Function at 0x4792f0
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de7e6
mov eax, dword fs:[0]
push eax
sub esp, 0x748
mov eax, dword [0x50f52c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
sub esp, 0x188
xor ebx, ebx
mov dword [ebp - 0x51c], ebx
mov edx, dword [0x510a54]
mov ecx, esp
mov dword [ebp - 0x50c], esp
push edx
mov dword [ebp - 0x54c], eax
call fcn.00410c80
mov dword [ebp - 4], ebx
mov eax, dword [0x510a58]
sub esp, 0x58
add eax, 0x2a8
mov ecx, esp
mov dword [ebp - 0x518], esp
push eax
call fcn.00409560
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.00428ab0
mov ecx, dword [0x510a58]
call fcn.0041e0d0
mov ecx, dword [0x510a58]
push 6
call fcn.0041ebe0
mov ecx, dword [0x510a58]
mov dword [ebp - 0x50c], esi
mov dword [ebp - 0x518], esi
mov esi, dword [ecx + 0x10]
sub esi, dword [ecx + 0xc]
mov eax, 0x8a42f871
imul esi
add edx, esi
sar edx, 9
mov eax, edx
xor edi, edi
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x514], edi
je 0x479604
push edi
call fcn.00463630
mov esi, dword [eax + 0x1b0]
add eax, 0x19c
mov ecx, esi
cmp ecx, esi
jae 0x4793de
mov edx, esi
cmp esi, 0x12
jb 0x4793ea
mov edx, 0x12
cmp dword [eax + 0x18], 8
jb 0x4793f5
mov eax, dword [eax + 4]
jmp 0x4793f8
add eax, 4
mov ecx, str.ZoneAlarm_Security
cmp edx, ebx
jbe 0x47941a
mov di, word [eax]
cmp di, word [ecx]
jne 0x479465
add eax, 2
add ecx, 2
sub edx, 1
jne 0x479401
mov edi, dword [ebp - 0x514]
cmp esi, 0x12
jb 0x479431
xor eax, eax
cmp esi, 0x12
setne al
cmp eax, ebx
jne 0x479431
mov dword [ebp - 0x50c], edi
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov esi, dword [eax + 0x1b0]
add eax, 0x19c
mov ecx, esi
cmp ecx, esi
jae 0x47944e
mov edx, esi
cmp esi, 0x12
jb 0x47945a
mov edx, 0x12
cmp dword [eax + 0x18], 8
jb 0x47947d
mov eax, dword [eax + 4]
jmp 0x479480
mov dx, di
cmp dx, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
cmp eax, ebx
je 0x479414
mov edi, dword [ebp - 0x514]
jmp 0x479427
add eax, 4
mov ecx, str.ZoneAlarm_Firewall
cmp edx, ebx
jbe 0x4794a9
lea esp, [esp]
mov di, word [eax]
cmp di, word [ecx]
jne 0x4794f4
add eax, 2
add ecx, 2
sub edx, 1
jne 0x479490
mov edi, dword [ebp - 0x514]
cmp esi, 0x12
jb 0x4794c0
xor eax, eax
cmp esi, 0x12
setne al
cmp eax, ebx
jne 0x4794c0
mov dword [ebp - 0x518], edi
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov ecx, dword [eax + 0x1b0]
add eax, 0x19c
mov edx, ecx
cmp edx, ecx
jae 0x4794dd
mov edx, ecx
cmp ecx, 0x13
jb 0x4794e9
mov edx, 0x13
cmp dword [eax + 0x18], 8
jb 0x47950c
mov eax, dword [eax + 4]
jmp 0x47950f
movzx eax, word [eax]
cmp ax, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
cmp eax, ebx
je 0x4794a3
mov edi, dword [ebp - 0x514]
jmp 0x4794b6
add eax, 4
mov ecx, str.ZoneAlarm_AntiVirus
cmp edx, ebx
jbe 0x47952b
mov si, word [eax]
cmp si, word [ecx]
jne 0x47952b
add eax, 2
add ecx, 2
sub edx, 1
jne 0x479518
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov ecx, dword [eax + 0x1b0]
add eax, 0x19c
mov edx, ecx
cmp edx, ecx
jae 0x479548
mov edx, ecx
cmp ecx, 0x12
jb 0x479554
mov edx, 0x12
cmp dword [eax + 0x18], 8
jb 0x47955f
mov eax, dword [eax + 4]
jmp 0x479562
add eax, 4
mov ecx, str.ZoneAlarm_Antispam
cmp edx, ebx
jbe 0x479583
jmp 0x479570
mov si, word [eax]
cmp si, word [ecx]
jne 0x479583
add eax, 2
add ecx, 2
sub edx, 1
jne 0x479570
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov ecx, dword [eax + 0x1b0]
add eax, 0x19c
mov edx, ecx
cmp edx, ecx
jae 0x4795a0
mov edx, ecx
cmp ecx, 0x12
jb 0x4795ac
mov edx, 0x12
cmp dword [eax + 0x18], 8
jb 0x4795b7
mov eax, dword [eax + 4]
jmp 0x4795ba
add eax, 4
mov ecx, str.ZoneAlarm_DataLock
cmp edx, ebx
jbe 0x4795d6
mov si, word [eax]
cmp si, word [ecx]
jne 0x4795d6
add eax, 2
add ecx, 2
sub edx, 1
jne 0x4795c3
mov ecx, dword [0x510a58]
mov esi, dword [ecx + 0x10]
sub esi, dword [ecx + 0xc]
mov eax, 0x8a42f871
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
mov dword [ebp - 0x514], edi
cmp edi, eax
jb 0x4793c7
mov dword [ebp - 0x5a0], ebx
mov dword [ebp - 4], 2
mov dword [ebp - 0x59c], ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x598], ebx
mov byte [ebp - 4], 4
mov dword [ebp - 0x594], ebx
mov byte [ebp - 4], 5
mov dword [ebp - 0x590], ebx
mov esi, 7
mov dword [ebp - 4], esi
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x479698
mov eax, dword [0x510a58]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x514], esp
push 0xffffffffffffffff
add eax, 0x268
push ebx
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00401750
mov byte [ebp - 4], 8
mov eax, dword [0x510a54]
mov ecx, dword [0x510a58]
push eax
push edi
call fcn.00463630
push eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5a0]
call fcn.0044b570
cmp dword [ebp - 0x518], 0xffffffff
je 0x479e3c
xor ecx, ecx
push 0xb
mov word [ebp - 0x564], cx
push str.INSTALLPAGE
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
call fcn.00401860
mov byte [ebp - 4], 9
push 0x10
xor edx, edx
push str.Stopping_client.
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x580], dx
call fcn.00401860
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x584]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 9
mov edi, 8
cmp dword [ebp - 0x56c], edi
jb 0x47972e
mov edx, dword [ebp - 0x580]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x580], ax
mov byte [ebp - 4], 7
cmp dword [ebp - 0x550], edi
jb 0x47975e
mov ecx, dword [ebp - 0x564]
push ecx
call fcn.004b29fa
add esp, 4
mov eax, dword [0x510a54]
mov ecx, dword [ebp - 0x518]
push eax
xor edx, edx
push ecx
mov ecx, dword [0x510a58]
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
mov word [ebp - 0x564], dx
call fcn.00463630
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x518], esp
push 0xffffffffffffffff
add eax, 0x24c
push ebx
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00401750
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5a0]
call fcn.00449d30
dec eax
cmp eax, 0xa
ja case.0x4797d0.3
movzx eax, byte [eax + 0x47b1fc]
jmp dword [eax*4 + 0x47b1e8]
push 0x3fb
jmp 0x4797f7
push 0x3fc
push ebx
call fcn.00454c60
jmp 0x4797fd
push 0x3fd
jmp 0x4797f7
push 0x3f1
push ebx
call fcn.00454ee0
mov ecx, dword [0x510a58]
push 0xff
call fcn.0041ebe0
mov ecx, dword [ebp - 0x54c]
push ebx
push 0x64
push 0x9015
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
xor edx, edx
push 0x4e25d8
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
call fcn.00401860
mov byte [ebp - 4], 0xc
push 0x23
lea eax, [ebp - 0x234]
push eax
call fcn.00451cd0
push 0x15
push str.CheckPointZoneAlarm
lea ecx, [ebp - 0x234]
call fcn.00401620
lea ecx, [ebp - 0x514]
push ecx
push 1
push 2
push 0x493e0
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x548]
push 0x4ee344
push eax
call fcn.00401a30
mov byte [ebp - 4], 0xd
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x518], esp
push str.Data___R__A__D_Y
push eax
push ecx
call fcn.00401b00
mov byte [ebp - 4], 0xe
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x524], esp
push 0xb
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.takeown.exe
mov word [ecx + 4], dx
call fcn.00401860
mov byte [ebp - 4], 0xf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x520], esp
push ebx
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4e25d8
mov word [ecx + 4], ax
call fcn.00401860
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xd
call fcn.00453920
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x530], edi
jb 0x47992b
mov ecx, dword [ebp - 0x544]
push ecx
call fcn.004b29fa
add esp, 4
lea eax, [ebp - 0x514]
push eax
push 1
push 2
push 0x493e0
xor edx, edx
lea ecx, [ebp - 0x234]
push ecx
mov word [ebp - 0x544], dx
lea edx, [ebp - 0x548]
push 0x4ee344
push edx
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
call fcn.00401a30
mov byte [ebp - 4], 0x11
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.Logs___R__A__D_Y
push eax
push ecx
call fcn.00401b00
mov byte [ebp - 4], 0x12
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x524], esp
push 0xb
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.takeown.exe
mov word [ecx + 4], dx
call fcn.00401860
mov byte [ebp - 4], 0x13
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x518], esp
push ebx
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4e25d8
mov word [ecx + 4], ax
call fcn.00401860
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x11
call fcn.00453920
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x530], edi
jb 0x4799f8
mov ecx, dword [ebp - 0x544]
push ecx
call fcn.004b29fa
add esp, 4
lea eax, [ebp - 0x514]
push eax
push 1
push 2
push 0x493e0
xor edx, edx
lea ecx, [ebp - 0x234]
push ecx
mov word [ebp - 0x544], dx
lea edx, [ebp - 0x548]
push 0x4e3c1c
push edx
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
call fcn.00401a30
mov byte [ebp - 4], 0x15
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.Data___reset__T
push eax
push ecx
call fcn.00401b00
mov byte [ebp - 4], 0x16
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x524], esp
push 0xa
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.icacls.exe
mov word [ecx + 4], dx
call fcn.00401860
mov byte [ebp - 4], 0x17
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x518], esp
push ebx
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4e25d8
mov word [ecx + 4], ax
call fcn.00401860
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x15
call fcn.00453920
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x530], edi
jb 0x479ac5
mov ecx, dword [ebp - 0x544]
push ecx
call fcn.004b29fa
add esp, 4
lea eax, [ebp - 0x514]
push eax
push 1
push 2
push 0x493e0
xor edx, edx
lea ecx, [ebp - 0x234]
push ecx
mov word [ebp - 0x544], dx
lea edx, [ebp - 0x548]
push 0x4e3c1c
push edx
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
call fcn.00401a30
mov byte [ebp - 4], 0x19
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.Logs___reset__T
push eax
push ecx
call fcn.00401b00
mov byte [ebp - 4], 0x1a
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x524], esp
push 0xa
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.icacls.exe
mov word [ecx + 4], dx
call fcn.00401860
mov byte [ebp - 4], 0x1b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x518], esp
push ebx
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4e25d8
mov word [ecx + 4], ax
call fcn.00401860
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0x19
call fcn.00453920
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x530], edi
jb 0x479b92
mov ecx, dword [ebp - 0x544]
push ecx
call fcn.004b29fa
add esp, 4
lea eax, [ebp - 0x514]
push eax
push 1
push 2
push 0x493e0
xor edx, edx
lea ecx, [ebp - 0x234]
push ecx
mov word [ebp - 0x544], dx
lea edx, [ebp - 0x548]
push 0x4e3c1c
push edx
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
call fcn.00401a30
mov byte [ebp - 4], 0x1d
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.Data___T__E__G_Administrators:F
push eax
push ecx
call fcn.00401b00
mov byte [ebp - 4], 0x1e
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x524], esp
push 9
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.cacls.exe
mov word [ecx + 4], dx
call fcn.00401860
mov byte [ebp - 4], 0x1f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x518], esp
push ebx
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4e25d8
mov word [ecx + 4], ax
call fcn.00401860
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x1d
call fcn.00453920
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x530], edi
jb 0x479c5f
mov ecx, dword [ebp - 0x544]
push ecx
call fcn.004b29fa
add esp, 4
lea eax, [ebp - 0x514]
push eax
push 1
push 2
push 0x493e0
xor edx, edx
lea ecx, [ebp - 0x234]
push ecx
mov word [ebp - 0x544], dx
lea edx, [ebp - 0x548]
push 0x4e3c1c
push edx
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
call fcn.00401a30
mov byte [ebp - 4], 0x21
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.Logs___T__E__G_Administrators:F
push eax
push ecx
call fcn.00401b00
mov byte [ebp - 4], 0x22
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x524], esp
push 9
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.cacls.exe
mov word [ecx + 4], dx
call fcn.00401860
mov byte [ebp - 4], 0x23
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x518], esp
push ebx
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4e25d8
mov word [ecx + 4], ax
call fcn.00401860
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x21
call fcn.00453920
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x530], edi
jb 0x479d2c
mov ecx, dword [ebp - 0x544]
push ecx
call fcn.004b29fa
add esp, 4
push 0xb
xor edx, edx
xor eax, eax
push str.INSTALLPAGE
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
mov word [ebp - 0x544], dx
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x580], ax
call fcn.00401860
mov byte [ebp - 4], 0x25
xor ecx, ecx
push 0xf
mov word [ebp - 0x564], cx
push str.Stopped_client.
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
call fcn.00401860
mov byte [ebp - 4], 0x26
lea edx, [ebp - 0x584]
push edx
lea eax, [ebp - 0x568]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0x25
cmp dword [ebp - 0x550], edi
jb 0x479dc5
mov ecx, dword [ebp - 0x564]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
mov word [ebp - 0x564], dx
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x56c], edi
jb 0x479df5
mov eax, dword [ebp - 0x580]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x580], cx
mov byte [ebp - 4], 7
cmp dword [ebp - 0x21c], edi
jb 0x479e25
mov edx, dword [ebp - 0x230]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
jmp 0x479e41
mov edi, 8
xor ecx, ecx
push 6
mov word [ebp - 0x580], cx
push str.AVHACK
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
call fcn.00401860
mov byte [ebp - 4], 0x27
push edi
xor edx, edx
push str.Got_here
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
mov word [ebp - 0x564], dx
call fcn.00401860
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x584]
push eax
lea ecx, [ebp - 0x568]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 0x27
cmp dword [ebp - 0x550], edi
jb 0x479ec4
mov edx, dword [ebp - 0x564]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
mov word [ebp - 0x564], ax
mov byte [ebp - 4], 7
cmp dword [ebp - 0x56c], edi
jb 0x479ef4
mov ecx, dword [ebp - 0x580]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x580], dx
call fcn.004783e0
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x479f69
mov eax, dword [0x510a58]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x520], esp
push 0xffffffffffffffff
add eax, 0x268
push ebx
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00401750
mov byte [ebp - 4], 0x29
mov eax, dword [0x510a54]
mov ecx, dword [0x510a58]
push eax
push edi
call fcn.00463630
push eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5a0]
call fcn.0044ca00
mov ecx, dword [0x510a58]
mov edi, dword [ecx + 0x10]
sub edi, dword [ecx + 0xc]
mov eax, 0x8a42f871
imul edi
add edx, edi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x514], ebx
jne 0x479fc8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5a0]
call fcn.00462270
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3057
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x510a58]
mov edx, dword [ebp - 0x514]
push edx
mov dword [ebp - 0x50c], ebx
call fcn.00463630
mov ecx, dword [eax + 0x38]
sub ecx, dword [eax + 0x34]
add eax, 0x28
mov eax, 0x5397829d
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x47a965
lea ebx, [ebx]
mov ecx, dword [ebp - 0x50c]
mov edx, dword [ebp - 0x514]
push ecx
mov ecx, dword [0x510a58]
push edx
call fcn.00463630
mov ecx, eax
add ecx, 0x28
call fcn.00403160
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00410c80
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x4a8]
call fcn.0042e880
mov byte [ebp - 4], 0x2b
mov ecx, dword [eax + 0x14]
or dword [ebp - 0x51c], 1
push 1
push 0x4e29e4
push ecx
push ebx
mov ecx, eax
call fcn.00401fe0
test eax, eax
je 0x47a081
mov edx, dword [0x510a54]
push edx
lea ecx, [ebp - 0x4a8]
call fcn.0042f5e0
test eax, eax
je 0x47a128
mov eax, dword [ebp - 0x328]
push ebx
push 0x4e25d8
push eax
push ebx
lea ecx, [ebp - 0x33c]
call fcn.00401fe0
test eax, eax
je 0x47a0d8
mov eax, dword [0x510a54]
cmp dword [eax + 0x184], 8
mov ecx, dword [eax + 0x180]
jb 0x47a0ba
mov eax, dword [eax + 0x170]
jmp 0x47a0bf
add eax, 0x170
push ecx
mov ecx, dword [ebp - 0x328]
push eax
push ecx
push ebx
lea ecx, [ebp - 0x33c]
call fcn.00401fe0
test eax, eax
jne 0x47a128
lea edx, [ebp - 0x690]
push edx
lea ecx, [ebp - 0x490]
call fcn.0042e880
mov dword [ebp - 4], 0x2c
mov ecx, dword [eax + 0x14]
or dword [ebp - 0x51c], 2
push 1
push 0x4e29e4
push ecx
push ebx
mov ecx, eax
call fcn.00401fe0
test eax, eax
je 0x47a130
mov edx, dword [0x510a54]
add edx, 0x18
push edx
lea ecx, [ebp - 0x490]
call fcn.0042f5e0
test eax, eax
jne 0x47a130
mov byte [ebp - 0x505], bl
jmp 0x47a137
mov byte [ebp - 0x505], 1
mov dword [ebp - 4], 0x2b
test byte [ebp - 0x51c], 2
je 0x47a17b
and dword [ebp - 0x51c], 0xfffffffd
cmp dword [ebp - 0x678], 8
jb 0x47a166
mov eax, dword [ebp - 0x68c]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x67c], ebx
mov word [ebp - 0x68c], cx
mov dword [ebp - 4], 0x2a
test byte [ebp - 0x51c], 1
je 0x47a1bf
and dword [ebp - 0x51c], 0xfffffffe
cmp dword [ebp - 0x65c], 8
jb 0x47a1aa
mov edx, dword [ebp - 0x670]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x65c], esi
mov dword [ebp - 0x660], ebx
mov word [ebp - 0x670], ax
cmp byte [ebp - 0x505], bl
je 0x47a915
mov ecx, dword [ebp - 0x450]
sub ecx, dword [ebp - 0x454]
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
xor edi, edi
add ecx, edx
je 0x47a252
mov edi, edi
push edi
lea ecx, [ebp - 0x460]
call fcn.00402f80
push eax
lea ecx, [ebp - 0x504]
call fcn.00409490
mov byte [ebp - 4], 0x2d
cmp dword [ebp - 0x4b4], ebx
je 0x47a21f
lea ecx, [ebp - 0x504]
call fcn.00434640
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x504]
call fcn.00402470
mov ecx, dword [ebp - 0x450]
sub ecx, dword [ebp - 0x454]
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
cmp edi, eax
jb 0x47a1f0
mov ecx, dword [ebp - 0x3a4]
sub ecx, dword [ebp - 0x3a8]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [ebp - 0x518], ebx
je 0x47a915
mov edi, 8
mov edx, dword [ebp - 0x518]
push edx
lea ecx, [ebp - 0x3b4]
call fcn.00422300
push eax
lea ecx, [ebp - 0x2c4]
call fcn.00409560
mov byte [ebp - 4], 0x2e
cmp dword [ebp - 0x270], ebx
je 0x47a8d7
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x2ac], edi
jae 0x47a2c2
lea eax, [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2b0]
lea edx, [ebp - 0x2c4]
lea eax, [eax + ecx*2]
push edx
push eax
lea ecx, [ebp - 0x5a8]
call fcn.00406e60
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x2ac], edi
jae 0x47a2f2
lea eax, [ebp - 0x2c0]
lea ecx, [ebp - 0x2c4]
push ecx
push eax
lea ecx, [ebp - 0x5b0]
call fcn.00406e60
mov edx, dword [ebp - 0x520]
mov eax, dword [ebp - 0x5a4]
mov ecx, dword [ebp - 0x5a8]
push edx
mov edx, dword [ebp - 0x5ac]
push eax
mov eax, dword [ebp - 0x5b0]
push ecx
push edx
push eax
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00441220
mov byte [ebp - 4], 0x2f
push ebx
push str...msu_
lea ecx, [ebp - 0x5f0]
call fcn.00441140
mov byte [ebp - 4], 0x30
push ebx
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.00478de0
mov byte [ebp - 0x505], al
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x5f0]
call fcn.00440de0
cmp byte [ebp - 0x505], bl
je 0x47a75c
push 0x104
lea edx, [ebp - 0x218]
push edx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov word [ebp - 0x564], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x47a3c6
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x568]
call fcn.00401860
mov byte [ebp - 4], 0x32
push str._system32
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x26c]
push eax
call fcn.00401b00
add esp, 0xc
mov byte [ebp - 4], 0x34
cmp dword [ebp - 0x550], edi
jb 0x47a422
mov ecx, dword [ebp - 0x564]
push ecx
call fcn.004b29fa
add esp, 4
mov ecx, dword [0x510a58]
lea eax, [ebp - 0x520]
push eax
push 1
push 2
push 0x493e0
xor edx, edx
add ecx, 0x19c
push ecx
mov word [ebp - 0x564], dx
lea edx, [ebp - 0x71c]
push 0x4e3c1c
push edx
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x554], ebx
call fcn.00401a30
mov byte [ebp - 4], 0x35
push 0x4e3448
push eax
lea eax, [ebp - 0x6e4]
push eax
call fcn.00401b00
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x2c4]
push ecx
push eax
lea edx, [ebp - 0x6ac]
push edx
call fcn.0040a680
mov byte [ebp - 4], 0x37
add esp, 8
mov ecx, esp
mov dword [ebp - 0x524], esp
push str.___quiet__norestart
push eax
push ecx
call fcn.00401b00
mov byte [ebp - 4], 0x38
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x58c], esp
push edi
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push str.wusa.exe
mov word [ecx + 4], dx
call fcn.00401860
mov byte [ebp - 4], 0x39
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x588], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x26c]
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov word [ecx + 4], ax
call fcn.00401750
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x37
call fcn.00453920
mov byte [ebp - 4], 0x36
cmp dword [ebp - 0x694], edi
jb 0x47a526
mov eax, dword [ebp - 0x6a8]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x694], esi
mov dword [ebp - 0x698], ebx
mov word [ebp - 0x6a8], cx
mov byte [ebp - 4], 0x35
cmp dword [ebp - 0x6cc], edi
jb 0x47a556
mov edx, dword [ebp - 0x6e0]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x6cc], esi
mov dword [ebp - 0x6d0], ebx
mov word [ebp - 0x6e0], ax
mov byte [ebp - 4], 0x34
cmp dword [ebp - 0x704], edi
jb 0x47a586
mov ecx, dword [ebp - 0x718]
push ecx
call fcn.004b29fa
add esp, 4
mov eax, dword [0x510a58]
add eax, 0x19c
push eax
lea ecx, [ebp - 0x6c8]
xor edx, edx
push 0x4e3c1c
push ecx
mov dword [ebp - 0x704], esi
mov dword [ebp - 0x708], ebx
mov word [ebp - 0x718], dx
call fcn.00401a30
mov byte [ebp - 4], 0x3b
push 0x4e3448
push eax
lea edx, [ebp - 0x700]
push edx
call fcn.00401b00
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2c4]
push ecx
push eax
lea edx, [ebp - 0x754]
push edx
call fcn.0040a680
mov byte [ebp - 4], 0x3d
push str.___quiet__norestart
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.00401b00
add esp, 0x30
mov byte [ebp - 4], 0x3f
cmp dword [ebp - 0x73c], edi
jb 0x47a619
mov ecx, dword [ebp - 0x750]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x73c], esi
mov dword [ebp - 0x740], ebx
mov word [ebp - 0x750], dx
mov byte [ebp - 4], 0x40
cmp dword [ebp - 0x6e8], edi
jb 0x47a649
mov eax, dword [ebp - 0x6fc]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x6e8], esi
mov dword [ebp - 0x6ec], ebx
mov word [ebp - 0x6fc], cx
mov byte [ebp - 4], 0x41
cmp dword [ebp - 0x6b0], edi
jb 0x47a679
mov edx, dword [ebp - 0x6c4]
push edx
call fcn.004b29fa
add esp, 4
xor ecx, ecx
push 0xb
xor eax, eax
mov word [ebp - 0x580], cx
push str.InstallPage
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x6b0], esi
mov dword [ebp - 0x6b4], ebx
mov word [ebp - 0x6c4], ax
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
call fcn.00401860
mov byte [ebp - 4], 0x42
lea edx, [ebp - 0x584]
push edx
lea eax, [ebp - 0x250]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0x41
cmp dword [ebp - 0x56c], edi
jb 0x47a6e7
mov ecx, dword [ebp - 0x580]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x56c], esi
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x580], dx
mov byte [ebp - 4], 0x34
cmp dword [ebp - 0x238], edi
jb 0x47a717
mov eax, dword [ebp - 0x24c]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], ebx
mov word [ebp - 0x24c], cx
mov byte [ebp - 4], 0x2f
cmp dword [ebp - 0x254], edi
jb 0x47a747
mov edx, dword [ebp - 0x268]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x258], ebx
mov word [ebp - 0x268], ax
push ebx
push str...exe_
lea ecx, [ebp - 0x614]
call fcn.00441140
mov byte [ebp - 4], 0x43
push ebx
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.00478de0
mov byte [ebp - 0x505], al
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x614]
call fcn.00440de0
cmp byte [ebp - 0x505], bl
je 0x47a8a5
lea edx, [ebp - 0x658]
push edx
push 1
push 2
push 0x493e0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x588], esp
push ebx
xor eax, eax
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4e25d8
mov word [ecx + 4], ax
call fcn.00401860
mov byte [ebp - 4], 0x45
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x58c], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c4]
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00401750
mov byte [ebp - 4], 0x46
mov eax, dword [0x510a58]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x524], esp
push 0xffffffffffffffff
add eax, 0x19c
push ebx
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00401750
mov byte [ebp - 4], 0x47
mov byte [ebp - 4], 0x2f
call fcn.00453920
push 0xb
xor eax, eax
push str.InstallPage
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 0x5b4], esi
mov dword [ebp - 0x5b8], ebx
mov word [ebp - 0x5c8], ax
call fcn.00401860
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x5cc]
push ecx
lea edx, [ebp - 0x2c4]
push edx
call fcn.00419d40
mov byte [ebp - 4], 0x2f
cmp dword [ebp - 0x5b4], edi
jb 0x47a890
mov eax, dword [ebp - 0x5c8]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x5b4], esi
mov dword [ebp - 0x5b8], ebx
mov word [ebp - 0x5c8], cx
mov byte [ebp - 4], 0x2e
cmp dword [ebp - 0x21c], 0x10
jb 0x47a8c1
mov edx, dword [ebp - 0x230]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x2c4]
call fcn.00407950
mov ecx, dword [ebp - 0x3a4]
sub ecx, dword [ebp - 0x3a8]
inc dword [ebp - 0x518]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x518], eax
jb 0x47a280
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4a8]
call fcn.004041d0
mov edi, dword [ebp - 0x50c]
mov ecx, dword [ebp - 0x514]
push ecx
mov ecx, dword [0x510a58]
inc edi
mov dword [ebp - 0x50c], edi
call fcn.00463630
mov ecx, dword [eax + 0x38]
sub ecx, dword [eax + 0x34]
add eax, 0x28
mov eax, 0x5397829d
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x47a000
mov edi, dword [ebp - 0x514]
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov ecx, dword [eax + 0x260]
push ebx
add eax, 0x24c
push 0x4e25d8
push ecx
push ebx
mov ecx, eax
call fcn.00401fe0
test eax, eax
jne 0x47a9c3
mov ecx, dword [0x510a58]
lea edx, [ecx + 0x1b8]
push edi
mov dword [ebp - 0x50c], edx
call fcn.00463630
mov ecx, dword [ebp - 0x50c]
push 0xffffffffffffffff
push ebx
add eax, 0x24c
push ecx
mov ecx, eax
call fcn.00401750
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov edx, dword [eax + 0x1b0]
push 0x1a
add eax, 0x19c
push str.ZoneAlarm_Security_Toolbar
push edx
push ebx
mov ecx, eax
call fcn.00401fe0
mov ecx, dword [0x510a58]
push edi
test eax, eax
jne 0x47abab
call fcn.00463630
mov ecx, dword [eax + 0x100]
add eax, 0xf4
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x518], ecx
cmp ecx, dword [eax + 0x10]
jbe 0x47aa1f
call fcn.004b32e0
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], edx
lea esp, [esp]
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov ecx, dword [eax + 0x104]
add eax, 0xf4
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x518], ecx
cmp dword [eax + 0xc], ecx
jbe 0x47aa6d
call fcn.004b32e0
mov ecx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x50c]
mov eax, dword [eax]
cmp ecx, ebx
je 0x47aa83
cmp ecx, eax
je 0x47aa88
call fcn.004b32e0
mov ecx, dword [ebp - 0x518]
cmp dword [ebp - 0x528], ecx
jae 0x47ab78
push ebx
push str.Firefox
lea ecx, [ebp - 0x638]
call fcn.004163c0
mov dword [ebp - 0x50c], eax
mov byte [ebp - 4], 0x49
cmp dword [ebp - 0x52c], ebx
jne 0x47ab63
call fcn.004b32e0
xor eax, eax
mov ecx, dword [ebp - 0x528]
cmp ecx, dword [eax + 0x10]
jb 0x47aad8
call fcn.004b32e0
mov edx, dword [ebp - 0x50c]
mov eax, dword [ebp - 0x528]
push ebx
push edx
push eax
call fcn.0041d850
mov byte [ebp - 0x505], al
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x638]
call fcn.00436f10
cmp byte [ebp - 0x505], bl
je 0x47ab36
mov eax, dword [ebp - 0x52c]
cmp eax, ebx
jne 0x47ab70
call fcn.004b32e0
xor eax, eax
mov ecx, dword [ebp - 0x528]
cmp ecx, dword [eax + 0x10]
jb 0x47ab2a
call fcn.004b32e0
mov ecx, dword [ebp - 0x528]
push ebx
call fcn.00432010
mov eax, dword [ebp - 0x52c]
cmp eax, ebx
jne 0x47ab74
call fcn.004b32e0
xor eax, eax
mov edx, dword [ebp - 0x528]
cmp edx, dword [eax + 0x10]
jb 0x47ab57
call fcn.004b32e0
add dword [ebp - 0x528], 0x24
jmp 0x47aa40
mov edx, dword [ebp - 0x52c]
mov eax, dword [edx]
jmp 0x47aac8
mov eax, dword [eax]
jmp 0x47ab1a
mov eax, dword [eax]
jmp 0x47ab47
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
cmp dword [eax + 0x348], ebx
je 0x47acba
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov dword [eax + 0x34c], 1
jmp 0x47acba
call fcn.00463630
mov ecx, dword [eax + 0x1b0]
push 0x12
add eax, 0x19c
push str.ZoneAlarm_Antispam
push ecx
push ebx
mov ecx, eax
call fcn.00401fe0
test eax, eax
jne 0x47acba
lea ecx, [ebp - 0x320]
call fcn.00433f10
mov byte [ebp - 4], 0x4a
push 0x15
push str.SOFTWAREMailFrontier
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x320], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401860
push 0xb
push str.installpath
lea ecx, [ebp - 0x300]
call fcn.00401860
mov edx, dword [0x510a58]
push str.MailFrontier
add edx, 0x1b8
push edx
lea eax, [ebp - 0x738]
push eax
call fcn.00401b00
add esp, 0xc
mov byte [ebp - 4], 0x4b
cmp dword [eax + 0x18], 8
jb 0x47ac40
mov eax, dword [eax + 4]
jmp 0x47ac43
add eax, 4
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, ebx
mov dword [ebp - 0x2dc], eax
sete byte [ebp - 0x505]
mov byte [ebp - 4], 0x4a
cmp dword [ebp - 0x720], 8
jb 0x47ac75
mov ecx, dword [ebp - 0x734]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x720], esi
mov dword [ebp - 0x724], ebx
mov word [ebp - 0x734], dx
cmp byte [ebp - 0x505], bl
jne 0x47b1cb
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x2d4], 1
call fcn.00434640
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x320]
call fcn.00402470
mov ecx, dword [0x510a58]
push ebx
push edi
call fcn.00463630
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x588], esp
push 0xffffffffffffffff
add eax, 0x19c
push ebx
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00401750
mov byte [ebp - 4], 0x4c
mov eax, dword [0x510a54]
sub esp, 0x188
mov ecx, esp
mov dword [ebp - 0x58c], esp
push eax
call fcn.00410c80
mov byte [ebp - 4], 0x4d
mov edx, dword [0x510a58]
sub esp, 0x3c4
mov ecx, esp
mov dword [ebp - 0x524], esp
push edx
call fcn.00462ac0
mov byte [ebp - 4], 0x4e
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50c], esp
push 0x4ebf68
call fcn.004019e0
mov byte [ebp - 4], 0x4f
push ebx
mov byte [ebp - 4], 7
call fcn.0041b950
push str.INSTALLLOCATION
lea ecx, [ebp - 0x654]
call fcn.004019e0
mov byte [ebp - 4], 0x50
mov ecx, dword [0x510a58]
lea edx, [ebp - 0x654]
push edx
lea eax, [ecx + 0x1b8]
push edi
mov dword [ebp - 0x50c], eax
call fcn.00463630
mov ecx, eax
add ecx, 0x210
call fcn.00419500
mov ecx, dword [ebp - 0x50c]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 7
cmp dword [ebp - 0x63c], 8
jb 0x47adbc
mov edx, dword [ebp - 0x650]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push str.LANGUAGE
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x640], ebx
mov word [ebp - 0x650], ax
call fcn.004019e0
mov byte [ebp - 4], 0x51
mov ecx, dword [0x510a58]
lea eax, [ebp - 0x630]
push eax
lea edx, [ecx + 0x2c4]
push edi
mov dword [ebp - 0x50c], edx
call fcn.00463630
mov ecx, eax
add ecx, 0x210
call fcn.00419500
mov ecx, dword [ebp - 0x50c]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 7
cmp dword [ebp - 0x618], 8
jb 0x47ae3e
mov edx, dword [ebp - 0x62c]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push str.LANGABV
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x618], esi
mov dword [ebp - 0x61c], ebx
mov word [ebp - 0x62c], ax
call fcn.004019e0
mov byte [ebp - 4], 0x52
mov ecx, dword [0x510a58]
lea eax, [ebp - 0x5e8]
push eax
lea edx, [ecx + 0x2e0]
push edi
mov dword [ebp - 0x50c], edx
call fcn.00463630
mov ecx, eax
add ecx, 0x210
call fcn.00419500
mov ecx, dword [ebp - 0x50c]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 7
cmp dword [ebp - 0x5d0], 8
jb 0x47aec0
mov edx, dword [ebp - 0x5e4]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
push str.PRODUCTNAME
lea ecx, [ebp - 0x60c]
mov dword [ebp - 0x5d0], esi
mov dword [ebp - 0x5d4], ebx
mov word [ebp - 0x5e4], ax
call fcn.004019e0
mov byte [ebp - 4], 0x53
mov ecx, dword [0x510a58]
lea eax, [ebp - 0x60c]
push eax
lea edx, [ecx + 0x84]
push edi
mov dword [ebp - 0x50c], edx
call fcn.00463630
mov ecx, eax
add ecx, 0x210
call fcn.00419500
mov ecx, dword [ebp - 0x50c]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.00401750
mov byte [ebp - 4], 7
cmp dword [ebp - 0x5f4], 8
jb 0x47af42
mov edx, dword [ebp - 0x608]
push edx
call fcn.004b29fa
add esp, 4
mov ecx, dword [0x510a58]
xor eax, eax
push edi
mov dword [ebp - 0x5f4], esi
mov dword [ebp - 0x5f8], ebx
mov word [ebp - 0x608], ax
call fcn.00463630
mov ecx, eax
call fcn.00423230
test eax, eax
je 0x47afa1
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
sub esp, 0x3b4
mov ecx, esp
mov dword [ebp - 0x588], esp
push eax
call fcn.0045e9a0
mov byte [ebp - 4], 0x54
mov byte [ebp - 4], 7
mov ecx, dword [0x510a58]
call fcn.0041fb10
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
mov ecx, dword [eax + 0x1b0]
push 0x13
add eax, 0x19c
push str.ZoneAlarm_AntiVirus
push ecx
push ebx
mov ecx, eax
call fcn.00401fe0
test eax, eax
jne 0x47b184
lea ecx, [ebp - 0x50d]
call fcn.00435640
mov edx, dword [0x510a54]
mov ecx, dword [0x510a58]
push edx
push edi
call fcn.00463630
push eax
lea ecx, [ebp - 0x50d]
call fcn.00440740
mov eax, dword [0x510a58]
mov ecx, dword [eax + 0x284]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x588], esp
push 0xffffffffffffffff
add eax, 0x19c
push ebx
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00401750
mov byte [ebp - 4], 0x55
mov eax, dword [0x510a54]
mov ecx, dword [0x510a58]
push eax
push edi
call fcn.00463630
push eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x50d]
call fcn.0043a650
mov ecx, dword [0x510a54]
push ecx
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
push eax
lea ecx, [ebp - 0x50d]
call fcn.00439490
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
cmp dword [eax + 0x348], ebx
je 0x47b0a3
mov edx, dword [0x510a54]
mov ecx, dword [0x510a58]
push edx
push edi
call fcn.00463630
push eax
lea ecx, [ebp - 0x50d]
call fcn.0043da30
mov ecx, dword [0x510a58]
push edi
call fcn.00463630
cmp dword [eax + 0x348], ebx
jne 0x47b110
push str.QUICKSCAN
lea ecx, [ebp - 0x548]
call fcn.004019e0
mov byte [ebp - 4], 0x56
mov ecx, dword [0x510a58]
or dword [ebp - 0x51c], 4
lea eax, [ebp - 0x548]
push eax
push edi
call fcn.00463630
mov ecx, eax
add ecx, 0x210
call fcn.00419500
mov ecx, dword [eax + 0x14]
push 3
push 0x4ed43c
push ecx
push ebx
mov ecx, eax
call fcn.00401fe0
mov byte [ebp - 0x505], 1
test eax, eax
je 0x47b116
mov byte [ebp - 0x505], bl
mov dword [ebp - 4], esi
test byte [ebp - 0x51c], 4
je 0x47b156
and dword [ebp - 0x51c], 0xfffffffb
cmp dword [ebp - 0x530], 8
jb 0x47b141
mov edx, dword [ebp - 0x544]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
mov word [ebp - 0x544], ax
cmp byte [ebp - 0x505], bl
je 0x47b184
mov ecx, dword [ebp - 0x54c]
mov edx, dword [0x510a54]
push ecx
mov ecx, dword [0x510a58]
push edx
push edi
call fcn.00463630
push eax
lea ecx, [ebp - 0x50d]
call fcn.0043be60
mov eax, dword [ebp - 0x54c]
push 1
push edi
push 0x9015
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x510a58]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, 0x8a42f871
imul ecx
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
inc edi
add ecx, edx
mov dword [ebp - 0x514], edi
cmp edi, ecx
jb 0x479fc2
jmp 0x479f90
push 0x4fbf34
lea edx, [ebp - 0x54c]
push edx
mov dword [ebp - 0x54c], 0x4e3c20
call fcn.004b3137
mov edi, edi
sub dword [eax - 0x6828ffb9], ebx
inc edi
add dh, bl
xchg edi, eax
inc edi
add bl, ch
xchg edi, eax
inc edi
add dl, dh
xchg edi, eax
inc edi
add byte [eax], al
add dword [esp + eax], eax
add al, byte [ecx]
add dword [esp + eax], eax
add al, 3
int3