Function at 0x425616
Capabilities:
Check for time delay via gettickcount
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create reverse shell
Parse pe header
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
sub esp, 0x74
lea ebp, [esp - 4]
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp + 0x74], eax
push 0x2e0
mov eax, 0x497d80
call fcn.00470906
mov esi, ecx
push str.install_thread:_entering
lea ecx, [ebp + 0x5c]
call fcn.0044e280
and dword [ebp - 4], 0
lea eax, [ebp + 0x5c]
push eax
call fcn.00404620
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp + 0x5c]
call fcn.0044e260
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [esi + 0x1f8]
mov ecx, edi
mov dword [esi + 0x6a0], eax
mov dword [ebp - 0x20], edi
call fcn.004184b0
and dword [esi + 0x6bc], 0
xor ebx, ebx
inc ebx
push ebx
mov ecx, edi
call fcn.00413867
and dword [ebp - 0x10], 0
and dword [ebp - 0x40], 0
lea ecx, [ebp - 0x58]
mov dword [ebp + 0x24], ebx
call fcn.0044f350
mov eax, dword [esi + 0x5fc]
mov dword [ebp - 4], ebx
cmp eax, dword [esi + 0x600]
je 0x425769
lea edi, [eax + 0x84]
cmp dword [edi - 0x78], 0
lea eax, [edi - 0x7c]
mov dword [ebp + 0x1c], eax
je 0x4256e7
mov ecx, edi
call fcn.0044e020
test eax, eax
je 0x4256e7
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.00401283
pop ecx
pop ecx
test al, al
jne 0x4256fd
add edi, 0xe0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x600]
jne 0x4256bc
jmp 0x425769
cmp dword [esi + 0x4b0], 0
je 0x42575b
push str.install_thread:_closing_browsers
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 2
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
mov ecx, esi
call fcn.00419aaa
push str.install_thread:_back_from_closing_browsers
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 3
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x40], ebx
call fcn.0044f400
push str.install_thread:_here1
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 4
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
mov edi, dword [esi + 0x5fc]
cmp edi, dword [esi + 0x600]
je 0x425807
add edi, 0x84
cmp dword [edi - 0x78], 0
je 0x4257f3
mov ecx, edi
call fcn.0044e020
test eax, eax
je 0x4257f3
lea eax, [edi - 0x30]
push str.main
push eax
call fcn.004012cb
pop ecx
pop ecx
test al, al
je 0x4257f3
inc dword [ebp - 0x10]
lea eax, [edi - 0x20]
push str.post
push eax
call fcn.00401283
pop ecx
pop ecx
test al, al
lea eax, [edi - 0x7c]
lea ecx, [ebp - 0x58]
push eax
je 0x4257ee
call fcn.0044f450
jmp 0x4257f3
call fcn.0044f400
add edi, 0xe0
lea ecx, [edi - 0x84]
cmp ecx, dword [esi + 0x600]
jne 0x4257a4
mov edi, str.install_thread:_here2
push edi
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 5
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
cmp dword [ebp - 0x48], 0
jle 0x42781d
push edi
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 6
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
mov eax, dword [esi + 0x24]
test eax, eax
je 0x425d50
lea ecx, [esi + 0x64]
cmp byte [ecx + 7], 0xff
lea edx, [esi + 8]
jne 0x425875
mov ecx, dword [ecx]
push ecx
push edx
call eax
pop ecx
pop ecx
test eax, eax
jne 0x425d50
push str.install_thread:_here3
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 7
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
mov eax, dword [esi + 0x67c]
cmp eax, 1
jb 0x425d45
push eax
push 0x2c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 0x4f0]
call fcn.0044ebe0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 0x660]
mov byte [ebp - 4], 8
call fcn.004255a1
add eax, 4
push eax
lea eax, [ebp + 0x4c]
push str.actioncancelvalue
push eax
call fcn.0044eb90
add esp, 0xc
mov edx, dword [esi]
push 1
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call dword [edx + 0x10]
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 8
call fcn.0044e260
push str.actionpageviewvaluecancel
lea ecx, [ebp + 0x5c]
call fcn.0044e280
mov eax, dword [esi]
push 0xa
lea ecx, [ebp + 0x5c]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xa
call dword [eax + 0x10]
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 8
call fcn.0044e260
push str.overinstall
lea ecx, [ebp + 0x5c]
call fcn.0044e280
cmp dword [esi + 0x4c], 0
mov byte [ebp - 4], 0xb
jne 0x425d2d
lea ebx, [esi + 0x468]
mov ecx, ebx
call fcn.00401219
test al, al
jne 0x425d2d
push ebx
lea ecx, [ebp + 0x54]
call fcn.0044e1c0
cmp byte [ebp + 0x5b], 0xff
mov byte [ebp - 4], 0xc
lea eax, [ebp + 0x54]
jne 0x425980
mov eax, dword [ebp + 0x54]
push 0x4a2770
push eax
call fcn.0046f770
pop ecx
test eax, eax
lea eax, [esi + 0x164]
pop ecx
push eax
lea eax, [ebp + 0x4c]
jne 0x4259af
push str._distcode
push eax
call fcn.0044eb90
add esp, 0xc
mov byte [ebp - 4], 0xd
jmp 0x4259c1
push 0x4a34c8
push eax
call fcn.0044eb90
add esp, 0xc
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp + 0x54]
call fcn.0044e7c0
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0xc
call fcn.0044e260
lea eax, [esi + 0x1a8]
push eax
lea eax, [ebp + 0x4c]
push 0x4a34c0
push eax
call fcn.0044eb90
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0xf
call fcn.0044e7c0
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0xc
call fcn.0044e260
lea eax, [esi + 0x190]
push eax
lea eax, [ebp + 0x4c]
push str.li
push eax
call fcn.0044eb90
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x10
call fcn.0044e7c0
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0xc
call fcn.0044e260
lea ecx, [ebp]
call fcn.0044e010
mov eax, dword [esi + 0x67c]
mov byte [ebp - 4], 0x11
cmp eax, 1
jb 0x425a7a
push eax
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [esi + 0x4f0]
call fcn.0044ebe0
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 0x12
call fcn.0044e310
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x11
call fcn.0044e260
lea eax, [ebp]
push eax
lea eax, [ebp + 0x4c]
push str.cancelled
push eax
call fcn.0044eb90
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x13
call fcn.0044e7c0
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x11
call fcn.0044e260
lea ecx, [ebp + 0x3c]
call fcn.0044e010
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 0x14
call fcn.0044e010
mov edi, dword [esi + 0x5fc]
mov byte [ebp - 4], 0x15
cmp edi, dword [esi + 0x600]
je 0x425bb5
mov ebx, 0x4a31b0
cmp dword [edi + 8], 0
je 0x425b3d
lea ecx, [ebp + 0x3c]
call fcn.00401219
test al, al
jne 0x425b13
push ebx
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.0044eb40
add esp, 0xc
push eax
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x16
call fcn.0044e310
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x15
call fcn.0044e260
push edi
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0044eaf0
add esp, 0xc
push eax
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x17
call fcn.0044e310
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x15
call fcn.0044e260
cmp dword [edi + 0xc], 0
je 0x425ba3
lea ecx, [ebp + 0x2c]
call fcn.00401219
test al, al
jne 0x425b79
push ebx
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0044eb40
add esp, 0xc
push eax
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 0x18
call fcn.0044e310
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x15
call fcn.0044e260
push edi
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0044eaf0
add esp, 0xc
push eax
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 0x19
call fcn.0044e310
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x15
call fcn.0044e260
add edi, 0xe0
cmp edi, dword [esi + 0x600]
jne 0x425ad7
lea ecx, [ebp + 0x3c]
call fcn.00401219
test al, al
je 0x425bce
push str.none
lea ecx, [ebp + 0x3c]
call fcn.0044e3b0
lea ecx, [ebp + 0x2c]
call fcn.00401219
test al, al
je 0x425be7
push str.none
lea ecx, [ebp + 0x2c]
call fcn.0044e3b0
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x34]
push str.displayedoffer
push eax
call fcn.0044eb90
push str.acceptedoffer
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0x1a
call fcn.0044eb40
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp + 0x4c]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0044eaf0
add esp, 0x24
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x1c
call fcn.0044e7c0
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x1b
call fcn.0044e260
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x1a
call fcn.0044e260
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x15
call fcn.0044e260
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x4c]
push str.action
push eax
call fcn.0044eb90
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x1d
call fcn.0044e7c0
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x15
call fcn.0044e260
push 0x38
xor edi, edi
lea eax, [ebp - 0x2e8]
push edi
push eax
call fcn.00470280
add esp, 0xc
cmp byte [ebp + 0x5b], 0xff
mov dword [ebp - 0x2ec], 0x3c
mov dword [ebp - 0x2e8], 0x440
mov dword [ebp - 0x2e4], edi
mov dword [ebp - 0x2e0], 0x4a09d8
lea eax, [ebp + 0x54]
jne 0x425cc4
mov eax, dword [ebp + 0x54]
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 0x2ec]
push eax
mov dword [ebp - 0x2d8], edi
mov dword [ebp - 0x2d4], edi
mov dword [ebp - 0x2d0], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x425cfd
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 0x14
call fcn.0044e260
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x11
call fcn.0044e260
lea ecx, [ebp]
mov byte [ebp - 4], 0xc
call fcn.0044e260
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0xb
call fcn.0044e260
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 8
call fcn.0044e260
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0044e260
and dword [ebp + 0x24], 0
mov dword [esi + 0x14], 1
push str.install_thread:_here4
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
cmp dword [ebp + 0x24], 0
je 0x42781d
push 0x4a4f18
lea ecx, [ebp + 0x5c]
call fcn.0044e280
lea eax, [ebp + 0x5c]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 1
call fcn.0044e260
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x48]
jge 0x42781d
mov eax, dword [esi + 0x6bc]
push dword [ebp - 0x14]
and dword [esi + 0x6c8], 0
lea ecx, [ebp - 0x58]
mov dword [esi + 0x6b8], eax
call fcn.0044f630
push eax
lea ecx, [ebp - 0x58]
call fcn.0044f4b0
mov ebx, dword [eax]
lea eax, [ebx + 0x4c]
push str.main
push eax
mov dword [ebp + 0x28], ebx
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x425e08
mov eax, dword [ebp - 0x48]
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffec
add eax, 0x64
jmp 0x425e28
cmp dword [ebp - 0x40], 0
fild dword [ebp - 0x10]
fld1
fdivrp st(1)
je 0x425e1d
fmul qword [0x4a4f08]
jmp 0x425e23
fmul qword [0x4a2d20]
call fcn.004742e0
and dword [ebp + 0x10], 0
mov dword [esi + 0x6c8], eax
lea eax, [ebx + 0x3c]
push eax
lea ecx, [esi + 0x5e8]
mov byte [ebp - 4], 0x20
call fcn.0041e753
test eax, eax
je 0x425e63
lea eax, [ebx + 0x3c]
push eax
lea ecx, [esi + 0x5e8]
call fcn.00420e8e
push dword [eax + 0x2c]
lea ecx, [ebp + 0x10]
call fcn.0041bc7f
cmp dword [ebx + 4], 0
je 0x427722
lea eax, [ebx + 0x4c]
push str.main
push eax
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x425f89
push str.clean
lea ecx, [ebp - 0x60]
call fcn.0044e280
mov eax, dword [esi + 0x52c]
mov byte [ebp - 4], 0x21
cmp eax, 1
jne 0x425ea8
push str.over
jmp 0x425eb2
cmp eax, 0xffffffff
jne 0x425eba
push str.under
lea ecx, [ebp - 0x60]
call fcn.0044e3b0
lea edi, [ebx + 0x3c]
push edi
lea eax, [ebp - 0x164]
push str.actioninstallerstartedvalue
push eax
call fcn.0044eb90
push str.installtype
push eax
lea eax, [ebp - 0x2a8]
push eax
mov byte [ebp - 4], 0x22
call fcn.0044eb40
lea ecx, [ebp - 0x60]
push ecx
push eax
lea eax, [ebp - 0x298]
push eax
mov byte [ebp - 4], 0x23
call fcn.0044eaf0
push str.webuserid
push eax
lea eax, [ebp - 0x288]
push eax
mov byte [ebp - 4], 0x24
call fcn.0044eb40
lea ecx, [esi + 0x174]
push ecx
push eax
lea eax, [ebp - 0x278]
push eax
mov byte [ebp - 4], 0x25
call fcn.0044eaf0
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x26
call dword [edx + 0x10]
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x25
call fcn.0044e260
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x24
call fcn.0044e260
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x23
call fcn.0044e260
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x22
call fcn.0044e260
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 0x21
call fcn.0044e260
lea ecx, [ebp - 0x60]
jmp 0x426001
lea edi, [ebx + 0x3c]
push edi
lea eax, [ebp - 0x290]
push str.actioninstallerstartedvalue
push eax
call fcn.0044eb90
push str.webuserid
push eax
lea eax, [ebp - 0x174]
push eax
mov byte [ebp - 4], 0x27
call fcn.0044eb40
lea ecx, [esi + 0x174]
push ecx
push eax
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 0x28
call fcn.0044eaf0
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x29
call dword [edx + 0x10]
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x28
call fcn.0044e260
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x27
call fcn.0044e260
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x20
call fcn.0044e260
lea ecx, [ebp - 0x1c]
call fcn.0044e010
lea eax, [ebx + 0x54]
push 0x4a1028
push eax
mov byte [ebp - 4], 0x2a
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x42641a
push str.install_thread:_pkg__rp
lea ecx, [ebp - 0xdc]
call fcn.0044e280
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 0x2b
call fcn.00404620
pop ecx
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
push edi
lea ecx, [esi + 0x5d4]
call fcn.0040b190
mov dword [ebp + 0x48], eax
lea eax, [ebp - 0x220]
push eax
mov ecx, esi
call fcn.004184e8
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x184]
push eax
mov byte [ebp - 4], 0x2c
call fcn.0044eb40
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x2d
jne 0x4260a0
mov eax, dword [eax]
push 0x4a1268
push eax
call fcn.0047136f
pop ecx
pop ecx
lea ecx, [ebp - 0x184]
mov ebx, eax
mov byte [ebp - 4], 0x2c
call fcn.0044e260
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
test ebx, ebx
je 0x426227
push str.StubInstall1_r_n
push ebx
call fcn.00472a4f
push str.AlwaysUseDefInstallPath1_r_n
push ebx
call fcn.00472a4f
add esp, 0x10
lea ecx, [esi + 0x164]
call fcn.00401219
test al, al
jne 0x426135
push 1
lea ecx, [esi + 0x164]
call fcn.0044ec10
push eax
push str.DistCode_s_r_n
push ebx
call fcn.00472a4f
add esp, 0xc
push 1
lea ecx, [esi + 0x164]
call fcn.0044ec10
push eax
push str.OrigCode_s_r_n
push ebx
call fcn.00472a4f
add esp, 0xc
mov eax, dword [ebp + 0x48]
mov edi, dword [eax]
jmp 0x426183
mov ecx, edi
call fcn.00401219
test al, al
jne 0x42616a
push 0
lea ecx, [edi + 8]
call fcn.0044ec10
push eax
push 0
mov ecx, edi
call fcn.0044ec10
push eax
push str._s_s_r_n
push ebx
call fcn.00472a4f
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [edi + 8]
call fcn.0044eca0
push 0xffffffffffffffff
mov ecx, edi
call fcn.0044eca0
mov eax, dword [ebp + 0x48]
add edi, 0x10
cmp edi, dword [eax + 4]
jne 0x42613c
push ebx
call fcn.00470ed8
pop ecx
lea eax, [ebp - 0x230]
push eax
mov ecx, esi
call fcn.004184e8
mov edi, eax
push str.__cfg
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0x2e
call fcn.0044e280
push edi
push eax
lea eax, [ebp - 0x270]
push eax
mov byte [ebp - 4], 0x2f
call fcn.0044eaf0
push str.rnsetup.cfg
push eax
lea eax, [ebp - 0x194]
push eax
mov byte [ebp - 4], 0x30
call fcn.0044eb40
add esp, 0x18
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x31
call fcn.0044e310
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0x30
call fcn.0044e260
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x2f
call fcn.0044e260
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0x2e
call fcn.0044e260
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
mov eax, dword [ebp + 0x28]
add eax, 0x7c
push str..manifest
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.0044eb40
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 0x32
jne 0x42624e
mov eax, dword [eax]
push 0x4a1268
push eax
call fcn.0047136f
pop ecx
pop ecx
lea ecx, [ebp - 0x1b4]
mov edi, eax
mov byte [ebp - 4], 0x2a
call fcn.0044e260
test edi, edi
je 0x4263e7
push str.__xml_version_1.0__encoding_UTF_8__standalone_yes____r_n
push edi
call fcn.00472a4f
push str._assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0___r_n
push edi
call fcn.00472a4f
push str._____assemblyIdentity_r_n
push edi
call fcn.00472a4f
push str.________version_1.0.0.0__r_n
push edi
call fcn.00472a4f
push str.________processorArchitecture_X86__r_n
push edi
call fcn.00472a4f
push str.________name_rnmininst.exe__r_n
push edi
call fcn.00472a4f
push str.________type_win32__r_n
push edi
call fcn.00472a4f
push str._______r_n
push edi
call fcn.00472a4f
add esp, 0x40
push str._____description_RealPlayer_Installer__description__r_n
push edi
call fcn.00472a4f
push str._____dependency__r_n
push edi
call fcn.00472a4f
push str._________dependentAssembly__r_n
push edi
call fcn.00472a4f
push str._____________assemblyIdentity_r_n
push edi
call fcn.00472a4f
push str.________________type_win32__r_n
push edi
call fcn.00472a4f
push str.________________name_Microsoft.Windows.Common_Controls__r_n
push edi
call fcn.00472a4f
push str.________________version_6.0.0.0__r_n
push edi
call fcn.00472a4f
push str.________________processorArchitecture_X86__r_n
push edi
call fcn.00472a4f
add esp, 0x40
push str.________________publicKeyToken_6595b64144ccf1df__r_n
push edi
call fcn.00472a4f
push str.________________language___r_n
push edi
call fcn.00472a4f
push str._______________r_n
push edi
call fcn.00472a4f
push str.__________dependentAssembly__r_n
push edi
call fcn.00472a4f
push str.______dependency__r_n
push edi
call fcn.00472a4f
push str._____trustInfo_xmlns_urn:schemas_microsoft_com:asm.v3___r_n
push edi
call fcn.00472a4f
push str._________security__r_n
push edi
call fcn.00472a4f
push str._____________requestedPrivileges__r_n
push edi
call fcn.00472a4f
add esp, 0x40
push str._________________requestedExecutionLevel_r_n
push edi
call fcn.00472a4f
push str.____________________level_requireAdministrator__r_n
push edi
call fcn.00472a4f
push str.____________________uiAccess_false__r_n
push edi
call fcn.00472a4f
push str.___________________r_n
push edi
call fcn.00472a4f
push str.______________requestedPrivileges__r_n
push edi
call fcn.00472a4f
push str.__________security__r_n
push edi
call fcn.00472a4f
push str.______trustInfo__r_n
push edi
call fcn.00472a4f
push str.__assembly__r_n
push edi
call fcn.00472a4f
add esp, 0x40
push edi
call fcn.00470ed8
pop ecx
push str.install_thread:_end_of_RP_package_setup
lea ecx, [ebp - 0xec]
call fcn.0044e280
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], 0x33
call fcn.00404620
pop ecx
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
mov ebx, dword [ebp + 0x28]
push str.install_thread:_here6
lea ecx, [ebp - 0xfc]
call fcn.0044e280
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0x34
call fcn.00404620
pop ecx
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
lea ecx, [ebx + 0x7c]
call fcn.0044e020
test eax, eax
je 0x427704
push str.install_thread:_here7
lea ecx, [ebp - 0x10c]
call fcn.0044e280
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 4], 0x35
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
mov dword [esi + 0x6d4], 1
mov dword [esi + 0x6d8], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x6cc], eax
mov edi, 0x4a0c2c
push edi
lea eax, [ebx + 0x84]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0044eb40
lea ecx, [ebx + 0x8c]
push ecx
push eax
lea eax, [ebp - 0x154]
push eax
mov byte [ebp - 4], 0x36
call fcn.0044eaf0
push edi
push eax
lea eax, [ebp - 0x2b0]
push eax
mov byte [ebp - 4], 0x37
call fcn.0044eb40
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp + 0x14]
push eax
mov byte [ebp - 4], 0x38
call fcn.0044eaf0
add esp, 0x30
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x3a
call fcn.0044e260
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x3b
call fcn.0044e260
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x3c
call fcn.0044e260
lea eax, [ebx + 0x3c]
cmp byte [eax + 7], 0xff
jne 0x42653a
mov eax, dword [eax]
push str.chrhlpr
push eax
call fcn.0046f770
pop ecx
pop ecx
test eax, eax
je 0x4265d9
and dword [ebp + 0x48], 0
mov eax, dword [ebp + 0x48]
cmp eax, dword [ebp - 0x48]
jge 0x4265d9
push eax
lea ecx, [ebp - 0x58]
call fcn.0044f630
push eax
lea ecx, [ebp - 0x58]
call fcn.0044f4b0
mov edi, dword [eax]
lea ecx, [ebx + 0x3c]
lea eax, [edi + 0x3c]
push ecx
push eax
mov dword [ebp + 0x1c], eax
call fcn.004012a1
pop ecx
pop ecx
test al, al
je 0x4265cc
push str.main
add edi, 0x4c
push edi
call fcn.004012cb
pop ecx
pop ecx
test al, al
je 0x4265cc
push dword [ebp + 0x1c]
lea eax, [ebp - 0x1d0]
push str.__pkg
push eax
call fcn.0044eb90
add esp, 0xc
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x3d
call fcn.0044e7c0
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x3c
call fcn.0044e260
inc dword [ebp + 0x48]
mov edi, 0x4a0c2c
jmp 0x426553
xor eax, eax
push eax
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x28], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x20], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.0040bc40
add esp, 0xc
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x3e
call fcn.0044e310
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x3c
call fcn.0044e260
push edi
lea edi, [ebx + 0x7c]
lea eax, [ebp - 0x1e0]
push edi
push eax
call fcn.0044eb40
lea ecx, [ebp + 0x14]
push ecx
push eax
lea eax, [ebp + 0x3c]
push eax
mov byte [ebp - 4], 0x3f
call fcn.0044eaf0
add esp, 0x18
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x41
call fcn.0044e260
cmp dword [esi + 0x708], 0
je 0x426760
push str.install_thread:_here7
lea ecx, [ebp - 0x12c]
call fcn.0044e280
lea eax, [ebp - 0x12c]
push eax
mov byte [ebp - 4], 0x42
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x41
call fcn.0044e260
xor edi, edi
push edi
push edi
mov eax, 0x104
push eax
push eax
push 0xff
push 6
push 3
push str..pipe_realnetworks.installer.pipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp + 0x20], eax
cmp eax, 0xffffffff
je 0x427745
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4266d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x42776a
lea eax, [ebx + 0xcc]
push 0x4a09d0
push eax
mov dword [ebp - 0xac], edi
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x426725
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x250]
push 0x4a099c
push eax
call fcn.0044eb90
add esp, 0xc
push eax
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x45
call fcn.0044e310
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x41
call fcn.0044e260
cmp byte [ebp + 0x43], 0xff
lea eax, [ebp + 0x3c]
jne 0x426731
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x44], eax
push edi
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0044e020
inc eax
push eax
push dword [ebp + 0x44]
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp + 0x44], 1
xor edi, edi
jmp 0x426df1
push str.install_thread:_here8
lea ecx, [ebp - 0x13c]
call fcn.0044e280
lea eax, [ebp - 0x13c]
push eax
mov byte [ebp - 4], 0x46
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x41
call fcn.0044e260
push 3
lea eax, [ebp - 0x1f0]
push eax
mov ecx, edi
call fcn.0044e9d0
push 0x4a4948
push eax
mov byte [ebp - 4], 0x47
call fcn.00401283
pop ecx
pop ecx
lea ecx, [ebp - 0x1f0]
mov byte [ebp + 0x67], al
mov byte [ebp - 4], 0x41
call fcn.0044e260
cmp byte [ebp + 0x67], 0
je 0x426cd1
push str.install_thread:_msi_install
lea ecx, [ebp - 0x14c]
call fcn.0044e280
lea eax, [ebp - 0x14c]
push eax
mov byte [ebp - 4], 0x48
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0x41
call fcn.0044e260
push 0
push 2
call sub.msi.dll_MsiSetPropertyW
and dword [esi + 0x6c0], 0
push esi
push 0x20034a3
push 0x41bdea
call sub.msi.dll_MsiSetInstallLevel
lea ecx, [ebp + 0x54]
mov dword [0x4c3458], eax
call fcn.0044e010
push 0x4a4928
lea edi, [ebx + 0x3c]
push edi
mov byte [ebp - 4], 0x49
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x426b2b
lea eax, [esi + 0x164]
push eax
lea ecx, [ebp - 0x70]
call fcn.0044e1c0
lea eax, [esi + 0x7c]
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x4a
call fcn.0044e1c0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x4b
call fcn.00401219
test al, al
je 0x426885
push 0x4a4924
lea ecx, [ebp - 0x70]
call fcn.0044e3b0
lea ecx, [ebp - 0xa0]
call fcn.00401219
test al, al
je 0x4268a4
push 0x4a4924
lea ecx, [ebp - 0xa0]
call fcn.0044e3b0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x260]
push str._DISTCODE
push eax
call fcn.0044eb90
push str._ORIGINCODE
push eax
lea eax, [ebp - 0x200]
push eax
mov byte [ebp - 4], 0x4c
call fcn.0044eb40
lea ecx, [esi + 0x74]
push ecx
push eax
lea eax, [ebp - 0x2a0]
push eax
mov byte [ebp - 4], 0x4d
call fcn.0044eaf0
add esp, 0x24
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x4e
call fcn.0044e310
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0x4d
call fcn.0044e260
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x4c
call fcn.0044e260
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x4b
call fcn.0044e260
push str.DefInstallPath
lea ecx, [ebp - 0x11c]
call fcn.0044e280
push 0x4a4928
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x4f
call fcn.0044e280
lea eax, [ebp - 0x144]
push eax
lea ecx, [esi + 0x5d4]
mov byte [ebp - 4], 0x50
call fcn.0040b190
lea ecx, [ebp - 0x11c]
push ecx
mov ecx, eax
call fcn.00407a80
test eax, eax
lea ecx, [ebp - 0x144]
setne byte [ebp + 0x67]
mov byte [ebp - 4], 0x4f
call fcn.0044e260
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x4b
call fcn.0044e260
cmp byte [ebp + 0x67], 0
je 0x426a74
push str.DefInstallPath
lea ecx, [ebp - 0x114]
call fcn.0044e280
push 0x4a4928
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x51
call fcn.0044e280
lea eax, [ebp - 0xd4]
push eax
lea ecx, [esi + 0x5d4]
mov byte [ebp - 4], 0x52
call fcn.0040b190
lea ecx, [ebp - 0x114]
push ecx
mov ecx, eax
call fcn.00409f60
push eax
lea ecx, [ebp - 0xe4]
call fcn.0044e1c0
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x54
call fcn.0044e260
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x55
call fcn.0044e260
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x16c]
push str._INSTALLDIR_
push eax
call fcn.0044eb90
push 0x4a0a88
push eax
lea eax, [ebp - 0x15c]
push eax
mov byte [ebp - 4], 0x56
call fcn.0044eb40
add esp, 0x18
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x57
call fcn.0044e7c0
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 0x56
call fcn.0044e260
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x55
call fcn.0044e260
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 0x4b
call fcn.0044e260
push str._system_appdata_RealNetworks
lea ecx, [ebp - 0x134]
call fcn.0044e280
push 0
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x17c]
push eax
mov byte [ebp - 4], 0x58
call fcn.0040bc40
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x59
call fcn.0044e310
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0x58
call fcn.0044e260
cmp byte [ebp + 0x5b], 0xff
lea eax, [ebp + 0x54]
jne 0x426ac8
mov eax, dword [ebp + 0x54]
push eax
call fcn.00491fde
lea ecx, [ebp + 0x54]
mov dword [esp], 0x4a48c8
call fcn.0044e6e0
cmp byte [ebp + 0x5b], 0xff
lea eax, [ebp + 0x54]
jne 0x426ae9
mov eax, dword [ebp + 0x54]
push eax
call fcn.00491fde
lea ecx, [ebp + 0x54]
mov dword [esp], str.RealDownloader_log.txt
call fcn.0044e6e0
lea ecx, [ebp - 0x134]
mov dword [ebp + 0x48], 0xe97
mov byte [ebp - 4], 0x4b
call fcn.0044e260
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x4a
call fcn.0044e260
lea ecx, [ebp - 0x70]
jmp 0x426bdd
push str._temp__
lea ecx, [ebp - 0xf4]
mov dword [ebp + 0x48], 0x1000
call fcn.0044e280
push 0
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x18c]
push eax
mov byte [ebp - 4], 0x5a
call fcn.0040bc40
add esp, 0xc
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x5b
call fcn.0044e310
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x5a
call fcn.0044e260
cmp byte [ebp + 0x5b], 0xff
lea eax, [ebp + 0x54]
jne 0x426b86
mov eax, dword [ebp + 0x54]
push eax
call fcn.00491fde
pop ecx
lea ecx, [ebp - 0x90]
call fcn.0044e010
cmp byte [edi + 7], 0xff
mov byte [ebp - 4], 0x5c
jne 0x426ba4
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x90]
push str.DLP__s_log.txt
push eax
call fcn.0044ee50
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp + 0x54]
call fcn.0044e7c0
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x5a
call fcn.0044e260
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x49
call fcn.0044e260
cmp byte [ebp + 0x5b], 0xff
lea eax, [ebp + 0x54]
jne 0x426bf2
mov eax, dword [ebp + 0x54]
push 2
push eax
push dword [ebp + 0x48]
call sub.msi.dll_MsiGetComponentPathA
lea edi, [ebx + 0x7c]
push edi
lea eax, [ebp - 0x1ac]
push str.msiexec__i
push eax
call fcn.0044eb90
lea ecx, [ebp + 0x14]
push ecx
push eax
lea eax, [ebp - 0x19c]
push eax
mov byte [ebp - 4], 0x5d
call fcn.0044eaf0
add esp, 0x18
push eax
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x5e
call fcn.0044e310
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0x5d
call fcn.0044e260
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0x49
call fcn.0044e260
cmp byte [ebp + 0x1b], 0xff
lea eax, [ebp + 0x14]
jne 0x426c61
mov eax, dword [ebp + 0x14]
cmp byte [edi + 7], 0xff
jne 0x426c69
mov edi, dword [edi]
push eax
push edi
call sub.msi.dll_MsiOpenDatabaseA
test eax, eax
jne 0x426c81
inc eax
and dword [ebp + 0x48], 0
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x28], eax
jmp 0x426c90
xor ecx, ecx
inc ecx
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0xc], eax
push str.install_thread:_end_msi_install
lea ecx, [ebp - 0x124]
call fcn.0044e280
lea eax, [ebp - 0x124]
push eax
mov byte [ebp - 4], 0x5f
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0x49
call fcn.0044e260
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x41
call fcn.0044e260
jmp 0x426759
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x426d5f
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
test eax, eax
je 0x426d5f
push str.install_thread:_IRNDownloadPartnerInstall
lea ecx, [ebp - 0x104]
call fcn.0044e280
lea eax, [ebp - 0x104]
push eax
mov byte [ebp - 4], 0x60
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x41
call fcn.0044e260
and dword [ebp - 0x44], 0
mov eax, dword [edi]
lea ecx, [ebp - 0x44]
push ecx
push edi
call dword [eax + 0x10]
xor eax, eax
inc eax
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x28], eax
mov eax, dword [ebp - 0x44]
push str.install_thread:_end_IRNDownloadPartnerInstall
lea ecx, [ebp - 0xc4]
mov dword [ebp + 0xc], eax
call fcn.0044e280
lea eax, [ebp - 0xc4]
push eax
mov byte [ebp - 4], 0x61
call fcn.00404620
pop ecx
lea ecx, [ebp - 0xc4]
jmp 0x426cc3
push str.install_thread:_other_install__exe_
lea ecx, [ebp - 0xcc]
call fcn.0044e280
lea eax, [ebp - 0xcc]
push eax
mov byte [ebp - 4], 0x62
call fcn.00404620
pop ecx
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x41
call fcn.0044e260
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x3c]
push 1
push eax
call fcn.00401bb1
add esp, 0xc
xor edi, edi
test eax, eax
je 0x426db0
mov dword [ebp + 0x44], 1
jmp 0x426dbc
mov dword [ebp + 0x44], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x48], eax
push str.install_thread:_end_other_install__exe_
lea ecx, [ebp - 0xbc]
call fcn.0044e280
lea eax, [ebp - 0xbc]
push eax
mov byte [ebp - 4], 0x63
call fcn.00404620
pop ecx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x41
call fcn.0044e260
cmp dword [ebp + 0x44], edi
je 0x426e2e
lea eax, [ebx + 0x4c]
push str.main
push eax
call fcn.004012cb
pop ecx
pop ecx
test al, al
je 0x426e2e
push ecx
push ecx
lea eax, [ebx + 0x3c]
mov ecx, esp
mov dword [ebp + 0x1c], esp
push eax
call fcn.0044e1c0
lea eax, [ebp - 0x1bc]
push eax
mov ecx, esi
call fcn.0041c79a
lea ecx, [ebp - 0x1bc]
call fcn.0044e260
lea eax, [ebx + 0xcc]
push 0x4a09d0
push eax
call fcn.004012cb
pop ecx
pop ecx
test al, al
je 0x426fbe
push str.install_thread:_wait_for_install_to_complete
lea ecx, [ebp - 0x78]
call fcn.0044e280
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 4], 0x64
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x41
call fcn.0044e260
cmp dword [ebp + 0x44], edi
je 0x426faf
push 3
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebx + 0x7c]
call fcn.0044e9d0
push 0x4a4948
push eax
mov byte [ebp - 4], 0x65
call fcn.00401283
pop ecx
pop ecx
lea ecx, [ebp - 0x1c8]
mov byte [ebp + 0x67], al
mov byte [ebp - 4], 0x41
call fcn.0044e260
cmp byte [ebp + 0x67], 0
je 0x426ec0
cmp dword [esi + 0x6c0], edi
je 0x426e79
jmp 0x426faf
cmp dword [ebp + 8], edi
je 0x426efb
push 0x3e8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x426f53
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp + 8]
mov dword [ebp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], edi
jmp 0x426faf
cmp dword [ebp + 0x20], edi
je 0x426faf
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x1c]
push eax
push edi
push dword [ebp + 0x20]
mov dword [ebp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
cmp dword [ebp + 0x1c], edi
je 0x426f6f
push edi
push edi
lea eax, [ebp - 0x24]
push eax
push 0xc
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x20]
mov dword [ebp - 0x24], edi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x70], edi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x426f48
cmp dword [ebp - 0x24], edi
ja 0x426f74
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebx + 0x54]
call fcn.00401219
xor ecx, ecx
test al, al
setne cl
push ecx
mov ecx, esi
call fcn.004190a5
jmp 0x426e79
mov dword [ebp + 0x24], edi
jmp 0x426faf
push edi
lea eax, [ebp - 0x24]
push eax
push 0xc
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x48], eax
xor eax, eax
cmp dword [ebp + 0x6c], edi
mov dword [ebp + 0x44], 1
setne al
mov dword [ebp + 0x28], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x6cc]
mov dword [ebx + 0x30], eax
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp + 0x34]
push str.actioninstalledpkgvalue
push eax
call fcn.0044eb90
add esp, 0xc
mov byte [ebp - 4], 0x66
cmp dword [ebp + 0x44], edi
je 0x4275c6
push str.install_thread:_executed
lea ecx, [ebp - 0x34]
call fcn.0044e280
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x67
call fcn.00404620
pop ecx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x66
call fcn.0044e260
lea ecx, [ebx + 0x34]
call fcn.00401219
test al, al
je 0x427018
lea ecx, [ebp + 0x34]
jmp 0x427038
lea eax, [ebp - 0x1c0]
push eax
push edi
push 1
lea eax, [ebx + 0x34]
push eax
lea ecx, [esi + 0x264]
call fcn.00431575
lea ecx, [ebp + 0x34]
test eax, eax
js 0x42704b
push str.successtrue
call fcn.0044e6e0
mov dword [ebx + 0x10], 1
jmp 0x427055
push str.successfalse
call fcn.0044e6e0
push str.exec_valuelaunch_success
lea ecx, [ebp + 0x34]
call fcn.0044e6e0
cmp dword [ebp + 0x28], edi
je 0x427123
lea ecx, [ebp - 0x68]
call fcn.0044e010
push dword [ebp + 0xc]
lea eax, [ebp - 0x68]
push str.return_value_d
push eax
mov byte [ebp - 4], 0x68
call fcn.0044ee50
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp + 0x34]
call fcn.0044e7c0
cmp dword [ebp + 0xc], edi
je 0x427115
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x80]
call fcn.0044e1c0
push str.pkg_downloaded
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x69
call fcn.0044e6e0
lea edi, [esi + 0x690]
mov ecx, edi
call fcn.00401219
test al, al
je 0x4270d1
mov edi, str.none
jmp 0x4270d9
cmp byte [edi + 7], 0xff
jne 0x4270d9
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x80]
call fcn.0044e6e0
lea eax, [ebp - 0x80]
push eax
push dword [ebx + 0xd4]
lea eax, [ebx + 0x3c]
push ecx
push ecx
mov ecx, esp
mov dword [ebp + 0x1c], esp
push eax
call fcn.0044e1c0
lea ecx, [esi + 0x264]
call fcn.0042cc29
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x68
call fcn.0044e260
xor edi, edi
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x66
call fcn.0044e260
jmp 0x427130
push str.return_valueunknown
lea ecx, [ebp + 0x34]
call fcn.0044e6e0
lea ecx, [ebp - 0x2c]
call fcn.0044e010
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0x2c]
push str.dltime_d
push eax
call fcn.0044ee50
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x34]
call fcn.0044e7c0
lea ecx, [ebp - 0x88]
call fcn.0044e010
mov eax, dword [ebx + 0x30]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov byte [ebp - 4], 0x6b
push eax
lea eax, [ebp - 0x88]
push str.installtime_d
push eax
call fcn.0044ee50
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp + 0x34]
call fcn.0044e7c0
lea eax, [ebx + 0xbc]
push str.player
push eax
call fcn.004012cb
pop ecx
pop ecx
test al, al
je 0x4271f5
lea eax, [ebx + 0xc4]
push str.minimized
push eax
call fcn.00401283
pop ecx
pop ecx
test al, al
jne 0x4271ed
lea eax, [ebx + 0xc4]
push str.restore
push eax
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x4271f5
push ebx
mov ecx, esi
call fcn.0041a00f
mov ecx, esi
call fcn.0041b4cb
cmp dword [ebx + 0x10], edi
je 0x4275af
lea ecx, [ebx + 0x54]
call fcn.00401219
test al, al
jne 0x4275af
lea edi, [esi + 0x470]
mov ecx, edi
call fcn.00401219
test al, al
jne 0x4275af
mov ecx, esi
call fcn.004193de
test eax, eax
je 0x4275af
push edi
lea eax, [ebp - 0xb4]
push eax
mov ecx, esi
call fcn.00418afe
lea eax, [esi + 0x478]
push eax
lea eax, [ebp + 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6c
call fcn.00418afe
lea eax, [esi + 0x488]
push 0x4a46dc
push eax
mov byte [ebp - 4], 0x6d
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x4273af
lea ecx, [ebp + 0x2c]
call fcn.00401219
test al, al
je 0x4272b4
push 0x4a099a
lea ecx, [ebp - 0x3c]
call fcn.0044e280
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xb4]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6e
call fcn.0041945f
lea ecx, [ebp - 0x3c]
jmp 0x42758b
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x1d8]
push str.Cookie:
push eax
call fcn.0044eb90
add esp, 0xc
push eax
lea eax, [ebp - 0xb4]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x6f
call fcn.0041945f
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x6d
call fcn.0044e260
push 1
push 0x4a25f0
push 0x4a0bf8
lea ecx, [ebp + 0x2c]
call fcn.0044f110
push 1
push 0x4a31b0
push 0x4a46cc
lea ecx, [ebp + 0x2c]
call fcn.0044f110
push edi
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00418afe
push eax
lea eax, [ebp - 0x208]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x70
call fcn.0044eb90
push 0x4a46a8
push eax
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebp - 4], 0x71
call fcn.0044eb40
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp - 0x1e8]
push eax
mov byte [ebp - 4], 0x72
call fcn.0044eaf0
add esp, 0x24
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x73
call dword [edx + 0x10]
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x72
call fcn.0044e260
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x71
call fcn.0044e260
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x70
call fcn.0044e260
lea ecx, [ebp - 0x218]
jmp 0x42758b
lea eax, [esi + 0x488]
push str.post
push eax
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x427594
lea eax, [esi + 0x490]
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00418afe
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x74
call fcn.004163b2
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 0x75
call fcn.00401219
test al, al
je 0x427408
push str.none
lea ecx, [ebp + 0x2c]
call fcn.0044e3b0
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x228]
push str.Cookie:
push eax
call fcn.0044eb90
add esp, 0xc
lea ecx, [esi + 0x4a0]
push ecx
lea ecx, [esi + 0x498]
push ecx
push eax
lea eax, [ebp]
push eax
push edi
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x76
call fcn.0041641f
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x75
call fcn.0044e260
lea ecx, [ebp]
call fcn.00401219
test al, al
je 0x42746b
push str.none
lea ecx, [ebp]
call fcn.0044e3b0
push 1
push 0x4a25f0
push 0x4a0bf8
lea ecx, [ebp + 0x2c]
call fcn.0044f110
push 1
push 0x4a31b0
push 0x4a46cc
lea ecx, [ebp + 0x2c]
call fcn.0044f110
push edi
lea eax, [ebp - 0xa8]
push eax
mov ecx, esi
call fcn.00418afe
push eax
lea eax, [ebp - 0x98]
push str.actionsentpingvalue
push eax
mov byte [ebp - 4], 0x77
call fcn.0044eb90
push 0x4a46a8
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 0x78
call fcn.0044eb40
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 4], 0x79
call fcn.0044eaf0
push 0x4a469c
push eax
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 0x7a
call fcn.0044eb40
lea ecx, [ebp]
push ecx
push eax
lea eax, [ebp - 0x238]
push eax
mov byte [ebp - 4], 0x7b
call fcn.0044eaf0
add esp, 0x3c
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x7c
call dword [edx + 0x10]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x7b
call fcn.0044e260
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x7a
call fcn.0044e260
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x79
call fcn.0044e260
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x78
call fcn.0044e260
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x77
call fcn.0044e260
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x75
call fcn.0044e260
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x74
call fcn.004166cb
lea ecx, [ebp]
mov byte [ebp - 4], 0x6d
call fcn.0044e260
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 0x6c
call fcn.0044e260
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x6b
call fcn.0044e260
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x6a
call fcn.0044e260
lea ecx, [ebp - 0x2c]
jmp 0x4276a3
push str.install_thread:_not_executed
lea ecx, [ebp + 0x4c]
call fcn.0044e280
lea eax, [ebp + 0x4c]
push eax
mov byte [ebp - 4], 0x7d
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x66
call fcn.0044e260
push str.successfalse
lea ecx, [ebp + 0x34]
call fcn.0044e6e0
mov edi, dword [ebp + 0x48]
cmp edi, 0x20
ja 0x427639
je 0x427632
lea eax, [edi - 1]
dec eax
je 0x42762b
dec eax
je 0x427624
dec eax
dec eax
je 0x42761d
sub eax, 3
jne 0x42764d
push str.exec_valuenot_enough_memory
jmp 0x42766e
push str.exec_valueaccess_denied
jmp 0x42766e
push str.exec_valuepath_not_found
jmp 0x42766e
push str.exec_valuefile_not_found
jmp 0x42766e
push str.exec_valuesharing_violation
jmp 0x42766e
mov eax, edi
sub eax, 0x483
je 0x427669
dec eax
je 0x427662
dec eax
je 0x42765b
sub eax, 0x42
je 0x427654
push str.exec_valueunknown_error
jmp 0x42766e
push str.exec_valueuser_canceled
jmp 0x42766e
push str.exec_valuedll_not_found
jmp 0x42766e
push str.exec_valuedde_fail
jmp 0x42766e
push str.exec_valueno_association_found
lea ecx, [ebp + 0x34]
call fcn.0044e6e0
lea ecx, [ebp + 0x5c]
call fcn.0044e010
push edi
lea eax, [ebp + 0x5c]
push str.return_value_d
push eax
mov byte [ebp - 4], 0x7e
call fcn.0044ee50
add esp, 0xc
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp + 0x34]
call fcn.0044e7c0
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x66
call fcn.0044e260
mov eax, dword [esi]
xor edi, edi
push edi
lea ecx, [ebp + 0x34]
push ecx
mov ecx, esi
call dword [eax + 0x10]
cmp dword [ebp + 0x44], edi
je 0x427780
lea eax, [ebx + 0x4c]
push str.main
push eax
call fcn.00401283
pop ecx
pop ecx
test al, al
je 0x4276e0
cmp dword [ebx + 0x10], edi
je 0x4277d9
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0x41
call fcn.0044e260
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x3c
call fcn.0044e260
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
mov eax, dword [esi + 0x6c8]
add eax, dword [esi + 0x6b8]
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x6bc], eax
mov byte [ebp - 4], 0x20
call fcn.0044e260
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 1
test eax, eax
je 0x427733
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp - 0x14]
cmp dword [ebp + 0x24], 0
jne 0x425dac
jmp 0x42781d
push str.actionerrorvaluepipe_creation
lea ecx, [ebp + 0x4c]
mov dword [ebp + 0x24], edi
call fcn.0044e280
mov byte [ebp - 4], 0x43
mov eax, dword [esi]
push edi
lea ecx, [ebp + 0x4c]
push ecx
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [ebp + 0x4c]
jmp 0x4277df
push str.actionerrorvaluepipe_connection
lea ecx, [ebp + 0x4c]
mov dword [ebp + 0x24], edi
call fcn.0044e280
mov byte [ebp - 4], 0x44
jmp 0x427759
add ebx, 0x3c
push ebx
lea eax, [ebp - 0x98]
push str.actionerrorvalue
push eax
call fcn.0044eb90
push str._exec
push eax
lea eax, [ebp - 0xa8]
push eax
mov byte [ebp - 4], 0x7f
call fcn.0044eb40
add esp, 0x18
mov edx, dword [esi]
push edi
push eax
mov ecx, esi
mov byte [ebp - 4], 0x80
call dword [edx + 0x10]
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x7f
call fcn.0044e260
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x66
call fcn.0044e260
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x24], edi
mov byte [ebp - 4], 0x41
call fcn.0044e260
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x3c
call fcn.0044e260
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x2a
call fcn.0044e260
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x20
call fcn.0044e260
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x42781d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push str.install_thread:_near_end
lea ecx, [ebp + 0x4c]
call fcn.0044e280
lea eax, [ebp + 0x4c]
push eax
mov byte [ebp - 4], 0x81
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 1
call fcn.0044e260
xor edi, edi
cmp dword [ebp + 0x24], edi
je 0x4278bb
push str.setting_m_bInstalled__TRUE
lea ecx, [ebp + 0x4c]
call fcn.0044e280
lea eax, [ebp + 0x4c]
push eax
mov byte [ebp - 4], 0x82
call fcn.00404620
pop ecx
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 1
call fcn.0044e260
mov dword [esi + 0x44], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x20]
push edi
mov dword [esi + 0x6a4], eax
call fcn.00413867
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0044f7b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.00470483
add ebp, 0x78
leave
ret
mov ecx, dword [ebp - 0x20]
push edi
call fcn.00413867
mov ecx, dword [ebp - 0x20]
call fcn.00413884
or esi, 0xffffffff
jmp 0x427890