Function at 0x438c00
Capabilities:
Allocate or change rwx memory
Copy file
Create thread
Execute shellcode via indirect call
Inject thread
Move file
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
push 0xffffffffffffffff
push 0x48a94d
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4afe78]
xor eax, esp
push eax
lea eax, [esp + 0xfc]
mov dword fs:[0], eax
push str.ListURL
lea eax, [esp + 0x38]
push str.UPDATEINFO
push eax
call fcn.0040d630
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx - 0xc]
xor ebp, ebp
mov dword [esp + 0x104], ebp
cmp eax, ebp
je 0x439fc1
cmp eax, 5
jl 0x439fc1
lea edx, [esp + 0x4c]
push edx
call fcn.0040b270
add esp, 4
push 0xffffffffffffffff
push ebp
mov ecx, 0x4b1468
mov byte [esp + 0x10c], 4
call fcn.00408ef0
mov ecx, 0x4b1480
call fcn.004015a0
lea ecx, [esp + 0xd4]
call fcn.004084c0
lea ecx, [esp + 0xc0]
call fcn.004084c0
mov byte [esp + 0x104], 6
call fcn.0044dc57
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x438ccb
push 0x80004005
call fcn.00401280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x5c], eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.try_to_download_the_list_file...
mov byte [esp + 0x10c], 7
call fcn.00401bd0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.MAIN
mov byte [esp + 0x110], 8
call fcn.00401bd0
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0x110], 7
call fcn.00416a90
add esp, 0xc
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x108], 9
call fcn.00401ab0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov byte [esp + 0x104], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x438d5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x5c]
push 0xffffffffffffffff
push ecx
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
mov dword [esp + 0x50], eax
call fcn.00401660
mov ecx, dword [esp + 0x118]
add esp, 4
add eax, 0x10
push ecx
mov dword [esi], eax
call fcn.0040c320
push edi
call fcn.0040e570
add esp, 0x10
push str.checkforupdates
push str.runmode
mov ecx, 0x4b1280
xor esi, esi
call fcn.004543fc
push eax
call fcn.00408920
add esp, 8
test al, al
je 0x438dbc
mov esi, 1
push str.appenternoprompt
push str.runmode
mov ecx, 0x4b1280
call fcn.004543fc
push eax
call fcn.00408920
add esp, 8
test al, al
je 0x438de2
mov esi, 1
push str.appenter
push str.runmode
mov ecx, 0x4b1280
call fcn.004543fc
push eax
call fcn.00408920
add esp, 8
test al, al
je 0x438e08
mov esi, 1
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], ebp
call fcn.0040e150
add esp, 4
xor bl, bl
mov byte [esp + 0x104], 0xa
cmp esi, ebp
je 0x438e40
push 0x48fc44
push str.QuickCheck
push 0x48e960
call fcn.0040d2c0
add esp, 0xc
mov bl, al
push 0x48e98c
push str.CheckVerNumber
push str.APPLICATION
call fcn.0040d2c0
add esp, 0xc
test al, al
jne 0x438f76
test bl, bl
je 0x438f76
push 0x4923e4
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00403ce0
mov eax, dword [eax]
mov edx, dword [esp + 0x2c]
add esp, 0xc
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438eac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x4923e4
lea ecx, [esp + 0x24]
call fcn.004050d0
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040afa0
add esp, 4
call fcn.00434dc0
push str._qupdater_.xml
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00403ce0
add esp, 0xc
push 0x48ef18
push 0x48ef10
lea ecx, [esp + 0x44]
mov byte [esp + 0x10c], 0x2c
call fcn.00403660
mov eax, dword [0x4b129c]
push eax
push 0x48fbdc
lea ecx, [esp + 0x44]
call fcn.00403660
mov edx, dword [esp + 0x20]
push 1
lea ecx, [esp + 0xc4]
push ecx
push edx
call fcn.00437e00
mov ecx, dword [esp + 0x48]
push ebp
lea eax, [esp + 0xe4]
push eax
push ecx
call fcn.00437e00
push 0x48e98c
push str.CheckLostFile
push 0x48e960
call fcn.0040d2c0
mov byte [esp + 0x57], al
mov eax, dword [esp + 0xec]
add esp, 0x24
cmp eax, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebp
jle 0x439dd7
mov dword [esp + 0x2c], ebp
mov bl, 0x2d
jmp 0x439a97
mov edx, dword [esp + 0x20]
push edx
call fcn.0040c4d0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push str.__down
push ecx
call fcn.00409750
add esp, 0x10
mov eax, dword [eax]
push eax
mov ecx, 0x4b1280
mov byte [esp + 0x108], 0xb
call fcn.004543fc
lea edx, [esp + 0x34]
push edx
mov ecx, eax
call fcn.00401ab0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov byte [esp + 0x104], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438fe0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, 0x4b16a4
call fcn.004015a0
mov eax, dword [0x4b14c0]
cmp eax, ebp
jle 0x4395ea
lea ecx, [esp + 0x24]
mov dword [0x4b169c], eax
call fcn.00402e90
mov eax, dword [0x4b14c0]
cmp eax, ebp
mov byte [esp + 0x104], 0xc
mov dword [esp + 0x2c], ebp
jle 0x4394fb
mov bl, 0xe
xor ebp, ebp
mov esi, dword [esp + 0x2c]
cmp esi, ebp
jl 0x4395a8
cmp esi, eax
jge 0x4395a8
mov ecx, dword [0x4b14bc]
mov eax, dword [ecx + esi*4]
sub eax, 0x10
push eax
call fcn.00401660
add eax, 0x10
add esp, 4
mov dword [esp + 0x1c], eax
mov byte [esp + 0x104], 0xd
call fcn.0044dc57
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
je 0x438cc1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x20]
push esi
push ecx
lea edx, [esp + 0x48]
push str._s_d
push edx
mov byte [esp + 0x114], bl
call fcn.00403ac0
mov eax, dword [esp + 0x50]
push eax
call fcn.0040c4d0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.Parameter1
lea ecx, [esp + 0x64]
push str.UPDATEINFO
push ecx
call fcn.0040d630
add esp, 0xc
mov eax, dword [eax]
push eax
push str._param1_
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], 0xf
call fcn.00403660
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
mov byte [esp + 0x104], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439104
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Parameter1
lea ecx, [esp + 0x70]
push str.UPDATEINFO
push ecx
call fcn.0040d630
add esp, 0xc
mov eax, dword [eax]
push eax
push str.param1
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], 0x10
call fcn.00403660
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov byte [esp + 0x104], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43915b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Parameter2
lea ecx, [esp + 0x78]
push str.UPDATEINFO
push ecx
call fcn.0040d630
add esp, 0xc
mov eax, dword [eax]
push eax
push str._param2_
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], 0x11
call fcn.00403660
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
mov byte [esp + 0x104], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4391b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Parameter2
lea ecx, [esp + 0x74]
push str.UPDATEINFO
push ecx
call fcn.0040d630
add esp, 0xc
mov eax, dword [eax]
push eax
push str.param2
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], 0x12
call fcn.00403660
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
mov byte [esp + 0x104], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439209
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Parameter
lea ecx, [esp + 0x6c]
push str.UPDATEINFO
push ecx
call fcn.0040d630
add esp, 0xc
mov eax, dword [eax]
push eax
push str._param_
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], 0x13
call fcn.00403660
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov byte [esp + 0x104], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439260
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Parameter
lea ecx, [esp + 0x68]
push str.UPDATEINFO
push ecx
call fcn.0040d630
add esp, 0xc
mov eax, dword [eax]
push eax
push str.param
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], 0x14
call fcn.00403660
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
mov byte [esp + 0x104], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4392b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x5c]
push str.download:
push edx
call fcn.00409750
mov eax, dword [eax]
push eax
mov byte [esp + 0x114], 0x15
call fcn.0040e570
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x104], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439305
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x495308
lea ecx, [esp + 0x3c]
call fcn.00422280
push 0x495304
lea ecx, [esp + 0x58]
mov byte [esp + 0x108], 0x16
call fcn.00422280
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
mov byte [esp + 0x110], 0x17
call fcn.004227b0
add esp, 0xc
mov eax, dword [eax]
mov byte [esp + 0x104], 0x18
cmp eax, ebp
je 0x43935a
mov eax, dword [eax]
jmp 0x43935c
xor eax, eax
lea ecx, [esp + 0x40]
push ecx
push eax
lea edx, [esp + 0x30]
push edx
call fcn.00409750
mov eax, dword [eax]
lea ecx, [esp + 0x44]
push ecx
push eax
lea edx, [esp + 0x64]
push edx
mov byte [esp + 0x11c], 0x19
call fcn.004227b0
add esp, 0x18
mov eax, dword [eax]
mov byte [esp + 0x104], 0x1a
cmp eax, ebp
je 0x43939b
mov eax, dword [eax]
jmp 0x43939d
xor eax, eax
push eax
lea ecx, [esp + 0x4c]
call fcn.00401bd0
lea ecx, [esp + 0x50]
call fcn.004094c0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x104], 0x1d
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4393d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
call fcn.004094c0
lea ecx, [esp + 0x54]
call fcn.004094c0
lea ecx, [esp + 0x38]
mov byte [esp + 0x104], 0x20
call fcn.004094c0
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx - 0xc]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00446b54
mov esi, eax
mov eax, dword [esp + 0x4c]
mov eax, dword [eax - 0xc]
lea ecx, [eax + eax + 4]
push ecx
push ebp
push esi
call fcn.0046e0a0
mov ecx, dword [esp + 0x58]
add esp, 0x10
mov edx, esi
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bp
jne 0x439440
lea edx, [esp + 0x14]
push edx
push ebp
push esi
push 0x438620
push ebp
push ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0x104], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439497
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov byte [esp + 0x104], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4394bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x104], 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4394e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [0x4b14c0]
inc ecx
cmp ecx, eax
mov dword [esp + 0x2c], ecx
jl 0x439022
xor ebp, ebp
push 0x4945c0
push str.MultCheckTimeOut
lea ecx, [esp + 0x1c]
push 0x48e960
push ecx
call fcn.0040c9c0
mov eax, dword [eax]
push eax
call fcn.0046e2e2
mov edi, eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439541
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
imul edi, edi, 0x64
xor esi, esi
cmp edi, ebp
jle 0x439588
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf000b
call fcn.00426cc0
mov ecx, dword [0x4b16a4]
add esp, 4
cmp dword [ecx - 0xc], 0
je 0x439571
mov esi, edi
cmp dword [0x4b169c], 0
jg 0x43957c
mov esi, edi
push eax
call ebx
push 1
call ebp
inc esi
cmp esi, edi
jl 0x439556
mov edx, dword [0x4b16a4]
cmp dword [edx - 0xc], 0
jne 0x4395ad
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], 1
add eax, 0xfffffff0
jmp 0x43970b
call fcn.0044d954
push 0x4b16a4
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0
call fcn.00401ab0
mov eax, dword [esp + 0x24]
push eax
call fcn.00438510
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, 0x4b14b8
call fcn.0044e129
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
jmp 0x43970b
mov ecx, dword [0x4b14b4]
cmp dword [ecx - 0xc], ebp
jne 0x439733
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
call fcn.00401750
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
mov byte [esp + 0x104], 0x21
neg ecx
or ecx, eax
push ecx
call fcn.00446b54
mov esi, eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax + 4]
push eax
push 0
push esi
call fcn.0046e0a0
mov edx, esi
add esp, 0x10
mov eax, ebp
sub edx, ebp
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x439650
xor edi, edi
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
push 0x438860
push edi
push edi
mov dword [0x4b16a0], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4952d8
push str.TimeOut
lea edx, [esp + 0x30]
push 0x48e960
push edx
call fcn.0040c9c0
mov eax, dword [eax]
push eax
call fcn.0046e2e2
add esp, 0x14
lea ecx, [esp + 0x28]
mov ebx, eax
call fcn.00401580
lea edi, [ebx + ebx*4]
add edi, edi
xor esi, esi
test edi, edi
jle 0x439708
push 0xf000c
call fcn.00426cc0
mov ecx, dword [0x4b16a0]
add esp, 4
cmp ecx, 2
jne 0x4396e2
mov dword [esp + 0x1c], 0
jmp 0x4396ef
cmp ecx, 3
jne 0x4396f4
mov dword [esp + 0x1c], 1
mov esi, ebx
imul esi, esi, 0x64
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, edi
jl 0x4396c0
lea eax, [ebp - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x104], 0xa
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43972c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x1c], 0
jne 0x439784
push 0x4923e4
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00403ce0
mov eax, dword [eax]
add esp, 0xc
xor ebp, ebp
push ebp
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438ecc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x438ecc
mov ecx, dword [0x4b14b4]
cmp dword [ecx - 0xc], 0
push 0xffffffffffffffff
push ecx
mov esi, esp
mov dword [esp + 0x1c], esp
jne 0x43994c
lea edx, [esp + 0x3c]
push edx
push 0x48fb68
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.error_when_download_the_list_file.
call fcn.00401bd0
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.MAIN
mov byte [esp + 0x120], 0x22
call fcn.00401bd0
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x120], 0xa
call fcn.00416a90
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov bl, 0x23
push ecx
mov byte [esp + 0x11c], bl
call fcn.00403ce0
add esp, 0xc
push eax
push esi
mov byte [esp + 0x118], 0x24
call fcn.00403c20
mov edx, dword [esp + 0x120]
add esp, 0xc
push edx
call fcn.0040c320
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x104], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439846
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x104], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43986e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x34]
push ecx
push 0x48fb68
push ecx
mov ecx, esp
mov dword [esp + 0x5c], esp
push str.error_when_download_the_list_file.
call fcn.00401bd0
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.MAIN
mov byte [esp + 0x118], 0x25
call fcn.00401bd0
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x118], 0xa
call fcn.00416a90
add esp, 0xc
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x114], 0x26
call fcn.00403ce0
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov bl, 0x27
push ecx
mov byte [esp + 0x110], bl
call fcn.00403c20
mov eax, dword [eax]
push eax
mov byte [esp + 0x114], 0x28
call fcn.0040e570
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x104], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43991b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x104], 0x26
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439943
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
jmp 0x4399e9
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.error_when_download_the_list_file.
call fcn.00401bd0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.MAIN
mov byte [esp + 0x118], 0x29
call fcn.00401bd0
push esi
mov byte [esp + 0x118], 0xa
call fcn.00416a90
mov ecx, dword [esp + 0x120]
add esp, 0xc
push ecx
call fcn.0040c320
add esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.error_when_download_the_list_file.
call fcn.00401bd0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.MAIN
mov byte [esp + 0x110], 0x2a
call fcn.00401bd0
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x110], 0xa
call fcn.00416a90
mov eax, dword [eax]
push eax
mov byte [esp + 0x114], 0x2b
call fcn.0040e570
mov eax, dword [esp + 0x24]
add esp, 0x10
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x104], 0xa
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439a0d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x104], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439a35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x44]
mov byte [esp + 0x104], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439a5a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc0]
mov byte [esp + 0x104], 5
call fcn.00409510
lea ecx, [esp + 0xd4]
mov byte [esp + 0x104], 4
call fcn.00409510
mov eax, dword [esp + 0x4c]
jmp 0x43a067
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jl 0x4395a8
cmp dword [esp + 0x24], eax
jge 0x4395a8
mov edx, dword [esp + 0xc4]
lea eax, [ecx + edx]
push eax
lea ecx, [esp + 0x7c]
call fcn.004032f0
mov eax, dword [esp + 0x84]
cmp dword [eax - 0xc], 0
mov byte [esp + 0x104], bl
je 0x439dac
cmp byte [esp + 0x33], 0
je 0x439bd0
mov eax, dword [esp + 0x98]
cmp eax, 0x7f000000
je 0x439bd0
cmp eax, 0x7e000000
je 0x439bd0
test al, 2
jne 0x439bd0
lea ecx, [esp + 0xe8]
call fcn.0044e082
lea ecx, [esp + 0xe8]
push ecx
sub esp, 0x24
lea edx, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
mov byte [esp + 0x130], 0x2e
call fcn.004032f0
call fcn.00428910
mov ebp, eax
add esp, 0x28
xor esi, esi
test ebp, ebp
jle 0x439bbd
jmp 0x439b50
lea ecx, [esp + 0x9c]
call fcn.00453c6b
mov byte [esp + 0x104], 0x2f
test esi, esi
jl 0x4395a8
cmp esi, dword [esp + 0xf0]
jge 0x4395a8
mov eax, dword [esp + 0xec]
mov eax, dword [eax + esi*4]
push 0
push eax
lea ecx, [esp + 0xa4]
call fcn.00453d03
lea ecx, [esp + 0x9c]
mov edi, eax
call fcn.004538fc
lea ecx, [esp + 0x9c]
mov byte [esp + 0x104], 0x2e
call fcn.00453c94
test edi, edi
je 0x439be7
inc esi
cmp esi, ebp
jl 0x439b50
lea ecx, [esp + 0xe8]
mov byte [esp + 0x104], bl
call fcn.0044e25f
mov eax, dword [esp + 0xdc]
xor edi, edi
mov ebp, eax
test eax, eax
jle 0x439d60
xor esi, esi
jmp 0x439c37
cmp esi, ebp
jge 0x439bbd
sub esp, 0x24
lea edx, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.004032f0
mov ecx, 0x4b1468
call fcn.0040d070
lea ecx, [esp + 0xe8]
mov byte [esp + 0x104], bl
call fcn.0044e25f
jmp 0x439dac
mov eax, dword [esp + 0xdc]
test esi, esi
jl 0x4395a8
cmp edi, eax
jge 0x4395a8
mov eax, dword [esp + 0xd8]
add eax, esi
push eax
lea ecx, [esp + 0xa0]
call fcn.004032f0
mov ecx, dword [esp + 0x7c]
xor eax, eax
test ecx, ecx
setne al
mov byte [esp + 0x104], 0x30
test eax, eax
je 0x438cc1
mov eax, dword [esp + 0xa0]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439ca6
test dx, dx
je 0x439ca2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439ca6
add eax, 4
add ecx, 4
test dx, dx
jne 0x439c80
xor eax, eax
jmp 0x439cab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x439cd8
lea ecx, [esp + 0x9c]
mov byte [esp + 0x104], bl
call fcn.00402ec0
inc edi
add esi, 0x24
cmp edi, ebp
jl 0x439c30
jmp 0x439d60
mov ecx, dword [esp + 0xa8]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x438cc1
mov eax, dword [esp + 0x84]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439d1b
test dx, dx
je 0x439d17
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439d1b
add eax, 4
add ecx, 4
test dx, dx
jne 0x439cf5
xor eax, eax
jmp 0x439d20
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x439d49
sub esp, 0x24
lea edx, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.004032f0
mov ecx, 0x4b1468
call fcn.0040d070
lea ecx, [esp + 0x9c]
mov byte [esp + 0x104], bl
call fcn.00402ec0
cmp edi, ebp
jl 0x439dac
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0xa0]
call fcn.004032f0
mov esi, dword [0x4b1470]
sub esp, 0x24
lea edx, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x12c], 0x31
call fcn.004032f0
push esi
mov ecx, 0x4b1468
call fcn.0040afe0
lea ecx, [esp + 0x9c]
call fcn.00402ec0
lea ecx, [esp + 0x78]
mov byte [esp + 0x104], 0x2c
call fcn.00402ec0
mov eax, dword [esp + 0x24]
add dword [esp + 0x2c], 0x24
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
jl 0x439a90
xor ebp, ebp
mov ecx, 0x4b1468
call fcn.004150a0
mov eax, dword [0x4b12a8]
cmp eax, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebp
jle 0x439eca
mov eax, dword [0x4b1480]
cmp dword [eax - 0xc], 0
je 0x439eca
mov esi, dword [esp + 0x24]
test esi, esi
jl 0x4395a8
cmp esi, dword [0x4b12a8]
jge 0x4395a8
mov ecx, dword [0x4b12a4]
mov ebp, dword [ecx + esi*4]
push ebp
mov ecx, 0x4b12d0
call fcn.00403060
push ebp
mov ecx, 0x4b12b4
call fcn.00403060
mov edi, dword [eax]
push str.qupdater.needmsg
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
cmp eax, 0x7b6
jne 0x439ebb
push 0
push 0x4931ec
mov ecx, 0x4b1480
call fcn.004039f0
mov edx, dword [0x4b1480]
mov eax, dword [edx - 0xc]
push 0x40
push 0x3000
lea ebx, [eax + eax]
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov eax, dword [0x4b1480]
mov ecx, dword [eax - 0xc]
lea edx, [esp + 0x18]
push edx
add ecx, ecx
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push esi
push 0x7b9
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [esp + 0x24]
inc esi
cmp esi, dword [esp + 0x14]
mov dword [esp + 0x24], esi
jl 0x439df6
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov byte [esp + 0x104], 0xa
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439ef2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x104], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439f1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x44]
mov byte [esp + 0x104], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439f3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc0]
mov byte [esp + 0x104], 5
call fcn.00409510
lea ecx, [esp + 0xd4]
mov byte [esp + 0x104], 4
call fcn.00409510
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov byte [esp + 0x104], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439f8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov dword [esp + 0x104], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439fba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x43a0b4
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x1c], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.qupdater.ini____UPDATEINFO____ListURL_cant_empty
call fcn.00401bd0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.MAIN
mov byte [esp + 0x118], 1
call fcn.00401bd0
push esi
mov byte [esp + 0x118], 0
call fcn.00416a90
mov ecx, dword [esp + 0x120]
add esp, 0xc
push ecx
call fcn.0040c320
add esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.qupdater.ini____UPDATEINFO____ListURL_cant_empty
call fcn.00401bd0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.MAIN
mov byte [esp + 0x110], 2
call fcn.00401bd0
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x110], 0
call fcn.00416a90
mov eax, dword [eax]
push eax
mov byte [esp + 0x114], 3
call fcn.0040e570
mov eax, dword [esp + 0x24]
add esp, 0x10
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x104], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a08b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x104], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a0b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret