Function at 0x436657
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Check os version
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Enumerate pe sections
Get file attributes
Get hostname
Get number of processors
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bc741
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x70a4
call fcn.004a3070
mov eax, dword [0x4e5c64]
xor eax, esp
mov dword [esp + 0x70a0], eax
push ebx
push esi
push edi
mov eax, dword [0x4e5c64]
xor eax, esp
push eax
lea eax, [esp + 0x70b8]
mov dword fs:[0], eax
lea eax, [esp + 0xa4]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0xa8], 8
mov dword [esp + 0xac], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x50]
call fcn.0049830e
mov esi, 0x4c4fbc
push esi
lea ecx, [esp + 0x84]
call fcn.00423442
push esi
lea ecx, [esp + 0x80]
mov dword [esp + 0x70c4], ebx
call fcn.00423442
xor edi, edi
push esi
lea ecx, [esp + 0x90]
inc edi
mov byte [esp + 0x70c4], 1
call fcn.00423442
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70c4], 2
call fcn.00460c70
pop ecx
lea eax, [esp + 0x78]
mov byte [esp + 0x70c0], 3
push eax
mov dword [esp + 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], ebx
call fcn.00460c70
pop ecx
push eax
mov ecx, 0x4ea9ec
mov byte [esp + 0x70c4], 4
call fcn.00423486
mov byte [esp + 0x70c0], 3
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x44], ebx
je 0x4370a0
cmp dword [esp + 0x78], edi
jle 0x4370a0
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], 2
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
push ecx
lea edi, [eax + ecx*4]
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [edi]
call fcn.00423442
call fcn.00435c66
mov dword [esp], 0x4ca328
call fcn.0049da60
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
jne 0x436801
push 0x4ca328
call fcn.0049da60
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.0042349b
push str._Confirm
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x43681b
mov dword [esp + 0x20], 1
push str._Quiet
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436838
mov dword [0x4e74b4], ebx
jmp 0x43708a
push str._AllUsers
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x43688b
mov dword [esp + 0x4c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00460920
test eax, eax
je 0x4371a5
call fcn.00460c20
test eax, eax
jne 0x43708a
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Admin_rights_required
jmp 0x4371c0
push str._ErrorsOnly
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x4368ac
mov dword [0x4e74b4], 1
jmp 0x43708a
push str._Wait
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x4368c8
or dword [esp + 0x54], 1
jmp 0x43708a
push 0x4ca3f4
call fcn.0049da60
pop ecx
push eax
push str._Services:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
jne 0x436930
push dword [edi]
lea ecx, [esp + 0x3c]
call fcn.00423442
push 0x4ca3f4
mov byte [esp + 0x70c4], 5
call fcn.0049da60
pop ecx
push ebx
lea ecx, [esp + 0x3c]
push ecx
call fcn.004234d9
push dword [esp + 0x38]
push str.CAMEYO_SERVICES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x70c0], 3
mov ecx, dword [esp + 0x38]
jmp 0x437082
push str._Register
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x4371d1
push str._Stop
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43727a
push str._Remove
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x437397
push str._Remove:Proc
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43767b
push str._Remove:Reg
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x437833
push str._LearnStreaming
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43bb08
push 0x4caa04
call fcn.0049da60
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43bb08
push str._UpdateBasicSettings
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x4369f6
mov dword [esp + 0x2c], 1
jmp 0x43708a
push str._Repackage
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x4379f6
push str._CreateDiff
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43b94a
push 0x4cac38
call fcn.0049da60
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43b94a
push str._exec
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x437bcf
push 0x4cac7c
call fcn.0049da60
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43b3dd
push 0x4cac94
call fcn.0049da60
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43b3dd
push str._ShowStreaming
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x437d4f
push str._Break
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x437e38
push str._Unbreak
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x4383c8
push str._Integrate
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43af92
push str._Integrate:once
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43af92
push str._FullIntegrate
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43af92
push str._Unintegrate
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x438a8a
push str._CreateShortcuts
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a955
push 0x4cb6c8
call fcn.0049da60
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43a955
push str._Perf
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x438adf
push str._ExtractLog
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x438ea1
push str._ExtractAll
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x439024
push str._Info
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x4390e6
push str._EngineVer
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436d22
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x148]
push eax
call fcn.00426225
mov byte [esp + 0x70c0], 0xc4
cmp dword [esp + 0x1c8], ebx
je 0x439552
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push str._s.AppVirtDll.dll
push eax
call fcn.00461d60
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.00461460
add esp, 4
mov byte [esp + 0x70c4], 0xc5
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0xc6
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 2
lea eax, [esp + 0x148]
push eax
mov byte [esp + 0x70d0], 0xc5
call fcn.004795c0
push dword [0x4e74b4]
lea eax, [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x64]
push eax
call fcn.00484590
add esp, 4
mov byte [esp + 0x70c8], 0xc7
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
mov byte [esp + 0x70c0], 0xc5
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
call fcn.00465470
pop ecx
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x13c]
push eax
mov byte [esp + 0x70c4], 3
call fcn.004262e4
jmp 0x43708a
mov eax, dword [esp + 0x44]
push str._ChangeLoader
push dword [eax + 4]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436d47
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x78], eax
jg 0x439564
push str._ChangeEngine
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436d67
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x78], eax
jg 0x439869
push str._ChangeIni
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436d87
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x78], eax
jg 0x439ba2
push str._Debug
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x439d14
push str._ForceMenu
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436dbc
mov dword [esp + 0x58], 1
jmp 0x43708a
push str._ShowTree
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x439db0
push str._DbgZip:
call fcn.0049db0a
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x439e74
push str._DbgNow
call fcn.0049db0a
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x439eb7
push str._Vintegrate
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a7eb
push 0x4cc1c0
call fcn.0049da60
pop ecx
push eax
push str._Vintegrate:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43a7eb
push str._VintegrateRecursive
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a7eb
push 0x4cc218
call fcn.0049da60
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43a7eb
push str._Vunintegrate
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x439f71
push str._Vmanager
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a0f0
push str._ProcessList
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a1a1
push str._GfxSvr
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436f26
call fcn.00434587
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov edi, 0x4ea9a8
call fcn.0047aff0
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.0047aff0
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43708a
push 0x4cc438
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x436f9b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
call fcn.00423442
push ebx
push ecx
mov dword [esp + 0x70cc], 0x10f
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Troubleshoot
xor edi, edi
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x10
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042342d
mov dword [esp + 0x70d0], 3
call fcn.00460320
add esp, 0x10
xor ebx, ebx
jmp 0x43708a
push str._Troubleshoot
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a49d
push str._AutoUpdate
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a4bd
push str._VirtRegSyncExport
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a582
push str._StartStreaming
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a5ed
push 0x4cc55c
call fcn.0049da60
pop ecx
push eax
push str._MakeStreamable:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x43a60b
push str._JumpTo
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a74c
push 0x4cb790
lea ecx, [esp + 0x80]
call fcn.0042349b
mov eax, dword [esp + 0x44]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.00423442
lea eax, [esp + 0x38]
push eax
call fcn.00467600
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x70c4], 0x11a
call fcn.00423486
mov dword [esp + 0x70c0], 3
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
inc dword [esp + 0x28]
cmp eax, dword [esp + 0x78]
jl 0x4367a8
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x388]
push eax
call fcn.00426225
mov dword [esp + 0x70c0], 0x11b
push dword [esp + 0x54]
lea eax, [esp + 0x90]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push eax
or esi, 0xffffffff
call fcn.0042342d
push ecx
mov byte [esp + 0x70cc], 0x1c
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70d0], 0x1d
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0xa4], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x1e
push dword [esp + 0x68]
lea eax, [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
call fcn.0042342d
mov ecx, esi
lea edx, [esp + 0x394]
mov byte [esp + 0x70d8], 0x1b
call fcn.0042c1aa
add esp, 0x18
cmp eax, 2
jne 0x43bce0
call fcn.0043655a
push ebx
push dword [0x4ea9b0]
push str.Application_is_now_integrated_into_your_system
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x37c]
call fcn.00478210
lea eax, [esp + 0x37c]
push eax
mov dword [esp + 0x70c4], 3
call fcn.004262e4
jmp 0x43721e
call fcn.00460970
test eax, eax
jne 0x4371ca
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Elevation_failed
call fcn.00423442
call fcn.004365d7
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
mov esi, 0x4ea9a8
push esi
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x437207
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x4371c0
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
call fcn.0042c0b7
pop ecx
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
mov ecx, dword [esp + 0x70b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70a0]
xor ecx, esp
call fcn.0049d211
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x4372ad
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ea9e4
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4ea9ec
call fcn.0042342d
push ecx
mov byte [esp + 0x70cc], 7
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4ea9e8
call fcn.0042342d
push ecx
mov byte [esp + 0x70d0], 8
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x4ea9b0
call fcn.0042342d
mov byte [esp + 0x70d0], 3
call fcn.00432986
add esp, 0x10
cmp eax, ebx
je 0x437343
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Cannot_stop_application__s
push eax
call fcn.00461d60
add esp, 0xc
jmp 0x4371c5
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.00423442
call fcn.00435c66
pop ecx
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
jmp 0x437256
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x4373ca
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
mov eax, dword [0x4ea9e8]
cmp dword [eax - 0xc], ebx
jne 0x4373f1
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Cannot_obtain_base_dir_for__s
jmp 0x437335
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x4ea9e8
push esi
call fcn.0042342d
call fcn.004647d0
pop ecx
cmp eax, ebx
jne 0x43742a
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Application_is_not_deployed_on_this_machine:__s
jmp 0x437335
cmp dword [esp + 0x20], ebx
je 0x437451
push 3
push dword [0x4ea9b0]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x437451
push 0x14
pop ebx
jmp 0x43735a
push ebx
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
mov dword [esp + 0x3c], ebx
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 9
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4ea9b0]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.00461d60
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x70d4], 3
call fcn.00462f30
add esp, 0x14
cmp eax, ebx
je 0x4374fa
cmp dword [esp + 0x2c], ebx
je 0x4374fa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00460920
test eax, eax
jne 0x4374df
call fcn.00460970
test eax, eax
jne 0x4371ca
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4371bb
call fcn.00460c20
test eax, eax
jne 0x4374fa
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x436881
call fcn.0042fda1
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push str.Removing__s
push eax
call fcn.00461d60
add esp, 0xc
call fcn.00435c66
pop ecx
lea ecx, [esp + 0x38]
call fcn.0042148a
push 0x4c2ec8
mov byte [esp + 0x70c4], 0xa
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x44]
push eax
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4ea9e4
call fcn.0042342d
push ecx
mov byte [esp + 0x70dc], 0xb
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4ea9ec
call fcn.0042342d
push ecx
mov byte [esp + 0x70e0], 0xc
mov ecx, esp
mov dword [esp + 0x5c], esp
push esi
call fcn.0042342d
push ecx
mov byte [esp + 0x70e4], 0xd
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4ea9b0
call fcn.0042342d
mov byte [esp + 0x70e4], 0xa
call fcn.00432db5
add esp, 0x20
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042342d
call fcn.00464810
pop ecx
cmp eax, ebx
je 0x4375e8
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x437335
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push edi
push eax
call fcn.00461d60
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00463270
pop ecx
cmp eax, ebx
je 0x43762b
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Registry_could_not_be_emptied_for__s
jmp 0x437335
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Removed_successfully
call fcn.00423442
call fcn.00435c66
pop ecx
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Application__s_removed_successfully
push eax
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43735a
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x4376ae
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
mov eax, dword [0x4ea9e8]
cmp dword [eax - 0xc], ebx
jne 0x4376ca
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4373e1
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ea9e8
call fcn.0042342d
call fcn.004647d0
pop ecx
cmp eax, ebx
jne 0x437711
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9e8]
push dword [0x4ea9b0]
push str.Application_is_not_deployed_on_this_machine:__s_n_n__s_
push eax
call fcn.00461d60
add esp, 0x10
jmp 0x4371c5
cmp dword [esp + 0x20], ebx
je 0x437734
push 3
push dword [0x4ea9b0]
push str.Do_you_want_to_stop_the_application_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x437449
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push str.Removing_processes:__s
push eax
call fcn.00461d60
add esp, 0xc
call fcn.00435c66
pop ecx
lea ecx, [esp + 0x2c]
call fcn.0042148a
push 0x4c2ec8
mov byte [esp + 0x70c4], 0xe
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
push ebx
push 1
lea eax, [esp + 0x38]
push eax
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4ea9e4
call fcn.0042342d
push ecx
mov byte [esp + 0x70dc], 0xf
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4ea9ec
call fcn.0042342d
push ecx
mov byte [esp + 0x70e0], 0x10
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x4ea9e8
call fcn.0042342d
push ecx
mov byte [esp + 0x70e4], 0x11
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4ea9b0
call fcn.0042342d
mov byte [esp + 0x70e4], 0xe
call fcn.00432db5
add esp, 0x20
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.00423442
call fcn.00435c66
pop ecx
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Application__s_stopped_successfully
push eax
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
jmp 0x43766e
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x437866
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
mov eax, dword [0x4ea9e8]
cmp dword [eax - 0xc], ebx
jne 0x437882
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4373e1
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x4ea9e8
push esi
call fcn.0042342d
call fcn.004647d0
pop ecx
cmp eax, ebx
jne 0x4378b0
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4376f2
cmp dword [esp + 0x20], ebx
je 0x4378d3
push 3
push dword [0x4ea9b0]
push str.Do_you_want_to_remove_the_applications_registry_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x437449
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push str.Removing_registry:__s
push eax
call fcn.00461d60
add esp, 0xc
call fcn.00435c66
pop ecx
lea ecx, [esp + 0x2c]
call fcn.0042148a
push 0x4c2ec8
mov byte [esp + 0x70c4], 0x12
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
push 1
push ebx
lea eax, [esp + 0x38]
push eax
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4ea9e4
call fcn.0042342d
push ecx
mov byte [esp + 0x70dc], 0x13
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4ea9ec
call fcn.0042342d
push ecx
mov byte [esp + 0x70e0], 0x14
mov ecx, esp
mov dword [esp + 0x5c], esp
push esi
call fcn.0042342d
push ecx
mov byte [esp + 0x70e4], 0x15
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4ea9b0
call fcn.0042342d
mov byte [esp + 0x70e4], 0x12
call fcn.00432db5
add esp, 0x20
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push str.SoftwareVOS_s
push eax
call fcn.00461d60
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00463270
pop ecx
cmp eax, ebx
je 0x4379c2
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43761b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Registry_removed_successfully
call fcn.00423442
call fcn.00435c66
pop ecx
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str.Application__ss_registry_removed_successfully
jmp 0x43781a
lea ecx, [esp + 0x4c]
call fcn.0042148a
lea ecx, [esp + 0x1c]
call fcn.0042148a
mov byte [esp + 0x70c0], 0x1e
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x437a30
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x50]
call fcn.0042349b
jmp 0x437a3e
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x50]
call fcn.00423486
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x1f
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0x1e
call fcn.004620b0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x70c4], 0x20
call fcn.00423486
mov byte [esp + 0x70c0], 0x1e
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x1c]
jne 0x437adc
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042342d
jmp 0x4371c5
push ebx
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70d0], 0x21
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x1e
call fcn.00430a05
add esp, 0x10
mov dword [esp + 0x34], eax
cmp eax, ebx
jne 0x437b87
push dword [0x4e74b4]
lea eax, [esp + 0x20]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x40]
push eax
call fcn.00462270
add esp, 8
mov byte [esp + 0x70c8], 0x22
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
mov ecx, dword [esp + 0x4c]
jmp 0x43766e
push edi
call esi
mov edx, dword [esp + 0x34]
push dword [0x4e74b4]
cmp edx, 0x10
jne 0x437baa
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x4371c0
lea eax, [esp + 0x14]
push eax
call fcn.00468830
mov byte [esp + 0x70c8], 0x23
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x437336
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax + edx*4]
call fcn.00423442
lea eax, [esp + 0x38]
push eax
call fcn.00467600
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x90]
mov byte [esp + 0x70c4], 0x2b
call fcn.00423486
push eax
lea ecx, [esp + 0x80]
call fcn.00423486
push eax
lea ecx, [esp + 0x3c]
call fcn.0042342d
mov byte [esp + 0x70c0], 0x2d
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x40]
call fcn.00423631
push 0x4c7e24
push eax
call fcn.0042373b
pop ecx
pop ecx
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
lea ecx, [esp + 0x7c]
cmp byte [esp + 0x43], bl
je 0x437c6f
push 1
push 0x22
jmp 0x437c72
push ebx
push 0x20
call fcn.004257fd
mov edi, eax
cmp edi, 0xffffffff
je 0x437cef
push edi
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x84]
call fcn.00423631
push 0x4c7d50
mov byte [esp + 0x70c4], 0x2e
call fcn.004305f6
push eax
lea ecx, [esp + 0x80]
call fcn.00423486
mov byte [esp + 0x70c0], 0x2d
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
lea ecx, [esp + 0x90]
lea eax, [edi + 1]
push ecx
call fcn.004234d9
lea eax, [esp + 0x8c]
call fcn.00423588
push eax
lea ecx, [esp + 0x90]
call fcn.00423486
jmp 0x437d17
push 0x4c7d50
lea eax, [esp + 0x3c]
call fcn.004305f6
push eax
lea ecx, [esp + 0x80]
call fcn.00423486
push esi
lea ecx, [esp + 0x90]
call fcn.0042349b
xor ecx, ecx
lea eax, [esp + 0x7c]
call fcn.00427bb8
movzx eax, ax
cmp ax, 0x25
jne 0x437d36
lea eax, [esp + 0x7c]
push eax
call fcn.00471590
pop ecx
mov byte [esp + 0x70c0], 3
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x4370a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ShowStreaming:
call fcn.00423442
call fcn.00435c66
pop ecx
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0xb8]
push eax
call fcn.00426225
push ebx
push ecx
mov byte [esp + 0x70c8], 0x3e
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x3f
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x40
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042342d
push 2
push ecx
mov byte [esp + 0x70d8], 0x41
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0042342d
mov ecx, edi
lea edx, [esp + 0xc4]
mov byte [esp + 0x70d8], 0x3e
call fcn.0042c1aa
lea eax, [esp + 0xc4]
push eax
call fcn.0042bdbc
add esp, 0x1c
lea eax, [esp + 0xac]
call fcn.00478210
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x70c4], 3
call fcn.004262e4
jmp 0x43735a
lea ecx, [esp + 0x20]
call fcn.0042148a
mov byte [esp + 0x70c0], 0x42
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x437e69
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.0042349b
jmp 0x437e77
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.00423486
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x43
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x70cc], 0x42
call fcn.004620b0
add esp, 0xc
push 1
push ebx
push ecx
mov byte [esp + 0x70cc], 0x44
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0xb8]
push eax
call fcn.00426225
mov byte [esp + 0x70c0], 0x45
cmp dword [esp + 0x138], ebx
jne 0x437f07
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_containers_
jmp 0x4371c0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
call fcn.00463df0
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x437f48
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push str.Cant_empty__s
jmp 0x437335
mov esi, dword [esp + 0x14]
call fcn.004648b0
test eax, eax
jne 0x437f70
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push str.Cant_create__s
jmp 0x437335
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov esi, 0x4c2ec8
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x46
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4c5950
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x47
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x48
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 3
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x49
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll.dll
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x4a
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x4b
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 2
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x4c
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll64.dll
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x4d
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x4e
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 8
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x4f
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtFiles.db
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x50
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x51
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 4
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x52
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SandboxCfg.db
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x53
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x54
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 5
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x55
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtReg.export
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x56
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x57
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 6
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x58
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SysDllSubdirs.txt
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x59
mov ecx, esp
mov dword [esp + 0x58], esp
lea eax, [esp + 0x24]
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x5a
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 7
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x5b
mov ecx, esp
mov dword [esp + 0x48], esp
push str.Core.zip
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x5c
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x45
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c8], 0x5d
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423442
push 1
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x45
call fcn.004795c0
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push 0x4cb11c
push eax
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
jmp 0x4371ca
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Unbreak:
call fcn.00423442
call fcn.00435c66
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x5e
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x70cc], 3
call fcn.004620b0
add esp, 0xc
mov byte [esp + 0x70c0], 0x5f
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43844e
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push str.Dir_doesnt_exist:__s
jmp 0x437335
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x50]
call fcn.0042342d
mov esi, str..old
push esi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0x60
call fcn.00423691
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.00423691
add esp, 0xc
push dword [eax]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x58]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], bl
je 0x4384e2
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_rename_myself_to_.old
jmp 0x4371c0
push esi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00423691
mov eax, dword [eax]
add esp, 0xc
push ebx
push dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x34]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], bl
je 0x438536
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_myself
jmp 0x4371c0
push 1
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [esp + 0x38], ebx
push 0x4c2ec8
lea ebx, [esp + 0x3c]
lea esi, [esp + 0x48]
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x61
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4c5950
call fcn.00423442
push ecx
mov byte [esp + 0x70d4], 0x62
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d4], 0x60
call fcn.004618b0
add esp, 0xc
mov edi, esi
call fcn.00462890
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x438a73
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x438a73
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x2c]
push eax
call fcn.004625f0
pop ecx
mov byte [esp + 0x70c0], 0x63
push dword [esp + 0x38]
call fcn.0049e0f5
pop ecx
push 1
push 1
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0xb8]
push eax
call fcn.00426225
mov byte [esp + 0x70c0], 0x64
cmp dword [esp + 0x138], 0
jne 0x438628
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_begin_to_update_resource
jmp 0x4371c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, str.Main
push ebx
call fcn.00423442
mov byte [esp + 0x70c4], 0x65
mov eax, dword [esp + 0x30]
mov eax, dword [eax - 0xc]
add eax, eax
push 0
push eax
lea ecx, [esp + 0x38]
call fcn.00423b6b
push eax
lea esi, [esp + 0xbc]
mov byte [esp + 0x70d0], 0x64
call fcn.00478c50
test eax, eax
je 0x438687
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_update_INI_resource
jmp 0x4371c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423442
push 0
push 2
push ecx
mov byte [esp + 0x70d0], 0x66
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov esi, 0x4c2ec8
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d8], 0x67
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll.dll
call fcn.00423442
push ecx
mov byte [esp + 0x70dc], 0x68
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70dc], 0x66
call fcn.004618b0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x64
call fcn.00478ed0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423442
push 0
push 8
push ecx
mov byte [esp + 0x70d0], 0x69
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d8], 0x6a
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll64.dll
call fcn.00423442
push ecx
mov byte [esp + 0x70dc], 0x6b
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70dc], 0x69
call fcn.004618b0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x64
call fcn.00478ed0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423442
push 0x4000
push 4
push ecx
mov byte [esp + 0x70d0], 0x6c
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d8], 0x6d
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtFiles.db
call fcn.00423442
push ecx
mov byte [esp + 0x70dc], 0x6e
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70dc], 0x6c
call fcn.004618b0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x64
call fcn.00478ed0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423442
push 0x4000
push 5
push ecx
mov byte [esp + 0x70d0], 0x6f
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d8], 0x70
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SandboxCfg.db
call fcn.00423442
push ecx
mov byte [esp + 0x70dc], 0x71
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70dc], 0x6f
call fcn.004618b0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x64
call fcn.00478ed0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423442
push 0x4000
push 6
push ecx
mov byte [esp + 0x70d0], 0x72
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d8], 0x73
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtReg.export
call fcn.00423442
push ecx
mov byte [esp + 0x70dc], 0x74
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70dc], 0x72
call fcn.004618b0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x64
call fcn.00478ed0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423442
push 0
push 7
push ecx
mov byte [esp + 0x70d0], 0x75
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d8], 0x76
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SysDllSubdirs.txt
call fcn.00423442
push ecx
mov byte [esp + 0x70dc], 0x77
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70dc], 0x75
call fcn.004618b0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x64
call fcn.00478ed0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423442
mov byte [esp + 0x70c4], 0x78
push 0x4000
push 1
push ecx
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d8], 0x79
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Core.zip
call fcn.00423442
push ecx
mov byte [esp + 0x70dc], 0x7a
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70dc], 0x78
call fcn.004618b0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x64
call fcn.00478ed0
lea eax, [esp + 0xac]
call fcn.00478210
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
je 0x438a5b
push str.Could_not_commit_resource
jmp 0x4371c0
push str.Success
call fcn.00423442
call fcn.004365fb
pop ecx
pop ecx
push 0
jmp 0x4371cb
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_VirtApp.ini
jmp 0x4371c0
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x438abd
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
call fcn.0042fda1
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4ea9b0]
push str._s_is_no_longer_integrated.
jmp 0x4383b3
lea ecx, [esp + 0x50]
call fcn.0042148a
lea ecx, [esp + 0x2c]
call fcn.0042148a
mov byte [esp + 0x70c0], 0xa5
mov edi, dword [esp + 0x30]
or dword [esp + 0x28], 0xffffffff
lea eax, [edi + 1]
cmp dword [esp + 0x78], eax
jle 0x438b1c
mov eax, dword [esp + 0x44]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x54]
call fcn.0042349b
lea eax, [edi + 2]
cmp dword [esp + 0x78], eax
jle 0x438b35
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4]
lea ecx, [esp + 0x30]
call fcn.0042349b
lea ecx, [esp + 0x34]
call fcn.0042148a
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x70c4], 0xa6
call fcn.0042342d
push ecx
mov byte [esp + 0x70c4], 0xa7
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x438b8f
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
xor edi, edi
inc edi
push edi
push ebx
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x148]
push eax
call fcn.00426225
lea eax, [esp + 0x13c]
push eax
mov byte [esp + 0x70c4], 0xa8
call fcn.004273aa
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x30]
pop ecx
cmp dword [eax - 0xc], ebx
je 0x438bf0
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x28], eax
push edi
push edi
push edi
lea eax, [esp + 0x40]
push eax
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4ea9e4
call fcn.0042342d
push ecx
mov byte [esp + 0x70dc], 0xa9
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4ea9ec
call fcn.0042342d
push ecx
mov byte [esp + 0x70e0], 0xaa
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x4ea9e8
call fcn.0042342d
push ecx
mov byte [esp + 0x70e4], 0xab
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4ea9b0
call fcn.0042342d
mov byte [esp + 0x70e4], 0xa8
call fcn.00432db5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x24
call edi
push ebx
mov dword [esp + 0x24], eax
push ebx
lea eax, [esp + 0x144]
push eax
push dword [esp + 0x64]
mov ecx, 0x4ea9a8
call fcn.0042a99d
add esp, 0x10
cmp eax, ebx
je 0x438cac
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Failed_BasicDeploy_
jmp 0x4371c0
call edi
sub eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
call edi
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x50]
cmp dword [eax - 0xc], ebx
je 0x438d63
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0xac
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4cb790
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0xad
mov ecx, esp
mov dword [esp + 0x4c], esp
push esi
call fcn.00423442
push ebx
push ecx
mov byte [esp + 0x70d8], 0xae
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0042342d
or ecx, 0xffffffff
lea edx, [esp + 0x154]
mov byte [esp + 0x70d8], 0xa8
call fcn.0042c1aa
add esp, 0x18
push ebx
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042342d
call fcn.004681b0
pop ecx
pop ecx
cmp eax, ebx
jne 0x438d63
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x438d39
call edi
push ecx
mov esi, eax
sub esi, dword [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ea9e4
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0xaf
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4ea9ec
call fcn.0042342d
push ecx
mov byte [esp + 0x70cc], 0xb0
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4ea9e8
call fcn.0042342d
push ecx
mov byte [esp + 0x70d0], 0xb1
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x4ea9b0
call fcn.0042342d
mov byte [esp + 0x70d0], 0xa8
call fcn.00432986
add esp, 0x10
lea ecx, [esp + 0x1c]
call fcn.0042148a
lea ecx, [esp + 0x5c]
mov eax, 0x100
push ecx
mov byte [esp + 0x70c4], 0xb2
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x64], eax
call fcn.004214d0
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00423750
push esi
push dword [esp + 0x24]
lea eax, [esp + 0x5c]
push dword [esp + 0x24]
push dword [0x4ea9b0]
push str._s__s__d_d_r_n
push eax
call fcn.00461d60
add esp, 0x18
mov byte [esp + 0x70c0], 0xb3
push dword [esp + 0x54]
lea ecx, [esp + 0x50]
call fcn.00424913
mov byte [esp + 0x70c0], 0xb4
mov esi, dword [esp + 0x28]
cmp esi, 0xffffffff
je 0x438e85
push 2
push ebx
push ebx
push esi
mov dword [esp + 0x68], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax - 0xc]
push ebx
lea edx, [esp + 0x5c]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x4e74b4]
lea eax, [esp + 0x58]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042342d
jmp 0x4383bc
lea ecx, [esp + 0x20]
call fcn.0042148a
mov byte [esp + 0x70c0], 0xb5
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x438ed2
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.0042349b
jmp 0x438ee0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.00423486
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Packager.log
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0xb6
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70cc], 0xb5
call fcn.004620b0
add esp, 0xc
mov byte [esp + 0x70c0], 0xb7
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push ebx
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
xor edi, edi
call fcn.0042342d
lea eax, [esp + 0x1d8]
push eax
call fcn.00426225
lea eax, [esp + 0x1cc]
push eax
mov byte [esp + 0x70c4], 0xb8
call fcn.004273aa
mov esi, eax
pop ecx
cmp esi, ebx
je 0x438fef
push 0x2024
lea eax, [esp + 0x654]
push ebx
push eax
mov dword [esp + 0x658], ebx
call fcn.0049e2e0
add esp, 0xc
lea eax, [esp + 0x64c]
push eax
lea eax, [esp + 0x30]
push eax
mov ecx, str.Packager.log
mov eax, esi
mov dword [esp + 0x34], ebx
call fcn.00477640
pop ecx
pop ecx
test eax, eax
jne 0x438fe6
lea eax, [esp + 0x34]
push eax
call fcn.00460e90
pop ecx
push dword [eax]
mov eax, esi
call fcn.00477700
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov eax, esi
call fcn.00477680
pop ecx
test eax, eax
jne 0x438fe6
inc edi
mov ebx, esi
call fcn.00477740
xor ebx, ebx
lea eax, [esp + 0x1cc]
call fcn.00478210
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
cmp edi, ebx
je 0x43901a
push str.Success:__s
jmp 0x4383b3
push str.Failed_saving__s
jmp 0x4383b3
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
mov esi, 0x4ea9a8
push esi
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x439058
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x148]
push eax
call fcn.00426225
lea eax, [esp + 0x13c]
push eax
mov byte [esp + 0x70c4], 0xb9
call fcn.004273aa
pop ecx
push 1
push ebx
lea ecx, [esp + 0x144]
push ecx
push eax
mov ecx, esi
call fcn.0042a99d
mov esi, eax
add esp, 0x10
lea eax, [esp + 0x13c]
call fcn.00478210
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
cmp esi, ebx
jne 0x4390d4
push dword [0x4ea9e8]
push 0x4cb848
jmp 0x4383b3
push str.Failed_extracting.
push eax
call fcn.00461d60
pop ecx
pop ecx
jmp 0x4383bc
lea ecx, [esp + 0x14]
call fcn.0042148a
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x70c4], 0xba
call fcn.0042342d
mov byte [esp + 0x70c0], 0xbb
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x43912b
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x3c]
call fcn.0042349b
push 1
push ebx
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0xb8]
push eax
call fcn.00426225
mov byte [esp + 0x70c0], 0xbc
cmp dword [esp + 0x138], ebx
jne 0x439171
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x18]
call fcn.0042609b
pop ecx
jmp 0x439222
lea eax, [esp + 0x60]
lea ecx, [esp + 0x120]
call fcn.0043bcf0
jmp 0x4391fc
lea esi, [esp + 0x60]
call fcn.0043bda9
mov edi, eax
add edi, 0x18
call fcn.0043bda9
mov ebx, eax
call fcn.0043bda9
push dword [eax + 0xc]
push dword [eax + 8]
movzx eax, word [edi + 0xc]
push dword [ebx + 4]
push dword [ebx]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 8]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
movzx eax, word [edi + 6]
push eax
call fcn.0043bda9
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043bda9
push dword [eax + 0x2c]
call fcn.0043bda9
mov eax, dword [eax + 0x28]
call fcn.0042787e
push eax
push str._s__s:_Size_lld__Time_.2d__.2d__.4d__.2d:_.2d:_.2d__Offset_lld__Allocated_lld_n
lea ebx, [esp + 0x50]
call fcn.0042609b
add esp, 0x3c
call fcn.0043bdd1
lea eax, [esp + 0x84]
lea ecx, [esp + 0x120]
call fcn.0043bd05
mov edi, eax
lea esi, [esp + 0x60]
call fcn.0043bdfc
test al, al
jne 0x439183
push str.______________________________n
lea ebx, [esp + 0x18]
call fcn.0042609b
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
test al, al
jne 0x439261
push str.Cannot_obtain_INI_info_from_resource__n
mov ecx, ebx
call fcn.00427b99
jmp 0x439539
lea ecx, [esp + 0x30]
call fcn.0042148a
mov byte [esp + 0x70c0], 0xbd
call fcn.0046ba00
push dword [0x4ea9b0]
lea ebx, [esp + 0x18]
push str.AppID___ws_n
call fcn.0042609b
push dword [0x4ea9bc]
push str.Publisher___ws_n
call fcn.0042609b
push dword [0x4ea9c0]
push str.Version___ws_n
call fcn.0042609b
push dword [0x4ea9b8]
push str.FriendlyName___ws_n
call fcn.0042609b
push dword [0x4ea9b4]
push str.AutoLaunch___ws_n
call fcn.0042609b
push dword [0x4ea9e8]
push str.BaseDirName___ws_n
call fcn.0042609b
push dword [0x4ea9ec]
push str.CarrierExeName___ws_n
call fcn.0042609b
push dword [0x4ea9c4]
push str.OnStartVirtualizedCmds___ws_n
call fcn.0042609b
add esp, 0x40
push dword [0x4ea9c8]
push str.OnStartUnvirtualizedCmds___ws_n
call fcn.0042609b
push dword [0x4ea9cc]
push str.OnStopVirtualizedCmds___ws_n
call fcn.0042609b
push dword [0x4ea9d0]
push str.OnStopUnvirtualizedCmds___ws_n
call fcn.0042609b
push dword [0x4ea9d4]
push str.StopInheritance___ws_n
call fcn.0042609b
add esp, 0x1c
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push str._s.AppVirtDll.dll
push eax
call fcn.00461d60
lea eax, [esp + 0x44]
add esp, 0xc
push eax
call fcn.00461460
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x70c4], 0xbe
call fcn.00423486
mov byte [esp + 0x70c0], 0xbd
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0xbf
mov ecx, esp
mov dword [esp + 0x20], esp
mov esi, str.Main
push esi
call fcn.00423442
push 2
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0xbd
call fcn.004795c0
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x38]
push eax
call fcn.00484590
mov byte [esp + 0x70c8], 0xc0
push dword [eax]
push str.EngineVersion_ws_n
call fcn.0042609b
mov byte [esp + 0x70d0], 0xbd
mov ecx, dword [esp + 0x44]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
call fcn.00465470
pop ecx
lea ecx, [esp + 0x50]
call fcn.0042148a
push ecx
mov byte [esp + 0x70c4], 0xc1
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9b0]
push str._s.SandboxCfg.db
push eax
call fcn.00461d60
lea eax, [esp + 0x44]
add esp, 0xc
push eax
call fcn.00461460
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x70c4], 0xc2
call fcn.00423486
mov byte [esp + 0x70c0], 0xc1
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0xc3
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423442
push 5
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0xc1
call fcn.004795c0
and dword [esp + 0x60], 0
xor eax, eax
lea edi, [esp + 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [esp + 0x30]
lea ebx, [esp + 0x60]
stosd dword es:[edi], eax
call fcn.0047eb70
lea eax, [esp + 0x50]
push eax
push 0x46e590
push 0
push dword [esp + 0x74]
mov eax, ebx
push eax
call fcn.0047f960
push dword [esp + 0x50]
lea ebx, [esp + 0x18]
push str.Sandbox:__ws_n
call fcn.0042609b
pop ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
call fcn.00465470
pop ecx
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
xor esi, esi
push esi
push str.Info
push dword [esp + 0x1c]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
jmp 0x4371cb
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437efd
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.0042342d
push 0x2e
lea ecx, [esp + 0x20]
mov byte [esp + 0x70c4], 0xc8
call fcn.004305d1
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x24]
call fcn.00423631
push str..new.exe
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x70cc], 0xc9
call fcn.00423691
add esp, 0xc
mov byte [esp + 0x70c0], 0xcb
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x5c]
call fcn.00423442
push ebx
mov byte [esp + 0x70c4], 0xcc
push dword [esp + 0x2c]
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439612
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x30]
push dword [esp + 0x28]
push str.Cant_copy__s_to__s
jmp 0x437703
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0xcd
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0xcc
call fcn.00430880
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0042101a
push 1
push ebx
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0xb8]
push eax
call fcn.00426225
push 1
push 1
push ecx
mov byte [esp + 0x70cc], 0xce
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1d8]
push eax
call fcn.00426225
lea eax, [esp + 0x60]
lea ecx, [esp + 0x120]
mov byte [esp + 0x70c0], 0xcf
call fcn.0043bcf0
jmp 0x4397c9
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CEChangeEngine.tmp
call fcn.00423442
lea eax, [esp + 0x24]
push eax
call fcn.00461460
add esp, 4
mov byte [esp + 0x70c4], 0xd0
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
lea esi, [esp + 0x64]
mov byte [esp + 0x70c4], 0xd1
call fcn.0043bda9
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
call fcn.0043bda9
push dword [eax + 0x28]
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0xd0
call fcn.004795c0
cmp eax, ebx
jne 0x439822
call fcn.0043bda9
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4000
mov byte [esp + 0x70c8], 0xd2
call fcn.0043bda9
push dword [eax + 0x28]
lea eax, [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1dc]
push eax
mov byte [esp + 0x70d4], 0xd0
call fcn.00478ed0
cmp eax, ebx
jne 0x43984e
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
call fcn.00465470
pop ecx
mov byte [esp + 0x70c0], 0xcf
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.0043bdd1
lea eax, [esp + 0x84]
lea ecx, [esp + 0x120]
call fcn.0043bd05
mov edi, eax
lea esi, [esp + 0x60]
call fcn.0043bdfc
test al, al
jne 0x4396c5
lea eax, [esp + 0xac]
call fcn.00478210
lea eax, [esp + 0x1cc]
call fcn.00478210
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x30]
push str.Successfully_changed_Loader:__s
jmp 0x4383b3
push dword [0x4e74b4]
call fcn.0043bda9
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x6c]
call fcn.0043bda9
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x437704
push dword [0x4e74b4]
lea esi, [esp + 0x64]
call fcn.0043bda9
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
jmp 0x43983b
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.0042342d
push 0x2e
lea ecx, [esp + 0x24]
mov byte [esp + 0x70c4], 0xd3
call fcn.004305d1
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x28]
call fcn.00423631
push str..new.exe
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70cc], 0xd4
call fcn.00423691
add esp, 0xc
mov byte [esp + 0x70c0], 0xd6
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x2c]
call fcn.00423442
push ebx
mov byte [esp + 0x70c4], 0xd7
push dword [esp + 0x20]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439912
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
push dword [esp + 0x2c]
jmp 0x439608
push 1
push 1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0xb8]
push eax
call fcn.00426225
mov byte [esp + 0x70c0], 0xd8
cmp dword [esp + 0x138], ebx
jne 0x43995c
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_open_PeContainer
jmp 0x4371c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.00423442
push ebx
push 2
push ecx
mov byte [esp + 0x70d0], 0xd9
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0042342d
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0xd8
call fcn.00478ed0
cmp eax, ebx
je 0x4399ba
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x4371c0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423442
push ebx
push 8
push ecx
mov byte [esp + 0x70d0], 0xda
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0042342d
push edi
call fcn.0046e6b0
pop ecx
pop ecx
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0xd8
call fcn.00478ed0
cmp eax, ebx
je 0x439a22
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x4371c0
lea ecx, [esp + 0x2c]
call fcn.0042148a
lea ecx, [esp + 0x38]
call fcn.0042148a
push ecx
mov byte [esp + 0x70c4], 0xdc
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
lea ebx, [esp + 0x34]
call fcn.00423442
push 3
lea edi, [esp + 0xb4]
call fcn.004794a0
test eax, eax
je 0x439a76
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x4371c0
lea eax, [esp + 0x38]
push eax
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0042342d
push edi
call fcn.00484590
add esp, 4
mov byte [esp + 0x70cc], 0xdd
mov ecx, esp
mov dword [esp + 0x24], esp
push str.EngineVersion
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0xde
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0xdc
call fcn.004664d0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423442
push 0x4000
push 3
push ecx
mov byte [esp + 0x70d0], 0xdf
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0042342d
lea esi, [esp + 0xbc]
mov byte [esp + 0x70d0], 0xdc
call fcn.00478d40
test eax, eax
je 0x439b38
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x4371c0
lea eax, [esp + 0xac]
call fcn.00478210
push dword [0x4e74b4]
lea eax, [esp + 0x2c]
push ecx
mov dword [esp + 0x18], esp
mov esi, esp
push dword [esp + 0x24]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x44]
push eax
call fcn.00484590
pop ecx
pop ecx
mov byte [esp + 0x70cc], 0xe0
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00461d60
add esp, 0x10
call fcn.004365fb
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x438a6c
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.0042342d
push 0x2e
lea ecx, [esp + 0x24]
mov byte [esp + 0x70c4], 0xe1
call fcn.004305d1
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x28]
call fcn.00423631
push str..new.exe
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70cc], 0xe2
call fcn.00423691
add esp, 0xc
mov byte [esp + 0x70c0], 0xe4
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x5c]
call fcn.00423442
push ebx
mov byte [esp + 0x70c4], 0xe5
push dword [esp + 0x20]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439c4b
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
push dword [esp + 0x2c]
jmp 0x439608
push 1
push 1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x148]
push eax
call fcn.00426225
mov byte [esp + 0x70c0], 0xe6
cmp dword [esp + 0x1c8], ebx
jne 0x439c90
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x439952
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Main
call fcn.00423442
push ebx
push 3
push ecx
mov byte [esp + 0x70d0], 0xe7
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x14c]
push eax
mov byte [esp + 0x70d4], 0xe6
call fcn.00478ed0
cmp eax, ebx
je 0x439ced
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEINI
jmp 0x4371c0
lea eax, [esp + 0x13c]
call fcn.00478210
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
push str.Successfully_changed_INI._nNew_package_saved_in:_n_s
jmp 0x4383b3
lea eax, [esp + 0x49c]
push eax
call fcn.0042a0f4
lea ecx, [esp + 0x2c]
call fcn.0042148a
lea eax, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x70c8], 0xe9
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0xea
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Description
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0xeb
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppID
call fcn.00423442
lea ecx, [esp + 0x4ac]
mov byte [esp + 0x70d0], 0xe9
call fcn.004296c2
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x49c]
push eax
mov byte [esp + 0x70c4], 3
call fcn.0042a21d
jmp 0x43735a
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x148]
push eax
call fcn.00426225
push ebx
push ecx
mov byte [esp + 0x70c8], 0xec
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0xed
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0xee
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042342d
push 2
push ecx
mov byte [esp + 0x70d8], 0xef
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0042342d
mov ecx, edi
lea edx, [esp + 0x154]
mov byte [esp + 0x70d8], 0xec
call fcn.0042c1aa
lea eax, [esp + 0x154]
push eax
call fcn.0042bdf0
add esp, 0x1c
lea eax, [esp + 0x13c]
call fcn.00478210
lea eax, [esp + 0x13c]
jmp 0x437e25
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.DbgZip
call fcn.00423442
call fcn.00435c66
mov dword [esp], str._DbgZip:
call fcn.0049db0a
mov edx, dword [esp + 0x34]
pop ecx
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x84]
call fcn.0042349b
jmp 0x4370a0
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x268]
push eax
call fcn.00426225
push ebx
push ecx
mov byte [esp + 0x70c8], 0xf0
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0xf1
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0xf2
mov ecx, esp
mov dword [esp + 0x4c], esp
push esi
call fcn.00423442
push 2
push ecx
mov byte [esp + 0x70d8], 0xf3
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0042342d
mov ecx, edi
lea edx, [esp + 0x274]
mov byte [esp + 0x70d8], 0xf0
call fcn.0042c1aa
lea eax, [esp + 0x274]
push eax
push dword [esp + 0x68]
push 0x4ea9a8
call fcn.0042fcaf
add esp, 0x24
lea eax, [esp + 0x25c]
jmp 0x437e25
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x418]
push eax
call fcn.00426225
push ebx
push ecx
mov byte [esp + 0x70c8], 0xfa
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0xfb
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0xfc
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042342d
push 2
push ecx
mov byte [esp + 0x70d8], 0xfd
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0042342d
mov ecx, edi
lea edx, [esp + 0x424]
mov byte [esp + 0x70d8], 0xfa
call fcn.0042c1aa
add esp, 0x18
lea esi, [esp + 0x60]
call fcn.0047c060
mov byte [esp + 0x70c0], 0xfe
mov dword [esp + 0x2c], ebx
jmp 0x43a0ae
push dword [0x4ea9b0]
lea eax, [esp + 0x6eb0]
push eax
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x43a0ae
xor edi, edi
cmp dword [esp + 0x2ea8], edi
jbe 0x43a0ae
lea esi, [esp + edi*8 + 0x2eac]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x43a0a4
test byte [esp + edi*8 + 0x2eb0], 3
je 0x43a0a4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ea9e8
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0xff
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4ea9b0
call fcn.0042342d
mov ebx, dword [esi]
mov byte [esp + 0x70c8], 0xfe
call fcn.00432848
pop ecx
pop ecx
inc edi
cmp edi, dword [esp + 0x2ea8]
jb 0x43a04e
lea eax, [esp + 0x2674]
push eax
lea esi, [esp + 0x30]
lea ebx, [esp + 0x64]
call fcn.0047bb20
test eax, eax
jne 0x43a02a
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [esp + 0x60]
call fcn.0047c080
lea eax, [esp + 0x40c]
jmp 0x437e25
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x2f8]
push eax
call fcn.00426225
mov dword [esp + 0x70c0], 0x100
push dword [esp + 0x54]
or edi, 0xffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 1
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Vintegrate_
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 2
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042342d
push ebx
push ecx
mov byte [esp + 0x70d8], 3
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0042342d
mov ecx, edi
lea edx, [esp + 0x304]
mov byte [esp + 0x70d8], bl
call fcn.0042c1aa
add esp, 0x18
call fcn.0043655a
jmp 0x4371ca
lea esi, [esp + 0x60]
call fcn.0047c060
mov dword [esp + 0x70c0], 0x104
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], ebx
call fcn.0042148a
mov byte [esp + 0x70c0], 5
jmp 0x43a446
lea eax, [esp + 0x6eac]
push eax
lea eax, [esp + 0x38]
push str._AppID_ws_n
push eax
call fcn.00461d60
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 6
call fcn.004234b0
mov byte [esp + 0x70c0], 5
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x2678]
lea eax, [esp + 0x5c]
push str.____SerialId:__d_n
push eax
call fcn.00461d60
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 7
call fcn.004234b0
mov byte [esp + 0x70c0], 5
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x2ea0]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x60]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00461d60
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 8
call fcn.004234b0
mov byte [esp + 0x70c0], 5
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2ea4]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x30]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00461d60
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 9
call fcn.004234b0
mov byte [esp + 0x70c0], 5
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x50]
push str.____Processes:_n
push eax
call fcn.00461d60
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0xa
call fcn.004234b0
mov byte [esp + 0x70c0], 5
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
xor ebx, ebx
cmp dword [esp + 0x2ea8], ebx
jbe 0x43a446
push 0x4c4fbc
lea ecx, [esp + 0x24]
call fcn.00423442
mov byte [esp + 0x70c0], 0xb
lea edi, [esp + ebx*8 + 0x2eac]
push dword [edi]
lea esi, [esp + 0x24]
call fcn.00460100
pop ecx
test eax, eax
jne 0x43a362
push 0x4c6250
mov ecx, esi
call fcn.0042349b
push 0x5c
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x30]
push eax
call fcn.00462270
add esp, 0xc
mov byte [esp + 0x70c0], 0xc
push dword [eax]
lea eax, [esp + 0x20]
push dword [edi]
push str._______wd:__ws
push eax
call fcn.00461d60
add esp, 0x10
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0xd
call fcn.004234b0
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x70c0], 0xb
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + ebx*8 + 0x2eb0]
test eax, eax
je 0x43a416
push eax
lea eax, [esp + 0x58]
push str._0x_x_
push eax
call fcn.00461d60
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0xe
call fcn.004234b0
mov byte [esp + 0x70c0], 0xb
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4c33ec
lea ecx, [esp + 0x18]
call fcn.00427ad1
mov byte [esp + 0x70c0], 5
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
inc ebx
cmp ebx, dword [esp + 0x2ea8]
jb 0x43a329
lea eax, [esp + 0x2674]
push eax
lea esi, [esp + 0x3c]
lea ebx, [esp + 0x64]
call fcn.0047bb20
test eax, eax
jne 0x43a1cf
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
cmp dword [esp + 0x40], eax
jne 0x43a48e
push str.No_active_virtual_apps
call fcn.00423442
call fcn.004365fb
pop ecx
pop ecx
push 1
jmp 0x4371cb
lea eax, [esp + 0x1c]
push eax
call fcn.0042342d
jmp 0x438a65
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x54]
mov eax, dword [eax + 0x44]
call fcn.00429d6e
lea eax, [esp + 0x34]
push eax
call fcn.00429eab
jmp 0x4371ca
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AutoUpdate
call fcn.00423442
call fcn.00435c66
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x43a505
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4ea9d8]
push str.SourceAddr_s
push eax
call fcn.00461d60
add esp, 0xc
call fcn.00435c66
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ea9ec
call fcn.0042342d
push ecx
mov dword [esp + 0x70c8], 0x111
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4ea9e8
call fcn.0042342d
push ecx
mov byte [esp + 0x70cc], 0x12
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4ea9d8
call fcn.0042342d
mov dword [esp + 0x70cc], 3
call fcn.0048cd60
add esp, 0xc
jmp 0x43735a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.VirtRegSyncExport
call fcn.00423442
call fcn.00435c66
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
mov esi, 0x4ea9a8
push esi
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x43a5cb
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
mov ecx, esi
call fcn.00433b7e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00461d60
add esp, 0xc
jmp 0x437354
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartStreaming:AppIDSkype
call fcn.00423442
call fcn.00425f50
pop ecx
jmp 0x437359
lea ecx, [esp + 0x2c]
call fcn.0042148a
lea ecx, [esp + 0x20]
mov dword [esp + 0x70c0], 0x113
call fcn.0042148a
mov byte [esp + 0x70c0], 0x14
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x30]
push 0x4cc55c
lea esi, [eax + edi*4 + 4]
call fcn.0049da60
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x30]
call fcn.0042349b
inc edi
cmp dword [esp + 0x78], edi
jle 0x43a66a
push dword [esi]
lea ecx, [esp + 0x24]
call fcn.0042349b
jmp 0x43a6cf
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Streamed
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x15
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0x14
call fcn.004620b0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x70c4], 0x16
call fcn.00423486
mov byte [esp + 0x70c0], 0x14
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0x17
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70c8], 0x14
call fcn.0043010c
pop ecx
pop ecx
push dword [0x4e74b4]
push ecx
mov dword [esp + 0x18], esp
cmp eax, ebx
jne 0x43a740
mov esi, dword [esp + 0x28]
mov eax, esp
push esi
push str.Success:_n_s
push eax
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042101a
jmp 0x43782a
mov ecx, esp
push str.Failed
jmp 0x4371c0
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x43a77f
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
call fcn.00423442
push ebx
push ecx
mov dword [esp + 0x70cc], 0x118
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x4ea9e8]
xor edi, edi
push str._select___s_
push eax
call fcn.00461d60
add esp, 8
mov byte [esp + 0x70d0], 0x19
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.explorer.exe
call fcn.00423442
mov dword [esp + 0x70d0], 3
call fcn.00460320
add esp, 0x10
xor ebx, ebx
jmp 0x43735a
push str.Vintegrate:
lea ecx, [esp + 0x24]
call fcn.00423442
mov byte [esp + 0x70c0], 0xf4
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push str._VintegrateRecursive
push dword [edi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
je 0x43a83d
push 0x4cc218
call fcn.0049da60
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
jne 0x43a84b
push str.VintegrateRecursive:
lea ecx, [esp + 0x24]
call fcn.0042349b
push str._Windows_Explorer.exe
lea ecx, [esp + 0x54]
call fcn.00423442
mov byte [esp + 0x70c0], 0xf5
mov edi, dword [edi]
push 0x3a
push edi
call fcn.0049e35a
pop ecx
pop ecx
cmp eax, ebx
je 0x43a87e
add eax, 2
push eax
lea ecx, [esp + 0x54]
call fcn.0042349b
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x2f8]
push eax
call fcn.00426225
mov byte [esp + 0x70c0], 0xf6
push dword [esp + 0x54]
or edi, 0xffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.00423442
push ecx
mov eax, esp
mov byte [esp + 0x70cc], 0xf7
mov dword [esp + 0x24], esp
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.0042985e
add esp, 8
mov byte [esp + 0x70d0], 0xf8
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0042342d
push ebx
push ecx
mov byte [esp + 0x70d8], 0xf9
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0042342d
mov ecx, edi
lea edx, [esp + 0x304]
mov byte [esp + 0x70d8], 0xf6
call fcn.0042c1aa
add esp, 0x18
lea eax, [esp + 0x2ec]
push eax
mov byte [esp + 0x70c4], 0xf5
call fcn.004262e4
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x20]
jmp 0x43766e
lea eax, [esp + 0x20]
push eax
call fcn.00460e90
mov byte [esp + 0x70c4], 0x8b
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
lea edi, [eax + ecx*4]
mov dword [esp], 0x4cb6c8
call fcn.0049da60
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
test eax, eax
jne 0x43a9b4
push dword [edi]
lea ecx, [esp + 0x24]
call fcn.0042349b
push 0x4cb6c8
call fcn.0049da60
pop ecx
push ebx
lea ecx, [esp + 0x24]
push ecx
call fcn.004234d9
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x43a9e7
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x437200
push 0x4ea9b4
lea ecx, [esp + 0x5c]
call fcn.0042342d
lea eax, [esp + 0x38]
push eax
push 0x4c6580
lea eax, [esp + 0x1c]
mov byte [esp + 0x70c8], 0x8c
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x44], ebx
call fcn.00427ae6
jmp 0x43af56
lea ecx, [esp + 0x28]
call fcn.0042148a
lea ecx, [esp + 0x4c]
call fcn.0042148a
lea ecx, [esp + 0x44]
call fcn.0042148a
lea ecx, [esp + 0x54]
call fcn.0042148a
push 0x3e
push ecx
mov byte [esp + 0x70c8], 0x91
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
mov dword [esp + 0x3c], ebx
lea edi, [esp + 0x3c]
call fcn.0042342d
lea eax, [esp + 0x3c]
push eax
mov ecx, edi
call fcn.00465a70
add esp, 0xc
mov byte [esp + 0x70c0], 0x92
call fcn.00423588
push eax
lea ecx, [esp + 0x2c]
call fcn.00423486
mov byte [esp + 0x70c0], 0x91
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
jne 0x43aaf2
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x70c0], 0x8c
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43af3e
push 0x3e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
lea edi, [esp + 0x3c]
call fcn.0042342d
lea eax, [esp + 0xa8]
push eax
mov ecx, edi
call fcn.00465a70
add esp, 0xc
mov byte [esp + 0x70c0], 0x93
call fcn.00423588
push eax
lea ecx, [esp + 0x50]
call fcn.00423486
mov byte [esp + 0x70c0], 0x91
mov ecx, dword [esp + 0xa0]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
je 0x43aaa9
push 0x3e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x50]
push eax
mov ecx, edi
call fcn.00465a70
add esp, 0xc
mov byte [esp + 0x70c0], 0x94
call fcn.00423588
push eax
lea ecx, [esp + 0x48]
call fcn.00423486
mov byte [esp + 0x70c0], 0x91
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
jne 0x43abba
push esi
lea ecx, [esp + 0x48]
call fcn.0042349b
jmp 0x43ac15
push 0x3e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
lea edi, [esp + 0x3c]
call fcn.0042342d
lea eax, [esp + 0x44]
push eax
mov ecx, edi
call fcn.00465a70
add esp, 0xc
mov byte [esp + 0x70c0], 0x95
call fcn.00423588
push eax
lea ecx, [esp + 0x58]
call fcn.00423486
mov byte [esp + 0x70c0], 0x91
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
jne 0x43ac1f
push esi
lea ecx, [esp + 0x58]
call fcn.0042349b
push dword [esp + 0x28]
lea eax, [esp + 0x54]
push str._exec___s_
push eax
call fcn.00461d60
add esp, 0xc
mov byte [esp + 0x70c0], 0x96
mov eax, dword [esp + 0x4c]
cmp dword [eax - 0xc], ebx
je 0x43ac62
push 0x4c6a08
lea ecx, [esp + 0x54]
call fcn.00427ad1
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x54]
call fcn.004234b0
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.0042342d
push ecx
mov esi, esp
mov byte [esp + 0x70c8], 0x97
mov dword [esp + 0x38], esp
push 0x5c
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.0042342d
push esi
call fcn.00462270
lea eax, [esp + 0x70]
add esp, 0xc
push eax
mov byte [esp + 0x70cc], 0x96
call fcn.004279bf
add esp, 8
mov byte [esp + 0x70c4], 0x98
mov ecx, esp
mov dword [esp + 0x94], esp
mov esi, 0x4c2ec8
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x99
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70cc], 0x9a
mov ecx, esp
mov dword [esp + 0xa8], esp
push 0x4ea9e8
call fcn.0042342d
lea edi, [esp + 0x38]
mov byte [esp + 0x70cc], 0x98
call fcn.004618b0
add esp, 8
mov byte [esp + 0x70c4], 0x9b
mov ecx, esp
mov dword [esp + 0xa0], esp
push esi
call fcn.00423442
push ecx
mov eax, esp
mov byte [esp + 0x70c8], 0x9c
mov dword [esp + 0x98], esp
push str..lnk
lea ecx, [esp + 0x50]
push ecx
push eax
call fcn.00423691
add esp, 8
mov byte [esp + 0x70cc], 0x9d
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.0042342d
lea edi, [esp + 0x24]
mov byte [esp + 0x70cc], 0x9b
call fcn.004618b0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0xa0], esp
push eax
call fcn.0042342d
call fcn.004647d0
pop ecx
cmp eax, ebx
je 0x43adbb
lea eax, [esp + 0x2c]
jmp 0x43add2
push ebx
lea ecx, [esp + 0x14]
call fcn.00423442
mov byte [esp + 0x70c0], 0x9e
or dword [esp + 0x1c], 2
mov eax, dword [eax]
push ebx
push ecx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0xa4], esp
push eax
call fcn.0042342d
push ecx
mov dword [esp + 0x70cc], 0x9f
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70d0], 0xa0
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0xa8], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70d4], 0xa1
mov dword [esp + 0xa8], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0xac], esp
push esi
call fcn.00423442
push ecx
mov eax, esp
mov byte [esp + 0x70dc], 0xa2
mov dword [esp + 0xa0], esp
push str..lnk
lea ecx, [esp + 0x64]
push ecx
push eax
call fcn.00423691
add esp, 8
mov byte [esp + 0x70e0], 0xa3
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x80], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70e0], 0xa1
call fcn.004618b0
mov esi, dword [esp + 0x50]
add esp, 0xc
mov byte [esp + 0x70d4], 0x9e
call fcn.00489b40
add esp, 0x14
mov dword [esp + 0x70c0], 0x9b
test byte [esp + 0x1c], 2
je 0x43aed1
mov ecx, dword [esp + 0x10]
and dword [esp + 0x1c], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x70c0], 0x8c
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, 0x4c4fbc
lea eax, [esp + 0x38]
push eax
push 0x4c6580
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x64]
call fcn.00427ae6
cmp dword [esp + 0x38], 0xffffffff
jne 0x43aa1e
mov byte [esp + 0x70c0], 0x8c
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [0x4ea9b0]
push str.Shortcuts_created_for__s.
jmp 0x4383b3
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.0042342d
mov byte [esp + 0x70c0], 0x7b
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push str._FullIntegrate
push dword [edi]
mov dword [esp + 0x58], edi
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x43b174
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
push 0x4ea9a8
call fcn.0042733c
pop ecx
pop ecx
cmp al, bl
jne 0x43b000
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437200
push 0x4ea9e8
lea ecx, [esp + 0x30]
call fcn.0042342d
mov byte [esp + 0x70c0], 0x7c
cmp dword [esp + 0x4c], ebx
je 0x43b05f
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push 0x4ea9b0
call fcn.0042342d
lea eax, [esp + 0x14]
push eax
call fcn.00433e76
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x70c4], 0x7d
call fcn.00423486
mov byte [esp + 0x70c0], 0x7c
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push 0x4c2ec8
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x7e
mov eax, esp
mov dword [esp + 0x8c], esp
push dword [0x4ea9b0]
push str._s.host.exe
push eax
call fcn.00461d60
add esp, 8
mov byte [esp + 0x70cc], 0x7f
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0xa0], esp
push eax
call fcn.0042342d
lea edi, [esp + 0x1c]
mov byte [esp + 0x70cc], 0x7c
call fcn.004618b0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70c4], 0x80
call fcn.00423486
mov byte [esp + 0x70c0], 0x7c
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0x2c]
call fcn.004648b0
test eax, eax
jne 0x43b10f
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.Could_not_create_virtual_repository
jmp 0x4371c0
lea eax, [esp + 0x10]
push eax
call fcn.00460c70
mov eax, dword [eax]
pop ecx
push ebx
push dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x10]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], bl
je 0x43b15b
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.Could_not_copy_executable_to_repository
jmp 0x4371c0
lea ecx, [esi - 0x10]
mov byte [esp + 0x70c0], 0x7b
call fcn.0042101a
mov edi, dword [esp + 0x50]
mov esi, 0x4c4fbc
push 1
push ebx
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x268]
push eax
call fcn.00426225
push ebx
push ecx
mov byte [esp + 0x70c8], 0x81
mov ecx, esp
mov dword [esp + 0x68], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x82
mov ecx, esp
mov dword [esp + 0x90], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x83
mov ecx, esp
mov dword [esp + 0xa4], esp
push esi
call fcn.00423442
push 2
push ecx
mov byte [esp + 0x70d8], 0x84
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
call fcn.0042342d
or ecx, 0xffffffff
lea edx, [esp + 0x274]
mov byte [esp + 0x70d8], 0x81
call fcn.0042c1aa
push str._Integrate:once
push dword [edi]
call fcn.0049d8c3
add esp, 0x20
mov edi, str.SoftwareVOS_s
test eax, eax
jne 0x43b348
push esi
lea ecx, [esp + 0x58]
call fcn.00423442
push ebx
push ebx
push ebx
push ecx
mov byte [esp + 0x70d0], 0x85
mov ecx, esp
mov dword [esp + 0x70], esp
push str.Registered
lea ebx, [esp + 0x68]
call fcn.00423442
mov byte [esp + 0x70d0], 0x86
push dword [0x4ea9b0]
lea eax, [esp + 0x24]
push edi
push eax
call fcn.00461d60
add esp, 8
mov byte [esp + 0x70d4], 0x87
mov ecx, esp
mov dword [esp + 0x98], esp
push str.Integrated
push eax
push ecx
mov dword [esp + 0x3c], 1
call fcn.00423691
add esp, 0xc
mov dword [esp + 0x70d4], 0x88
call fcn.00471bd0
push eax
mov byte [esp + 0x70d8], 0x89
call fcn.00462c50
add esp, 0x18
test eax, eax
je 0x43b2cd
mov eax, dword [esp + 0x54]
cmp dword [eax - 0xc], 0
je 0x43b2cd
mov bl, 1
jmp 0x43b2cf
xor bl, bl
mov dword [esp + 0x70c0], 0x85
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x43b332
push str.Success
lea eax, [esp + 0x58]
call fcn.004234c5
push ecx
test eax, eax
mov dword [esp + 0x64], esp
mov eax, esp
jne 0x43b31a
push str._Integrate:once:_already_registered_successfully._Quitting.
push eax
call fcn.00461d60
pop ecx
pop ecx
call fcn.00435c36
jmp 0x438a6b
push dword [esp + 0x58]
push str._Integrate:once:_already_attempted_registration_before__but_failed:__s._Trying_integration_again.
push eax
call fcn.00461d60
add esp, 0xc
call fcn.00435c36
pop ecx
mov byte [esp + 0x70c0], 0x81
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
xor ebx, ebx
xor eax, eax
cmp dword [esp + 0x4c], ebx
push ebx
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push str.AllUsers
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x8a
mov eax, esp
mov dword [esp + 0x94], esp
push dword [0x4ea9b0]
push edi
push eax
call fcn.00461d60
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x70d4], 0x81
call fcn.00463170
add esp, 0x14
lea eax, [esp + 0x25c]
push eax
push dword [esp + 0x50]
push 0x4ea9a8
call fcn.0042fcaf
add esp, 0xc
lea eax, [esp + 0x25c]
call fcn.00478210
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [0x4ea9b0]
push str._s_is_now_integrated_into_your_system.
jmp 0x4383b3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00460920
test eax, eax
jne 0x43b45b
mov eax, dword [esp + 0x44]
push ebx
push ebx
push ebx
push ecx
mov esi, esp
mov dword [esp + 0x70], esp
push ecx
mov ecx, esp
mov dword [esp + 0x98], esp
push dword [eax]
call fcn.00423442
push esi
call fcn.00467600
add esp, 4
mov byte [esp + 0x70d4], 0x2f
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d4], 3
call fcn.00460490
add esp, 0x14
cmp eax, ebx
jne 0x4371ca
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x4371bb
call fcn.00460c20
test eax, eax
jne 0x43b476
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x436881
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push 0x4cac7c
mov dword [esp + 0x54], edi
call fcn.0049da60
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.0049e6c5
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x24]
sbb edi, edi
push eax
lea ecx, [esp + 0x24]
inc edi
call fcn.0042342d
push ecx
mov byte [esp + 0x70c4], 0x30
mov ecx, esp
mov dword [esp + 0x64], esp
push str..new.exe
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x31
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x70cc], 0x30
call fcn.004620b0
add esp, 0xc
mov byte [esp + 0x70c0], 0x32
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x50]
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push dword [eax]
call fcn.00423442
lea eax, [esp + 0x20]
push eax
call fcn.00467600
pop ecx
pop ecx
push 1
push ebx
push ecx
mov byte [esp + 0x70cc], 0x33
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1d8]
push eax
call fcn.00426225
push ebx
push ecx
mov byte [esp + 0x70c8], 0x34
mov ecx, esp
mov dword [esp + 0x68], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70cc], 0x35
mov ecx, esp
mov dword [esp + 0x90], esp
push esi
call fcn.00423442
push ecx
mov byte [esp + 0x70d0], 0x36
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0xa4], esp
push eax
call fcn.0042342d
push 2
push ecx
mov byte [esp + 0x70d8], 0x37
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
call fcn.0042342d
or ecx, 0xffffffff
lea edx, [esp + 0x1e4]
mov byte [esp + 0x70d8], 0x34
call fcn.0042c1aa
push dword [0x4ea9b0]
lea eax, [esp + 0x54]
push dword [0x4ea9e8]
push str._sAppVirtDll__s.dll
push eax
call fcn.00461d60
add esp, 0x24
mov byte [esp + 0x70c4], 0x38
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
call fcn.004256ef
pop ecx
cmp eax, ebx
je 0x43b67a
push dword [0x4e74b4]
cmp eax, 0x11
jne 0x43b63e
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00461d60
pop ecx
pop ecx
jmp 0x4371c5
cmp eax, 0x12
jne 0x43b651
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x43b631
lea ecx, [esp + 0x64]
push ecx
mov edx, eax
call fcn.00468830
mov byte [esp + 0x70c8], 0x39
mov ecx, esp
mov dword [esp + 0x8c], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x437bc9
push dword [esp + 0x1c]
lea eax, [esp + 0x14]
push str._exec__s
push eax
call fcn.00461d60
mov eax, dword [eax]
add esp, 0xc
push ebx
push ebx
push eax
push dword [esp + 0x30]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
cmp esi, ebx
je 0x43b702
cmp edi, ebx
je 0x43b6cd
push 1
push 0x4c33f0
push str.Starting_installation_in_virtual_mode..._nWhen_installation_is_done__click_OK_and_Cameyo_will_turn_it_into_a_virtual_package._nInstallation_will_not_truly_install_anything_on_your_hard_drive__it_is_simulated_.
jmp 0x43b6d8
push ebx
push 0x4c33f0
push str.When_installation_is_done__click_OK.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x43b702
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
call fcn.00425776
pop ecx
push 0x14
jmp 0x4371cb
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
call fcn.00425776
pop ecx
cmp eax, ebx
je 0x43b778
push dword [0x4e74b4]
cmp eax, 0x11
jne 0x43b739
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x43b631
cmp eax, 0x12
jne 0x43b74f
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x43b631
lea ecx, [esp + 0x64]
push ecx
mov edx, eax
call fcn.00468830
mov byte [esp + 0x70c8], 0x3a
mov ecx, esp
mov dword [esp + 0x8c], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x437bc9
cmp esi, ebx
jne 0x43b797
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [esp + 0x24]
push str.Failed_executing__s
jmp 0x437335
mov esi, dword [esp + 0x20]
cmp edi, ebx
je 0x43b892
call fcn.00434587
push 0x407
mov edi, 0x4ea9a8
call fcn.0047aff0
pop ecx
push ebx
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x14]
jne 0x43b7de
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437ad1
push ebx
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70d0], 0x3b
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x38
call fcn.00430a05
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x43b905
push dword [0x4e74b4]
lea eax, [esp + 0x18]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1c]
push eax
call fcn.00462270
add esp, 8
mov byte [esp + 0x70c8], 0x3c
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
mov byte [esp + 0x70c0], 0x38
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
call fcn.0047aff0
pop ecx
lea eax, [esp + 0x1cc]
call fcn.00478210
push dword [0x4e74b4]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [esp + 0x1c]
push 0x4cb11c
push eax
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x1cc]
push eax
mov byte [esp + 0x70c4], 0x33
call fcn.004262e4
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
jmp 0x437671
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esp + 0x10]
push dword [0x4e74b4]
cmp edx, 0x10
jne 0x43b92a
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437ba0
lea eax, [esp + 0x64]
push eax
call fcn.00468830
mov byte [esp + 0x70c8], 0x3d
mov ecx, esp
mov dword [esp + 0x8c], esp
jmp 0x437bc2
lea ecx, [esp + 0x1c]
call fcn.0042148a
lea ecx, [esp + 0x28]
call fcn.0042148a
mov byte [esp + 0x70c0], 0x25
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea esi, [eax + ecx*4]
push str._CreateDiff
push dword [esi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x43b991
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.00423486
jmp 0x43b9ab
push 0x4cac38
call fcn.0049da60
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x20]
call fcn.0042349b
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push str..mod
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x26
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x70cc], 0x25
call fcn.004620b0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70c4], 0x27
call fcn.00423486
mov byte [esp + 0x70c0], 0x25
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x28]
jne 0x43ba46
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437ad1
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70d0], 0x28
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70d0], 0x25
call fcn.00430a05
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x43baca
push dword [0x4e74b4]
lea eax, [esp + 0x2c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1c]
push eax
call fcn.00462270
add esp, 8
mov byte [esp + 0x70c8], 0x29
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
jmp 0x43bc7f
push edi
call esi
mov edx, dword [esp + 0x10]
push dword [0x4e74b4]
cmp edx, 0x10
jne 0x43bae8
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437ba0
lea eax, [esp + 0x64]
push eax
call fcn.00468830
mov byte [esp + 0x70c8], 0x2a
mov ecx, esp
mov dword [esp + 0x8c], esp
jmp 0x437bc2
lea ecx, [esp + 0x1c]
call fcn.0042148a
lea ecx, [esp + 0x28]
call fcn.0042148a
mov byte [esp + 0x70c0], 0x17
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea esi, [eax + ecx*4]
push str._LearnStreaming
push dword [esi]
call fcn.0049d8c3
pop ecx
pop ecx
test eax, eax
jne 0x43bb4f
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.00423486
jmp 0x43bb69
push 0x4caa04
call fcn.0049da60
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x20]
call fcn.0042349b
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push str..new.exe
call fcn.00423442
push ecx
mov byte [esp + 0x70c8], 0x18
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x70cc], 0x17
call fcn.004620b0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70c4], 0x19
call fcn.00423486
mov byte [esp + 0x70c0], 0x17
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x28]
jne 0x43bc04
push dword [0x4e74b4]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437ad1
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0042342d
push ecx
mov byte [esp + 0x70c8], 0x1a
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.0042342d
mov byte [esp + 0x70c8], 0x17
call fcn.00432394
pop ecx
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x43bcac
push dword [0x4e74b4]
lea eax, [esp + 0x2c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.0042342d
lea eax, [esp + 0x1c]
push eax
call fcn.00462270
add esp, 8
mov byte [esp + 0x70c8], 0x1b
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00461d60
add esp, 0xc
call fcn.004365fb
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
mov ecx, dword [esp + 0x1c]
jmp 0x43766e
push edi
call esi
push dword [0x4e74b4]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x64]
push eax
call fcn.00468830
mov byte [esp + 0x70c8], 0x1c
mov ecx, esp
mov dword [esp + 0x8c], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x437bc9
push str.CLoaderApp:_Done._Bye__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4371ca