
mov dword [ebp - 0x530], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.004518d0
lea eax, [ebp - 0x530]
mov byte [ebp - 4], 0x1b
push eax
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x258]
call fcn.004a97e0
add esp, 4
lea ecx, [ebp - 0x2e8]
push eax
call fcn.0046abd0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
mov edx, dword [ebp - 0x530]
mov ecx, str.ALState
call fcn.0046d5e0
cmp dword [ebp - 0x2d8], 0
je 0x4ac487
mov ecx, 0x70bf
call fcn.00497430
mov dl, byte [ebp - 0x52a]
lea ecx, [ebp - 0x2e8]
push 0
push 0
push 1
push 0
push 1
call fcn.004aae30
add esp, 0x14
jmp 0x4ac491
mov ecx, 0x70c0
call fcn.00497430
call fcn.0046d940
mov edx, edi
mov ecx, str.DiskStartAfterSetup
call fcn.0046d5e0
cmp byte [ebp - 0x533], 0
je 0x4ac4c3
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x270]
call fcn.0048cb50
mov byte [ebp - 0x533], 0
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7e10
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
jne 0x4ac4f3
mov ecx, str.SetupID
call fcn.0046da20
jmp 0x4ac543
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7e10
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x1c
push eax
call fcn.00636100
add esp, 8
mov edx, eax
mov byte [ebp - 4], 0x1d
mov ecx, str.SetupID
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7e30
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
jne 0x4ac573
mov ecx, str.SetupDDate
call fcn.0046da20
jmp 0x4ac5c3
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7e30
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x1e
push eax
call fcn.00636100
add esp, 8
mov edx, eax
mov byte [ebp - 4], 0x1f
mov ecx, str.SetupDDate
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7e50
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
jne 0x4ac5f3
mov ecx, str.SetupSrc
call fcn.0046da20
jmp 0x4ac643
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.004a7e50
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x20
push eax
call fcn.00636100
add esp, 8
mov edx, eax
mov byte [ebp - 4], 0x21
mov ecx, str.SetupSrc
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1a
call fcn.0044fa30
push dword [ebp - 0x578]
mov dl, byte [ebp - 0x52a]
lea ecx, [ebp - 0x270]
push 1
push 0
push dword [ebp - 0x580]
push 0
call fcn.004aae30
add esp, 0x14
lea ecx, [ebp - 0x98]
mov edi, eax
lea eax, [ebp - 0x258]
push eax
call fcn.00489500
lea ecx, [ebp - 0x258]
mov esi, dword [eax + 0x10]
call fcn.0044fa30
test esi, esi
je 0x4ac6e6
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x98]
call fcn.00489500
push eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0x22
push eax
call fcn.00636100
add esp, 8
mov ecx, eax
push 1
push 0
push 0
call fcn.00458230
push eax
push 0x76b264
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x258]
call fcn.00453390
lea ecx, [ebp - 0x240]
call fcn.0044fa30
lea ecx, [ebp - 0x98]
call fcn.0048ba80
lea ecx, [ebp - 0x2e8]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
lea ecx, [ebp - 0x574]
call fcn.004b63e0
mov eax, edi
jmp 0x4acd2b
cmp byte [ebp - 0x539], 0
je 0x4ac7c6
push dword [ebp - 0x578]
mov dl, byte [ebp - 0x52a]
lea ecx, [ebp - 0x270]
push 0
push 0
push 0
push 1
call fcn.004aae30
add esp, 0x14
mov esi, eax
lea ecx, [ebp - 0x2e8]
call fcn.00453390
lea ecx, [ebp - 0x2b8]
call fcn.00453390
lea ecx, [ebp - 0x270]
call fcn.00453390
lea ecx, [ebp - 0x2d0]
call fcn.00453390
lea ecx, [ebp - 0x2a0]
call fcn.00453390
lea ecx, [ebp - 0x288]
call fcn.00453390
lea ecx, [ebp - 0x574]
call fcn.004b63e0
mov eax, esi
jmp 0x4acd2b
cmp byte [ebp - 0x533], 0
je 0x4ac7e0
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x270]
call fcn.0048cb50
test esi, esi
je 0x4ac81a
lea edx, [ebp - 0x530]
mov dword [ebp - 0x530], 0
call fcn.0046d6a0
mov edx, dword [ebp - 0x530]
cmp esi, 1
jne 0x4ac808
or edx, esi
jmp 0x4ac80f
cmp esi, 2
jne 0x4ac815
or edx, esi
mov dword [ebp - 0x530], edx
call fcn.0046d670
cmp dword [ebp - 0x2a8], 0
je 0x4ac947
lea edx, [ebp - 0x2b8]
call fcn.0046d640
push str.browser
lea ecx, [ebp - 0x2b8]
call fcn.00469b00
test al, al
je 0x4ac94c
lea eax, [ebp - 0x2f8]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x2f8], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ecx
lea eax, [ebp - 0x530]
mov dword [ebp - 0x530], 0
push eax
push 0x400
lea ecx, [ebp - 0x234]
call fcn.00464120
mov byte [ebp - 4], 0x23
movzx eax, word [ebp - 0x2f2]
mov ecx, dword [ebp - 0x230]
mov edx, dword [ebp - 0x234]
sub ecx, edx
push eax
movzx eax, word [ebp - 0x2f6]
push eax
movzx eax, word [ebp - 0x2f8]
sar ecx, 1
push eax
push str._d__02d__02d
lea eax, [ecx + ecx]
push eax
push edx
call fcn.0046ab10
add esp, 0x18
test eax, eax
js 0x4ac8f9
push dword [ebp - 0x234]
lea ecx, [ebp - 0x258]
call fcn.00464940
lea edx, [ebp - 0x258]
mov byte [ebp - 4], 0x24
mov ecx, str.SetupDDate
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x23
call fcn.00453390
push str.Yandex.Browser
lea ecx, [ebp - 0x258]
call fcn.00464940
lea edx, [ebp - 0x258]
mov byte [ebp - 4], 0x25
mov ecx, str.SetupSrc
call fcn.0046d9f0
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x23
call fcn.00453390
mov ecx, str.SetupID
call fcn.0046da20
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0x19
call fcn.00453330
jmp 0x4ac94c
call fcn.0046d610
cmp byte [ebp - 0x534], 0
je 0x4aca6f
mov ecx, 0x6e5d
call fcn.00497430
cmp byte [ebp - 0x52b], 0
je 0x4ac976
mov ecx, 0x6ed1
call fcn.00497430
mov ecx, 0x6ef6
call fcn.00497430
lea ecx, [ebp - 0xb0]
call fcn.004a7e70
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x536]
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x94], al
lea eax, [ebp - 0x270]
push eax
call fcn.00458240
mov al, byte [ebp - 0x52a]
lea ecx, [ebp - 0x258]
mov edx, dword [ebp - 0x540]
mov byte [ebp - 0x48], al
mov al, byte [ebp - 0x57c]
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], al
call fcn.004ab1b0
push eax
lea ecx, [ebp - 0x78]
call fcn.0046abd0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x60]
call fcn.00458240
mov al, byte [ebp - 0x537]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x3f], al
mov al, byte [ebp - 0x52b]
mov byte [ebp - 0x3e], al
lea eax, [ebp - 0x2a0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x538]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 0x3d], al
mov al, byte [ebp - 0x578]
mov byte [ebp - 0x24], al
call fcn.004ab110
mov esi, eax
test esi, esi
je 0x4aca5f
mov ecx, 0x6ebf
call fcn.00497430
lea ecx, [ebp - 0xb0]
call fcn.00489b70
jmp 0x4ac772
lea ecx, [ebp - 0x2e8]
call fcn.00453390
push ecx
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0xe
call fcn.00471b20
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0x28
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.004b4a40
sub esp, 0xc
call fcn.004b4940
call fcn.004b4770
mov ecx, 0x6e5d
mov byte [ebp - 4], 0x29
call fcn.00497430
cmp byte [ebp - 0x52b], 0
je 0x4acad2
mov ecx, 0x6ed1
call fcn.00497430
lea ecx, [ebp - 0xb0]
call fcn.004a7e70
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x536]
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x94], al
lea eax, [ebp - 0x270]
push eax
call fcn.00458240
mov al, byte [ebp - 0x52a]
lea ecx, [ebp - 0x258]
mov edx, dword [ebp - 0x540]
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], esi
call fcn.004ab1b0
push eax
lea ecx, [ebp - 0x78]
call fcn.0046abd0
lea ecx, [ebp - 0x258]
call fcn.00453390
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x60]
call fcn.00458240
mov al, byte [ebp - 0x57c]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x40], al
mov al, byte [ebp - 0x537]
mov byte [ebp - 0x3f], al
mov al, byte [ebp - 0x52b]
mov byte [ebp - 0x3e], al
mov al, byte [ebp - 0x538]
mov byte [ebp - 0x3d], al
lea eax, [ebp - 0x2a0]
push eax
call fcn.00458240
mov al, byte [ebp - 0x578]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 0x24], al
call fcn.004a8030
lea ecx, [ebp - 0xb0]
mov esi, eax
call fcn.00489b70
jmp 0x4acbcc
mov dword [ebp - 4], 0x28
call fcn.004aea80
lea ecx, [ebp - 0x230]
call fcn.00471b40
jmp 0x4ac77d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.006116c3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret