Function at 0x42a0fd
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Schedule task via at

Disassembly:
push ebp
sub esp, 0x6c
push 0x58
mov eax, 0x4a7c5b
call fcn.0048d8e5
mov ebx, ecx
mov dword [ebp + 0x24], ebx
lea eax, [ebp + 0x60]
push str.FinishedAsDownloader
xor esi, esi
push eax
mov dword [ebp], esi
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp + 0xc]
push eax
call fcn.0045b4c0
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff0
call fcn.0040174a
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x20], esi
call fcn.0046df20
push eax
lea ecx, [ebp + 0x2c]
call fcn.0046e14b
mov byte [ebp - 4], 1
call fcn.0046df20
push eax
lea ecx, [ebp + 0x28]
call fcn.0046e14b
mov byte [ebp - 4], 2
call fcn.0046df20
push eax
lea ecx, [ebp + 0x54]
call fcn.0046e14b
mov byte [ebp - 4], 3
call fcn.0046df20
push eax
lea ecx, [ebp + 0x38]
call fcn.0046e14b
mov byte [ebp - 4], 4
call fcn.0046df20
push eax
lea ecx, [ebp + 0x3c]
call fcn.0046e14b
mov byte [ebp - 4], 5
call fcn.0046df20
push eax
lea ecx, [ebp + 0x34]
call fcn.0046e14b
lea eax, [ebp + 0x4c]
mov byte [ebp - 4], 6
mov edi, dword [ebx + 0x274]
push eax
call fcn.0040de8c
mov esi, ebx
mov byte [ebp - 4], 7
call fcn.0043e04a
fld qword [ebx + 0x1c8]
call fcn.0048de30
mov edx, dword [ebx + 0x20c]
mov ecx, dword [ebx + 0x274]
mov dword [ecx + edx*4 + 0x228], eax
xor eax, eax
inc eax
mov dword [ecx + 0xc], eax
mov dword [0x4db168], eax
mov dword [0x4db16c], eax
lea eax, [ebp + 0x50]
push str.FinishedAsDownloader_1
push eax
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp + 4]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff0
call fcn.0040174a
lea ecx, [ebp + 0x58]
call fcn.0046f568
mov byte [ebp - 4], 0xa
mov ecx, dword [ebx + 0x27c]
test ecx, ecx
je 0x42a23e
call fcn.0041042a
mov dword [ebp - 4], 9
xor edi, edi
inc edi
mov byte [ebp - 4], 8
call fcn.0046f57e
mov ecx, dword [ebx + 0x274]
cmp dword [ecx + 0x34], 0
je 0x42a28f
mov ecx, dword [ebx + 0x8e8]
mov eax, dword [ebx + 0x860]
call fcn.0044d7c9
test eax, eax
je 0x42a2a9
jmp 0x42b2b7
mov eax, ecx
call fcn.0040e0d7
test eax, eax
je 0x42a2a9
mov eax, ecx
call fcn.0040e13f
test eax, eax
je 0x42b2b7
cmp dword [ebx + 0x21c], 0
jne 0x42a329
push 0
push str.GR_FinishingOne
push edi
push edi
lea ecx, [ebp + 0x58]
call fcn.004720a6
push edi
lea eax, [ebp + 0x58]
push eax
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00451de4
mov byte [ebp - 4], 0xd
mov eax, dword [ebx + 0x274]
cmp dword [eax + 0x100], 0
je 0x42a30b
push edi
mov ecx, ebx
call fcn.00443ce9
mov ecx, esi
mov byte [ebp - 4], 0xc
call fcn.00451e6c
lea ecx, [ebp + 0x58]
mov byte [ebp - 4], 8
call fcn.004720f1
jmp 0x42b2b7
lea ecx, [ebp - 0x1c]
mov dword [eax + 0x100], edi
mov byte [ebp - 4], 0xc
call fcn.00451e6c
lea ecx, [ebp + 0x58]
mov byte [ebp - 4], 8
call fcn.004720f1
mov eax, dword [ebx + 0x274]
cmp dword [eax + 0x34], 0
je 0x42a40c
push dword [ebx + 0x1c0]
lea eax, [ebp + 0x6c]
push eax
call fcn.00461705
lea ecx, [ebp + 0x64]
push str.GR_OtherGRI
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.00404da1
add esp, 0x10
push 0
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
push eax
push edi
push edi
lea ecx, [ebp + 0x58]
call fcn.004720a6
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
push edi
lea eax, [ebp + 0x58]
push eax
lea esi, [ebp - 0x54]
call fcn.00451de4
mov byte [ebp - 4], 0x13
mov dword [ebx + 0x2dc], edi
lea esi, [ebx + 0x68]
mov dword [ebp + 0x60], 0x27
cmp dword [esi], 0
je 0x42a3fb
mov eax, dword [esi]
mov dword [eax + 0x2dc], edi
mov eax, dword [esi]
cmp dword [eax + 0x4c0], 8
je 0x42a3e2
push edi
mov ecx, eax
call fcn.00443ce9
call fcn.0046579c
cmp dword [ebx + 0x260], 0
je 0x42a3fb
call fcn.0047a570
jmp 0x42a3fb
cmp dword [eax + 0x774], 0
je 0x42a3fb
push edi
push edi
push 0x906
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
add esi, 4
dec dword [ebp + 0x60]
jne 0x42a3ad
mov byte [ebp - 4], 0x12
jmp 0x42a4c5
call fcn.0040e0d7
test eax, eax
je 0x42a4d9
push dword [ebx + 0x1c0]
lea eax, [ebp + 0x64]
push eax
call fcn.00461705
lea ecx, [ebp + 0x6c]
push str.GR_OtherGRI
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.00404da1
add esp, 0x10
push 0
mov byte [ebp - 4], 0x15
mov eax, dword [eax]
push eax
push edi
push edi
lea ecx, [ebp + 0x58]
call fcn.004720a6
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
push edi
lea eax, [ebp + 0x58]
push eax
lea esi, [ebp - 0x54]
call fcn.00451de4
mov byte [ebp - 4], 0x19
lea esi, [ebx + 0x68]
mov dword [ebp + 0x60], 0x27
mov ecx, dword [esi]
test ecx, ecx
je 0x42a493
push edi
call fcn.00443ce9
call fcn.0046579c
cmp dword [ebx + 0x260], 0
je 0x42a4a6
call fcn.0047a570
add esi, 4
dec dword [ebp + 0x60]
jne 0x42a487
call fcn.0046579c
cmp dword [ebx + 0x260], 0
je 0x42a4c1
call fcn.0047a570
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x54]
call fcn.00451e6c
lea ecx, [ebp + 0x58]
mov byte [ebp - 4], 8
call fcn.004720f1
mov edi, dword [ebx + 0x274]
lea eax, [ebp + 0x6c]
push eax
call fcn.0040d20b
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.004609f5
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040174a
xor eax, eax
cmp esi, eax
je 0x42a539
cmp dword [0x4db238], eax
jne 0x42a51a
cmp dword [ebx + 0x140], eax
je 0x42a539
mov esi, ebx
call fcn.0042b32f
test eax, eax
jne 0x42b2b7
push eax
push 0x8c6
call fcn.0043f6d2
jmp 0x42b2b7
cmp dword [ebx + 0x1e8], eax
je 0x42a6d4
mov edi, str.TotalDone
lea eax, [ebp + 0x60]
push edi
push eax
call fcn.00461468
mov dword [ebp + 0x6c], eax
mov esi, str.Stats
lea eax, [ebp + 0x64]
push esi
push eax
mov byte [ebp - 4], 0x1b
call fcn.00461468
add esp, 0x10
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp + 0x6c]
mov ecx, dword [ecx]
push 0
push 0
push ecx
push eax
push dword [ebx + 0x1e8]
call fcn.0044a4a6
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x5c], edx
call fcn.0040174a
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [ebp + 0x64]
push edi
push eax
call fcn.00461468
mov edi, eax
lea eax, [ebp + 0x6c]
push esi
push eax
mov byte [ebp - 4], 0x1d
call fcn.00461468
add esp, 0x10
mov byte [ebp - 4], 0x1e
mov edx, dword [ebx + 0x274]
mov ecx, dword [edx + 0x68]
add ecx, dword [ebp + 0x58]
mov edx, dword [edx + 0x6c]
adc edx, dword [ebp + 0x5c]
mov edi, dword [edi]
mov eax, dword [eax]
push edx
push ecx
push edi
mov edi, dword [ebx + 0x1e8]
push eax
call fcn.00449ffc
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
mov edi, str.TotalElapsed
lea eax, [ebp + 0x60]
push edi
push eax
call fcn.00461468
mov dword [ebp + 0x6c], eax
lea eax, [ebp + 0x64]
push esi
push eax
mov byte [ebp - 4], 0x1f
call fcn.00461468
add esp, 0x10
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp + 0x6c]
mov ecx, dword [ecx]
push 0
push 0
push ecx
push eax
push dword [ebx + 0x1e8]
call fcn.0044a4a6
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x5c], edx
call fcn.0040174a
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [ebp + 0x64]
push edi
push eax
call fcn.00461468
mov edi, eax
lea eax, [ebp + 0x6c]
push esi
push eax
mov byte [ebp - 4], 0x21
call fcn.00461468
add esp, 0x10
mov byte [ebp - 4], 0x22
mov ecx, dword [ebx + 0x274]
mov esi, dword [eax]
mov ecx, dword [ecx + 0x1b0c]
mov edi, dword [edi]
mov eax, ecx
cdq
add eax, dword [ebp + 0x58]
adc edx, dword [ebp + 0x5c]
push edx
push eax
push edi
mov edi, dword [ebx + 0x1e8]
push esi
call fcn.00449ffc
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebx + 0x1e8]
call fcn.0044af0c
xor eax, eax
cmp dword [ebx + 0x164], eax
jg 0x42a705
jl 0x42a6e6
cmp dword [ebx + 0x160], eax
ja 0x42a705
mov eax, dword [ebx + 0x274]
call fcn.0040e0d7
test eax, eax
jne 0x42a705
push 2
push 0x8c7
mov esi, ebx
call fcn.0043f6d2
jmp 0x42a771
push 1
push 0x8c7
mov esi, ebx
call fcn.0043f6d2
lea eax, [ebp + 0x6c]
push str.100_
push eax
call fcn.00461468
pop ecx
pop ecx
mov byte [ebp - 4], 0x23
mov edi, dword [ebx + 0x274]
push eax
call fcn.0040b2fe
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [ebp + 0x6c]
push str.0:00:00
push eax
call fcn.00461468
pop ecx
pop ecx
mov byte [ebp - 4], 0x24
mov edi, dword [ebx + 0x274]
push eax
call fcn.0040b395
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
xor esi, esi
lea eax, [ebp + 0x6c]
inc esi
push str.FinishedAsDownloader_2
push eax
mov dword [0x4db230], esi
mov dword [0x4db24c], esi
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp - 0x24]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
xor edi, edi
cmp dword [ebx + 0x690], edi
je 0x42a831
push esi
mov ecx, ebx
call fcn.00443ce9
cmp dword [0x4db1d8], edi
jne 0x42a7f1
mov eax, ebx
call fcn.0043f4b6
test eax, eax
jne 0x42a7f1
cmp dword [0x4db238], edi
jne 0x42a7f1
cmp dword [ebx + 0x140], edi
jne 0x42a7f1
cmp dword [0x4db23c], edi
jne 0x42a7f1
cmp dword [0x4db244], edi
je 0x42b2ac
mov ecx, ebx
call fcn.0046e7f8
test eax, eax
je 0x42b2ac
call fcn.0046579c
cmp dword [ebx + 0x260], edi
je 0x42a812
call fcn.0047a570
mov esi, ebx
call fcn.0042b32f
test eax, eax
jne 0x42b2ac
push edi
push 0x8c5
call fcn.0043f6d2
jmp 0x42b2ac
cmp dword [ebx + 0x27c], edi
mov dword [ebp + 0x40], esi
jne 0x42a89d
lea ecx, [ebx + 0x6f0]
call fcn.004609f5
test eax, eax
jne 0x42a89d
lea ecx, [ebp + 0x58]
call fcn.0046f568
mov byte [ebp - 4], 0x27
cmp dword [ebx + 0x27c], edi
jne 0x42a88b
push 0x38
call fcn.0046788f
pop ecx
mov dword [ebp + 0x64], eax
cmp eax, edi
mov byte [ebp - 4], 0x28
je 0x42a885
mov eax, dword [ebx + 0x58]
push 0x3042
push eax
push dword [ebp + 0x64]
call fcn.0041000c
mov edi, eax
mov dword [ebx + 0x27c], edi
mov dword [ebp - 4], 0x26
mov byte [ebp - 4], 0x25
call fcn.0046f57e
xor edi, edi
lea ecx, [ebp + 0x58]
call fcn.0046f568
mov byte [ebp - 4], 0x2b
mov esi, dword [ebx + 0x27c]
cmp esi, edi
je 0x42a8f4
call fcn.0041053c
mov esi, eax
mov edi, edx
jmp 0x42a8f6
xor esi, esi
mov dword [ebp - 4], 0x2a
mov byte [ebp - 4], 0x25
call fcn.0046f57e
lea ecx, [ebx + 0x6f0]
call fcn.004609f5
test eax, eax
jne 0x42aad7
lea ecx, [ebp - 0x18]
call fcn.0046f568
lea eax, [ebx + 0x6f0]
push eax
lea ecx, [ebp + 0x60]
mov byte [ebp - 4], 0x2e
call fcn.004019f2
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp + 0x60]
mov eax, dword [eax - 0xc]
cdq
sub esi, eax
sbb edi, edx
mov dword [ebp + 0x14], eax
mov eax, edi
mov edi, esi
sub edi, 5
mov dword [ebp + 0x5c], eax
sbb eax, 0
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x48], eax
cmp eax, dword [ebp + 0x5c]
jg 0x42aa7c
jl 0x42a96d
cmp edi, dword [ebp + 0x58]
jae 0x42aa7c
cmp dword [ebp + 0x20], 0
jne 0x42aa7c
test eax, eax
jl 0x42aa6d
jg 0x42a989
test edi, edi
jbe 0x42aa6d
mov eax, dword [ebx + 0x27c]
test eax, eax
je 0x42a99c
push dword [ebp + 0x48]
push edi
call fcn.004104d3
mov ecx, dword [ebx + 0x27c]
lea eax, [ebp + 0x64]
push eax
call fcn.0045ba16
pop ecx
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x30
call fcn.0040189c
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
push dword [ebp + 0x14]
lea eax, [ebp + 0x50]
push eax
lea ecx, [ebp + 0x54]
call fcn.004013d0
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x31
call fcn.0040189c
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff0
call fcn.0040174a
push dword [ebp + 0x60]
lea ecx, [ebp + 0x54]
call fcn.00403f2c
test eax, eax
jne 0x42aa6d
mov eax, dword [ebx + 0x27c]
test eax, eax
je 0x42aa3e
push dword [ebp + 0x48]
push edi
call fcn.00410555
mov ecx, dword [ebp + 0x48]
mov eax, edi
sub eax, 2
sbb ecx, 0
push ecx
push eax
mov eax, dword [ebx + 0x27c]
call fcn.004104d3
mov esi, dword [ebx + 0x27c]
push 2
lea eax, [ebp + 0x1c]
push eax
call fcn.00410201
cmp byte [ebp + 0x1c], 0xd
jne 0x42aa66
cmp byte [ebp + 0x1d], 0xa
jne 0x42aa66
mov eax, dword [ebx + 0x27c]
test eax, eax
je 0x42aa66
mov edx, dword [ebp + 0x48]
mov ecx, edi
sub ecx, 2
sbb edx, 0
push edx
push ecx
call fcn.00410555
mov dword [ebp + 0x20], 1
add edi, 1
adc dword [ebp + 0x48], 0
mov eax, dword [ebp + 0x48]
jmp 0x42a959
mov eax, dword [ebx + 0x27c]
test eax, eax
je 0x42aa9d
push eax
call fcn.004101b9
mov ecx, dword [ebx + 0x27c]
test ecx, ecx
je 0x42aa9d
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [ebp + 0x60]
and dword [ebx + 0x27c], 0
add ecx, 0xfffffff0
call fcn.0040174a
mov dword [ebp - 4], 0x2d
jmp 0x42aace
mov byte [ebp - 4], 0x25
call fcn.0046f57e
lea eax, [ebp + 0x64]
push str.FinishedAsDownloader_3
push eax
xor edi, edi
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp + 0x58]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [ebp + 0x6c]
push str.FinishedAsDownloader_3d
push eax
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp + 0x14]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [ebp + 0x64]
push str.FinishedAsDownloader_3c
push eax
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp - 0x18]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x35
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
cmp dword [ebx + 0x260], edi
je 0x42ab5e
call fcn.0047a570
mov eax, dword [ebx + 0x274]
or dword [ebp + 0x20], 0xffffffff
cmp dword [eax + 0x34], edi
je 0x42ab75
cmp dword [ebx + 0x774], edi
je 0x42ab7e
push 1
mov ecx, ebx
call fcn.00443ce9
cmp dword [ebx + 0x260], edi
je 0x42ab8b
call fcn.0047a570
lea eax, [ebp + 0x6c]
push str.FinishedAsDownloader_3b
push eax
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [ebp + 0x64]
push str.FinishedAsDownloader_3a
push eax
mov dword [ebx + 0x2dc], 1
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
mov eax, dword [ebx + 0x274]
cmp dword [eax + 0x34], edi
je 0x42abfd
push edi
push 0x904
mov esi, ebx
call fcn.0043f71c
lea eax, [ebp + 0x6c]
push str.FinishedAsDownloader_4
push eax
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
cmp dword [ebx + 0x540], edi
jne 0x42ac5a
cmp dword [ebp + 0x40], edi
je 0x42ac5a
lea eax, [ebx + 0x58]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.004637e6
pop ecx
pop ecx
push ebx
mov byte [ebp - 4], 0x4c
call fcn.0042b706
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp + 0x40]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [ebp + 0x40]
push str.FinishedAsDownloader_6
push eax
call fcn.00461468
pop ecx
pop ecx
lea eax, [ebp - 0x40]
push eax
call fcn.0045b4c0
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp + 0x40]
add ecx, 0xfffffff0
call fcn.0040174a
lea esi, [ebx + 0x58]
push esi
lea ecx, [ebp + 0x50]
call fcn.004019f2
lea eax, [ebp + 0x30]
push 0x4b578c
push eax
mov byte [ebp - 4], 0x4e
call fcn.00461468
mov edi, eax
lea eax, [ebp + 0x60]
push str.CommandLine
push eax
mov byte [ebp - 4], 0x4f
call fcn.00461468
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x64]
push str.ToGoData
push eax
mov byte [ebp - 4], 0x50
call fcn.00461468
add esp, 0x18
mov byte [ebp - 4], 0x51
mov edi, dword [edi]
mov ecx, dword [ebp + 0x40]
mov ecx, dword [ecx]
mov eax, dword [eax]
push edi
mov edi, dword [ebx + 0x1e8]
push ecx
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.0044a212
mov byte [ebp - 4], 0x52
mov edi, dword [ebx + 0x274]
push eax
call fcn.0040cd23
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff0
call fcn.0040174a
mov edi, dword [ebx + 0x274]
lea eax, [ebp + 0x48]
push eax
call fcn.0040dd8a
mov ecx, eax
mov byte [ebp - 4], 0x53
call fcn.004609f5
neg eax
sbb al, al
inc al
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
mov byte [ebp + 0x6b], al
call fcn.0040174a
cmp byte [ebp + 0x6b], 0
je 0x42ae1f
push 0
push 0x20
lea ecx, [ebp + 0x50]
call fcn.00406b61
test eax, eax
jle 0x42add3
push 0
push 0x22
lea ecx, [ebp + 0x50]
call fcn.00406b61
cmp eax, 0xffffffff
jne 0x42add3
mov edi, 0x4b72f0
lea eax, [ebp + 0x30]
push edi
push eax
lea ecx, [ebp + 0x50]
call fcn.00404da1
push edi
push eax
lea eax, [ebp + 0x48]
push eax
mov byte [ebp - 4], 0x54
call fcn.0040145d
add esp, 0x14
push eax
lea ecx, [ebp + 0x50]
mov byte [ebp - 4], 0x55
call fcn.0040189c
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff0
call fcn.0040174a
mov edi, dword [ebx + 0x274]
lea eax, [ebp + 0x30]
push eax
call fcn.0040dd8a
lea ecx, [ebp + 0x48]
push 0x4b606c
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x56
call fcn.00404da1
pop ecx
pop ecx
push eax
lea ecx, [ebp + 0x50]
mov byte [ebp - 4], 0x57
call fcn.0040157b
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff0
call fcn.0040174a
mov eax, dword [ebx + 0x274]
and dword [ebp + 0x60], 0
cmp dword [eax + 0x104], 0
je 0x42af95
mov edi, dword [0x4db468]
call fcn.00471d19
mov eax, dword [eax + 4]
push 1
push str.DoDLTorrents
push edi
mov ecx, eax
call fcn.00471162
test eax, eax
je 0x42ae99
push str..torrent
mov edi, esi
call fcn.0046038c
test eax, eax
pop ecx
jne 0x42ae8d
push str..torrent
lea edi, [ebx + 0x54]
call fcn.0046038c
test eax, eax
pop ecx
jne 0x42ae8d
push str.application_x_bittorrent
push dword [ebp + 0x4c]
call fcn.00488c03
test eax, eax
pop ecx
pop ecx
jne 0x42ae99
mov dword [ebp + 0x60], 1
jmp 0x42af95
mov edi, dword [ebx + 0x274]
lea eax, [ebp + 0x30]
push eax
call fcn.0040dd8a
lea ecx, [ebp + 0x48]
push ecx
mov ebx, eax
mov byte [ebp - 4], 0x58
call fcn.004600a3
push eax
push esi
mov byte [ebp - 4], 0x59
call fcn.0045b723
mov ecx, dword [ebp + 0x48]
add esp, 0xc
add ecx, 0xfffffff0
mov edi, eax
call fcn.0040174a
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff0
call fcn.0040174a
test edi, edi
jne 0x42af92
lea eax, [ebp + 0x6c]
push esi
push eax
call fcn.0045f6f7
pop ecx
pop ecx
mov dword [ebp + 0x48], eax
lea eax, [ebp + 0x40]
push eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 0x5a
mov edi, dword [eax + 0x274]
call fcn.0040dd8a
lea ecx, [ebp + 0x30]
push ecx
mov ebx, eax
mov byte [ebp - 4], 0x5b
call fcn.004600a3
mov eax, dword [eax]
mov edx, dword [esi]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ecx
mov ecx, dword [ebp + 0x48]
mov ecx, dword [ecx]
push 1
push ecx
push eax
push edx
mov ebx, str.open
push ebx
push 0
call edi
mov ecx, dword [ebp + 0x30]
cmp eax, 0x20
setg byte [ebp + 0x6b]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x40]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp + 0x6c]
add ecx, 0xfffffff0
call fcn.0040174a
cmp byte [ebp + 0x6b], 0
jne 0x42af92
lea eax, [ebp + 0x48]
push esi
push eax
call fcn.0045f6f7
pop ecx
pop ecx
mov ecx, dword [eax]
push 1
xor eax, eax
push eax
push eax
push ecx
push ebx
push eax
call edi
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.0040174a
mov ebx, dword [ebp + 0x24]
cmp dword [ebx + 0x690], 0
jne 0x42afc2
mov ecx, ebx
call fcn.0043f4a2
test eax, eax
je 0x42afc2
push str..PAC
mov edi, esi
call fcn.0046038c
test eax, eax
pop ecx
je 0x42afc2
push esi
mov ecx, ebx
call fcn.0043f87a
lea eax, [ebp + 0x48]
push esi
push eax
call fcn.004637cc
mov byte [ebp - 4], 0x5c
or dword [ebp], 2
push str..torrent
mov edi, eax
call fcn.0046038c
add esp, 0xc
test eax, eax
jne 0x42b010
push str..torrent
lea edi, [ebx + 0x54]
call fcn.0046038c
test eax, eax
pop ecx
jne 0x42b010
push str.application_x_bittorrent
push dword [ebp + 0x4c]
call fcn.00488c03
test eax, eax
pop ecx
pop ecx
mov byte [ebp + 0x6b], 0
jne 0x42b014
mov byte [ebp + 0x6b], 1
mov dword [ebp - 4], 0x4e
test byte [ebp], 2
je 0x42b02c
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.0040174a
cmp byte [ebp + 0x6b], 0
je 0x42b04f
mov edi, dword [0x4db468]
call fcn.00471d19
mov eax, dword [eax + 4]
push 1
push str.DoDLTorrents
push edi
mov ecx, eax
call fcn.00471162
mov edi, dword [0x4db468]
call fcn.00471d19
mov eax, dword [eax + 4]
push 1
push str.DoDLTorrents
push edi
mov ecx, eax
call fcn.00471162
test eax, eax
je 0x42b0b2
push str..torrent
mov edi, esi
call fcn.0046038c
test eax, eax
pop ecx
jne 0x42b0a6
push str..torrent
lea edi, [ebx + 0x54]
call fcn.0046038c
test eax, eax
pop ecx
jne 0x42b0a6
push str.application_x_bittorrent
push dword [ebp + 0x4c]
call fcn.00488c03
test eax, eax
pop ecx
pop ecx
jne 0x42b0b2
mov dword [ebp + 0x60], 1
jmp 0x42b137
cmp dword [ebx + 0x260], 0
jne 0x42b137
push 0
push str.GR_Updating
push 1
push 1
lea ecx, [ebp + 0x44]
call fcn.004720a6
push 1
lea eax, [ebp + 0x44]
push eax
lea esi, [ebp - 0x54]
mov byte [ebp - 4], 0x5d
call fcn.00451de4
mov byte [ebp - 4], 0x5e
push dword [ebx + 0x1c0]
call fcn.0045888b
test eax, eax
pop ecx
mov dword [ebp + 0x20], eax
jl 0x42b11f
push eax
mov ecx, ebx
call fcn.0042b97d
test eax, eax
je 0x42b11f
mov ecx, esi
mov byte [ebp - 4], 0x5d
call fcn.00451e6c
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 0x4e
call fcn.004720f1
jmp 0x42b254
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x5d
call fcn.00451e6c
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 0x4e
call fcn.004720f1
xor eax, eax
cmp dword [ebx + 0x53c], eax
je 0x42b154
cmp dword [ebp + 0x20], eax
jl 0x42b154
cmp dword [ebx + 0x260], eax
jne 0x42b154
cmp dword [ebp + 0x78], 1
je 0x42b162
push 0
push 0x8cb
mov esi, ebx
call fcn.0043f6d2
mov eax, ebx
call fcn.00459ab1
test eax, eax
je 0x42b254
mov edi, dword [ebx + 0x274]
lea eax, [ebp - 0x28]
push eax
call fcn.0040de8c
mov eax, ebx
mov byte [ebp - 4], 0x5f
call fcn.00459ab1
test eax, eax
je 0x42b249
cmp dword [0x4db1d8], 0
jne 0x42b1b9
mov esi, dword [0x4db468]
call fcn.00471d19
mov eax, dword [eax + 4]
push 1
push str.Exit
push esi
mov ecx, eax
call fcn.00471162
mov eax, ebx
call fcn.0043f4e2
xor edi, edi
push edi
push 0x90a
mov esi, ebx
mov dword [ebp + 0x78], eax
call fcn.0043f71c
cmp dword [ebp + 0x78], edi
jne 0x42b1f7
cmp dword [0x4db238], edi
jne 0x42b1f7
cmp dword [ebx + 0x140], edi
jne 0x42b1f7
cmp dword [0x4db23c], edi
jne 0x42b1f7
cmp dword [0x4db244], edi
je 0x42b22c
cmp dword [ebp + 0x60], edi
jne 0x42b249
mov ecx, ebx
call fcn.0046e7f8
test eax, eax
je 0x42b231
call fcn.0046579c
cmp dword [ebx + 0x260], edi
je 0x42b219
call fcn.0047a570
mov esi, ebx
call fcn.0042b32f
test eax, eax
jne 0x42b249
push edi
push 0x8c5
jmp 0x42b242
cmp dword [ebp + 0x60], edi
jne 0x42b249
mov esi, ebx
call fcn.0042b32f
test eax, eax
jne 0x42b249
push edi
push 0x8ee
mov esi, ebx
call fcn.0043f6d2
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 4]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x4c]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x34]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x3c]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0x2c]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 4