Function at 0x40d221
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push 0x2e4
mov eax, 0x4272a6
call fcn.00418141
mov eax, ecx
mov dword [ebp - 0x2c8], eax
lea edi, [eax + 4]
mov dword [ebp - 0x2dc], eax
push 7
pop edx
xor ebx, ebx
mov dword [edi + 0x14], edx
xor ecx, ecx
mov dword [edi + 0x10], ebx
mov word [edi], cx
mov dword [ebp - 4], ebx
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x2c], ebx
mov byte [eax + 0x1c], bl
mov dword [eax + 0x48], edx
mov dword [eax + 0x44], ebx
mov word [eax + 0x34], cx
mov dword [eax + 0x60], edx
xor edx, edx
mov dword [eax + 0x5c], edx
mov word [eax + 0x4c], cx
lea esi, [eax + 0x64]
push 0xf
pop ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edx
mov byte [esi], dl
lea ecx, [eax + 0x7c]
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x10], edx
mov dword [ebp - 0x2c4], ecx
mov byte [ecx], dl
lea ebx, [eax + 0xa0]
push 0xf
pop ecx
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x10], edx
mov byte [ebx], dl
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xc8], edx
mov byte [eax + 0xb8], dl
lea ecx, [eax + 0xd4]
mov dword [ebp - 0x2d8], ecx
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
lea ecx, [eax + 0xe0]
mov dword [ebp - 0x2d4], ecx
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov byte [ebp - 4], 9
push str.utm_sourcebrowser
mov byte [eax + 2], dl
mov byte [eax + 0xd0], dl
mov byte [eax], dl
call fcn.00415410
pop ecx
push eax
push str.utm_sourcebrowser
mov ecx, esi
call fcn.00405e7c
mov esi, str.00000000_0000_0000_0000_000000000000
push esi
call fcn.00415410
pop ecx
mov ecx, dword [ebp - 0x2c4]
push eax
push esi
call fcn.00405e7c
mov esi, str.https:__api.elementsbrowser.com_download_attachment_elements.bin
push esi
call fcn.0041454e
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00406681
xor ecx, ecx
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e4], ecx
push 0x104
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0xa
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push ecx
lea edx, [ebp - 0x218]
mov dword [ebp - 0x2cc], eax
lea ecx, [ebp - 0x230]
call fcn.00408bc7
pop ecx
push eax
mov ecx, ebx
call fcn.00402e5e
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004062d8
call esi
mov edi, eax
mov eax, dword [ebp - 0x2cc]
sub edi, eax
cmp dword [ebx + 0x14], 0x10
jb 0x40d3af
mov ecx, dword [ebx]
jmp 0x40d3b1
mov ecx, ebx
mov eax, dword [ebx + 0x10]
add eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x40d3c0
mov ecx, dword [ebx]
jmp 0x40d3c2
mov ecx, ebx
push dword [ebp - 0x2dc]
and dword [ebp - 0x268], 0
push eax
push ecx
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], 0xf
mov byte [ebp - 0x278], 0
call fcn.0040489a
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x2f0]
lea ecx, [ebp - 0x2a8]
call fcn.00401834
pop ecx
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x298], 0
jne 0x40d48c
cmp dword [ebp - 0x2f0], 5
jne 0x40d48c
lea ecx, [ebp - 0x2f0]
call fcn.00401454
push 0x42e850
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.00405f0d
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
push 0x42eda5
call fcn.00405f0d
lea eax, [ebp - 0x230]
mov edx, esi
push eax
lea ecx, [ebp - 0x248]
call fcn.00407137
mov ebx, dword [ebp - 0x2c4]
add esp, 0x1c
mov ecx, ebx
push eax
call fcn.00402e5e
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004062d8
lea ecx, [ebp - 0x230]
jmp 0x40d4d5
and dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 0x10
jb 0x40d498
mov ebx, dword [ebx]
lea ecx, [ebp - 0x290]
mov byte [ebx], 0
call fcn.004077a2
mov ebx, dword [ebp - 0x2c4]
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x280], 0
je 0x40d4cf
lea eax, [ebp - 0x290]
cmp ebx, eax
je 0x40d4cf
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.004061df
lea ecx, [ebp - 0x290]
push 0
push 1
mov byte [ebp - 4], 0xc
call fcn.004062d8
call fcn.004018ab
push ebx
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.00406273
lea edx, [ebp - 0x230]
mov byte [ebp - 4], 0xf
mov ecx, 0x42e0d0
call fcn.00407efd
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0xc
call fcn.004062d8
push 0x42e850
lea ecx, [ebp - 0x260]
call fcn.00405f0d
push 0x42f8c0
mov byte [ebp - 4], 0x10
call fcn.00415410
pop ecx
push eax
push 0x42f8c0
lea ecx, [ebp - 0x260]
call fcn.00405bf6
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [ebp - 0x260]
call fcn.00405c98
mov ebx, str.__client_id:
push ebx
call fcn.00415410
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x260]
call fcn.00405bf6
push ecx
lea eax, [ebp - 0x230]
push eax
lea ecx, [esi + 0x80]
call fcn.00406886
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x11
call fcn.00405c98
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x10
call fcn.004062d8
lea eax, [ebp - 0x260]
push edi
push eax
call fcn.0040957e
mov ecx, eax
call fcn.00406ef1
push 0x70
call fcn.00414bb9
pop ecx
test eax, eax
je 0x40d5d8
mov ecx, eax
call fcn.0040ca7b
jmp 0x40d5da
xor eax, eax
mov ecx, dword [ebp - 0x2d8]
mov dword [eax + 4], 0xff
mov dword [ebp - 0x2cc], eax
mov byte [eax + 0x68], 1
lea eax, [ebp - 0x2cc]
push eax
call fcn.0040c302
xor ebx, ebx
xor esi, esi
and dword [ebp - 0x234], ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], ebx
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 0x12
and dword [ebp - 0x2d0], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x2c4], eax
test eax, eax
je 0x40d6a6
xor edi, edi
inc edi
cmp dword [ebp - 0x2d0], edi
jle 0x40d69f
push dword [eax + edi*4]
call dword [sym.imp.USER32.dll_CharLowerW]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040671f
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x23c]
call fcn.00403093
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x12
call fcn.004065b8
mov eax, dword [ebp - 0x2c4]
inc edi
cmp edi, dword [ebp - 0x2d0]
jl 0x40d646
mov ebx, dword [ebp - 0x238]
mov esi, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str._silent
call fcn.0041454e
mov dword [ebp - 0x2c4], eax
pop ecx
cmp esi, ebx
je 0x40d7bc
mov edi, dword [ebp - 0x2c8]
push eax
push ecx
push eax
push ecx
mov ecx, esi
call fcn.0040a33a
neg eax
sbb al, al
inc al
mov byte [edi + 1], al
jne 0x40d6ef
push 0x18
pop eax
add esi, eax
mov eax, dword [ebp - 0x2c4]
cmp esi, ebx
jne 0x40d6c5
jmp 0x40d7bc
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0x2c4]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x2c0]
mov ecx, esi
push eax
call fcn.00408ebb
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x230]
call fcn.00401970
push 0
push 1
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x16
call fcn.004065b8
cmp dword [ebp - 0x21c], 0x10
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
cmovae ecx, dword [ebp - 0x230]
mov ebx, dword [ebp - 0x2d4]
add eax, ecx
cmp dword [ebp - 0x21c], 0x10
lea ecx, [ebp - 0x230]
push eax
cmovae ecx, dword [ebp - 0x230]
mov edx, ebx
push ecx
mov cl, 0x2c
call fcn.00403e80
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
pop ecx
pop ecx
cmp esi, edi
je 0x40d790
push 0x18
pop ebx
mov ecx, esi
call fcn.0040e91d
add esi, ebx
cmp esi, edi
jne 0x40d77d
mov ebx, dword [ebp - 0x2d4]
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
push 0x18
pop ecx
cdq
idiv ecx
mov ecx, dword [ebp - 0x2c8]
test eax, eax
mov byte [ebp - 4], 0x12
push 0
setne al
mov byte [ecx + 1], al
lea ecx, [ebp - 0x230]
push 1
call fcn.004062d8
mov eax, dword [ebp - 0x2c8]
xor edx, edx
mov ecx, str.silent_install
cmp byte [eax + 1], dl
setne dl
call fcn.0040809e
lea ecx, [ebp - 0x23c]
call fcn.004033db
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.004062d8
push 0
push 1
lea ecx, [ebp - 0x2a8]
call fcn.004062d8
push 0
push 1
lea ecx, [ebp - 0x278]
call fcn.004062d8
lea ecx, [ebp - 0x2f0]
call fcn.00401269
mov eax, dword [ebp - 0x2c8]
call fcn.004180f0
ret