Function at 0x4401a3
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Get file attributes
Get hostname
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d53a3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3414
call fcn.004b43f0
mov eax, dword [0x512f18]
xor eax, esp
mov dword [esp + 0x3410], eax
push ebx
push esi
push edi
mov eax, dword [0x512f18]
xor eax, esp
push eax
lea eax, [esp + 0x3428]
mov dword fs:[0], eax
lea eax, [esp + 0x280]
xor edi, edi
mov dword [esp + 0x40], edi
push eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x284], 8
mov dword [esp + 0x288], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x5c]
call fcn.004a7d89
mov ebx, 0x4de948
push ebx
lea ecx, [esp + 0x64]
call fcn.00423607
push ebx
lea ecx, [esp + 0x70]
mov dword [esp + 0x3434], edi
call fcn.00423607
xor esi, esi
push ebx
lea ecx, [esp + 0x78]
inc esi
mov byte [esp + 0x3434], 1
call fcn.00423607
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x3434], 2
call fcn.00463d50
pop ecx
lea ecx, [esp + 0x44]
call fcn.00421487
lea eax, [esp + 0x4c]
mov byte [esp + 0x3430], 4
push eax
mov dword [esp + 0x7c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1ac]
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x40], edi
call fcn.00463d50
pop ecx
push eax
mov ecx, 0x518f68
mov byte [esp + 0x3434], 5
call fcn.0042364b
mov byte [esp + 0x3430], 4
mov ecx, dword [esp + 0x1ac]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x26c]
push eax
call fcn.00463d50
mov byte [esp + 0x3434], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Loader:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043f27e
pop ecx
mov byte [esp + 0x3430], 4
mov ecx, dword [esp + 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x518bb8], eax
cmp dword [esp + 0x28], edi
je 0x441b8b
cmp dword [esp + 0x4c], esi
jle 0x441b8b
mov dword [esp + 0x58], esi
mov eax, dword [esp + 0x28]
push ecx
lea edi, [eax + esi*4]
mov ecx, esp
mov dword [esp + 0x34], esp
push dword [edi]
call fcn.00423607
call fcn.0043f2ae
mov dword [esp], 0x4ebe44
call fcn.004ad530
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
jne 0x44039d
push 0x4ebe44
call fcn.004ad530
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x18]
jmp 0x44121a
push str._Confirm
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x4403bc
mov dword [esp + 0x50], 1
jmp 0x441220
push str._Quiet
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x4403de
and dword [0x5154ac], eax
or dword [esp + 0x3c], 2
jmp 0x441220
push str._AllUsers
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440431
mov dword [esp + 0x48], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00463b30
test eax, eax
je 0x441234
call fcn.00463d00
test eax, eax
jne 0x441220
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Admin_rights_required
jmp 0x44124f
push str._ErrorsOnly
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440452
mov dword [0x5154ac], 1
jmp 0x441220
push str._Wait
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x44046e
or dword [esp + 0x3c], 1
jmp 0x441220
push 0x4ebf10
call fcn.004ad530
pop ecx
push eax
push str._Password:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x4411fb
push 0x4ebf34
call fcn.004ad530
pop ecx
push eax
push str._Password
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x4411fb
push 0x4ebf70
call fcn.004ad530
pop ecx
push eax
push str._Properties:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
jne 0x44083a
push str._Properties_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xd40]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 7
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xd40]
push eax
call fcn.0043fb96
add esp, 0x10
lea eax, [esp + 0xd34]
call fcn.00479240
lea ecx, [esp + 0x24]
call fcn.00421487
lea ecx, [esp + 0x20]
call fcn.00421487
lea ecx, [esp + 0x64]
call fcn.00421487
push 0x4ebf70
mov byte [esp + 0x3434], 0xa
call fcn.004ad530
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x140]
call fcn.00423607
lea eax, [esp + 0x288]
push eax
mov byte [esp + 0x3434], 0xb
call fcn.0043d3fe
mov byte [esp + 0x3430], 0xc
mov dword [esp + 0x150], esi
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4eb8f8
lea edi, [esp + 0x158]
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0xd
lea eax, [esp + 0x144]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1a4]
push eax
mov byte [esp + 0x343c], 0xc
call fcn.004686f0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x3434], 0xe
call fcn.0042364b
mov byte [esp + 0x3430], 0xc
mov ecx, dword [esp + 0x19c]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
push 0x3d
lea ecx, [esp + 0x2c]
call fcn.00425cb6
mov edi, eax
cmp edi, 0xffffffff
je 0x4406b7
push edi
lea eax, [esp + 0x1a8]
push eax
lea ecx, [esp + 0x2c]
call fcn.004237f6
mov byte [esp + 0x3430], 0xf
call fcn.0042374d
push eax
lea ecx, [esp + 0x24]
call fcn.0042364b
mov byte [esp + 0x3430], 0xc
mov ecx, dword [esp + 0x1a4]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], esi
je 0x4406b7
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x68]
call fcn.0042364b
push esi
lea ecx, [esp + 0x68]
lea eax, [edi + 1]
push ecx
call fcn.0042369e
lea eax, [esp + 0x64]
push eax
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x294]
push eax
call fcn.0043d44f
pop ecx
mov ecx, eax
call fcn.0042364b
cmp dword [esp + 0x150], 0xffffffff
jne 0x4405a6
mov eax, dword [esp + 0x2a0]
mov eax, dword [eax]
lea edi, [esp + 0x288]
lea esi, [esp + 0x90]
call fcn.0042a34a
jmp 0x4407a5
lea esi, [esp + 0x90]
call fcn.0043d536
push eax
lea ecx, [esp + 0xf4]
call fcn.004235f2
mov byte [esp + 0x3430], 0x10
call fcn.0043d536
add eax, 4
push eax
lea ecx, [esp + 0x20]
call fcn.004235f2
push str.Branding
lea eax, [esp + 0xf4]
mov byte [esp + 0x3434], 0x11
call fcn.0042368a
test eax, eax
je 0x441261
lea edi, [esp + 0xf0]
call fcn.00429e6e
push dword [eax]
lea eax, [esp + 0x280]
push str.CAMEYO__s
push eax
call fcn.00464a80
mov esi, dword [esp + 0x28]
mov eax, dword [eax]
add esp, 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x27c]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov byte [esp + 0x3430], 0xc
mov ecx, dword [esp + 0xf0]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [esp + 0x90]
call fcn.0042a360
mov eax, dword [esp + 0x2a0]
lea edi, [esp + 0x288]
lea esi, [esp + 0xa4]
call fcn.0042a34a
mov edi, esi
lea esi, [esp + 0x90]
call fcn.0042a3ad
test al, al
je 0x4406e6
lea eax, [esp + 0x288]
push eax
mov byte [esp + 0x3434], 0xb
call fcn.0043d3ed
mov ecx, dword [esp + 0x13c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0xd34]
mov byte [esp + 0x3430], 4
call fcn.004266c5
mov esi, dword [esp + 0x58]
jmp 0x441220
push str._SafeMode
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440886
push str._SafeMode_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x4e0930
push str.CAMEYO_LEGACYREG
call edi
push str.Disk
push str.CAMEYO_VIRTMODE
call edi
push 0x4e0874
push str.CAMEYO_EARLYINJECTION
call edi
jmp 0x441220
push 0x4ec074
call fcn.004ad530
pop ecx
push eax
push str._Services:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
jne 0x4408fb
push dword [edi]
lea ecx, [esp + 0x108]
call fcn.00423607
push 0x4ec074
mov byte [esp + 0x3434], 0x12
call fcn.004ad530
pop ecx
push 0
lea ecx, [esp + 0x108]
push ecx
call fcn.0042369e
push dword [esp + 0x104]
push str.CAMEYO_SERVICES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x3430], 4
mov ecx, dword [esp + 0x104]
jmp 0x4411f1
push str._Register
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x441275
push str._Stop
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x441326
push str._Remove
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x447826
push str._RemoveSelf
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x447826
push str._Remove:Proc
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x44144b
push str._Remove:Reg
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x441635
push str._LearnStreaming
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x447643
push 0x4ec62c
call fcn.004ad530
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x447643
push str._UpdateBasicSettings
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x4409d7
mov dword [esp + 0x38], 1
jmp 0x441220
push str._Repackage
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x44183e
push str._CreateDiff
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x44748b
push 0x4ec850
call fcn.004ad530
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x44748b
push str._exec
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x441a0c
push 0x4ec894
call fcn.004ad530
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x446ed7
push 0x4ec8ac
call fcn.004ad530
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x446ed7
push str._ShowStreaming
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x441c81
push str._Break
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x441d65
push str._Unbreak
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x442480
push str._Integrate
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x446a94
push str._Integrate:once
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x446a94
push str._FullIntegrate
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x446a94
push str._Unintegrate
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x442cad
push str._CreateShortcuts
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x446474
push 0x4ed370
call fcn.004ad530
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x446474
push str._Perf
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x442d05
push str._ExtractLog
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x443115
push str._ExtractAll
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x443304
push str._AutoUpdateXml
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4433d3
push str._Info
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x443526
push str._Sandbox
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4435d9
push 0x4ed610
call fcn.004ad530
pop ecx
push eax
push str._GetProperty:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x4436d9
push 0x4ed658
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4438ee
push str._InfoLog
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4439a7
push str._Ini
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x446358
push str._ShowIni
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x446358
push str._ExtractIni
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x443b9c
push str._csv
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x443d26
push str._EngineVer
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x44410c
push str._ChangeLoader
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440cb5
lea eax, [esi + 1]
cmp dword [esp + 0x4c], eax
jg 0x44424f
push str._ChangeEngine
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440cd4
lea eax, [esi + 1]
cmp dword [esp + 0x4c], eax
jg 0x444576
push str._ChangeIni
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440cf3
lea eax, [esi + 1]
cmp dword [esp + 0x4c], eax
jg 0x44490c
push str._TestAutoUpdate
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440d12
lea eax, [esi + 5]
cmp dword [esp + 0x4c], eax
jg 0x444ad1
push str._Debug
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x444be0
push str._ForceMenu
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440d47
mov dword [esp + 0x78], 1
jmp 0x441220
push str._ShowTree
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x444c22
push str._RegDump
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x444cf0
push str._SetFileFlags
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440d92
lea eax, [esi + 2]
cmp dword [esp + 0x4c], eax
jg 0x444e6f
push str._DbgZip:
call fcn.004ad5da
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x44507e
push str._DbgNow
call fcn.004ad5da
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x4450ba
push str._Vintegrate
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4461db
push 0x4ee060
call fcn.004ad530
pop ecx
push eax
push str._Vintegrate:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x4461db
push str._VintegrateRecursive
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4461db
push 0x4ee0b8
call fcn.004ad530
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x4461db
push str._Vunintegrate
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4451aa
push str._Vmanager
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445370
push 0x4ee178
call fcn.004ad530
pop ecx
push eax
push str._ProcessList
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x44541f
push 0x4ee300
call fcn.004ad530
pop ecx
push eax
push str._WaitFor
push dword [edi]
call fcn.004afb46
add esp, 0xc
test eax, eax
je 0x445790
push str._GfxSvr
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440f16
call fcn.0042e05c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov edi, 0x518f00
call fcn.0047d760
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.0047d760
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x441220
push 0x4ee330
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x440f94
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.open
xor edi, edi
xor ebx, ebx
call fcn.00423607
push edi
push ecx
mov dword [esp + 0x343c], 0x15c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str._Troubleshoot
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x5d
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
mov dword [esp + 0x3440], 4
call fcn.004637b0
mov esi, dword [esp + 0x68]
add esp, 0x10
mov ebx, 0x4de948
jmp 0x441220
push str._Troubleshoot
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445851
push str._AutoUpdate
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445877
push str._VirtRegSyncExport
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x44590c
push str._StartStreaming
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445974
push str._JumpTo
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445992
push str._SvcRegister
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445a31
push str._SvcStart
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445b33
push str._SvcRegisterStart
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445bee
push str._SvcStop
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445d66
push str._SvcRemove
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x445e24
push str._AuthCheck
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4460cd
push str._AuthCheck:Force
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x4460cd
push str._RepoSync
push dword [edi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x4410bb
lea eax, [esi + 1]
cmp dword [esp + 0x4c], eax
jg 0x445ee2
push dword [edi]
lea ecx, [esp + 0xdc]
call fcn.00423607
push 0
push ecx
mov dword [esp + 0x3438], 0x16b
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4dd498
call fcn.00423607
push ecx
mov edi, esp
mov byte [esp + 0x343c], 0x6c
mov dword [esp + 0x20], esp
push 0x5c
push ecx
lea eax, [esp + 0xec]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235f2
push edi
call fcn.00464db0
add esp, 0xc
mov byte [esp + 0x343c], 0x6b
call fcn.00468c10
add esp, 0xc
test eax, eax
je 0x441164
push 0x4e8384
push ecx
lea eax, [esp + 0xe0]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1c8]
push eax
call fcn.00464b10
or dword [esp + 0x4c], 4
pop ecx
pop ecx
call fcn.0042368a
mov byte [esp + 0x2f], 1
test eax, eax
je 0x441169
mov byte [esp + 0x2f], 0
test byte [esp + 0x40], 4
je 0x441184
mov ecx, dword [esp + 0x1c0]
and dword [esp + 0x40], 0xfffffffb
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [esp + 0x2f], 0
jne 0x445fb7
push 0x4e698c
lea ecx, [esp + 0x70]
call fcn.00423660
mov eax, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.00423607
lea eax, [esp + 0x218]
push eax
call fcn.0046a390
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x3434], 0x71
call fcn.0042364b
mov ecx, dword [esp + 0x214]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [esp + 0x3430], 4
mov ecx, dword [esp + 0xd8]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x441220
push str._Password_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4ebf10
call fcn.004ad530
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x44]
push eax
call fcn.00423660
inc esi
cmp esi, dword [esp + 0x4c]
mov dword [esp + 0x58], esi
jl 0x440349
jmp 0x441b89
call fcn.00463b80
test eax, eax
jne 0x441259
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Elevation_failed
call fcn.00423607
call fcn.0043facd
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.License_required.
jmp 0x44124f
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x4412ab
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x44124f
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov ecx, esi
call fcn.0043320f
pop ecx
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x6c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
mov ecx, dword [esp + 0x3428]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3410]
xor ecx, esp
call fcn.004acc76
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x441359
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x518f58
call fcn.004235f2
push ecx
mov byte [esp + 0x3438], 0x13
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x518f68
call fcn.004235f2
push ecx
mov byte [esp + 0x343c], 0x14
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x518f5c
call fcn.004235f2
push ecx
mov byte [esp + 0x3440], 0x15
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x518f0c
call fcn.004235f2
mov byte [esp + 0x3440], 4
call fcn.0043b376
add esp, 0x10
test eax, eax
je 0x4413ef
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Cannot_stop_application__s
push eax
call fcn.00464a80
add esp, 0xc
jmp 0x441254
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.00423607
call fcn.0043f2ae
pop ecx
xor esi, esi
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x6c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
jmp 0x441302
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x44147e
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
mov eax, dword [0x518f5c]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x4414a7
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Cannot_obtain_base_dir_for__s
jmp 0x4413e1
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov edi, 0x518f5c
push edi
call fcn.004235f2
call fcn.004670b0
pop ecx
cmp eax, esi
jne 0x4414f2
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Application_is_not_deployed_on_this_machine:__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
push 5
jmp 0x44125b
cmp dword [esp + 0x50], esi
je 0x441515
push 3
push dword [0x518f0c]
push str.Do_you_want_to_stop_the_application_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4478f0
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f0c]
push str.Removing_processes:__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043f2ae
pop ecx
lea ecx, [esp + 0x120]
call fcn.00421487
push 0x4dcf70
mov byte [esp + 0x3434], 0x1c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push esi
push 1
lea eax, [esp + 0x12c]
push eax
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x518f58
call fcn.004235f2
push ecx
mov byte [esp + 0x344c], 0x1d
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x518f68
call fcn.004235f2
push ecx
mov byte [esp + 0x3450], 0x1e
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x518f64
call fcn.004235f2
push ecx
mov byte [esp + 0x3454], 0x1f
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.004235f2
push ecx
mov byte [esp + 0x3458], 0x20
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0x518f0c
call fcn.004235f2
mov byte [esp + 0x3458], 0x1c
call fcn.0043b77b
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.00423607
call fcn.0043f2ae
pop ecx
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Application__s_stopped_successfully
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x120]
jmp 0x447b52
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x441668
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
mov eax, dword [0x518f5c]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x441686
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x441497
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov edi, 0x518f5c
push edi
call fcn.004235f2
call fcn.004670b0
pop ecx
cmp eax, esi
jne 0x4416b4
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4414d0
cmp dword [esp + 0x50], esi
je 0x4416d7
push 3
push dword [0x518f0c]
push str.Do_you_want_to_remove_the_applications_registry_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4478f0
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f0c]
push str.Removing_registry:__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043f2ae
pop ecx
lea ecx, [esp + 0x128]
call fcn.00421487
push 0x4dcf70
mov byte [esp + 0x3434], 0x21
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push 1
push esi
lea eax, [esp + 0x134]
push eax
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x518f58
call fcn.004235f2
push ecx
mov byte [esp + 0x344c], 0x22
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x518f68
call fcn.004235f2
push ecx
mov byte [esp + 0x3450], 0x23
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x518f64
call fcn.004235f2
push ecx
mov byte [esp + 0x3454], 0x24
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.004235f2
push ecx
mov byte [esp + 0x3458], 0x25
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0x518f0c
call fcn.004235f2
mov byte [esp + 0x3458], 0x21
call fcn.0043b77b
add esp, 0x24
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f0c]
push str.SoftwareVOS_s
push eax
call fcn.00464a80
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00465b60
pop ecx
cmp eax, esi
je 0x4417f3
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Registry_could_not_be_emptied_for__s
jmp 0x4413e1
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Registry_removed_successfully
call fcn.00423607
call fcn.0043f2ae
pop ecx
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Application__ss_registry_removed_successfully
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x128]
jmp 0x447b52
lea ecx, [esp + 0x20]
call fcn.00421487
lea ecx, [esp + 0x3c]
call fcn.00421487
lea eax, [esi + 1]
mov byte [esp + 0x3430], 0x2e
cmp dword [esp + 0x4c], eax
lea ecx, [esp + 0x20]
jle 0x441874
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
call fcn.00423660
jmp 0x44187e
lea eax, [esp + 0x18]
push eax
call fcn.0042364b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0x2f
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x168]
push eax
mov byte [esp + 0x343c], 0x2e
call fcn.00464c40
add esp, 0xc
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x3434], 0x30
call fcn.0042364b
mov byte [esp + 0x3430], 0x2e
mov ecx, dword [esp + 0x160]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00467aa0
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x24]
pop ecx
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x3c]
jne 0x441932
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
jmp 0x441254
push dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
call fcn.0043ac5f
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4419bd
push dword [0x5154ac]
lea eax, [esp + 0x40]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x228]
push eax
call fcn.00464db0
add esp, 8
mov byte [esp + 0x3438], 0x31
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x21c]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
lea ecx, [edi - 0x10]
jmp 0x4477e5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [0x5154ac]
cmp ebx, 0x10
jne 0x4419e0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x44124f
lea eax, [esp + 0x2ac]
push ebx
push eax
call fcn.0046b760
add esp, 4
mov byte [esp + 0x3438], 0x32
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x4413e2
mov eax, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax + esi*4]
call fcn.00423607
lea eax, [esp + 0x16c]
push eax
call fcn.0046a390
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x3434], 0x39
call fcn.0042364b
push eax
lea ecx, [esp + 0x70]
call fcn.0042364b
push eax
lea ecx, [esp + 0xe4]
call fcn.004235f2
mov byte [esp + 0x3430], 0x3b
mov ecx, dword [esp + 0x168]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0xe8]
call fcn.004237f6
push 0x4e71dc
push eax
call fcn.00423900
pop ecx
pop ecx
mov ecx, dword [esp + 0x224]
add ecx, 0xfffffff0
mov byte [esp + 0x2f], al
call fcn.0042101a
cmp byte [esp + 0x2f], 0
lea ecx, [esp + 0x6c]
je 0x441ab5
push 1
push 0x22
jmp 0x441ab9
push 0
push 0x20
call fcn.00425cb6
mov esi, eax
cmp esi, 0xffffffff
je 0x441b2e
push esi
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x74]
call fcn.004237f6
push 0x4e70c8
mov byte [esp + 0x3434], 0x3c
call fcn.00438cdc
push eax
lea ecx, [esp + 0x70]
call fcn.0042364b
mov byte [esp + 0x3430], 0x3b
mov ecx, dword [esp + 0x170]
add ecx, 0xfffffff0
call fcn.0042101a
push 0
lea ecx, [esp + 0x78]
lea eax, [esi + 1]
push ecx
call fcn.0042369e
lea eax, [esp + 0x74]
call fcn.0042374d
push eax
lea ecx, [esp + 0x78]
call fcn.0042364b
jmp 0x441b53
push 0x4e70c8
lea eax, [esp + 0xe4]
call fcn.00438cdc
push eax
lea ecx, [esp + 0x70]
call fcn.0042364b
push ebx
lea ecx, [esp + 0x78]
call fcn.00423660
xor ecx, ecx
lea eax, [esp + 0x6c]
call fcn.00429eb7
movzx eax, ax
cmp ax, 0x25
jne 0x441b72
lea eax, [esp + 0x6c]
push eax
call fcn.00474150
pop ecx
mov byte [esp + 0x3430], 4
mov ecx, dword [esp + 0xe0]
add ecx, 0xfffffff0
call fcn.0042101a
xor edi, edi
push 1
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xe60]
push eax
call fcn.00478360
push 0xffffffffffffffff
mov dword [esp + 0x3434], 0x172
push dword [esp + 0x40]
lea eax, [esp + 0x7c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3440], 0x73
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3444], 0x74
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3444], 0x75
push dword [esp + 0x8c]
lea eax, [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xe70]
push eax
mov byte [esp + 0x3450], 0x72
call fcn.004339c1
add esp, 0x20
cmp eax, 2
jne 0x447b5f
call fcn.0043fa50
push edi
push dword [0x518f0c]
push str.Application_is_now_integrated_into_your_system
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0xe54]
call fcn.00479240
lea eax, [esp + 0xe54]
mov dword [esp + 0x3430], 4
call fcn.004266c5
jmp 0x4412c4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ShowStreaming:
call fcn.00423607
call fcn.0043f2ae
pop ecx
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x970]
push eax
call fcn.00478360
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x343c], 0x4b
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x4c
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x4d
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x344c], 0x4e
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x980]
push eax
mov byte [esp + 0x3450], 0x4b
call fcn.004339c1
add esp, 0x20
lea ecx, [esp + 0x964]
call fcn.00432d22
lea eax, [esp + 0x964]
call fcn.00479240
mov byte [esp + 0x3430], 4
lea eax, [esp + 0x964]
call fcn.004266c5
jmp 0x441408
lea ecx, [esp + 0x20]
call fcn.00421487
lea eax, [esi + 1]
mov byte [esp + 0x3430], 0x4f
cmp dword [esp + 0x4c], eax
lea ecx, [esp + 0x20]
jle 0x441d92
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
call fcn.00423660
jmp 0x441d9c
lea eax, [esp + 0x18]
push eax
call fcn.0042364b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0x50
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0x343c], 0x4f
call fcn.00464c40
add esp, 0xc
push 1
push 0
push ecx
mov byte [esp + 0x343c], 0x51
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x388]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0x52
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x388]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0x404], 0
jne 0x441e57
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_containers_
jmp 0x44124f
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00466770
pop ecx
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x441e98
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x5c]
push str.Cant_empty__s
jmp 0x4413e1
mov esi, dword [esp + 0x54]
call fcn.00467190
test eax, eax
jne 0x441ec0
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x5c]
push str.Cant_create__s
jmp 0x4413e1
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, 0x4dcf70
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x53
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.VirtApp.ini
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x54
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x55
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str.Main
push esi
call fcn.00423607
push 3
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x56
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.AppVirtDll.dll
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x57
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x58
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 2
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x59
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.AppVirtDll64.dll
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x5a
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x5b
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 8
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x5c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.StubExe.exe
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x5d
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x5e
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 9
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x5f
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.StubExe64.exe
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x60
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x61
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 0xa
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x62
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.VirtFiles.db
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x63
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x64
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 4
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x65
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.SandboxCfg.db
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x66
mov ecx, esp
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x67
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 5
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x68
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.VirtReg.export
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x69
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x6a
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 6
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x6b
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.VirtReg.dat
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x6c
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x6d
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 0xb
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x6e
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.SysDllSubdirs.txt
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x6f
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x70
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push 7
pop ecx
lea edi, [esp + 0x384]
mov byte [esp + 0x3438], 0x52
call fcn.0047a750
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x71
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.VirtFiles.vfc
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x72
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0x52
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3438], 0x73
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
mov byte [esp + 0x3438], 0x52
xor ecx, ecx
inc ecx
lea edi, [esp + 0x384]
call fcn.0047a750
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x5c]
push 0x4ecd84
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
jmp 0x441259
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Unbreak:
call fcn.00423607
call fcn.0043f2ae
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0x74
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x78]
push eax
mov byte [esp + 0x343c], 4
call fcn.00464c40
add esp, 0xc
mov byte [esp + 0x3430], 0x75
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x442506
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x78]
push str.Dir_doesnt_exist:__s
jmp 0x4413e1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.004235f2
mov esi, str..old
push esi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x234]
push eax
mov byte [esp + 0x343c], 0x76
call fcn.00423856
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x180]
push eax
call fcn.00423856
add esp, 0xc
push dword [eax]
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x178]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x4425a2
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_rename_myself_to_.old
jmp 0x44124f
push esi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x23c]
push eax
call fcn.00423856
mov eax, dword [eax]
add esp, 0xc
push 0
push dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x234]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x4425f9
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_myself
jmp 0x44124f
and dword [esp + 0xe8], 0
push 1
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4dcf70
lea ebx, [esp + 0xf8]
lea esi, [esp + 0x140]
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x77
mov ecx, esp
mov dword [esp + 0x24], esp
push str.VirtApp.ini
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x78
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3444], 0x76
call fcn.004645d0
add esp, 0xc
mov edi, esi
call fcn.00465210
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x442c96
xor edi, edi
cmp dword [esp + 0xe8], edi
je 0x442c96
push dword [esp + 0xe8]
mov ecx, dword [esp + 0x134]
lea eax, [esp + 0x3c]
push eax
call fcn.00464f70
mov byte [esp + 0x3438], 0x79
push dword [esp + 0x138]
call fcn.004add25
add esp, 0xc
push 1
push 1
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x2f8]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0x7a
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x2f8]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0x374], edi
jne 0x442731
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_begin_to_update_resource
jmp 0x44124f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.00423607
mov byte [esp + 0x3434], 0x7b
mov eax, dword [esp + 0x3c]
mov eax, dword [eax - 0xc]
add eax, eax
push edi
push eax
lea ecx, [esp + 0x44]
call fcn.00423dd4
push eax
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479c10
cmp eax, edi
je 0x442790
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_update_INI_resource
jmp 0x44124f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0
push 2
push ecx
mov byte [esp + 0x3440], 0x7c
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov ebx, 0x4dcf70
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x7d
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll.dll
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x7e
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x7c
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0
push 8
push ecx
mov byte [esp + 0x3440], 0x7f
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x80
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll64.dll
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x81
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x7f
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0
push 9
push ecx
mov byte [esp + 0x3440], 0x82
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x83
mov ecx, esp
mov dword [esp + 0x48], esp
push str.StubExe.exe
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x84
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x82
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0
push 0xa
push ecx
mov byte [esp + 0x3440], 0x85
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x86
mov ecx, esp
mov dword [esp + 0x48], esp
push str.StubExe64.exe
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x87
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x85
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0x4000
push 4
push ecx
mov byte [esp + 0x3440], 0x88
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x89
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtFiles.db
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x8a
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x88
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0x4000
push 5
push ecx
mov byte [esp + 0x3440], 0x8b
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x8c
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SandboxCfg.db
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x8d
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x8b
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
mov byte [esp + 0x3434], 0x8e
push 0x4000
push 0xb
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x8f
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtReg.dat
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x90
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x8e
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0
push 7
push ecx
mov byte [esp + 0x3440], 0x91
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x92
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SysDllSubdirs.txt
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x93
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x91
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0x4000
push 1
push ecx
mov byte [esp + 0x3440], 0x94
mov edi, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3448], 0x95
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtFiles.vfc
call fcn.00423607
push ecx
mov byte [esp + 0x344c], 0x96
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
mov byte [esp + 0x344c], 0x94
call fcn.004645d0
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
mov byte [esp + 0x3444], 0x7a
call fcn.00479f70
lea eax, [esp + 0x2ec]
call fcn.00479240
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
je 0x442c87
push str.Could_not_commit_resource
jmp 0x44124f
push str.Success
call fcn.00423607
jmp 0x442474
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_VirtApp.ini
jmp 0x44124f
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x442ce1
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push esi
call fcn.00437756
pop ecx
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str._s_is_no_longer_integrated.
jmp 0x44246b
lea ecx, [esp + 0x20]
call fcn.00421487
lea ecx, [esp + 0x38]
call fcn.00421487
mov byte [esp + 0x3430], 0xc0
or dword [esp + 0x24], 0xffffffff
lea eax, [esi + 1]
cmp dword [esp + 0x4c], eax
jle 0x442d3e
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x24]
call fcn.00423660
add esi, 2
cmp dword [esp + 0x4c], esi
jle 0x442d57
mov eax, dword [esp + 0x28]
push dword [eax + esi*4]
lea ecx, [esp + 0x3c]
call fcn.00423660
lea ecx, [esp + 0x180]
call fcn.00421487
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x3434], 0xc1
call fcn.004235f2
push ecx
mov byte [esp + 0x3434], 0xc2
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x442db4
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
xor esi, esi
inc esi
push esi
push 0
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xdd0]
push eax
call fcn.00478360
lea edi, [esp + 0xdc4]
mov byte [esp + 0x3430], 0xc3
call fcn.00428a5f
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
je 0x442e16
push ecx
push 0x80
push 4
push ecx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x24], eax
push esi
push esi
push esi
lea eax, [esp + 0x18c]
push eax
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x518f58
call fcn.004235f2
push ecx
mov byte [esp + 0x344c], 0xc4
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x518f68
call fcn.004235f2
push ecx
mov byte [esp + 0x3450], 0xc5
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x518f64
call fcn.004235f2
push ecx
mov byte [esp + 0x3454], 0xc6
mov ecx, esp
mov dword [esp + 0x9c], esp
push 0x518f5c
call fcn.004235f2
push ecx
mov byte [esp + 0x3458], 0xc7
mov ecx, esp
mov dword [esp + 0x84], esp
mov esi, 0x518f0c
push esi
call fcn.004235f2
mov byte [esp + 0x3458], 0xc3
call fcn.0043b77b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x28
call edi
push 0
push 2
mov dword [esp + 0x6c], eax
push 0x518f00
lea eax, [esp + 0xdd0]
push eax
push dword [esp + 0x2c]
call fcn.00430f13
add esp, 0x14
test eax, eax
je 0x442ef7
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Failed_BasicDeploy_
jmp 0x44124f
call edi
sub eax, dword [esp + 0x64]
mov dword [esp + 0x64], eax
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], 0
je 0x442fb6
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0xc8
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4e698c
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0xc9
mov ecx, esp
mov dword [esp + 0x44], esp
push ebx
call fcn.00423607
push 2
push ecx
mov byte [esp + 0x344c], 0xca
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xde0]
push eax
mov byte [esp + 0x3450], 0xc3
call fcn.004339c1
add esp, 0x20
push 0
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
call fcn.0046ae40
pop ecx
pop ecx
test eax, eax
jne 0x442fb6
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x442f8b
call edi
push ecx
mov edi, eax
sub edi, dword [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x518f58
call fcn.004235f2
push ecx
mov byte [esp + 0x3438], 0xcb
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x518f68
call fcn.004235f2
push ecx
mov byte [esp + 0x343c], 0xcc
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x518f5c
call fcn.004235f2
push ecx
mov byte [esp + 0x3440], 0xcd
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.004235f2
mov byte [esp + 0x3440], 0xc3
call fcn.0043b376
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.00421487
lea ecx, [esp + 0x23c]
mov eax, 0x100
push ecx
mov byte [esp + 0x3434], 0xce
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x244], eax
call fcn.004214a5
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x4c]
call fcn.00423915
push edi
push dword [esp + 0x68]
lea eax, [esp + 0x140]
push dword [esp + 0x50]
push dword [0x518f0c]
push str._s__s__d_d_r_n
push eax
call fcn.00464a80
add esp, 0x18
mov byte [esp + 0x3430], 0xcf
push dword [esp + 0x138]
lea ecx, [esp + 0x18c]
call fcn.00424faf
mov byte [esp + 0x3430], 0xd0
mov esi, dword [esp + 0x24]
xor edi, edi
cmp esi, 0xffffffff
je 0x4430ee
push 2
push edi
push edi
push esi
mov dword [esp + 0x254], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x188]
mov ecx, dword [eax - 0xc]
push edi
lea edx, [esp + 0x248]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x5154ac]
lea eax, [esp + 0x13c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
call fcn.0043fb1c
pop ecx
pop ecx
push edi
jmp 0x44125b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Packager.log
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0xd1
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xd0]
push eax
mov byte [esp + 0x343c], 4
call fcn.00464c40
add esp, 8
mov byte [esp + 0x3434], 0xd2
lea eax, [esp + 0xcc]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00467aa0
pop ecx
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x7c0]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xd3
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x7c0]
push eax
call fcn.0043fb96
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0xd4
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0xd5
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x344c], 0xd6
mov ecx, esp
mov dword [esp + 0x38], esp
lea eax, [esp + 0x34]
push eax
call fcn.004235f2
lea eax, [esp + 0x7d0]
push eax
mov byte [esp + 0x3450], 0xd3
call fcn.004339c1
add esp, 0x20
lea edi, [esp + 0x7b4]
call fcn.00428a5f
mov ebx, eax
test ebx, ebx
je 0x4432aa
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00463e40
mov byte [esp + 0x3438], 0xd7
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LogsPackager.log
call fcn.00423607
push ebx
mov byte [esp + 0x343c], 0xd3
call fcn.00426b99
add esp, 0xc
test eax, eax
jne 0x4432a0
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_extract_Packager.log_
jmp 0x44124f
xor esi, esi
inc esi
call fcn.0047ce00
jmp 0x4432cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.Loader__ExtractLog_:_OpenVfc_failed__LE_d
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043f27e
pop ecx
lea eax, [esp + 0x7b4]
call fcn.00479240
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xd0]
test esi, esi
je 0x4432fa
push str.Success:__s
jmp 0x44246b
push str.Failed_saving__s
jmp 0x44246b
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x443338
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push 1
push 0
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x730]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xd8
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x730]
push eax
call fcn.0043fb96
lea edi, [esp + 0x734]
call fcn.00428a5f
push 1
push 2
push esi
mov ecx, edi
push ecx
push eax
call fcn.00430f13
mov esi, eax
add esp, 0x24
mov eax, edi
call fcn.00479240
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
test esi, esi
jne 0x443514
push dword [0x518f5c]
push str.Success:_n_s
jmp 0x44246b
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x443407
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
lea eax, [esp + 0x190]
push eax
call fcn.0048cd40
pop ecx
mov byte [esp + 0x3430], 0xd9
push dword [eax]
lea ecx, [esp + 0x250]
call fcn.00424faf
mov byte [esp + 0x3430], 0xdb
mov ecx, dword [esp + 0x190]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x24c]
mov edi, dword [eax - 0xc]
push eax
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str..xml
push esi
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0xdc
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00463d50
pop ecx
push ebx
mov byte [esp + 0x3444], 0xdb
call fcn.00464c40
add esp, 0xc
call fcn.00465450
pop ecx
pop ecx
push dword [0x5154ac]
push ecx
mov dword [esp + 0x18], esp
test eax, eax
je 0x443512
mov ecx, esp
push esi
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0xdd
mov eax, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00463d50
pop ecx
lea eax, [esp + 0x1a4]
push eax
mov byte [esp + 0x3440], 0xdb
call fcn.00464c40
add esp, 8
mov byte [esp + 0x3438], 0xde
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Success:_n_s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x198]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x441259
mov eax, esp
push str.Failed_extracting.
push eax
call fcn.00464a80
pop ecx
pop ecx
jmp 0x442474
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
call fcn.004235f2
lea eax, [esi + 1]
mov byte [esp + 0x3430], 0xdf
cmp dword [esp + 0x4c], eax
jle 0x443556
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x3c]
call fcn.00423660
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1250]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xe0
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1250]
push eax
call fcn.0043fb96
lea eax, [esp + 0x1254]
push eax
lea eax, [esp + 0x268]
push eax
call fcn.0043fc2f
add esp, 0x18
push esi
push str.Info
push dword [esp + 0x25c]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
jmp 0x44125b
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x44360c
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
call fcn.004235f2
lea eax, [esi + 1]
mov byte [esp + 0x3430], 0xe1
cmp dword [esp + 0x4c], eax
jle 0x44363c
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x3c]
call fcn.00423660
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xf80]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xe2
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xf80]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0xffc], esi
jne 0x4436b0
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FAILED_LOADING_CONTAINERS_
jmp 0x44124f
lea eax, [esp + 0xf74]
push eax
lea eax, [esp + 0x1a4]
push eax
call fcn.0043ff73
pop ecx
pop ecx
push esi
push str.Sandbox
push dword [esp + 0x1a8]
jmp 0x4435cc
push str._GetProperty_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4ed610
call fcn.004ad530
pop ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + esi*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x260]
call fcn.00423607
push 1
push 0
push ecx
mov byte [esp + 0x343c], 0xe3
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x12e0]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xe4
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x12e0]
push eax
call fcn.0043fb96
add esp, 0x10
lea ecx, [esp + 0x140]
call fcn.00421487
lea eax, [esp + 0x2cc]
push eax
mov byte [esp + 0x3434], 0xe5
call fcn.00429f18
lea eax, [esp + 0x140]
push eax
push ecx
mov byte [esp + 0x3438], 0xe6
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.00423607
push 3
lea edi, [esp + 0x12e0]
call fcn.0047a5b0
mov ecx, dword [esp + 0x140]
mov eax, dword [ecx - 0xc]
test eax, eax
jne 0x4437c6
push 6
jmp 0x44125b
lea edx, [esp + 0x2cc]
push edx
push eax
push ecx
call fcn.0046c570
mov eax, dword [esp + 0x2f0]
mov eax, dword [eax]
add esp, 0xc
lea edi, [esp + 0x2cc]
lea esi, [esp + 0x90]
call fcn.0042a34a
mov eax, dword [esp + 0x2e4]
lea esi, [esp + 0xa4]
call fcn.0042a34a
mov edi, esi
lea esi, [esp + 0x90]
call fcn.0042a05c
test al, al
je 0x4414eb
xor ebx, ebx
lea esi, [esp + 0x90]
call fcn.0043d536
push dword [eax]
lea eax, [esp + 0x260]
call fcn.0042368a
test eax, eax
jne 0x4438ad
call fcn.0043d536
add eax, 4
push dword [eax]
lea ecx, [esp + 0xfc]
call fcn.00424faf
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x44389e
mov ecx, dword [esp + 0xf8]
push ebx
mov dword [esp + 0x14c], ebx
mov edx, dword [ecx - 0xc]
lea esi, [esp + 0x14c]
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44389e
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0xf8]
cmp eax, dword [ecx - 0xc]
je 0x446e05
mov ecx, dword [esp + 0xf8]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [esp + 0x90]
call fcn.0042a360
mov eax, dword [esp + 0x2e4]
lea edi, [esp + 0x2cc]
lea esi, [esp + 0xa4]
call fcn.0042a34a
mov edi, esi
lea esi, [esp + 0x90]
call fcn.0042a05c
test al, al
jne 0x44381f
jmp 0x4414eb
push str._ExportProperties_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x20]
call fcn.00421487
push str._ExportProperties
mov byte [esp + 0x3434], 0xe7
call fcn.004ad530
pop ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + esi*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x24]
call fcn.00423660
push 0
push ecx
lea eax, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x343c], 0xe8
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3440], 0xe9
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3440], 0xe7
call fcn.004298cc
add esp, 0x10
push dword [0x5154ac]
test eax, eax
push ecx
mov dword [esp + 0x18], esp
mov eax, esp
push dword [esp + 0x28]
jne 0x44399d
push str.Cannot_save_into:__s
jmp 0x4413e1
push str.Properties_exported_to:_n_s
jmp 0x44246b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
call fcn.004235f2
lea eax, [esi + 1]
mov byte [esp + 0x3430], 0xea
cmp dword [esp + 0x4c], eax
jle 0x4439d7
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x3c]
call fcn.00423660
push 1
push 0
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x8e0]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xeb
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x8e0]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0x95c], 0
jne 0x443a46
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4436a6
lea eax, [esp + 0x8d4]
push eax
lea eax, [esp + 0x104]
push eax
call fcn.0043fc2f
pop ecx
pop ecx
push str._n_nSandboxing:_n_n
lea ecx, [esp + 0x104]
mov byte [esp + 0x3434], 0xec
call fcn.00429c2c
lea eax, [esp + 0x8d4]
push eax
lea eax, [esp + 0x1ac]
push eax
call fcn.0043ff73
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x3434], 0xed
call fcn.00423675
mov byte [esp + 0x3430], 0xec
mov ecx, dword [esp + 0x1a8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x100]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str..txt
push esi
lea edi, [eax + eax]
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0xee
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00463d50
pop ecx
push ebx
mov byte [esp + 0x3444], 0xec
call fcn.00464c40
add esp, 0xc
call fcn.00465450
pop ecx
pop ecx
xor edi, edi
push edi
push str.Package_info
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0xef
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00463d50
pop ecx
lea eax, [esp + 0x1c0]
push eax
mov byte [esp + 0x3444], 0xec
call fcn.00464c40
add esp, 0xc
mov byte [esp + 0x3438], 0xf0
push dword [eax]
push str.Saved_in:__s
lea eax, [esp + 0x274]
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x264]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x1b0]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x44310f
lea ecx, [esp + 0x10]
call fcn.00421487
lea ecx, [esp + 0x10c]
call fcn.00421487
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x3434], 0xf6
call fcn.004235f2
lea eax, [esi + 1]
mov byte [esp + 0x3430], 0xf7
cmp dword [esp + 0x4c], eax
jle 0x443be9
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x54]
call fcn.00423660
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str..ini
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0xf8
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x11c]
push eax
mov byte [esp + 0x343c], 0xf7
call fcn.00464c40
add esp, 8
mov byte [esp + 0x3434], 0xf9
lea eax, [esp + 0x118]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
call fcn.00467aa0
pop ecx
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xcb0]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xfa
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xcb0]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0xd2c], esi
jne 0x443cbb
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x4436a6
lea eax, [esp + 0x10c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.00423607
push 3
lea edi, [esp + 0xcb0]
call fcn.0047a5b0
mov ecx, dword [esp + 0x10c]
mov eax, dword [ecx - 0xc]
cmp eax, esi
jne 0x443d02
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x4412a4
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x11c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
call fcn.00465450
pop ecx
pop ecx
jmp 0x4435d3
push str.AppID_ShortDesc_FriendlyName_Category_DownloadUrl_IconUrl_Version_BuildUid_Size_PopularityIndex_n
lea ecx, [esp + 0x6c]
call fcn.00423607
xor edi, edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x134], edi
mov dword [esp + 0x220], edi
call fcn.00421487
push 1
push edi
push ecx
mov byte [esp + 0x343c], 0xfc
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1520]
push eax
call fcn.00478360
push 0xffffffffffffffff
push edi
push ecx
mov byte [esp + 0x343c], 0xfd
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0xfe
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0xff
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov dword [esp + 0x344c], 0x100
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1530]
mov ebx, 0xfd
push eax
mov dword [esp + 0x3450], ebx
call fcn.004339c1
mov edi, 0x4e28e8
push edi
lea eax, [esp + 0x178]
push 0x518f0c
push eax
call fcn.00423856
add esp, 0x2c
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x3434], 0x101
call fcn.00423675
mov dword [esp + 0x3430], ebx
mov ecx, dword [esp + 0x154]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea ecx, [esp + 0x6c]
call fcn.00429c2c
push edi
push 0x518f18
lea eax, [esp + 0x27c]
push eax
call fcn.00423856
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x3434], 0x102
call fcn.00423675
mov dword [esp + 0x3430], ebx
mov ecx, dword [esp + 0x274]
add ecx, 0xfffffff0
call fcn.0042101a
push str.Productivity_
lea ecx, [esp + 0x6c]
call fcn.00429c2c
lea eax, [esi + 1]
cmp dword [esp + 0x4c], eax
jle 0x443ebe
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ebx, [esp + 0x6c]
push 0x4ed8c8
call fcn.0042651c
mov esi, dword [esp + 0x60]
pop ecx
pop ecx
mov ebx, 0xfd
jmp 0x443ecc
push str._Download_URL_here__
lea ecx, [esp + 0x6c]
call fcn.00429c2c
lea eax, [esi + 2]
cmp dword [esp + 0x4c], eax
jle 0x443ef7
mov ecx, dword [esp + 0x28]
push dword [ecx + eax*4]
lea ebx, [esp + 0x6c]
push 0x4ed8c8
call fcn.0042651c
mov esi, dword [esp + 0x60]
pop ecx
pop ecx
mov ebx, 0xfd
jmp 0x443f05
push str._Icon_here__
lea ecx, [esp + 0x6c]
call fcn.00429c2c
push edi
lea eax, [esp + 0x1bc]
push 0x518f20
push eax
call fcn.00423856
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x3434], 0x103
call fcn.00423675
mov dword [esp + 0x3430], ebx
mov ecx, dword [esp + 0x1b8]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea eax, [esp + 0x1c0]
push 0x518f50
push eax
call fcn.00423856
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x3434], 0x104
call fcn.00423675
mov dword [esp + 0x3430], ebx
mov ecx, dword [esp + 0x1bc]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x138]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00463d50
pop ecx
call fcn.00467a00
add esp, 0xc
push dword [esp + 0x134]
lea eax, [esp + 0x254]
push 0x4dfb18
push eax
call fcn.00464a80
add esp, 0xc
push edi
push eax
lea eax, [esp + 0x1d0]
push eax
mov dword [esp + 0x343c], 0x105
call fcn.00423856
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x3434], 6
call fcn.00423675
mov ecx, dword [esp + 0x1c8]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [esp + 0x3430], ebx
mov ecx, dword [esp + 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4e0874
lea ecx, [esp + 0x6c]
call fcn.00429c2c
add esi, 3
cmp dword [esp + 0x4c], esi
jle 0x4440a2
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..csv
call fcn.00423607
push ecx
mov dword [esp + 0x3438], 0x107
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00463d50
pop ecx
lea eax, [esp + 0x1d8]
push eax
mov dword [esp + 0x343c], ebx
call fcn.00464c40
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3434], 0x108
call fcn.0042364b
mov dword [esp + 0x3430], ebx
mov ecx, dword [esp + 0x1d0]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x4440b2
mov eax, dword [esp + 0x28]
push dword [eax + esi*4]
lea ecx, [esp + 0x28]
call fcn.00423660
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
call fcn.00465450
pop ecx
pop ecx
push dword [0x5154ac]
push ecx
mov dword [esp + 0x18], esp
test eax, eax
jne 0x4440fb
mov eax, esp
lea ecx, [esp + 0x2c]
push ecx
push str.Could_not_save_to
push eax
call fcn.004238ab
jmp 0x4413e7
mov ecx, esp
lea eax, [esp + 0x2c]
push eax
call fcn.004235f2
jmp 0x442474
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1010]
push eax
call fcn.00478360
mov dword [esp + 0x3430], 0x109
cmp dword [esp + 0x108c], esi
jne 0x444155
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x441e4d
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f0c]
push str._s.AppVirtDll.dll
push eax
call fcn.00464a80
lea eax, [esp + 0x118]
add esp, 0xc
push eax
call fcn.004643e0
add esp, 4
mov byte [esp + 0x3434], 0xa
lea eax, [esp + 0x10c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3438], 0xb
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.00423607
push 2
pop ecx
lea edi, [esp + 0x100c]
mov byte [esp + 0x3438], 0xa
call fcn.0047a750
push dword [0x5154ac]
lea eax, [esp + 0x10c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x230]
push eax
call fcn.00481ae0
add esp, 4
mov byte [esp + 0x3438], 0xc
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov byte [esp + 0x3430], 0xa
mov ecx, dword [esp + 0x228]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x10c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00467aa0
jmp 0x443d20
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004235f2
push 0x2e
lea ecx, [esp + 0x28]
mov dword [esp + 0x3434], 0x10d
call fcn.00438cb7
push eax
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0x2c]
call fcn.004237f6
push str..new.exe
push eax
lea eax, [esp + 0x94]
push eax
mov byte [esp + 0x343c], 0xe
call fcn.00423856
add esp, 0xc
mov byte [esp + 0x3430], 0x10
mov ecx, dword [esp + 0x1d8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x26c]
call fcn.00423607
push 0
mov byte [esp + 0x3434], 0x11
push dword [esp + 0x90]
push dword [esp + 0x270]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x44431b
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push dword [esp + 0x30]
push str.Cant_copy__s_to__s
push eax
call fcn.00464a80
add esp, 0x10
jmp 0x441254
push dword [esp + 0x8c]
push dword [esp + 0x28]
call fcn.00438ed8
pop ecx
pop ecx
xor esi, esi
inc esi
push esi
push 0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x4f0]
push eax
call fcn.00478360
push esi
push esi
push ecx
mov byte [esp + 0x343c], 0x12
lea eax, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x11c0]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0x13
push dword [0x5154ac]
lea eax, [esp + 0x48]
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x4f0]
push eax
call fcn.0043fb96
add esp, 0x10
lea eax, [esp + 0x30]
lea ecx, [esp + 0x554]
call fcn.00447c30
jmp 0x4444d3
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CEChangeEngine.tmp
call fcn.00423607
lea eax, [esp + 0xa0]
push eax
call fcn.004643e0
add esp, 4
mov byte [esp + 0x3434], 0x14
lea eax, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
lea esi, [esp + 0x34]
mov byte [esp + 0x3434], 0x15
call fcn.00423b76
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
call fcn.00423b76
mov byte [esp + 0x3438], 0x14
mov ecx, dword [eax + 0x28]
lea edi, [esp + 0x4ec]
call fcn.0047a750
test eax, eax
jne 0x44452f
call fcn.00423b76
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x4000
mov byte [esp + 0x3438], 0x16
call fcn.00423b76
push dword [eax + 0x28]
lea eax, [esp + 0xa8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x11c4]
push eax
mov byte [esp + 0x3444], 0x14
call fcn.00479f70
test eax, eax
jne 0x44455b
push ecx
lea eax, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00467aa0
pop ecx
mov byte [esp + 0x3430], 0x13
mov ecx, dword [esp + 0x9c]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.00447ca8
lea eax, [esp + 0x2b0]
lea ecx, [esp + 0x554]
call fcn.00447c45
mov edi, eax
lea esi, [esp + 0x30]
call fcn.00423bf4
test al, al
jne 0x4443c1
lea eax, [esp + 0x4e4]
call fcn.00479240
lea eax, [esp + 0x11b4]
call fcn.00479240
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push str.Successfully_changed_Loader:__s
jmp 0x44246b
push dword [0x5154ac]
call fcn.00423b76
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x3c]
call fcn.00423b76
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x44430e
push dword [0x5154ac]
lea esi, [esp + 0x34]
call fcn.00423b76
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
jmp 0x444548
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004235f2
push 0x2e
lea ecx, [esp + 0x24]
mov dword [esp + 0x3434], 0x117
call fcn.00438cb7
push eax
lea eax, [esp + 0x1e4]
push eax
lea ecx, [esp + 0x28]
call fcn.004237f6
push str..new.exe
push eax
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x343c], 0x18
call fcn.00423856
add esp, 0xc
mov byte [esp + 0x3430], 0x1a
mov ecx, dword [esp + 0x1e0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0xa4]
call fcn.00423607
push 0
mov byte [esp + 0x3434], 0x1b
push dword [esp + 0xbc]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x444631
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc0]
push dword [esp + 0x2c]
jmp 0x444308
push 1
push 1
push ecx
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x460]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0x1c
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x460]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0x4dc], 0
jne 0x4446a8
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_open_PeContainer
jmp 0x44124f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.00423607
push 0
push 2
push ecx
mov byte [esp + 0x3440], 0x1d
lea eax, [esp + 0xb0]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x464]
push eax
mov byte [esp + 0x3444], 0x1c
call fcn.00479f70
test eax, eax
je 0x44470a
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x44124f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0
push 8
push ecx
mov byte [esp + 0x3440], 0x1e
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235f2
push edi
call fcn.00471ba0
pop ecx
pop ecx
lea eax, [esp + 0x464]
push eax
mov byte [esp + 0x3444], 0x1c
call fcn.00479f70
test eax, eax
je 0x444776
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x44124f
lea ecx, [esp + 0x11c]
call fcn.00421487
lea ecx, [esp + 0x144]
call fcn.00421487
lea eax, [esp + 0x11c]
push eax
push ecx
mov byte [esp + 0x3438], 0x20
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.00423607
push 3
lea edi, [esp + 0x460]
call fcn.0047a5b0
test eax, eax
je 0x4447d4
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x44124f
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
lea eax, [esp + 0xa8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
lea ebx, [esp + 0x150]
call fcn.004235f2
push edi
call fcn.00481ae0
add esp, 4
mov byte [esp + 0x3438], 0x21
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.EngineVersion
call fcn.00423607
push ecx
mov byte [esp + 0x343c], 0x22
lea eax, [esp + 0x128]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x343c], 0x20
call fcn.00469080
pop ecx
pop ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push 0x4000
push 3
pop esi
push ecx
mov byte [esp + 0x343c], 0x23
mov eax, ebx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
mov ecx, esi
lea ebx, [esp + 0x460]
mov byte [esp + 0x343c], 0x20
call fcn.00479d50
test eax, eax
je 0x44489e
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x44124f
lea eax, [esp + 0x454]
call fcn.00479240
push dword [0x5154ac]
lea eax, [esp + 0xa4]
push ecx
mov dword [esp + 0x18], esp
mov esi, esp
push dword [esp + 0xc0]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x240]
push eax
call fcn.00481ae0
pop ecx
pop ecx
mov byte [esp + 0x343c], 0x24
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00464a80
add esp, 0x10
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x230]
jmp 0x443505
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004235f2
push 0x2e
lea ecx, [esp + 0x24]
mov dword [esp + 0x3434], 0x125
call fcn.00438cb7
push eax
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x28]
call fcn.004237f6
push str..new.exe
push eax
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x343c], 0x26
call fcn.00423856
add esp, 0xc
mov byte [esp + 0x3430], 0x28
mov ecx, dword [esp + 0x1e8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x25c]
call fcn.00423607
xor esi, esi
push esi
mov byte [esp + 0x3434], 0x29
push dword [esp + 0xb8]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4449c8
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xbc]
push dword [esp + 0x2c]
jmp 0x444308
push 1
push 1
push ecx
lea eax, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x6a0]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0x2a
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x6a0]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0x71c], esi
jne 0x444a39
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x44469e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Main
call fcn.00423607
push esi
push 3
push ecx
mov byte [esp + 0x3440], 0x2b
lea eax, [esp + 0x268]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x6a4]
push eax
mov byte [esp + 0x3444], 0x2a
call fcn.00479f70
cmp eax, esi
je 0x444a99
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEINI
jmp 0x44124f
lea eax, [esp + 0x694]
call fcn.00479240
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xbc]
push str.Successfully_changed_INI._nNew_package_saved_in:_n_s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
jmp 0x443d1f
lea esi, [esp + 0x9f4]
call fcn.00430017
mov dword [esp + 0x3430], 0x12c
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x58]
push dword [edi + esi*4 + 4]
lea ecx, [esp + 0xa40]
call fcn.00423660
push dword [edi + esi*4 + 8]
lea ecx, [esp + 0xa18]
call fcn.00423660
push dword [edi + esi*4 + 0xc]
lea ecx, [esp + 0xa10]
call fcn.00423660
push eax
lea ecx, [esp + 0xa04]
call fcn.0042364b
push dword [edi + esi*4 + 0x10]
lea ecx, [esp + 0xa48]
call fcn.00423660
push dword [edi + esi*4 + 0x14]
lea ecx, [esp + 0xa44]
call fcn.00423660
lea eax, [esp + 0x1364]
push eax
lea edi, [esp + 0x9f8]
call fcn.0048b930
lea eax, [esp + 0x1364]
push eax
mov byte [esp + 0x3434], 0x2d
call fcn.0048bad0
test eax, eax
je 0x444bc5
xor esi, esi
mov eax, 0x4eddb8
cmp dword [esp + 0x1364], esi
jne 0x444b8f
mov eax, 0x4eddc0
push dword [esp + 0x1370]
push dword [esp + 0x1370]
push eax
lea eax, [esp + 0x1fc]
push str.Need_to_update:__s_nVersion:__s_nBuildUID:__s_n
push eax
call fcn.00464a80
add esp, 0x14
push esi
push str.Server_test:
push dword [esp + 0x1f8]
jmp 0x4435cc
push 0
push str.Server_test:
push str.Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
jmp 0x44125b
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x444c14
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push 0
mov ecx, esi
call fcn.00435846
jmp 0x441405
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x850]
push eax
call fcn.00478360
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x343c], 0x12e
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x2f
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x30
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x344c], 0x31
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x860]
push eax
mov byte [esp + 0x3450], 0x2e
call fcn.004339c1
add esp, 0x20
lea ecx, [esp + 0x844]
call fcn.00432d4e
lea eax, [esp + 0x844]
call fcn.00479240
mov dword [esp + 0x3430], 4
lea eax, [esp + 0x844]
jmp 0x441d5b
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xef0]
push eax
call fcn.00478360
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x343c], 0x132
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x33
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x34
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x344c], 0x35
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xf00]
push eax
mov byte [esp + 0x3450], 0x32
call fcn.004339c1
add esp, 0x20
push esi
push esi
push esi
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
xor ecx, ecx
call fcn.00475990
pop ecx
call fcn.0048ac20
add esp, 0x10
lea eax, [esp + 0xee4]
call fcn.00479240
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov edi, 0x518f00
push edi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x444def
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Cannot_obtain_INI_info_from_resource_
call fcn.00423607
call fcn.0043f27e
pop ecx
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str.MountVirtReg
push eax
call fcn.00464a80
pop ecx
pop ecx
call fcn.0043f27e
mov eax, esp
mov dword [esp + 0x14], esp
push str._____________
push eax
call fcn.00464a80
pop ecx
pop ecx
call fcn.0043f27e
pop ecx
call fcn.00429663
mov edi, eax
cmp edi, esi
jne 0x444e43
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Cannot_mount_virtual_registry
call fcn.00423607
call fcn.0043f27e
pop ecx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423607
push edi
call fcn.00440060
pop ecx
pop ecx
mov dword [esp + 0x3430], 4
lea eax, [esp + 0xee4]
jmp 0x441d5b
mov edi, dword [esp + 0x28]
push dword [edi + esi*4 + 4]
lea ecx, [esp + 0x128]
call fcn.00423607
mov dword [esp + 0x3430], 0x136
push dword [edi + esi*4 + 8]
lea ecx, [esp + 0x9c]
call fcn.00423607
push 0x10
xor edi, edi
mov byte [esp + 0x3434], 0x37
push edi
push dword [esp + 0x12c]
call fcn.004b152e
add esp, 8
mov esi, eax
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x9c]
push esi
push str.SetFileFlags:__0x_x____s_
push eax
call fcn.00464a80
add esp, 0x10
call fcn.0043f27e
pop ecx
push 1
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xb90]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0x38
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xb90]
push eax
call fcn.0043fb96
add esp, 0x10
push 0xffffffffffffffff
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x39
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x3a
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x344c], 0x3b
mov ecx, esp
mov dword [esp + 0x38], esp
lea eax, [esp + 0x34]
push eax
call fcn.004235f2
lea eax, [esp + 0xba0]
push eax
mov byte [esp + 0x3450], 0x38
call fcn.004339c1
call fcn.0046f7f0
mov edi, 0x51876c
mov eax, edi
call fcn.004803d0
mov eax, dword [esp + 0xb8]
push 0
call fcn.0046fea0
add esp, 0x24
push ecx
mov dword [esp + 0x14], esp
test eax, eax
je 0x445028
mov eax, dword [eax + 0x24]
mov dword [eax], esi
mov ecx, esp
push dword [0x51876c]
call fcn.00423607
mov ecx, edi
call fcn.0046fdd0
pop ecx
test eax, eax
je 0x445012
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xa0]
push esi
push str.Success:_n__x___s
push eax
call fcn.00464a80
add esp, 0x10
call fcn.0043fb1c
pop ecx
jmp 0x445044
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str._SetFileFlags:_could_not_save_tree
push eax
call fcn.00464a80
pop ecx
pop ecx
jmp 0x44503f
mov eax, esp
push dword [esp + 0x9c]
push str._SetFileFlags:_could_not_find__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043f27e
pop ecx
mov eax, edi
call fcn.004803e0
lea eax, [esp + 0xb84]
mov byte [esp + 0x3430], 0x37
call fcn.004266c5
mov ecx, dword [esp + 0x98]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x124]
add ecx, 0xfffffff0
jmp 0x4477e5
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.DbgZip
call fcn.00423607
call fcn.0043f2ae
mov dword [esp], str._DbgZip:
call fcn.004ad5da
pop ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + esi*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x64]
call fcn.00423660
jmp 0x441b89
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x610]
push eax
call fcn.00478360
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x343c], 0x13c
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x3d
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x3e
mov ecx, esp
mov dword [esp + 0x44], esp
push ebx
call fcn.00423607
push 2
push ecx
mov byte [esp + 0x344c], 0x3f
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x620]
push eax
mov byte [esp + 0x3450], 0x3c
call fcn.004339c1
add esp, 0x20
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x610]
push eax
call fcn.0043fb96
push dword [esp + 0x58]
lea edx, [esp + 0x618]
mov ecx, 0x518f00
call fcn.004375d1
add esp, 0x14
mov dword [esp + 0x3430], 4
lea eax, [esp + 0x604]
jmp 0x441d5b
push 1
xor edi, edi
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x10a0]
push eax
call fcn.00478360
push 0xffffffffffffffff
push edi
push ecx
mov dword [esp + 0x343c], 0x146
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x47
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x48
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x344c], 0x49
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x10b0]
push eax
mov byte [esp + 0x3450], 0x46
call fcn.004339c1
add esp, 0x20
lea esi, [esp + 0xa4]
call fcn.0047e130
push 1
lea eax, [esp + 0x1fd0]
push eax
mov eax, esi
push eax
mov byte [esp + 0x343c], 0x4a
lea eax, [esp + 0x44]
mov dword [esp + 0x44], edi
call fcn.0047de50
test eax, eax
je 0x44533a
mov esi, 0x518f0c
push dword [0x518f0c]
lea eax, [esp + 0x27f8]
push eax
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x445317
mov dword [esp + 0x24], edi
cmp dword [esp + 0x23f0], edi
jbe 0x445317
mov ebx, dword [esp + 0x24]
lea ebx, [esp + ebx*8 + 0x23f4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebx], eax
je 0x445306
mov eax, dword [esp + 0x24]
test byte [esp + eax*8 + 0x23f8], 3
je 0x445306
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x518f5c
call fcn.004235f2
push ecx
mov byte [esp + 0x3438], 0x4b
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
mov byte [esp + 0x3438], 0x4a
mov ebx, dword [ebx]
call fcn.0043b238
pop ecx
pop ecx
xor edi, edi
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x23f0]
jb 0x4452aa
push 1
lea eax, [esp + 0x1fd0]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x44]
call fcn.0047de50
test eax, eax
jne 0x445284
push edi
push edi
push edi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [esp + 0xa4]
call fcn.0047e150
lea eax, [esp + 0x1094]
mov dword [esp + 0x3430], 4
call fcn.004266c5
jmp 0x441406
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1490]
push eax
call fcn.00478360
push 0xffffffffffffffff
mov dword [esp + 0x3434], 0x14c
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x4d
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Vintegrate_
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x4e
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push esi
push ecx
mov byte [esp + 0x344c], 0x4f
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x14a0]
push eax
mov byte [esp + 0x3450], 0x4c
call fcn.004339c1
add esp, 0x20
call fcn.0043fa50
jmp 0x4435d3
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x58]
push str._ProcessList:all
push dword [eax + ecx*4]
call fcn.004ad328
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
lea esi, [esp + 0xa4]
inc edi
call fcn.0047e130
mov dword [esp + 0x3430], 0x150
and dword [esp + 0x20], 0
lea ecx, [esp + 0x40]
call fcn.00421487
xor eax, eax
test edi, edi
sete al
mov byte [esp + 0x3430], 0x51
mov dword [esp + 0x38], eax
jmp 0x445739
lea eax, [esp + 0x1dcc]
push eax
lea eax, [esp + 0x23c]
push str._AppID_ws_n
push eax
call fcn.00464a80
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3434], 0x52
call fcn.00423675
mov byte [esp + 0x3430], 0x51
mov ecx, dword [esp + 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x15a8]
lea eax, [esp + 0x1fc]
push str.____SerialId:__d_n
push eax
call fcn.00464a80
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3434], 0x53
call fcn.00423675
mov byte [esp + 0x3430], 0x51
mov ecx, dword [esp + 0x1f8]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x19c0]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x27c]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00464a80
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3434], 0x54
call fcn.00423675
mov byte [esp + 0x3430], 0x51
mov ecx, dword [esp + 0x278]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x19c4]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x204]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00464a80
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3434], 0x55
call fcn.00423675
mov byte [esp + 0x3430], 0x51
mov ecx, dword [esp + 0x200]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x240]
push str.____Processes:_n
push eax
call fcn.00464a80
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3434], 0x56
call fcn.00423675
mov byte [esp + 0x3430], 0x51
mov ecx, dword [esp + 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
and dword [esp + 0x50], 0
cmp dword [esp + 0x19c8], 0
jbe 0x445739
push ebx
lea ecx, [esp + 0xc0]
call fcn.00423607
mov byte [esp + 0x3430], 0x57
mov edi, dword [esp + 0x50]
lea edi, [esp + edi*8 + 0x19cc]
push dword [edi]
lea esi, [esp + 0xc0]
call fcn.00463590
pop ecx
test eax, eax
jne 0x445635
push 0x4e13c0
mov ecx, esi
call fcn.00423660
push 0x5c
push ecx
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x268]
push eax
call fcn.00464db0
add esp, 0xc
mov byte [esp + 0x3430], 0x58
push dword [eax]
lea eax, [esp + 0x20c]
push dword [edi]
push str._______wd:__ws
push eax
call fcn.00464a80
add esp, 0x10
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3434], 0x59
call fcn.00423675
mov ecx, dword [esp + 0x208]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x3430], 0x57
mov ecx, dword [esp + 0x260]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0x50]
mov eax, dword [esp + esi*8 + 0x19d0]
test eax, eax
je 0x445702
push eax
lea eax, [esp + 0x214]
push str._0x_x_
push eax
call fcn.00464a80
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3434], 0x5a
call fcn.00423675
mov byte [esp + 0x3430], 0x57
mov ecx, dword [esp + 0x210]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4dd494
lea ecx, [esp + 0x44]
call fcn.00429c2c
mov byte [esp + 0x3430], 0x51
mov ecx, dword [esp + 0xbc]
add ecx, 0xfffffff0
call fcn.0042101a
inc esi
mov dword [esp + 0x50], esi
cmp esi, dword [esp + 0x19c8]
jb 0x4455f6
push dword [esp + 0x38]
lea eax, [esp + 0x15a8]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x2c]
call fcn.0047de50
test eax, eax
jne 0x44547a
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
cmp dword [esp + 0x28], eax
jne 0x445787
push str.No_active_virtual_apps
call fcn.00423607
call fcn.0043fb1c
pop ecx
pop ecx
jmp 0x444bd9
lea eax, [esp + 0x48]
jmp 0x444101
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x4457c3
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
lea esi, [esp + 0xa4]
call fcn.0047e130
mov dword [esp + 0x3430], 0x15b
and dword [esp + 0x38], 0
jmp 0x4457fa
push dword [0x518f0c]
lea eax, [esp + 0x3220]
push eax
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x44582a
push 1
lea eax, [esp + 0x29f8]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x44]
call fcn.0047de50
test eax, eax
jne 0x4457e1
lea eax, [esp + 0xa4]
call fcn.0047e150
jmp 0x441259
push 0x2bc
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0xa4]
mov dword [esp + 0x3430], 4
call fcn.0047e150
jmp 0x4457c3
lea eax, [esp + 0x248]
push eax
mov eax, dword [esp + 0x60]
mov eax, dword [eax + 0x44]
call fcn.0042e597
lea eax, [esp + 0x248]
push eax
call fcn.0042e6d4
jmp 0x441259
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AutoUpdate
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x4458c0
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f48]
push str.AutoUpdate_s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043f2ae
mov ecx, 0x518f48
mov dword [esp], str.https:__online.cameyo.com
call fcn.00423660
push str.0000
mov ecx, 0x518f4c
call fcn.00423660
mov ecx, esi
call fcn.0048d740
jmp 0x441406
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.VirtRegSyncExport
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x445954
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
call fcn.0043c55b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00464a80
add esp, 0xc
jmp 0x441400
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartStreaming:AppIDSkype
call fcn.00423607
call fcn.004263d1
pop ecx
jmp 0x441405
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x4459c5
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
xor edi, edi
xor ebx, ebx
call fcn.00423607
push edi
push ecx
mov dword [esp + 0x343c], 0x15e
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x518f5c]
push str._select___s_
push eax
call fcn.00464a80
add esp, 8
mov byte [esp + 0x3440], 0x5f
mov ecx, esp
mov dword [esp + 0x40], esp
push str.explorer.exe
call fcn.00423607
mov dword [esp + 0x3440], 4
call fcn.004637b0
add esp, 0x10
jmp 0x441406
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegister
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov edi, 0x518f00
push edi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x445a7a
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
call fcn.00429663
mov esi, eax
test esi, esi
jne 0x445a9c
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_mount_virtual_registry
jmp 0x44124f
call fcn.0046f7f0
push dword [0x5154ac]
push esi
push edi
call fcn.004229c2
add esp, 0xc
push dword [0x5154ac]
mov esi, eax
test esi, esi
jne 0x445acb
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Success
jmp 0x445adc
cmp esi, 5
jne 0x445ae6
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_register
call fcn.00423607
jmp 0x444ac7
lea eax, [esp + 0x21c]
push esi
push eax
call fcn.0046b760
add esp, 4
mov dword [esp + 0x3438], 0x160
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_registering_services:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x218]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x4435d3
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStart
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x445b7c
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
mov ecx, esi
call fcn.00423210
push dword [0x5154ac]
mov esi, eax
test esi, esi
je 0x445abd
cmp esi, 5
jne 0x445ba9
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_start
jmp 0x445adc
lea eax, [esp + 0x274]
push esi
push eax
call fcn.0046b760
add esp, 4
mov dword [esp + 0x3438], 0x161
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_starting_services:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x270]
jmp 0x445b26
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegisterStart
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov edi, 0x518f00
push edi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x445c37
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
call fcn.00429663
mov esi, eax
test esi, esi
jne 0x445c54
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x445a92
call fcn.0046f7f0
push dword [0x5154ac]
push esi
push edi
call fcn.004229c2
add esp, 0xc
mov ebx, str.No_services_to_register
mov esi, str.Failed_registering_services:__s
cmp eax, 5
jne 0x445c94
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00423607
call fcn.0043fb1c
pop ecx
pop ecx
jmp 0x445ced
test eax, eax
je 0x445ced
push dword [0x5154ac]
push eax
lea eax, [esp + 0x1bc]
push eax
call fcn.0046b760
add esp, 4
mov dword [esp + 0x3438], 0x162
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push esi
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov dword [esp + 0x3430], 4
mov ecx, dword [esp + 0x1b4]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, edi
call fcn.00423210
push dword [0x5154ac]
mov edi, eax
test edi, edi
jne 0x445d0e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Success
jmp 0x445d1b
cmp edi, 5
jne 0x445d25
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00423607
jmp 0x443108
lea eax, [esp + 0x1c8]
push edi
push eax
call fcn.0046b760
add esp, 4
mov dword [esp + 0x3438], 0x163
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push esi
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c4]
jmp 0x443b8f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStop
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x445daf
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push 0
mov ecx, esi
call fcn.00422db4
mov esi, eax
pop ecx
push dword [0x5154ac]
test esi, esi
je 0x445abd
cmp esi, 5
jne 0x445ddf
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_stop
jmp 0x445adc
lea eax, [esp + 0x1d0]
push esi
push eax
call fcn.0046b760
add esp, 4
mov dword [esp + 0x3438], 0x164
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_stopping_services:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x1cc]
jmp 0x445b26
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRemove
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x445e6d
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push 1
mov ecx, esi
call fcn.00422db4
mov esi, eax
pop ecx
push dword [0x5154ac]
test esi, esi
je 0x445abd
cmp esi, 5
jne 0x445e9d
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_remove
jmp 0x445adc
lea eax, [esp + 0x1d8]
push esi
push eax
call fcn.0046b760
add esp, 4
mov dword [esp + 0x3438], 0x165
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_removing_services:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x1d4]
jmp 0x445b26
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.RepoSync
call fcn.00423607
call fcn.0043f2ae
mov eax, dword [esp + 0x2c]
pop ecx
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x130]
call fcn.00423607
lea eax, [esp + 0x43c]
push eax
mov dword [esp + 0x3434], 0x166
call fcn.00423a00
lea eax, [esp + 0x40c]
push eax
mov byte [esp + 0x3434], 0x67
call fcn.00423a00
lea eax, [esp + 0x424]
push eax
mov byte [esp + 0x3434], 0x68
call fcn.00423a00
push 0
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x448]
push eax
push ecx
mov byte [esp + 0x3444], 0x69
lea eax, [esp + 0x140]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3448], 0x6a
lea eax, [esp + 0x144]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3448], 0x69
call fcn.004378f0
add esp, 0x18
push eax
jmp 0x44125b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Cameyo.exe__UpgradePkg_
call fcn.00423607
call fcn.0043f2ae
pop ecx
lea ecx, [esp + 0xd0]
call fcn.00421487
mov byte [esp + 0x3430], 0x6d
mov eax, dword [esp + 0x28]
push dword [eax + esi*4]
lea ecx, [esp + 0xf0]
call fcn.00423607
push ecx
mov byte [esp + 0x3434], 0x6e
lea eax, [esp + 0xf0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.004670b0
pop ecx
test eax, eax
jne 0x446039
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xf4]
push str._s_not_found
jmp 0x4413e1
push 0
lea eax, [esp + 0xd4]
push eax
push ecx
lea eax, [esp + 0xf8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3440], 0x6f
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00463d50
pop ecx
mov byte [esp + 0x3440], 0x6e
call fcn.0043c872
add esp, 0x10
push dword [0x5154ac]
test eax, eax
jne 0x44609a
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xd8]
jmp 0x442466
push eax
lea eax, [esp + 0x2d0]
push eax
call fcn.0046b760
add esp, 4
mov byte [esp + 0x3438], 0x70
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xd8]
push dword [eax]
push str._s:__s
push ecx
jmp 0x44430e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AuthCheck
call fcn.00423607
call fcn.0043f2ae
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
mov esi, 0x518f00
push esi
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x446116
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
call fcn.0042fecb
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4461c4
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x58]
push str._AuthCheck:Force
push dword [eax + ecx*4]
call fcn.004ad328
and dword [esp + 0x1e4], 0
add esp, 4
mov dword [esp + 0x14], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuthToken.dat
lea edi, [esp + 0x1e8]
call fcn.00423607
push ebx
xor ecx, ecx
call fcn.004755b0
mov edx, dword [esp + 0x28]
pop ecx
pop ecx
mov ecx, esi
call fcn.0042f758
push dword [0x5154ac]
mov esi, eax
push ecx
mov dword [esp + 0x18], esp
test esi, esi
je 0x446199
mov ecx, esp
push str.Allowed_to_run_this_package
call fcn.00423607
jmp 0x4461ae
mov eax, esp
push 0x518fd8
push str.Denied:_n
push eax
call fcn.004238ab
add esp, 0xc
call fcn.0043fb1c
neg esi
sbb esi, esi
pop ecx
and esi, 0xffffffef
pop ecx
add esi, 0x11
jmp 0x4435d3
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_authentication_server_specified_in_this_package
jmp 0x44124f
push str.Vintegrate:
lea ecx, [esp + 0x100]
call fcn.00423607
mov dword [esp + 0x3430], 0x140
mov eax, dword [esp + 0x28]
lea esi, [eax + esi*4]
push str._VintegrateRecursive
push dword [esi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x44622f
push 0x4ee0b8
call fcn.004ad530
pop ecx
push eax
push str._VintegrateRecursive:
push dword [esi]
call fcn.004afb46
add esp, 0xc
test eax, eax
jne 0x446240
push str.VintegrateRecursive:
lea ecx, [esp + 0x100]
call fcn.00423660
push str._Windows_Explorer.exe
lea ecx, [esp + 0xd8]
call fcn.00423607
mov byte [esp + 0x3430], 0x41
mov esi, dword [esi]
push 0x3a
push esi
call fcn.004ae088
xor esi, esi
pop ecx
pop ecx
cmp eax, esi
je 0x44627b
add eax, 2
push eax
lea ecx, [esp + 0xd8]
call fcn.00423660
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1130]
push eax
call fcn.00478360
push 0xffffffffffffffff
mov byte [esp + 0x3434], 0x42
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov eax, esp
mov byte [esp + 0x3440], 0x43
mov dword [esp + 0x24], esp
lea ecx, [esp + 0xe4]
push ecx
lea ecx, [esp + 0x110]
push ecx
push eax
call fcn.0042a7f3
add esp, 8
mov byte [esp + 0x3444], 0x44
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push esi
push ecx
mov byte [esp + 0x344c], 0x45
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1140]
push eax
mov byte [esp + 0x3450], 0x42
call fcn.004339c1
add esp, 0x20
lea eax, [esp + 0x1124]
mov byte [esp + 0x3430], 0x41
call fcn.004266c5
mov ecx, dword [esp + 0xd4]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xfc]
jmp 0x447b52
lea ecx, [esp + 0x20]
call fcn.00421487
lea ecx, [esp + 0xdc]
call fcn.00421487
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x3434], 0xf2
call fcn.004235f2
lea eax, [esi + 1]
mov byte [esp + 0x3430], 0xf3
cmp dword [esp + 0x4c], eax
jle 0x4463a5
mov eax, dword [esp + 0x28]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x60]
call fcn.00423660
push 1
push 0
push ecx
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xc20]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0xf4
push dword [0x5154ac]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xc20]
push eax
call fcn.0043fb96
add esp, 0x10
cmp dword [esp + 0xc9c], 0
jne 0x446411
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x24]
call fcn.0042651c
pop ecx
lea eax, [esp + 0xdc]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.00423607
push 3
lea edi, [esp + 0xc20]
call fcn.0047a5b0
mov eax, dword [esp + 0xdc]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x446454
push str.Cannot_obtain_INI_info_from_resource__n
lea ecx, [esp + 0x24]
call fcn.0042a3c8
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x24]
call fcn.004241c9
push esi
push 0x4e1344
push dword [esp + 0x28]
jmp 0x4435cc
lea eax, [esp + 0x20]
push eax
call fcn.00463e40
pop ecx
mov byte [esp + 0x3430], 0xa6
mov eax, dword [esp + 0x28]
mov edi, 0x4ed370
push edi
lea esi, [eax + esi*4]
call fcn.004ad530
pop ecx
push eax
push str._CreateShortcuts:
push dword [esi]
call fcn.004afb46
add esp, 0xc
test eax, eax
jne 0x4464cc
push dword [esi]
lea ecx, [esp + 0x24]
call fcn.00423660
push edi
call fcn.004ad530
pop ecx
push 0
lea ecx, [esp + 0x24]
push ecx
call fcn.0042369e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x4464ff
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push 0x518f10
lea ecx, [esp + 0x60]
call fcn.004235f2
lea eax, [esp + 0x64]
push eax
push 0x4e28e8
lea eax, [esp + 0x84]
mov byte [esp + 0x3438], 0xa7
and dword [esp + 0x6c], 0
push eax
lea ecx, [esp + 0x68]
call fcn.00429dbb
jmp 0x446a58
lea ecx, [esp + 0x24]
call fcn.00421487
lea ecx, [esp + 0x28]
call fcn.00421487
lea ecx, [esp + 0x58]
call fcn.00421487
lea ecx, [esp + 0x3c]
call fcn.00421487
push 0x3e
pop esi
push esi
push ecx
mov byte [esp + 0x3438], 0xac
and dword [esp + 0x88], 0
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x8c]
call fcn.004235f2
lea eax, [esp + 0x1ec]
push eax
call fcn.004685a0
add esp, 0xc
mov byte [esp + 0x3430], 0xad
call fcn.0042374d
push eax
lea ecx, [esp + 0x28]
call fcn.0042364b
mov byte [esp + 0x3430], 0xac
mov ecx, dword [esp + 0x1e4]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x80], 0xffffffff
je 0x4469f9
push esi
push ecx
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1f4]
push eax
call fcn.004685a0
add esp, 0xc
mov byte [esp + 0x3430], 0xae
call fcn.0042374d
push eax
lea ecx, [esp + 0x2c]
call fcn.0042364b
mov byte [esp + 0x3430], 0xac
mov ecx, dword [esp + 0x1ec]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x80], 0xffffffff
je 0x4469f9
push esi
push ecx
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1fc]
push eax
call fcn.004685a0
add esp, 0xc
mov byte [esp + 0x3430], 0xaf
call fcn.0042374d
push eax
lea ecx, [esp + 0x5c]
call fcn.0042364b
mov byte [esp + 0x3430], 0xac
mov ecx, dword [esp + 0x1f4]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x80], 0xffffffff
jne 0x4466a3
push ebx
lea ecx, [esp + 0x5c]
call fcn.00423660
jmp 0x4466fd
push esi
push ecx
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x8c]
call fcn.004235f2
lea eax, [esp + 0x204]
push eax
call fcn.004685a0
add esp, 0xc
mov byte [esp + 0x3430], 0xb0
call fcn.0042374d
push eax
lea ecx, [esp + 0x40]
call fcn.0042364b
mov byte [esp + 0x3430], 0xac
mov ecx, dword [esp + 0x1fc]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x80], 0xffffffff
jne 0x446711
push ebx
lea ecx, [esp + 0x40]
call fcn.00423660
push dword [esp + 0x24]
lea eax, [esp + 0xc8]
push str._exec___s_
push eax
call fcn.00464a80
add esp, 0xc
mov byte [esp + 0x3430], 0xb1
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
je 0x44675e
push 0x4e4420
lea ecx, [esp + 0xc8]
call fcn.00429c2c
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xc8]
call fcn.00423675
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push ecx
mov esi, esp
mov byte [esp + 0x3438], 0xb2
mov dword [esp + 0x1c], esp
push 0x5c
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235f2
push esi
call fcn.00464db0
lea eax, [esp + 0x160]
add esp, 0xc
push eax
mov byte [esp + 0x343c], 0xb1
call fcn.00429226
add esp, 8
mov byte [esp + 0x3434], 0xb3
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x4dcf70
push esi
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0xb4
lea eax, [esp + 0x154]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x343c], 0xb5
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x518f5c
call fcn.004235f2
lea edi, [esp + 0x100]
mov byte [esp + 0x343c], 0xb3
call fcn.004645d0
add esp, 8
mov byte [esp + 0x3434], 0xb6
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423607
push ecx
mov eax, esp
mov byte [esp + 0x3438], 0xb7
mov dword [esp + 0x1c], esp
push str..lnk
lea ecx, [esp + 0x64]
push ecx
push eax
call fcn.00423856
add esp, 8
mov byte [esp + 0x343c], 0xb8
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004235f2
lea edi, [esp + 0x210]
mov byte [esp + 0x343c], 0xb6
call fcn.004645d0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x204]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0xf8]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.004670b0
pop ecx
test eax, eax
je 0x4468ba
lea eax, [esp + 0xf4]
jmp 0x4468d5
push 0
lea ecx, [esp + 0x210]
call fcn.00423607
mov byte [esp + 0x3430], 0xb9
or dword [esp + 0x40], 2
mov eax, dword [eax]
push 0
push ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
push ecx
mov dword [esp + 0x343c], 0xba
lea eax, [esp + 0xd0]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3440], 0xbb
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3444], 0xbc
mov dword [esp + 0x8c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x90], esp
push esi
call fcn.00423607
push ecx
mov eax, esp
mov byte [esp + 0x344c], 0xbd
mov dword [esp + 0x54], esp
push str..lnk
lea ecx, [esp + 0x78]
push ecx
push eax
call fcn.00423856
add esp, 8
mov byte [esp + 0x3450], 0xbe
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x70], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3450], 0xbc
call fcn.004645d0
mov esi, dword [esp + 0x3c]
add esp, 0xc
mov byte [esp + 0x3444], 0xb9
call fcn.00489ba0
add esp, 0x14
mov dword [esp + 0x3430], 0xb6
test byte [esp + 0x40], 2
je 0x4469cc
mov ecx, dword [esp + 0x20c]
and dword [esp + 0x40], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xf4]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x14c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xc4]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x3430], 0xa7
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x64]
push eax
push 0x4e28e8
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x68]
call fcn.00429dbb
cmp dword [esp + 0x64], 0xffffffff
jne 0x44653a
mov byte [esp + 0x3430], 0xa7
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Shortcuts_created_for__s.
jmp 0x44246b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004235f2
mov byte [esp + 0x3430], 0x97
mov eax, dword [esp + 0x28]
lea esi, [eax + esi*4]
push str._FullIntegrate
push dword [esi]
mov dword [esp + 0x24], esi
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x446c4f
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x446afe
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
push dword [esp + 0x48]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x518f0c
call fcn.004235f2
lea eax, [esp + 0xec]
push eax
call fcn.0043c81c
add esp, 8
mov byte [esp + 0x3434], 0x98
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4dcf70
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0x99
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x518f0c]
push str._s.host.exe
push eax
call fcn.00464a80
add esp, 8
mov byte [esp + 0x343c], 0x9a
lea eax, [esp + 0xf0]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004235f2
lea edi, [esp + 0x164]
mov byte [esp + 0x343c], 0x98
call fcn.004645d0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x3434], 0x9b
call fcn.0042364b
mov byte [esp + 0x3430], 0x98
mov ecx, dword [esp + 0x158]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0xe4]
call fcn.00467190
test eax, eax
jne 0x446be0
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_create_virtual_repository
jmp 0x44124f
lea eax, [esp + 0x15c]
push eax
call fcn.00463d50
mov eax, dword [eax]
pop ecx
push 0
push dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x15c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x2f], al
call fcn.0042101a
cmp byte [esp + 0x2f], 0
je 0x446c34
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_executable_to_repository
jmp 0x44124f
mov byte [esp + 0x3430], 0x97
mov ecx, dword [esp + 0xe4]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0x1c]
push 1
xor edi, edi
push edi
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xb00]
push eax
call fcn.00478360
push 0xffffffffffffffff
push edi
push ecx
mov byte [esp + 0x343c], 0x9c
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x9d
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x9e
mov ecx, esp
mov dword [esp + 0x44], esp
push ebx
call fcn.00423607
push 2
push ecx
mov byte [esp + 0x344c], 0x9f
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0xb10]
push eax
mov byte [esp + 0x3450], 0x9c
call fcn.004339c1
push str._Integrate:once
push dword [esi]
call fcn.004ad328
add esp, 0x28
mov esi, str.SoftwareVOS_s
test eax, eax
jne 0x446e3f
push ebx
lea ecx, [esp + 0x8c]
call fcn.00423607
xor ebx, ebx
push ebx
push ebx
push ebx
push ecx
mov byte [esp + 0x3440], 0xa0
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Registered
lea edi, [esp + 0x9c]
call fcn.00423607
mov byte [esp + 0x3440], 0xa1
push dword [0x518f0c]
lea eax, [esp + 0x178]
push esi
push eax
call fcn.00464a80
add esp, 8
mov byte [esp + 0x3444], 0xa2
or dword [esp + 0x54], 1
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Integrated
push eax
push ecx
call fcn.00423856
add esp, 0xc
mov dword [esp + 0x3444], 0xa3
call fcn.004749b0
push eax
mov byte [esp + 0x3448], 0xa4
call fcn.00465560
add esp, 0x18
cmp eax, ebx
je 0x446da9
mov eax, dword [esp + 0x88]
mov byte [esp + 0x2f], 1
cmp dword [eax - 0xc], ebx
jne 0x446dae
mov byte [esp + 0x2f], 0
mov dword [esp + 0x3430], 0xa0
test byte [esp + 0x40], 1
je 0x446dcf
mov ecx, dword [esp + 0x164]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [esp + 0x2f], 0
je 0x446e26
push str.Success
lea eax, [esp + 0x8c]
call fcn.0042368a
push ecx
test eax, eax
mov dword [esp + 0x14], esp
mov eax, esp
jne 0x446e0b
push str._Integrate:once:_already_registered_successfully._Quitting.
push eax
call fcn.00464a80
pop ecx
pop ecx
call fcn.0043f27e
pop ecx
push ebx
jmp 0x44125b
push dword [esp + 0x8c]
push str._Integrate:once:_already_attempted_registration_before__but_failed:__s._Trying_integration_again.
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043f27e
pop ecx
mov byte [esp + 0x3430], 0x9c
mov ecx, dword [esp + 0x88]
add ecx, 0xfffffff0
call fcn.0042101a
xor edi, edi
xor eax, eax
cmp dword [esp + 0x48], edi
push edi
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0xa5
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x518f0c]
push esi
push eax
call fcn.00464a80
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x3444], 0x9c
call fcn.00465a60
add esp, 0x14
push dword [esp + 0x48]
lea edx, [esp + 0xaf8]
mov ecx, 0x518f00
call fcn.004375d1
pop ecx
lea eax, [esp + 0xaf4]
call fcn.00479240
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str._s_is_now_integrated_into_your_system.
push eax
call fcn.00464a80
add esp, 0xc
jmp 0x443108
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00463b30
test eax, eax
jne 0x446f55
mov eax, dword [esp + 0x28]
xor edi, edi
push edi
push ecx
mov ebx, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
xor esi, esi
call fcn.00423607
push ebx
call fcn.0046a390
add esp, 4
mov byte [esp + 0x343c], 0x3d
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235f2
mov ecx, esi
mov edx, edi
mov byte [esp + 0x343c], 4
call fcn.00463920
add esp, 0xc
test eax, eax
jne 0x441259
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x44124a
call fcn.00463d00
test eax, eax
jne 0x446f70
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x440427
mov eax, dword [esp + 0x28]
push 0x4ec894
lea esi, [eax + esi*4]
call fcn.004ad530
pop ecx
push eax
push str._Patch
push dword [esi]
call fcn.004afb46
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x18]
sbb edi, edi
push eax
lea ecx, [esp + 0x60]
inc edi
call fcn.004235f2
push ecx
mov byte [esp + 0x3434], 0x3e
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0x3f
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x8c]
push eax
mov byte [esp + 0x343c], 0x3e
call fcn.00464c40
add esp, 0xc
mov byte [esp + 0x3430], 0x40
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [esi]
call fcn.00423607
lea eax, [esp + 0xd0]
push eax
call fcn.0046a390
pop ecx
pop ecx
push 1
xor esi, esi
push esi
push ecx
mov byte [esp + 0x343c], 0x41
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x580]
push eax
call fcn.00478360
mov byte [esp + 0x3430], 0x42
push dword [0x5154ac]
cmp dword [esp + 0x600], esi
jne 0x44707a
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x20]
push str.Cannot_load_newly_created_package__s
jmp 0x4413e1
push 1
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x580]
push eax
call fcn.0043fb96
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x43
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00423607
push ecx
mov byte [esp + 0x3444], 0x44
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x344c], 0x45
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x590]
push eax
mov byte [esp + 0x3450], 0x42
call fcn.004339c1
push dword [0x518f0c]
lea eax, [esp + 0xe4]
push dword [0x518f5c]
push str._sAppVirtDll__s.dll
push eax
call fcn.00464a80
add esp, 0x2c
mov byte [esp + 0x3434], 0x46
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00425ba8
pop ecx
cmp eax, esi
je 0x4471b3
push dword [0x5154ac]
cmp eax, 0x11
jne 0x447175
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00464a80
pop ecx
pop ecx
jmp 0x441254
cmp eax, 0x12
jne 0x447188
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x447168
push eax
lea eax, [esp + 0x2c8]
push eax
call fcn.0046b760
add esp, 4
mov byte [esp + 0x3438], 0x47
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x441a06
push dword [esp + 0xcc]
lea eax, [esp + 0x170]
push str._exec__s
push eax
call fcn.00464a80
mov eax, dword [eax]
add esp, 0xc
push esi
push esi
push eax
push dword [esp + 0x24]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x16c]
xor ebx, ebx
cmp eax, 0x20
setg bl
add ecx, 0xfffffff0
call fcn.0042101a
cmp ebx, esi
je 0x447245
cmp edi, esi
je 0x44720d
push 1
push 0x4dd498
push str.Installation_launched_in_virtual_mode..._nWhen_installation_is_done__click_OK_and_Cameyo_will_turn_it_into_a_virtual_package._nInstallation_will_not_truly_install_anything_on_your_hard_drive__it_is_simulated_.
jmp 0x447218
push esi
push 0x4dd498
push str.When_installation_is_done__click_OK.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x447245
push ecx
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00425c2f
pop ecx
push 0x14
jmp 0x44125b
push ecx
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
call fcn.00425c2f
pop ecx
cmp eax, esi
je 0x4472c0
push dword [0x5154ac]
cmp eax, 0x11
jne 0x44727f
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x447168
cmp eax, 0x12
jne 0x447295
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x447168
push eax
lea eax, [esp + 0x2b4]
push eax
call fcn.0046b760
add esp, 4
mov byte [esp + 0x3438], 0x48
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x441a06
cmp ebx, esi
jne 0x4472e2
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xd4]
push str.Failed_executing__s
jmp 0x4413e1
mov ebx, dword [esp + 0x5c]
cmp edi, esi
je 0x4473c5
call fcn.0042e05c
push 0x407
mov edi, 0x518f00
call fcn.0047d760
pop ecx
push 0
push dword [esp + 0x88]
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x84]
jne 0x447330
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x441927
push dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
call fcn.0043ac5f
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x447443
push dword [0x5154ac]
lea eax, [esp + 0x88]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x180]
push eax
call fcn.00464db0
add esp, 8
mov byte [esp + 0x3438], 0x49
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov byte [esp + 0x3430], 0x46
mov ecx, dword [esp + 0x174]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
call fcn.0047d760
pop ecx
lea eax, [esp + 0x574]
call fcn.00479240
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x8c]
push 0x4ecd84
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0xc0]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x574]
mov byte [esp + 0x3430], 0x41
call fcn.004266c5
mov ecx, dword [esp + 0xcc]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x84]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [ebx - 0x10]
jmp 0x447b55
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [0x5154ac]
cmp esi, 0x10
jne 0x447467
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4419d6
lea eax, [esp + 0x2c8]
push esi
push eax
call fcn.0046b760
add esp, 4
mov byte [esp + 0x3438], 0x4a
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4419ff
lea ecx, [esp + 0x20]
call fcn.00421487
lea ecx, [esp + 0x48]
call fcn.00421487
mov byte [esp + 0x3430], 0x34
mov eax, dword [esp + 0x28]
lea esi, [eax + esi*4]
push str._CreateDiff
push dword [esi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x4474ce
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.0042364b
jmp 0x4474e8
push 0x4ec850
call fcn.004ad530
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x24]
call fcn.00423660
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..mod
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0x35
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x184]
push eax
mov byte [esp + 0x343c], 0x34
call fcn.00464c40
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3434], 0x36
call fcn.0042364b
mov byte [esp + 0x3430], 0x34
mov ecx, dword [esp + 0x17c]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x20]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x48]
jne 0x447588
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x441927
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235f2
call fcn.0043ac5f
pop ecx
pop ecx
mov dword [esp + 0x5c], eax
test eax, eax
jne 0x447600
push dword [0x5154ac]
lea eax, [esp + 0x4c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x190]
push eax
call fcn.00464db0
add esp, 8
mov byte [esp + 0x3438], 0x37
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x184]
jmp 0x4477d2
push edi
call esi
cmp dword [esp + 0x5c], 0x10
push dword [0x5154ac]
jne 0x44761c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4419d6
push dword [esp + 0x60]
lea eax, [esp + 0x2c4]
push eax
call fcn.0046b760
add esp, 4
mov byte [esp + 0x3438], 0x38
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4419ff
lea ecx, [esp + 0x48]
call fcn.00421487
lea ecx, [esp + 0x24]
call fcn.00421487
mov byte [esp + 0x3430], 0x27
mov eax, dword [esp + 0x28]
lea esi, [eax + esi*4]
push str._LearnStreaming
push dword [esi]
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
jne 0x447686
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x4c]
call fcn.0042364b
jmp 0x4476a0
push 0x4ec62c
call fcn.004ad530
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x4c]
call fcn.00423660
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.00423607
push ecx
mov byte [esp + 0x3438], 0x28
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x194]
push eax
mov byte [esp + 0x343c], 0x27
call fcn.00464c40
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x3434], 0x29
call fcn.0042364b
mov byte [esp + 0x3430], 0x27
mov ecx, dword [esp + 0x18c]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x48]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x24]
jne 0x447740
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x441927
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235f2
push ecx
mov byte [esp + 0x3438], 0x2a
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
mov byte [esp + 0x3438], 0x27
call fcn.0043ae46
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4477ef
push dword [0x5154ac]
lea eax, [esp + 0x28]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235f2
lea eax, [esp + 0x1a0]
push eax
call fcn.00464db0
add esp, 8
mov byte [esp + 0x3438], 0x2b
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x194]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
lea ecx, [ebx - 0x10]
call fcn.0042101a
jmp 0x441406
push edi
call esi
push dword [0x5154ac]
lea eax, [esp + 0x2bc]
push dword [esp + 0x20]
push eax
call fcn.0046b760
add esp, 4
mov byte [esp + 0x3438], 0x2c
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x441a06
mov eax, dword [esp + 0x28]
push str._RemoveSelf
push dword [eax + esi*4]
call fcn.004ad328
mov ebx, eax
neg ebx
sbb ebx, ebx
add esp, 4
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
inc ebx
call fcn.004235f2
push 0x518f00
call fcn.004289f4
pop ecx
pop ecx
test al, al
jne 0x447873
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4412a4
mov eax, dword [0x518f5c]
cmp dword [eax - 0xc], 0
jne 0x447890
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x441497
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov edi, 0x518f5c
push edi
call fcn.004235f2
call fcn.004670b0
xor esi, esi
pop ecx
cmp eax, esi
jne 0x4478d1
cmp ebx, esi
je 0x4478bf
call fcn.00467b70
test eax, eax
jne 0x4435d3
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4414d0
cmp dword [esp + 0x50], esi
je 0x4478f8
push 3
push dword [0x518f0c]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x4478f8
push 0x14
pop esi
jmp 0x441408
and dword [esp + 0x110], 0
push 0
lea eax, [esp + 0x114]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
call fcn.00423607
push ecx
mov byte [esp + 0x3440], 0x16
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x518f0c]
mov esi, str.SoftwareVOS_s
push esi
push eax
call fcn.00464a80
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x3444], 4
call fcn.004657e0
add esp, 0x14
test eax, eax
je 0x4479ad
cmp dword [esp + 0x110], 0
je 0x4479ad
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00463b30
test eax, eax
jne 0x447992
call fcn.00463b80
test eax, eax
jne 0x441259
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x44124a
call fcn.00463d00
test eax, eax
jne 0x4479ad
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x440427
push 0x518f00
call fcn.00437756
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f0c]
push str.Removing__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043f2ae
pop ecx
lea ecx, [esp + 0x118]
call fcn.00421487
push 0x4dcf70
mov byte [esp + 0x3434], 0x17
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x124]
push eax
push dword [0x5154ac]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x518f58
call fcn.004235f2
push ecx
mov byte [esp + 0x344c], 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x518f68
call fcn.004235f2
push ecx
mov byte [esp + 0x3450], 0x19
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x518f64
call fcn.004235f2
push ecx
mov byte [esp + 0x3454], 0x1a
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.004235f2
push ecx
mov byte [esp + 0x3458], 0x1b
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0x518f0c
call fcn.004235f2
mov byte [esp + 0x3458], 0x17
call fcn.0043b77b
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
call fcn.004235f2
call fcn.004670f0
pop ecx
test eax, eax
je 0x447ac1
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x4413e1
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f0c]
push esi
push eax
call fcn.00464a80
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00465b60
xor esi, esi
pop ecx
cmp eax, esi
je 0x447afb
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4417e3
cmp ebx, esi
je 0x447b0c
call fcn.00467b70
test eax, eax
jne 0x4435d3
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Removed_successfully
call fcn.00423607
call fcn.0043f2ae
pop ecx
push dword [0x5154ac]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x518f0c]
push str.Application__s_removed_successfully
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043fb1c
pop ecx
pop ecx
mov ecx, dword [esp + 0x118]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x441408
cmp dword [0x518bb8], edi
je 0x447b96
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x518f48]
push str.CLoaderApp:_waiting_for_LoaderCanQuit__AutoUpdate_s_
push eax
call fcn.00464a80
add esp, 0xc
call fcn.0043f27e
pop ecx
push 0xffffffffffffffff
push dword [0x518bb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CLoaderApp:_done._Bye_
call fcn.00423607
call fcn.0043f27e
mov eax, dword [0x5154bc]
pop ecx
cmp eax, 0xa2c2a
je 0x44310f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.CLoaderApp:_ExecWait:_g_LoaderExitCode_d
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.0043f27e
pop ecx
push dword [0x5154bc]
jmp 0x44125b