Function at 0x42c04e
Capabilities:
Check for time delay via gettickcount
Create thread
Get file attributes
Set current directory
Set environment variable
Terminate process

Disassembly:
push 0x274
mov eax, 0x4c3344
call fcn.004a9ca4
mov ebx, ecx
mov edi, edx
xor esi, esi
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x234], esi
push 3
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x244], esi
call fcn.0049673f
push eax
lea ecx, [ebp - 0x250]
call fcn.004249c2
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 4
call fcn.00461180
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x220], esp
push dword [eax]
push str.Loader_Main:_in:_ProcessName_s
push ecx
call fcn.00462050
add esp, 0xc
call fcn.0042a10d
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
call fcn.004271e9
pop ecx
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x42c0f7
push str.Cannot_open_ZIP__RESOURCE_COREZIP_
call fcn.0042a13d
lea eax, [ebp + 8]
push eax
mov ecx, 0x4f4b10
call fcn.00423ab3
push edi
push 0x4f4ac8
call fcn.004270a9
pop ecx
pop ecx
cmp ebx, 0xffffffff
je 0x42c11d
mov dword [0x4f4b34], ebx
push ecx
mov dword [ebp - 0x23c], esp
mov ecx, esp
mov ebx, 0x4f4ad0
push ebx
call fcn.00423a92
mov ecx, esi
call fcn.00472f00
pop ecx
cmp word [0x4f4b18], si
je 0x42c1ac
xor eax, eax
mov word [ebp - 0x27c], ax
lea edi, [ebp - 0x27a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [ebp - 0x27c]
cmp ax, word [0x4f4b18]
jb 0x42c1ac
mov ax, word [ebp - 0x27a]
cmp ax, word [0x4f4b1a]
jb 0x42c1ac
mov ax, word [ebp - 0x276]
cmp ax, word [0x4f4b1e]
jb 0x42c1ac
push esi
push str.Expiration
push str.Package_expired
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.Vintegrate:
call fcn.00423416
push ecx
mov byte [ebp - 4], 6
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24c], esp
mov ecx, esp
push eax
call fcn.00423a92
mov byte [ebp - 4], 4
call fcn.00466470
add esp, 0xc
cmp eax, esi
je 0x42c1f2
mov dword [ebp - 0x244], 1
jmp 0x42c236
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.VintegrateRecursive:
call fcn.00423416
push ecx
mov byte [ebp - 4], 7
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24c], esp
mov ecx, esp
push eax
call fcn.00423a92
mov byte [ebp - 4], 4
call fcn.00466470
add esp, 0xc
cmp eax, esi
je 0x42c261
mov dword [ebp - 0x244], 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x250]
call fcn.00423ab3
push esi
push 0x3a
lea ecx, [ebp - 0x250]
call fcn.00425613
push esi
lea ecx, [ebp - 0x250]
inc eax
push ecx
call fcn.004234ad
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
mov esi, 0x4f4ac8
call fcn.00423a92
mov ecx, esi
call fcn.0042bf1e
pop ecx
xor edi, edi
push edi
push dword [ebp - 0x244]
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.VintegrateMode
call fcn.00423416
push ecx
mov byte [ebp - 4], 8
mov esi, esp
mov dword [ebp - 0x24c], esp
push ecx
mov dword [ebp - 0x258], esp
mov ecx, esp
push ebx
call fcn.00423a92
call fcn.0046f180
pop ecx
mov byte [ebp - 4], 9
call fcn.00472430
push eax
mov byte [ebp - 4], 4
call fcn.00463460
add esp, 0x14
push edi
push ecx
lea eax, [ebp - 0x250]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
call fcn.00423a92
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x24c], esp
push str.VintegrateTgtPattern
call fcn.00423416
push ecx
mov byte [ebp - 4], 0xb
mov esi, esp
mov dword [ebp - 0x258], esp
push ecx
mov dword [ebp - 0x26c], esp
mov ecx, esp
push ebx
call fcn.00423a92
call fcn.0046f180
pop ecx
mov byte [ebp - 4], 0xc
call fcn.00472430
push eax
mov byte [ebp - 4], 4
call fcn.00463330
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.StartTickTime
call fcn.00423416
mov byte [ebp - 4], 0xd
push ecx
mov esi, esp
mov dword [ebp - 0x24c], esp
push ecx
mov dword [ebp - 0x258], esp
mov ecx, esp
push ebx
call fcn.00423a92
call fcn.0046f180
pop ecx
mov byte [ebp - 4], 0xe
call fcn.00472430
push eax
mov byte [ebp - 4], 4
call fcn.00463460
add esp, 0x10
mov dword [ebp - 0x23c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push 0x4cb098
call fcn.00423416
push ecx
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x24c], esp
push 0x4cdac0
call fcn.00423416
push ecx
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x258], esp
mov ecx, esp
push 0x4f4b0c
call fcn.00423a92
mov byte [ebp - 4], 4
call fcn.00461ba0
add esp, 0xc
call fcn.00464ac0
pop ecx
test eax, eax
jne 0x42c466
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x25c], eax
call fcn.00434639
push 0x405
mov edi, 0x4f4ac8
call fcn.0047c8d0
pop ecx
xor ebx, ebx
push dword [0x4f4ad0]
lea eax, [ebp - 0x21c]
push dword [0x4f4b0c]
push str._sAppVirtDll__s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [0x4f4ad0]
add esp, 0x10
push dword [0x4f4ad8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x4f4b14]
push eax
mov eax, esi
call fcn.0047d1f0
mov esi, 0x4cd12c
cmp dword [0x4f4ad4], ebx
je 0x42c4c7
mov eax, 0x4f4ad4
jmp 0x42c4e1
mov eax, dword [0x4f4b08]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x42c40e
cmp dword [ebp + 0xc], 2
je 0x42c40e
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x23c], esp
push dword [0x4f4ad0]
push str.StartStreaming:AppID_s
push eax
call fcn.00462050
add esp, 0xc
call fcn.00425d5d
pop ecx
pop ecx
cmp eax, ebx
jne 0x42c40e
push dword [0x4f4ad0]
lea eax, [ebp - 0x220]
push str.Cannot_stream_application__s_
push eax
call fcn.00462050
add esp, 0xc
push dword [eax]
jmp 0x42c0f2
push esi
lea ecx, [ebp - 0x280]
call fcn.00423416
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x234], 1
push eax
lea ecx, [ebp - 0x240]
call fcn.00423a92
mov dword [ebp - 4], 0x13
test byte [ebp - 0x234], 1
je 0x42c512
mov ecx, dword [ebp - 0x280]
and dword [ebp - 0x234], 0xfffffffe
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0x268], ebx
je 0x42c741
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
jne 0x42c572
push 0x3b
push dword [0x4f4ad4]
call fcn.004a55da
pop ecx
pop ecx
test eax, eax
jne 0x42c547
cmp dword [ebp + 0xc], 1
jne 0x42c741
push 0x404
mov edi, 0x4f4ac8
call fcn.0047c8d0
pop ecx
push ebx
push ebx
push ebx
push 0x42be38
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x268], eax
jmp 0x42c741
push 1
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp + 0x14]
call fcn.00423605
push 0x4cf7fc
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.004239bd
neg eax
sbb al, al
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x230]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x221], al
call fcn.0042101a
cmp byte [ebp - 0x221], 0
je 0x42c741
push ebx
lea eax, [ebp + 0x14]
push eax
xor eax, eax
inc eax
call fcn.004234ad
push dword [ebp + 0x14]
call fcn.004a5850
pop ecx
push esi
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x228], ebx
call fcn.00423416
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
jle 0x42c714
mov edi, 0x4ce710
lea eax, [ebp - 0x228]
push eax
push 0x4ce700
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x240]
call fcn.00427925
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x16
call fcn.00423ab3
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x42c6e4
lea eax, [ebp - 0x258]
push eax
push edi
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x258], ebx
call fcn.00427925
push edi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 0x17
call fcn.00423665
add esp, 0xc
lea ecx, [ebp + 0x18]
push ecx
push eax
lea eax, [ebp - 0x24c]
push eax
mov byte [ebp - 4], 0x18
call fcn.004296a6
add esp, 0xc
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x19
call fcn.00423ab3
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x228], 0xffffffff
je 0x42c771
mov eax, dword [ebp - 0x238]
cmp dword [eax - 0xc], ebx
je 0x42c771
inc dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x230]
jl 0x42c607
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x240]
call fcn.00423ab3
push esi
lea ecx, [ebp + 0x14]
call fcn.00423ebc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
push dword [ebp + 0xc]
mov ecx, 0x4f4ac8
push dword [ebp - 0x264]
push dword [ebp - 0x220]
call fcn.0042a7e5
add esp, 0x10
cmp eax, ebx
je 0x42c78f
cmp eax, 7
jne 0x42c77b
push 0x4cf800
jmp 0x42c0f2
push 0xff
jmp 0x42c1a6
lea ecx, [ebp - 0x220]
push ecx
mov edx, eax
call fcn.00469060
pop ecx
jmp 0x42c4c0
push 1
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
mov esi, str.RequireManaged
push esi
call fcn.00423416
push ecx
mov byte [ebp - 4], 0x1a
mov ecx, esp
mov dword [ebp - 0x264], esp
mov edi, str.SoftwareCameyo
push edi
call fcn.00423416
push SysReAllocStringLen
mov byte [ebp - 4], 0x13
call fcn.00463220
add esp, 0x14
cmp eax, ebx
jne 0x42c81e
push 1
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push esi
call fcn.00423416
push ecx
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ebp - 0x264], esp
push edi
call fcn.00423416
mov byte [ebp - 4], 0x1c
call fcn.00472430
push eax
mov byte [ebp - 4], 0x13
call fcn.00463220
add esp, 0x14
cmp eax, ebx
je 0x42c874
cmp dword [ebp - 0x260], ebx
je 0x42c874
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_RequireManaged
call fcn.00423416
call fcn.0042a10d
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
call fcn.00423416
call fcn.00425122
pop ecx
cmp eax, ebx
jne 0x42c874
push ebx
push 0x4cb5c0
push str.You_are_not_allowd_to_use_unmanaged_apps.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
jmp 0x42c1a6
mov eax, dword [0x4f4b38]
cmp dword [eax - 0xc], ebx
je 0x42c897
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f4b38
call fcn.00423a92
call fcn.0042bc6c
pop ecx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42c8e4
push 1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp + 0x14]
call fcn.00423605
mov byte [ebp - 4], 0x1d
or dword [ebp - 0x234], 2
push 0x4cf7fc
mov ecx, eax
call fcn.004239bd
test eax, eax
je 0x42c8e4
push ebx
push 0x5c
lea ecx, [ebp + 0x14]
call fcn.00425613
mov byte [ebp - 0x221], 1
cmp eax, 0xffffffff
je 0x42c8eb
mov byte [ebp - 0x221], 0
mov dword [ebp - 4], 0x13
test byte [ebp - 0x234], 2
je 0x42c909
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x221], 0
je 0x42c9df
call fcn.0049673f
push eax
lea ecx, [ebp - 0x228]
call fcn.004249c2
mov byte [ebp - 4], 0x1e
call fcn.0049673f
push eax
lea ecx, [ebp - 0x22c]
call fcn.004249c2
mov byte [ebp - 4], 0x1f
call fcn.0046c260
lea eax, [ebp - 0x22c]
push eax
push 0x42a4be
push ebx
push dword [0x4f4418]
push 0x4f4410
call fcn.004811b0
push ebx
lea eax, [ebp - 0x228]
push eax
push ebx
push ecx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423a92
push ecx
mov byte [ebp - 4], 0x20
lea eax, [ebp + 0x14]
mov dword [ebp - 0x264], esp
mov ecx, esp
push eax
call fcn.00423a92
mov byte [ebp - 4], 0x1f
call fcn.0046e440
add esp, 0x14
cmp eax, ebx
je 0x42c9bf
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 0x14]
call fcn.00423ab3
lea eax, [ebp + 0x14]
push eax
call fcn.00471df0
pop ecx
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp + 0x14]
push dword [ebp - 0x240]
push dword [ebp + 0xc]
push str.Loader_Main:_AutoLaunchMode_d__AutoLaunchRaw_s__ExecCmd_s
push eax
call fcn.00462050
add esp, 0x14
call fcn.0042a10d
cmp dword [ebp + 0xc], 2
pop ecx
je 0x42d230
mov eax, dword [0x4f4af8]
cmp dword [eax - 0xc], ebx
je 0x42cb5d
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x42ca3d
push 0x4cfa34
lea ecx, [ebp + 0x14]
call fcn.004239bd
test eax, eax
jne 0x42cb5d
lea esi, [ebp - 0x27c]
call fcn.0047d940
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f4ad0
call fcn.00423a92
call fcn.0047d260
mov esi, eax
cmp esi, ebx
je 0x42cb27
cmp dword [esi + 0x834], ebx
je 0x42cb27
call fcn.0049673f
push eax
lea ecx, [ebp - 0x230]
call fcn.004249c2
mov byte [ebp - 4], 0x22
cmp dword [esi + 0x834], ebx
mov dword [ebp - 0x22c], ebx
jle 0x42caf9
lea edi, [esi + 0x838]
push dword [edi]
lea eax, [ebp - 0x220]
push 0x4cfa3c
push eax
call fcn.00462050
add esp, 0xc
mov byte [ebp - 4], 0x23
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x230]
push eax
call fcn.00424476
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
inc dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
add edi, 8
cmp eax, dword [esi + 0x834]
jl 0x42caa5
mov esi, dword [ebp - 0x230]
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push esi
push str.AutoUpdate:_app_already_running__aborting__PIDs_s_
push eax
call fcn.00462050
add esp, 0xc
call fcn.0042a10d
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042101a
jmp 0x42cb4e
mov eax, dword [0x4f484c]
cmp eax, ebx
je 0x42cb37
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
push 0x42beff
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0x13
call fcn.0047d960
test byte [0x4f4b34], 2
je 0x42cb70
mov ecx, 0x4f4ac8
call fcn.004230dd
cmp dword [ebp - 0x244], ebx
je 0x42cc31
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x230]
call fcn.00423a92
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 0x24
call fcn.00471df0
mov edi, dword [ebp - 0x230]
pop ecx
push 1
push edi
lea ecx, [ebp - 0x21c]
call fcn.00424d89
pop ecx
pop ecx
test eax, eax
je 0x42cbd3
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 0x254], 2
jmp 0x42cc25
call fcn.0049673f
push eax
lea ecx, [ebp - 0x248]
call fcn.004249c2
mov byte [ebp - 4], 0x25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x248]
push str.Could_not_inject_explorer.exe__Error_d_
push eax
call fcn.004215fc
mov esi, dword [ebp - 0x248]
add esp, 0xc
push ebx
push str.Error
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x254], ebx
call fcn.0042101a
mov byte [ebp - 4], 0x13
lea ecx, [edi - 0x10]
jmp 0x42d22b
mov eax, dword [ebp - 0x240]
cmp dword [eax - 0xc], ebx
jne 0x42cc48
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x42d230
cmp dword [ebp - 0x268], ebx
je 0x42cd38
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_Waiting_for_AutoLaunchMenu
push eax
call fcn.00462050
pop ecx
pop ecx
call fcn.0042a10d
mov edi, 0x4f4ac8
mov dword [esp], 0x404
call fcn.0047c8d0
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4f4ad4
lea ecx, [ebp - 0x240]
call fcn.00423ab3
push str._Cancel_
lea ecx, [ebp - 0x240]
call fcn.004239bd
test eax, eax
jne 0x42cd28
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_cancelled_n
call fcn.00423416
call fcn.0042a10d
pop ecx
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
inc eax
jmp 0x42d2a5
call fcn.00434639
push 0x405
call fcn.0047c8d0
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp - 0x240]
push str.Loader_Main:_AutoLaunchRaw_s
push eax
call fcn.00462050
add esp, 0xc
call fcn.0042a10d
pop ecx
mov dword [ebp - 0x228], ebx
call fcn.0049673f
push eax
lea ecx, [ebp - 0x234]
call fcn.004249c2
mov byte [ebp - 4], 0x26
call fcn.0049673f
push eax
lea ecx, [ebp - 0x22c]
call fcn.004249c2
push 0x3e
push ecx
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x240]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x228]
call fcn.00423a92
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.00465d60
add esp, 0xc
mov byte [ebp - 4], 0x28
call fcn.0042355c
push eax
lea ecx, [ebp - 0x234]
call fcn.00423ab3
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x3e
push ecx
lea eax, [ebp - 0x240]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423a92
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.00465d60
add esp, 0xc
mov byte [ebp - 4], 0x29
call fcn.0042355c
push eax
lea ecx, [ebp - 0x22c]
call fcn.00423ab3
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
push 1
push ebx
lea edi, [ebp - 0x234]
call fcn.0047c630
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp - 0x234]
push str.Loader_Main:_AutoLaunchCmd_s
push eax
call fcn.00462050
add esp, 0xc
call fcn.0042a10d
mov eax, esp
mov dword [ebp - 0x220], esp
lea ecx, [ebp - 0x21c]
push ecx
push str.Loader_Main:_Loading_DLL_to_get_myself_hooked:__s
push eax
call fcn.00462050
add esp, 0xc
call fcn.0042a10d
mov dword [esp], str.TRUE
push str.CAMEYO_VIRTUALAPP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
lea eax, [ebp - 0x21c]
push eax
push str.Loader_Main:_LoadLibrary__s_0x_x
push ecx
call fcn.00462050
add esp, 0x10
call fcn.0042a10d
pop ecx
call fcn.0049673f
push eax
lea ecx, [ebp - 0x228]
call fcn.004249c2
mov byte [ebp - 4], 0x2a
call fcn.0049673f
push eax
lea ecx, [ebp - 0x244]
call fcn.004249c2
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp + 0x14]
push ecx
mov dword [ebp - 0x220], esp
cmp dword [eax - 0xc], ebx
jne 0x42cf41
mov eax, esp
push dword [ebp - 0x234]
push str.ExecName:_Taking_AutoLaunchCmd_s
push eax
call fcn.00462050
add esp, 0xc
call fcn.0042a10d
pop ecx
mov eax, edi
push eax
lea ecx, [ebp - 0x228]
call fcn.00423ab3
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x244]
cmp dword [eax - 0xc], ebx
jne 0x42cf6d
lea eax, [ebp - 0x22c]
jmp 0x42cf70
mov ecx, esp
push eax
push str.ExecName:_Taking_ExecCmd_s
push ecx
call fcn.00462050
add esp, 0xc
call fcn.0042a10d
pop ecx
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x228]
call fcn.00423ab3
lea ecx, [ebp - 0x244]
lea eax, [ebp + 0x18]
push eax
call fcn.00423ab3
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
call fcn.00423a92
lea eax, [ebp - 0x238]
push eax
mov byte [ebp - 4], 0x2c
call fcn.00471df0
pop ecx
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push dword [ebp - 0x238]
mov dword [ebp - 0x260], eax
push str.Loader_Main:_GetFileAttributes__s__d
push ecx
call fcn.00462050
add esp, 0x10
call fcn.0042a10d
pop ecx
push 0x5c
push ecx
lea eax, [ebp - 0x238]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423a92
lea eax, [ebp - 0x220]
push eax
call fcn.00462690
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov dword [ebp - 0x260], eax
call fcn.0042101a
push ecx
mov dword [ebp - 0x220], esp
mov esi, esp
push dword [ebp - 0x260]
lea eax, [ebp - 0x238]
push 0x5c
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423a92
lea eax, [ebp - 0x220]
push eax
call fcn.00462690
add esp, 0xc
mov byte [ebp - 4], 0x2d
push dword [eax]
push str.Loader_Main:_SetCurrentDirectory__s__d
push esi
call fcn.00462050
add esp, 0x10
call fcn.0042a10d
pop ecx
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [0x4f4b3c]
cmp dword [eax - 0xc], ebx
je 0x42d0a6
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f4b3c
call fcn.00423a92
call fcn.00464b00
pop ecx
cmp eax, ebx
je 0x42d0a6
mov eax, dword [0x4f4b3c]
mov dword [ebp - 0x230], eax
jmp 0x42d0ac
mov dword [ebp - 0x230], ebx
mov esi, dword [ebp - 0x228]
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
lea ecx, [ebp - 0x21c]
push ecx
push esi
push str.Loader_Main:_ExecName_s__Dll32Name_s
push eax
mov dword [ebp - 0x248], ebx
call fcn.00462050
add esp, 0x10
call fcn.0042a10d
mov eax, dword [ebp + 0x1c]
pop ecx
and eax, 1
push eax
push dword [ebp - 0x230]
lea eax, [ebp - 0x244]
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x248]
call fcn.00423a92
push ecx
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x264], esp
push eax
call fcn.00423416
push ecx
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x228]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
call fcn.00423a92
mov ecx, edi
mov byte [ebp - 4], 0x2c
call fcn.0042a164
add esp, 0x14
cmp eax, ebx
je 0x42d193
mov edi, dword [ebp - 0x25c]
mov dword [ebp - 0x254], 1
cmp edi, ebx
je 0x42d1ec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, edi
mov ecx, 0x1770
cmp edx, ecx
jae 0x42d181
sub edi, eax
push 1
add edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push 0x404
mov edi, 0x4f4ac8
call fcn.0047c8d0
pop ecx
jmp 0x42d1ec
call fcn.0049673f
push eax
lea ecx, [ebp - 0x25c]
call fcn.004249c2
mov byte [ebp - 4], 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x248]
lea eax, [ebp - 0x25c]
push esi
push str.Could_not_execute__s__Error_d__MyPID_d_
push eax
call fcn.004215fc
mov edi, dword [ebp - 0x25c]
add esp, 0x14
push ebx
push str.Error
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x254], ebx
call fcn.0042101a
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
mov edi, 0x4f4ac8
call fcn.0047c8d0
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_out_n
call fcn.00423416
call fcn.0042a10d
pop ecx
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp - 0x254]
call fcn.004a9d27
ret