Function at 0x10063a20
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Get common file path
Query environment variable
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100877ac
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x24], edi
cmp eax, 1
jne 0x10064a34
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x38], eax
call fcn.10021470
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x10063aa3
push 0x80004005
call fcn.10021340
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
push 0x820
mov dword [esp + 0x284], 0
call fcn.1006bba0
mov dword [esp + 0x40], eax
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 0
mov word [esp + 0x54], ax
xorps xmm0, xmm0
mov dword [esp + 0x5e], eax
mov word [esp + 0x62], ax
lea eax, [esp + 0x54]
push eax
movq qword [esp + 0x5a], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x66]
push eax
movzx eax, word [esp + 0x6e]
push eax
lea eax, [esp + 0x34]
push str._.2d__.2d__.4d__.2d:_.2d:_.2d
push eax
call fcn.1003a800
add esp, 0x20
mov byte [esp + 0x280], 1
or ebx, 0xffffffff
mov edx, dword [eax]
mov esi, dword [esp + 0x2c]
add esi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x10063b93
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x10063b82
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x10063b82
call fcn.100236e0
mov dword [esp + 0x30], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x10063b79
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x30]
add eax, 0x10
mov dword [esp + 0x2c], eax
jmp 0x10063b8f
push dword [edx - 0xc]
lea ecx, [esp + 0x30]
push edx
call fcn.10023530
mov edi, dword [esp + 0x24]
mov byte [esp + 0x280], 0
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063bb8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push str.APPVIRTDLL_LOADED_BY_LOADER
call fcn.10022bb0
mov edx, 0x104
lea ecx, [esp + 0x34]
call fcn.1003dc20
add esp, 4
mov ecx, 0x1009c75c
mov eax, dword [eax]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10063c06
test dx, dx
je 0x10063c02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10063c06
add eax, 4
add ecx, 4
test dx, dx
jne 0x10063be0
xor eax, eax
jmp 0x10063c0b
sbb eax, eax
or eax, 1
mov edx, dword [esp + 0x30]
test eax, eax
mov ecx, ebx
sete byte [esp + 0x17]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063c2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x17], 0
lea eax, [esp + 0x24]
push dword [esp + 0x2c]
je 0x10063d07
push str.DllMain:_called_by_Loader__to_get_myself_hooked____s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x280], 2
mov edx, dword [esp + 0x24]
call fcn.100394f0
mov byte [esp + 0x280], 0
mov ecx, ebx
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063c86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x1008fa88
push str.APPVIRTDLL_LOADED_BY_LOADER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ecx
mov ecx, esp
mov dword [esp + 0x38], 1
push str.CAMEYO_PERF_LOADLIB
call fcn.10022bb0
mov edx, 0x104
lea ecx, [esp + 0x34]
call fcn.1003dc20
add esp, 4
mov edx, 0x1009c75c
mov ecx, eax
call fcn.1002d580
mov esi, dword [esp + 0x30]
mov edx, ebx
add esi, 0xfffffff0
mov byte [esp + 0x17], al
lea ecx, [esi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10063ced
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [esp + 0x17]
test al, al
je 0x10063d4b
push 0
push str.PERF_LOADLIB
push str.After
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10063d4b
push str.DllMain:_not_called_by_Loader___s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x280], 3
mov edx, dword [esp + 0x24]
call fcn.100394f0
mov byte [esp + 0x280], 0
mov ecx, ebx
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063d4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x100b2388], 0
jne 0x10063d5e
push 0x10020bbc
call fcn.10020970
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x410
push 0x100b10f8
push 0
call esi
push 0x1008fa88
push 0x410
push 0x100b2398
call fcn.1006c14d
add esp, 0xc
push 0x410
push 0x100b2398
push edi
call esi
push 0x100b10f8
push 0x104
push 0x100b1b68
call fcn.1006c14d
add esp, 0xc
push 0x5c
push 0x100b1b68
call fcn.1006d206
add esp, 8
xor ecx, ecx
lea edi, [eax + 2]
mov word [eax], cx
push dword [esp + 0x3c]
mov dword [esp + 0x34], edi
push 0x410
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.10021470
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x10063df3
push 0x80004005
call fcn.10021340
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov byte [esp + 0x280], 4
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0xf3c
or eax, ecx
jge 0x10063e2f
push 0xf3c
lea ecx, [esp + 0x28]
call fcn.10023670
mov esi, dword [esp + 0x24]
push 0xf3c
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [esi - 8]
push esi
call fcn.1006b17d
add esp, 8
test eax, eax
js 0x10064a2a
cmp eax, dword [esi - 8]
jg 0x10064a2a
push dword [esp + 0x3c]
mov dword [esi - 0xc], eax
xor ecx, ecx
push 0x100b2398
push 0x100b10f8
mov word [esi + eax*2], cx
lea eax, [esp + 0x28]
push str.DllMain:_ProcessName_s__Dll_s__CurDir_s
push eax
call fcn.1003a800
add esp, 0x14
mov byte [esp + 0x280], 5
mov edx, dword [esp + 0x1c]
call fcn.100394f0
mov byte [esp + 0x280], 4
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063ebc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x20]
push str.DllMain:_CmdLine_s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x280], 6
mov edx, dword [esp + 0x1c]
call fcn.100394f0
mov byte [esp + 0x280], 4
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063f0b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea eax, [esp + 0x20]
push str.DllMain:_Path_s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x280], 7
mov edx, dword [esp + 0x1c]
call fcn.100394f0
mov byte [esp + 0x280], 4
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063f54
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x10063f8d
push str.DBGVIEW.EXE
push edi
call fcn.1006af63
add esp, 8
test eax, eax
je 0x10063f7c
push str.DEBUGRECEIVER.EXE
push edi
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x10063f8d
mov dword [esp + 0x1c], 1
mov edi, dword [esp + 0x1c]
jmp 0x10064243
push ecx
mov ecx, esp
push str.CAMEYO_APPVIRTDLLADHOCMODE
call fcn.10022bb0
mov edx, 0x104
lea ecx, [esp + 0x20]
call fcn.1003dc20
mov edx, dword [esp + 0x20]
add esp, 4
mov ecx, ebx
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
setne byte [esp + 0x17]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10063fd3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x17], 0
je 0x100640ca
push 0x100b10f8
lea eax, [esp + 0x20]
push str.APPVIRTDLLADHOCMODE_SESSIONOPENER:_DllMain:__s
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x280], 8
mov edx, dword [esp + 0x1c]
call fcn.100394f0
mov byte [esp + 0x280], 4
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1006402b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push str.CAMEYO_APPVIRTDLLADHOCMODE
call fcn.10022bb0
mov edx, 0x104
lea ecx, [esp + 0x38]
call fcn.1003dc20
add esp, 4
mov edx, str.SessionOpener
mov ecx, eax
call fcn.1002d580
mov edi, dword [esp + 0x34]
mov edx, ebx
add edi, 0xfffffff0
mov byte [esp + 0x17], al
lea ecx, [edi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1006407a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [esp + 0x17]
test al, al
je 0x1006409c
mov ecx, dword [esp + 0x30]
mov dword [0x100b2d14], 0x10
call fcn.10061260
mov dword [esp + 0x1c], eax
mov edi, eax
jmp 0x10064243
cmp dword [0x100b2d14], 0x10
jne 0x100640b9
mov ecx, dword [esp + 0x30]
call fcn.10061260
mov dword [esp + 0x1c], eax
mov edi, eax
jmp 0x10064243
mov dword [esp + 0x1c], 0
mov edi, dword [esp + 0x1c]
jmp 0x10064243
push ecx
mov ecx, esp
push str.CAMEYO_RDPTUNNEL_TOKENID
call fcn.10022bb0
mov edx, 0x104
lea ecx, [esp + 0x20]
call fcn.1003dc20
mov edx, dword [esp + 0x20]
add esp, 4
mov ecx, ebx
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
setne byte [esp + 0x17]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064110
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x17], 0
je 0x1006413f
push ecx
mov eax, esp
push 0x100b10f8
push str.CAMEYO_RDPTUNNEL_TOKENID:_DllMain:__s
push eax
call fcn.1003a800
add esp, 0xc
call fcn.10021810
add esp, 4
call fcn.1004ce30
jmp 0x1006423e
call fcn.10021470
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1006415b
push 0x80004005
call fcn.10021340
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x1c], edi
push ecx
mov ecx, esp
mov byte [esp + 0x284], 9
push 0x1009f5d4
call fcn.10022bb0
mov ecx, 1
call fcn.10021c30
mov ecx, esp
push 0x100b10f8
call fcn.10022bb0
call fcn.10032170
add esp, 4
test eax, eax
je 0x100641ce
push ecx
mov eax, esp
push 0x1009f5d4
push str.ENVSETTING_VIRTUALAPP:_flagging_missed_process._AppID_s
push eax
call fcn.1003a800
add esp, 0xc
call fcn.10021810
add esp, 4
push str.TRUE
push str.CAMEYO_VIRTUALAPP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x288], 0xa
push 0x100b10f8
call fcn.10022bb0
mov byte [esp + 0x288], 9
call fcn.100628a0
add esp, 8
test eax, eax
je 0x10064291
push 0x1009f5d4
mov ecx, 0x100b2ce4
call fcn.10022c70
add edi, 0xfffffff0
mov byte [esp + 0x280], 4
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1006423e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 1
add esi, 0xfffffff0
mov byte [esp + 0x280], 0
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064264
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x280], 0xffffffff
mov esi, dword [esp + 0x2c]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x1006428a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
jmp 0x10064e57
push ecx
mov eax, 0x5c
mov ecx, esp
push 0x100b2398
movzx ebx, ax
call fcn.10022bb0
mov edx, ebx
lea ecx, [esp + 0x2c]
call fcn.1003a970
add esp, 4
mov byte [esp + 0x280], 0xb
lea ecx, [edi - 0x10]
mov edx, dword [eax]
mov dword [esp + 0x44], ecx
lea ebx, [edx - 0x10]
cmp ebx, ecx
je 0x1006431e
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
jl 0x1006430d
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1006430d
mov ecx, ebx
call fcn.100236e0
or ebx, 0xffffffff
mov dword [esp + 0x40], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x10064304
mov edi, dword [esp + 0x44]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x40]
lea edi, [eax + 0x10]
mov dword [esp + 0x1c], edi
jmp 0x10064321
push dword [edx - 0xc]
lea ecx, [esp + 0x20]
push edx
call fcn.10023530
mov edi, dword [esp + 0x1c]
or ebx, 0xffffffff
lea ecx, [esp + 0x28]
mov byte [esp + 0x280], 9
call fcn.10022680
mov ecx, edi
call fcn.10064e80
lea ecx, [esp + 0x18]
call fcn.10065010
mov byte [esp + 0x280], 0xc
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov dword [esp + 0x28], ecx
lea eax, [edx - 0x10]
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
mov dword [esp + 0x44], ecx
cmp eax, ecx
je 0x100643bb
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [esp + 0x40], eax
jl 0x100643ae
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x100643ae
mov ecx, dword [esp + 0x28]
call fcn.100236e0
mov dword [esp + 0x28], eax
mov ecx, ebx
mov eax, dword [esp + 0x40]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100643a1
mov eax, dword [esp + 0x44]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0x10
mov dword [esp + 0x2c], eax
jmp 0x100643bb
push dword [edx - 0xc]
lea ecx, [esp + 0x30]
push edx
call fcn.10023530
lea ecx, [esp + 0x18]
mov byte [esp + 0x280], 9
call fcn.10022680
mov edx, dword [esp + 0x2c]
mov ecx, dword [0x100b2cfc]
add edx, 0xfffffff0
add ecx, 0xfffffff0
mov dword [esp + 0x18], edx
mov dword [esp + 0x40], ecx
cmp edx, ecx
je 0x10064443
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
jl 0x10064435
mov edx, dword [edx]
cmp edx, dword [ecx]
jne 0x10064435
mov ecx, dword [esp + 0x18]
call fcn.100236e0
mov dword [esp + 0x18], eax
mov ecx, ebx
mov eax, dword [esp + 0x28]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064427
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0x10
mov dword [0x100b2cfc], eax
jmp 0x10064443
push dword [eax - 0xc]
mov ecx, 0x100b2cfc
push eax
call fcn.10023530
mov ecx, ebx
call fcn.10029900
push ecx
mov eax, esp
push dword [0x100b2cfc]
push edi
push str.AppVirt_Loader:_AppDir_s__CarrierExeName_s
push eax
call fcn.1003a800
add esp, 0x10
call fcn.10021810
add esp, 4
mov ecx, 0x100b2ce0
call fcn.100650a0
call fcn.10025550
push ecx
mov ecx, esp
push 0x100b10f8
call fcn.10022bb0
call fcn.10032170
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x288], 0xd
push 0x100b10f8
call fcn.10022bb0
mov byte [esp + 0x288], 9
call fcn.10062a70
add esp, 8
test eax, eax
jne 0x1006421d
cmp dword [0x100b2d10], eax
je 0x10064545
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x1008fa70
call fcn.10022bb0
push ecx
mov byte [esp + 0x288], 0xe
mov ecx, esp
mov dword [esp + 0x48], esp
push str.services.exe
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x28c], 0xf
call fcn.1003a340
lea ecx, [esp + 0x24]
mov byte [esp + 0x28c], 9
call fcn.1003a550
add esp, 0xc
mov ecx, 1
mov dword [esp + 0x20], ecx
push dword [eax]
push 0x100b10f8
call fcn.1006af63
add esp, 8
mov byte [esp + 0x17], 1
test eax, eax
je 0x1006454a
mov byte [esp + 0x17], 0
mov eax, dword [esp + 0x20]
test al, 1
je 0x10064562
and eax, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.10022680
cmp byte [esp + 0x17], 0
je 0x10064612
push ecx
mov ecx, esp
mov byte [0x100b0b26], 1
push str.___Services.exe:_waiting_in_MsiTracker_mode.
call fcn.10022bb0
call fcn.10021810
add esp, 4
push str.CreateProcessAsUserW
push 0x10093094
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
mov edx, str.Advapi32.dll
push ecx
sbb eax, eax
mov ecx, str.Kernel32.dll
neg eax
push 0x100b10a0
cmove ecx, edx
mov edx, str.CreateProcessAsUserW
push fcn.10059ce0
call fcn.10060d40
add esp, 8
mov edx, 0x100a1410
mov ecx, str.Kernel32.dll
push 0x100b109c
push 0x100596d0
call fcn.10060d40
add esp, 8
mov edx, 0x100a1420
mov ecx, str.Kernel32.dll
push 0x100b1098
push 0x100597a0
call fcn.10060d40
add esp, 0xc
mov dword [0x100b2d00], 0
jmp 0x1006421d
mov ecx, dword [0x100b2d00]
sub esp, 0xc
call fcn.100402c0
push ecx
mov ecx, esp
push eax
push 0x100b2398
push 0x100b10f8
push str.ProcessName_s__Dll_s__TotalProcesses_d
push ecx
call fcn.1003a800
add esp, 0x14
call fcn.10021810
add esp, 4
call fcn.10061440
test eax, eax
jne 0x10064667
push ecx
mov ecx, esp
push str._InstallHooks_failed._Quitting_
call fcn.10022bb0
call fcn.10021810
add esp, 4
jmp 0x1006421d
cmp dword [esp + 0x34], 0
je 0x100646b7
push ecx
mov ecx, esp
push str.CAMEYO_WINCRED
call fcn.10022bb0
mov edx, 0x104
lea ecx, [esp + 0x2c]
call fcn.1003dc20
add esp, 4
mov byte [esp + 0x280], 0x10
mov edx, 0x10094274
mov ecx, dword [esp + 0x20]
or ecx, 2
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ecx
mov ecx, eax
call fcn.10037960
test al, al
je 0x100646b7
mov bl, 1
jmp 0x100646b9
xor bl, bl
mov dword [esp + 0x280], 9
mov ecx, dword [esp + 0x20]
test cl, 2
je 0x100646d6
lea ecx, [esp + 0x28]
call fcn.10022680
test bl, bl
je 0x100646f8
push ecx
mov eax, esp
push str.DllMain:_restoring_Windows_Credentials
push eax
call fcn.1003a800
add esp, 8
call fcn.10021810
add esp, 4
call fcn.10048860
push 1
xor edx, edx
mov ecx, str._Fonts_
call fcn.100261e0
add esp, 4
test eax, eax
je 0x10064782
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x10064782
push dword [ebx + 8]
lea ecx, [esp + 0x24]
call fcn.10022bb0
push ecx
mov eax, esp
mov byte [esp + 0x284], 0x11
push dword [esp + 0x24]
push str.VirtFonts:_MatrixFileName_s
push eax
call fcn.1003a800
add esp, 0xc
call fcn.10021810
add esp, 4
lea ecx, [esp + 0x20]
call fcn.1002abf0
push ecx
mov ecx, dword [esp + 0x24]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
mov dword [esi], eax
call fcn.10063900
mov ebx, dword [ebx + 0x1c]
lea ecx, [esp + 0x24]
add esp, 4
mov byte [esp + 0x280], 9
call fcn.10022680
test ebx, ebx
jne 0x10064714
push str.AcroRd32.exe
push ecx
mov ecx, esp
mov esi, 0x5c
call fcn.1003a230
mov edx, esi
lea ecx, [esp + 0x20]
call fcn.1003a890
add esp, 4
mov ecx, eax
mov byte [esp + 0x284], 0x12
call fcn.10022cc0
test eax, eax
mov byte [esp + 0x280], 9
lea ecx, [esp + 0x18]
sete bl
call fcn.10022680
test bl, bl
je 0x100648a8
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
push 0
push 1
push 0
push ecx
mov ecx, esp
mov byte [esp + 0x290], 0x13
push str.SoftwareAdobeAcrobat_Reader
lea esi, [esp + 0x5c]
call fcn.10022bb0
mov edx, esi
call fcn.1003b580
mov esi, dword [esp + 0x58]
add esp, 0x10
cmp esi, dword [esp + 0x4c]
je 0x10064897
lea ebx, [ebx]
push dword [esi]
lea eax, [esp + 0x38]
push str.SoftwareAdobeAcrobat_Reader_sPrivileged
push eax
call fcn.1003a800
add esp, 0xc
push 0
push ecx
mov byte [esp + 0x288], 0x14
mov ecx, esp
mov dword [esp + 0x20], esp
push str.bProtectedMode
call fcn.10022bb0
push ecx
mov byte [esp + 0x28c], 0x15
mov ebx, esp
mov ecx, dword [esp + 0x40]
lea ecx, [ecx - 0x10]
call fcn.100236e0
add eax, 0x10
xor edx, edx
mov dword [ebx], eax
mov byte [esp + 0x28c], 0x14
call fcn.1003b480
add esp, 0xc
mov byte [esp + 0x280], 0x13
lea ecx, [esp + 0x34]
call fcn.10022680
add esi, 4
cmp esi, dword [esp + 0x4c]
jne 0x10064820
lea ecx, [esp + 0x48]
mov byte [esp + 0x280], 9
call fcn.1003f390
push 0x10090c58
lea ecx, [esp + 0x30]
call fcn.10022c70
mov edx, dword [0x100b0b38]
lea eax, [esp + 0x2c]
push eax
push 0x10027830
push 0
mov ecx, 0x100b0b30
call fcn.10030e30
push ecx
mov eax, esp
push dword [esp + 0x30]
push str.Sandbox:__s
push eax
call fcn.1003a800
add esp, 0xc
call fcn.10021810
mov eax, dword [esp + 0x34]
add esp, 4
test eax, eax
je 0x1006491c
push str.xxxxxxxx.exe
push eax
call fcn.1006af63
movzx ecx, byte [0x100b0b27]
add esp, 8
test eax, eax
mov eax, 1
cmove ecx, eax
mov byte [0x100b0b27], cl
call fcn.100626a0
test byte [0x100b1920], 2
je 0x100649e8
lea ecx, [esp + 0x20]
call fcn.10022b60
xor eax, eax
mov byte [esp + 0x280], 0x16
push 0x206
push eax
mov word [esp + 0x6c], ax
lea eax, [esp + 0x6e]
push eax
call fcn.1006df00
add esp, 0xc
lea eax, [esp + 0x64]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, dword [esp + 0x3c]
push 0x410
push ebx
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x100b10f8
push 0x1009f5d4
lea eax, [esp + 0x78]
push eax
push edi
push 0x100b2398
lea eax, [esp + 0x40]
push str.g_MyDllName_s_nAppDir_s_nCurrentDir_s_nAppID_s_nGetModuleName_s_nCommandLine_s_nPath_s_nTook__d_ms_to_initialize
push eax
call fcn.1003f740
add esp, 0x28
push 0
push 0x100b10f8
push dword [esp + 0x28]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x20]
mov dword [0x100b1920], 1
mov byte [esp + 0x280], 9
call fcn.10022680
jmp 0x100649ec
mov ebx, dword [esp + 0x3c]
push ebx
call fcn.1006ac0c
mov eax, esp
push str.DllMain:_DLL_PROCESS_ATTACH_done
push eax
call fcn.1003a800
add esp, 8
call fcn.10021810
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.10022680
lea ecx, [esp + 0x24]
call fcn.10022680
lea ecx, [esp + 0x2c]
call fcn.10022680
jmp 0x10064e52
push 0x80070057
call fcn.10021340
test eax, eax
jne 0x10064e52
lea eax, [esp + 0x30]
push str.DllMain:_DLL_PROCESS_DETACH
push eax
call fcn.1003a800
add esp, 8
mov dword [esp + 0x280], 0x17
mov edx, dword [esp + 0x30]
call fcn.100394f0
mov dword [esp + 0x280], 0xffffffff
or ebx, 0xffffffff
mov edx, dword [esp + 0x30]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10064a8d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x100b1b60]
test eax, eax
je 0x10064aa2
cmp eax, 0xffffffff
je 0x10064aa2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esp
mov byte [0x100af305], 0
push 0x100b10f8
mov esi, 0x5c
call fcn.10022bb0
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.1003a890
add esp, 4
mov ecx, eax
mov dword [esp + 0x280], 0x18
call fcn.1003ec50
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.100236e0
lea esi, [eax + 0x10]
mov dword [esp + 0x30], esi
mov byte [esp + 0x280], 0x1a
mov ecx, ebx
mov edx, dword [esp + 0x38]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064b11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, str.services.exe
lea ecx, [esp + 0x30]
call fcn.1002d580
test al, al
jne 0x10064b35
mov edx, str.explorer.exe
lea ecx, [esp + 0x30]
call fcn.1002d580
test al, al
je 0x10064ba1
mov eax, dword [0x100b1b64]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
call edi
mov ebx, eax
call fcn.10061150
call edi
sub eax, ebx
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push str.UnHookAll__d__took__d_ms
push eax
call fcn.1003a800
add esp, 0x10
mov byte [esp + 0x280], 0x1b
mov edx, dword [esp + 0x34]
call fcn.100394f0
mov byte [esp + 0x280], 0x1a
or ebx, 0xffffffff
mov edx, dword [esp + 0x34]
mov ecx, ebx
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064ba1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x100b2d00]
mov dword [esp + 0x24], eax
test eax, eax
je 0x10064dfe
mov dword [esp + 0x3c], 0
lea ebx, [ebx]
push 1
push 0
push ecx
mov ecx, dword [0x100b2ce4]
mov edi, esp
lea ecx, [ecx - 0x10]
call fcn.100236e0
mov ecx, dword [esp + 0x30]
add eax, 0x10
mov dword [edi], eax
call fcn.100406a0
mov edi, eax
lea eax, [esp + 0x34]
push edi
push dword [0x100b2ce4]
push str.DllMain_DETACH_:_CActiveVirtApp:_pVirtApp__s__.8x
push eax
call fcn.1003a800
add esp, 0x10
mov byte [esp + 0x280], 0x1c
mov edx, dword [esp + 0x34]
call fcn.100394f0
mov byte [esp + 0x280], 0x1a
mov ecx, ebx
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064c34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x10064dc3
mov eax, dword [esp + 0x24]
mov edi, dword [edi + 0x424]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
push dword [0x100b2ce4]
lea eax, [esp + 0x24]
push str.DllMain_DETACH_:__s.TotalProcesses_d
push eax
call fcn.1003a800
add esp, 0x10
mov byte [esp + 0x280], 0x1d
mov edx, dword [esp + 0x1c]
call fcn.100394f0
mov byte [esp + 0x280], 0x1a
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064c9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 1
ja 0x10064d90
mov ecx, dword [esp + 0x3c]
mov eax, ecx
inc ecx
mov dword [esp + 0x3c], ecx
cmp eax, 5
jge 0x10064d0b
push str.DllMain_DETACH_:_CActiveVirtApp:_Re_checking_if_this_is_the_last_process_for_this_app__Recheck_.
lea ecx, [esp + 0x24]
call fcn.10022bb0
mov byte [esp + 0x280], 0x1e
mov edx, dword [esp + 0x20]
call fcn.100394f0
mov byte [esp + 0x280], 0x1a
mov ecx, ebx
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064cfb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10064bc0
push ecx
mov ecx, esp
push str.DllMain_DETACH_:_CActiveVirtApp:_This_is_the_last_process_for_this_app.
call fcn.10022bb0
call fcn.10021810
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x288], 0x1f
push 0x100b10f8
call fcn.10022bb0
mov byte [esp + 0x288], 0x1a
call fcn.100628a0
add esp, 8
test eax, eax
je 0x10064d7d
push ecx
mov ecx, esp
push str.DllMain_DETACH_:_AVOIDING_VirtRegSync__CustomEvents_because_were_rundll32_injector
call fcn.10022bb0
call fcn.10021810
add esp, 4
mov ecx, 1
call fcn.100257f0
jmp 0x10064dc3
mov ecx, 1
mov byte [0x100af304], 0
call fcn.100257f0
jmp 0x10064dc3
push ecx
mov ecx, esp
lea edi, [esp + 0x1c]
push str.Matrix_Finalize
lea ebx, [esp + 0x30]
call fcn.10022bb0
mov edx, edi
mov ecx, ebx
call fcn.1003e870
mov edx, dword [esp + 0x1c]
add esp, 4
mov ecx, dword [esp + 0x28]
push 1
call fcn.1003ea90
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
push ecx
mov edx, esp
push eax
push dword [0x100b2ce4]
push str.DllMain_DETACH_:_CActiveVirtApp:_UnregisterAppProcess__s___d_
push edx
call fcn.1003a800
add esp, 0x10
call fcn.10021810
mov edi, dword [0x100b2ce4]
add esp, 4
call ebx
mov ecx, dword [esp + 0x24]
push eax
push edi
call fcn.10040540
push 0x96
mov byte [0x100af304], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x100b2388], 0
jne 0x10064e2d
push 0x10020bbc
mov dword [0x100b2388], 1
call fcn.100209c0
add esi, 0xfffffff0
mov dword [esp + 0x280], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10064e52
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.1006abfd
mov esp, ebp
pop ebp
ret 0xc