Function at 0x40d190
Capabilities:
Check for time delay via gettickcount
Print debug messages
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x45d1e6
mov eax, dword fs:[0]
push eax
sub esp, 0x87c
mov eax, dword [0x4713c0]
xor eax, esp
mov dword [esp + 0x878], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4713c0]
xor eax, esp
push eax
lea eax, [esp + 0x890]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
push ebx
push 0x463328
lea eax, [esp + 0x94]
push 0x200
push eax
mov dword [esp + 0x44], ebx
call fcn.004414db
xor ebp, ebp
add esp, 0x10
lea ecx, [esp + 0x38]
mov word [esp + 0x48a], bp
call fcn.0042bd40
mov dword [esp + 0x898], ebp
mov edi, 7
lea eax, [esp + 0x8c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
jmp 0x40d230
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d230
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x90]
push ecx
lea esi, [esp + 0x1c]
call fcn.00406f80
mov edx, esi
push ebp
push edx
or eax, 0xffffffff
lea esi, [esp + 0x40]
mov byte [esp + 0x8a0], 1
call fcn.00406df0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x40d281
mov eax, dword [esp + 0x18]
push eax
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x50], esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jae 0x40d29c
lea edx, [esp + 0x3c]
mov edi, dword [0x474bb0]
cmp edi, ebp
je 0x40d2db
mov eax, edx
lea esi, [eax + 2]
jmp 0x40d2b0
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d2b0
sub eax, esi
sar eax, 1
push edi
lea ecx, [eax + eax]
push ecx
push 1
push edx
call fcn.004422ed
mov edx, dword [0x474bb0]
push edx
call fcn.004428a9
add esp, 0x14
mov dword [esp + 0x898], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x40d2fa
mov eax, dword [esp + 0x3c]
push eax
call fcn.004415cb
add esp, 4
fld dword [0x468790]
push 1
push ecx
fstp dword [esp]
call fcn.0040ceb0
push ebx
call fcn.0040bda0
add esp, 0xc
push ebx
call fcn.0040c6c0
add esp, 4
push 0xffffffffffffffff
mov edi, 7
push ebp
mov eax, 0x475158
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebp
mov word [esp + 0x7c], bp
call fcn.00406d10
mov dword [esp + 0x898], 2
cmp dword [0x474f6c], ebp
je 0x40d36a
push 0xffffffffffffffff
push ebp
mov eax, 0x474f74
lea ecx, [esp + 0x78]
call fcn.00406d10
push 0xd
push str.QTService.dll
lea esi, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
call fcn.00406f80
mov ecx, esi
push ecx
lea edx, [esp + 0x74]
lea ecx, [esp + 0x58]
mov byte [esp + 0x89c], 3
call fcn.00428b10
add esp, 4
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x78]
mov byte [esp + 0x8a0], 4
call fcn.00406d10
mov esi, 8
cmp dword [esp + 0x6c], esi
jb 0x40d3ce
mov edx, dword [esp + 0x58]
push edx
call fcn.004415cb
add esp, 4
mov byte [esp + 0x898], 2
cmp dword [esp + 0x50], esi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], bp
jb 0x40d3f6
mov eax, dword [esp + 0x3c]
push eax
call fcn.004415cb
add esp, 4
call fcn.0040cfc0
test eax, eax
je 0x40d49e
cmp dword [esp + 0x88], esi
mov eax, dword [esp + 0x74]
jae 0x40d414
lea eax, [esp + 0x74]
call fcn.00440000
neg eax
sbb eax, eax
add eax, 2
cmp dword [0x474f04], ebp
mov ebx, eax
je 0x40d49e
mov edx, dword [0x473cfc]
mov eax, dword [edx + 0xc]
mov ecx, 0x473cfc
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
push ebx
push 1
push str._QTSvcStat__idx___lu__value___lu
lea edi, [esp + 0x3c]
mov byte [esp + 0x8a4], 5
call fcn.004073c0
mov esi, dword [esp + 0x3c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov byte [esp + 0x898], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d48c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x474f04]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
push ebx
push 1
push 0x41
call eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
call fcn.004207d0
call edi
sub eax, esi
push eax
push str._setup_WriteVerInfo
lea ecx, [esp + 0x94]
push 0x200
push ecx
call fcn.004414db
add esp, 0x10
lea ecx, [esp + 0x38]
mov word [esp + 0x48a], bp
call fcn.0042bd40
mov byte [esp + 0x898], 7
mov ebx, 7
lea eax, [esp + 0x8c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d501
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x90]
push edx
lea esi, [esp + 0x1c]
call fcn.00406f80
mov eax, esi
push ebp
push eax
or eax, 0xffffffff
lea esi, [esp + 0x40]
mov byte [esp + 0x8a0], 8
call fcn.00406df0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x40d552
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x50], esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jae 0x40d56d
lea edx, [esp + 0x3c]
mov ebx, dword [0x474bb0]
cmp ebx, ebp
je 0x40d5aa
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d580
sub eax, esi
sar eax, 1
push ebx
add eax, eax
push eax
push 1
push edx
call fcn.004422ed
mov ecx, dword [0x474bb0]
push ecx
call fcn.004428a9
add esp, 0x14
mov byte [esp + 0x898], 2
cmp dword [esp + 0x50], 8
jb 0x40d5c6
mov edx, dword [esp + 0x3c]
push edx
call fcn.004415cb
add esp, 4
call edi
mov esi, eax
call fcn.00423160
call edi
sub eax, esi
push eax
push str._setup_CopyUserFoloder
lea eax, [esp + 0x94]
push 0x200
push eax
call fcn.004414db
add esp, 0x10
lea ecx, [esp + 0x38]
mov word [esp + 0x48a], bp
call fcn.0042bd40
mov byte [esp + 0x898], 9
mov ebx, 7
lea eax, [esp + 0x8c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d623
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x90]
push ecx
lea esi, [esp + 0x1c]
call fcn.00406f80
mov edx, esi
push ebp
push edx
or eax, 0xffffffff
lea esi, [esp + 0x40]
mov byte [esp + 0x8a0], 0xa
call fcn.00406df0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x40d674
mov eax, dword [esp + 0x18]
push eax
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x50], esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jae 0x40d68f
lea edx, [esp + 0x3c]
mov ebx, dword [0x474bb0]
cmp ebx, ebp
je 0x40d6cb
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d6a0
sub eax, esi
sar eax, 1
push ebx
lea ecx, [eax + eax]
push ecx
push 1
push edx
call fcn.004422ed
mov edx, dword [0x474bb0]
push edx
call fcn.004428a9
add esp, 0x14
mov byte [esp + 0x898], 2
cmp dword [esp + 0x50], 8
jb 0x40d6e7
mov eax, dword [esp + 0x3c]
push eax
call fcn.004415cb
add esp, 4
call edi
mov ecx, 0x475158
mov esi, eax
call fcn.0041f070
call edi
sub eax, esi
push eax
push str._setup_WriteProtocalInfo
lea ecx, [esp + 0x94]
push 0x200
push ecx
call fcn.004414db
add esp, 0x10
lea ecx, [esp + 0x38]
mov word [esp + 0x48a], bp
call fcn.0042bd40
mov byte [esp + 0x898], 0xb
mov edi, 7
lea eax, [esp + 0x8c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d750
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x90]
push edx
lea esi, [esp + 0x1c]
call fcn.00406f80
mov eax, esi
push ebp
push eax
or eax, 0xffffffff
lea esi, [esp + 0x40]
mov byte [esp + 0x8a0], 0xc
call fcn.00406df0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x40d7a1
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x50], esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jae 0x40d7bc
lea edx, [esp + 0x3c]
mov ebx, dword [0x474bb0]
cmp ebx, ebp
je 0x40d7fa
mov eax, edx
lea esi, [eax + 2]
jmp 0x40d7d0
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d7d0
sub eax, esi
sar eax, 1
push ebx
add eax, eax
push eax
push 1
push edx
call fcn.004422ed
mov ecx, dword [0x474bb0]
push ecx
call fcn.004428a9
add esp, 0x14
mov byte [esp + 0x898], 2
cmp dword [esp + 0x50], 8
jb 0x40d816
mov edx, dword [esp + 0x3c]
push edx
call fcn.004415cb
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x40
call edi
mov esi, dword [esp + 0x38]
mov ebx, eax
sub ebx, esi
push 0xf
call fcn.004062d0
add esp, 8
call edi
sub eax, esi
push eax
push 0x463440
lea eax, [esp + 0x94]
push 0x200
push eax
call fcn.004414db
add esp, 0x10
lea ecx, [esp + 0x38]
mov word [esp + 0x48a], bp
call fcn.0042bd40
mov byte [esp + 0x898], 0xd
mov ebx, 7
lea eax, [esp + 0x8c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d886
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x90]
push ecx
lea esi, [esp + 0x1c]
call fcn.00406f80
mov edx, esi
push ebp
push edx
or eax, 0xffffffff
lea esi, [esp + 0x40]
mov byte [esp + 0x8a0], 0xe
call fcn.00406df0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x40d8d7
mov eax, dword [esp + 0x18]
push eax
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x50], esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jae 0x40d8f2
lea edx, [esp + 0x3c]
mov ebx, dword [0x474bb0]
cmp ebx, ebp
je 0x40d931
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d901
sub eax, esi
sar eax, 1
push ebx
lea ecx, [eax + eax]
push ecx
push 1
push edx
call fcn.004422ed
mov edx, dword [0x474bb0]
push edx
call fcn.004428a9
add esp, 0x14
mov esi, 8
mov byte [esp + 0x898], 2
cmp dword [esp + 0x50], esi
jb 0x40d94c
mov eax, dword [esp + 0x3c]
push eax
call fcn.004415cb
add esp, 4
push 0x40
call edi
mov ebx, eax
sub ebx, dword [0x474f10]
push 0xc
call fcn.004062d0
add esp, 8
call edi
sub eax, dword [0x474f10]
lea ecx, [esp + 0x8c]
push eax
push 0x46346c
push 0x200
push ecx
call fcn.004414db
add esp, 0x10
lea ecx, [esp + 0x38]
mov word [esp + 0x48a], bp
call fcn.0042bd40
mov byte [esp + 0x898], 0xf
mov ebx, 7
lea eax, [esp + 0x8c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40d9c0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x90]
push edx
lea esi, [esp + 0x1c]
call fcn.00406f80
mov eax, esi
push ebp
push eax
or eax, 0xffffffff
lea esi, [esp + 0x40]
mov byte [esp + 0x8a0], 0x10
call fcn.00406df0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x40da11
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x50], esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jae 0x40da2c
lea edx, [esp + 0x3c]
mov edi, dword [0x474bb0]
cmp edi, ebp
je 0x40da6a
mov eax, edx
lea esi, [eax + 2]
jmp 0x40da40
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40da40
sub eax, esi
sar eax, 1
push edi
add eax, eax
push eax
push 1
push edx
call fcn.004422ed
mov ecx, dword [0x474bb0]
push ecx
call fcn.004428a9
add esp, 0x14
mov byte [esp + 0x898], 2
cmp dword [esp + 0x50], 8
jb 0x40da86
mov edx, dword [esp + 0x3c]
push edx
call fcn.004415cb
add esp, 4
cmp dword [0x474f6c], ebp
je 0x40dbd1
push 0x7404
mov ecx, 1
call fcn.00419130
add esp, 4
push 0x7530
mov ecx, 1
call fcn.00419130
add esp, 4
push ebp
mov ecx, 2
call fcn.00419130
add esp, 4
push 0x46348c
lea eax, [esp + 0x490]
push 0x200
push eax
call fcn.004414db
add esp, 0xc
lea ecx, [esp + 0x54]
mov word [esp + 0x88a], bp
call fcn.0042bd40
mov byte [esp + 0x898], 0x11
lea eax, [esp + 0x48c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40db10
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x490]
push ecx
lea esi, [esp + 0x1c]
call fcn.00406f80
mov edx, esi
push ebp
push edx
or eax, 0xffffffff
lea esi, [esp + 0x5c]
mov byte [esp + 0x8a0], 0x12
call fcn.00406df0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x40db61
mov eax, dword [esp + 0x18]
push eax
call fcn.004415cb
add esp, 4
cmp dword [esp + 0x6c], esi
mov edx, dword [esp + 0x58]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jae 0x40db7c
lea edx, [esp + 0x58]
mov edi, dword [0x474bb0]
cmp edi, ebp
je 0x40dbbb
mov eax, edx
lea esi, [eax + 2]
jmp 0x40db90
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x40db90
sub eax, esi
sar eax, 1
push edi
lea ecx, [eax + eax]
push ecx
push 1
push edx
call fcn.004422ed
mov edx, dword [0x474bb0]
push edx
call fcn.004428a9
add esp, 0x14
cmp dword [esp + 0x6c], 8
jb 0x40dbec
mov eax, dword [esp + 0x58]
push eax
call fcn.004415cb
add esp, 4
jmp 0x40dbec
call fcn.00406c10
fld dword [0x46878c]
mov ecx, dword [eax + 0x40]
push ecx
push ecx
fstp dword [esp]
call fcn.0040b680
add esp, 8
cmp dword [esp + 0x88], 8
jb 0x40dc03
mov edx, dword [esp + 0x74]
push edx
call fcn.004415cb
add esp, 4
mov ecx, dword [esp + 0x890]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x878]
xor ecx, esp
call fcn.004414cc
add esp, 0x888
ret