Function at 0x422a94
Capabilities:
Create directory
Get disk information
Query environment variable
Terminate process

Disassembly:
push 0x34
mov eax, 0x4a99d9
call fcn.004931c3
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x28], esi
call fcn.00480035
push eax
lea ecx, [ebp - 0x1c]
call fcn.00420985
push 0x4b263c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00421017
mov byte [ebp - 4], 1
call fcn.00480035
push eax
lea ecx, [ebp - 0x20]
call fcn.00420985
mov edx, dword [ebp + 8]
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
add ecx, ecx
push eax
call fcn.00456280
pop ecx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.00423e75
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [ebp - 0x28]
push eax
mov edi, 0x4b306c
push edi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00423b3e
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00423e75
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042001a
push 0x10
lea eax, [ebx + 0x50]
push esi
push eax
call fcn.0048ea70
add esp, 0xc
jmp 0x422ee2
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0xc]
jge 0x422eec
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
push dword [ebp - 0x20]
push str.VirtIniSettings:__s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004228d1
pop ecx
lea eax, [ebp - 0x24]
push eax
push 0x4b30a0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
call fcn.00423b3e
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00421e00
push esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 6
push eax
mov eax, dword [ebp - 0x24]
call fcn.00423ac2
push str.AppID
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422bd5
push dword [ebp - 0x14]
call fcn.0048f20a
pop ecx
mov dword [ebx + 8], eax
jmp 0x422e9f
push 0x4b30a4
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422bf9
push dword [ebp - 0x14]
call fcn.0048f20a
pop ecx
mov dword [ebx + 0xc], eax
jmp 0x422e9f
push str.Streamer
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422c1d
push dword [ebp - 0x14]
call fcn.0048f20a
pop ecx
mov dword [ebx + 0x40], eax
jmp 0x422e9f
push str.FriendlyName
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422c41
push dword [ebp - 0x14]
call fcn.0048f20a
pop ecx
mov dword [ebx + 0x10], eax
jmp 0x422e9f
push str.Shortcuts
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422c65
push dword [ebp - 0x14]
call fcn.0048f20a
pop ecx
mov dword [ebx + 0x14], eax
jmp 0x422e9f
push str.BaseDirName
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422c80
lea ecx, [ebp - 0x10]
jmp 0x422d74
push str.Publisher
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422ca1
push dword [ebp - 0x14]
call fcn.0048f20a
pop ecx
lea ecx, [ebx + 0x18]
jmp 0x422cc0
push str.Version
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422ccb
push dword [ebp - 0x14]
call fcn.0048f20a
pop ecx
lea ecx, [ebx + 0x1c]
push eax
call fcn.0042105b
jmp 0x422e9f
push str.OnStartVirtualized
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422ce6
lea ecx, [ebx + 0x20]
jmp 0x422d74
push str.OnStartUnvirtualized
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422cfe
lea ecx, [ebx + 0x24]
jmp 0x422d74
push str.OnStopVirtualized
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422d16
lea ecx, [ebx + 0x28]
jmp 0x422d74
push str.OnStopUnvirtualized
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422d2e
lea ecx, [ebx + 0x2c]
jmp 0x422d74
push str.StopInheritance
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422d46
lea ecx, [ebx + 0x30]
jmp 0x422d74
push str.AutoUpdate
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422d5e
lea ecx, [ebx + 0x34]
jmp 0x422d74
push str.CloudPkgId
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422d82
lea ecx, [ebx + 0x38]
lea eax, [ebp - 0x14]
push eax
call fcn.00423e75
jmp 0x422e9f
push str.EarlyInjection
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422dc6
push 0x4b322c
push dword [ebp - 0x14]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422dc6
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x4b3230
call fcn.00421017
call fcn.004228d1
pop ecx
mov dword [ebx + 0x3c], esi
jmp 0x422e9f
push str.Expiration
push dword [ebp - 0x18]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x422e9f
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], esi
je 0x422e9f
push 0x2f
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], esp
mov ecx, esp
mov dword [ebp - 0x24], esi
push eax
lea esi, [ebp - 0x24]
call fcn.00421e00
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.004594e0
add esp, 0xc
push dword [eax]
call fcn.0048efc2
pop ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov word [ebx + 0x56], ax
call fcn.0042001a
cmp dword [ebp - 0x24], 0xffffffff
je 0x422e9d
push 0x2f
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], esp
mov ecx, esp
push eax
call fcn.00421e00
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.004594e0
add esp, 0xc
push dword [eax]
call fcn.0048efc2
pop ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov word [ebx + 0x52], ax
call fcn.0042001a
cmp dword [ebp - 0x24], 0xffffffff
je 0x422e9d
push 0x2f
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], esp
mov ecx, esp
push eax
call fcn.00421e00
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.004594e0
add esp, 0xc
push dword [eax]
call fcn.0048efc2
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
mov word [ebx + 0x50], ax
call fcn.0042001a
xor esi, esi
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00423b3e
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.00423e75
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [ebp - 0x28], 0xffffffff
jne 0x422b4f
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x423337
cmp word [eax], si
je 0x423337
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jne 0x422f51
mov edi, 0x514
push edi
lea ecx, [ebp - 0x10]
call fcn.0042049e
push edi
push eax
xor ecx, ecx
mov edi, str.CAMEYO_BASEDIRNAME
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00423cc9
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push dword [ebp - 0x10]
push edi
push str.UnpackUtils_ReadIniFile::BaseDirName:_Environment__s__s_
push eax
call fcn.004559f0
add esp, 0x10
call fcn.004228d1
pop ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
cmp eax, esi
jne 0x423161
mov eax, dword [ebx + 0x48]
cmp eax, esi
je 0x423161
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x14]
push str._c:_
push eax
call fcn.004559f0
add esp, 0xc
mov byte [ebp - 4], 0xb
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0x4b263c
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00421017
push 2
pop esi
mov byte [ebp - 4], 0xc
cmp edi, esi
jne 0x422fad
push str.REMOVABLE
jmp 0x422fb7
cmp edi, 3
jne 0x422fc1
push str.FIXED
lea ecx, [ebp - 0x28]
call fcn.00421149
jmp 0x422fef
push edi
lea eax, [ebp - 0x3c]
push 0x4b304c
push eax
call fcn.004559f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xd
call fcn.00423e75
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov eax, esp
mov dword [ebp - 0x40], esp
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push str.UnpackUtils_ReadIniFile::BaseDirName:_RootDir__s_drive_type_s
push eax
call fcn.004559f0
add esp, 0x10
call fcn.004228d1
mov ecx, esp
mov dword [ebp - 0x40], esp
push str..data
call fcn.00421017
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x3c], esp
push dword [ebx + 0x48]
call fcn.00421017
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 0xc
call fcn.00455d40
add esp, 0xc
mov byte [ebp - 4], 0xf
cmp edi, esi
jne 0x42307b
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x423067
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42313a
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00423e75
mov dword [ebx + 0x60], esi
jmp 0x42313a
lea eax, [ebp - 0x18]
push eax
call fcn.00463900
pop ecx
push 0x5c
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x40], esp
push dword [ebx + 0x48]
call fcn.00421017
lea eax, [ebp - 0x24]
push eax
call fcn.00456030
add esp, 0xc
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4230f9
push eax
push dword [ebp - 0x24]
push ecx
call fcn.0048f0b7
add esp, 0xc
test eax, eax
jne 0x4230f9
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4230df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4230f2
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00423e75
mov dword [ebx + 0x60], 1
mov ecx, str.TRUE:_running_from_Dropbox_dir
jmp 0x4230fe
mov ecx, str.FALSE
mov edx, dword [ebp - 0x18]
mov eax, dword [edx - 0xc]
push ecx
mov esi, esp
mov dword [ebp - 0x40], esp
push ecx
push eax
push dword [ebp - 0x24]
push edx
push str.DropboxDir:_comparing__s_to__s___d_chars_compare_:__s
push esi
call fcn.004559f0
add esp, 0x18
call fcn.004228d1
pop ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
xor esi, esi
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push dword [ebx + 0x48]
push dword [ebp - 0x10]
push str.UnpackUtils_ReadIniFile:_INIs_BaseDirName_s__CarrierExeName_s
push eax
call fcn.004559f0
add esp, 0x10
call fcn.004228d1
mov eax, dword [ebp - 0x10]
pop ecx
cmp dword [eax - 0xc], esi
jne 0x4231b3
push str._AppData_
lea ecx, [ebp - 0x10]
call fcn.00421149
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push dword [ebp - 0x10]
push str.UnpackUtils_ReadIniFile::BaseDirName:_Taking_default:__s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004228d1
pop ecx
mov eax, dword [ebx + 8]
mov dword [0x4d4990], eax
mov eax, dword [ebx + 0x48]
push 4
mov dword [0x4d49d0], eax
call fcn.00462bb0
pop ecx
lea eax, [ebp - 0x10]
push eax
call fcn.00464b90
pop ecx
push 1
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00423c25
mov edi, 0x4b280c
push edi
mov ecx, eax
mov byte [ebp - 4], 0x12
call fcn.00423dd3
test eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
setne byte [ebp + 0xf]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp + 0xf], 0
je 0x423218
push edi
lea ecx, [ebp - 0x10]
call fcn.00423caa
push str.VOS_
lea ecx, [ebp - 0x10]
call fcn.00423caa
push dword [ebx + 8]
lea ecx, [ebp - 0x10]
call fcn.00423caa
push 1
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], esp
mov ecx, esp
push eax
call fcn.00421e00
lea eax, [ebp - 0x2c]
push eax
call fcn.0046e340
add esp, 0xc
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], esi
je 0x4232d6
push esi
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.00423bf1
cmp eax, 0xffffffff
jne 0x42326f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
push esi
lea ecx, [ebp - 0x10]
push ecx
call fcn.00423ac2
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
push edi
call fcn.00421017
push ecx
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x10]
mov dword [ebp - 0x3c], esp
mov ecx, esp
push eax
call fcn.00421e00
push ecx
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], esp
mov ecx, esp
push eax
call fcn.00421e00
lea edi, [ebp + 0xc]
mov byte [ebp - 4], 0x13
call fcn.004555d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x16
call fcn.00423e75
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [ebp - 0x10]
call fcn.0048f20a
pop ecx
push 0x10
mov dword [ebx + 0x44], eax
call fcn.0047f920
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x17
cmp eax, esi
je 0x4232fe
mov esi, eax
call fcn.0046e1f0
jmp 0x423300
xor eax, eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
mov dword [ebx + 0x4c], eax
call fcn.0042001a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov al, 1
call fcn.0049329b
ret
push 3
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00423c6c
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edi - 0xc]
cmp ebx, esi
jge 0x42335d
push 0x80070057
call fcn.00420000
cmp ebx, esi
movzx ecx, word [edi]
movzx edx, cx
jl 0x423353
movzx ecx, cx
push ecx
movzx edx, dx
mov ebx, esp
mov dword [ebp - 0x40], esp
push edx
movzx ecx, cx
push ecx
push dword [eax]
push str.VirtIniSettings:_incorrect_data:_Str_3_:_s__0_0x_x_d
push ebx
call fcn.004559f0
add esp, 0x14
call fcn.004228d1
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042001a
push esi
push 0x5c
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push eax
call fcn.00454b90
pop ecx
lea eax, [ebp - 0x38]
push eax
call fcn.00455f00
add esp, 0xc
mov ebx, eax
push 0x14
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.00423c6c
mov byte [ebp - 4], 0xa
cmp dword [edi - 0xc], esi
jl 0x423353
push dword [eax]
movzx eax, word [edi]
push eax
lea eax, [ebp + 0xc]
push str.Virt_info_incorrect__is_VirtApp.ini_in_Unicode_format__0x_x_:_n_s
push eax
call fcn.004559f0
add esp, 0x10
push dword [ebx]
push dword [eax]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042001a
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]