Function at 0x4386fe
Capabilities:
Accept command line arguments
Check for peb ntglobalflag flag
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Check os version
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Get file attributes
Get hostname
Get number of processors
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d22f9
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0xa48c
call fcn.004b2070
mov eax, dword [0x504c94]
xor eax, esp
mov dword [esp + 0xa488], eax
push ebx
push esi
push edi
mov eax, dword [0x504c94]
xor eax, esp
push eax
lea eax, [esp + 0xa4a0]
mov dword fs:[0], eax
lea eax, [esp + 0x1e8]
xor ebx, ebx
mov dword [esp + 0x34], ebx
push eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x1ec], 8
mov dword [esp + 0x1f0], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x5c]
call fcn.004a6083
mov esi, 0x4d9c38
push esi
lea ecx, [esp + 0x68]
call fcn.0042341f
push esi
lea ecx, [esp + 0x6c]
mov dword [esp + 0xa4ac], ebx
call fcn.0042341f
xor edi, edi
push esi
lea ecx, [esp + 0x7c]
inc edi
mov byte [esp + 0xa4ac], 1
call fcn.0042341f
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0xa4ac], 2
call fcn.00465890
pop ecx
lea ecx, [esp + 0x60]
call fcn.0042148a
lea eax, [esp + 0x6c]
mov byte [esp + 0xa4a8], 4
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1d4]
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x30], ebx
call fcn.00465890
pop ecx
push eax
mov ecx, 0x50a1a4
mov byte [esp + 0xa4ac], 5
call fcn.00423463
mov byte [esp + 0xa4a8], 4
mov ecx, dword [esp + 0x1d4]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x134]
push eax
call fcn.00465890
mov byte [esp + 0xa4ac], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [eax]
push str.Loader:__s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.00437d52
pop ecx
mov byte [esp + 0xa4a8], 4
mov ecx, dword [esp + 0x134]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x509e58], eax
cmp dword [esp + 0x38], ebx
je 0x43927e
cmp dword [esp + 0x6c], edi
jle 0x43927e
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], 2
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
push ecx
lea edi, [eax + ecx*4]
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [edi]
call fcn.0042341f
call fcn.00437d82
mov dword [esp], 0x4e408c
call fcn.004ab840
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
jne 0x438905
push 0x4e408c
call fcn.004ab840
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x1c]
call fcn.00423478
push str._Confirm
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x43891f
mov dword [esp + 0x24], 1
push str._Quiet
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438941
or dword [esp + 0x2c], 2
mov dword [0x50681c], ebx
jmp 0x439268
push str._AllUsers
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438994
mov dword [esp + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00465540
test eax, eax
je 0x439374
call fcn.00465840
test eax, eax
jne 0x439268
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Admin_rights_required
jmp 0x43938f
push str._ErrorsOnly
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x4389b5
mov dword [0x50681c], 1
jmp 0x439268
push str._Wait
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x4389d1
or dword [esp + 0x2c], 1
jmp 0x439268
push 0x4e4158
call fcn.004ab840
pop ecx
push eax
push str._Password:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x439243
push 0x4e417c
call fcn.004ab840
pop ecx
push eax
push str._Password
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x439243
push 0x4e41b8
call fcn.004ab840
pop ecx
push eax
push str._Services:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
jne 0x438a8b
push dword [edi]
lea ecx, [esp + 0xcc]
call fcn.0042341f
push 0x4e41b8
mov byte [esp + 0xa4ac], 7
call fcn.004ab840
pop ecx
push ebx
lea ecx, [esp + 0xcc]
push ecx
call fcn.004234b6
push dword [esp + 0xc8]
push str.CAMEYO_SERVICES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0xa4a8], 4
mov ecx, dword [esp + 0xc8]
jmp 0x439239
push str._Register
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x4393a0
push str._Stop
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x439451
push str._Remove
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x439574
push str._Remove:Proc
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x439886
push str._Remove:Reg
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x439a63
push str._LearnStreaming
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43e7c0
push 0x4e47c4
call fcn.004ab840
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43e7c0
push str._UpdateBasicSettings
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438b51
mov dword [esp + 0x40], 1
jmp 0x439268
push str._Repackage
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x439c5f
push str._CreateDiff
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43e607
push 0x4e49f8
call fcn.004ab840
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43e607
push str._exec
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x439e3b
push 0x4e4a3c
call fcn.004ab840
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43e03a
push 0x4e4a54
call fcn.004ab840
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43e03a
push str._ShowStreaming
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x439fbf
push str._Break
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43a0a4
push str._Unbreak
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43a7c7
push str._Integrate
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43dbcd
push str._Integrate:once
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43dbcd
push str._FullIntegrate
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43dbcd
push str._Unintegrate
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43aff2
push str._CreateShortcuts
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d554
push 0x4e5560
call fcn.004ab840
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43d554
push str._Perf
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43b057
push str._ExtractLog
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43b459
push str._ExtractAll
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43b657
push str._AutoUpdateXml
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43b733
push str._Info
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43b890
push str._EngineVer
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438ea2
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xa48]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0xe2
cmp dword [esp + 0xac0], ebx
je 0x43bd56
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x50a154]
push str._s.AppVirtDll.dll
push eax
call fcn.00466a00
lea eax, [esp + 0xb8]
add esp, 0xc
push eax
call fcn.00466100
add esp, 4
mov byte [esp + 0xa4ac], 0xe3
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 0xe4
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.0042341f
push 2
pop ecx
lea edi, [esp + 0xa44]
mov byte [esp + 0xa4b0], 0xe3
call fcn.0047efc0
push dword [0x50681c]
lea eax, [esp + 0xac]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x144]
push eax
call fcn.00486ee0
add esp, 4
mov byte [esp + 0xa4b0], 0xe5
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov byte [esp + 0xa4a8], 0xe3
mov ecx, dword [esp + 0x13c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
call fcn.0046a050
pop ecx
mov ecx, dword [esp + 0xa8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, edi
mov byte [esp + 0xa4a8], 4
call fcn.00426079
jmp 0x439268
mov eax, dword [esp + 0x38]
push str._ChangeLoader
push dword [eax + 4]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438ec7
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x6c], eax
jg 0x43bd68
push str._ChangeEngine
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438ee7
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x6c], eax
jg 0x43c0c7
push str._ChangeIni
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438f07
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x6c], eax
jg 0x43c469
push str._TestAutoUpdate
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438f2a
mov eax, dword [esp + 0x28]
add eax, 4
cmp dword [esp + 0x6c], eax
jg 0x43c622
push str._Debug
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43c734
push str._ForceMenu
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438f5f
mov dword [esp + 0x1c], 1
jmp 0x439268
push str._ShowTree
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43c775
push str._RegDump
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43c844
push str._SetFileFlags
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x438fac
mov eax, dword [esp + 0x28]
inc eax
cmp dword [esp + 0x6c], eax
jg 0x43c939
push str._DbgZip:
call fcn.004ab8ea
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43cb44
push str._DbgNow
call fcn.004ab8ea
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43cb84
push str._Vintegrate
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d3d2
push 0x4e60e0
call fcn.004ab840
pop ecx
push eax
push str._Vintegrate:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43d3d2
push str._VintegrateRecursive
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d3d2
push 0x4e6138
call fcn.004ab840
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
je 0x43d3d2
push str._Vunintegrate
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43cc7f
push str._Vmanager
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43ce0c
push str._ProcessList
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43cebc
push str._GfxSvr
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x439100
call fcn.0042b295
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov edi, 0x50a148
call fcn.00481ae0
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.00481ae0
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x439268
push 0x4e6358
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x439175
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.open
xor edi, edi
xor ebx, ebx
call fcn.0042341f
push edi
push ecx
mov dword [esp + 0xa4b4], 0x135
mov ecx, esp
mov dword [esp + 0x2c], esp
push str._Troubleshoot
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x36
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042340a
mov dword [esp + 0xa4b8], 4
call fcn.00464f40
add esp, 0x10
jmp 0x439268
push str._Troubleshoot
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d1f3
push str._AutoUpdate
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d219
push str._VirtRegSyncExport
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d2ae
push str._StartStreaming
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d316
push str._JumpTo
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d333
push 0x4e0954
lea ecx, [esp + 0x6c]
call fcn.00423478
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.0042341f
lea eax, [esp + 0x148]
push eax
call fcn.0046c580
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x7c]
mov dword [esp + 0xa4ac], 0x139
call fcn.00423463
mov dword [esp + 0xa4a8], 4
mov ecx, dword [esp + 0x144]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x439268
push str._Password_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4e4158
call fcn.004ab840
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x64]
call fcn.00423478
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
inc dword [esp + 0x28]
cmp eax, dword [esp + 0x6c]
jl 0x4388ac
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xad8]
push eax
call fcn.0047c820
mov dword [esp + 0xa4a8], 0x13a
push dword [esp + 0x2c]
lea eax, [esp + 0x7c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
or esi, 0xffffffff
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b4], 0x3b
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x80], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b8], 0x3c
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x3d
push dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xae4]
push eax
mov ecx, esi
mov byte [esp + 0xa4c4], 0x3a
call fcn.0042f15c
add esp, 0x1c
cmp eax, 2
jne 0x43e9a1
call fcn.0043851f
push ebx
push dword [0x50a154]
push str.Application_is_now_integrated_into_your_system
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0xacc]
call fcn.0047da30
lea eax, [esp + 0xacc]
mov dword [esp + 0xa4a8], 4
call fcn.00426079
jmp 0x4393ef
call fcn.00465590
test eax, eax
jne 0x439399
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Elevation_failed
call fcn.0042341f
call fcn.0043859c
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
mov esi, 0x50a148
push esi
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x4393d6
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x43938f
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
mov ecx, esi
call fcn.0042ea9d
pop ecx
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x68]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
mov ecx, dword [esp + 0xa4a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa488]
xor ecx, esp
call fcn.004aaf83
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x439484
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x50a194
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x50a1a4
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b4], 9
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x50a198
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b8], 0xa
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x50a154
call fcn.0042340a
mov byte [esp + 0xa4b8], 4
call fcn.004351e2
add esp, 0x10
cmp eax, ebx
je 0x43951a
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Cannot_stop_application__s
push eax
call fcn.00466a00
add esp, 0xc
jmp 0x439394
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.0042341f
call fcn.00437d82
pop ecx
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x68]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
jmp 0x43942d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x4395a7
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
mov eax, dword [0x50a198]
cmp dword [eax - 0xc], ebx
jne 0x4395ce
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Cannot_obtain_base_dir_for__s
jmp 0x43950c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x50a198
push esi
call fcn.0042340a
call fcn.00469380
pop ecx
cmp eax, ebx
jne 0x439607
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Application_is_not_deployed_on_this_machine:__s
jmp 0x43950c
cmp dword [esp + 0x24], ebx
je 0x43962e
push 3
push dword [0x50a154]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x43962e
push 0x14
pop ebx
jmp 0x439531
push ebx
lea eax, [esp + 0x104]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
mov dword [esp + 0x110], ebx
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0xb
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x50a154]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.00466a00
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0xa4bc], 4
call fcn.00467ab0
add esp, 0x14
cmp eax, ebx
je 0x4396e0
cmp dword [esp + 0x100], ebx
je 0x4396e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00465540
test eax, eax
jne 0x4396c5
call fcn.00465590
test eax, eax
jne 0x439399
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43938a
call fcn.00465840
test eax, eax
jne 0x4396e0
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43898a
call fcn.00432960
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a154]
push str.Removing__s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00437d82
pop ecx
lea ecx, [esp + 0xf8]
call fcn.0042148a
push 0x4d9c3c
mov byte [esp + 0xa4ac], 0xc
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x104]
push eax
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x50a194
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c4], 0xd
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x50a1a4
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c8], 0xe
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x50a1a0
call fcn.0042340a
push ecx
mov byte [esp + 0xa4cc], 0xf
mov ecx, esp
mov dword [esp + 0x40], esp
push esi
call fcn.0042340a
push ecx
mov byte [esp + 0xa4d0], 0x10
mov ecx, esp
mov dword [esp + 0x84], esp
push 0x50a154
call fcn.0042340a
mov byte [esp + 0xa4d0], 0xc
call fcn.00435611
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042340a
call fcn.004693c0
pop ecx
cmp eax, ebx
je 0x4397f0
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x43950c
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a154]
push edi
push eax
call fcn.00466a00
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00467df0
pop ecx
cmp eax, ebx
je 0x439833
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Registry_could_not_be_emptied_for__s
jmp 0x43950c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Removed_successfully
call fcn.0042341f
call fcn.00437d82
pop ecx
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Application__s_removed_successfully
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0xf8]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x439531
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x4398b9
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
mov eax, dword [0x50a198]
cmp dword [eax - 0xc], ebx
jne 0x4398d5
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4395be
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x50a198
call fcn.0042340a
call fcn.00469380
pop ecx
cmp eax, ebx
jne 0x43991c
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a198]
push dword [0x50a154]
push str.Application_is_not_deployed_on_this_machine:__s_n_n__s_
push eax
call fcn.00466a00
add esp, 0x10
jmp 0x439394
cmp dword [esp + 0x24], ebx
je 0x43993f
push 3
push dword [0x50a154]
push str.Do_you_want_to_stop_the_application_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x439626
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a154]
push str.Removing_processes:__s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00437d82
pop ecx
lea ecx, [esp + 0xe0]
call fcn.0042148a
push 0x4d9c3c
mov byte [esp + 0xa4ac], 0x11
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
push ebx
push 1
lea eax, [esp + 0xec]
push eax
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x50a194
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c4], 0x12
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x50a1a4
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c8], 0x13
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x50a1a0
call fcn.0042340a
push ecx
mov byte [esp + 0xa4cc], 0x14
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x50a198
call fcn.0042340a
push ecx
mov byte [esp + 0xa4d0], 0x15
mov ecx, esp
mov dword [esp + 0x84], esp
push 0x50a154
call fcn.0042340a
mov byte [esp + 0xa4d0], 0x11
call fcn.00435611
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.0042341f
call fcn.00437d82
pop ecx
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Application__s_stopped_successfully
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0xe0]
jmp 0x439879
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x439a96
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
mov eax, dword [0x50a198]
cmp dword [eax - 0xc], ebx
jne 0x439ab2
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4395be
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x50a198
push esi
call fcn.0042340a
call fcn.00469380
pop ecx
cmp eax, ebx
jne 0x439ae0
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4398fd
cmp dword [esp + 0x24], ebx
je 0x439b03
push 3
push dword [0x50a154]
push str.Do_you_want_to_remove_the_applications_registry_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x439626
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a154]
push str.Removing_registry:__s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00437d82
pop ecx
lea ecx, [esp + 0xe4]
call fcn.0042148a
push 0x4d9c3c
mov byte [esp + 0xa4ac], 0x16
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
push 1
push ebx
lea eax, [esp + 0xf0]
push eax
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x50a194
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c4], 0x17
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x50a1a4
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c8], 0x18
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x50a1a0
call fcn.0042340a
push ecx
mov byte [esp + 0xa4cc], 0x19
mov ecx, esp
mov dword [esp + 0x40], esp
push esi
call fcn.0042340a
push ecx
mov byte [esp + 0xa4d0], 0x1a
mov ecx, esp
mov dword [esp + 0x84], esp
push 0x50a154
call fcn.0042340a
mov byte [esp + 0xa4d0], 0x16
call fcn.00435611
add esp, 0x24
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a154]
push str.SoftwareVOS_s
push eax
call fcn.00466a00
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00467df0
pop ecx
cmp eax, ebx
je 0x439c14
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x439823
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Registry_removed_successfully
call fcn.0042341f
call fcn.00437d82
pop ecx
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str.Application__ss_registry_removed_successfully
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0xe4]
jmp 0x439879
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x2c]
call fcn.0042148a
mov byte [esp + 0xa4a8], 0x23
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x6c], ecx
jle 0x439c99
mov ecx, dword [esp + 0x38]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x28]
call fcn.00423478
jmp 0x439ca7
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00423463
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0x24
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x1ec]
push eax
mov byte [esp + 0xa4b4], 0x23
call fcn.00466d50
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xa4ac], 0x25
call fcn.00423463
mov byte [esp + 0xa4a8], 0x23
mov ecx, dword [esp + 0x1e4]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
call fcn.0046a050
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
pop ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x2c]
jne 0x439d5a
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
jmp 0x439394
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
call fcn.00434ac1
pop ecx
pop ecx
mov dword [esp + 0x40], eax
cmp eax, ebx
jne 0x439de7
push dword [0x50681c]
lea eax, [esp + 0x30]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x1ac]
push eax
call fcn.00466f10
add esp, 8
mov byte [esp + 0xa4b0], 0x26
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x1a0]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
lea ecx, [edi - 0x10]
jmp 0x43987c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x40], 0x10
push dword [0x50681c]
jne 0x439e0c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x43938f
push dword [esp + 0x44]
lea eax, [esp + 0x1f8]
push eax
call fcn.0046db80
add esp, 4
mov byte [esp + 0xa4b0], 0x27
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x43950d
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax + edx*4]
call fcn.0042341f
lea eax, [esp + 0x114]
push eax
call fcn.0046c580
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x7c]
mov byte [esp + 0xa4ac], 0x2e
call fcn.00423463
push eax
lea ecx, [esp + 0x6c]
call fcn.00423463
push eax
lea ecx, [esp + 0xe0]
call fcn.0042340a
mov byte [esp + 0xa4a8], 0x30
mov ecx, dword [esp + 0x110]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [esp + 0x19c]
push eax
lea ecx, [esp + 0xe4]
call fcn.0042360e
push 0x4e114c
push eax
call fcn.00423718
pop ecx
pop ecx
mov ecx, dword [esp + 0x198]
add ecx, 0xfffffff0
mov byte [esp + 0x47], al
call fcn.0042101a
cmp byte [esp + 0x47], 0
lea ecx, [esp + 0x68]
je 0x439ee8
push 1
push 0x22
jmp 0x439eeb
push ebx
push 0x20
call fcn.00425653
mov edi, eax
cmp edi, 0xffffffff
je 0x439f5f
push edi
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x70]
call fcn.0042360e
push 0x4e1038
mov byte [esp + 0xa4ac], 0x31
call fcn.00432ba0
push eax
lea ecx, [esp + 0x6c]
call fcn.00423463
mov byte [esp + 0xa4a8], 0x30
mov ecx, dword [esp + 0x118]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
lea ecx, [esp + 0x7c]
lea eax, [edi + 1]
push ecx
call fcn.004234b6
lea eax, [esp + 0x78]
call fcn.00423565
push eax
lea ecx, [esp + 0x7c]
call fcn.00423463
jmp 0x439f84
push 0x4e1038
lea eax, [esp + 0xe0]
call fcn.00432ba0
push eax
lea ecx, [esp + 0x6c]
call fcn.00423463
push esi
lea ecx, [esp + 0x7c]
call fcn.00423478
xor ecx, ecx
lea eax, [esp + 0x68]
call fcn.00428a9b
movzx eax, ax
cmp ax, 0x25
jne 0x439fa3
lea eax, [esp + 0x68]
push eax
call fcn.00477f90
pop ecx
mov byte [esp + 0xa4a8], 4
mov ecx, dword [esp + 0xdc]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43927e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ShowStreaming:
call fcn.0042341f
call fcn.00437d82
pop ecx
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x928]
push eax
call fcn.0047c820
push ebx
push ecx
mov byte [esp + 0xa4b0], 0x40
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x41
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x42
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push 2
push ecx
mov byte [esp + 0xa4c0], 0x43
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x934]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 0x40
call fcn.0042f15c
add esp, 0x1c
lea ecx, [esp + 0x91c]
call fcn.0042e5ae
lea eax, [esp + 0x91c]
call fcn.0047da30
mov byte [esp + 0xa4a8], 4
lea eax, [esp + 0x91c]
call fcn.00426079
jmp 0x439531
lea ecx, [esp + 0x24]
call fcn.0042148a
mov byte [esp + 0xa4a8], 0x44
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x6c], ecx
jle 0x43a0d5
mov ecx, dword [esp + 0x38]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x28]
call fcn.00423478
jmp 0x43a0e3
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00423463
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0x45
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0xa4b4], 0x44
call fcn.00466d50
add esp, 0xc
push 1
push ebx
push ecx
mov byte [esp + 0xa4b4], 0x46
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x2d0]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0x47
push dword [0x50681c]
lea eax, [esp + 0x64]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x2d0]
push eax
call fcn.00438665
add esp, 0x10
cmp dword [esp + 0x348], ebx
jne 0x43a19c
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_containers_
jmp 0x43938f
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
call fcn.00468970
pop ecx
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43a1dd
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_empty__s
jmp 0x43950c
mov esi, dword [esp + 0x58]
call fcn.00469460
test eax, eax
jne 0x43a205
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_create__s
jmp 0x43950c
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, 0x4d9c3c
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x48
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.VirtApp.ini
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x49
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x4a
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, str.Main
push ebx
call fcn.0042341f
push 3
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x4b
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppVirtDll.dll
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x4c
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x4d
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 2
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x4e
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppVirtDll64.dll
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x4f
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x50
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 8
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x51
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.StubExe.exe
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x52
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x53
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 9
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x54
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.StubExe64.exe
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x55
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x56
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 0xa
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x57
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.VirtFiles.db
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x58
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x59
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 4
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x5a
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SandboxCfg.db
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x5b
mov ecx, esp
lea eax, [esp + 0x68]
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x5c
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 5
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x5d
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.VirtReg.export
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x5e
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x5f
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 6
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x60
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.VirtReg.dat
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x61
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x62
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 0xb
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x63
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SysDllSubdirs.txt
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x64
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x65
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
push 7
pop ecx
lea edi, [esp + 0x2cc]
mov byte [esp + 0xa4b0], 0x47
call fcn.0047efc0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x66
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.VirtFiles.vfc
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x67
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0x47
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4b0], 0x68
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042341f
mov byte [esp + 0xa4b0], 0x47
xor ecx, ecx
inc ecx
lea edi, [esp + 0x2cc]
call fcn.0047efc0
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push 0x4e4f2c
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
push 0
jmp 0x43939a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Unbreak:
call fcn.0042341f
call fcn.00437d82
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0x69
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x78]
push eax
mov byte [esp + 0xa4b4], 4
call fcn.00466d50
add esp, 0xc
mov byte [esp + 0xa4a8], 0x6a
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43a84d
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x78]
push str.Dir_doesnt_exist:__s
jmp 0x43950c
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
call fcn.0042340a
mov esi, str..old
push esi
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1ac]
push eax
mov byte [esp + 0xa4b4], 0x6b
call fcn.0042366e
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x1a4]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x128]
push eax
call fcn.0042366e
add esp, 0xc
push dword [eax]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x120]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x47], al
call fcn.0042101a
cmp byte [esp + 0x47], 0
je 0x43a8ee
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_rename_myself_to_.old
jmp 0x43938f
push esi
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1b4]
push eax
call fcn.0042366e
mov eax, dword [eax]
add esp, 0xc
push ebx
push dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x1ac]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x43a944
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_myself
jmp 0x43938f
and dword [esp + 0xc0], 0
push 1
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, 0x4d9c3c
push esi
lea ebx, [esp + 0xd0]
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x6c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.VirtApp.ini
call fcn.0042341f
push ecx
mov byte [esp + 0xa4bc], 0x6d
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4bc], 0x6b
call fcn.00466550
add esp, 0xc
lea edi, [esp + 0xf4]
call fcn.00467410
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x43afdb
xor edi, edi
cmp dword [esp + 0xc0], edi
je 0x43afdb
push dword [esp + 0xc0]
mov ecx, dword [esp + 0xf0]
lea eax, [esp + 0x44]
push eax
call fcn.00467170
mov byte [esp + 0xa4b0], 0x6e
push dword [esp + 0xf4]
call fcn.004ac035
add esp, 0xc
push 1
push 1
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x240]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0x6f
push dword [0x50681c]
lea eax, [esp + 0x64]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x240]
push eax
call fcn.00438665
add esp, 0x10
cmp dword [esp + 0x2b8], edi
jne 0x43aa7b
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_begin_to_update_resource
jmp 0x43938f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, str.Main
push ebx
call fcn.0042341f
mov byte [esp + 0xa4ac], 0x70
mov eax, dword [esp + 0x44]
mov eax, dword [eax - 0xc]
add eax, eax
push edi
push eax
lea ecx, [esp + 0x4c]
call fcn.00423b65
push eax
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e460
cmp eax, edi
je 0x43aada
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_update_INI_resource
jmp 0x43938f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0
push 2
push ecx
mov byte [esp + 0xa4b8], 0x71
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x72
mov ecx, esp
mov dword [esp + 0x38], esp
push str.AppVirtDll.dll
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x73
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x71
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0
push 8
push ecx
mov byte [esp + 0xa4b8], 0x74
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x75
mov ecx, esp
mov dword [esp + 0x38], esp
push str.AppVirtDll64.dll
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x76
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x74
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0
push 9
push ecx
mov byte [esp + 0xa4b8], 0x77
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x78
mov ecx, esp
mov dword [esp + 0x38], esp
push str.StubExe.exe
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x79
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x77
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0
push 0xa
push ecx
mov byte [esp + 0xa4b8], 0x7a
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x7b
mov ecx, esp
mov dword [esp + 0x38], esp
push str.StubExe64.exe
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x7c
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x7a
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0x4000
push 4
push ecx
mov byte [esp + 0xa4b8], 0x7d
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x7e
mov ecx, esp
mov dword [esp + 0x38], esp
push str.VirtFiles.db
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x7f
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x7d
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0x4000
push 5
push ecx
mov byte [esp + 0xa4b8], 0x80
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x81
mov ecx, esp
mov dword [esp + 0x38], esp
push str.SandboxCfg.db
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x82
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x80
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0x4000
mov byte [esp + 0xa4b0], 0x83
push 0xb
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x84
mov ecx, esp
mov dword [esp + 0x38], esp
push str.VirtReg.dat
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x85
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x83
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0
push 7
push ecx
mov byte [esp + 0xa4b8], 0x86
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x87
mov ecx, esp
mov dword [esp + 0x38], esp
push str.SysDllSubdirs.txt
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x88
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x86
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.0042341f
push 0x4000
push 1
push ecx
mov byte [esp + 0xa4b8], 0x89
mov edi, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c0], 0x8a
mov ecx, esp
mov dword [esp + 0x38], esp
push str.VirtFiles.vfc
call fcn.0042341f
push ecx
mov byte [esp + 0xa4c4], 0x8b
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c4], 0x89
call fcn.00466550
add esp, 0xc
lea eax, [esp + 0x244]
push eax
mov byte [esp + 0xa4bc], 0x6f
call fcn.0047e7c0
lea eax, [esp + 0x234]
call fcn.0047da30
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
je 0x43afcc
push str.Could_not_commit_resource
jmp 0x43938f
push str.Success
call fcn.0042341f
jmp 0x43a7b9
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_VirtApp.ini
jmp 0x43938f
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43b025
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
call fcn.00432960
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x50a154]
push str._s_is_no_longer_integrated.
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
jmp 0x439399
lea ecx, [esp + 0x3c]
call fcn.0042148a
lea ecx, [esp + 0x40]
call fcn.0042148a
mov byte [esp + 0xa4a8], 0xb6
mov edi, dword [esp + 0x30]
or dword [esp + 0x28], 0xffffffff
lea eax, [edi + 1]
cmp dword [esp + 0x6c], eax
jle 0x43b094
mov eax, dword [esp + 0x38]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x40]
call fcn.00423478
lea eax, [edi + 2]
cmp dword [esp + 0x6c], eax
jle 0x43b0ad
mov ecx, dword [esp + 0x38]
push dword [ecx + eax*4]
lea ecx, [esp + 0x44]
call fcn.00423478
lea ecx, [esp + 0x128]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xa4ac], 0xb7
call fcn.0042340a
push ecx
mov byte [esp + 0xa4ac], 0xb8
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43b10a
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
xor edi, edi
inc edi
push edi
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xc88]
push eax
call fcn.0047c820
lea eax, [esp + 0xc7c]
push eax
mov byte [esp + 0xa4ac], 0xb9
call fcn.00427bba
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x44]
pop ecx
cmp dword [eax - 0xc], ebx
je 0x43b16b
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x28], eax
push edi
push edi
push edi
lea eax, [esp + 0x134]
push eax
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x50a194
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c4], 0xba
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x50a1a4
call fcn.0042340a
push ecx
mov byte [esp + 0xa4c8], 0xbb
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x50a1a0
call fcn.0042340a
push ecx
mov byte [esp + 0xa4cc], 0xbc
mov ecx, esp
mov dword [esp + 0x80], esp
push 0x50a198
call fcn.0042340a
push ecx
mov byte [esp + 0xa4d0], 0xbd
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x50a154
call fcn.0042340a
mov byte [esp + 0xa4d0], 0xb9
call fcn.00435611
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x28
call edi
push ebx
push 2
mov dword [esp + 0x3c], eax
push 0x50a148
lea eax, [esp + 0xc88]
push eax
push dword [esp + 0x2c]
call fcn.0042ccb4
add esp, 0x14
cmp eax, ebx
je 0x43b247
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Failed_BasicDeploy_
jmp 0x43938f
call edi
sub eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
cmp dword [eax - 0xc], ebx
je 0x43b300
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0xbe
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4e0954
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0xbf
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.0042341f
push 2
push ecx
mov byte [esp + 0xa4c0], 0xc0
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xc94]
push eax
or ecx, 0xffffffff
mov byte [esp + 0xa4c4], 0xb9
call fcn.0042f15c
add esp, 0x1c
push ebx
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
call fcn.0046d300
pop ecx
pop ecx
cmp eax, ebx
jne 0x43b300
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43b2d6
call edi
push ecx
mov esi, eax
sub esi, dword [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x50a194
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 0xc1
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x50a1a4
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b4], 0xc2
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x50a198
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b8], 0xc3
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x50a154
call fcn.0042340a
mov byte [esp + 0xa4b8], 0xb9
call fcn.004351e2
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.0042148a
lea ecx, [esp + 0x1b4]
mov eax, pe_nt_image_headers32
push ecx
mov byte [esp + 0xa4ac], 0xc4
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x1bc], eax
call fcn.004214c6
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.0042372d
push esi
push dword [esp + 0x38]
lea eax, [esp + 0xfc]
push dword [esp + 0x34]
push dword [0x50a154]
push str._s__s__d_d_r_n
push eax
call fcn.00466a00
add esp, 0x18
mov byte [esp + 0xa4a8], 0xc5
push dword [esp + 0xf4]
lea ecx, [esp + 0x134]
call fcn.00424970
mov byte [esp + 0xa4a8], 0xc6
mov esi, dword [esp + 0x28]
cmp esi, 0xffffffff
je 0x43b43a
push 2
push ebx
push ebx
push esi
mov dword [esp + 0x1cc], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x130]
mov ecx, dword [eax - 0xc]
push ebx
lea edx, [esp + 0x1c0]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x50681c]
lea eax, [esp + 0xf8]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
jmp 0x43b04b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Packager.log
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0xc7
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0xa4b4], 4
call fcn.00466d50
add esp, 8
mov byte [esp + 0xa4ac], 0xc8
lea eax, [esp + 0xdc]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
call fcn.0046a050
pop ecx
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov dword [esp + 0x50], ebx
call fcn.0042340a
lea eax, [esp + 0x778]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0xc9
push dword [0x50681c]
lea eax, [esp + 0x64]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x778]
push eax
call fcn.00438665
add esp, 0x10
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0xca
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0xcb
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push 2
push ecx
mov byte [esp + 0xa4c0], 0xcc
mov ecx, esp
mov dword [esp + 0x34], esp
lea eax, [esp + 0x30]
push eax
call fcn.0042340a
lea eax, [esp + 0x784]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 0xc9
call fcn.0042f15c
lea eax, [esp + 0x788]
add esp, 0x1c
push eax
call fcn.00427bba
mov esi, eax
pop ecx
cmp esi, ebx
je 0x43b5fb
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00465ab0
mov byte [esp + 0xa4b0], 0xcd
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LogsPackager.log
call fcn.0042341f
push esi
mov byte [esp + 0xa4b4], 0xc9
call fcn.0042654c
add esp, 0xc
cmp eax, ebx
jne 0x43b5eb
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_extract_Packager.log_
jmp 0x43938f
push esi
mov dword [esp + 0x44], 1
call fcn.004811b0
jmp 0x43b61d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.Loader__ExtractLog_:_OpenVfc_failed__LE_d
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.00437d52
pop ecx
lea eax, [esp + 0x76c]
call fcn.0047da30
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xe0]
cmp dword [esp + 0x4c], ebx
je 0x43b64d
push str.Success:__s
jmp 0x43b042
push str.Failed_saving__s
jmp 0x43b042
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
mov esi, 0x50a148
push esi
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43b68b
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x658]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0xce
push dword [0x50681c]
lea eax, [esp + 0x64]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x658]
push eax
call fcn.00438665
lea eax, [esp + 0x65c]
push eax
call fcn.00427bba
add esp, 0x14
push 1
push 2
push esi
lea ecx, [esp + 0x658]
push ecx
push eax
call fcn.0042ccb4
mov esi, eax
add esp, 0x14
lea eax, [esp + 0x64c]
call fcn.0047da30
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
cmp esi, ebx
jne 0x43b87e
push dword [0x50a198]
push str.Success:_n_s
jmp 0x43b042
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
mov esi, 0x50a148
push esi
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43b767
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
lea eax, [esp + 0x138]
push eax
mov ecx, esi
call fcn.00492770
pop ecx
mov byte [esp + 0xa4a8], 0xcf
push dword [eax]
lea ecx, [esp + 0x1c8]
call fcn.00424970
mov byte [esp + 0xa4a8], 0xd1
mov ecx, dword [esp + 0x138]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x1c4]
mov ecx, dword [eax - 0xc]
push eax
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov dword [esp + 0x28], ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str..xml
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0xd2
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00465890
pop ecx
push edi
mov byte [esp + 0xa4bc], 0xd1
call fcn.00466d50
mov edi, dword [esp + 0x30]
add esp, 0xc
call fcn.004676c0
pop ecx
pop ecx
push dword [0x50681c]
push ecx
mov dword [esp + 0x18], esp
cmp eax, ebx
je 0x43b87c
mov ecx, esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0xd3
mov eax, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00465890
pop ecx
lea eax, [esp + 0x14c]
push eax
mov byte [esp + 0xa4b8], 0xd1
call fcn.00466d50
add esp, 8
mov byte [esp + 0xa4b0], 0xd4
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Success:_n_s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x140]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x439399
mov eax, esp
push str.Failed_extracting.
push eax
call fcn.00466a00
pop ecx
pop ecx
jmp 0x43b04b
lea ecx, [esp + 0x28]
call fcn.0042148a
lea ecx, [esp + 0xbc]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xa4ac], 0xd6
call fcn.0042340a
mov byte [esp + 0xa4a8], 0xd7
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x6c], ecx
jle 0x43b8e1
mov ecx, dword [esp + 0x38]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x44]
call fcn.00423478
push 1
push ebx
push ecx
lea eax, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x360]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0xd8
push dword [0x50681c]
lea eax, [esp + 0x64]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x360]
push eax
call fcn.00438665
add esp, 0x10
cmp dword [esp + 0x3d8], ebx
jne 0x43b950
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x2c]
call fcn.00425eef
pop ecx
jmp 0x43ba98
lea eax, [esp + 0x48]
lea ecx, [esp + 0x3c0]
call fcn.0043ea3e
jmp 0x43ba72
lea esi, [esp + 0x48]
call fcn.0043eaf7
mov edi, eax
add edi, 0x18
call fcn.0043eaf7
mov eax, dword [eax + 0x28]
call fcn.004281b9
push eax
lea ecx, [esp + 0xb4]
call fcn.0042341f
push 0x4ddb40
lea ecx, [esp + 0xb4]
mov byte [esp + 0xa4ac], 0xd9
call fcn.004239f5
test eax, eax
jne 0x43b9f3
call fcn.0043eaf7
push dword [eax + 0x28]
lea eax, [esp + 0x1d0]
push 0x4e5820
push eax
call fcn.00466a00
add esp, 0xc
push eax
lea ecx, [esp + 0xb4]
mov byte [esp + 0xa4ac], 0xda
call fcn.00423463
mov byte [esp + 0xa4a8], 0xd9
mov ecx, dword [esp + 0x1cc]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [esp + 0x48]
call fcn.0043eaf7
mov ebx, eax
call fcn.0043eaf7
push dword [eax + 0xc]
push dword [eax + 8]
movzx eax, word [edi + 0xc]
push dword [ebx + 4]
push dword [ebx]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 8]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
movzx eax, word [edi + 6]
push eax
call fcn.0043eaf7
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043eaf7
push dword [eax + 0x2c]
lea ebx, [esp + 0x5c]
push dword [esp + 0xe4]
push str._s__s:_Size_lld__Time_.2d__.2d__.4d__.2d:_.2d:_.2d__Offset_lld__Allocated_lld_n
call fcn.00425eef
mov byte [esp + 0xa4e4], 0xd8
mov ecx, dword [esp + 0xec]
add esp, 0x3c
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.0043eb1f
lea eax, [esp + 0x204]
lea ecx, [esp + 0x3c0]
call fcn.0043ea53
mov edi, eax
lea esi, [esp + 0x48]
call fcn.0042395a
test al, al
jne 0x43b965
push str.______________________________n
lea ebx, [esp + 0x2c]
call fcn.00425eef
pop ecx
lea eax, [esp + 0xbc]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
mov esi, str.Main
push esi
call fcn.0042341f
push 3
lea edi, [esp + 0x360]
call fcn.0047ee20
mov eax, dword [esp + 0xbc]
cmp dword [eax - 0xc], 0
jne 0x43baed
push str.Cannot_obtain_INI_info_from_resource__n
mov ecx, ebx
call fcn.00428f7c
jmp 0x43bd3d
lea ecx, [esp + 0x30]
call fcn.0042148a
mov byte [esp + 0xa4a8], 0xdb
call fcn.004726a0
push dword [0x50a198]
lea ebx, [esp + 0x2c]
push str.BaseDirName___ws_n
call fcn.00425eef
push dword [esp + 0xc4]
push str.INI:_n_ws
call fcn.00425eef
add esp, 0xc
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a154]
push str._s.AppVirtDll.dll
push eax
call fcn.00466a00
lea eax, [esp + 0x158]
add esp, 0xc
push eax
call fcn.00466100
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xa4ac], 0xdc
call fcn.00423463
mov byte [esp + 0xa4a8], 0xdb
mov ecx, dword [esp + 0x148]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 0xdd
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push 2
pop ecx
lea edi, [esp + 0x35c]
mov byte [esp + 0xa4b0], 0xdb
call fcn.0047efc0
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x10c]
push eax
call fcn.00486ee0
mov byte [esp + 0xa4b0], 0xde
push dword [eax]
push str.EngineVersion_ws_n
call fcn.00425eef
mov byte [esp + 0xa4b8], 0xdb
mov ecx, dword [esp + 0x118]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
call fcn.0046a050
pop ecx
lea ecx, [esp + 0xc4]
call fcn.0042148a
push ecx
mov byte [esp + 0xa4ac], 0xdf
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a154]
push str._s.SandboxCfg.db
push eax
call fcn.00466a00
lea eax, [esp + 0x1ec]
add esp, 0xc
push eax
call fcn.00466100
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xa4ac], 0xe0
call fcn.00423463
mov byte [esp + 0xa4a8], 0xdf
mov ecx, dword [esp + 0x1dc]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 0xe1
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042341f
push 5
pop ecx
mov byte [esp + 0xa4b0], 0xdf
call fcn.0047efc0
and dword [esp + 0x218], 0
mov esi, dword [esp + 0x30]
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x21c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x218]
call fcn.004856e0
lea eax, [esp + 0xc4]
push eax
push 0x474ad0
push 0
push dword [esp + 0x22c]
mov eax, edi
push eax
call fcn.00486560
push dword [esp + 0xc4]
push str.Sandbox:__ws_n
call fcn.00425eef
pop ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
call fcn.0046a050
pop ecx
mov ecx, dword [esp + 0xc4]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
xor esi, esi
push esi
push str.Info
push dword [esp + 0x30]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
jmp 0x43939a
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43a192
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.0042340a
push 0x2e
lea ecx, [esp + 0x38]
mov byte [esp + 0xa4ac], 0xe6
call fcn.00432b7b
push eax
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x3c]
call fcn.0042360e
push str..new.exe
push eax
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0xa4b4], 0xe7
call fcn.0042366e
add esp, 0xc
mov byte [esp + 0xa4a8], 0xe9
mov ecx, dword [esp + 0x154]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x1a0]
call fcn.0042341f
push ebx
mov byte [esp + 0xa4ac], 0xea
push dword [esp + 0x94]
push dword [esp + 0x1a4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43be2b
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x98]
push dword [esp + 0x40]
push str.Cant_copy__s_to__s
jmp 0x43990e
push ecx
lea eax, [esp + 0x94]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 0xeb
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x164]
push eax
mov byte [esp + 0xa4b4], 0xea
call fcn.00432d49
mov ecx, dword [esp + 0x168]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0042101a
xor esi, esi
inc esi
push esi
push ebx
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x480]
push eax
call fcn.0047c820
push esi
push esi
push ecx
mov byte [esp + 0xa4b4], 0xec
lea eax, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xf10]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0xed
push dword [0x50681c]
lea eax, [esp + 0x64]
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x480]
push eax
call fcn.00438665
add esp, 0x10
lea eax, [esp + 0x48]
lea ecx, [esp + 0x4e0]
call fcn.0043ea3e
jmp 0x43c024
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CEChangeEngine.tmp
call fcn.0042341f
lea eax, [esp + 0x9c]
push eax
call fcn.00466100
add esp, 4
mov byte [esp + 0xa4ac], 0xee
lea eax, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
lea esi, [esp + 0x4c]
mov byte [esp + 0xa4ac], 0xef
call fcn.0043eaf7
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
call fcn.0043eaf7
mov byte [esp + 0xa4b0], 0xee
mov ecx, dword [eax + 0x28]
lea edi, [esp + 0x47c]
call fcn.0047efc0
cmp eax, ebx
jne 0x43c080
call fcn.0043eaf7
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x4000
mov byte [esp + 0xa4b0], 0xf0
call fcn.0043eaf7
push dword [eax + 0x28]
lea eax, [esp + 0xa4]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xf14]
push eax
mov byte [esp + 0xa4bc], 0xee
call fcn.0047e7c0
cmp eax, ebx
jne 0x43c0ac
push ecx
lea eax, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
call fcn.0046a050
pop ecx
mov byte [esp + 0xa4a8], 0xed
mov ecx, dword [esp + 0x98]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.0043eb1f
lea eax, [esp + 0x210]
lea ecx, [esp + 0x4e0]
call fcn.0043ea53
mov edi, eax
lea esi, [esp + 0x48]
call fcn.0042395a
test al, al
jne 0x43bf12
lea eax, [esp + 0x474]
call fcn.0047da30
lea eax, [esp + 0xf04]
call fcn.0047da30
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x98]
push str.Successfully_changed_Loader:__s
jmp 0x43b042
push dword [0x50681c]
call fcn.0043eaf7
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x54]
call fcn.0043eaf7
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x43990f
push dword [0x50681c]
lea esi, [esp + 0x4c]
call fcn.0043eaf7
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
jmp 0x43c099
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.0042340a
push 0x2e
lea ecx, [esp + 0x28]
mov byte [esp + 0xa4ac], 0xf1
call fcn.00432b7b
push eax
lea eax, [esp + 0x1e4]
push eax
lea ecx, [esp + 0x2c]
call fcn.0042360e
push str..new.exe
push eax
lea eax, [esp + 0xa4]
push eax
mov byte [esp + 0xa4b4], 0xf2
call fcn.0042366e
add esp, 0xc
mov byte [esp + 0xa4a8], 0xf4
mov ecx, dword [esp + 0x1e0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0xa8]
call fcn.0042341f
push ebx
mov byte [esp + 0xa4ac], 0xf5
push dword [esp + 0xa0]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43c182
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xa4]
push dword [esp + 0x30]
jmp 0x43be21
push 1
push 1
push ecx
lea eax, [esp + 0xa8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x3f0]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0xf6
push dword [0x50681c]
lea eax, [esp + 0x64]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x3f0]
push eax
call fcn.00438665
add esp, 0x10
cmp dword [esp + 0x468], ebx
jne 0x43c1f8
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_open_PeContainer
jmp 0x43938f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.0042341f
push ebx
push 2
push ecx
mov byte [esp + 0xa4b8], 0xf7
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x3f4]
push eax
mov byte [esp + 0xa4bc], 0xf6
call fcn.0047e7c0
cmp eax, ebx
je 0x43c259
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x43938f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042341f
push ebx
push 8
push ecx
mov byte [esp + 0xa4b8], 0xf8
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
lea eax, [esp + 0xb8]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0042340a
push edi
call fcn.00474bf0
pop ecx
pop ecx
lea eax, [esp + 0x3f4]
push eax
mov byte [esp + 0xa4bc], 0xf6
call fcn.0047e7c0
cmp eax, ebx
je 0x43c2c4
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x43938f
lea ecx, [esp + 0xfc]
call fcn.0042148a
lea ecx, [esp + 0x104]
call fcn.0042148a
lea eax, [esp + 0xfc]
push eax
push ecx
mov byte [esp + 0xa4b0], 0xfa
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0042341f
push 3
lea edi, [esp + 0x3f0]
call fcn.0047ee20
cmp eax, ebx
je 0x43c322
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x43938f
lea eax, [esp + 0x104]
push eax
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
lea eax, [esp + 0xb0]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042340a
push edi
call fcn.00486ee0
add esp, 4
mov byte [esp + 0xa4b4], 0xfb
mov ecx, esp
mov dword [esp + 0x20], esp
push str.EngineVersion
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0xfc
lea eax, [esp + 0x10c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b8], 0xfa
call fcn.0046b0d0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042341f
push 0x4000
push 3
pop esi
push ecx
mov byte [esp + 0xa4b4], 0xfd
lea eax, [esp + 0x110]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042340a
mov ecx, esi
lea ebx, [esp + 0x3f0]
mov byte [esp + 0xa4b4], 0xfa
call fcn.0047e5a0
test eax, eax
je 0x43c3f3
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x43938f
lea eax, [esp + 0x3e4]
call fcn.0047da30
push dword [0x50681c]
lea eax, [esp + 0xa8]
push ecx
mov dword [esp + 0x18], esp
mov esi, esp
push dword [esp + 0xa4]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x174]
push eax
call fcn.00486ee0
pop ecx
pop ecx
mov byte [esp + 0xa4b4], 0xfe
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00466a00
add esp, 0x10
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x164]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43a7c0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.0042340a
push 0x2e
lea ecx, [esp + 0x28]
mov byte [esp + 0xa4ac], 0xff
call fcn.00432b7b
push eax
lea eax, [esp + 0x1ac]
push eax
lea ecx, [esp + 0x2c]
call fcn.0042360e
push str..new.exe
push eax
lea eax, [esp + 0xb4]
push eax
mov dword [esp + 0xa4b4], 0x100
call fcn.0042366e
add esp, 0xc
mov byte [esp + 0xa4a8], 2
mov ecx, dword [esp + 0x1a8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x170]
call fcn.0042341f
push ebx
mov byte [esp + 0xa4ac], 3
push dword [esp + 0xb0]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43c527
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xb4]
push dword [esp + 0x30]
jmp 0x43be21
push 1
push 1
push ecx
lea eax, [esp + 0xb8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x898]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 4
push dword [0x50681c]
lea eax, [esp + 0x64]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x898]
push eax
call fcn.00438665
add esp, 0x10
cmp dword [esp + 0x910], ebx
jne 0x43c598
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c1ee
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Main
call fcn.0042341f
push ebx
push 3
push ecx
mov byte [esp + 0xa4b8], 5
lea eax, [esp + 0x17c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x89c]
push eax
mov byte [esp + 0xa4bc], 4
call fcn.0047e7c0
cmp eax, ebx
je 0x43c5f8
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEINI
jmp 0x43938f
lea eax, [esp + 0x88c]
call fcn.0047da30
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xb4]
push str.Successfully_changed_INI._nNew_package_saved_in:_n_s
jmp 0x43b042
lea esi, [esp + 0x504]
call fcn.0042c15a
mov dword [esp + 0xa4a8], 0x106
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
push dword [edi + esi*4 + 4]
lea ecx, [esp + 0x544]
call fcn.00423478
push dword [edi + esi*4 + 8]
lea ecx, [esp + 0x524]
call fcn.00423478
push dword [edi + esi*4 + 0xc]
lea ecx, [esp + 0x51c]
call fcn.00423478
push eax
lea ecx, [esp + 0x514]
call fcn.00423463
push dword [edi + esi*4 + 0x10]
lea ecx, [esp + 0x54c]
call fcn.00423478
push dword [edi + esi*4 + 0x14]
lea ecx, [esp + 0x548]
call fcn.00423478
lea eax, [esp + 0xd0c]
push eax
lea edi, [esp + 0x508]
call fcn.00491240
lea eax, [esp + 0xd0c]
push eax
mov byte [esp + 0xa4ac], 7
call fcn.004913e0
test eax, eax
je 0x43c71b
mov eax, 0x4e5ea8
cmp dword [esp + 0xd0c], ebx
jne 0x43c6de
mov eax, 0x4e5eb0
push dword [esp + 0xd18]
push dword [esp + 0xd18]
push eax
lea eax, [esp + 0x1d4]
push str.Need_to_update:__s_nVersion:__s_nBuildUID:__s_n
push eax
call fcn.00466a00
add esp, 0x14
push ebx
push str.Server_test:
push dword [esp + 0x1d0]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x439399
push ebx
push str.Server_test:
push str.Failed
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
jmp 0x43939a
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
mov esi, 0x50a148
push esi
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43c768
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
push ebx
push esi
call fcn.00430d6b
pop ecx
jmp 0x439530
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x6e8]
push eax
call fcn.0047c820
push ebx
push ecx
mov dword [esp + 0xa4b0], 0x108
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 9
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0xa
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push 2
push ecx
mov byte [esp + 0xa4c0], 0xb
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x6f4]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 8
call fcn.0042f15c
add esp, 0x1c
lea ecx, [esp + 0x6dc]
call fcn.0042e5da
lea eax, [esp + 0x6dc]
call fcn.0047da30
mov dword [esp + 0xa4a8], 4
lea eax, [esp + 0x6dc]
jmp 0x43a09a
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xbf8]
push eax
call fcn.0047c820
push ebx
push ecx
mov dword [esp + 0xa4b0], 0x10c
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0xd
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0xe
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push 2
push ecx
mov byte [esp + 0xa4c0], 0xf
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xc04]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 0xc
call fcn.0042f15c
add esp, 0x1c
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x20], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.VirtReg.dat
call fcn.0042341f
push 1
mov ecx, esi
call fcn.00479070
add esp, 0x14
call fcn.004904d0
add esp, 0x10
lea eax, [esp + 0xbec]
call fcn.0047da30
mov dword [esp + 0xa4a8], 4
lea eax, [esp + 0xbec]
jmp 0x43a09a
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0xec]
call fcn.0042341f
mov dword [esp + 0xa4a8], 0x110
mov eax, dword [esp + 0x38]
push dword [eax + edi*4 + 8]
lea ecx, [esp + 0x90]
call fcn.0042341f
push 0x10
mov byte [esp + 0xa4ac], 0x11
push ebx
push dword [esp + 0xf0]
call fcn.004af21e
add esp, 8
mov edi, eax
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x90]
push edi
push str.SetFileFlags:__0x_x____s_
push eax
call fcn.00466a00
add esp, 0x10
call fcn.00437d52
pop ecx
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xb68]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0x12
push dword [0x50681c]
lea eax, [esp + 0x64]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xb68]
push eax
call fcn.00438665
add esp, 0x10
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x13
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x14
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push 2
push ecx
mov byte [esp + 0xa4c0], 0x15
mov ecx, esp
mov dword [esp + 0x34], esp
lea eax, [esp + 0x30]
push eax
call fcn.0042340a
lea eax, [esp + 0xb74]
push eax
or ecx, 0xffffffff
mov byte [esp + 0xa4c4], 0x12
call fcn.0042f15c
add esp, 0x1c
call fcn.004726a0
mov esi, 0x509a0c
mov eax, esi
call fcn.004857a0
mov eax, dword [esp + 0x8c]
push ebx
call fcn.00472e10
pop ecx
cmp eax, ebx
je 0x43caec
mov eax, dword [eax + 0x24]
mov dword [eax], edi
push dword [0x509a0c]
mov eax, esi
call fcn.004866e0
test eax, eax
je 0x43cad6
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push edi
push str.Success:_n__x___s
push eax
call fcn.00466a00
add esp, 0x10
call fcn.004385eb
pop ecx
jmp 0x43cb0d
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str._SetFileFlags:_could_not_save_tree
push eax
call fcn.00466a00
pop ecx
pop ecx
jmp 0x43cb08
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x90]
push str._SetFileFlags:_could_not_find__s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00437d52
pop ecx
mov eax, esi
call fcn.004857b0
lea eax, [esp + 0xb5c]
mov byte [esp + 0xa4a8], 0x11
call fcn.00426079
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xe8]
jmp 0x439879
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.DbgZip
call fcn.0042341f
call fcn.00437d82
mov dword [esp], str._DbgZip:
call fcn.004ab8ea
mov edx, dword [esp + 0x34]
pop ecx
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x68]
call fcn.00423478
jmp 0x43927e
push 1
push 0
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x808]
push eax
call fcn.0047c820
push 0
push ecx
mov dword [esp + 0xa4b0], 0x116
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x17
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.0042341f
push 2
push ecx
mov byte [esp + 0xa4c0], 0x19
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x814]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 0x16
call fcn.0042f15c
add esp, 0x1c
push dword [0x50681c]
lea eax, [esp + 0x64]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x808]
push eax
call fcn.00438665
lea eax, [esp + 0x80c]
push eax
push dword [esp + 0x50]
mov ebx, 0x50a148
call fcn.00432829
add esp, 0x18
lea eax, [esp + 0x7fc]
mov dword [esp + 0xa4a8], 4
call fcn.00426079
xor ebx, ebx
jmp 0x439531
push 1
xor ebx, ebx
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xdf0]
push eax
call fcn.0047c820
push ebx
push ecx
mov dword [esp + 0xa4b0], 0x120
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x21
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x22
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push 2
push ecx
mov byte [esp + 0xa4c0], 0x23
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xdfc]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 0x20
call fcn.0042f15c
add esp, 0x1c
lea esi, [esp + 0x48]
call fcn.00482b50
mov byte [esp + 0xa4a8], 0x24
mov dword [esp + 0x40], ebx
jmp 0x43cdbf
push dword [0x50a154]
lea eax, [esp + 0xa298]
push eax
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x43cdbf
xor edi, edi
cmp dword [esp + 0x6290], edi
jbe 0x43cdbf
lea esi, [esp + edi*8 + 0x6294]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x43cdb5
test byte [esp + edi*8 + 0x6298], 3
je 0x43cdb5
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x50a198
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 0x25
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x50a154
call fcn.0042340a
mov byte [esp + 0xa4b0], 0x24
mov ebx, dword [esi]
call fcn.004350a4
pop ecx
pop ecx
inc edi
cmp edi, dword [esp + 0x6290]
jb 0x43cd5f
lea eax, [esp + 0x5a5c]
push eax
lea esi, [esp + 0x44]
lea ebx, [esp + 0x4c]
call fcn.00482610
test eax, eax
jne 0x43cd3b
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [esp + 0x48]
call fcn.00482b70
mov dword [esp + 0xa4a8], 4
lea eax, [esp + 0xde4]
jmp 0x43a09a
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xfa0]
push eax
call fcn.0047c820
mov dword [esp + 0xa4a8], 0x126
push dword [esp + 0x2c]
or edi, 0xffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x27
mov ecx, esp
mov dword [esp + 0x20], esp
push str._Vintegrate_
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x28
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push ebx
push ecx
mov byte [esp + 0xa4c0], 0x29
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xfac]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 0x26
call fcn.0042f15c
add esp, 0x1c
call fcn.0043851f
jmp 0x439399
lea esi, [esp + 0x48]
call fcn.00482b50
mov dword [esp + 0xa4a8], 0x12a
and dword [esp + 0x24], 0
lea ecx, [esp + 0x28]
call fcn.0042148a
mov byte [esp + 0xa4a8], 0x2b
jmp 0x43d19e
lea eax, [esp + 0x585c]
push eax
lea eax, [esp + 0x178]
push str._AppID_ws_n
push eax
call fcn.00466a00
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4ac], 0x2c
call fcn.0042348d
mov byte [esp + 0xa4a8], 0x2b
mov ecx, dword [esp + 0x174]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x1028]
lea eax, [esp + 0x1b4]
push str.____SerialId:__d_n
push eax
call fcn.00466a00
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4ac], 0x2d
call fcn.0042348d
mov byte [esp + 0xa4a8], 0x2b
mov ecx, dword [esp + 0x1b0]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1850]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x180]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00466a00
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4ac], 0x2e
call fcn.0042348d
mov byte [esp + 0xa4a8], 0x2b
mov ecx, dword [esp + 0x17c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x1854]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x1dc]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00466a00
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4ac], 0x2f
call fcn.0042348d
mov byte [esp + 0xa4a8], 0x2b
mov ecx, dword [esp + 0x1d8]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x184]
push str.____Processes:_n
push eax
call fcn.00466a00
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4ac], 0x30
call fcn.0042348d
mov byte [esp + 0xa4a8], 0x2b
mov ecx, dword [esp + 0x184]
add ecx, 0xfffffff0
call fcn.0042101a
xor ebx, ebx
cmp dword [esp + 0x1858], ebx
jbe 0x43d19e
push 0x4d9c38
lea ecx, [esp + 0xb8]
call fcn.0042341f
mov byte [esp + 0xa4a8], 0x31
lea edi, [esp + ebx*8 + 0x185c]
push dword [edi]
lea esi, [esp + 0xb8]
call fcn.00464d20
pop ecx
test eax, eax
jne 0x43d0a2
push 0x4ddb40
mov ecx, esi
call fcn.00423478
push 0x5c
push ecx
lea eax, [esp + 0xbc]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x194]
push eax
call fcn.00466f10
add esp, 0xc
mov byte [esp + 0xa4a8], 0x32
push dword [eax]
lea eax, [esp + 0x1bc]
push dword [edi]
push str._______wd:__ws
push eax
call fcn.00466a00
add esp, 0x10
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4ac], 0x33
call fcn.0042348d
mov ecx, dword [esp + 0x1b8]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0xa4a8], 0x31
mov ecx, dword [esp + 0x18c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + ebx*8 + 0x1860]
test eax, eax
je 0x43d16b
push eax
lea eax, [esp + 0x1d4]
push str._0x_x_
push eax
call fcn.00466a00
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4ac], 0x34
call fcn.0042348d
mov byte [esp + 0xa4a8], 0x31
mov ecx, dword [esp + 0x1d0]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4da15c
lea ecx, [esp + 0x2c]
call fcn.0042898a
mov byte [esp + 0xa4a8], 0x2b
mov ecx, dword [esp + 0xb4]
add ecx, 0xfffffff0
call fcn.0042101a
inc ebx
cmp ebx, dword [esp + 0x1858]
jb 0x43d063
lea eax, [esp + 0x1024]
push eax
lea esi, [esp + 0x28]
lea ebx, [esp + 0x4c]
call fcn.00482610
test eax, eax
jne 0x43ceeb
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
cmp dword [esp + 0x2c], eax
jne 0x43d1e4
push str.No_active_virtual_apps
call fcn.0042341f
call fcn.004385eb
pop ecx
pop ecx
jmp 0x43c72d
lea eax, [esp + 0x30]
push eax
call fcn.0042340a
jmp 0x43a7b9
lea eax, [esp + 0x194]
push eax
mov eax, dword [esp + 0x60]
mov eax, dword [eax + 0x44]
call fcn.0042b7d0
lea eax, [esp + 0x194]
push eax
call fcn.0042b90d
jmp 0x439399
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AutoUpdate
call fcn.0042341f
call fcn.00437d82
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
mov esi, 0x50a148
push esi
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43d262
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x50a184]
push str.AutoUpdate_s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00437d82
mov ecx, 0x50a184
mov dword [esp], str.https:__online.cameyo.com
call fcn.00423478
push str.0000
mov ecx, 0x50a188
call fcn.00423478
mov ecx, esi
call fcn.00493610
jmp 0x439531
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.VirtRegSyncExport
call fcn.0042341f
call fcn.00437d82
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43d2f6
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
call fcn.004363d4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00466a00
add esp, 0xc
jmp 0x43952b
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartStreaming:AppIDSkype
call fcn.0042341f
call fcn.00425da4
jmp 0x43c76f
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43d366
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
xor edi, edi
xor ebx, ebx
call fcn.0042341f
push edi
push ecx
mov dword [esp + 0xa4b4], 0x137
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x50a198]
push str._select___s_
push eax
call fcn.00466a00
add esp, 8
mov byte [esp + 0xa4b8], 0x38
mov ecx, esp
mov dword [esp + 0x30], esp
push str.explorer.exe
call fcn.0042341f
mov dword [esp + 0xa4b8], 4
call fcn.00464f40
add esp, 0x10
jmp 0x43cc78
push str.Vintegrate:
lea ecx, [esp + 0xd8]
call fcn.0042341f
mov dword [esp + 0xa4a8], 0x11a
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push str._VintegrateRecursive
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
je 0x43d42a
push 0x4e6138
call fcn.004ab840
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
jne 0x43d43b
push str.VintegrateRecursive:
lea ecx, [esp + 0xd8]
call fcn.00423478
push str._Windows_Explorer.exe
lea ecx, [esp + 0xd0]
call fcn.0042341f
mov byte [esp + 0xa4a8], 0x1b
mov edi, dword [edi]
push 0x3a
push edi
call fcn.004ac398
pop ecx
pop ecx
cmp eax, ebx
je 0x43d474
add eax, 2
push eax
lea ecx, [esp + 0xd0]
call fcn.00423478
push 1
push ebx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xe80]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0x1c
push dword [esp + 0x2c]
or edi, 0xffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0042341f
push ecx
mov eax, esp
mov byte [esp + 0xa4b4], 0x1d
mov dword [esp + 0x20], esp
lea ecx, [esp + 0xd8]
push ecx
lea ecx, [esp + 0xe4]
push ecx
push eax
call fcn.0042a90e
add esp, 8
mov byte [esp + 0xa4b8], 0x1e
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push ebx
push ecx
mov byte [esp + 0xa4c0], 0x1f
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0042340a
lea eax, [esp + 0xe8c]
push eax
mov ecx, edi
mov byte [esp + 0xa4c4], 0x1c
call fcn.0042f15c
add esp, 0x1c
lea eax, [esp + 0xe74]
mov byte [esp + 0xa4a8], 0x1b
call fcn.00426079
mov ecx, dword [esp + 0xcc]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xd4]
jmp 0x439879
lea eax, [esp + 0x24]
push eax
call fcn.00465ab0
mov byte [esp + 0xa4ac], 0x9c
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
lea edi, [eax + ecx*4]
mov dword [esp], 0x4e5560
call fcn.004ab840
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004ade56
add esp, 0xc
test eax, eax
jne 0x43d5b3
push dword [edi]
lea ecx, [esp + 0x28]
call fcn.00423478
push 0x4e5560
call fcn.004ab840
pop ecx
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.004234b6
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43d5e6
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4393cf
push 0x50a158
lea ecx, [esp + 0x60]
call fcn.0042340a
lea eax, [esp + 0x3c]
push eax
push 0x4de1d0
lea eax, [esp + 0x84]
mov byte [esp + 0xa4b0], 0x9d
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x48], ebx
call fcn.0042899f
jmp 0x43db91
lea ecx, [esp + 0x38]
call fcn.0042148a
lea ecx, [esp + 0x30]
call fcn.0042148a
lea ecx, [esp + 0x28]
call fcn.0042148a
lea ecx, [esp + 0x2c]
call fcn.0042148a
push 0x3e
push ecx
mov byte [esp + 0xa4b0], 0xa2
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov dword [esp + 0x90], ebx
lea edi, [esp + 0x90]
call fcn.0042340a
lea eax, [esp + 0x1c8]
push eax
mov ecx, edi
call fcn.0046a670
add esp, 0xc
mov byte [esp + 0xa4a8], 0xa3
call fcn.00423565
push eax
lea ecx, [esp + 0x3c]
call fcn.00423463
mov byte [esp + 0xa4a8], 0xa2
mov ecx, dword [esp + 0x1c0]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x84], 0xffffffff
jne 0x43d703
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0xa4a8], 0x9d
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43db76
push 0x3e
push ecx
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x90]
call fcn.0042340a
lea eax, [esp + 0x154]
push eax
mov ecx, edi
call fcn.0046a670
add esp, 0xc
mov byte [esp + 0xa4a8], 0xa4
call fcn.00423565
push eax
lea ecx, [esp + 0x34]
call fcn.00423463
mov byte [esp + 0xa4a8], 0xa2
mov ecx, dword [esp + 0x14c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x84], 0xffffffff
je 0x43d6ba
push 0x3e
push ecx
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x158]
push eax
mov ecx, edi
call fcn.0046a670
add esp, 0xc
mov byte [esp + 0xa4a8], 0xa5
call fcn.00423565
push eax
lea ecx, [esp + 0x2c]
call fcn.00423463
mov byte [esp + 0xa4a8], 0xa2
mov ecx, dword [esp + 0x150]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x84], 0xffffffff
jne 0x43d7da
push esi
lea ecx, [esp + 0x2c]
call fcn.00423478
jmp 0x43d837
push 0x3e
push ecx
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x90]
call fcn.0042340a
lea eax, [esp + 0x160]
push eax
mov ecx, edi
call fcn.0046a670
add esp, 0xc
mov byte [esp + 0xa4a8], 0xa6
call fcn.00423565
push eax
lea ecx, [esp + 0x30]
call fcn.00423463
mov byte [esp + 0xa4a8], 0xa2
mov ecx, dword [esp + 0x158]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x84], 0xffffffff
jne 0x43d84b
push esi
lea ecx, [esp + 0x30]
call fcn.00423478
push dword [esp + 0x38]
lea eax, [esp + 0x98]
push str._exec___s_
push eax
call fcn.00466a00
add esp, 0xc
mov byte [esp + 0xa4a8], 0xa7
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], ebx
je 0x43d897
push 0x4df03c
lea ecx, [esp + 0x98]
call fcn.0042898a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x98]
call fcn.0042348d
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
push ecx
mov esi, esp
mov byte [esp + 0xa4b0], 0xa8
mov dword [esp + 0x1c], esp
push 0x5c
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0042340a
push esi
call fcn.00466f10
lea eax, [esp + 0x104]
add esp, 0xc
push eax
mov byte [esp + 0xa4b4], 0xa7
call fcn.0042831a
add esp, 8
mov byte [esp + 0xa4ac], 0xa9
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x4d9c3c
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0xaa
lea eax, [esp + 0xf8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b4], 0xab
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x50a198
call fcn.0042340a
lea edi, [esp + 0xc4]
mov byte [esp + 0xa4b4], 0xa9
call fcn.00466550
add esp, 8
mov byte [esp + 0xa4ac], 0xac
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042341f
push ecx
mov eax, esp
mov byte [esp + 0xa4b0], 0xad
mov dword [esp + 0x1c], esp
push str..lnk
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.0042366e
add esp, 8
mov byte [esp + 0xa4b4], 0xae
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
lea edi, [esp + 0x16c]
mov byte [esp + 0xa4b4], 0xac
call fcn.00466550
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x160]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0xbc]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042340a
call fcn.00469380
pop ecx
cmp eax, ebx
je 0x43d9f3
lea eax, [esp + 0xb8]
jmp 0x43da0d
push ebx
lea ecx, [esp + 0x16c]
call fcn.0042341f
mov byte [esp + 0xa4a8], 0xaf
or dword [esp + 0x34], 2
mov eax, dword [eax]
push ebx
push ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042340a
push ecx
mov dword [esp + 0xa4b4], 0xb0
lea eax, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b8], 0xb1
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4bc], 0xb2
mov dword [esp + 0x54], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push esi
call fcn.0042341f
push ecx
mov eax, esp
mov byte [esp + 0xa4c4], 0xb3
mov dword [esp + 0x90], esp
push str..lnk
lea ecx, [esp + 0x48]
push ecx
push eax
call fcn.0042366e
add esp, 8
mov byte [esp + 0xa4c8], 0xb4
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x68], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4c8], 0xb2
call fcn.00466550
mov esi, dword [esp + 0x3c]
add esp, 0xc
mov byte [esp + 0xa4bc], 0xaf
call fcn.0048f350
add esp, 0x14
mov dword [esp + 0xa4a8], 0xac
test byte [esp + 0x34], 2
je 0x43db00
mov ecx, dword [esp + 0x168]
and dword [esp + 0x34], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xb8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xf0]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x94]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0xa4a8], 0x9d
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, 0x4d9c38
lea eax, [esp + 0x3c]
push eax
push 0x4de1d0
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x68]
call fcn.0042899f
cmp dword [esp + 0x3c], 0xffffffff
jne 0x43d620
mov byte [esp + 0xa4a8], 0x9d
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push dword [0x50a154]
push str.Shortcuts_created_for__s.
jmp 0x43b042
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
call fcn.0042340a
mov byte [esp + 0xa4a8], 0x8c
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push str._FullIntegrate
push dword [edi]
mov dword [esp + 0x3c], edi
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x43ddbc
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042340a
push 0x50a148
call fcn.00427b4f
pop ecx
pop ecx
test al, al
jne 0x43dc3b
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x4393cf
push 0x50a198
lea ecx, [esp + 0x28]
call fcn.0042340a
mov byte [esp + 0xa4a8], 0x8d
cmp dword [esp + 0x3c], ebx
je 0x43dca0
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x50a154
call fcn.0042340a
lea eax, [esp + 0x174]
push eax
call fcn.00436693
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xa4ac], 0x8e
call fcn.00423463
mov byte [esp + 0xa4a8], 0x8d
mov ecx, dword [esp + 0x170]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x4d9c3c
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0x8f
mov eax, esp
mov dword [esp + 0x7c], esp
push dword [0x50a154]
push str._s.host.exe
push eax
call fcn.00466a00
add esp, 8
mov byte [esp + 0xa4b4], 0x90
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042340a
lea edi, [esp + 0x184]
mov byte [esp + 0xa4b4], 0x8d
call fcn.00466550
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xa4ac], 0x91
call fcn.00423463
mov byte [esp + 0xa4a8], 0x8d
mov ecx, dword [esp + 0x178]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0x24]
call fcn.00469460
test eax, eax
jne 0x43dd50
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Could_not_create_virtual_repository
jmp 0x43938f
lea eax, [esp + 0x180]
push eax
call fcn.00465890
mov eax, dword [eax]
pop ecx
push ebx
push dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x180]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x47], al
call fcn.0042101a
cmp byte [esp + 0x47], 0
je 0x43dda3
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Could_not_copy_executable_to_repository
jmp 0x43938f
lea ecx, [esi - 0x10]
mov byte [esp + 0xa4a8], 0x8c
call fcn.0042101a
mov edi, dword [esp + 0x34]
mov esi, 0x4d9c38
push 1
push ebx
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x9b8]
push eax
call fcn.0047c820
push ebx
push ecx
mov byte [esp + 0xa4b0], 0x92
mov ecx, esp
mov dword [esp + 0x50], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x93
mov ecx, esp
mov dword [esp + 0x80], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x94
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.0042341f
push 2
push ecx
mov byte [esp + 0xa4c0], 0x95
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x9c4]
push eax
or ecx, 0xffffffff
mov byte [esp + 0xa4c4], 0x92
call fcn.0042f15c
add esp, 0x1c
push str._Integrate:once
push dword [edi]
call fcn.004ab635
pop ecx
pop ecx
mov edi, str.SoftwareVOS_s
test eax, eax
jne 0x43dfa5
push esi
lea ecx, [esp + 0x8c]
call fcn.0042341f
xor eax, eax
push eax
push eax
push eax
push ecx
mov byte [esp + 0xa4b8], 0x96
mov ecx, esp
mov dword [esp + 0x58], esp
push str.Registered
lea ebx, [esp + 0x9c]
call fcn.0042341f
mov byte [esp + 0xa4b8], 0x97
push dword [0x50a154]
lea eax, [esp + 0x19c]
push edi
push eax
call fcn.00466a00
add esp, 8
mov byte [esp + 0xa4bc], 0x98
mov ecx, esp
mov dword [esp + 0x88], esp
push str.Integrated
push eax
push ecx
mov dword [esp + 0x54], 1
call fcn.0042366e
add esp, 0xc
mov dword [esp + 0xa4bc], 0x99
call fcn.00478650
push eax
mov byte [esp + 0xa4c0], 0x9a
call fcn.004677d0
add esp, 0x18
test eax, eax
je 0x43df20
mov eax, dword [esp + 0x88]
cmp dword [eax - 0xc], 0
je 0x43df20
mov bl, 1
jmp 0x43df22
xor bl, bl
mov dword [esp + 0xa4a8], 0x96
mov ecx, dword [esp + 0x188]
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x43df8e
push str.Success
lea eax, [esp + 0x8c]
call fcn.004234a2
push ecx
test eax, eax
mov dword [esp + 0x4c], esp
mov eax, esp
jne 0x43df73
push str._Integrate:once:_already_registered_successfully._Quitting.
push eax
call fcn.00466a00
pop ecx
pop ecx
call fcn.00437d52
jmp 0x43a7bf
push dword [esp + 0x8c]
push str._Integrate:once:_already_attempted_registration_before__but_failed:__s._Trying_integration_again.
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00437d52
pop ecx
mov byte [esp + 0xa4a8], 0x92
mov ecx, dword [esp + 0x88]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
cmp dword [esp + 0x3c], eax
push 0
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AllUsers
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x9b
mov eax, esp
mov dword [esp + 0x84], esp
push dword [0x50a154]
push edi
push eax
call fcn.00466a00
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0xa4bc], 0x92
call fcn.00467cf0
add esp, 0x14
lea eax, [esp + 0x9ac]
push eax
push dword [esp + 0x40]
mov ebx, 0x50a148
call fcn.00432829
pop ecx
pop ecx
lea eax, [esp + 0x9ac]
call fcn.0047da30
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push dword [0x50a154]
push str._s_is_now_integrated_into_your_system.
jmp 0x43a7b0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00465540
test eax, eax
jne 0x43e0b8
mov eax, dword [esp + 0x38]
push ebx
push ebx
push ebx
push ecx
mov esi, esp
mov dword [esp + 0x58], esp
push ecx
mov ecx, esp
mov dword [esp + 0x88], esp
push dword [eax]
call fcn.0042341f
push esi
call fcn.0046c580
add esp, 4
mov byte [esp + 0xa4bc], 0x32
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x88], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4bc], 4
call fcn.004650b0
add esp, 0x14
cmp eax, ebx
jne 0x439399
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x43938a
call fcn.00465840
test eax, eax
jne 0x43e0d3
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x43898a
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push 0x4e4a3c
mov dword [esp + 0x38], edi
call fcn.004ab840
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004ade56
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x18]
sbb edi, edi
push eax
lea ecx, [esp + 0x60]
inc edi
call fcn.0042340a
push ecx
mov byte [esp + 0xa4ac], 0x33
mov ecx, esp
mov dword [esp + 0x4c], esp
push str..new.exe
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0x34
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x88]
push eax
mov byte [esp + 0xa4b4], 0x33
call fcn.00466d50
add esp, 0xc
mov byte [esp + 0xa4a8], 0x35
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x34]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push dword [eax]
call fcn.0042341f
lea eax, [esp + 0xd4]
push eax
call fcn.0046c580
pop ecx
pop ecx
push 1
push ebx
push ecx
mov byte [esp + 0xa4b4], 0x36
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x5c8]
push eax
call fcn.0047c820
mov byte [esp + 0xa4a8], 0x37
push dword [0x50681c]
cmp dword [esp + 0x644], ebx
jne 0x43e1e7
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push dword [esp + 0x20]
push str.Cannot_load_newly_created_package__s
jmp 0x43950c
push 1
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x5c8]
push eax
call fcn.00438665
add esp, 0x10
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b4], 0x38
mov ecx, esp
mov dword [esp + 0x80], esp
push esi
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b8], 0x39
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042340a
push 2
push ecx
mov byte [esp + 0xa4c0], 0x3a
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x5d4]
push eax
or ecx, 0xffffffff
mov byte [esp + 0xa4c4], 0x37
call fcn.0042f15c
add esp, 0x1c
push dword [0x50a154]
lea eax, [esp + 0xa4]
push dword [0x50a198]
push str._sAppVirtDll__s.dll
push eax
call fcn.00466a00
add esp, 0xc
mov byte [esp + 0xa4ac], 0x3b
lea eax, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042340a
call fcn.00425545
pop ecx
cmp eax, ebx
je 0x43e327
push dword [0x50681c]
cmp eax, 0x11
jne 0x43e2e9
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00466a00
pop ecx
pop ecx
jmp 0x439394
cmp eax, 0x12
jne 0x43e2fc
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x43e2dc
push eax
lea eax, [esp + 0x204]
push eax
call fcn.0046db80
add esp, 4
mov byte [esp + 0xa4b0], 0x3c
mov ecx, esp
mov dword [esp + 0x50], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x439e35
push dword [esp + 0xd0]
lea eax, [esp + 0x194]
push str._exec__s
push eax
call fcn.00466a00
mov eax, dword [eax]
add esp, 0xc
push ebx
push ebx
push eax
push dword [esp + 0x24]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
mov ecx, dword [esp + 0x190]
add ecx, 0xfffffff0
call fcn.0042101a
cmp esi, ebx
je 0x43e3bb
cmp edi, ebx
je 0x43e383
push 1
push 0x4da160
push str.Installation_launched_in_virtual_mode..._nWhen_installation_is_done__click_OK_and_Cameyo_will_turn_it_into_a_virtual_package._nInstallation_will_not_truly_install_anything_on_your_hard_drive__it_is_simulated_.
jmp 0x43e38e
push ebx
push 0x4da160
push str.When_installation_is_done__click_OK.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x43e3bb
push ecx
lea eax, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042340a
call fcn.004255cc
pop ecx
push 0x14
jmp 0x43939a
push ecx
lea eax, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042340a
call fcn.004255cc
pop ecx
cmp eax, ebx
je 0x43e436
push dword [0x50681c]
cmp eax, 0x11
jne 0x43e3f5
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x43e2dc
cmp eax, 0x12
jne 0x43e40b
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x43e2dc
push eax
lea eax, [esp + 0x200]
push eax
call fcn.0046db80
add esp, 4
mov byte [esp + 0xa4b0], 0x3d
mov ecx, esp
mov dword [esp + 0x50], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x439e35
cmp esi, ebx
jne 0x43e458
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push dword [esp + 0xd8]
push str.Failed_executing__s
jmp 0x43950c
mov esi, dword [esp + 0x5c]
cmp edi, ebx
je 0x43e53c
call fcn.0042b295
push 0x407
mov edi, 0x50a148
call fcn.00481ae0
pop ecx
push ebx
push dword [esp + 0x84]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x80]
jne 0x43e4a5
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x439d4f
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.0042340a
call fcn.00434ac1
pop ecx
pop ecx
mov dword [esp + 0x40], eax
cmp eax, ebx
jne 0x43e5ba
push dword [0x50681c]
lea eax, [esp + 0x84]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x118]
push eax
call fcn.00466f10
add esp, 8
mov byte [esp + 0xa4b0], 0x3e
mov ecx, esp
mov dword [esp + 0x50], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov byte [esp + 0xa4a8], 0x3b
mov ecx, dword [esp + 0x10c]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
call fcn.00481ae0
pop ecx
lea eax, [esp + 0x5bc]
call fcn.0047da30
push dword [0x50681c]
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
push dword [esp + 0x88]
push 0x4e4f2c
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0xa0]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x5bc]
mov byte [esp + 0xa4a8], 0x36
call fcn.00426079
mov ecx, dword [esp + 0xd0]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
jmp 0x43987c
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x40], 0x10
push dword [0x50681c]
jne 0x43e5e0
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x439e02
push dword [esp + 0x44]
lea eax, [esp + 0x214]
push eax
call fcn.0046db80
add esp, 4
mov byte [esp + 0xa4b0], 0x3f
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x439e2e
lea ecx, [esp + 0x34]
call fcn.0042148a
lea ecx, [esp + 0x3c]
call fcn.0042148a
mov byte [esp + 0xa4a8], 0x29
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
lea esi, [eax + ecx*4]
push str._CreateDiff
push dword [esi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x43e64e
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00423463
jmp 0x43e668
push 0x4e49f8
call fcn.004ab840
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x38]
call fcn.00423478
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push str..mod
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0x2a
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x11c]
push eax
mov byte [esp + 0xa4b4], 0x29
call fcn.00466d50
add esp, 0xc
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4ac], 0x2b
call fcn.00423463
mov byte [esp + 0xa4a8], 0x29
mov ecx, dword [esp + 0x114]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x3c]
jne 0x43e706
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x439d4f
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.0042340a
call fcn.00434ac1
pop ecx
pop ecx
mov dword [esp + 0x5c], eax
cmp eax, ebx
jne 0x43e77d
push dword [0x50681c]
lea eax, [esp + 0x40]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x128]
push eax
call fcn.00466f10
add esp, 8
mov byte [esp + 0xa4b0], 0x2c
mov ecx, esp
mov dword [esp + 0x50], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x11c]
jmp 0x43e951
push edi
call esi
cmp dword [esp + 0x5c], 0x10
push dword [0x50681c]
jne 0x43e799
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x439e02
push dword [esp + 0x60]
lea eax, [esp + 0x208]
push eax
call fcn.0046db80
add esp, 4
mov byte [esp + 0xa4b0], 0x2d
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x439e2e
lea ecx, [esp + 0x34]
call fcn.0042148a
lea ecx, [esp + 0x3c]
call fcn.0042148a
mov byte [esp + 0xa4a8], 0x1c
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
lea esi, [eax + ecx*4]
push str._LearnStreaming
push dword [esi]
call fcn.004ab635
pop ecx
pop ecx
test eax, eax
jne 0x43e807
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00423463
jmp 0x43e821
push 0x4e47c4
call fcn.004ab840
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x38]
call fcn.00423478
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push str..new.exe
call fcn.0042341f
push ecx
mov byte [esp + 0xa4b0], 0x1d
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0xa4b4], 0x1c
call fcn.00466d50
add esp, 0xc
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4ac], 0x1e
call fcn.00423463
mov byte [esp + 0xa4a8], 0x1c
mov ecx, dword [esp + 0x124]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x3c]
jne 0x43e8bf
push dword [0x50681c]
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
jmp 0x439d4f
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042340a
push ecx
mov byte [esp + 0xa4b0], 0x1f
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.0042340a
mov byte [esp + 0xa4b0], 0x1c
call fcn.00434ca8
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x43e96a
push dword [0x50681c]
lea eax, [esp + 0x40]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.0042340a
lea eax, [esp + 0x138]
push eax
call fcn.00466f10
add esp, 8
mov byte [esp + 0xa4b0], 0x20
mov ecx, esp
mov dword [esp + 0x50], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.004385eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x12c]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
mov ecx, dword [esp + 0x34]
jmp 0x439879
push edi
call esi
push dword [0x50681c]
lea eax, [esp + 0x1f8]
push dword [esp + 0x20]
push eax
call fcn.0046db80
add esp, 4
mov byte [esp + 0xa4b0], 0x21
mov ecx, esp
mov dword [esp + 0x50], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x439e35
cmp dword [0x509e58], ebx
je 0x43e9d7
push ecx
mov eax, esp
mov dword [esp + 0x4c], esp
push dword [0x50a184]
push str.CLoaderApp:_waiting_for_LoaderCanQuit__AutoUpdate_s_
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00437d52
pop ecx
push esi
push dword [0x509e58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.CLoaderApp:_done._Bye_
call fcn.0042341f
call fcn.00437d52
jmp 0x43b051