Function at 0x466e00
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a95cf
mov eax, dword fs:[0]
push eax
sub esp, 0xca0
mov eax, dword [0x63b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa00], ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0xacc], eax
xor eax, eax
mov ecx, dword [ebp - 0xa00]
add ecx, 0x9e0
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xa00]
mov byte [edx + 0x9d4], 0
mov eax, dword [ebp - 0xa00]
mov byte [eax + 0x9b8], 1
mov ecx, dword [ebp - 0xa00]
mov byte [ecx + 0x9b0], 0
mov ecx, dword [ebp - 0xa00]
call fcn.0046c450
mov edx, dword [ebp - 0xa00]
mov dword [edx + 0x984], eax
mov eax, dword [ebp - 0xa00]
mov dword [eax + 0x9d8], 0
mov dword [eax + 0x9dc], 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa00]
add ecx, 0x30
call fcn.004ab1ea
push 0x218
call fcn.004a3a00
add esp, 4
mov dword [ebp - 0xad8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xad8]
call fcn.00423220
mov dword [ebp - 0xa34], eax
jmp 0x466efe
mov ecx, dword [ebp - 0xa34]
mov dword [ebp - 0xadc], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xa00]
mov eax, dword [ebp - 0xadc]
mov dword [edx + 0x988], eax
mov ecx, dword [ebp - 0xa00]
add ecx, 0x30
push ecx
mov edx, dword [ebp - 0xa00]
mov ecx, dword [edx + 0x988]
call fcn.00426eb0
push str.root_layout
mov ecx, dword [ebp - 0xa00]
add ecx, 0x30
call fcn.004a65a5
mov ecx, dword [ebp - 0xa00]
mov dword [ecx + 0x77c], eax
mov ecx, dword [ebp - 0xa00]
call fcn.00457510
mov edx, dword [ebp - 0xa00]
mov dword [edx + 0x990], 0xffffffff
mov dword [ebp - 0xbd0], 0
lea eax, [ebp - 0x76c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
xor ecx, ecx
mov word [ebp - 0x75c], cx
push 0x206
push 0
lea edx, [ebp - 0x75a]
push edx
call fcn.00577360
add esp, 0xc
movzx eax, word [ebp - 0x75e]
push eax
movzx ecx, word [ebp - 0x760]
push ecx
movzx edx, word [ebp - 0x762]
push edx
movzx eax, word [ebp - 0x764]
push eax
movzx ecx, word [ebp - 0x766]
push ecx
movzx edx, word [ebp - 0x76a]
push edx
movzx eax, word [ebp - 0x76c]
push eax
push str._.4d_.2d_.2d_.2d_.2d_.2d_.3d
lea ecx, [ebp - 0x75c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea edx, [ebp - 0x75c]
push edx
mov ecx, dword [ebp - 0xa00]
add ecx, 0x9bc
call fcn.00413680
xor eax, eax
mov word [ebp - 0x34c], ax
push 0x206
push 0
lea ecx, [ebp - 0x34a]
push ecx
call fcn.00577360
add esp, 0xc
lea edx, [ebp - 0x34c]
push edx
mov ecx, dword [ebp - 0xa00]
call fcn.00463ff0
lea ecx, [ebp - 0x9fc]
call fcn.004b00c9
mov dword [ebp - 4], 1
lea eax, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x9fc]
call fcn.004b0249
push 0x5fd7f4
lea ecx, [ebp - 0x9fc]
call fcn.004b030a
push 0x5fd8a4
lea ecx, [ebp - 0x9fc]
call fcn.004b030a
lea ecx, [ebp - 0x9fc]
call fcn.004b06da
push eax
mov ecx, dword [ebp - 0xa00]
add ecx, 0x954
call fcn.00413680
mov ecx, dword [ebp - 0xa00]
cmp dword [ecx + 0x784], 0
je 0x4670df
lea ecx, [ebp - 0x9fc]
call fcn.004b06da
push eax
mov edx, dword [ebp - 0xa00]
mov eax, dword [edx + 0x784]
mov ecx, dword [ebp - 0xa00]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x784]
mov eax, dword [edx + 0x2c]
call eax
lea ecx, [ebp - 0x784]
call fcn.00413850
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x79c]
call fcn.00413850
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x79c]
push ecx
mov edx, dword [ebp - 0xa00]
add edx, 0x96c
push edx
mov ecx, dword [ebp - 0xa00]
call fcn.00459c90
test eax, eax
je 0x46751a
lea eax, [ebp - 0x79c]
push eax
mov ecx, dword [ebp - 0xa00]
add ecx, 0x924
call fcn.004136a0
push 0x5fd8a0
mov ecx, dword [ebp - 0xa00]
add ecx, 0x96c
push ecx
lea edx, [ebp - 0x900]
push edx
call fcn.00472f80
add esp, 0xc
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xae0]
push eax
lea ecx, [ebp - 0x784]
call fcn.00413760
lea ecx, [ebp - 0x900]
call fcn.00413710
push 0
lea ecx, [ebp - 0x930]
push ecx
mov ecx, dword [ebp - 0xa00]
call fcn.0046abb0
mov dword [ebp - 0xae4], eax
mov edx, dword [ebp - 0xae4]
mov dword [ebp - 0xae8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xae8]
push eax
lea ecx, [ebp - 0x784]
push ecx
lea edx, [ebp - 0x918]
push edx
call fcn.00473130
add esp, 0xc
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xad4]
push eax
lea ecx, [ebp - 0x784]
call fcn.00413760
lea ecx, [ebp - 0x918]
call fcn.00413710
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x930]
call fcn.00413710
lea ecx, [ebp - 0x784]
call fcn.00411720
sub eax, 4
push eax
push 0
lea ecx, [ebp - 0x960]
push ecx
lea ecx, [ebp - 0x784]
call fcn.004135c0
mov dword [ebp - 0xaec], eax
mov edx, dword [ebp - 0xaec]
mov dword [ebp - 0xaf0], edx
mov byte [ebp - 4], 5
push str..log
mov eax, dword [ebp - 0xaf0]
push eax
lea ecx, [ebp - 0x948]
push ecx
call fcn.00472f40
add esp, 0xc
mov dword [ebp - 0xaf4], eax
mov edx, dword [ebp - 0xaf4]
push edx
lea ecx, [ebp - 0x784]
call fcn.00413760
lea ecx, [ebp - 0x948]
call fcn.00413710
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x960]
call fcn.00413710
lea eax, [ebp - 0x784]
push eax
mov ecx, dword [ebp - 0xa00]
add ecx, 0x93c
call fcn.004136a0
lea ecx, [ebp - 0x8e8]
call fcn.0041f6a0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x8e8]
call fcn.00455e40
push str._datetime___Thread___thread___msg
lea ecx, [ebp - 0x814]
call fcn.00411850
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x814]
push ecx
push 8
push 0x80
lea ecx, [ebp - 0x8e8]
call fcn.0041f890
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x814]
call fcn.00411780
push 0x5fd8f4
lea ecx, [ebp - 0x7fc]
call fcn.00411850
mov byte [ebp - 4], 8
lea edx, [ebp - 0x7fc]
push edx
push 1
push 0x80
lea ecx, [ebp - 0x8e8]
call fcn.0041f890
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7fc]
call fcn.00411780
push 0x5fd8ec
lea ecx, [ebp - 0x7e4]
call fcn.00411850
mov byte [ebp - 4], 9
lea eax, [ebp - 0x7e4]
push eax
push 4
push 0x80
lea ecx, [ebp - 0x8e8]
call fcn.0041f890
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7e4]
call fcn.00411780
push 0x5fd904
lea ecx, [ebp - 0x7b4]
call fcn.00411850
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7b4]
push ecx
push 2
push 0x80
lea ecx, [ebp - 0x8e8]
call fcn.0041f890
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7b4]
call fcn.00411780
call fcn.0041ce50
mov dword [ebp - 0xb00], eax
lea ecx, [ebp - 0x784]
call fcn.00413640
mov dword [ebp - 0xa14], eax
cmp dword [ebp - 0xa14], 0
jne 0x4673d5
mov dword [ebp - 0xa28], 0
jmp 0x467494
mov edx, dword [ebp - 0xa14]
mov dword [ebp - 0xa08], edx
mov eax, dword [ebp - 0xa08]
add eax, 2
mov dword [ebp - 0xaf8], eax
mov ecx, dword [ebp - 0xa08]
mov dx, word [ecx]
mov word [ebp - 0xa0a], dx
add dword [ebp - 0xa08], 2
cmp word [ebp - 0xa0a], 0
jne 0x4673f0
mov eax, dword [ebp - 0xa08]
sub eax, dword [ebp - 0xaf8]
sar eax, 1
mov dword [ebp - 0xafc], eax
mov ecx, dword [ebp - 0xafc]
add ecx, 1
mov dword [ebp - 0xa10], ecx
cmp dword [ebp - 0xa10], 0x3fffffff
jle 0x46744c
mov dword [ebp - 0xa30], 0
jmp 0x467488
mov eax, dword [ebp - 0xa10]
shl eax, 1
call fcn.004a4480
mov dword [ebp - 0xb04], esp
mov edx, dword [ebp - 0xb00]
push edx
mov eax, dword [ebp - 0xa10]
shl eax, 1
push eax
mov ecx, dword [ebp - 0xa14]
push ecx
mov edx, dword [ebp - 0xb04]
push edx
call fcn.0041ceb0
mov dword [ebp - 0xa30], eax
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0xa28], eax
mov ecx, dword [ebp - 0xa28]
push ecx
lea ecx, [ebp - 0x88c]
call fcn.00411850
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x88c]
push edx
push 0x10
push 0x80
lea ecx, [ebp - 0x8e8]
call fcn.0041f890
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88c]
call fcn.00411780
push 0x5fd8fc
lea ecx, [ebp - 0x874]
call fcn.00411850
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x8e8]
push eax
lea ecx, [ebp - 0x874]
push ecx
call fcn.004565a0
add esp, 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x874]
call fcn.00411780
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8e8]
call fcn.0041f6e0
mov ecx, dword [ebp - 0xa00]
add ecx, 0x9f8
call fcn.00428270
mov ecx, dword [ebp - 0xa00]
add ecx, 0xa04
call fcn.00428270
mov ecx, dword [ebp - 0xa00]
add ecx, 0xa10
call fcn.00428270
mov ecx, dword [ebp - 0xa00]
add ecx, 0xa1c
call fcn.0046cfa0
mov edx, dword [ebp - 0xa00]
mov eax, dword [edx + 0x988]
cmp dword [eax + 0x38], 0
je 0x467579
mov byte [ebp - 0xa01], 1
jmp 0x467580
mov byte [ebp - 0xa01], 0
mov ecx, dword [ebp - 0xa00]
mov dl, byte [ebp - 0xa01]
mov byte [ecx + 0xa30], dl
push 0
mov ecx, dword [ebp - 0xa00]
call fcn.0046c9d0
movzx eax, al
test eax, eax
jne 0x46763c
push 0
push 0
mov ecx, dword [ebp - 0xa00]
push ecx
push 0x4621a0
push 0
push 0
call fcn.0057a80e
add esp, 0x18
mov edx, 4
shl edx, 0
mov ecx, dword [ebp - 0xa00]
mov dword [ecx + edx + 0x9e0], eax
push 0
push 0
mov edx, dword [ebp - 0xa00]
push edx
push 0x4608e0
push 0
push 0
call fcn.0057a80e
add esp, 0x18
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 0xa00]
mov dword [edx + ecx + 0x9e0], eax
push 0
push 0
mov eax, dword [ebp - 0xa00]
push eax
push 0x462270
push 0
push 0
call fcn.0057a80e
add esp, 0x18
mov ecx, 4
imul edx, ecx, 3
mov ecx, dword [ebp - 0xa00]
mov dword [ecx + edx + 0x9e0], eax
mov ecx, dword [ebp - 0xa00]
call fcn.0042db80
movzx edx, al
test edx, edx
je 0x467660
mov eax, dword [ebp - 0xa00]
mov dword [eax + 0x98c], 0xbb8
jmp 0x467670
mov ecx, dword [ebp - 0xa00]
mov dword [ecx + 0x98c], 0x7d0
call fcn.00483820
mov dword [ebp - 0xa20], eax
xor edx, edx
mov word [ebp - 0x554], dx
push 0x206
push 0
lea eax, [ebp - 0x552]
push eax
call fcn.00577360
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x554]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edx, [ebp - 0x554]
push edx
lea eax, [ebp - 0x82c]
push eax
call fcn.00484c60
add esp, 8
mov byte [ebp - 4], 0xd
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa20], 0
je 0x4676e8
mov dword [ebp - 0xa24], str.True
jmp 0x4676f2
mov dword [ebp - 0xa24], str.False
mov ecx, dword [ebp - 0xa24]
mov dword [ebp - 0xa40], ecx
push 0
push 2
push 0x5fd93c
push 0xc09
push 0x5fd90c
push 0x80
lea ecx, [ebp - 0xcac]
call fcn.00422610
mov dword [ebp - 0xa38], eax
mov edx, dword [ebp - 0xa38]
mov dword [ebp - 0xa44], edx
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0xa3c]
push eax
push str.__proc_id
lea ecx, [ebp - 0xa40]
push ecx
push str.__64Bit:
lea edx, [ebp - 0x82c]
push edx
push str._Downloader_version:
mov eax, dword [0x63c128]
push eax
push 1
mov ecx, dword [ebp - 0xa44]
push ecx
call fcn.004226f0
add esp, 0xc
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a8a0
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a8d0
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a930
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xcac]
call fcn.00422690
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0xa1c], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0xa18], eax
lea edx, [ebp - 0xa18]
push edx
lea eax, [ebp - 0xa1c]
push eax
call fcn.00484e40
add esp, 8
fstp qword [ebp - 0xb9c]
push 0
push 2
push 0x5fd9a4
push 0xc0c
push 0x5fd9f0
push 0x80
lea ecx, [ebp - 0xc74]
call fcn.00422610
mov dword [ebp - 0xa48], eax
mov ecx, dword [ebp - 0xa48]
mov dword [ebp - 0xa4c], ecx
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0xb9c]
push edx
push 0x5fda20
lea eax, [ebp - 0xa18]
push eax
push 0x5fda24
lea ecx, [ebp - 0xa1c]
push ecx
push str._Screen:
mov edx, dword [0x63c128]
push edx
push 1
mov eax, dword [ebp - 0xa4c]
push eax
call fcn.004226f0
add esp, 0xc
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a930
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a930
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.004734d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc74]
call fcn.00422690
push 0
push 2
push str.void___thiscall_InstallUIMainWnd::InitWindow_void_
push 0xc0d
push 0x5fda28
push 0x80
lea ecx, [ebp - 0xc3c]
call fcn.00422610
mov dword [ebp - 0xa50], eax
mov ecx, dword [ebp - 0xa50]
mov dword [ebp - 0xa54], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xa00]
mov eax, dword [edx + 0x988]
add eax, 0x1c
push eax
push str.__Language_Id_:
mov ecx, dword [ebp - 0xa00]
mov edx, dword [ecx + 0x988]
add edx, 0x18
push edx
push str.__Site_Id_:
mov eax, dword [ebp - 0xa00]
mov ecx, dword [eax + 0x988]
add ecx, 0x10
push ecx
push str._Downloader_Id_:
push str._Request_For_Product_Config___
mov edx, dword [0x63c128]
push edx
push 1
mov eax, dword [ebp - 0xa54]
push eax
call fcn.004226f0
add esp, 0xc
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a930
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a930
mov ecx, eax
call fcn.0043a870
mov ecx, eax
call fcn.0043a930
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc3c]
call fcn.00422690
mov ecx, dword [ebp - 0xa00]
push ecx
mov edx, dword [ebp - 0xa00]
mov eax, dword [edx + 0x988]
mov ecx, dword [eax + 0x34]
push ecx
mov edx, dword [ebp - 0xa00]
add edx, 0x96c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbcc], esp
push edx
call fcn.004138a0
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0xbc8], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0xa00]
movzx edx, byte [ecx + 0xa30]
push edx
mov eax, dword [ebp - 0xa00]
mov ecx, dword [eax + 0x988]
add ecx, 0xbc
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0xbc0], esp
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0xbbc], esp
push ecx
mov ecx, edx
call fcn.004138a0
mov dword [ebp - 0xbb8], eax
push esi
call fcn.00484470
add esp, 0x1c
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0xbb4], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0xa00]
mov edx, dword [ecx + 0x988]
add edx, 0x44
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0xbb0], esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbac], esp
push edx
call fcn.004138a0
mov dword [ebp - 0xba8], eax
push esi
call fcn.00484470
add esp, 0x1c
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xba4], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0xa00]
mov edx, dword [ecx + 0x988]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0xa00]
mov edx, dword [ecx + 0x988]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0xa00]
mov edx, dword [ecx + 0x988]
mov eax, dword [edx + 0x10]
push eax
call fcn.0048abf0
mov byte [ebp - 4], 0xd
mov ecx, eax
call fcn.0048c430
push 0
push 0x5e084a
push 0x5fdae4
push 0x5fdaf4
call fcn.0048abf0
mov ecx, eax
call fcn.0048ac90
push 0
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xba0], esp
push 0x5fdaec
call fcn.00411850
mov dword [ebp - 0xa64], eax
mov ecx, dword [ebp - 0xa64]
mov dword [ebp - 0xb74], ecx
mov byte [ebp - 4], 0x14
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbc4], esp
push str.Start
call fcn.00411850
mov dword [ebp - 0xa68], eax
mov edx, dword [ebp - 0xa68]
mov dword [ebp - 0xbd4], edx
mov byte [ebp - 4], 0x15
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbd8], esp
push 0x5fdb00
call fcn.00411850
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xbdc], eax
mov byte [ebp - 4], 0x16
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbe0], esp
push 0x5fdb28
call fcn.00411850
mov dword [ebp - 0xa70], eax
mov ecx, dword [ebp - 0xa70]
mov dword [ebp - 0xbe4], ecx
mov byte [ebp - 4], 0x17
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbe8], esp
push 0x5fdb1c
call fcn.00411850
mov dword [ebp - 0xa74], eax
mov edx, dword [ebp - 0xa74]
mov dword [ebp - 0xbec], edx
mov byte [ebp - 4], 0x18
call fcn.0048abf0
mov byte [ebp - 4], 0xd
mov ecx, eax
call fcn.0048d120
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbf4], esp
push 0x5fdb78
call fcn.00418610
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xbf8], eax
mov byte [ebp - 4], 0x19
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xbfc], esp
push 0x5fdb30
call fcn.00418610
mov dword [ebp - 0xc00], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x844]
push ecx
mov byte [ebp - 4], 0xd
call fcn.00483870
add esp, 0x38
mov dword [ebp - 0xc04], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x844]
call fcn.00411720
test eax, eax
jne 0x467dfa
push 0
mov ecx, dword [ebp - 0xa00]
call fcn.0046c9d0
movzx edx, al
test edx, edx
jne 0x467dfa
cmp dword [ebp - 0xa20], 0
je 0x467c55
mov dword [ebp - 0xa2c], 0x5fdb8c
jmp 0x467c5f
mov dword [ebp - 0xa2c], 0x5fdb84
lea eax, [ebp - 0x978]
push eax
call fcn.00481fd0
add esp, 4
mov dword [ebp - 0xa7c], eax
mov ecx, dword [ebp - 0xa7c]
mov dword [ebp - 0xa80], ecx
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0xa2c]
push edx
mov eax, dword [ebp - 0xa80]
push eax
lea ecx, [ebp - 0x85c]
push ecx
call fcn.0044bcc0
add esp, 0xc
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x978]
call fcn.00411780
lea edx, [ebp - 0x7cc]
push edx
call fcn.004823a0
add esp, 4
mov byte [ebp - 4], 0x1e
push 0
lea ecx, [ebp - 0x85c]
call fcn.00411740
push eax
push str.SysOS
push 0x5fdb94
call fcn.0048abf0
mov ecx, eax
call fcn.0048ac90
push 0
lea ecx, [ebp - 0x7cc]
call fcn.00411740
push eax
push str.SysLanguage
push 0x5fdba0
call fcn.0048abf0
mov ecx, eax
call fcn.0048ac90
mov byte [ebp - 0x40], 0
push 0x2f
push 0
lea eax, [ebp - 0x3f]
push eax
call fcn.00577360
add esp, 0xc
mov ecx, dword [ebp - 0xa18]
push ecx
mov edx, dword [ebp - 0xa1c]
push edx
push str._d_d
lea eax, [ebp - 0x40]
push eax
call fcn.0041aef0
add esp, 0x10
push 0
lea ecx, [ebp - 0x40]
push ecx
push str.SysScreenResolution
push 0x5fdbd0
call fcn.0048abf0
mov ecx, eax
call fcn.0048ac90
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb08], esp
push 0x5fdbcc
call fcn.00418610
mov dword [ebp - 0xa84], eax
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xb0c], edx
mov byte [ebp - 4], 0x1f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb10], esp
push str.GA_PC
call fcn.00418610
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0xb14], eax
mov byte [ebp - 4], 0x20
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb18], esp
push str.SOFTWARETenorshareDownloader2.5.0
call fcn.00418610
mov dword [ebp - 0xb1c], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x1e
call fcn.004839d0
add esp, 0x4c
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x7cc]
call fcn.00411780
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x85c]
call fcn.00411780
push 0
mov ecx, dword [ebp - 0xa00]
call fcn.0046c9d0
movzx ecx, al
test ecx, ecx
jne 0x4680f6
push 0
push 0x5e084b
push str.1.Launch
push 0x5fdc3c
call fcn.0048abf0
mov ecx, eax
call fcn.0048ac90
push 0
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb20], esp
push 0x5fdc34
call fcn.00411850
mov dword [ebp - 0xa8c], eax
mov edx, dword [ebp - 0xa8c]
mov dword [ebp - 0xb24], edx
mov byte [ebp - 4], 0x21
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb28], esp
push 0x5fdc54
call fcn.00411850
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xb2c], eax
mov byte [ebp - 4], 0x22
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb30], esp
push 0x5fdc48
call fcn.00411850
mov dword [ebp - 0xa94], eax
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0xb34], ecx
mov byte [ebp - 4], 0x23
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb38], esp
push 0x5fdc74
call fcn.00411850
mov dword [ebp - 0xa98], eax
mov edx, dword [ebp - 0xa98]
mov dword [ebp - 0xb3c], edx
mov byte [ebp - 4], 0x24
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb40], esp
push 0x5fdc64
call fcn.00411850
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xb44], eax
mov byte [ebp - 4], 0x25
call fcn.0048abf0
mov byte [ebp - 4], 0x1a
mov ecx, eax
call fcn.0048d120
push 0
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb48], esp
push 0x5fdc8c
call fcn.00411850
mov dword [ebp - 0xaa0], eax
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp - 0xb4c], ecx
mov byte [ebp - 4], 0x26
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb50], esp
push str.Launch
call fcn.00411850
mov dword [ebp - 0xaa4], eax
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb54], edx
mov byte [ebp - 4], 0x27
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb58], esp
push 0x5fdca4
call fcn.00411850
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xb5c], eax
mov byte [ebp - 4], 0x28
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb60], esp
push 0x5fdc94
call fcn.00411850
mov dword [ebp - 0xaac], eax
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xb64], ecx
mov byte [ebp - 4], 0x29
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb68], esp
push 0x5fdcb8
call fcn.00411850
mov dword [ebp - 0xab0], eax
mov edx, dword [ebp - 0xab0]
mov dword [ebp - 0xb6c], edx
mov byte [ebp - 4], 0x2a
call fcn.0048abf0
mov byte [ebp - 4], 0x1a
mov ecx, eax
call fcn.0048d120
push 0
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb70], esp
push 0x5fdcb0
call fcn.00411850
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xbf0], eax
mov byte [ebp - 4], 0x2b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb78], esp
push 0x5fdcd4
call fcn.00411850
mov dword [ebp - 0xab8], eax
mov ecx, dword [ebp - 0xab8]
mov dword [ebp - 0xb7c], ecx
mov byte [ebp - 4], 0x2c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb80], esp
push 0x5fdcc8
call fcn.00411850
mov dword [ebp - 0xabc], eax
mov edx, dword [ebp - 0xabc]
mov dword [ebp - 0xb84], edx
mov byte [ebp - 4], 0x2d
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb88], esp
push 0x5fdcf0
call fcn.00411850
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xb8c], eax
mov byte [ebp - 4], 0x2e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb90], esp
push 0x5fdce0
call fcn.00411850
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xac4]
mov dword [ebp - 0xb94], ecx
mov byte [ebp - 4], 0x2f
call fcn.0048abf0
mov byte [ebp - 4], 0x1a
mov ecx, eax
call fcn.0048d120
push 0x8f
mov ecx, dword [ebp - 0xa00]
call fcn.004b1504
mov ecx, dword [ebp - 0xa00]
call fcn.00466a20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0xac8], eax
mov edx, dword [ebp - 0xac8]
sub edx, dword [ebp - 0xacc]
mov dword [ebp - 0xad0], edx
mov byte [ebp - 0x144], 0
push 0x103
push 0
lea eax, [ebp - 0x143]
push eax
call fcn.00577360
add esp, 0xc
mov ecx, dword [ebp - 0xad0]
push ecx
push 0x5fdd10
lea edx, [ebp - 0x144]
push edx
call fcn.0043a9c0
add esp, 0xc
push 0
mov ecx, dword [ebp - 0xa00]
call fcn.0046c9d0
movzx eax, al
test eax, eax
jne 0x46819a
push 0
lea ecx, [ebp - 0x144]
push ecx
push str.ClickToShowTime
push 0x5fdd1c
call fcn.0048abf0
mov ecx, eax
call fcn.0048ac90
call fcn.00486c90
movzx edx, al
test edx, edx
je 0x4681c2
push 0
push 0x7d0
push 0x29a
mov eax, dword [ebp - 0xa00]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x844]
call fcn.00413710
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x82c]
call fcn.00411780
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x79c]
call fcn.00413710
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x784]
call fcn.00413710
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9fc]
call fcn.004b01a7
lea esp, [ebp - 0xcb4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a39ef
mov esp, ebp
pop ebp
ret