Function at 0x432ca1
Capabilities:
Check for time delay via gettickcount
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create reverse shell
Delete registry value
Parse pe header
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
sub esp, 0x10c
lea ebp, [esp - 4]
mov eax, dword [0x4fc5b0]
xor eax, ebp
mov dword [ebp + 0x10c], eax
push 0x33c
mov eax, 0x4bf72c
call fcn.00492516
mov esi, ecx
push str.install_thread:_entering
lea ecx, [ebp - 0x18]
call fcn.00470680
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
call fcn.004126e0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00470660
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [esi + 0x1f0]
mov ecx, edi
mov dword [esi + 0xb54], eax
mov dword [ebp - 0x90], edi
call fcn.00424c05
and dword [esi + 0xb6c], 0
xor ebx, ebx
inc ebx
push ebx
mov ecx, edi
call fcn.0041fb9a
and dword [ebp - 0x7c], 0
and dword [ebp - 0xac], 0
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x5c], ebx
call fcn.00471830
mov eax, dword [esi + 0x72c]
mov dword [ebp - 4], ebx
cmp eax, dword [esi + 0x730]
je 0x432e09
lea edi, [eax + 0x84]
cmp dword [edi - 0x78], 0
lea eax, [edi - 0x7c]
mov dword [ebp - 0x58], eax
je 0x432d81
mov ecx, edi
call fcn.004703e0
test eax, eax
je 0x432d81
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.0040d567
pop ecx
pop ecx
test al, al
jne 0x432d97
add edi, 0xd0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x730]
jne 0x432d56
jmp 0x432e09
cmp dword [esi + 0x5e0], 0
je 0x432df5
push str.install_thread:_closing_browsers
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
mov ecx, esi
call fcn.00426eb5
push str.install_thread:_back_from_closing_browsers
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
push dword [ebp - 0x58]
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xac], ebx
call fcn.004718e0
push str.install_thread:_here1
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
mov edi, dword [esi + 0x72c]
cmp edi, dword [esi + 0x730]
je 0x432eaa
add edi, 0x84
cmp dword [edi - 0x78], 0
je 0x432e96
mov ecx, edi
call fcn.004703e0
test eax, eax
je 0x432e96
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.0040d5af
pop ecx
pop ecx
test al, al
je 0x432e96
inc dword [ebp - 0x7c]
lea eax, [edi - 0x20]
push str.post
push eax
call fcn.0040d567
pop ecx
pop ecx
test al, al
lea eax, [edi - 0x7c]
lea ecx, [ebp - 0xc0]
push eax
je 0x432e91
call fcn.00471930
jmp 0x432e96
call fcn.004718e0
add edi, 0xd0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x730]
jne 0x432e44
mov edi, str.install_thread:_here2
push edi
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
cmp dword [ebp - 0xb0], 0
jle 0x435066
push edi
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 6
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
mov eax, dword [esi + 0x24]
test eax, eax
je 0x433461
lea ecx, [esi + 0x70]
cmp byte [ecx + 7], 0xff
lea edx, [esi + 8]
jne 0x432f1b
mov ecx, dword [ecx]
push ecx
push edx
call eax
pop ecx
pop ecx
test eax, eax
jne 0x433461
push str.install_thread:_here3
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 7
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
mov eax, dword [esi + 0xb30]
cmp eax, 1
jb 0x433456
push eax
push 0x2c
lea eax, [ebp - 0xa8]
push eax
lea ecx, [esi + 0x624]
call fcn.00471000
lea eax, [ebp - 0xa8]
push eax
lea ecx, [esi + 0x790]
mov byte [ebp - 4], 8
call fcn.0042c3a1
add eax, 4
push eax
lea eax, [ebp - 0x20]
push str.actioncancelvalue
push eax
call fcn.00470fb0
add esp, 0xc
mov edx, dword [esi]
push 1
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call dword [edx + 0x10]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.00470660
push str.actionpageviewvaluecancel
lea ecx, [ebp - 0x18]
call fcn.00470680
mov eax, dword [esi]
push 0xa
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xa
call dword [eax + 0x10]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00470660
push str.overinstall
lea ecx, [ebp - 0x18]
call fcn.00470680
cmp dword [esi + 0x58], 0
mov byte [ebp - 4], 0xb
jne 0x4333f7
lea ebx, [esi + 0x598]
mov ecx, ebx
call fcn.0040d4fd
test al, al
jne 0x4333f7
push ebx
lea ecx, [ebp - 0x28]
call fcn.004705c0
cmp byte [ebp - 0x21], 0xff
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x28]
jne 0x43302c
mov eax, dword [ebp - 0x28]
push 0x4d18e8
push eax
call fcn.00491770
pop ecx
test eax, eax
lea eax, [esi + 0x168]
pop ecx
push eax
lea eax, [ebp - 0x20]
jne 0x43305b
push str._distcode
push eax
call fcn.00470fb0
add esp, 0xc
mov byte [ebp - 4], 0xd
jmp 0x43306d
push 0x4d25c0
push eax
call fcn.00470fb0
add esp, 0xc
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x28]
call fcn.00470bc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.00470660
lea eax, [esi + 0x1a8]
push eax
lea eax, [ebp - 0x20]
push 0x4d25b8
push eax
call fcn.00470fb0
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call fcn.00470bc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.00470660
lea eax, [esi + 0x190]
push eax
lea eax, [ebp - 0x20]
push str.li
push eax
call fcn.00470fb0
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.00470bc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.00470660
lea ecx, [ebp - 0x78]
call fcn.004703d0
mov eax, dword [esi + 0xb30]
mov byte [ebp - 4], 0x11
cmp eax, 1
jb 0x433126
push eax
push 0x2c
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x624]
call fcn.00471000
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x12
call fcn.00470710
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.00470660
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x20]
push str.cancelled
push eax
call fcn.00470fb0
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x13
call fcn.00470bc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.00470660
lea ecx, [ebp - 0x38]
call fcn.004703d0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.004703d0
mov edi, dword [esi + 0x72c]
mov byte [ebp - 4], 0x15
cmp edi, dword [esi + 0x730]
je 0x433273
mov ebx, 0x4d1e7c
cmp dword [edi + 8], 0
je 0x4331ef
lea ecx, [ebp - 0x38]
call fcn.0040d4fd
test al, al
jne 0x4331bf
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00470f60
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x16
call fcn.00470710
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x15
call fcn.00470660
push edi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00470f10
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x17
call fcn.00470710
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x15
call fcn.00470660
cmp dword [edi + 0xc], 0
je 0x433261
lea ecx, [ebp - 0x40]
call fcn.0040d4fd
test al, al
jne 0x433231
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00470f60
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x18
call fcn.00470710
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x15
call fcn.00470660
push edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00470f10
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x19
call fcn.00470710
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x15
call fcn.00470660
add edi, 0xd0
cmp edi, dword [esi + 0x730]
jne 0x433183
lea ecx, [ebp - 0x38]
call fcn.0040d4fd
test al, al
je 0x43328c
push str.none
lea ecx, [ebp - 0x38]
call fcn.004707b0
lea ecx, [ebp - 0x40]
call fcn.0040d4fd
test al, al
je 0x4332a5
push str.none
lea ecx, [ebp - 0x40]
call fcn.004707b0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x98]
push str.displayedoffer
push eax
call fcn.00470fb0
push str.acceptedoffer
push eax
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00470f60
lea ecx, [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00470f10
add esp, 0x24
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
call fcn.00470bc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1b
call fcn.00470660
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x1a
call fcn.00470660
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x15
call fcn.00470660
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push str.action
push eax
call fcn.00470fb0
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
call fcn.00470bc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x15
call fcn.00470660
push 0x38
xor edi, edi
lea eax, [ebp - 0x334]
push edi
push eax
call fcn.00491e90
add esp, 0xc
cmp byte [ebp - 0x21], 0xff
mov dword [ebp - 0x338], 0x3c
mov dword [ebp - 0x334], 0x440
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x32c], str.open
lea eax, [ebp - 0x28]
jne 0x43338e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x338]
push eax
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x320], edi
mov dword [ebp - 0x31c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4333c7
push dword [ebp - 0x300]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.00470660
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x11
call fcn.00470660
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0xc
call fcn.00470660
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
call fcn.00470660
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00470660
cmp dword [esi + 0x4c], 0
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x433421
push 0x4d58f8
push str.SOFTWAREGoogleNo_Chrome_Offer_Until
push ebx
call edi
cmp dword [esi + 0x50], 0
je 0x433434
push 0x4d58f8
push str.SOFTWAREGoogleNo_Toolbar_Offer_Until
push ebx
call edi
cmp dword [esi + 0x54], 0
je 0x433447
push 0x4d58f8
push str.SOFTWAREGoogleNo_Drive_Offer_Until
push ebx
call edi
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00470660
and dword [ebp - 0x5c], 0
mov dword [esi + 0x14], 1
push str.install_thread:_here4
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x1e
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
cmp dword [ebp - 0x5c], 0
je 0x435066
push 0x4d5850
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x1f
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xb0]
jge 0x435066
mov eax, dword [esi + 0xb6c]
push dword [ebp - 0x80]
and dword [esi + 0xb78], 0
lea ecx, [ebp - 0xc0]
mov dword [esi + 0xb68], eax
call fcn.00471b10
push eax
lea ecx, [ebp - 0xc0]
call fcn.00471990
mov ebx, dword [eax]
mov edi, str.main
lea eax, [ebx + 0x4c]
push edi
push eax
mov dword [ebp - 0x4c], ebx
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x433526
mov eax, dword [ebp - 0xb0]
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffec
add eax, 0x64
jmp 0x433549
cmp dword [ebp - 0xac], 0
fild dword [ebp - 0x7c]
fld1
fdivrp st(1)
je 0x43353e
fmul qword [0x4d5840]
jmp 0x433544
fmul qword [0x4d1f18]
call fcn.004960f0
mov dword [esi + 0xb78], eax
cmp dword [ebx + 4], 0
je 0x434f3e
lea eax, [ebx + 0x4c]
push edi
push eax
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x43367d
push str.clean
lea ecx, [ebp - 0xd8]
call fcn.00470680
mov eax, dword [esi + 0x660]
mov byte [ebp - 4], 0x20
cmp eax, 1
jne 0x433593
push str.over
jmp 0x43359d
cmp eax, 0xffffffff
jne 0x4335a8
push str.under
lea ecx, [ebp - 0xd8]
call fcn.004707b0
lea edi, [ebx + 0x3c]
push edi
lea eax, [ebp - 0x348]
push str.actioninstallerstartedvalue
push eax
call fcn.00470fb0
push str.installtype
push eax
lea eax, [ebp - 0x2f4]
push eax
mov byte [ebp - 4], 0x21
call fcn.00470f60
lea ecx, [ebp - 0xd8]
push ecx
push eax
lea eax, [ebp - 0x2d8]
push eax
mov byte [ebp - 4], 0x22
call fcn.00470f10
push str.webuserid
push eax
lea eax, [ebp - 0x2c8]
push eax
mov byte [ebp - 4], 0x23
call fcn.00470f60
lea ecx, [esi + 0x170]
push ecx
push eax
lea eax, [ebp - 0x1e0]
push eax
mov byte [ebp - 4], 0x24
call fcn.00470f10
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x25
call dword [edx + 0x10]
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x24
call fcn.00470660
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0x23
call fcn.00470660
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0x22
call fcn.00470660
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 0x21
call fcn.00470660
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 0x20
call fcn.00470660
lea ecx, [ebp - 0xd8]
jmp 0x4336f5
lea edi, [ebx + 0x3c]
push edi
lea eax, [ebp - 0x270]
push str.actioninstallerstartedvalue
push eax
call fcn.00470fb0
push str.webuserid
push eax
lea eax, [ebp - 0x1c0]
push eax
mov byte [ebp - 4], 0x26
call fcn.00470f60
lea ecx, [esi + 0x170]
push ecx
push eax
lea eax, [ebp - 0x2c0]
push eax
mov byte [ebp - 4], 0x27
call fcn.00470f10
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x28
call dword [edx + 0x10]
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x27
call fcn.00470660
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x26
call fcn.00470660
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 1
call fcn.00470660
lea ecx, [ebp - 0x88]
call fcn.004703d0
lea eax, [ebx + 0x54]
push 0x4d02f4
push eax
mov byte [ebp - 4], 0x29
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x433b14
push str.install_thread:_pkg__rp
lea ecx, [ebp - 0x1a0]
call fcn.00470680
lea eax, [ebp - 0x1a0]
push eax
mov byte [ebp - 4], 0x2a
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 0x29
call fcn.00470660
push edi
lea ecx, [esi + 0x704]
call fcn.00417cd0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2ec]
push eax
mov ecx, esi
call fcn.00424c63
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x1d0]
push eax
mov byte [ebp - 4], 0x2b
call fcn.00470f60
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x2c
jne 0x433797
mov eax, dword [eax]
push 0x4d03c4
push eax
call fcn.00492fff
pop ecx
pop ecx
lea ecx, [ebp - 0x1d0]
mov ebx, eax
mov byte [ebp - 4], 0x2b
call fcn.00470660
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0x29
call fcn.00470660
test ebx, ebx
je 0x433921
push str.StubInstall1_r_n
push ebx
call fcn.004946ab
push str.AlwaysUseDefInstallPath1_r_n
push ebx
call fcn.004946ab
add esp, 0x10
lea ecx, [esi + 0x168]
call fcn.0040d4fd
test al, al
jne 0x43382c
push 1
lea ecx, [esi + 0x168]
call fcn.004710f0
push eax
push str.DistCode_s_r_n
push ebx
call fcn.004946ab
add esp, 0xc
push 1
lea ecx, [esi + 0x168]
call fcn.004710f0
push eax
push str.OrigCode_s_r_n
push ebx
call fcn.004946ab
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax]
jmp 0x43387a
mov ecx, edi
call fcn.0040d4fd
test al, al
jne 0x433861
push 0
lea ecx, [edi + 8]
call fcn.004710f0
push eax
push 0
mov ecx, edi
call fcn.004710f0
push eax
push str._s_s_r_n
push ebx
call fcn.004946ab
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [edi + 8]
call fcn.00471180
push 0xffffffffffffffff
mov ecx, edi
call fcn.00471180
mov eax, dword [ebp - 0x2c]
add edi, 0x10
cmp edi, dword [eax + 4]
jne 0x433833
push ebx
call fcn.00492b68
pop ecx
lea eax, [ebp - 0x2d0]
push eax
mov ecx, esi
call fcn.00424c63
mov edi, eax
push str.__cfg
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x2d
call fcn.00470680
push edi
push eax
lea eax, [ebp - 0x280]
push eax
mov byte [ebp - 4], 0x2e
call fcn.00470f10
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x1a8]
push eax
mov byte [ebp - 4], 0x2f
call fcn.00470f60
add esp, 0x18
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x30
call fcn.00470710
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x2f
call fcn.00470660
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x2e
call fcn.00470660
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x2d
call fcn.00470660
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x29
call fcn.00470660
mov eax, dword [ebp - 0x4c]
add eax, 0x7c
push str..manifest
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00470f60
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x31
jne 0x433948
mov eax, dword [eax]
push 0x4d03c4
push eax
call fcn.00492fff
pop ecx
pop ecx
lea ecx, [ebp - 0x200]
mov edi, eax
mov byte [ebp - 4], 0x29
call fcn.00470660
test edi, edi
je 0x433ae1
push str.__xml_version_1.0__encoding_UTF_8__standalone_yes____r_n
push edi
call fcn.004946ab
push str._assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0___r_n
push edi
call fcn.004946ab
push str._t_assemblyIdentity_r_n
push edi
call fcn.004946ab
push str._t____version_1.0.0.0__r_n
push edi
call fcn.004946ab
push str._t____processorArchitecture_X86__r_n
push edi
call fcn.004946ab
push str._t____name_rnmininst.exe__r_n
push edi
call fcn.004946ab
push str._t____type_win32__r_n
push edi
call fcn.004946ab
push str._t___r_n
push edi
call fcn.004946ab
add esp, 0x40
push str._t_description_RealPlayer_Installer__description__r_n
push edi
call fcn.004946ab
push str._t_dependency__r_n
push edi
call fcn.004946ab
push str._t_____dependentAssembly__r_n
push edi
call fcn.004946ab
push str._t_________assemblyIdentity_r_n
push edi
call fcn.004946ab
push str._t____________type_win32__r_n
push edi
call fcn.004946ab
push str._t____________name_Microsoft.Windows.Common_Controls__r_n
push edi
call fcn.004946ab
push str._t____________version_6.0.0.0__r_n
push edi
call fcn.004946ab
push str._t____________processorArchitecture_X86__r_n
push edi
call fcn.004946ab
add esp, 0x40
push str._t____________publicKeyToken_6595b64144ccf1df__r_n
push edi
call fcn.004946ab
push str._t____________language___r_n
push edi
call fcn.004946ab
push str._t___________r_n
push edi
call fcn.004946ab
push str._t______dependentAssembly__r_n
push edi
call fcn.004946ab
push str._t__dependency__r_n
push edi
call fcn.004946ab
push str._t_trustInfo_xmlns_urn:schemas_microsoft_com:asm.v3___r_n
push edi
call fcn.004946ab
push str._t_t_security__r_n
push edi
call fcn.004946ab
push str._t_t_t_requestedPrivileges__r_n
push edi
call fcn.004946ab
add esp, 0x40
push str._t_t_t_t_requestedExecutionLevel_r_n
push edi
call fcn.004946ab
push str._t_t_t_t_tlevel_requireAdministrator__r_n
push edi
call fcn.004946ab
push str._t_t_t_t_tuiAccess_false__r_n
push edi
call fcn.004946ab
push str._t_t_t_t___r_n
push edi
call fcn.004946ab
push str._t_t_t__requestedPrivileges__r_n
push edi
call fcn.004946ab
push str._t_t__security__r_n
push edi
call fcn.004946ab
push str._t__trustInfo__r_n
push edi
call fcn.004946ab
push str.__assembly__r_n
push edi
call fcn.004946ab
add esp, 0x40
push edi
call fcn.00492b68
pop ecx
push str.install_thread:_end_of_RP_package_setup
lea ecx, [ebp - 0x130]
call fcn.00470680
lea eax, [ebp - 0x130]
push eax
mov byte [ebp - 4], 0x32
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x29
call fcn.00470660
mov ebx, dword [ebp - 0x4c]
lea eax, [ebx + 0x3c]
push 0x4d539c
push eax
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x433c5f
lea ecx, [ebp - 0x28]
call fcn.004703d0
lea eax, [ebp - 0x28]
push eax
xor edi, edi
push edi
push edi
push 0x1c
push edi
mov byte [ebp - 4], 0x33
call fcn.0040e1c2
add esp, 0x14
lea ecx, [ebp - 0x28]
test eax, eax
je 0x434f50
push str.The_Weather_ChannelDesktop_
call fcn.00470ae0
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x433b6c
mov eax, dword [ebp - 0x28]
push edi
push eax
call fcn.0040e4bb
pop ecx
pop ecx
push str.apps.ini
lea ecx, [ebp - 0x28]
call fcn.00470ae0
lea eax, [ebp - 0xec]
push eax
call fcn.00491a23
lea eax, [ebp - 0xec]
push eax
call fcn.004919fc
push 0xff
mov edi, eax
lea eax, [ebp + 0xd]
push 0
push eax
mov byte [ebp + 0xc], 0
call fcn.00491e90
push edi
call fcn.004942b1
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00492970
lea eax, [ebp + 0xc]
push eax
xor edi, edi
call fcn.00492a70
add esp, 0x24
test eax, eax
je 0x433bf5
lea eax, [ebp + edi + 0xc]
cmp byte [eax], 0xd
jne 0x433bde
mov byte [eax], 0
cmp byte [eax], 0xa
jne 0x433be6
mov byte [eax], 0
lea eax, [ebp + 0xc]
push eax
inc edi
call fcn.00492a70
pop ecx
cmp edi, eax
jb 0x433bd2
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x433c01
mov eax, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x4d536c
push str.SoftwareThe_Weather_ChannelAppsAppData
call edi
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x433c24
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x4d533c
push str.SoftwareThe_Weather_ChannelAppsAppData
call edi
cmp byte [ebp - 0x21], 0xff
lea eax, [ebp - 0x28]
jne 0x433c41
mov eax, dword [ebp - 0x28]
push eax
push 0x4d5338
push str.initialLaunch
push str.SoftwareThe_Weather_ChannelAppsAppDataSetup
call edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x29
call fcn.00470660
push str.install_thread:_here6
lea ecx, [ebp - 0x140]
call fcn.00470680
lea eax, [ebp - 0x140]
push eax
mov byte [ebp - 4], 0x34
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0x29
call fcn.00470660
lea ecx, [ebx + 0x7c]
call fcn.004703e0
test eax, eax
je 0x434f1d
push str.install_thread:_here7
lea ecx, [ebp - 0x150]
call fcn.00470680
lea eax, [ebp - 0x150]
push eax
mov byte [ebp - 4], 0x35
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x29
call fcn.00470660
mov dword [esi + 0xb84], 1
mov dword [esi + 0xb88], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb7c], eax
mov edi, 0x4cfe44
push edi
lea eax, [ebx + 0x84]
push eax
lea eax, [ebp - 0x340]
push eax
call fcn.00470f60
lea ecx, [ebx + 0x8c]
push ecx
push eax
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 0x36
call fcn.00470f10
push edi
push eax
lea eax, [ebp - 0x290]
push eax
mov byte [ebp - 4], 0x37
call fcn.00470f60
lea ecx, [ebp - 0x88]
push ecx
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 0x38
call fcn.00470f10
add esp, 0x30
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x3a
call fcn.00470660
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x3b
call fcn.00470660
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x3c
call fcn.00470660
lea eax, [ebx + 0x3c]
cmp byte [eax + 7], 0xff
jne 0x433d82
mov eax, dword [eax]
push str.chrhlpr
push eax
call fcn.00491770
pop ecx
pop ecx
test eax, eax
je 0x433e2e
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xb0]
jge 0x433e2e
push eax
lea ecx, [ebp - 0xc0]
call fcn.00471b10
push eax
lea ecx, [ebp - 0xc0]
call fcn.00471990
mov edi, dword [eax]
lea ecx, [ebx + 0x3c]
lea eax, [edi + 0x3c]
push ecx
push eax
mov dword [ebp - 0x58], eax
call fcn.0040d585
pop ecx
pop ecx
test al, al
je 0x433e21
push str.main
add edi, 0x4c
push edi
call fcn.0040d5af
pop ecx
pop ecx
test al, al
je 0x433e21
push dword [ebp - 0x58]
lea eax, [ebp - 0x220]
push str.__pkg
push eax
call fcn.00470fb0
add esp, 0xc
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x3d
call fcn.00470bc0
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x3c
call fcn.00470660
inc dword [ebp - 0x2c]
mov edi, 0x4cfe44
jmp 0x433d9b
xor eax, eax
push eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.004113a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x3e
call fcn.00470710
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0x3c
call fcn.00470660
push edi
lea edi, [ebx + 0x7c]
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00470f60
lea ecx, [ebp - 0x68]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x3f
call fcn.00470f10
add esp, 0x18
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x41
call fcn.00470660
cmp dword [esi + 0xbb8], 0
je 0x433fb5
push str.install_thread:_here7
lea ecx, [ebp - 0x160]
call fcn.00470680
lea eax, [ebp - 0x160]
push eax
mov byte [ebp - 4], 0x42
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x41
call fcn.00470660
xor edi, edi
push edi
push edi
mov eax, 0x104
push eax
push eax
push 0xff
push 6
push 3
push str..pipe_realnetworks.installer.pipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
je 0x434f9c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x433f29
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x434fc1
lea eax, [ebx + 0xbc]
push 0x4e3e40
push eax
mov dword [ebp - 0xf0], edi
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x433f7a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x2e0]
push 0x4cfa1c
push eax
call fcn.00470fb0
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x45
call fcn.00470710
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x41
call fcn.00470660
cmp byte [ebp - 0x39], 0xff
lea eax, [ebp - 0x40]
jne 0x433f86
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x40]
call fcn.004703e0
inc eax
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x30], 1
xor edi, edi
jmp 0x4345ca
push str.install_thread:_here8
lea ecx, [ebp - 0x170]
call fcn.00470680
lea eax, [ebp - 0x170]
push eax
mov byte [ebp - 4], 0x46
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x41
call fcn.00470660
push 3
lea eax, [ebp - 0x240]
push eax
mov ecx, edi
call fcn.00470df0
push 0x4d529c
push eax
mov byte [ebp - 4], 0x47
call fcn.0040d567
pop ecx
pop ecx
lea ecx, [ebp - 0x240]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0x41
call fcn.00470660
cmp byte [ebp - 0xd], 0
je 0x434538
push str.install_thread:_msi_install
lea ecx, [ebp - 0x180]
call fcn.00470680
lea eax, [ebp - 0x180]
push eax
mov byte [ebp - 4], 0x48
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x41
call fcn.00470660
xor edi, edi
push edi
push 2
call sub.msi.dll_MsiSetPropertyW
push esi
push 0x20034a3
push 0x4292e4
mov dword [esi + 0xb70], edi
call sub.msi.dll_MsiSetInstallLevel
lea ecx, [ebp - 0x54]
mov dword [0x4fe718], eax
call fcn.004703d0
mov dword [ebp - 0x2c], edi
push 0x4d527c
lea edi, [ebx + 0x3c]
push edi
mov byte [ebp - 4], 0x49
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x434398
lea eax, [esi + 0x168]
push eax
lea ecx, [ebp - 0xe0]
call fcn.004705c0
lea eax, [esi + 0x88]
push eax
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x4a
call fcn.004705c0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x4b
call fcn.0040d4fd
test al, al
je 0x4340e9
push 0x4d5278
lea ecx, [ebp - 0xe0]
call fcn.004707b0
lea ecx, [ebp - 0xf8]
call fcn.0040d4fd
test al, al
je 0x434108
push 0x4d5278
lea ecx, [ebp - 0xf8]
call fcn.004707b0
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2fc]
push str._DISTCODE
push eax
call fcn.00470fb0
push str._ORIGINCODE
push eax
lea eax, [ebp - 0x250]
push eax
mov byte [ebp - 4], 0x4c
call fcn.00470f60
lea ecx, [esi + 0x80]
push ecx
push eax
lea eax, [ebp - 0x2b0]
push eax
mov byte [ebp - 4], 0x4d
call fcn.00470f10
add esp, 0x24
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x4e
call fcn.00470710
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x4d
call fcn.00470660
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x4c
call fcn.00470660
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x4b
call fcn.00470660
push str.DefInstallPath
lea ecx, [ebp - 0x120]
call fcn.00470680
push 0x4d527c
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x4f
call fcn.00470680
lea eax, [ebp - 0x190]
push eax
lea ecx, [esi + 0x704]
mov byte [ebp - 4], 0x50
call fcn.00417cd0
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00415670
test eax, eax
lea ecx, [ebp - 0x190]
setne byte [ebp - 0xd]
mov byte [ebp - 4], 0x4f
call fcn.00470660
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x4b
call fcn.00470660
cmp byte [ebp - 0xd], 0
je 0x4342de
push str.DefInstallPath
lea ecx, [ebp - 0x138]
call fcn.00470680
push 0x4d527c
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x51
call fcn.00470680
lea eax, [ebp - 0x168]
push eax
lea ecx, [esi + 0x704]
mov byte [ebp - 4], 0x52
call fcn.00417cd0
lea ecx, [ebp - 0x138]
push ecx
mov ecx, eax
call fcn.00416af0
push eax
lea ecx, [ebp - 0x188]
call fcn.004705c0
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x54
call fcn.00470660
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x55
call fcn.00470660
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x1b0]
push str._INSTALLDIR_
push eax
call fcn.00470fb0
push 0x4e42c4
push eax
lea eax, [ebp - 0x260]
push eax
mov byte [ebp - 4], 0x56
call fcn.00470f60
add esp, 0x18
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x57
call fcn.00470bc0
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x56
call fcn.00470660
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x55
call fcn.00470660
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 0x4b
call fcn.00470660
push str._system_appdata_RealNetworks
lea ecx, [ebp - 0x148]
call fcn.00470680
push 0
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x1b8]
push eax
mov byte [ebp - 4], 0x58
call fcn.004113a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x59
call fcn.00470710
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 0x58
call fcn.00470660
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x434332
mov eax, dword [ebp - 0x54]
push eax
call fcn.004b9bfb
lea ecx, [ebp - 0x54]
mov dword [esp], str.RealDownloader
call fcn.00470ae0
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x434353
mov eax, dword [ebp - 0x54]
push eax
call fcn.004b9bfb
lea ecx, [ebp - 0x54]
mov dword [esp], str.RealDownloader_log.txt
call fcn.00470ae0
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x2c], 0xe97
mov byte [ebp - 4], 0x4b
call fcn.00470660
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x4a
call fcn.00470660
lea ecx, [ebp - 0xe0]
jmp 0x434444
push str._system_appdata_RealNetworks
lea ecx, [ebp - 0x178]
call fcn.00470680
push 0
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x1c8]
push eax
mov byte [ebp - 4], 0x5a
call fcn.004113a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x5b
call fcn.00470710
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x5a
call fcn.00470660
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x4343ec
mov eax, dword [ebp - 0x54]
push eax
call fcn.004b9bfb
pop ecx
lea ecx, [ebp - 0x100]
call fcn.004703d0
push 1
mov ecx, edi
mov byte [ebp - 4], 0x5c
call fcn.004710f0
push eax
lea eax, [ebp - 0x100]
push str.DLP__s_log.txt
push eax
call fcn.00471330
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x54]
call fcn.00470bc0
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x5a
call fcn.00470660
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x49
call fcn.00470660
cmp byte [ebp - 0x4d], 0xff
lea eax, [ebp - 0x54]
jne 0x434459
mov eax, dword [ebp - 0x54]
push 2
push eax
push dword [ebp - 0x2c]
call sub.msi.dll_MsiGetComponentPathA
lea edi, [ebx + 0x7c]
push edi
lea eax, [ebp - 0x1e8]
push str.msiexec__i
push eax
call fcn.00470fb0
lea ecx, [ebp - 0x68]
push ecx
push eax
lea eax, [ebp - 0x1d8]
push eax
mov byte [ebp - 4], 0x5d
call fcn.00470f10
add esp, 0x18
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x5e
call fcn.00470710
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x5d
call fcn.00470660
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x49
call fcn.00470660
cmp byte [ebp - 0x61], 0xff
lea eax, [ebp - 0x68]
jne 0x4344c8
mov eax, dword [ebp - 0x68]
cmp byte [edi + 7], 0xff
jne 0x4344d0
mov edi, dword [edi]
push eax
push edi
call sub.msi.dll_MsiOpenDatabaseA
test eax, eax
jne 0x4344e8
inc eax
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
jmp 0x4344f7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x70], eax
push str.install_thread:_end_msi_install
lea ecx, [ebp - 0x158]
call fcn.00470680
lea eax, [ebp - 0x158]
push eax
mov byte [ebp - 4], 0x5f
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x49
call fcn.00470660
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x41
call fcn.00470660
jmp 0x433fae
push str.install_thread:_other_install__exe_
lea ecx, [ebp - 0x198]
call fcn.00470680
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 0x60
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x41
call fcn.00470660
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x40]
push 1
push eax
call fcn.0040de8d
add esp, 0xc
xor edi, edi
test eax, eax
je 0x434589
mov dword [ebp - 0x30], 1
jmp 0x434595
mov dword [ebp - 0x30], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
push str.install_thread:_end_other_install__exe_
lea ecx, [ebp - 0x128]
call fcn.00470680
lea eax, [ebp - 0x128]
push eax
mov byte [ebp - 4], 0x61
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x41
call fcn.00470660
cmp dword [ebp - 0x30], edi
je 0x434607
lea eax, [ebx + 0x4c]
push str.main
push eax
call fcn.0040d5af
pop ecx
pop ecx
test al, al
je 0x434607
push ecx
push ecx
lea eax, [ebx + 0x3c]
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
call fcn.004705c0
lea eax, [ebp - 0x1f8]
push eax
mov ecx, esi
call fcn.00429333
lea ecx, [ebp - 0x1f8]
call fcn.00470660
lea eax, [ebx + 0xbc]
push 0x4e3e40
push eax
call fcn.0040d5af
pop ecx
pop ecx
test al, al
je 0x4347b0
push str.install_thread:_wait_for_install_to_complete
lea ecx, [ebp - 0xc8]
call fcn.00470680
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 0x62
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x41
call fcn.00470660
cmp dword [ebp - 0x30], edi
je 0x4347a1
push 3
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebx + 0x7c]
call fcn.00470df0
push 0x4d529c
push eax
mov byte [ebp - 4], 0x63
call fcn.0040d567
pop ecx
pop ecx
lea ecx, [ebp - 0x208]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0x41
call fcn.00470660
cmp byte [ebp - 0xd], 0
je 0x4346a2
cmp dword [esi + 0xb70], edi
je 0x43465b
jmp 0x4347a1
cmp dword [ebp - 0x6c], edi
je 0x4346e1
push 0x3e8
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x434742
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6c], edi
jmp 0x4347a1
cmp dword [ebp - 0x60], edi
je 0x4347a1
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x58]
push eax
push edi
push dword [ebp - 0x60]
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
cmp dword [ebp - 0x58], edi
je 0x43475e
push edi
push edi
lea eax, [ebp - 0x8c]
push eax
push 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x8c], edi
mov dword [ebp], edi
mov dword [ebp + 4], edi
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x434737
cmp dword [ebp - 0x8c], edi
ja 0x434763
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebx + 0x54]
call fcn.0040d4fd
xor ecx, ecx
test al, al
setne cl
push ecx
mov ecx, esi
call fcn.004256d6
jmp 0x43465b
mov dword [ebp - 0x5c], edi
jmp 0x4347a1
push edi
lea eax, [ebp - 0x8c]
push eax
push 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp + 4], edi
mov dword [ebp - 0x30], 1
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0xb7c]
mov dword [ebx + 0x30], eax
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 0x48]
push str.actioninstalledpkgvalue
push eax
call fcn.00470fb0
add esp, 0xc
mov byte [ebp - 4], 0x64
cmp dword [ebp - 0x30], edi
je 0x434e35
push str.install_thread:_executed
lea ecx, [ebp - 0x98]
call fcn.00470680
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 0x65
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x64
call fcn.00470660
lea ecx, [ebx + 0x34]
call fcn.0040d4fd
test al, al
je 0x434813
lea ecx, [ebp - 0x48]
jmp 0x434833
lea eax, [ebp - 0x2e4]
push eax
push edi
push 1
lea eax, [ebx + 0x34]
push eax
lea ecx, [esi + 0x260]
call fcn.0044df7c
lea ecx, [ebp - 0x48]
test eax, eax
js 0x434846
push str.successtrue
call fcn.00470ae0
mov dword [ebx + 0x10], 1
jmp 0x434850
push str.successfalse
call fcn.00470ae0
push str.exec_valuelaunch_success
lea ecx, [ebp - 0x48]
call fcn.00470ae0
cmp dword [ebp - 0x2c], edi
je 0x43497e
lea ecx, [ebp - 0xe8]
call fcn.004703d0
push dword [ebp - 0x70]
lea eax, [ebp - 0xe8]
push str.return_value_d
push eax
mov byte [ebp - 4], 0x66
call fcn.00471330
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00470bc0
cmp dword [ebp - 0x70], edi
je 0x43496d
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0xd0]
call fcn.004705c0
push str.pkg_downloaded
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x67
call fcn.00470ae0
lea edi, [esi + 0xb44]
mov ecx, edi
call fcn.0040d4fd
test al, al
je 0x4348e2
mov edi, str.none
jmp 0x4348ea
cmp byte [edi + 7], 0xff
jne 0x4348ea
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0xd0]
call fcn.00470ae0
push 3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x7c]
xor edi, edi
call fcn.00470df0
push 0x4d529c
push eax
mov byte [ebp - 4], 0x68
call fcn.0040d567
pop ecx
pop ecx
lea ecx, [ebp - 0x218]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0x67
call fcn.00470660
cmp byte [ebp - 0xd], 0
je 0x434933
inc edi
push edi
lea eax, [ebp - 0xd0]
push eax
push dword [ebx + 0xc4]
lea eax, [ebx + 0x3c]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
call fcn.004705c0
lea ecx, [esi + 0x260]
call fcn.0044b36c
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x66
call fcn.00470660
xor edi, edi
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x64
call fcn.00470660
jmp 0x43498b
push str.return_valueunknown
lea ecx, [ebp - 0x48]
call fcn.00470ae0
lea ecx, [ebp - 0x18]
call fcn.004703d0
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov byte [ebp - 4], 0x69
push eax
lea eax, [ebp - 0x18]
push str.dltime_d
push eax
call fcn.00471330
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x48]
call fcn.00470bc0
lea ecx, [ebp - 0xa8]
call fcn.004703d0
mov eax, dword [ebx + 0x30]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0xa8]
push str.installtime_d
push eax
call fcn.00471330
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00470bc0
lea eax, [ebx + 0xac]
push str.player
push eax
call fcn.0040d5af
pop ecx
pop ecx
test al, al
je 0x434a50
lea eax, [ebx + 0xb4]
push str.minimized
push eax
call fcn.0040d567
pop ecx
pop ecx
test al, al
jne 0x434a48
lea eax, [ebx + 0xb4]
push str.restore
push eax
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x434a50
push ebx
mov ecx, esi
call fcn.0042741a
mov ecx, esi
call fcn.00428810
cmp dword [ebx + 0x10], edi
je 0x434e13
lea ecx, [ebx + 0x54]
call fcn.0040d4fd
test al, al
jne 0x434e13
lea edi, [esi + 0x5a0]
mov ecx, edi
call fcn.0040d4fd
test al, al
jne 0x434e13
mov ecx, esi
call fcn.00425a0f
test eax, eax
je 0x434e13
push edi
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
call fcn.0042512f
lea eax, [esi + 0x5a8]
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6b
call fcn.0042512f
lea eax, [esi + 0x5b8]
push 0x4d5084
push eax
mov byte [ebp - 4], 0x6c
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x434c13
lea ecx, [ebp - 0x38]
call fcn.0040d4fd
test al, al
je 0x434b18
push 0x4cfa1a
lea ecx, [ebp - 0xa0]
call fcn.00470680
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6d
call fcn.00425a90
lea ecx, [ebp - 0xa0]
jmp 0x434def
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x228]
push str.Cookie:
push eax
call fcn.00470fb0
add esp, 0xc
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6e
call fcn.00425a90
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x6c
call fcn.00470660
push 1
push 0x4d1764
push 0x4cfe7c
lea ecx, [ebp - 0x38]
call fcn.004715f0
push 1
push 0x4d1e7c
push 0x4e4578
lea ecx, [ebp - 0x38]
call fcn.004715f0
push edi
lea eax, [ebp - 0x268]
push eax
mov ecx, esi
call fcn.0042512f
push eax
lea eax, [ebp - 0x258]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x6f
call fcn.00470fb0
push 0x4d5054
push eax
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 0x70
call fcn.00470f60
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x238]
push eax
mov byte [ebp - 4], 0x71
call fcn.00470f10
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x72
call dword [edx + 0x10]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x71
call fcn.00470660
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x70
call fcn.00470660
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x6f
call fcn.00470660
lea ecx, [ebp - 0x268]
jmp 0x434def
lea eax, [esi + 0x5b8]
push str.post
push eax
call fcn.0040d567
pop ecx
pop ecx
test al, al
je 0x434df8
lea eax, [esi + 0x5c0]
push eax
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.0042512f
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x73
call fcn.00422b38
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x74
call fcn.0040d4fd
test al, al
je 0x434c6c
push str.none
lea ecx, [ebp - 0x38]
call fcn.004707b0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x278]
push str.Cookie:
push eax
call fcn.00470fb0
add esp, 0xc
lea ecx, [esi + 0x5d0]
push ecx
lea ecx, [esi + 0x5c8]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
push edi
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x75
call fcn.00422ba5
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x74
call fcn.00470660
lea ecx, [ebp - 0x78]
call fcn.0040d4fd
test al, al
je 0x434ccf
push str.none
lea ecx, [ebp - 0x78]
call fcn.004707b0
push 1
push 0x4d1764
push 0x4cfe7c
lea ecx, [ebp - 0x38]
call fcn.004715f0
push 1
push 0x4d1e7c
push 0x4e4578
lea ecx, [ebp - 0x38]
call fcn.004715f0
push edi
lea eax, [ebp - 0x118]
push eax
mov ecx, esi
call fcn.0042512f
push eax
lea eax, [ebp - 0x108]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x76
call fcn.00470fb0
push 0x4d5054
push eax
lea eax, [ebp - 0x2b8]
push eax
mov byte [ebp - 4], 0x77
call fcn.00470f60
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x2a8]
push eax
mov byte [ebp - 4], 0x78
call fcn.00470f10
push 0x4d5048
push eax
lea eax, [ebp - 0x298]
push eax
mov byte [ebp - 4], 0x79
call fcn.00470f60
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x288]
push eax
mov byte [ebp - 4], 0x7a
call fcn.00470f10
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x7b
call dword [edx + 0x10]
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x7a
call fcn.00470660
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x79
call fcn.00470660
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x78
call fcn.00470660
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x77
call fcn.00470660
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x76
call fcn.00470660
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x74
call fcn.00470660
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x73
call fcn.00422e51
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x6c
call fcn.00470660
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x6b
call fcn.00470660
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x6a
call fcn.00470660
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x69
call fcn.00470660
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x64
call fcn.00470660
xor edi, edi
jmp 0x434ee4
push str.install_thread:_not_executed
lea ecx, [ebp - 0x20]
call fcn.00470680
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x7c
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x64
call fcn.00470660
push str.successfalse
lea ecx, [ebp - 0x48]
call fcn.00470ae0
mov eax, dword [ebp - 0x4c]
cmp eax, 0x20
ja 0x434ea9
cmp eax, 0x20
je 0x434ea2
dec eax
dec eax
je 0x434e9b
dec eax
je 0x434e94
dec eax
dec eax
je 0x434e8d
sub eax, 3
jne 0x434ebb
push str.exec_valuenot_enough_memory
jmp 0x434edc
push str.exec_valueaccess_denied
jmp 0x434edc
push str.exec_valuepath_not_found
jmp 0x434edc
push str.exec_valuefile_not_found
jmp 0x434edc
push str.exec_valuesharing_violation
jmp 0x434edc
sub eax, 0x483
je 0x434ed7
dec eax
je 0x434ed0
dec eax
je 0x434ec9
sub eax, 0x42
je 0x434ec2
push str.exec_valueunknown_error
jmp 0x434edc
push str.exec_valueuser_canceled
jmp 0x434edc
push str.exec_valuedll_not_found
jmp 0x434edc
push str.exec_valuedde_fail
jmp 0x434edc
push str.exec_valueno_association_found
lea ecx, [ebp - 0x48]
call fcn.00470ae0
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x48]
push ecx
mov ecx, esi
call dword [eax + 0x10]
cmp dword [ebp - 0x30], edi
je 0x434fd7
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x41
call fcn.00470660
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3c
call fcn.00470660
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x29
call fcn.00470660
mov eax, dword [esi + 0xb78]
add eax, dword [esi + 0xb68]
lea ecx, [ebp - 0x88]
mov dword [esi + 0xb6c], eax
mov byte [ebp - 4], 1
call fcn.00470660
inc dword [ebp - 0x80]
cmp dword [ebp - 0x5c], 0
jne 0x4334bd
jmp 0x435066
mov byte [ebp - 4], 0x29
call fcn.00470660
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00470660
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00471c90
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10c]
xor ecx, ebp
call fcn.00492093
add ebp, 0x110
leave
ret
push str.actionerrorvaluepipe_creation
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x5c], edi
call fcn.00470680
mov byte [ebp - 4], 0x43
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [ebp - 0x20]
jmp 0x435036
push str.actionerrorvaluepipe_connection
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x5c], edi
call fcn.00470680
mov byte [ebp - 4], 0x44
jmp 0x434fb0
add ebx, 0x3c
push ebx
lea eax, [ebp - 0x108]
push str.actionerrorvalue
push eax
call fcn.00470fb0
push str._exec
push eax
lea eax, [ebp - 0x118]
push eax
mov byte [ebp - 4], 0x7d
call fcn.00470f60
add esp, 0x18
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
mov byte [ebp - 4], 0x7e
call dword [edx + 0x10]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x7d
call fcn.00470660
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x64
call fcn.00470660
mov dword [ebp - 0x5c], edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x41
call fcn.00470660
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3c
call fcn.00470660
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x29
call fcn.00470660
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00470660
push str.install_thread:_near_end
lea ecx, [ebp - 0x20]
call fcn.00470680
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x7f
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00470660
xor edi, edi
cmp dword [ebp - 0x5c], edi
je 0x4350f2
push str.setting_m_bInstalled__TRUE
lea ecx, [ebp - 0x20]
call fcn.00470680
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x80
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00470660
mov dword [esi + 0x44], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x90]
push edi
mov dword [esi + 0xb58], eax
call fcn.0041fb9a
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00471c90
mov eax, esi
jmp 0x434f79
mov ecx, dword [ebp - 0x90]
push edi
call fcn.0041fb9a
mov ecx, dword [ebp - 0x90]
call fcn.0041fbb7
or esi, 0xffffffff
jmp 0x4350dc