Function at 0x43a777
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Get file attributes
Get hostname
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d573c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x289c
call fcn.004b4cc0
mov eax, dword [0x50ac94]
xor eax, esp
mov dword [esp + 0x2898], eax
push ebx
push esi
push edi
mov eax, dword [0x50ac94]
xor eax, esp
push eax
lea eax, [esp + 0x28b0]
mov dword fs:[0], eax
lea eax, [esp + 0x278]
xor esi, esi
mov dword [esp + 0x44], esi
push eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x27c], 8
mov dword [esp + 0x280], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x60]
call fcn.004a8e0e
mov ebx, 0x4df5f8
push ebx
lea ecx, [esp + 0x60]
call fcn.004235bf
push ebx
lea ecx, [esp + 0x68]
mov dword [esp + 0x28bc], esi
call fcn.004235bf
xor edi, edi
push ebx
lea ecx, [esp + 0x74]
inc edi
mov byte [esp + 0x28bc], 1
call fcn.004235bf
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x28bc], 2
call fcn.004671a0
pop ecx
lea ecx, [esp + 0x4c]
call fcn.0042148a
lea eax, [esp + 0x50]
mov byte [esp + 0x28b8], 4
push eax
mov dword [esp + 0x80], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1b8]
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x40], esi
call fcn.004671a0
pop ecx
push eax
mov ecx, 0x5101f4
mov byte [esp + 0x28bc], 5
call fcn.00423603
mov byte [esp + 0x28b8], 4
mov ecx, dword [esp + 0x1b8]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x1a4]
push eax
call fcn.004671a0
mov byte [esp + 0x28bc], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Loader:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.00439a1d
pop ecx
mov byte [esp + 0x28b8], 4
mov ecx, dword [esp + 0x1a4]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x50fe58], eax
cmp dword [esp + 0x2c], esi
je 0x43b71c
cmp dword [esp + 0x50], edi
jle 0x43b71c
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push ecx
lea edi, [eax + ecx*4]
mov ecx, esp
mov dword [esp + 0x38], esp
push dword [edi]
call fcn.004235bf
call fcn.00439a4d
mov dword [esp], 0x4e9014
call fcn.004ae5d0
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
jne 0x43a978
push 0x4e9014
call fcn.004ae5d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x18]
jmp 0x43b704
push str._Confirm
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43a997
mov dword [esp + 0x20], 1
jmp 0x43b70a
push str._Quiet
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43a9b9
or dword [esp + 0x3c], 2
mov dword [0x50c82c], esi
jmp 0x43b70a
push str._AllUsers
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43aa0c
mov dword [esp + 0x48], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00466e50
test eax, eax
je 0x43b812
call fcn.00467150
test eax, eax
jne 0x43b70a
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Admin_rights_required
jmp 0x43b82d
push str._ErrorsOnly
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43aa2d
mov dword [0x50c82c], 1
jmp 0x43b70a
push str._Wait
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43aa49
or dword [esp + 0x3c], 1
jmp 0x43b70a
push 0x4e90e0
call fcn.004ae5d0
pop ecx
push eax
push str._Password:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x43b6e5
push 0x4e9104
call fcn.004ae5d0
pop ecx
push eax
push str._Password
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x43b6e5
push 0x4e9140
call fcn.004ae5d0
pop ecx
push eax
push str._Properties:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
jne 0x43adb4
push str._Properties_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x54]
call fcn.0042148a
lea ecx, [esp + 0x80]
call fcn.0042148a
push 0x4e9140
mov byte [esp + 0x28bc], 9
call fcn.004ae5d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x110]
call fcn.004235bf
lea eax, [esp + 0x280]
push eax
mov byte [esp + 0x28bc], 0xa
call fcn.00429b8b
mov byte [esp + 0x28b8], 0xb
mov dword [esp + 0x148], esi
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4e9188
lea edi, [esp + 0x150]
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0xc
lea eax, [esp + 0x114]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1b0]
push eax
mov byte [esp + 0x28c4], 0xb
call fcn.0046c8a0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x28bc], 0xd
call fcn.00423603
mov byte [esp + 0x28b8], 0xb
mov ecx, dword [esp + 0x1a8]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
push 0x3d
lea ecx, [esp + 0x2c]
call fcn.00425c5a
mov edi, eax
cmp edi, 0xffffffff
je 0x43ac3e
push edi
lea eax, [esp + 0x1b4]
push eax
lea ecx, [esp + 0x2c]
call fcn.004237ae
mov byte [esp + 0x28b8], 0xe
call fcn.00423705
push eax
lea ecx, [esp + 0x58]
call fcn.00423603
mov byte [esp + 0x28b8], 0xb
mov ecx, dword [esp + 0x1b0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x54]
cmp dword [eax - 0xc], esi
je 0x43ac3e
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x84]
call fcn.00423603
push esi
lea ecx, [esp + 0x84]
lea eax, [edi + 1]
push ecx
call fcn.00423656
lea eax, [esp + 0x80]
push eax
push ecx
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x28c]
push eax
call fcn.00429bc1
pop ecx
mov ecx, eax
call fcn.00423603
cmp dword [esp + 0x148], 0xffffffff
jne 0x43ab24
mov eax, dword [esp + 0x298]
mov eax, dword [eax]
lea edi, [esp + 0x280]
lea esi, [esp + 0x94]
call fcn.0042a224
jmp 0x43ad2c
lea esi, [esp + 0x94]
call fcn.004294d9
push eax
lea ecx, [esp + 0xec]
call fcn.004235aa
mov byte [esp + 0x28b8], 0xf
call fcn.004294d9
add eax, 4
push eax
lea ecx, [esp + 0x20]
call fcn.004235aa
push str.Branding
lea eax, [esp + 0xec]
mov byte [esp + 0x28bc], 0x10
call fcn.00423642
test eax, eax
je 0x43b83e
lea edi, [esp + 0xe8]
call fcn.004292fc
push dword [eax]
lea eax, [esp + 0x278]
push str.CAMEYO__s
push eax
call fcn.00468700
mov esi, dword [esp + 0x28]
mov eax, dword [eax]
add esp, 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x274]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov byte [esp + 0x28b8], 0xb
mov ecx, dword [esp + 0xe8]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [esp + 0x94]
call fcn.0042a23a
mov eax, dword [esp + 0x298]
lea edi, [esp + 0x280]
lea esi, [esp + 0xf8]
call fcn.0042a224
mov edi, esi
lea esi, [esp + 0x94]
call fcn.0042a287
test al, al
je 0x43ac6d
lea eax, [esp + 0x280]
push eax
mov byte [esp + 0x28bc], 0xa
call fcn.004299f4
mov ecx, dword [esp + 0x10c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28b8], 4
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43b4c3
push str._SafeMode
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43ae00
push str._SafeMode_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x4e1328
push str.CAMEYO_LEGACYREG
call edi
push str.Disk
push str.CAMEYO_VIRTMODE
call edi
push 0x4e12bc
push str.CAMEYO_EARLYINJECTION
call edi
jmp 0x43b70a
push 0x4e9270
call fcn.004ae5d0
pop ecx
push eax
push str._Services:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
jne 0x43ae74
push dword [edi]
lea ecx, [esp + 0xcc]
call fcn.004235bf
push 0x4e9270
mov byte [esp + 0x28bc], 0x11
call fcn.004ae5d0
pop ecx
push esi
lea ecx, [esp + 0xcc]
push ecx
call fcn.00423656
push dword [esp + 0xc8]
push str.CAMEYO_SERVICES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x28b8], 4
mov ecx, dword [esp + 0xc8]
jmp 0x43b6db
push str._Register
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43b852
push str._Stop
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43b903
push str._Remove
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43ba26
push str._Remove:Proc
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43bd4a
push str._Remove:Reg
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43bf0a
push str._LearnStreaming
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x441a42
push 0x4e980c
call fcn.004ae5d0
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x441a42
push str._UpdateBasicSettings
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43af3a
mov dword [esp + 0x30], 1
jmp 0x43b70a
push str._Repackage
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43c106
push str._CreateDiff
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x441889
push 0x4e9a30
call fcn.004ae5d0
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x441889
push str._exec
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43c2e2
push 0x4e9a74
call fcn.004ae5d0
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x4412d3
push 0x4e9a8c
call fcn.004ae5d0
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x4412d3
push str._ShowStreaming
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43c466
push str._Break
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43c548
push str._Unbreak
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43cc6b
push str._Integrate
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x440e71
push str._Integrate:once
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x440e71
push str._FullIntegrate
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x440e71
push str._Unintegrate
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43d496
push str._CreateShortcuts
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x440819
push 0x4ea550
call fcn.004ae5d0
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x440819
push str._Perf
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43d4fb
push str._ExtractLog
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43d90e
push str._ExtractAll
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43daff
push str._AutoUpdateXml
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43dbdb
push str._Info
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43dd38
push str._Sandbox
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43ddec
push 0x4ea808
call fcn.004ae5d0
pop ecx
push eax
push str._GetProperty:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x43debb
push str._InfoLog
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43e0d5
push str._Ini
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x4406fb
push str._ShowIni
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x4406fb
push str._ExtractIni
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43e2c9
push str._csv
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43e453
push str._EngineVer
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43e829
push str._ChangeLoader
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b204
mov eax, dword [esp + 0x28]
inc eax
cmp dword [esp + 0x50], eax
jg 0x43e96a
push str._ChangeEngine
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b225
mov eax, dword [esp + 0x28]
inc eax
cmp dword [esp + 0x50], eax
jg 0x43ec94
push str._ChangeIni
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b246
mov eax, dword [esp + 0x28]
inc eax
cmp dword [esp + 0x50], eax
jg 0x43f03b
push str._TestAutoUpdate
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b269
mov eax, dword [esp + 0x28]
add eax, 5
cmp dword [esp + 0x50], eax
jg 0x43f1f4
push str._Debug
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43f303
push str._ForceMenu
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b29e
mov dword [esp + 0x7c], 1
jmp 0x43b70a
push str._ShowTree
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43f344
push str._RegDump
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43f410
push str._SetFileFlags
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b2ed
mov eax, dword [esp + 0x28]
add eax, 2
cmp dword [esp + 0x50], eax
jg 0x43f502
push str._DbgZip:
call fcn.004ae67a
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x43f70b
push str._DbgNow
call fcn.004ae67a
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x43f74b
push str._Vintegrate
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x44057c
push 0x4eb128
call fcn.004ae5d0
pop ecx
push eax
push str._Vintegrate:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x44057c
push str._VintegrateRecursive
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x44057c
push 0x4eb180
call fcn.004ae5d0
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x44057c
push str._Vunintegrate
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43f83a
push str._Vmanager
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43f9ca
push 0x4eb240
call fcn.004ae5d0
pop ecx
push eax
push str._ProcessList
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
je 0x43fa77
push str._GfxSvr
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b44e
call fcn.0042bd82
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov edi, 0x510190
call fcn.00484750
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.00484750
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43b70a
push 0x4eb3d8
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43b4ca
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.open
xor ebx, ebx
call fcn.004235bf
push esi
push ecx
mov dword [esp + 0x28c4], 0x158
mov ecx, esp
mov dword [esp + 0x40], esp
push str._Troubleshoot
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x59
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235aa
mov edi, esi
mov dword [esp + 0x28c8], 4
call fcn.00466850
add esp, 0x10
mov ebx, 0x4df5f8
xor esi, esi
jmp 0x43b70a
push str._Troubleshoot
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43fde1
push str._AutoUpdate
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43fe07
push str._VirtRegSyncExport
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43fe9c
push str._StartStreaming
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43ff04
push str._JumpTo
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43ff21
push str._SvcRegister
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x43ffc2
push str._SvcStart
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x4400c9
push str._SvcRegisterStart
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x440184
push str._SvcStop
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x4402e3
push str._SvcRemove
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x4403a0
push dword [edi]
lea ecx, [esp + 0xd4]
call fcn.004235bf
push esi
push ecx
mov dword [esp + 0x28c0], 0x162
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4de148
call fcn.004235bf
push ecx
mov edi, esp
mov byte [esp + 0x28c4], 0x63
mov dword [esp + 0x20], esp
push 0x5c
push ecx
lea eax, [esp + 0xe4]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235aa
push edi
call fcn.00468c10
add esp, 0xc
mov byte [esp + 0x28c4], 0x62
call fcn.0046cd30
add esp, 0xc
cmp eax, esi
je 0x43b64e
push 0x4eb810
push ecx
lea eax, [esp + 0xd8]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x230]
push eax
call fcn.004687f0
or dword [esp + 0x50], 4
pop ecx
pop ecx
call fcn.00423642
mov byte [esp + 0x43], 1
test eax, eax
je 0x43b653
mov byte [esp + 0x43], 0
test byte [esp + 0x44], 4
je 0x43b66e
mov ecx, dword [esp + 0x228]
and dword [esp + 0x44], 0xfffffffb
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [esp + 0x43], 0
jne 0x44045e
push 0x4e5074
lea ecx, [esp + 0x68]
call fcn.00423618
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.004235bf
lea eax, [esp + 0x158]
push eax
call fcn.0046e850
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x28bc], 0x68
call fcn.00423603
mov ecx, dword [esp + 0x154]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [esp + 0x28b8], 4
mov ecx, dword [esp + 0xd0]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43b70a
push str._Password_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4e90e0
call fcn.004ae5d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x4c]
push eax
call fcn.00423618
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x50]
jl 0x43a920
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xa78]
push eax
call fcn.0047f520
push 0xffffffffffffffff
mov dword [esp + 0x28bc], 0x169
push dword [esp + 0x40]
lea eax, [esp + 0x78]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28c8], 0x6a
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28cc], 0x6b
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28cc], 0x6c
push dword [esp + 0x90]
lea eax, [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xa88]
push eax
mov byte [esp + 0x28d8], 0x69
call fcn.0042ffbd
add esp, 0x20
cmp eax, 2
jne 0x441c23
call fcn.0043a1f0
push esi
push dword [0x51019c]
push str.Application_is_now_integrated_into_your_system
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0xa6c]
call fcn.00480740
lea eax, [esp + 0xa6c]
mov dword [esp + 0x28b8], 4
call fcn.00426682
jmp 0x43b8a1
call fcn.00466ea0
test eax, eax
jne 0x43b837
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Elevation_failed
call fcn.004235bf
call fcn.0043a26d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.License_required.
jmp 0x43b82d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov esi, 0x510190
push esi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43b888
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x43b82d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov ecx, esi
call fcn.0042f80b
pop ecx
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
mov ecx, dword [esp + 0x28b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2898]
xor ecx, esp
call fcn.004add11
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43b936
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5101e4
call fcn.004235aa
push ecx
mov byte [esp + 0x28c0], 0x12
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x5101f4
call fcn.004235aa
push ecx
mov byte [esp + 0x28c4], 0x13
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x5101e8
call fcn.004235aa
push ecx
mov byte [esp + 0x28c8], 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x51019c
call fcn.004235aa
mov byte [esp + 0x28c8], 4
call fcn.004362e8
add esp, 0x10
cmp eax, esi
je 0x43b9cc
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Cannot_stop_application__s
push eax
call fcn.00468700
add esp, 0xc
jmp 0x43b832
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.004235bf
call fcn.00439a4d
pop ecx
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
jmp 0x43b8df
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43ba59
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
mov eax, dword [0x5101e8]
cmp dword [eax - 0xc], esi
jne 0x43ba80
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Cannot_obtain_base_dir_for__s
jmp 0x43b9be
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, 0x5101e8
push ebx
call fcn.004235aa
call fcn.0046b080
pop ecx
cmp eax, esi
jne 0x43bacb
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Application_is_not_deployed_on_this_machine:__s
push eax
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
push 5
jmp 0x43b838
cmp dword [esp + 0x20], esi
je 0x43baf2
push 3
push dword [0x51019c]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x43baf2
push 0x14
pop esi
jmp 0x43b9e3
push esi
lea eax, [esp + 0x11c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
mov dword [esp + 0x128], esi
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x15
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x51019c]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.00468700
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x28cc], 4
call fcn.004697b0
add esp, 0x14
cmp eax, esi
je 0x43bba4
cmp dword [esp + 0x118], esi
je 0x43bba4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00466e50
test eax, eax
jne 0x43bb89
call fcn.00466ea0
test eax, eax
jne 0x43b837
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b828
call fcn.00467150
test eax, eax
jne 0x43bba4
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43aa02
call fcn.00433a17
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51019c]
push str.Removing__s
push eax
call fcn.00468700
add esp, 0xc
call fcn.00439a4d
pop ecx
lea ecx, [esp + 0x120]
call fcn.0042148a
push 0x4ddc20
mov byte [esp + 0x28bc], 0x16
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x12c]
push eax
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5101e4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d4], 0x17
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5101f4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d8], 0x18
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5101f0
call fcn.004235aa
push ecx
mov byte [esp + 0x28dc], 0x19
mov ecx, esp
mov dword [esp + 0x40], esp
push ebx
call fcn.004235aa
push ecx
mov byte [esp + 0x28e0], 0x1a
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51019c
call fcn.004235aa
mov byte [esp + 0x28e0], 0x16
call fcn.004366ec
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.004235aa
call fcn.0046b0c0
pop ecx
cmp eax, esi
je 0x43bcb4
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x43b9be
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51019c]
push edi
push eax
call fcn.00468700
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00469af0
pop ecx
cmp eax, esi
je 0x43bcf7
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Registry_could_not_be_emptied_for__s
jmp 0x43b9be
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Removed_successfully
call fcn.004235bf
call fcn.00439a4d
pop ecx
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Application__s_removed_successfully
push eax
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x120]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43b9e3
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43bd7d
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
mov eax, dword [0x5101e8]
cmp dword [eax - 0xc], esi
jne 0x43bd99
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43ba70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, 0x5101e8
push ebx
call fcn.004235aa
call fcn.0046b080
pop ecx
cmp eax, esi
jne 0x43bdc7
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43baa9
cmp dword [esp + 0x20], esi
je 0x43bdea
push 3
push dword [0x51019c]
push str.Do_you_want_to_stop_the_application_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x43baea
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51019c]
push str.Removing_processes:__s
push eax
call fcn.00468700
add esp, 0xc
call fcn.00439a4d
pop ecx
lea ecx, [esp + 0x128]
call fcn.0042148a
push 0x4ddc20
mov byte [esp + 0x28bc], 0x1b
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push esi
push 1
lea eax, [esp + 0x134]
push eax
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5101e4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d4], 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5101f4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d8], 0x1d
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5101f0
call fcn.004235aa
push ecx
mov byte [esp + 0x28dc], 0x1e
mov ecx, esp
mov dword [esp + 0x40], esp
push ebx
call fcn.004235aa
push ecx
mov byte [esp + 0x28e0], 0x1f
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51019c
call fcn.004235aa
mov byte [esp + 0x28e0], 0x1b
call fcn.004366ec
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.004235bf
call fcn.00439a4d
pop ecx
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Application__s_stopped_successfully
push eax
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x128]
jmp 0x43bd3d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43bf3d
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
mov eax, dword [0x5101e8]
cmp dword [eax - 0xc], esi
jne 0x43bf59
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43ba70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, 0x5101e8
push ebx
call fcn.004235aa
call fcn.0046b080
pop ecx
cmp eax, esi
jne 0x43bf87
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43baa9
cmp dword [esp + 0x20], esi
je 0x43bfaa
push 3
push dword [0x51019c]
push str.Do_you_want_to_remove_the_applications_registry_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x43baea
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51019c]
push str.Removing_registry:__s
push eax
call fcn.00468700
add esp, 0xc
call fcn.00439a4d
pop ecx
lea ecx, [esp + 0x130]
call fcn.0042148a
push 0x4ddc20
mov byte [esp + 0x28bc], 0x20
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push 1
push esi
lea eax, [esp + 0x13c]
push eax
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5101e4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d4], 0x21
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5101f4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d8], 0x22
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5101f0
call fcn.004235aa
push ecx
mov byte [esp + 0x28dc], 0x23
mov ecx, esp
mov dword [esp + 0x40], esp
push ebx
call fcn.004235aa
push ecx
mov byte [esp + 0x28e0], 0x24
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51019c
call fcn.004235aa
mov byte [esp + 0x28e0], 0x20
call fcn.004366ec
add esp, 0x24
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51019c]
push str.SoftwareVOS_s
push eax
call fcn.00468700
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00469af0
pop ecx
cmp eax, esi
je 0x43c0bb
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43bce7
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Registry_removed_successfully
call fcn.004235bf
call fcn.00439a4d
pop ecx
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Application__ss_registry_removed_successfully
push eax
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x130]
jmp 0x43bd3d
lea ecx, [esp + 0x20]
call fcn.0042148a
lea ecx, [esp + 0x3c]
call fcn.0042148a
mov byte [esp + 0x28b8], 0x2d
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43c140
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.00423618
jmp 0x43c14e
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.00423603
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0x2e
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1fc]
push eax
mov byte [esp + 0x28c4], 0x2d
call fcn.00468a50
add esp, 0xc
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x28bc], 0x2f
call fcn.00423603
mov byte [esp + 0x28b8], 0x2d
mov ecx, dword [esp + 0x1f4]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.0046bda0
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
pop ecx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x3c]
jne 0x43c201
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
jmp 0x43b832
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
call fcn.00435bc7
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, esi
jne 0x43c28e
push dword [0x50c82c]
lea eax, [esp + 0x40]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x168]
push eax
call fcn.00468c10
add esp, 8
mov byte [esp + 0x28c0], 0x30
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x15c]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
lea ecx, [ebx - 0x10]
jmp 0x43bd40
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x30], 0x10
push dword [0x50c82c]
jne 0x43c2b3
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x43b82d
push dword [esp + 0x34]
lea eax, [esp + 0x2a8]
push eax
call fcn.0046fec0
add esp, 4
mov byte [esp + 0x28c0], 0x31
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x43b9bf
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax + edx*4]
call fcn.004235bf
lea eax, [esp + 0x200]
push eax
call fcn.0046e850
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x28bc], 0x38
call fcn.00423603
push eax
lea ecx, [esp + 0x68]
call fcn.00423603
push eax
lea ecx, [esp + 0xdc]
call fcn.004235aa
mov byte [esp + 0x28b8], 0x3a
mov ecx, dword [esp + 0x1fc]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0xe0]
call fcn.004237ae
push 0x4e58c4
push eax
call fcn.004238b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x164]
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], 0
lea ecx, [esp + 0x64]
je 0x43c38f
push 1
push 0x22
jmp 0x43c392
push esi
push 0x20
call fcn.00425c5a
mov edi, eax
cmp edi, 0xffffffff
je 0x43c406
push edi
lea eax, [esp + 0x208]
push eax
lea ecx, [esp + 0x6c]
call fcn.004237ae
push 0x4e57b0
mov byte [esp + 0x28bc], 0x3b
call fcn.00433c57
push eax
lea ecx, [esp + 0x68]
call fcn.00423603
mov byte [esp + 0x28b8], 0x3a
mov ecx, dword [esp + 0x204]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
lea ecx, [esp + 0x74]
lea eax, [edi + 1]
push ecx
call fcn.00423656
lea eax, [esp + 0x70]
call fcn.00423705
push eax
lea ecx, [esp + 0x74]
call fcn.00423603
jmp 0x43c42b
push 0x4e57b0
lea eax, [esp + 0xdc]
call fcn.00433c57
push eax
lea ecx, [esp + 0x68]
call fcn.00423603
push ebx
lea ecx, [esp + 0x74]
call fcn.00423618
xor ecx, ecx
lea eax, [esp + 0x64]
call fcn.00429345
movzx eax, ax
cmp ax, 0x25
jne 0x43c44a
lea eax, [esp + 0x64]
push eax
call fcn.0047a5f0
pop ecx
mov byte [esp + 0x28b8], 4
mov ecx, dword [esp + 0xd8]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43b71c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ShowStreaming:
call fcn.004235bf
call fcn.00439a4d
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x8c8]
push eax
call fcn.0047f520
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x28c4], 0x4a
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x4b
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x4c
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0x4d
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x8d8]
push eax
mov byte [esp + 0x28d8], 0x4a
call fcn.0042ffbd
add esp, 0x20
lea ecx, [esp + 0x8bc]
call fcn.0042f31c
lea eax, [esp + 0x8bc]
call fcn.00480740
mov byte [esp + 0x28b8], 4
lea eax, [esp + 0x8bc]
call fcn.00426682
jmp 0x43b9e3
lea ecx, [esp + 0x20]
call fcn.0042148a
mov byte [esp + 0x28b8], 0x4e
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43c579
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.00423618
jmp 0x43c587
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.00423603
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0x4f
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x28c4], 0x4e
call fcn.00468a50
add esp, 0xc
push 1
push esi
push ecx
mov byte [esp + 0x28c4], 0x50
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x2f0]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0x51
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x2f0]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0x36c], esi
jne 0x43c640
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_containers_
jmp 0x43b82d
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.0046a670
pop ecx
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43c681
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_empty__s
jmp 0x43b9be
mov esi, dword [esp + 0x58]
call fcn.0046b160
test eax, eax
jne 0x43c6a9
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_create__s
jmp 0x43b9be
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, 0x4ddc20
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x52
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtApp.ini
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x53
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x54
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str.Main
push esi
call fcn.004235bf
push 3
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x55
mov ecx, esp
mov dword [esp + 0x40], esp
push str.AppVirtDll.dll
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x56
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x57
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 2
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x58
mov ecx, esp
mov dword [esp + 0x40], esp
push str.AppVirtDll64.dll
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x59
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x5a
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 8
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x5b
mov ecx, esp
mov dword [esp + 0x40], esp
push str.StubExe.exe
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x5c
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x5d
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 9
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x5e
mov ecx, esp
mov dword [esp + 0x40], esp
push str.StubExe64.exe
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x5f
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x60
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 0xa
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x61
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtFiles.db
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x62
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x63
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 4
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x64
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SandboxCfg.db
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x65
mov ecx, esp
lea eax, [esp + 0x68]
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x66
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 5
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x67
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtReg.export
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x68
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x69
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 6
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x6a
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtReg.dat
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x6b
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x6c
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 0xb
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x6d
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SysDllSubdirs.txt
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x6e
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x6f
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push 7
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28c0], 0x51
call fcn.00481cd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0x70
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtFiles.vfc
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x71
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x51
call fcn.00468250
add esp, 8
mov byte [esp + 0x28c0], 0x72
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
mov byte [esp + 0x28c0], 0x51
xor ecx, ecx
inc ecx
lea edi, [esp + 0x2ec]
call fcn.00481cd0
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push 0x4e9f64
push eax
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
push 0
jmp 0x43b838
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Unbreak:
call fcn.004235bf
call fcn.00439a4d
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0x73
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x28c4], 4
call fcn.00468a50
add esp, 0xc
mov byte [esp + 0x28b8], 0x74
push dword [esp + 0x6c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43ccf1
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x74]
push str.Dir_doesnt_exist:__s
jmp 0x43b9be
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.004235aa
mov edi, str..old
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x174]
push eax
mov byte [esp + 0x28c4], 0x75
call fcn.0042380e
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x16c]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x214]
push eax
call fcn.0042380e
add esp, 0xc
push dword [eax]
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x20c]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x43cd8d
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_rename_myself_to_.old
jmp 0x43b82d
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x17c]
push eax
call fcn.0042380e
mov eax, dword [eax]
add esp, 0xc
push esi
push dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x174]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x43cde3
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_myself
jmp 0x43b82d
push 1
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [esp + 0xc4], esi
push 0x4ddc20
lea ebx, [esp + 0xc8]
lea esi, [esp + 0x148]
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x76
mov ecx, esp
mov dword [esp + 0x24], esp
push str.VirtApp.ini
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x77
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28cc], 0x75
call fcn.00468250
add esp, 0xc
mov edi, esi
call fcn.00469110
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x43d47f
xor edi, edi
cmp dword [esp + 0xb8], edi
je 0x43d47f
push dword [esp + 0xb8]
mov ecx, dword [esp + 0x13c]
lea eax, [esp + 0x34]
push eax
call fcn.00468e70
mov byte [esp + 0x28c0], 0x78
push dword [esp + 0x140]
call fcn.004aedc5
add esp, 0xc
push 1
push 1
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x380]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0x79
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x380]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0x3fc], edi
jne 0x43cf1a
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_begin_to_update_resource
jmp 0x43b82d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.004235bf
mov byte [esp + 0x28bc], 0x7a
mov eax, dword [esp + 0x34]
mov eax, dword [eax - 0xc]
add eax, eax
push edi
push eax
lea ecx, [esp + 0x3c]
call fcn.00423d54
push eax
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.00481170
cmp eax, edi
je 0x43cf79
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_update_INI_resource
jmp 0x43b82d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0
push 2
push ecx
mov byte [esp + 0x28c8], 0x7b
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov ebx, 0x4ddc20
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x7c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppVirtDll.dll
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x7d
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x7b
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0
push 8
push ecx
mov byte [esp + 0x28c8], 0x7e
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x7f
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppVirtDll64.dll
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x80
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x7e
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0
push 9
push ecx
mov byte [esp + 0x28c8], 0x81
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x82
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.StubExe.exe
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x83
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x81
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0
push 0xa
push ecx
mov byte [esp + 0x28c8], 0x84
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x85
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.StubExe64.exe
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x86
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x84
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0x4000
push 4
push ecx
mov byte [esp + 0x28c8], 0x87
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x88
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtFiles.db
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x89
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x87
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0x4000
push 5
push ecx
mov byte [esp + 0x28c8], 0x8a
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x8b
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.SandboxCfg.db
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x8c
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x8a
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
mov byte [esp + 0x28bc], 0x8d
push 0x4000
push 0xb
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x8e
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtReg.dat
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x8f
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x8d
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0
push 7
push ecx
mov byte [esp + 0x28c8], 0x90
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x91
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.SysDllSubdirs.txt
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x92
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x90
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0x4000
push 1
push ecx
mov byte [esp + 0x28c8], 0x93
mov edi, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28d0], 0x94
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtFiles.vfc
call fcn.004235bf
push ecx
mov byte [esp + 0x28d4], 0x95
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d4], 0x93
call fcn.00468250
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28cc], 0x79
call fcn.004814d0
lea eax, [esp + 0x374]
call fcn.00480740
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
je 0x43d470
push str.Could_not_commit_resource
jmp 0x43b82d
push str.Success
call fcn.004235bf
jmp 0x43cc5d
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_VirtApp.ini
jmp 0x43b82d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43d4c9
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
call fcn.00433a17
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str._s_is_no_longer_integrated.
push eax
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
jmp 0x43b837
lea ecx, [esp + 0x54]
call fcn.0042148a
lea ecx, [esp + 0x30]
call fcn.0042148a
mov byte [esp + 0x28b8], 0xc0
mov edi, dword [esp + 0x28]
or dword [esp + 0x24], 0xffffffff
lea eax, [edi + 1]
cmp dword [esp + 0x50], eax
jle 0x43d538
mov eax, dword [esp + 0x2c]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x58]
call fcn.00423618
lea eax, [edi + 2]
cmp dword [esp + 0x50], eax
jle 0x43d551
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ecx, [esp + 0x34]
call fcn.00423618
lea ecx, [esp + 0x214]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x28bc], 0xc1
call fcn.004235aa
push ecx
mov byte [esp + 0x28bc], 0xc2
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43d5ae
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
xor edi, edi
inc edi
push edi
push esi
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xcb8]
push eax
call fcn.0047f520
lea eax, [esp + 0xcac]
push eax
mov byte [esp + 0x28bc], 0xc3
call fcn.0042841b
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
pop ecx
cmp dword [eax - 0xc], esi
je 0x43d60f
push esi
push 0x80
push 4
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x24], eax
push edi
push edi
push edi
lea eax, [esp + 0x220]
push eax
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5101e4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d4], 0xc4
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5101f4
call fcn.004235aa
push ecx
mov byte [esp + 0x28d8], 0xc5
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5101f0
call fcn.004235aa
push ecx
mov byte [esp + 0x28dc], 0xc6
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0x5101e8
call fcn.004235aa
push ecx
mov byte [esp + 0x28e0], 0xc7
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x51019c
call fcn.004235aa
mov byte [esp + 0x28e0], 0xc3
call fcn.004366ec
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x28
call edi
push esi
push 2
mov dword [esp + 0x88], eax
push 0x510190
lea eax, [esp + 0xcb8]
push eax
push dword [esp + 0x2c]
call fcn.0042d8f9
add esp, 0x14
cmp eax, esi
je 0x43d6f1
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Failed_BasicDeploy_
jmp 0x43b82d
call edi
sub eax, dword [esp + 0x80]
mov dword [esp + 0x80], eax
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
cmp dword [eax - 0xc], esi
je 0x43d7b2
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0xc8
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4e5074
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0xc9
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.004235bf
push 2
push ecx
mov byte [esp + 0x28d4], 0xca
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xcc8]
push eax
mov byte [esp + 0x28d8], 0xc3
call fcn.0042ffbd
add esp, 0x20
push esi
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
call fcn.0046f5d0
pop ecx
pop ecx
cmp eax, esi
jne 0x43d7b2
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43d788
call edi
push ecx
mov edi, eax
sub edi, dword [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5101e4
call fcn.004235aa
push ecx
mov byte [esp + 0x28c0], 0xcb
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x5101f4
call fcn.004235aa
push ecx
mov byte [esp + 0x28c4], 0xcc
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x5101e8
call fcn.004235aa
push ecx
mov byte [esp + 0x28c8], 0xcd
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x51019c
call fcn.004235aa
mov byte [esp + 0x28c8], 0xc3
call fcn.004362e8
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.0042148a
lea ecx, [esp + 0x17c]
mov eax, 0x100
push ecx
mov byte [esp + 0x28bc], 0xce
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x184], eax
call fcn.0042149e
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x4c]
call fcn.004238cd
push edi
push dword [esp + 0x84]
lea eax, [esp + 0x148]
push dword [esp + 0x50]
push dword [0x51019c]
push str._s__s__d_d_r_n
push eax
call fcn.00468700
add esp, 0x18
mov byte [esp + 0x28b8], 0xcf
push dword [esp + 0x140]
lea ecx, [esp + 0x220]
call fcn.00424f4f
mov byte [esp + 0x28b8], 0xd0
mov edi, dword [esp + 0x24]
cmp edi, 0xffffffff
je 0x43d8ef
push 2
push esi
push esi
push edi
mov dword [esp + 0x194], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x21c]
mov ecx, dword [eax - 0xc]
push esi
lea edx, [esp + 0x188]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x50c82c]
lea eax, [esp + 0x144]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
jmp 0x43d4ef
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Packager.log
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0xd1
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xf4]
push eax
mov byte [esp + 0x28c4], 4
call fcn.00468a50
add esp, 8
mov byte [esp + 0x28bc], 0xd2
lea eax, [esp + 0xf0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.0046bda0
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
xor edi, edi
call fcn.004235aa
lea eax, [esp + 0x958]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xd3
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x958]
push eax
call fcn.0043a336
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0xd4
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0xd5
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0xd6
mov ecx, esp
mov dword [esp + 0x38], esp
lea eax, [esp + 0x34]
push eax
call fcn.004235aa
lea eax, [esp + 0x968]
push eax
mov byte [esp + 0x28d8], 0xd3
call fcn.0042ffbd
lea eax, [esp + 0x96c]
push eax
call fcn.0042841b
mov ebx, eax
add esp, 0x24
cmp ebx, esi
je 0x43daa5
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004673c0
mov byte [esp + 0x28c0], 0xd7
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LogsPackager.log
call fcn.004235bf
push ebx
mov byte [esp + 0x28c4], 0xd3
call fcn.00426b55
add esp, 0xc
cmp eax, esi
jne 0x43da9a
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_extract_Packager.log_
jmp 0x43b82d
xor edi, edi
push ebx
inc edi
call fcn.00483e20
jmp 0x43dac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.Loader__ExtractLog_:_OpenVfc_failed__LE_d
push ecx
call fcn.00468700
add esp, 0xc
call fcn.00439a1d
pop ecx
lea eax, [esp + 0x94c]
call fcn.00480740
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xf4]
cmp edi, esi
je 0x43daf5
push str.Success:__s
jmp 0x43d4e6
push str.Failed_saving__s
jmp 0x43d4e6
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43db33
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x9e8]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xd8
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x9e8]
push eax
call fcn.0043a336
lea eax, [esp + 0x9ec]
push eax
call fcn.0042841b
add esp, 0x14
push 1
push 2
push edi
lea ecx, [esp + 0x9e8]
push ecx
push eax
call fcn.0042d8f9
mov edi, eax
add esp, 0x14
lea eax, [esp + 0x9dc]
call fcn.00480740
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
cmp edi, esi
jne 0x43dd26
push dword [0x5101e8]
push str.Success:_n_s
jmp 0x43d4e6
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43dc0f
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
lea eax, [esp + 0x22c]
push eax
mov ecx, edi
call fcn.004954d0
pop ecx
mov byte [esp + 0x28b8], 0xd9
push dword [eax]
lea ecx, [esp + 0x190]
call fcn.00424f4f
mov byte [esp + 0x28b8], 0xdb
mov ecx, dword [esp + 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x18c]
mov ecx, dword [eax - 0xc]
push eax
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov dword [esp + 0x28], ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, str..xml
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0xdc
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004671a0
pop ecx
push edi
mov byte [esp + 0x28cc], 0xdb
call fcn.00468a50
mov edi, dword [esp + 0x30]
add esp, 0xc
call fcn.004693c0
pop ecx
pop ecx
push dword [0x50c82c]
push ecx
mov dword [esp + 0x18], esp
cmp eax, esi
je 0x43dd24
mov ecx, esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c4], 0xdd
mov eax, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004671a0
pop ecx
lea eax, [esp + 0x240]
push eax
mov byte [esp + 0x28c8], 0xdb
call fcn.00468a50
add esp, 8
mov byte [esp + 0x28c0], 0xde
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Success:_n_s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x234]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43b837
mov eax, esp
push str.Failed_extracting.
push eax
call fcn.00468700
pop ecx
pop ecx
jmp 0x43d4ef
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.004235aa
mov byte [esp + 0x28b8], 0xdf
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43dd6c
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.00423618
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1100]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xe0
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1100]
push eax
call fcn.0043a336
lea eax, [esp + 0x1104]
push eax
lea eax, [esp + 0x1a8]
push eax
call fcn.0043a3cf
add esp, 0x18
push esi
push str.Info
push dword [esp + 0x19c]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x43b837
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.004235aa
mov byte [esp + 0x28b8], 0xe1
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43de20
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.00423618
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xdd8]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xe2
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xdd8]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0xe54], esi
jne 0x43de92
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FAILED_LOADING_CONTAINERS_
jmp 0x43b82d
lea eax, [esp + 0xdcc]
push eax
lea eax, [esp + 0x240]
push eax
call fcn.0043a69e
pop ecx
pop ecx
push esi
push str.Sandbox
push dword [esp + 0x244]
jmp 0x43dde0
push str._GetProperty_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4ea808
call fcn.004ae5d0
mov edx, dword [esp + 0x2c]
pop ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x1a0]
call fcn.004235bf
push 1
push esi
push ecx
mov byte [esp + 0x28c4], 0xe3
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x12b0]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xe4
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x12b0]
push eax
call fcn.0043a336
add esp, 0x10
lea ecx, [esp + 0x108]
call fcn.0042148a
lea eax, [esp + 0x2a8]
push eax
mov byte [esp + 0x28bc], 0xe5
call fcn.004293a6
lea eax, [esp + 0x108]
push eax
push ecx
mov byte [esp + 0x28c0], 0xe6
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.004235bf
push 3
lea edi, [esp + 0x12b0]
call fcn.00481b30
mov ecx, dword [esp + 0x108]
mov eax, dword [ecx - 0xc]
cmp eax, esi
jne 0x43dfab
push 6
jmp 0x43b838
lea edx, [esp + 0x2a8]
push edx
push eax
push ecx
call fcn.00471a90
mov eax, dword [esp + 0x2cc]
mov eax, dword [eax]
add esp, 0xc
lea edi, [esp + 0x2a8]
lea esi, [esp + 0x94]
call fcn.0042a224
mov eax, dword [esp + 0x2c0]
lea esi, [esp + 0xf8]
call fcn.0042a224
mov edi, esi
lea esi, [esp + 0x94]
call fcn.0042a287
test al, al
jne 0x43bac4
xor ebx, ebx
lea esi, [esp + 0x94]
call fcn.004294d9
push dword [eax]
lea eax, [esp + 0x1a0]
call fcn.00423642
test eax, eax
jne 0x43e08e
call fcn.004294d9
add eax, 4
push dword [eax]
lea ecx, [esp + 0xf8]
call fcn.00424f4f
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x43e07f
mov ecx, dword [esp + 0xf4]
push ebx
mov dword [esp + 0x130], ebx
mov edx, dword [ecx - 0xc]
lea esi, [esp + 0x130]
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43e07f
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0xf4]
cmp eax, dword [ecx - 0xc]
je 0x43e0cf
mov ecx, dword [esp + 0xf4]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [esp + 0x94]
call fcn.0042a23a
mov eax, dword [esp + 0x2c0]
lea edi, [esp + 0x2a8]
lea esi, [esp + 0xf8]
call fcn.0042a224
mov edi, esi
lea esi, [esp + 0x94]
call fcn.0042a287
test al, al
je 0x43e004
jmp 0x43bac4
push ebx
jmp 0x43b838
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.004235aa
mov byte [esp + 0x28b8], 0xe7
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43e109
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.00423618
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x838]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xe8
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x838]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0x8b4], esi
jne 0x43e176
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43de88
lea eax, [esp + 0x82c]
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.0043a3cf
pop ecx
pop ecx
push str._n_nSandboxing:_n_n
lea ecx, [esp + 0xf4]
mov byte [esp + 0x28bc], 0xe9
call fcn.00429234
lea eax, [esp + 0x82c]
push eax
lea eax, [esp + 0x248]
push eax
call fcn.0043a69e
pop ecx
pop ecx
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x28bc], 0xea
call fcn.0042362d
mov byte [esp + 0x28b8], 0xe9
mov ecx, dword [esp + 0x244]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xf0]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
add eax, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, str..txt
push ebx
mov dword [esp + 0x2c], eax
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0xeb
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004671a0
pop ecx
push edi
mov byte [esp + 0x28cc], 0xe9
call fcn.00468a50
mov edi, dword [esp + 0x30]
add esp, 0xc
call fcn.004693c0
pop ecx
pop ecx
push esi
push str.Package_info
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0xec
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004671a0
pop ecx
lea eax, [esp + 0x25c]
push eax
mov byte [esp + 0x28cc], 0xe9
call fcn.00468a50
add esp, 0xc
mov byte [esp + 0x28c0], 0xed
push dword [eax]
lea eax, [esp + 0x158]
push str.Saved_in:__s
push eax
call fcn.00468700
add esp, 0xc
push dword [eax]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x14c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24c]
jmp 0x43dd17
lea ecx, [esp + 0x10]
call fcn.0042148a
lea ecx, [esp + 0x114]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x28bc], 0xf3
call fcn.004235aa
mov byte [esp + 0x28b8], 0xf4
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43e31a
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.00423618
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str..ini
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0xf5
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x144]
push eax
mov byte [esp + 0x28c4], 0xf4
call fcn.00468a50
add esp, 8
mov byte [esp + 0x28bc], 0xf6
lea eax, [esp + 0x140]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
call fcn.0046bda0
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xe68]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xf7
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xe68]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0xee4], esi
jne 0x43e3ea
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x43de88
lea eax, [esp + 0x114]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.004235bf
push 3
lea edi, [esp + 0xe68]
call fcn.00481b30
mov ecx, dword [esp + 0x114]
mov eax, dword [ecx - 0xc]
cmp eax, esi
jne 0x43e431
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x43b881
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x144]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
call fcn.004693c0
jmp 0x43d4f4
push str.AppID_ShortDesc_FriendlyName_Category_DownloadUrl_IconUrl_Version_BuildUid_Size_PopularityIndex_n
lea ecx, [esp + 0x6c]
call fcn.004235bf
lea ecx, [esp + 0x24]
mov dword [esp + 0x11c], esi
mov dword [esp + 0x1bc], esi
call fcn.0042148a
push 1
push esi
push ecx
mov byte [esp + 0x28c4], 0xf9
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x13d0]
push eax
call fcn.0047f520
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x28c4], 0xfa
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0xfb
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0xfc
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0xfd
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x13e0]
push eax
mov byte [esp + 0x28d8], 0xfa
call fcn.0042ffbd
mov edi, 0x4e2540
push edi
lea eax, [esp + 0x1d0]
push 0x51019c
push eax
call fcn.0042380e
add esp, 0x2c
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x28bc], 0xfe
call fcn.0042362d
mov byte [esp + 0x28b8], 0xfa
mov ecx, dword [esp + 0x1ac]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea ecx, [esp + 0x6c]
call fcn.00429234
push edi
push 0x5101a4
lea eax, [esp + 0x25c]
push eax
call fcn.0042380e
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x28bc], 0xff
call fcn.0042362d
mov byte [esp + 0x28b8], 0xfa
mov ecx, dword [esp + 0x254]
add ecx, 0xfffffff0
call fcn.0042101a
push str.Productivity_
lea ecx, [esp + 0x6c]
call fcn.00429234
mov ebx, dword [esp + 0x28]
lea eax, [ebx + 1]
cmp dword [esp + 0x50], eax
jle 0x43e5df
mov eax, dword [esp + 0x2c]
push dword [eax + ebx*4 + 4]
lea ebx, [esp + 0x6c]
push 0x4eaa00
call fcn.004264f8
mov ebx, dword [esp + 0x30]
pop ecx
pop ecx
xor esi, esi
jmp 0x43e5ed
push str._Download_URL_here__
lea ecx, [esp + 0x6c]
call fcn.00429234
lea eax, [ebx + 2]
cmp dword [esp + 0x50], eax
jle 0x43e611
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ebx, [esp + 0x6c]
push 0x4eaa00
call fcn.004264f8
pop ecx
pop ecx
xor esi, esi
jmp 0x43e61f
push str._Icon_here__
lea ecx, [esp + 0x6c]
call fcn.00429234
push edi
lea eax, [esp + 0x1b8]
push 0x5101ac
push eax
call fcn.0042380e
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x28bc], 0x100
call fcn.0042362d
mov ebx, 0xfa
mov dword [esp + 0x28b8], ebx
mov ecx, dword [esp + 0x1b4]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea eax, [esp + 0x260]
push 0x5101dc
push eax
call fcn.0042380e
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x28bc], 0x101
call fcn.0042362d
mov dword [esp + 0x28b8], ebx
mov ecx, dword [esp + 0x25c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x120]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004671a0
pop ecx
call fcn.0046bd00
add esp, 0xc
push dword [esp + 0x11c]
lea eax, [esp + 0x270]
push 0x4e07c8
push eax
call fcn.00468700
add esp, 0xc
push edi
push eax
lea eax, [esp + 0x26c]
push eax
mov dword [esp + 0x28c4], 0x102
call fcn.0042380e
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x28bc], 3
call fcn.0042362d
mov ecx, dword [esp + 0x264]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [esp + 0x28b8], ebx
mov ecx, dword [esp + 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4e12bc
lea ecx, [esp + 0x6c]
call fcn.00429234
mov eax, dword [esp + 0x28]
add eax, 3
cmp dword [esp + 0x50], eax
jle 0x43e7c5
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..csv
call fcn.004235bf
push ecx
mov dword [esp + 0x28c0], 0x104
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004671a0
pop ecx
lea eax, [esp + 0x1d0]
push eax
mov dword [esp + 0x28c4], ebx
call fcn.00468a50
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x28bc], 0x105
call fcn.00423603
mov dword [esp + 0x28b8], ebx
mov ecx, dword [esp + 0x1c8]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43e7d5
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ecx, [esp + 0x28]
call fcn.00423618
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
call fcn.004693c0
pop ecx
pop ecx
push dword [0x50c82c]
push ecx
mov dword [esp + 0x18], esp
cmp eax, esi
jne 0x43e81e
mov eax, esp
lea ecx, [esp + 0x2c]
push ecx
push str.Could_not_save_to
push eax
call fcn.00423863
jmp 0x43b9c4
mov ecx, esp
lea eax, [esp + 0x2c]
jmp 0x43d903
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xfe0]
push eax
call fcn.0047f520
mov dword [esp + 0x28b8], 0x106
cmp dword [esp + 0x105c], esi
jne 0x43e870
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c636
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51019c]
push str._s.AppVirtDll.dll
push eax
call fcn.00468700
lea eax, [esp + 0xec]
add esp, 0xc
push eax
call fcn.00467e00
add esp, 4
mov byte [esp + 0x28bc], 7
lea eax, [esp + 0xe0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28c0], 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.004235bf
push 2
pop ecx
lea edi, [esp + 0xfdc]
mov byte [esp + 0x28c0], 7
call fcn.00481cd0
push dword [0x50c82c]
lea eax, [esp + 0xe0]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x228]
push eax
call fcn.00489bb0
add esp, 4
mov byte [esp + 0x28c0], 9
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov byte [esp + 0x28b8], 7
mov ecx, dword [esp + 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0xe0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.0046bda0
jmp 0x43d4f5
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004235aa
push 0x2e
lea ecx, [esp + 0x28]
mov dword [esp + 0x28bc], 0x10a
call fcn.00433c32
push eax
lea eax, [esp + 0x1d4]
push eax
lea ecx, [esp + 0x2c]
call fcn.004237ae
push str..new.exe
push eax
lea eax, [esp + 0x94]
push eax
mov byte [esp + 0x28c4], 0xb
call fcn.0042380e
add esp, 0xc
mov byte [esp + 0x28b8], 0xd
mov ecx, dword [esp + 0x1d0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x228]
call fcn.004235bf
push esi
mov byte [esp + 0x28bc], 0xe
push dword [esp + 0x90]
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43ea39
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push dword [esp + 0x30]
push str.Cant_copy__s_to__s
push eax
call fcn.00468700
add esp, 0x10
jmp 0x43b832
push dword [esp + 0x8c]
push dword [esp + 0x28]
call fcn.00433e00
pop ecx
pop ecx
xor esi, esi
inc esi
push esi
push 0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x4a0]
push eax
call fcn.0047f520
push esi
push esi
push ecx
mov byte [esp + 0x28c4], 0xf
lea eax, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1190]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0x10
push dword [0x50c82c]
lea eax, [esp + 0x50]
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x4a0]
push eax
call fcn.0043a336
add esp, 0x10
lea eax, [esp + 0x34]
lea ecx, [esp + 0x504]
call fcn.00441cf4
jmp 0x43ebf1
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CEChangeEngine.tmp
call fcn.004235bf
lea eax, [esp + 0xa0]
push eax
call fcn.00467e00
add esp, 4
mov byte [esp + 0x28bc], 0x11
lea eax, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
lea esi, [esp + 0x38]
mov byte [esp + 0x28bc], 0x12
call fcn.00423af6
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
call fcn.00423af6
mov byte [esp + 0x28c0], 0x11
mov ecx, dword [eax + 0x28]
lea edi, [esp + 0x49c]
call fcn.00481cd0
test eax, eax
jne 0x43ec4d
call fcn.00423af6
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x4000
mov byte [esp + 0x28c0], 0x13
call fcn.00423af6
push dword [eax + 0x28]
lea eax, [esp + 0xa8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1194]
push eax
mov byte [esp + 0x28cc], 0x11
call fcn.004814d0
test eax, eax
jne 0x43ec79
push ecx
lea eax, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.0046bda0
pop ecx
mov byte [esp + 0x28b8], 0x10
mov ecx, dword [esp + 0x9c]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.00441d6c
lea eax, [esp + 0x2cc]
lea ecx, [esp + 0x504]
call fcn.00441d09
mov edi, eax
lea esi, [esp + 0x34]
call fcn.00423b74
test al, al
jne 0x43eadf
lea eax, [esp + 0x494]
call fcn.00480740
lea eax, [esp + 0x1184]
call fcn.00480740
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push str.Successfully_changed_Loader:__s
jmp 0x43cc54
push dword [0x50c82c]
call fcn.00423af6
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x40]
call fcn.00423af6
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x43ea2c
push dword [0x50c82c]
lea esi, [esp + 0x38]
call fcn.00423af6
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
jmp 0x43ec66
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004235aa
push 0x2e
lea ecx, [esp + 0x24]
mov dword [esp + 0x28bc], 0x114
call fcn.00433c32
push eax
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0x28]
call fcn.004237ae
push str..new.exe
push eax
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x28c4], 0x15
call fcn.0042380e
add esp, 0xc
mov byte [esp + 0x28b8], 0x17
mov ecx, dword [esp + 0x1d8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0xa8]
call fcn.004235bf
push esi
mov byte [esp + 0x28bc], 0x18
push dword [esp + 0xa4]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43ed52
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xa8]
push dword [esp + 0x2c]
jmp 0x43ea26
push 1
push 1
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x410]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0x19
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x410]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0x48c], esi
jne 0x43edc8
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_open_PeContainer
jmp 0x43b82d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.004235bf
push 0
push 2
push ecx
mov byte [esp + 0x28c8], 0x1a
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x414]
push eax
mov byte [esp + 0x28cc], 0x19
call fcn.004814d0
test eax, eax
je 0x43ee2a
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x43b82d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0
push 8
push ecx
mov byte [esp + 0x28c8], 0x1b
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
lea eax, [esp + 0xb8]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235aa
push edi
call fcn.00477210
pop ecx
pop ecx
lea eax, [esp + 0x414]
push eax
mov byte [esp + 0x28cc], 0x19
call fcn.004814d0
test eax, eax
je 0x43ee96
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x43b82d
lea ecx, [esp + 0x134]
call fcn.0042148a
lea ecx, [esp + 0x124]
call fcn.0042148a
lea eax, [esp + 0x134]
push eax
push ecx
mov byte [esp + 0x28c0], 0x1d
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.004235bf
push 3
lea edi, [esp + 0x410]
call fcn.00481b30
test eax, eax
je 0x43eef4
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x43b82d
lea eax, [esp + 0x124]
push eax
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
lea eax, [esp + 0xb0]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235aa
push edi
call fcn.00489bb0
add esp, 4
mov byte [esp + 0x28c4], 0x1e
mov ecx, esp
mov dword [esp + 0x20], esp
push str.EngineVersion
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x1f
lea eax, [esp + 0x144]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c8], 0x1d
call fcn.0046d080
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235bf
push 0x4000
push 3
pop esi
push ecx
mov byte [esp + 0x28c4], 0x20
lea eax, [esp + 0x130]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235aa
mov ecx, esi
lea ebx, [esp + 0x410]
mov byte [esp + 0x28c4], 0x1d
call fcn.004812b0
test eax, eax
je 0x43efc5
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x43b82d
lea eax, [esp + 0x404]
call fcn.00480740
push dword [0x50c82c]
lea eax, [esp + 0xa8]
push ecx
mov dword [esp + 0x18], esp
mov esi, esp
push dword [esp + 0xa8]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x260]
push eax
call fcn.00489bb0
pop ecx
pop ecx
mov byte [esp + 0x28c4], 0x21
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00468700
add esp, 0x10
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43cc64
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004235aa
push 0x2e
lea ecx, [esp + 0x24]
mov dword [esp + 0x28bc], 0x122
call fcn.00433c32
push eax
lea eax, [esp + 0x1e4]
push eax
lea ecx, [esp + 0x28]
call fcn.004237ae
push str..new.exe
push eax
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x28c4], 0x23
call fcn.0042380e
add esp, 0xc
mov byte [esp + 0x28b8], 0x25
mov ecx, dword [esp + 0x1e0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x234]
call fcn.004235bf
push esi
mov byte [esp + 0x28bc], 0x26
push dword [esp + 0xb0]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43f0f9
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xb4]
push dword [esp + 0x2c]
jmp 0x43ea26
push 1
push 1
push ecx
lea eax, [esp + 0xb8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x718]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0x27
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x718]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0x794], esi
jne 0x43f16a
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43edbe
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Main
call fcn.004235bf
push esi
push 3
push ecx
mov byte [esp + 0x28c8], 0x28
lea eax, [esp + 0x240]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x71c]
push eax
mov byte [esp + 0x28cc], 0x27
call fcn.004814d0
cmp eax, esi
je 0x43f1ca
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEINI
jmp 0x43b82d
lea eax, [esp + 0x70c]
call fcn.00480740
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xb4]
push str.Successfully_changed_INI._nNew_package_saved_in:_n_s
jmp 0x43d4e6
lea esi, [esp + 0x5b4]
call fcn.0042cc47
mov dword [esp + 0x28b8], 0x129
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
push dword [edi + esi*4 + 4]
lea ecx, [esp + 0x5fc]
call fcn.00423618
push dword [edi + esi*4 + 8]
lea ecx, [esp + 0x5d4]
call fcn.00423618
push dword [edi + esi*4 + 0xc]
lea ecx, [esp + 0x5cc]
call fcn.00423618
push eax
lea ecx, [esp + 0x5c4]
call fcn.00423603
push dword [edi + esi*4 + 0x10]
lea ecx, [esp + 0x604]
call fcn.00423618
push dword [edi + esi*4 + 0x14]
lea ecx, [esp + 0x600]
call fcn.00423618
lea eax, [esp + 0xeec]
push eax
lea edi, [esp + 0x5b8]
call fcn.00493fa0
lea eax, [esp + 0xeec]
push eax
mov byte [esp + 0x28bc], 0x2a
call fcn.00494140
test eax, eax
je 0x43f2e8
xor esi, esi
mov eax, 0x4eaef0
cmp dword [esp + 0xeec], esi
jne 0x43f2b2
mov eax, 0x4eaef8
push dword [esp + 0xef8]
push dword [esp + 0xef8]
push eax
lea eax, [esp + 0x1f4]
push str.Need_to_update:__s_nVersion:__s_nBuildUID:__s_n
push eax
call fcn.00468700
add esp, 0x14
push esi
push str.Server_test:
push dword [esp + 0x1f0]
jmp 0x43dde0
push 0
push str.Server_test:
push str.Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
jmp 0x43b838
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43f337
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push esi
push edi
call fcn.00431cfe
pop ecx
jmp 0x43b9e2
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x7a8]
push eax
call fcn.0047f520
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x28c4], 0x12b
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x2c
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x2d
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0x2e
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x7b8]
push eax
mov byte [esp + 0x28d8], 0x2b
call fcn.0042ffbd
add esp, 0x20
lea ecx, [esp + 0x79c]
call fcn.0042f348
lea eax, [esp + 0x79c]
call fcn.00480740
mov dword [esp + 0x28b8], 4
lea eax, [esp + 0x79c]
jmp 0x43c53e
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xc28]
push eax
call fcn.0047f520
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x28c4], 0x12f
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x30
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x31
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0x32
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xc38]
push eax
mov byte [esp + 0x28d8], 0x2f
call fcn.0042ffbd
add esp, 0x20
push esi
push esi
push esi
push ecx
mov dword [esp + 0x20], esp
mov edi, esp
push esi
push esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.VirtReg.dat
call fcn.004235bf
push 1
mov ecx, edi
call fcn.0047bc30
add esp, 0x14
call fcn.00493240
add esp, 0x10
lea eax, [esp + 0xc1c]
call fcn.00480740
mov dword [esp + 0x28b8], 4
lea eax, [esp + 0xc1c]
jmp 0x43c53e
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x148]
call fcn.004235bf
mov dword [esp + 0x28b8], 0x133
mov eax, dword [esp + 0x2c]
push dword [eax + edi*4 + 8]
lea ecx, [esp + 0x8c]
call fcn.004235bf
push 0x10
mov byte [esp + 0x28bc], 0x34
push esi
push dword [esp + 0x14c]
call fcn.004b1fae
add esp, 8
mov edi, eax
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x8c]
push edi
push str.SetFileFlags:__0x_x____s_
push eax
call fcn.00468700
add esp, 0x10
call fcn.00439a1d
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xd48]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0x35
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xd48]
push eax
call fcn.0043a336
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x36
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x37
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0x38
mov ecx, esp
lea eax, [esp + 0x34]
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xd58]
push eax
mov byte [esp + 0x28d8], 0x35
call fcn.0042ffbd
call fcn.00474a30
mov ebx, 0x50fa0c
mov eax, ebx
call fcn.00488470
mov eax, dword [esp + 0xa8]
push esi
call fcn.004751a0
add esp, 0x24
cmp eax, esi
je 0x43f6b3
mov eax, dword [eax + 0x24]
mov dword [eax], edi
push dword [0x50fa0c]
mov eax, ebx
call fcn.004893b0
test eax, eax
je 0x43f69d
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x90]
push edi
push str.Success:_n__x___s
push eax
call fcn.00468700
add esp, 0x10
call fcn.0043a2bc
pop ecx
jmp 0x43f6d4
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str._SetFileFlags:_could_not_save_tree
push eax
call fcn.00468700
pop ecx
pop ecx
jmp 0x43f6cf
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x8c]
push str._SetFileFlags:_could_not_find__s
push eax
call fcn.00468700
add esp, 0xc
call fcn.00439a1d
pop ecx
mov eax, ebx
call fcn.00488480
lea eax, [esp + 0xd3c]
mov byte [esp + 0x28b8], 0x34
call fcn.00426682
mov ecx, dword [esp + 0x88]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x144]
jmp 0x43bd3d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.DbgZip
call fcn.004235bf
call fcn.00439a4d
mov dword [esp], str._DbgZip:
call fcn.004ae67a
mov edx, dword [esp + 0x2c]
pop ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x60]
call fcn.00423618
jmp 0x43b71c
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x688]
push eax
call fcn.0047f520
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x28c4], 0x139
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x3a
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x3b
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.004235bf
push 2
push ecx
mov byte [esp + 0x28d4], 0x3c
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x698]
push eax
mov byte [esp + 0x28d8], 0x39
call fcn.0042ffbd
add esp, 0x20
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x688]
push eax
call fcn.0043a336
lea eax, [esp + 0x68c]
push eax
push dword [esp + 0x5c]
mov ecx, 0x510190
call fcn.0043388f
add esp, 0x18
mov dword [esp + 0x28b8], 4
lea eax, [esp + 0x67c]
jmp 0x43c53e
push 1
xor edi, edi
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1220]
push eax
call fcn.0047f520
push 0xffffffffffffffff
push edi
push ecx
mov dword [esp + 0x28c4], 0x143
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x44
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x45
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0x46
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1230]
push eax
mov byte [esp + 0x28d8], 0x43
call fcn.0042ffbd
add esp, 0x20
lea esi, [esp + 0xf8]
call fcn.004856b0
mov byte [esp + 0x28b8], 0x47
mov dword [esp + 0x30], edi
jmp 0x43f97a
push dword [0x51019c]
lea eax, [esp + 0x26a8]
push eax
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x43f97a
xor edi, edi
cmp dword [esp + 0x22a0], edi
jbe 0x43f97a
lea esi, [esp + edi*8 + 0x22a4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x43f970
test byte [esp + edi*8 + 0x22a8], 3
je 0x43f970
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5101e8
call fcn.004235aa
push ecx
mov byte [esp + 0x28c0], 0x48
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x51019c
call fcn.004235aa
mov byte [esp + 0x28c0], 0x47
mov ebx, dword [esi]
call fcn.004361aa
pop ecx
pop ecx
inc edi
cmp edi, dword [esp + 0x22a0]
jb 0x43f91a
push 1
lea eax, [esp + 0x1e80]
push eax
lea eax, [esp + 0x38]
lea ebx, [esp + 0x100]
call fcn.00485180
test eax, eax
jne 0x43f8f6
xor esi, esi
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, ebx
call fcn.004856d0
mov dword [esp + 0x28b8], 4
lea eax, [esp + 0x1214]
jmp 0x43c53e
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1340]
push eax
call fcn.0047f520
push 0xffffffffffffffff
mov dword [esp + 0x28bc], 0x149
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x4a
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Vintegrate_
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x4b
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push esi
push ecx
mov byte [esp + 0x28d4], 0x4c
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1350]
push eax
mov byte [esp + 0x28d8], 0x49
call fcn.0042ffbd
add esp, 0x20
call fcn.0043a1f0
jmp 0x43b837
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push str._ProcessList:all
push dword [eax + ecx*4]
call fcn.004ae3c3
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
lea esi, [esp + 0xf8]
inc edi
call fcn.004856b0
mov dword [esp + 0x28b8], 0x14d
and dword [esp + 0x20], 0
lea ecx, [esp + 0x44]
call fcn.0042148a
xor eax, eax
test edi, edi
sete al
mov byte [esp + 0x28b8], 0x4e
mov dword [esp + 0x30], eax
jmp 0x43fd85
lea eax, [esp + 0x1c7c]
push eax
lea eax, [esp + 0x274]
push str._AppID_ws_n
push eax
call fcn.00468700
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28bc], 0x4f
call fcn.0042362d
mov byte [esp + 0x28b8], 0x4e
mov ecx, dword [esp + 0x270]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x1458]
lea eax, [esp + 0x1f4]
push str.____SerialId:__d_n
push eax
call fcn.00468700
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28bc], 0x50
call fcn.0042362d
mov byte [esp + 0x28b8], 0x4e
mov ecx, dword [esp + 0x1f0]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1870]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x23c]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00468700
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28bc], 0x51
call fcn.0042362d
mov byte [esp + 0x28b8], 0x4e
mov ecx, dword [esp + 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x1874]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x1fc]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00468700
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28bc], 0x52
call fcn.0042362d
mov byte [esp + 0x28b8], 0x4e
mov ecx, dword [esp + 0x1f8]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x258]
push str.____Processes:_n
push eax
call fcn.00468700
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28bc], 0x53
call fcn.0042362d
mov byte [esp + 0x28b8], 0x4e
mov ecx, dword [esp + 0x258]
add ecx, 0xfffffff0
call fcn.0042101a
xor edi, edi
cmp dword [esp + 0x1878], edi
jbe 0x43fd85
push 0x4df5f8
lea ecx, [esp + 0xb8]
call fcn.004235bf
mov byte [esp + 0x28b8], 0x54
lea ebx, [esp + edi*8 + 0x187c]
push dword [ebx]
lea esi, [esp + 0xb8]
call fcn.00466630
pop ecx
test eax, eax
jne 0x43fc89
push 0x4e1e20
mov ecx, esi
call fcn.00423618
push 0x5c
push ecx
lea eax, [esp + 0xbc]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x248]
push eax
call fcn.00468c10
add esp, 0xc
mov byte [esp + 0x28b8], 0x55
push dword [eax]
lea eax, [esp + 0x204]
push dword [ebx]
push str._______wd:__ws
push eax
call fcn.00468700
add esp, 0x10
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28bc], 0x56
call fcn.0042362d
mov ecx, dword [esp + 0x200]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28b8], 0x54
mov ecx, dword [esp + 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + edi*8 + 0x1880]
test eax, eax
je 0x43fd52
push eax
lea eax, [esp + 0x20c]
push str._0x_x_
push eax
call fcn.00468700
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28bc], 0x57
call fcn.0042362d
mov byte [esp + 0x28b8], 0x54
mov ecx, dword [esp + 0x208]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4de144
lea ecx, [esp + 0x48]
call fcn.00429234
mov byte [esp + 0x28b8], 0x4e
mov ecx, dword [esp + 0xb4]
add ecx, 0xfffffff0
call fcn.0042101a
inc edi
cmp edi, dword [esp + 0x1878]
jb 0x43fc4a
push dword [esp + 0x30]
lea eax, [esp + 0x1458]
push eax
lea eax, [esp + 0x28]
lea ebx, [esp + 0x100]
call fcn.00485180
test eax, eax
jne 0x43fad2
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
cmp dword [esp + 0x28], eax
jne 0x43fdd2
push str.No_active_virtual_apps
call fcn.004235bf
call fcn.0043a2bc
pop ecx
pop ecx
jmp 0x43f2fc
lea eax, [esp + 0x4c]
push eax
call fcn.004235aa
jmp 0x43cc5d
lea eax, [esp + 0x268]
push eax
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x44]
call fcn.0042c2bd
lea eax, [esp + 0x268]
push eax
call fcn.0042c3fa
jmp 0x43b837
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AutoUpdate
call fcn.004235bf
call fcn.00439a4d
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43fe50
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x5101d4]
push str.AutoUpdate_s
push eax
call fcn.00468700
add esp, 0xc
call fcn.00439a4d
mov ecx, 0x5101d4
mov dword [esp], str.https:__online.cameyo.com
call fcn.00423618
push str.0000
mov ecx, 0x5101d8
call fcn.00423618
mov ecx, edi
call fcn.00496370
jmp 0x43b9e3
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.VirtRegSyncExport
call fcn.004235bf
call fcn.00439a4d
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43fee4
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
call fcn.004374eb
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00468700
add esp, 0xc
jmp 0x43b9dd
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartStreaming:AppIDSkype
call fcn.004235bf
call fcn.004263ad
jmp 0x43f33e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x43ff54
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
xor ebx, ebx
call fcn.004235bf
push esi
push ecx
mov dword [esp + 0x28c4], 0x15a
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x5101e8]
xor edi, edi
push str._select___s_
push eax
call fcn.00468700
add esp, 8
mov byte [esp + 0x28c8], 0x5b
mov ecx, esp
mov dword [esp + 0x44], esp
push str.explorer.exe
call fcn.004235bf
mov dword [esp + 0x28c8], 4
call fcn.00466850
add esp, 0x10
xor esi, esi
jmp 0x43b9e3
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegister
call fcn.004235bf
call fcn.00439a4d
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x44000b
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
call fcn.00428fb8
mov ebx, eax
cmp ebx, esi
jne 0x44002d
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_mount_virtual_registry
jmp 0x43b82d
call fcn.00474a30
push dword [0x50c82c]
push ebx
push edi
call fcn.004229b9
add esp, 0xc
push dword [0x50c82c]
mov edi, eax
cmp edi, esi
jne 0x44005c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Success
jmp 0x44006d
cmp edi, 5
jne 0x44007b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_register
call fcn.004235bf
call fcn.0043a2bc
pop ecx
pop ecx
jmp 0x4400c3
lea eax, [esp + 0x214]
push edi
push eax
call fcn.0046fec0
add esp, 4
mov dword [esp + 0x28c0], 0x15c
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_registering_services:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x210]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
jmp 0x43b838
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStart
call fcn.004235bf
call fcn.00439a4d
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x440112
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
mov ecx, edi
call fcn.004231df
push dword [0x50c82c]
mov edi, eax
cmp edi, esi
je 0x44004e
cmp edi, 5
jne 0x44013f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_start
jmp 0x44006d
lea eax, [esp + 0x24c]
push edi
push eax
call fcn.0046fec0
add esp, 4
mov dword [esp + 0x28c0], 0x15d
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_starting_services:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x248]
jmp 0x4400bb
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegisterStart
call fcn.004235bf
call fcn.00439a4d
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x4401cd
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
call fcn.00428fb8
mov ebx, eax
cmp ebx, esi
jne 0x4401ea
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x440023
call fcn.00474a30
push dword [0x50c82c]
push ebx
push edi
call fcn.004229b9
add esp, 0xc
mov ebx, str.Failed_registering_services:__s
cmp eax, 5
jne 0x440229
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_register
call fcn.004235bf
call fcn.0043a2bc
pop ecx
pop ecx
jmp 0x440282
cmp eax, esi
je 0x440282
push dword [0x50c82c]
push eax
lea eax, [esp + 0x220]
push eax
call fcn.0046fec0
add esp, 4
mov dword [esp + 0x28c0], 0x15e
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push ebx
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov dword [esp + 0x28b8], 4
mov ecx, dword [esp + 0x218]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, edi
call fcn.004231df
push dword [0x50c82c]
mov edi, eax
cmp edi, esi
je 0x44004e
cmp edi, 5
je 0x440061
lea eax, [esp + 0x264]
push edi
push eax
call fcn.0046fec0
add esp, 4
mov dword [esp + 0x28c0], 0x15f
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push ebx
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x260]
jmp 0x4400bb
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStop
call fcn.004235bf
call fcn.00439a4d
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x44032c
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push esi
mov ecx, edi
call fcn.00422d87
mov edi, eax
pop ecx
push dword [0x50c82c]
cmp edi, esi
je 0x44004e
cmp edi, 5
jne 0x44035b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_stop
jmp 0x44006d
lea eax, [esp + 0x1c4]
push edi
push eax
call fcn.0046fec0
add esp, 4
mov dword [esp + 0x28c0], 0x160
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_stopping_services:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c0]
jmp 0x4400bb
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRemove
call fcn.004235bf
call fcn.00439a4d
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
mov edi, 0x510190
push edi
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x4403e9
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push 1
mov ecx, edi
call fcn.00422d87
mov edi, eax
pop ecx
push dword [0x50c82c]
cmp edi, esi
je 0x44004e
cmp edi, 5
jne 0x440419
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_remove
jmp 0x44006d
lea eax, [esp + 0x1c8]
push edi
push eax
call fcn.0046fec0
add esp, 4
mov dword [esp + 0x28c0], 0x161
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_removing_services:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c4]
jmp 0x4400bb
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Cameyo.exe__UpgradePkg_
call fcn.004235bf
call fcn.00439a4d
pop ecx
lea ecx, [esp + 0xc4]
call fcn.0042148a
mov byte [esp + 0x28b8], 0x64
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4]
lea ecx, [esp + 0xc4]
call fcn.004235bf
push ecx
mov byte [esp + 0x28bc], 0x65
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.0046b080
pop ecx
cmp eax, esi
jne 0x4404e4
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc8]
push str._s_not_found
jmp 0x43b9be
push esi
lea eax, [esp + 0xc8]
push eax
push ecx
lea eax, [esp + 0xcc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28c8], 0x66
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004671a0
pop ecx
mov byte [esp + 0x28c8], 0x65
call fcn.00437801
add esp, 0x10
push dword [0x50c82c]
cmp eax, esi
jne 0x440549
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xcc]
push 0x4e9f64
jmp 0x43d4e6
push eax
lea eax, [esp + 0x2e0]
push eax
call fcn.0046fec0
add esp, 4
mov byte [esp + 0x28c0], 0x67
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xcc]
push dword [eax]
push str._s:__s
push ecx
jmp 0x43ea2c
push str.Vintegrate:
lea ecx, [esp + 0xd0]
call fcn.004235bf
mov dword [esp + 0x28b8], 0x13d
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._VintegrateRecursive
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
je 0x4405d4
push 0x4eb180
call fcn.004ae5d0
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
jne 0x4405e5
push str.VintegrateRecursive:
lea ecx, [esp + 0xd0]
call fcn.00423618
push str._Windows_Explorer.exe
lea ecx, [esp + 0xe4]
call fcn.004235bf
mov byte [esp + 0x28b8], 0x3e
mov edi, dword [edi]
push 0x3a
push edi
call fcn.004af128
pop ecx
pop ecx
cmp eax, esi
je 0x44061e
add eax, 2
push eax
lea ecx, [esp + 0xe4]
call fcn.00423618
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1070]
push eax
call fcn.0047f520
push 0xffffffffffffffff
mov byte [esp + 0x28bc], 0x3f
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov eax, esp
mov byte [esp + 0x28c8], 0x40
mov dword [esp + 0x24], esp
lea ecx, [esp + 0xf0]
push ecx
lea ecx, [esp + 0xe0]
push ecx
push eax
call fcn.00429a41
add esp, 8
mov byte [esp + 0x28cc], 0x41
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push esi
push ecx
mov byte [esp + 0x28d4], 0x42
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1080]
push eax
mov byte [esp + 0x28d8], 0x3f
call fcn.0042ffbd
add esp, 0x20
lea eax, [esp + 0x1064]
mov byte [esp + 0x28b8], 0x3e
call fcn.00426682
mov ecx, dword [esp + 0xe0]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xcc]
jmp 0x43bd3d
lea ecx, [esp + 0x20]
call fcn.0042148a
lea ecx, [esp + 0xe4]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x28bc], 0xef
call fcn.004235aa
mov byte [esp + 0x28b8], 0xf0
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x44074c
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x64]
call fcn.00423618
push 1
push esi
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xb08]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0xf1
push dword [0x50c82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xb08]
push eax
call fcn.0043a336
add esp, 0x10
cmp dword [esp + 0xb84], esi
jne 0x4407b8
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x24]
call fcn.004264f8
pop ecx
xor esi, esi
lea eax, [esp + 0xe4]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.004235bf
push 3
lea edi, [esp + 0xb08]
call fcn.00481b30
mov eax, dword [esp + 0xe4]
cmp dword [eax - 0xc], esi
jne 0x4407f9
push str.Cannot_obtain_INI_info_from_resource__n
lea ecx, [esp + 0x24]
call fcn.004297af
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x24]
call fcn.00424149
push esi
push 0x4e1da4
push dword [esp + 0x28]
jmp 0x43dde0
lea eax, [esp + 0x20]
push eax
call fcn.004673c0
mov byte [esp + 0x28bc], 0xa6
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
lea edi, [eax + ecx*4]
mov dword [esp], 0x4ea550
call fcn.004ae5d0
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004b0be6
add esp, 0xc
test eax, eax
jne 0x440878
push dword [edi]
lea ecx, [esp + 0x24]
call fcn.00423618
push 0x4ea550
call fcn.004ae5d0
pop ecx
push esi
lea ecx, [esp + 0x24]
push ecx
call fcn.00423656
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x4408ab
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push 0x5101a0
lea ecx, [esp + 0x64]
call fcn.004235aa
lea eax, [esp + 0x54]
push eax
push 0x4e2540
lea eax, [esp + 0x7c]
mov byte [esp + 0x28c0], 0xa7
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x60], esi
call fcn.00429249
jmp 0x440e35
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x28]
call fcn.0042148a
lea ecx, [esp + 0x2c]
call fcn.0042148a
lea ecx, [esp + 0x3c]
call fcn.0042148a
push 0x3e
push ecx
mov byte [esp + 0x28c0], 0xac
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov dword [esp + 0x84], esi
lea edi, [esp + 0x84]
call fcn.004235aa
lea eax, [esp + 0x1d4]
push eax
mov ecx, edi
call fcn.0046c620
add esp, 0xc
mov byte [esp + 0x28b8], 0xad
call fcn.00423705
push eax
lea ecx, [esp + 0x28]
call fcn.00423603
mov byte [esp + 0x28b8], 0xac
mov ecx, dword [esp + 0x1cc]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
jne 0x4409bf
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28b8], 0xa7
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x440e1d
push 0x3e
push ecx
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x84]
call fcn.004235aa
lea eax, [esp + 0x1dc]
push eax
mov ecx, edi
call fcn.0046c620
add esp, 0xc
mov byte [esp + 0x28b8], 0xae
call fcn.00423705
push eax
lea ecx, [esp + 0x2c]
call fcn.00423603
mov byte [esp + 0x28b8], 0xac
mov ecx, dword [esp + 0x1d4]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
je 0x440976
push 0x3e
push ecx
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1e4]
push eax
mov ecx, edi
call fcn.0046c620
add esp, 0xc
mov byte [esp + 0x28b8], 0xaf
call fcn.00423705
push eax
lea ecx, [esp + 0x30]
call fcn.00423603
mov byte [esp + 0x28b8], 0xac
mov ecx, dword [esp + 0x1dc]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
jne 0x440a8a
push ebx
lea ecx, [esp + 0x30]
call fcn.00423618
jmp 0x440ae4
push 0x3e
push ecx
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x84]
call fcn.004235aa
lea eax, [esp + 0x1ec]
push eax
mov ecx, edi
call fcn.0046c620
add esp, 0xc
mov byte [esp + 0x28b8], 0xb0
call fcn.00423705
push eax
lea ecx, [esp + 0x40]
call fcn.00423603
mov byte [esp + 0x28b8], 0xac
mov ecx, dword [esp + 0x1e4]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
jne 0x440af5
push ebx
lea ecx, [esp + 0x40]
call fcn.00423618
push dword [esp + 0x24]
lea eax, [esp + 0xb4]
push str._exec___s_
push eax
call fcn.00468700
add esp, 0xc
mov byte [esp + 0x28b8], 0xb1
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], esi
je 0x440b41
push 0x4e33ac
lea ecx, [esp + 0xb4]
call fcn.00429234
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xb4]
call fcn.0042362d
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push ecx
mov edi, esp
mov byte [esp + 0x28c0], 0xb2
mov dword [esp + 0x1c], esp
push 0x5c
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235aa
push edi
call fcn.00468c10
lea eax, [esp + 0x124]
add esp, 0xc
push eax
mov byte [esp + 0x28c4], 0xb1
call fcn.00428b7b
add esp, 8
mov byte [esp + 0x28bc], 0xb3
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ddc20
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0xb4
lea eax, [esp + 0x118]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28c4], 0xb5
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x5101e8
call fcn.004235aa
lea edi, [esp + 0xe0]
mov byte [esp + 0x28c4], 0xb3
call fcn.00468250
add esp, 8
mov byte [esp + 0x28bc], 0xb6
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ddc20
call fcn.004235bf
push ecx
mov eax, esp
mov byte [esp + 0x28c0], 0xb7
mov dword [esp + 0x1c], esp
push str..lnk
lea ecx, [esp + 0x38]
push ecx
push eax
call fcn.0042380e
add esp, 8
mov byte [esp + 0x28c4], 0xb8
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004235aa
lea edi, [esp + 0x1f8]
mov byte [esp + 0x28c4], 0xb6
call fcn.00468250
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x1ec]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0xd8]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.0046b080
pop ecx
cmp eax, esi
je 0x440ca0
lea eax, [esp + 0xd4]
jmp 0x440cba
push esi
lea ecx, [esp + 0x154]
call fcn.004235bf
mov byte [esp + 0x28b8], 0xb9
or dword [esp + 0x44], 2
mov esi, dword [eax]
push 0
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
push ecx
mov dword [esp + 0x28c4], 0xba
lea eax, [esp + 0xbc]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28c8], 0xbb
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28cc], 0xbc
mov dword [esp + 0x30], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4ddc20
call fcn.004235bf
push ecx
mov eax, esp
mov byte [esp + 0x28d4], 0xbd
mov dword [esp + 0x98], esp
push str..lnk
lea ecx, [esp + 0x4c]
push ecx
push eax
call fcn.0042380e
add esp, 8
mov byte [esp + 0x28d8], 0xbe
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28d8], 0xbc
call fcn.00468250
add esp, 0xc
mov byte [esp + 0x28cc], 0xb9
call fcn.00492020
add esp, 0x14
mov dword [esp + 0x28b8], 0xb6
test byte [esp + 0x44], 2
je 0x440daa
mov ecx, dword [esp + 0x150]
and dword [esp + 0x44], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xd4]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x110]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xb0]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28b8], 0xa7
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
xor esi, esi
lea eax, [esp + 0x54]
push eax
push 0x4e2540
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x6c]
call fcn.00429249
cmp dword [esp + 0x54], 0xffffffff
jne 0x4408e2
mov byte [esp + 0x28b8], 0xa7
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str.Shortcuts_created_for__s.
jmp 0x43d4e6
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004235aa
mov byte [esp + 0x28b8], 0x96
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._FullIntegrate
push dword [edi]
mov dword [esp + 0x5c], edi
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x44105e
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push 0x510190
call fcn.004283b0
pop ecx
pop ecx
test al, al
jne 0x440edf
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b881
push 0x5101e8
lea ecx, [esp + 0x24]
call fcn.004235aa
mov byte [esp + 0x28b8], 0x97
cmp dword [esp + 0x48], esi
je 0x440f44
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x51019c
call fcn.004235aa
lea eax, [esp + 0x15c]
push eax
call fcn.004377aa
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x28bc], 0x98
call fcn.00423603
mov byte [esp + 0x28b8], 0x97
mov ecx, dword [esp + 0x158]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4ddc20
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0x99
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x51019c]
push str._s.host.exe
push eax
call fcn.00468700
add esp, 8
mov byte [esp + 0x28c4], 0x9a
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004235aa
lea edi, [esp + 0x16c]
mov byte [esp + 0x28c4], 0x97
call fcn.00468250
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x28bc], 0x9b
call fcn.00423603
mov byte [esp + 0x28b8], 0x97
mov ecx, dword [esp + 0x160]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0x20]
call fcn.0046b160
test eax, eax
jne 0x440ff4
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_create_virtual_repository
jmp 0x43b82d
lea eax, [esp + 0x168]
push eax
call fcn.004671a0
mov eax, dword [eax]
pop ecx
push 0
push dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x168]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], 0
je 0x441048
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_executable_to_repository
jmp 0x43b82d
lea ecx, [esi - 0x10]
mov byte [esp + 0x28b8], 0x96
call fcn.0042101a
mov edi, dword [esp + 0x54]
xor esi, esi
push 1
push esi
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xb98]
push eax
call fcn.0047f520
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x28c4], 0x9c
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x9d
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x9e
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.004235bf
push 2
push ecx
mov byte [esp + 0x28d4], 0x9f
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0xba8]
push eax
mov byte [esp + 0x28d8], 0x9c
call fcn.0042ffbd
push str._Integrate:once
push dword [edi]
call fcn.004ae3c3
add esp, 0x28
mov edi, str.SoftwareVOS_s
test eax, eax
jne 0x441242
push ebx
lea ecx, [esp + 0x94]
call fcn.004235bf
push esi
push esi
push esi
push ecx
mov byte [esp + 0x28c8], 0xa0
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Registered
lea ebx, [esp + 0xa4]
call fcn.004235bf
mov byte [esp + 0x28c8], 0xa1
push dword [0x51019c]
lea eax, [esp + 0x184]
push edi
push eax
call fcn.00468700
add esp, 8
mov byte [esp + 0x28cc], 0xa2
or dword [esp + 0x58], 1
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Integrated
push eax
push ecx
call fcn.0042380e
add esp, 0xc
mov dword [esp + 0x28cc], 0xa3
call fcn.0047b220
push eax
mov byte [esp + 0x28d0], 0xa4
call fcn.004694d0
add esp, 0x18
test eax, eax
je 0x4411b4
mov eax, dword [esp + 0x90]
cmp dword [eax - 0xc], 0
je 0x4411b4
mov bl, 1
jmp 0x4411b6
xor bl, bl
mov dword [esp + 0x28b8], 0xa0
test byte [esp + 0x44], 1
je 0x4411d7
mov ecx, dword [esp + 0x170]
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x441229
push str.Success
lea eax, [esp + 0x94]
call fcn.00423642
push ecx
test eax, eax
mov dword [esp + 0x14], esp
mov eax, esp
jne 0x44120e
push str._Integrate:once:_already_registered_successfully._Quitting.
push eax
call fcn.00468700
pop ecx
pop ecx
call fcn.00439a1d
jmp 0x43cc63
push dword [esp + 0x94]
push str._Integrate:once:_already_attempted_registration_before__but_failed:__s._Trying_integration_again.
push eax
call fcn.00468700
add esp, 0xc
call fcn.00439a1d
pop ecx
mov byte [esp + 0x28b8], 0x9c
mov ecx, dword [esp + 0x90]
add ecx, 0xfffffff0
call fcn.0042101a
xor esi, esi
xor eax, eax
cmp dword [esp + 0x48], esi
push esi
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0xa5
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x51019c]
push edi
push eax
call fcn.00468700
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x28cc], 0x9c
call fcn.004699f0
add esp, 0x14
lea eax, [esp + 0xb8c]
push eax
push dword [esp + 0x4c]
mov ecx, 0x510190
call fcn.0043388f
pop ecx
pop ecx
lea eax, [esp + 0xb8c]
call fcn.00480740
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51019c]
push str._s_is_now_integrated_into_your_system.
jmp 0x43d4e6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00466e50
test eax, eax
jne 0x44134b
mov eax, dword [esp + 0x2c]
push esi
push esi
push esi
push ecx
mov edi, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [eax]
call fcn.004235bf
push edi
call fcn.0046e850
add esp, 4
mov byte [esp + 0x28cc], 0x3c
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28cc], 4
call fcn.004669c0
add esp, 0x14
cmp eax, esi
jne 0x43b837
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43b828
call fcn.00467150
test eax, eax
jne 0x441366
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43aa02
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push 0x4e9a74
mov dword [esp + 0x58], edi
call fcn.004ae5d0
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004b0be6
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x18]
sbb edi, edi
push eax
lea ecx, [esp + 0x64]
inc edi
call fcn.004235aa
push ecx
mov byte [esp + 0x28bc], 0x3d
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0x3e
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x8c]
push eax
mov byte [esp + 0x28c4], 0x3d
call fcn.00468a50
add esp, 0xc
mov byte [esp + 0x28b8], 0x3f
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x54]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.004235bf
lea eax, [esp + 0xc0]
push eax
call fcn.0046e850
pop ecx
pop ecx
push 1
push esi
push ecx
mov byte [esp + 0x28c4], 0x40
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x530]
push eax
call fcn.0047f520
mov byte [esp + 0x28b8], 0x41
push dword [0x50c82c]
cmp dword [esp + 0x5b0], esi
jne 0x44147a
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x20]
push str.Cannot_load_newly_created_package__s
jmp 0x43b9be
push 1
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x530]
push eax
call fcn.0043a336
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28c8], 0x42
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235bf
push ecx
mov byte [esp + 0x28cc], 0x43
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235aa
push 2
push ecx
mov byte [esp + 0x28d4], 0x44
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x540]
push eax
mov byte [esp + 0x28d8], 0x41
call fcn.0042ffbd
push dword [0x51019c]
lea eax, [esp + 0xcc]
push dword [0x5101e8]
push str._sAppVirtDll__s.dll
push eax
call fcn.00468700
add esp, 0x2c
mov byte [esp + 0x28bc], 0x45
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.00425b4c
pop ecx
cmp eax, esi
je 0x4415b3
push dword [0x50c82c]
cmp eax, 0x11
jne 0x441575
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00468700
pop ecx
pop ecx
jmp 0x43b832
cmp eax, 0x12
jne 0x441588
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x441568
push eax
lea eax, [esp + 0x2e8]
push eax
call fcn.0046fec0
add esp, 4
mov byte [esp + 0x28c0], 0x46
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x43c2dc
push dword [esp + 0xbc]
lea eax, [esp + 0x17c]
push str._exec__s
push eax
call fcn.00468700
mov eax, dword [eax]
add esp, 0xc
push esi
push esi
push eax
push dword [esp + 0x24]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x178]
xor ebx, ebx
cmp eax, 0x20
setg bl
add ecx, 0xfffffff0
call fcn.0042101a
cmp ebx, esi
je 0x441645
cmp edi, esi
je 0x44160d
push 1
push 0x4de148
push str.Installation_launched_in_virtual_mode..._nWhen_installation_is_done__click_OK_and_Cameyo_will_turn_it_into_a_virtual_package._nInstallation_will_not_truly_install_anything_on_your_hard_drive__it_is_simulated_.
jmp 0x441618
push esi
push 0x4de148
push str.When_installation_is_done__click_OK.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x441645
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.00425bd3
pop ecx
push 0x14
jmp 0x43b838
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
call fcn.00425bd3
pop ecx
cmp eax, esi
je 0x4416c0
push dword [0x50c82c]
cmp eax, 0x11
jne 0x44167f
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x441568
cmp eax, 0x12
jne 0x441695
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x441568
push eax
lea eax, [esp + 0x2e4]
push eax
call fcn.0046fec0
add esp, 4
mov byte [esp + 0x28c0], 0x47
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x43c2dc
cmp ebx, esi
jne 0x4416e2
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc4]
push str.Failed_executing__s
jmp 0x43b9be
mov ebx, dword [esp + 0x60]
cmp edi, esi
je 0x4417c6
call fcn.0042bd82
push 0x407
mov edi, 0x510190
call fcn.00484750
pop ecx
push esi
push dword [esp + 0x88]
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x84]
jne 0x44172f
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c1f6
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
call fcn.00435bc7
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, esi
jne 0x44183c
push dword [0x50c82c]
lea eax, [esp + 0x88]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x18c]
push eax
call fcn.00468c10
add esp, 8
mov byte [esp + 0x28c0], 0x48
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov byte [esp + 0x28b8], 0x45
mov ecx, dword [esp + 0x180]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
call fcn.00484750
pop ecx
lea eax, [esp + 0x524]
call fcn.00480740
push dword [0x50c82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x8c]
push 0x4e9f64
push eax
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0xa8]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x524]
mov byte [esp + 0x28b8], 0x40
call fcn.00426682
mov ecx, dword [esp + 0xbc]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x84]
add ecx, 0xfffffff0
jmp 0x43c281
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x30], 0x10
push dword [0x50c82c]
jne 0x441862
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c2a9
push dword [esp + 0x34]
lea eax, [esp + 0x2ac]
push eax
call fcn.0046fec0
add esp, 4
mov byte [esp + 0x28c0], 0x49
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c2d5
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x48]
call fcn.0042148a
mov byte [esp + 0x28b8], 0x33
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._CreateDiff
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x4418d0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00423603
jmp 0x4418ea
push 0x4e9a30
call fcn.004ae5d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.00423618
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..mod
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0x34
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x190]
push eax
mov byte [esp + 0x28c4], 0x33
call fcn.00468a50
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x28bc], 0x35
call fcn.00423603
mov byte [esp + 0x28b8], 0x33
mov ecx, dword [esp + 0x188]
add ecx, 0xfffffff0
call fcn.0042101a
mov ebx, dword [esp + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
push esi
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x48]
jne 0x441988
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c1f6
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235aa
call fcn.00435bc7
pop ecx
pop ecx
mov dword [esp + 0x60], eax
cmp eax, esi
jne 0x4419ff
push dword [0x50c82c]
lea eax, [esp + 0x4c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x19c]
push eax
call fcn.00468c10
add esp, 8
mov byte [esp + 0x28c0], 0x36
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x190]
jmp 0x441bd3
push ebx
call edi
cmp dword [esp + 0x60], 0x10
push dword [0x50c82c]
jne 0x441a1b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c2a9
push dword [esp + 0x64]
lea eax, [esp + 0x2dc]
push eax
call fcn.0046fec0
add esp, 4
mov byte [esp + 0x28c0], 0x37
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c2d5
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x48]
call fcn.0042148a
mov byte [esp + 0x28b8], 0x26
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._LearnStreaming
push dword [edi]
call fcn.004ae3c3
pop ecx
pop ecx
test eax, eax
jne 0x441a89
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00423603
jmp 0x441aa3
push 0x4e980c
call fcn.004ae5d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.00423618
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.004235bf
push ecx
mov byte [esp + 0x28c0], 0x27
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1a0]
push eax
mov byte [esp + 0x28c4], 0x26
call fcn.00468a50
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x28bc], 0x28
call fcn.00423603
mov byte [esp + 0x28b8], 0x26
mov ecx, dword [esp + 0x198]
add ecx, 0xfffffff0
call fcn.0042101a
mov ebx, dword [esp + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
push esi
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x48]
jne 0x441b41
push dword [0x50c82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c1f6
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235aa
push ecx
mov byte [esp + 0x28c0], 0x29
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
mov byte [esp + 0x28c0], 0x26
call fcn.00435dae
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, esi
jne 0x441bec
push dword [0x50c82c]
lea eax, [esp + 0x4c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235aa
lea eax, [esp + 0x1ac]
push eax
call fcn.00468c10
add esp, 8
mov byte [esp + 0x28c0], 0x2a
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0043a2bc
pop ecx
pop ecx
mov ecx, dword [esp + 0x1a0]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [ebx - 0x10]
call fcn.0042101a
mov ecx, dword [esp + 0x24]
jmp 0x43bd3d
push ebx
call edi
push dword [0x50c82c]
lea eax, [esp + 0x2cc]
push dword [esp + 0x20]
push eax
call fcn.0046fec0
add esp, 4
mov byte [esp + 0x28c0], 0x2b
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x43c2dc
cmp dword [0x50fe58], esi
je 0x441c5a
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x5101d4]
push str.CLoaderApp:_waiting_for_LoaderCanQuit__AutoUpdate_s_
push eax
call fcn.00468700
add esp, 0xc
call fcn.00439a1d
pop ecx
push 0xffffffffffffffff
push dword [0x50fe58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CLoaderApp:_done._Bye_
call fcn.004235bf
call fcn.00439a1d
mov eax, dword [0x50c83c]
pop ecx
cmp eax, 0xa2c2a
je 0x43b837
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.CLoaderApp:_ExecWait:_g_LoaderExitCode_d
push ecx
call fcn.00468700
add esp, 0xc
call fcn.00439a1d
pop ecx
push dword [0x50c83c]
jmp 0x43b838