Function at 0x43670a
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Check os version
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Enumerate pe sections
Get file attributes
Get hostname
Get number of processors
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c400e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x70a4
call fcn.004aa4c0
mov eax, dword [0x4efc64]
xor eax, esp
mov dword [esp + 0x70a0], eax
push ebx
push esi
push edi
mov eax, dword [0x4efc64]
xor eax, esp
push eax
lea eax, [esp + 0x70b8]
mov dword fs:[0], eax
lea eax, [esp + 0xa4]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0xa8], 8
mov dword [esp + 0xac], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x50]
call fcn.0049f5a4
mov esi, 0x4cd12c
push esi
lea ecx, [esp + 0x84]
call fcn.00423416
push esi
lea ecx, [esp + 0x80]
mov dword [esp + 0x70c4], ebx
call fcn.00423416
xor edi, edi
push esi
lea ecx, [esp + 0x90]
inc edi
mov byte [esp + 0x70c4], 1
call fcn.00423416
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70c4], 2
call fcn.00460f60
pop ecx
lea eax, [esp + 0x78]
mov byte [esp + 0x70c0], 3
push eax
mov dword [esp + 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], ebx
call fcn.00460f60
pop ecx
push eax
mov ecx, 0x4f4b10
mov byte [esp + 0x70c4], 4
call fcn.0042345a
mov byte [esp + 0x70c0], 3
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x5c]
push eax
call fcn.00460f60
mov byte [esp + 0x70c4], 5
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
push 0x4d2588
push ecx
call fcn.00462050
add esp, 0xc
call fcn.00435ce9
pop ecx
mov byte [esp + 0x70c0], 3
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4f484c], eax
cmp dword [esp + 0x44], ebx
je 0x4371ba
cmp dword [esp + 0x78], edi
jle 0x4371ba
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], 2
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
push ecx
lea edi, [eax + ecx*4]
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [edi]
call fcn.00423416
call fcn.00435d19
mov dword [esp], 0x4d25a0
call fcn.004a4ce0
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
jne 0x436905
push 0x4d25a0
call fcn.004a4ce0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.0042346f
push str._Confirm
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x43691f
mov dword [esp + 0x20], 1
push str._Quiet
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x43693c
mov dword [0x4f1564], ebx
jmp 0x4371a4
push str._AllUsers
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x43698f
mov dword [esp + 0x4c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00460c10
test eax, eax
je 0x4372bf
call fcn.00460f10
test eax, eax
jne 0x4371a4
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Admin_rights_required
jmp 0x4372da
push str._ErrorsOnly
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x4369b0
mov dword [0x4f1564], 1
jmp 0x4371a4
push str._Wait
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x4369cc
or dword [esp + 0x54], 1
jmp 0x4371a4
push 0x4d266c
call fcn.004a4ce0
pop ecx
push eax
push str._Services:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
jne 0x436a34
push dword [edi]
lea ecx, [esp + 0x3c]
call fcn.00423416
push 0x4d266c
mov byte [esp + 0x70c4], 6
call fcn.004a4ce0
pop ecx
push ebx
lea ecx, [esp + 0x3c]
push ecx
call fcn.004234ad
push dword [esp + 0x38]
push str.CAMEYO_SERVICES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x70c0], 3
mov ecx, dword [esp + 0x38]
jmp 0x43719c
push str._Register
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x4372eb
push str._Stop
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x437396
push str._Remove
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x4374b3
push str._Remove:Proc
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x437797
push str._Remove:Reg
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43794f
push str._LearnStreaming
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43bd46
push 0x4d2c7c
call fcn.004a4ce0
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43bd46
push str._UpdateBasicSettings
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x436afa
mov dword [esp + 0x2c], 1
jmp 0x4371a4
push str._Repackage
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x437b12
push str._CreateDiff
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43bb88
push 0x4d2eb0
call fcn.004a4ce0
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43bb88
push str._exec
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x437ceb
push 0x4d2ef4
call fcn.004a4ce0
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43b61b
push 0x4d2f0c
call fcn.004a4ce0
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43b61b
push str._ShowStreaming
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x437e6b
push str._Break
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x437f54
push str._Unbreak
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x4384e4
push str._Integrate
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43b1d0
push str._Integrate:once
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43b1d0
push str._FullIntegrate
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43b1d0
push str._Unintegrate
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x438ba6
push str._CreateShortcuts
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43ab93
push 0x4d3940
call fcn.004a4ce0
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43ab93
push str._Perf
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x438bfb
push str._ExtractLog
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x438fbd
push str._ExtractAll
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x439140
push str._AutoUpdateXml
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x4391f4
push str._Info
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43933f
push str._EngineVer
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x436e3c
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x148]
push eax
call fcn.00426032
mov byte [esp + 0x70c0], 0xcb
cmp dword [esp + 0x1c8], ebx
je 0x4397ab
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push str._s.AppVirtDll.dll
push eax
call fcn.00462050
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.00461750
add esp, 4
mov byte [esp + 0x70c4], 0xcc
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 0xcd
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 2
lea eax, [esp + 0x148]
push eax
mov byte [esp + 0x70d0], 0xcc
call fcn.0047aea0
push dword [0x4f1564]
lea eax, [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00423401
lea eax, [esp + 0x64]
push eax
call fcn.00485de0
add esp, 4
mov byte [esp + 0x70c8], 0xce
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov byte [esp + 0x70c0], 0xcc
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
call fcn.00465760
pop ecx
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x13c]
push eax
mov byte [esp + 0x70c4], 3
call fcn.004260f1
jmp 0x4371a4
mov eax, dword [esp + 0x44]
push str._ChangeLoader
push dword [eax + 4]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x436e61
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x78], eax
jg 0x4397bd
push str._ChangeEngine
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x436e81
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x78], eax
jg 0x439ac2
push str._ChangeIni
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x436ea1
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x78], eax
jg 0x439dfb
push str._Debug
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x439f6d
push str._ForceMenu
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x436ed6
mov dword [esp + 0x58], 1
jmp 0x4371a4
push str._ShowTree
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a009
push str._DbgZip:
call fcn.004a4d8a
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43a0cd
push str._DbgNow
call fcn.004a4d8a
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43a110
push str._Vintegrate
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43aa23
push 0x4d4460
call fcn.004a4ce0
pop ecx
push eax
push str._Vintegrate:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43aa23
push str._VintegrateRecursive
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43aa23
push 0x4d44b8
call fcn.004a4ce0
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43aa23
push str._Vunintegrate
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a1ca
push str._Vmanager
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a357
push str._ProcessList
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a409
push str._GfxSvr
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x437040
call fcn.00434639
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov edi, 0x4f4ac8
call fcn.0047c8d0
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.0047c8d0
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4371a4
push 0x4d46d8
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x4370b5
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
call fcn.00423416
push ebx
push ecx
mov dword [esp + 0x70cc], 0x116
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Troubleshoot
xor edi, edi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x17
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00423401
mov dword [esp + 0x70d0], 3
call fcn.00460610
add esp, 0x10
xor ebx, ebx
jmp 0x4371a4
push str._Troubleshoot
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a705
push str._AutoUpdate
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a725
push str._VirtRegSyncExport
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a7ba
push str._StartStreaming
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a825
push 0x4d483c
call fcn.004a4ce0
pop ecx
push eax
push str._MakeStreamable:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
je 0x43a843
push str._JumpTo
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43a984
push 0x4cfa34
lea ecx, [esp + 0x80]
call fcn.0042346f
mov eax, dword [esp + 0x44]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.00423416
lea eax, [esp + 0x38]
push eax
call fcn.00467c40
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x70c4], 0x11f
call fcn.0042345a
mov dword [esp + 0x70c0], 3
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
inc dword [esp + 0x28]
cmp eax, dword [esp + 0x78]
jl 0x4368ac
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x388]
push eax
call fcn.00426032
mov dword [esp + 0x70c0], 0x120
push dword [esp + 0x54]
lea eax, [esp + 0x90]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push eax
or esi, 0xffffffff
call fcn.00423401
push ecx
mov byte [esp + 0x70cc], 0x21
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70d0], 0x22
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0xa4], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x23
push dword [esp + 0x68]
lea eax, [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
call fcn.00423401
mov ecx, esi
lea edx, [esp + 0x394]
mov byte [esp + 0x70d8], 0x20
call fcn.0042c04e
add esp, 0x18
cmp eax, 2
jne 0x43bf1e
call fcn.0043660d
push ebx
push dword [0x4f4ad0]
push str.Application_is_now_integrated_into_your_system
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x37c]
call fcn.00479af0
lea eax, [esp + 0x37c]
push eax
mov dword [esp + 0x70c4], 3
call fcn.004260f1
jmp 0x43733a
call fcn.00460c60
test eax, eax
jne 0x4372e4
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Elevation_failed
call fcn.00423416
call fcn.0043668a
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
mov esi, 0x4f4ac8
push esi
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x437321
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x4372da
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
mov ecx, esi
call fcn.0042bf1e
pop ecx
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
mov ecx, dword [esp + 0x70b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70a0]
xor ecx, esp
call fcn.004a4491
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x4373c9
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4f4b08
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 7
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4f4b10
call fcn.00423401
push ecx
mov byte [esp + 0x70cc], 8
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4f4b0c
call fcn.00423401
push ecx
mov byte [esp + 0x70d0], 9
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x4f4ad0
call fcn.00423401
mov byte [esp + 0x70d0], 3
call fcn.004329a5
add esp, 0x10
cmp eax, ebx
je 0x43745f
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Cannot_stop_application__s
push eax
call fcn.00462050
add esp, 0xc
jmp 0x4372df
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.00423416
call fcn.00435d19
pop ecx
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x7c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
jmp 0x437372
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x4374e6
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
mov eax, dword [0x4f4b0c]
cmp dword [eax - 0xc], ebx
jne 0x43750d
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Cannot_obtain_base_dir_for__s
jmp 0x437451
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x4f4b0c
push esi
call fcn.00423401
call fcn.00464ac0
pop ecx
cmp eax, ebx
jne 0x437546
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Application_is_not_deployed_on_this_machine:__s
jmp 0x437451
cmp dword [esp + 0x20], ebx
je 0x43756d
push 3
push dword [0x4f4ad0]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x43756d
push 0x14
pop ebx
jmp 0x437476
push ebx
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
mov dword [esp + 0x3c], ebx
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0xa
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4f4ad0]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.00462050
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x70d4], 3
call fcn.00463220
add esp, 0x14
cmp eax, ebx
je 0x437616
cmp dword [esp + 0x2c], ebx
je 0x437616
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00460c10
test eax, eax
jne 0x4375fb
call fcn.00460c60
test eax, eax
jne 0x4372e4
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4372d5
call fcn.00460f10
test eax, eax
jne 0x437616
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x436985
call fcn.0042fdae
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push str.Removing__s
push eax
call fcn.00462050
add esp, 0xc
call fcn.00435d19
pop ecx
lea ecx, [esp + 0x38]
call fcn.00421487
push 0x4cb098
mov byte [esp + 0x70c4], 0xb
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x44]
push eax
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4f4b08
call fcn.00423401
push ecx
mov byte [esp + 0x70dc], 0xc
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4f4b10
call fcn.00423401
push ecx
mov byte [esp + 0x70e0], 0xd
mov ecx, esp
mov dword [esp + 0x5c], esp
push esi
call fcn.00423401
push ecx
mov byte [esp + 0x70e4], 0xe
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4f4ad0
call fcn.00423401
mov byte [esp + 0x70e4], 0xb
call fcn.00432dd4
add esp, 0x20
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423401
call fcn.00464b00
pop ecx
cmp eax, ebx
je 0x437704
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x437451
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push edi
push eax
call fcn.00462050
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00463560
pop ecx
cmp eax, ebx
je 0x437747
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Registry_could_not_be_emptied_for__s
jmp 0x437451
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Removed_successfully
call fcn.00423416
call fcn.00435d19
pop ecx
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Application__s_removed_successfully
push eax
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x437476
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x4377ca
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
mov eax, dword [0x4f4b0c]
cmp dword [eax - 0xc], ebx
jne 0x4377e6
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4374fd
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4f4b0c
call fcn.00423401
call fcn.00464ac0
pop ecx
cmp eax, ebx
jne 0x43782d
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4b0c]
push dword [0x4f4ad0]
push str.Application_is_not_deployed_on_this_machine:__s_n_n__s_
push eax
call fcn.00462050
add esp, 0x10
jmp 0x4372df
cmp dword [esp + 0x20], ebx
je 0x437850
push 3
push dword [0x4f4ad0]
push str.Do_you_want_to_stop_the_application_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x437565
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push str.Removing_processes:__s
push eax
call fcn.00462050
add esp, 0xc
call fcn.00435d19
pop ecx
lea ecx, [esp + 0x2c]
call fcn.00421487
push 0x4cb098
mov byte [esp + 0x70c4], 0xf
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
push ebx
push 1
lea eax, [esp + 0x38]
push eax
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4f4b08
call fcn.00423401
push ecx
mov byte [esp + 0x70dc], 0x10
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4f4b10
call fcn.00423401
push ecx
mov byte [esp + 0x70e0], 0x11
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x4f4b0c
call fcn.00423401
push ecx
mov byte [esp + 0x70e4], 0x12
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4f4ad0
call fcn.00423401
mov byte [esp + 0x70e4], 0xf
call fcn.00432dd4
add esp, 0x20
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.00423416
call fcn.00435d19
pop ecx
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Application__s_stopped_successfully
push eax
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov ecx, dword [esp + 0x2c]
jmp 0x43778a
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x437982
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
mov eax, dword [0x4f4b0c]
cmp dword [eax - 0xc], ebx
jne 0x43799e
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4374fd
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, 0x4f4b0c
push esi
call fcn.00423401
call fcn.00464ac0
pop ecx
cmp eax, ebx
jne 0x4379cc
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43780e
cmp dword [esp + 0x20], ebx
je 0x4379ef
push 3
push dword [0x4f4ad0]
push str.Do_you_want_to_remove_the_applications_registry_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x437565
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push str.Removing_registry:__s
push eax
call fcn.00462050
add esp, 0xc
call fcn.00435d19
pop ecx
lea ecx, [esp + 0x2c]
call fcn.00421487
push 0x4cb098
mov byte [esp + 0x70c4], 0x13
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
push 1
push ebx
lea eax, [esp + 0x38]
push eax
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4f4b08
call fcn.00423401
push ecx
mov byte [esp + 0x70dc], 0x14
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4f4b10
call fcn.00423401
push ecx
mov byte [esp + 0x70e0], 0x15
mov ecx, esp
mov dword [esp + 0x5c], esp
push esi
call fcn.00423401
push ecx
mov byte [esp + 0x70e4], 0x16
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4f4ad0
call fcn.00423401
mov byte [esp + 0x70e4], 0x13
call fcn.00432dd4
add esp, 0x20
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push str.SoftwareVOS_s
push eax
call fcn.00462050
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00463560
pop ecx
cmp eax, ebx
je 0x437ade
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x437737
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Registry_removed_successfully
call fcn.00423416
call fcn.00435d19
pop ecx
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str.Application__ss_registry_removed_successfully
jmp 0x437936
lea ecx, [esp + 0x4c]
call fcn.00421487
lea ecx, [esp + 0x1c]
call fcn.00421487
mov byte [esp + 0x70c0], 0x1f
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x437b4c
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x50]
call fcn.0042346f
jmp 0x437b5a
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x50]
call fcn.0042345a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x20
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0x1f
call fcn.004623a0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x70c4], 0x21
call fcn.0042345a
mov byte [esp + 0x70c0], 0x1f
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x1c]
jne 0x437bf8
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00423401
jmp 0x4372df
push ebx
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70d0], 0x22
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x1f
call fcn.00430a1a
add esp, 0x10
mov dword [esp + 0x34], eax
cmp eax, ebx
jne 0x437ca3
push dword [0x4f1564]
lea eax, [esp + 0x20]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x40]
push eax
call fcn.00462560
add esp, 8
mov byte [esp + 0x70c8], 0x23
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
mov ecx, dword [esp + 0x4c]
jmp 0x43778a
push edi
call esi
mov edx, dword [esp + 0x34]
push dword [0x4f1564]
cmp edx, 0x10
jne 0x437cc6
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x4372da
lea eax, [esp + 0x14]
push eax
call fcn.00469060
mov byte [esp + 0x70c8], 0x24
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x437452
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax + edx*4]
call fcn.00423416
lea eax, [esp + 0x38]
push eax
call fcn.00467c40
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x90]
mov byte [esp + 0x70c4], 0x2c
call fcn.0042345a
push eax
lea ecx, [esp + 0x80]
call fcn.0042345a
push eax
lea ecx, [esp + 0x3c]
call fcn.00423401
mov byte [esp + 0x70c0], 0x2e
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x40]
call fcn.00423605
push 0x4d008c
push eax
call fcn.0042370f
pop ecx
pop ecx
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
lea ecx, [esp + 0x7c]
cmp byte [esp + 0x43], bl
je 0x437d8b
push 1
push 0x22
jmp 0x437d8e
push ebx
push 0x20
call fcn.00425613
mov edi, eax
cmp edi, 0xffffffff
je 0x437e0b
push edi
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x84]
call fcn.00423605
push 0x4cffa8
mov byte [esp + 0x70c4], 0x2f
call fcn.00430603
push eax
lea ecx, [esp + 0x80]
call fcn.0042345a
mov byte [esp + 0x70c0], 0x2e
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
lea ecx, [esp + 0x90]
lea eax, [edi + 1]
push ecx
call fcn.004234ad
lea eax, [esp + 0x8c]
call fcn.0042355c
push eax
lea ecx, [esp + 0x90]
call fcn.0042345a
jmp 0x437e33
push 0x4cffa8
lea eax, [esp + 0x3c]
call fcn.00430603
push eax
lea ecx, [esp + 0x80]
call fcn.0042345a
push esi
lea ecx, [esp + 0x90]
call fcn.0042346f
xor ecx, ecx
lea eax, [esp + 0x7c]
call fcn.004279f7
movzx eax, ax
cmp ax, 0x25
jne 0x437e52
lea eax, [esp + 0x7c]
push eax
call fcn.00471df0
pop ecx
mov byte [esp + 0x70c0], 3
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x4371ba
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ShowStreaming:
call fcn.00423416
call fcn.00435d19
pop ecx
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0xb8]
push eax
call fcn.00426032
push ebx
push ecx
mov byte [esp + 0x70c8], 0x3f
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x40
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x41
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00423401
push 2
push ecx
mov byte [esp + 0x70d8], 0x42
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00423401
mov ecx, edi
lea edx, [esp + 0xc4]
mov byte [esp + 0x70d8], 0x3f
call fcn.0042c04e
lea eax, [esp + 0xc4]
push eax
call fcn.0042bc04
add esp, 0x1c
lea eax, [esp + 0xac]
call fcn.00479af0
lea eax, [esp + 0xac]
mov byte [esp + 0x70c0], 3
push eax
call fcn.004260f1
jmp 0x437476
lea ecx, [esp + 0x20]
call fcn.00421487
mov byte [esp + 0x70c0], 0x43
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x437f85
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.0042346f
jmp 0x437f93
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.0042345a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x44
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x70cc], 0x43
call fcn.004623a0
add esp, 0xc
push 1
push ebx
push ecx
mov byte [esp + 0x70cc], 0x45
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0xb8]
push eax
call fcn.00426032
mov byte [esp + 0x70c0], 0x46
cmp dword [esp + 0x138], ebx
jne 0x438023
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_containers_
jmp 0x4372da
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
call fcn.004640e0
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x438064
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push str.Cant_empty__s
jmp 0x437451
mov esi, dword [esp + 0x14]
call fcn.00464ba0
test eax, eax
jne 0x43808c
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push str.Cant_create__s
jmp 0x437451
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov esi, 0x4cb098
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x47
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4cdac0
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x48
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x49
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 3
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x4a
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll.dll
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x4b
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x4c
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 2
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x4d
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll64.dll
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x4e
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x4f
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 8
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x50
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtFiles.db
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x51
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x52
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 4
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x53
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SandboxCfg.db
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x54
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x55
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 5
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x56
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtReg.export
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x57
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x58
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 6
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x59
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SysDllSubdirs.txt
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x5a
mov ecx, esp
mov dword [esp + 0x58], esp
lea eax, [esp + 0x24]
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x5b
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 7
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x5c
mov ecx, esp
mov dword [esp + 0x48], esp
push str.Core.zip
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x5d
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x46
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c8], 0x5e
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Main
call fcn.00423416
push 1
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0x46
call fcn.0047aea0
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push 0x4d3394
push eax
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
jmp 0x4372e4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Unbreak:
call fcn.00423416
call fcn.00435d19
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x5f
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x70cc], 3
call fcn.004623a0
add esp, 0xc
mov byte [esp + 0x70c0], 0x60
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43856a
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x1c]
push str.Dir_doesnt_exist:__s
jmp 0x437451
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x50]
call fcn.00423401
mov esi, str..old
push esi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0x61
call fcn.00423665
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.00423665
add esp, 0xc
push dword [eax]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x58]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], bl
je 0x4385fe
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_rename_myself_to_.old
jmp 0x4372da
push esi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00423665
mov eax, dword [eax]
add esp, 0xc
push ebx
push dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x34]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], bl
je 0x438652
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_myself
jmp 0x4372da
push 1
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [esp + 0x38], ebx
push 0x4cb098
lea ebx, [esp + 0x3c]
lea esi, [esp + 0x48]
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x62
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4cdac0
call fcn.00423416
push ecx
mov byte [esp + 0x70d4], 0x63
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d4], 0x61
call fcn.00461ba0
add esp, 0xc
mov edi, esi
call fcn.00462b80
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x438b8f
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x438b8f
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x2c]
push eax
call fcn.004628e0
pop ecx
mov byte [esp + 0x70c0], 0x64
push dword [esp + 0x38]
call fcn.004a5375
pop ecx
push 1
push 1
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0xb8]
push eax
call fcn.00426032
mov byte [esp + 0x70c0], 0x65
cmp dword [esp + 0x138], 0
jne 0x438744
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_begin_to_update_resource
jmp 0x4372da
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, str.Main
push ebx
call fcn.00423416
mov byte [esp + 0x70c4], 0x66
mov eax, dword [esp + 0x30]
mov eax, dword [eax - 0xc]
add eax, eax
push 0
push eax
lea ecx, [esp + 0x38]
call fcn.00423b2d
push eax
lea esi, [esp + 0xbc]
mov byte [esp + 0x70d0], 0x65
call fcn.0047a530
test eax, eax
je 0x4387a3
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_update_INI_resource
jmp 0x4372da
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423416
push 0
push 2
push ecx
mov byte [esp + 0x70d0], 0x67
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov esi, 0x4cb098
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d8], 0x68
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll.dll
call fcn.00423416
push ecx
mov byte [esp + 0x70dc], 0x69
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
mov byte [esp + 0x70dc], 0x67
call fcn.00461ba0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x65
call fcn.0047a7b0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423416
push 0
push 8
push ecx
mov byte [esp + 0x70d0], 0x6a
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d8], 0x6b
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll64.dll
call fcn.00423416
push ecx
mov byte [esp + 0x70dc], 0x6c
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
mov byte [esp + 0x70dc], 0x6a
call fcn.00461ba0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x65
call fcn.0047a7b0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423416
push 0x4000
push 4
push ecx
mov byte [esp + 0x70d0], 0x6d
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d8], 0x6e
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtFiles.db
call fcn.00423416
push ecx
mov byte [esp + 0x70dc], 0x6f
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
mov byte [esp + 0x70dc], 0x6d
call fcn.00461ba0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x65
call fcn.0047a7b0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423416
push 0x4000
push 5
push ecx
mov byte [esp + 0x70d0], 0x70
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d8], 0x71
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SandboxCfg.db
call fcn.00423416
push ecx
mov byte [esp + 0x70dc], 0x72
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
mov byte [esp + 0x70dc], 0x70
call fcn.00461ba0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x65
call fcn.0047a7b0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423416
push 0x4000
push 6
push ecx
mov byte [esp + 0x70d0], 0x73
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d8], 0x74
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtReg.export
call fcn.00423416
push ecx
mov byte [esp + 0x70dc], 0x75
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
mov byte [esp + 0x70dc], 0x73
call fcn.00461ba0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x65
call fcn.0047a7b0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423416
push 0
push 7
push ecx
mov byte [esp + 0x70d0], 0x76
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d8], 0x77
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SysDllSubdirs.txt
call fcn.00423416
push ecx
mov byte [esp + 0x70dc], 0x78
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
mov byte [esp + 0x70dc], 0x76
call fcn.00461ba0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x65
call fcn.0047a7b0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00423416
mov byte [esp + 0x70c4], 0x79
push 0x4000
push 1
push ecx
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d8], 0x7a
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Core.zip
call fcn.00423416
push ecx
mov byte [esp + 0x70dc], 0x7b
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
mov byte [esp + 0x70dc], 0x79
call fcn.00461ba0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0x65
call fcn.0047a7b0
lea eax, [esp + 0xac]
call fcn.00479af0
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
je 0x438b77
push str.Could_not_commit_resource
jmp 0x4372da
push str.Success
call fcn.00423416
call fcn.004366ae
pop ecx
pop ecx
push 0
jmp 0x4372e5
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_VirtApp.ini
jmp 0x4372da
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x438bd9
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
call fcn.0042fdae
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4f4ad0]
push str._s_is_no_longer_integrated.
jmp 0x4384cf
lea ecx, [esp + 0x50]
call fcn.00421487
lea ecx, [esp + 0x2c]
call fcn.00421487
mov byte [esp + 0x70c0], 0xa6
mov edi, dword [esp + 0x30]
or dword [esp + 0x28], 0xffffffff
lea eax, [edi + 1]
cmp dword [esp + 0x78], eax
jle 0x438c38
mov eax, dword [esp + 0x44]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x54]
call fcn.0042346f
lea eax, [edi + 2]
cmp dword [esp + 0x78], eax
jle 0x438c51
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4]
lea ecx, [esp + 0x30]
call fcn.0042346f
lea ecx, [esp + 0x34]
call fcn.00421487
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x70c4], 0xa7
call fcn.00423401
push ecx
mov byte [esp + 0x70c4], 0xa8
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x438cab
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
xor edi, edi
inc edi
push edi
push ebx
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x148]
push eax
call fcn.00426032
lea eax, [esp + 0x13c]
push eax
mov byte [esp + 0x70c4], 0xa9
call fcn.004271e9
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x30]
pop ecx
cmp dword [eax - 0xc], ebx
je 0x438d0c
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x28], eax
push edi
push edi
push edi
lea eax, [esp + 0x40]
push eax
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4f4b08
call fcn.00423401
push ecx
mov byte [esp + 0x70dc], 0xaa
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4f4b10
call fcn.00423401
push ecx
mov byte [esp + 0x70e0], 0xab
mov ecx, esp
mov dword [esp + 0x5c], esp
push 0x4f4b0c
call fcn.00423401
push ecx
mov byte [esp + 0x70e4], 0xac
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4f4ad0
call fcn.00423401
mov byte [esp + 0x70e4], 0xa9
call fcn.00432dd4
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x24
call edi
push ebx
mov dword [esp + 0x24], eax
push ebx
lea eax, [esp + 0x144]
push eax
push dword [esp + 0x64]
mov ecx, 0x4f4ac8
call fcn.0042a7e5
add esp, 0x10
cmp eax, ebx
je 0x438dc8
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Failed_BasicDeploy_
jmp 0x4372da
call edi
sub eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
call edi
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x50]
cmp dword [eax - 0xc], ebx
je 0x438e7f
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0xad
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4cfa34
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0xae
mov ecx, esp
mov dword [esp + 0x4c], esp
push esi
call fcn.00423416
push ebx
push ecx
mov byte [esp + 0x70d8], 0xaf
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00423401
or ecx, 0xffffffff
lea edx, [esp + 0x154]
mov byte [esp + 0x70d8], 0xa9
call fcn.0042c04e
add esp, 0x18
push ebx
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00423401
call fcn.004689c0
pop ecx
pop ecx
cmp eax, ebx
jne 0x438e7f
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x438e55
call edi
push ecx
mov esi, eax
sub esi, dword [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4f4b08
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 0xb0
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4f4b10
call fcn.00423401
push ecx
mov byte [esp + 0x70cc], 0xb1
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x4f4b0c
call fcn.00423401
push ecx
mov byte [esp + 0x70d0], 0xb2
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x4f4ad0
call fcn.00423401
mov byte [esp + 0x70d0], 0xa9
call fcn.004329a5
add esp, 0x10
lea ecx, [esp + 0x1c]
call fcn.00421487
lea ecx, [esp + 0x5c]
mov eax, 0x100
push ecx
mov byte [esp + 0x70c4], 0xb3
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x64], eax
call fcn.0042149b
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00423724
push esi
push dword [esp + 0x24]
lea eax, [esp + 0x5c]
push dword [esp + 0x24]
push dword [0x4f4ad0]
push str._s__s__d_d_r_n
push eax
call fcn.00462050
add esp, 0x18
mov byte [esp + 0x70c0], 0xb4
push dword [esp + 0x54]
lea ecx, [esp + 0x50]
call fcn.0042490d
mov byte [esp + 0x70c0], 0xb5
mov esi, dword [esp + 0x28]
cmp esi, 0xffffffff
je 0x438fa1
push 2
push ebx
push ebx
push esi
mov dword [esp + 0x68], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax - 0xc]
push ebx
lea edx, [esp + 0x5c]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x4f1564]
lea eax, [esp + 0x58]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00423401
jmp 0x4384d8
lea ecx, [esp + 0x20]
call fcn.00421487
mov byte [esp + 0x70c0], 0xb6
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x438fee
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.0042346f
jmp 0x438ffc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.0042345a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Packager.log
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0xb7
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70cc], 0xb6
call fcn.004623a0
add esp, 0xc
mov byte [esp + 0x70c0], 0xb8
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push ebx
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
xor edi, edi
call fcn.00423401
lea eax, [esp + 0x1d8]
push eax
call fcn.00426032
lea eax, [esp + 0x1cc]
push eax
mov byte [esp + 0x70c4], 0xb9
call fcn.004271e9
mov esi, eax
pop ecx
cmp esi, ebx
je 0x43910b
push 0x2024
lea eax, [esp + 0x654]
push ebx
push eax
mov dword [esp + 0x658], ebx
call fcn.004a5560
add esp, 0xc
lea eax, [esp + 0x64c]
push eax
lea eax, [esp + 0x30]
push eax
mov ecx, str.Packager.log
mov eax, esi
mov dword [esp + 0x34], ebx
call fcn.00478f20
pop ecx
pop ecx
test eax, eax
jne 0x439102
lea eax, [esp + 0x34]
push eax
call fcn.00461180
pop ecx
push dword [eax]
mov eax, esi
call fcn.00478fe0
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov eax, esi
call fcn.00478f60
pop ecx
test eax, eax
jne 0x439102
inc edi
mov ebx, esi
call fcn.00479020
xor ebx, ebx
lea eax, [esp + 0x1cc]
call fcn.00479af0
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
cmp edi, ebx
je 0x439136
push str.Success:__s
jmp 0x4384cf
push str.Failed_saving__s
jmp 0x4384cf
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
mov esi, 0x4f4ac8
push esi
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x439174
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x148]
push eax
call fcn.00426032
lea eax, [esp + 0x13c]
push eax
mov byte [esp + 0x70c4], 0xba
call fcn.004271e9
pop ecx
push 1
push ebx
lea ecx, [esp + 0x144]
push ecx
push eax
mov ecx, esi
call fcn.0042a7e5
mov esi, eax
add esp, 0x10
lea eax, [esp + 0x13c]
call fcn.00479af0
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
cmp esi, ebx
jne 0x43932d
push dword [0x4f4b0c]
push 0x4d3ab8
jmp 0x4384cf
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
mov esi, 0x4f4ac8
push esi
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x439228
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.0048f030
pop ecx
mov byte [esp + 0x70c0], 0xbb
push dword [eax]
lea ecx, [esp + 0x5c]
call fcn.0042490d
mov byte [esp + 0x70c0], 0xbd
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x58]
mov ecx, dword [eax - 0xc]
push eax
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov dword [esp + 0x68], ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str..xml
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0xbe
mov eax, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00460f60
pop ecx
push edi
mov byte [esp + 0x70d4], 0xbd
call fcn.004623a0
mov edi, dword [esp + 0x70]
add esp, 0xc
call fcn.00462e30
pop ecx
pop ecx
push dword [0x4f1564]
push ecx
mov dword [esp + 0x18], esp
cmp eax, ebx
je 0x43932b
mov ecx, esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0xbf
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00460f60
pop ecx
lea eax, [esp + 0x68]
push eax
mov byte [esp + 0x70d0], 0xbd
call fcn.004623a0
add esp, 8
mov byte [esp + 0x70c8], 0xc0
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push 0x4d3ab8
push ecx
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x4372e4
mov eax, esp
push str.Failed_extracting.
push eax
call fcn.00462050
pop ecx
pop ecx
jmp 0x4384d8
lea ecx, [esp + 0x14]
call fcn.00421487
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x70c4], 0xc1
call fcn.00423401
mov byte [esp + 0x70c0], 0xc2
mov eax, dword [esp + 0x30]
lea ecx, [eax + 1]
cmp dword [esp + 0x78], ecx
jle 0x439384
mov ecx, dword [esp + 0x44]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x3c]
call fcn.0042346f
push 1
push ebx
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0xb8]
push eax
call fcn.00426032
mov byte [esp + 0x70c0], 0xc3
cmp dword [esp + 0x138], ebx
jne 0x4393ca
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x18]
call fcn.00425ea8
pop ecx
jmp 0x43947b
lea eax, [esp + 0x60]
lea ecx, [esp + 0x120]
call fcn.0043bf3b
jmp 0x439455
lea esi, [esp + 0x60]
call fcn.0043bff4
mov edi, eax
add edi, 0x18
call fcn.0043bff4
mov ebx, eax
call fcn.0043bff4
push dword [eax + 0xc]
push dword [eax + 8]
movzx eax, word [edi + 0xc]
push dword [ebx + 4]
push dword [ebx]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 8]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
movzx eax, word [edi + 6]
push eax
call fcn.0043bff4
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043bff4
push dword [eax + 0x2c]
call fcn.0043bff4
mov eax, dword [eax + 0x28]
call fcn.004276bd
push eax
push str._s__s:_Size_lld__Time_.2d__.2d__.4d__.2d:_.2d:_.2d__Offset_lld__Allocated_lld_n
lea ebx, [esp + 0x50]
call fcn.00425ea8
add esp, 0x3c
call fcn.0043c01c
lea eax, [esp + 0x84]
lea ecx, [esp + 0x120]
call fcn.0043bf50
mov edi, eax
lea esi, [esp + 0x60]
call fcn.00423944
test al, al
jne 0x4393dc
push str.______________________________n
lea ebx, [esp + 0x18]
call fcn.00425ea8
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
test al, al
jne 0x4394ba
push str.Cannot_obtain_INI_info_from_resource__n
mov ecx, ebx
call fcn.004279d8
jmp 0x439792
lea ecx, [esp + 0x30]
call fcn.00421487
mov byte [esp + 0x70c0], 0xc4
call fcn.0046c260
push dword [0x4f4ad0]
lea ebx, [esp + 0x18]
push str.AppID___ws_n
call fcn.00425ea8
push dword [0x4f4adc]
push str.Publisher___ws_n
call fcn.00425ea8
push dword [0x4f4ae0]
push str.Version___ws_n
call fcn.00425ea8
push dword [0x4f4ad8]
push str.FriendlyName___ws_n
call fcn.00425ea8
push dword [0x4f4ad4]
push str.AutoLaunch___ws_n
call fcn.00425ea8
push dword [0x4f4b0c]
push str.BaseDirName___ws_n
call fcn.00425ea8
push dword [0x4f4b10]
push str.CarrierExeName___ws_n
call fcn.00425ea8
push dword [0x4f4ae4]
push str.OnStartVirtualizedCmds___ws_n
call fcn.00425ea8
add esp, 0x40
push dword [0x4f4ae8]
push str.OnStartUnvirtualizedCmds___ws_n
call fcn.00425ea8
push dword [0x4f4aec]
push str.OnStopVirtualizedCmds___ws_n
call fcn.00425ea8
push dword [0x4f4af0]
push str.OnStopUnvirtualizedCmds___ws_n
call fcn.00425ea8
push dword [0x4f4af4]
push str.StopInheritance___ws_n
call fcn.00425ea8
add esp, 0x1c
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push str._s.AppVirtDll.dll
push eax
call fcn.00462050
lea eax, [esp + 0x44]
add esp, 0xc
push eax
call fcn.00461750
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x70c4], 0xc5
call fcn.0042345a
mov byte [esp + 0x70c0], 0xc4
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 0xc6
mov ecx, esp
mov dword [esp + 0x20], esp
mov esi, str.Main
push esi
call fcn.00423416
push 2
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0xc4
call fcn.0047aea0
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
lea eax, [esp + 0x38]
push eax
call fcn.00485de0
mov byte [esp + 0x70c8], 0xc7
push dword [eax]
push str.EngineVersion_ws_n
call fcn.00425ea8
mov byte [esp + 0x70d0], 0xc4
mov ecx, dword [esp + 0x44]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
call fcn.00465760
pop ecx
lea ecx, [esp + 0x50]
call fcn.00421487
push ecx
mov byte [esp + 0x70c4], 0xc8
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4ad0]
push str._s.SandboxCfg.db
push eax
call fcn.00462050
lea eax, [esp + 0x44]
add esp, 0xc
push eax
call fcn.00461750
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x70c4], 0xc9
call fcn.0042345a
mov byte [esp + 0x70c0], 0xc8
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 0xca
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00423416
push 5
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0xc8
call fcn.0047aea0
and dword [esp + 0x60], 0
xor eax, eax
lea edi, [esp + 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [esp + 0x30]
lea ebx, [esp + 0x60]
stosd dword es:[edi], eax
call fcn.004803c0
lea eax, [esp + 0x50]
push eax
push 0x46edf0
push 0
push dword [esp + 0x74]
mov eax, ebx
push eax
call fcn.004811b0
push dword [esp + 0x50]
lea ebx, [esp + 0x18]
push str.Sandbox:__ws_n
call fcn.00425ea8
pop ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
call fcn.00465760
pop ecx
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
xor esi, esi
push esi
push str.Info
push dword [esp + 0x1c]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
jmp 0x4372e5
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x438019
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.00423401
push 0x2e
lea ecx, [esp + 0x20]
mov byte [esp + 0x70c4], 0xcf
call fcn.004305de
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x24]
call fcn.00423605
push str..new.exe
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x70cc], 0xd0
call fcn.00423665
add esp, 0xc
mov byte [esp + 0x70c0], 0xd2
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x5c]
call fcn.00423416
push ebx
mov byte [esp + 0x70c4], 0xd3
push dword [esp + 0x2c]
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43986b
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x30]
push dword [esp + 0x28]
push str.Cant_copy__s_to__s
jmp 0x43781f
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 0xd4
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0xd3
call fcn.00430895
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0042101a
push 1
push ebx
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0xb8]
push eax
call fcn.00426032
push 1
push 1
push ecx
mov byte [esp + 0x70cc], 0xd5
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1d8]
push eax
call fcn.00426032
lea eax, [esp + 0x60]
lea ecx, [esp + 0x120]
mov byte [esp + 0x70c0], 0xd6
call fcn.0043bf3b
jmp 0x439a22
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CEChangeEngine.tmp
call fcn.00423416
lea eax, [esp + 0x24]
push eax
call fcn.00461750
add esp, 4
mov byte [esp + 0x70c4], 0xd7
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
lea esi, [esp + 0x64]
mov byte [esp + 0x70c4], 0xd8
call fcn.0043bff4
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
call fcn.0043bff4
push dword [eax + 0x28]
lea eax, [esp + 0xb8]
push eax
mov byte [esp + 0x70d0], 0xd7
call fcn.0047aea0
cmp eax, ebx
jne 0x439a7b
call fcn.0043bff4
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4000
mov byte [esp + 0x70c8], 0xd9
call fcn.0043bff4
push dword [eax + 0x28]
lea eax, [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1dc]
push eax
mov byte [esp + 0x70d4], 0xd7
call fcn.0047a7b0
cmp eax, ebx
jne 0x439aa7
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
call fcn.00465760
pop ecx
mov byte [esp + 0x70c0], 0xd6
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.0043c01c
lea eax, [esp + 0x84]
lea ecx, [esp + 0x120]
call fcn.0043bf50
mov edi, eax
lea esi, [esp + 0x60]
call fcn.00423944
test al, al
jne 0x43991e
lea eax, [esp + 0xac]
call fcn.00479af0
lea eax, [esp + 0x1cc]
call fcn.00479af0
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x30]
push str.Successfully_changed_Loader:__s
jmp 0x4384cf
push dword [0x4f1564]
call fcn.0043bff4
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x6c]
call fcn.0043bff4
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x437820
push dword [0x4f1564]
lea esi, [esp + 0x64]
call fcn.0043bff4
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
jmp 0x439a94
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.00423401
push 0x2e
lea ecx, [esp + 0x24]
mov byte [esp + 0x70c4], 0xda
call fcn.004305de
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x28]
call fcn.00423605
push str..new.exe
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70cc], 0xdb
call fcn.00423665
add esp, 0xc
mov byte [esp + 0x70c0], 0xdd
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x2c]
call fcn.00423416
push ebx
mov byte [esp + 0x70c4], 0xde
push dword [esp + 0x20]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439b6b
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
push dword [esp + 0x2c]
jmp 0x439861
push 1
push 1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0xb8]
push eax
call fcn.00426032
mov byte [esp + 0x70c0], 0xdf
cmp dword [esp + 0x138], ebx
jne 0x439bb5
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_open_PeContainer
jmp 0x4372da
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.00423416
push ebx
push 2
push ecx
mov byte [esp + 0x70d0], 0xe0
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00423401
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0xdf
call fcn.0047a7b0
cmp eax, ebx
je 0x439c13
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x4372da
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423416
push ebx
push 8
push ecx
mov byte [esp + 0x70d0], 0xe1
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00423401
push edi
call fcn.0046ef10
pop ecx
pop ecx
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x70d4], 0xdf
call fcn.0047a7b0
cmp eax, ebx
je 0x439c7b
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x4372da
lea ecx, [esp + 0x2c]
call fcn.00421487
lea ecx, [esp + 0x38]
call fcn.00421487
push ecx
mov byte [esp + 0x70c4], 0xe3
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
lea ebx, [esp + 0x34]
call fcn.00423416
push 3
lea edi, [esp + 0xb4]
call fcn.0047ad80
test eax, eax
je 0x439ccf
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x4372da
lea eax, [esp + 0x38]
push eax
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00423401
push edi
call fcn.00485de0
add esp, 4
mov byte [esp + 0x70cc], 0xe4
mov ecx, esp
mov dword [esp + 0x24], esp
push str.EngineVersion
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0xe5
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0xe3
call fcn.004667c0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00423416
push 0x4000
push 3
push ecx
mov byte [esp + 0x70d0], 0xe6
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00423401
lea esi, [esp + 0xbc]
mov byte [esp + 0x70d0], 0xe3
call fcn.0047a620
test eax, eax
je 0x439d91
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x4372da
lea eax, [esp + 0xac]
call fcn.00479af0
push dword [0x4f1564]
lea eax, [esp + 0x2c]
push ecx
mov dword [esp + 0x18], esp
mov esi, esp
push dword [esp + 0x24]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
lea eax, [esp + 0x44]
push eax
call fcn.00485de0
pop ecx
pop ecx
mov byte [esp + 0x70cc], 0xe7
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00462050
add esp, 0x10
call fcn.004366ae
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x438b88
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.00423401
push 0x2e
lea ecx, [esp + 0x24]
mov byte [esp + 0x70c4], 0xe8
call fcn.004305de
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x28]
call fcn.00423605
push str..new.exe
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x70cc], 0xe9
call fcn.00423665
add esp, 0xc
mov byte [esp + 0x70c0], 0xeb
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x5c]
call fcn.00423416
push ebx
mov byte [esp + 0x70c4], 0xec
push dword [esp + 0x20]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439ea4
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
push dword [esp + 0x2c]
jmp 0x439861
push 1
push 1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x148]
push eax
call fcn.00426032
mov byte [esp + 0x70c0], 0xed
cmp dword [esp + 0x1c8], ebx
jne 0x439ee9
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x439bab
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Main
call fcn.00423416
push ebx
push 3
push ecx
mov byte [esp + 0x70d0], 0xee
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00423401
lea eax, [esp + 0x14c]
push eax
mov byte [esp + 0x70d4], 0xed
call fcn.0047a7b0
cmp eax, ebx
je 0x439f46
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEINI
jmp 0x4372da
lea eax, [esp + 0x13c]
call fcn.00479af0
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x24]
push str.Successfully_changed_INI._nNew_package_saved_in:_n_s
jmp 0x4384cf
lea eax, [esp + 0x49c]
push eax
call fcn.00429f3c
lea ecx, [esp + 0x2c]
call fcn.00421487
lea eax, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x70c8], 0xf0
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0xf1
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Description
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0xf2
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppID
call fcn.00423416
lea ecx, [esp + 0x4ac]
mov byte [esp + 0x70d0], 0xf0
call fcn.0042950a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x49c]
push eax
mov byte [esp + 0x70c4], 3
call fcn.0042a065
jmp 0x437476
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x148]
push eax
call fcn.00426032
push ebx
push ecx
mov byte [esp + 0x70c8], 0xf3
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0xf4
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0xf5
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00423401
push 2
push ecx
mov byte [esp + 0x70d8], 0xf6
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00423401
mov ecx, edi
lea edx, [esp + 0x154]
mov byte [esp + 0x70d8], 0xf3
call fcn.0042c04e
lea eax, [esp + 0x154]
push eax
call fcn.0042bc38
add esp, 0x1c
lea eax, [esp + 0x13c]
call fcn.00479af0
lea eax, [esp + 0x13c]
jmp 0x437f41
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.DbgZip
call fcn.00423416
call fcn.00435d19
mov dword [esp], str._DbgZip:
call fcn.004a4d8a
mov edx, dword [esp + 0x34]
pop ecx
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x84]
call fcn.0042346f
jmp 0x4371ba
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x268]
push eax
call fcn.00426032
push ebx
push ecx
mov byte [esp + 0x70c8], 0xf7
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0xf8
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0xf9
mov ecx, esp
mov dword [esp + 0x4c], esp
push esi
call fcn.00423416
push 2
push ecx
mov byte [esp + 0x70d8], 0xfa
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00423401
mov ecx, edi
lea edx, [esp + 0x274]
mov byte [esp + 0x70d8], 0xf7
call fcn.0042c04e
lea eax, [esp + 0x274]
push eax
push dword [esp + 0x68]
push 0x4f4ac8
call fcn.0042fcbc
add esp, 0x24
lea eax, [esp + 0x25c]
jmp 0x437f41
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x418]
push eax
call fcn.00426032
push ebx
push ecx
mov dword [esp + 0x70c8], 0x101
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
or edi, 0xffffffff
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 2
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 3
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00423401
push 2
push ecx
mov byte [esp + 0x70d8], 4
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00423401
mov ecx, edi
lea edx, [esp + 0x424]
mov byte [esp + 0x70d8], 1
call fcn.0042c04e
add esp, 0x18
lea esi, [esp + 0x60]
call fcn.0047d940
mov byte [esp + 0x70c0], 5
mov dword [esp + 0x2c], ebx
jmp 0x43a30a
push dword [0x4f4ad0]
lea eax, [esp + 0x6eb0]
push eax
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x43a30a
xor edi, edi
cmp dword [esp + 0x2ea8], edi
jbe 0x43a30a
lea esi, [esp + edi*8 + 0x2eac]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x43a300
test byte [esp + edi*8 + 0x2eb0], 3
je 0x43a300
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4f4b0c
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4f4ad0
call fcn.00423401
mov ebx, dword [esi]
mov byte [esp + 0x70c8], 5
call fcn.00432867
pop ecx
pop ecx
inc edi
cmp edi, dword [esp + 0x2ea8]
jb 0x43a2aa
lea eax, [esp + 0x2674]
push eax
lea esi, [esp + 0x30]
lea ebx, [esp + 0x64]
call fcn.0047d400
test eax, eax
jne 0x43a286
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [esp + 0x60]
call fcn.0047d960
mov dword [esp + 0x70c0], 3
lea eax, [esp + 0x40c]
jmp 0x437f49
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x2f8]
push eax
call fcn.00426032
mov dword [esp + 0x70c0], 0x107
push dword [esp + 0x54]
or edi, 0xffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 8
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Vintegrate_
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 9
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00423401
push ebx
push ecx
mov byte [esp + 0x70d8], 0xa
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00423401
mov ecx, edi
lea edx, [esp + 0x304]
mov byte [esp + 0x70d8], 7
call fcn.0042c04e
add esp, 0x18
call fcn.0043660d
jmp 0x4372e4
lea esi, [esp + 0x60]
call fcn.0047d940
mov dword [esp + 0x70c0], 0x10b
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], ebx
call fcn.00421487
mov byte [esp + 0x70c0], 0xc
jmp 0x43a6ae
lea eax, [esp + 0x6eac]
push eax
lea eax, [esp + 0x38]
push str._AppID_ws_n
push eax
call fcn.00462050
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0xd
call fcn.00423484
mov byte [esp + 0x70c0], 0xc
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x2678]
lea eax, [esp + 0x5c]
push str.____SerialId:__d_n
push eax
call fcn.00462050
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0xe
call fcn.00423484
mov byte [esp + 0x70c0], 0xc
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x2ea0]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x60]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00462050
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0xf
call fcn.00423484
mov byte [esp + 0x70c0], 0xc
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2ea4]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x30]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00462050
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0x10
call fcn.00423484
mov byte [esp + 0x70c0], 0xc
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x50]
push str.____Processes:_n
push eax
call fcn.00462050
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0x11
call fcn.00423484
mov byte [esp + 0x70c0], 0xc
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
xor ebx, ebx
cmp dword [esp + 0x2ea8], ebx
jbe 0x43a6ae
push 0x4cd12c
lea ecx, [esp + 0x24]
call fcn.00423416
mov byte [esp + 0x70c0], 0x12
lea edi, [esp + ebx*8 + 0x2eac]
push dword [edi]
lea esi, [esp + 0x24]
call fcn.004603f0
pop ecx
test eax, eax
jne 0x43a5ca
push 0x4ce3d0
mov ecx, esi
call fcn.0042346f
push 0x5c
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00423401
lea eax, [esp + 0x30]
push eax
call fcn.00462560
add esp, 0xc
mov byte [esp + 0x70c0], 0x13
push dword [eax]
lea eax, [esp + 0x20]
push dword [edi]
push str._______wd:__ws
push eax
call fcn.00462050
add esp, 0x10
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0x14
call fcn.00423484
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x70c0], 0x12
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + ebx*8 + 0x2eb0]
test eax, eax
je 0x43a67e
push eax
lea eax, [esp + 0x58]
push str._0x_x_
push eax
call fcn.00462050
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x70c4], 0x15
call fcn.00423484
mov byte [esp + 0x70c0], 0x12
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4cb5bc
lea ecx, [esp + 0x18]
call fcn.00427910
mov byte [esp + 0x70c0], 0xc
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
inc ebx
cmp ebx, dword [esp + 0x2ea8]
jb 0x43a591
lea eax, [esp + 0x2674]
push eax
lea esi, [esp + 0x3c]
lea ebx, [esp + 0x64]
call fcn.0047d400
test eax, eax
jne 0x43a437
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
cmp dword [esp + 0x40], eax
jne 0x43a6f6
push str.No_active_virtual_apps
call fcn.00423416
call fcn.004366ae
pop ecx
pop ecx
push 1
jmp 0x4372e5
lea eax, [esp + 0x1c]
push eax
call fcn.00423401
jmp 0x438b81
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x54]
mov eax, dword [eax + 0x44]
call fcn.00429bb6
lea eax, [esp + 0x34]
push eax
call fcn.00429cf3
jmp 0x4372e4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AutoUpdate
call fcn.00423416
call fcn.00435d19
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
mov esi, 0x4f4ac8
push esi
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x43a76e
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x4f4af8]
push str.AutoUpdate_s
push eax
call fcn.00462050
add esp, 0xc
call fcn.00435d19
mov ecx, 0x4f4af8
mov dword [esp], str.https:__online.cameyo.com
call fcn.0042346f
push str.0000
mov ecx, 0x4f4afc
call fcn.0042346f
mov ecx, esi
call fcn.004901d0
jmp 0x437476
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.VirtRegSyncExport
call fcn.00423416
call fcn.00435d19
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
mov esi, 0x4f4ac8
push esi
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x43a803
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
mov ecx, esi
call fcn.00433bdd
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00462050
add esp, 0xc
jmp 0x437470
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartStreaming:AppIDSkype
call fcn.00423416
call fcn.00425d5d
pop ecx
jmp 0x437475
lea ecx, [esp + 0x2c]
call fcn.00421487
lea ecx, [esp + 0x20]
mov dword [esp + 0x70c0], 0x118
call fcn.00421487
mov byte [esp + 0x70c0], 0x19
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x30]
push 0x4d483c
lea esi, [eax + edi*4 + 4]
call fcn.004a4ce0
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x30]
call fcn.0042346f
inc edi
cmp dword [esp + 0x78], edi
jle 0x43a8a2
push dword [esi]
lea ecx, [esp + 0x24]
call fcn.0042346f
jmp 0x43a907
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Streamed
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x1a
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x70cc], 0x19
call fcn.004623a0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x70c4], 0x1b
call fcn.0042345a
mov byte [esp + 0x70c0], 0x19
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 0x1c
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00423401
mov byte [esp + 0x70c8], 0x19
call fcn.00430119
pop ecx
pop ecx
push dword [0x4f1564]
push ecx
mov dword [esp + 0x18], esp
cmp eax, ebx
jne 0x43a978
mov esi, dword [esp + 0x28]
mov eax, esp
push esi
push str.Success:_n_s
push eax
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042101a
jmp 0x437946
mov ecx, esp
push str.Failed
jmp 0x4372da
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x43a9b7
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
call fcn.00423416
push ebx
push ecx
mov dword [esp + 0x70cc], 0x11d
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x4f4b0c]
xor edi, edi
push str._select___s_
push eax
call fcn.00462050
add esp, 8
mov byte [esp + 0x70d0], 0x1e
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.explorer.exe
call fcn.00423416
mov dword [esp + 0x70d0], 3
call fcn.00460610
add esp, 0x10
xor ebx, ebx
jmp 0x437476
push str.Vintegrate:
lea ecx, [esp + 0x24]
call fcn.00423416
mov byte [esp + 0x70c0], 0xfb
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push str._VintegrateRecursive
push dword [edi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
je 0x43aa75
push 0x4d44b8
call fcn.004a4ce0
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
jne 0x43aa83
push str.VintegrateRecursive:
lea ecx, [esp + 0x24]
call fcn.0042346f
push str._Windows_Explorer.exe
lea ecx, [esp + 0x54]
call fcn.00423416
mov byte [esp + 0x70c0], 0xfc
mov edi, dword [edi]
push 0x3a
push edi
call fcn.004a55da
pop ecx
pop ecx
cmp eax, ebx
je 0x43aab6
add eax, 2
push eax
lea ecx, [esp + 0x54]
call fcn.0042346f
push 1
push ebx
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x2f8]
push eax
call fcn.00426032
mov byte [esp + 0x70c0], 0xfd
push dword [esp + 0x54]
or edi, 0xffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.00423416
push ecx
mov eax, esp
mov byte [esp + 0x70cc], 0xfe
mov dword [esp + 0x24], esp
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.004296a6
add esp, 8
mov byte [esp + 0x70d0], 0xff
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00423401
push ebx
push ecx
mov dword [esp + 0x70d8], 0x100
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00423401
mov ecx, edi
lea edx, [esp + 0x304]
mov dword [esp + 0x70d8], 0xfd
call fcn.0042c04e
add esp, 0x18
lea eax, [esp + 0x2ec]
push eax
mov byte [esp + 0x70c4], 0xfc
call fcn.004260f1
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x20]
jmp 0x43778a
lea eax, [esp + 0x20]
push eax
call fcn.00461180
mov byte [esp + 0x70c4], 0x8c
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
lea edi, [eax + ecx*4]
mov dword [esp], 0x4d3940
call fcn.004a4ce0
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004a5945
add esp, 0xc
test eax, eax
jne 0x43abf2
push dword [edi]
lea ecx, [esp + 0x24]
call fcn.0042346f
push 0x4d3940
call fcn.004a4ce0
pop ecx
push ebx
lea ecx, [esp + 0x24]
push ecx
call fcn.004234ad
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x43ac25
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43731a
push 0x4f4ad4
lea ecx, [esp + 0x5c]
call fcn.00423401
lea eax, [esp + 0x38]
push eax
push 0x4ce700
lea eax, [esp + 0x1c]
mov byte [esp + 0x70c8], 0x8d
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x44], ebx
call fcn.00427925
jmp 0x43b194
lea ecx, [esp + 0x28]
call fcn.00421487
lea ecx, [esp + 0x4c]
call fcn.00421487
lea ecx, [esp + 0x44]
call fcn.00421487
lea ecx, [esp + 0x54]
call fcn.00421487
push 0x3e
push ecx
mov byte [esp + 0x70c8], 0x92
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
mov dword [esp + 0x3c], ebx
lea edi, [esp + 0x3c]
call fcn.00423401
lea eax, [esp + 0x3c]
push eax
mov ecx, edi
call fcn.00465d60
add esp, 0xc
mov byte [esp + 0x70c0], 0x93
call fcn.0042355c
push eax
lea ecx, [esp + 0x2c]
call fcn.0042345a
mov byte [esp + 0x70c0], 0x92
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
jne 0x43ad30
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x70c0], 0x8d
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43b17c
push 0x3e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
lea edi, [esp + 0x3c]
call fcn.00423401
lea eax, [esp + 0xa8]
push eax
mov ecx, edi
call fcn.00465d60
add esp, 0xc
mov byte [esp + 0x70c0], 0x94
call fcn.0042355c
push eax
lea ecx, [esp + 0x50]
call fcn.0042345a
mov byte [esp + 0x70c0], 0x92
mov ecx, dword [esp + 0xa0]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
je 0x43ace7
push 0x3e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
call fcn.00423401
lea eax, [esp + 0x50]
push eax
mov ecx, edi
call fcn.00465d60
add esp, 0xc
mov byte [esp + 0x70c0], 0x95
call fcn.0042355c
push eax
lea ecx, [esp + 0x48]
call fcn.0042345a
mov byte [esp + 0x70c0], 0x92
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
jne 0x43adf8
push esi
lea ecx, [esp + 0x48]
call fcn.0042346f
jmp 0x43ae53
push 0x3e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
lea edi, [esp + 0x3c]
call fcn.00423401
lea eax, [esp + 0x44]
push eax
mov ecx, edi
call fcn.00465d60
add esp, 0xc
mov byte [esp + 0x70c0], 0x96
call fcn.0042355c
push eax
lea ecx, [esp + 0x58]
call fcn.0042345a
mov byte [esp + 0x70c0], 0x92
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x30], 0xffffffff
jne 0x43ae5d
push esi
lea ecx, [esp + 0x58]
call fcn.0042346f
push dword [esp + 0x28]
lea eax, [esp + 0x54]
push str._exec___s_
push eax
call fcn.00462050
add esp, 0xc
mov byte [esp + 0x70c0], 0x97
mov eax, dword [esp + 0x4c]
cmp dword [eax - 0xc], ebx
je 0x43aea0
push 0x4ceb90
lea ecx, [esp + 0x54]
call fcn.00427910
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x54]
call fcn.00423484
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.00423401
push ecx
mov esi, esp
mov byte [esp + 0x70c8], 0x98
mov dword [esp + 0x38], esp
push 0x5c
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00423401
push esi
call fcn.00462560
lea eax, [esp + 0x70]
add esp, 0xc
push eax
mov byte [esp + 0x70cc], 0x97
call fcn.004277fe
add esp, 8
mov byte [esp + 0x70c4], 0x99
mov ecx, esp
mov dword [esp + 0x94], esp
mov esi, 0x4cb098
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x9a
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70cc], 0x9b
mov ecx, esp
mov dword [esp + 0xa8], esp
push 0x4f4b0c
call fcn.00423401
lea edi, [esp + 0x38]
mov byte [esp + 0x70cc], 0x99
call fcn.00461ba0
add esp, 8
mov byte [esp + 0x70c4], 0x9c
mov ecx, esp
mov dword [esp + 0xa0], esp
push esi
call fcn.00423416
push ecx
mov eax, esp
mov byte [esp + 0x70c8], 0x9d
mov dword [esp + 0x98], esp
push str..lnk
lea ecx, [esp + 0x50]
push ecx
push eax
call fcn.00423665
add esp, 8
mov byte [esp + 0x70cc], 0x9e
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00423401
lea edi, [esp + 0x24]
mov byte [esp + 0x70cc], 0x9c
call fcn.00461ba0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0xa0], esp
push eax
call fcn.00423401
call fcn.00464ac0
pop ecx
cmp eax, ebx
je 0x43aff9
lea eax, [esp + 0x2c]
jmp 0x43b010
push ebx
lea ecx, [esp + 0x14]
call fcn.00423416
mov byte [esp + 0x70c0], 0x9f
or dword [esp + 0x1c], 2
mov eax, dword [eax]
push ebx
push ecx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0xa4], esp
push eax
call fcn.00423401
push ecx
mov dword [esp + 0x70cc], 0xa0
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70d0], 0xa1
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0xa8], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70d4], 0xa2
mov dword [esp + 0xa8], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0xac], esp
push esi
call fcn.00423416
push ecx
mov eax, esp
mov byte [esp + 0x70dc], 0xa3
mov dword [esp + 0xa0], esp
push str..lnk
lea ecx, [esp + 0x64]
push ecx
push eax
call fcn.00423665
add esp, 8
mov byte [esp + 0x70e0], 0xa4
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x80], esp
push eax
call fcn.00423401
mov byte [esp + 0x70e0], 0xa2
call fcn.00461ba0
mov esi, dword [esp + 0x50]
add esp, 0xc
mov byte [esp + 0x70d4], 0x9f
call fcn.0048b580
add esp, 0x14
mov dword [esp + 0x70c0], 0x9c
test byte [esp + 0x1c], 2
je 0x43b10f
mov ecx, dword [esp + 0x10]
and dword [esp + 0x1c], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x70c0], 0x8d
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, 0x4cd12c
lea eax, [esp + 0x38]
push eax
push 0x4ce700
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x64]
call fcn.00427925
cmp dword [esp + 0x38], 0xffffffff
jne 0x43ac5c
mov byte [esp + 0x70c0], 0x8d
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [0x4f4ad0]
push str.Shortcuts_created_for__s.
jmp 0x4384cf
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.00423401
mov byte [esp + 0x70c0], 0x7c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push str._FullIntegrate
push dword [edi]
mov dword [esp + 0x58], edi
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x43b3b2
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
push 0x4f4ac8
call fcn.0042717b
pop ecx
pop ecx
cmp al, bl
jne 0x43b23e
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x43731a
push 0x4f4b0c
lea ecx, [esp + 0x30]
call fcn.00423401
mov byte [esp + 0x70c0], 0x7d
cmp dword [esp + 0x4c], ebx
je 0x43b29d
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push 0x4f4ad0
call fcn.00423401
lea eax, [esp + 0x14]
push eax
call fcn.00433ed5
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x70c4], 0x7e
call fcn.0042345a
mov byte [esp + 0x70c0], 0x7d
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push 0x4cb098
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x7f
mov eax, esp
mov dword [esp + 0x8c], esp
push dword [0x4f4ad0]
push str._s.host.exe
push eax
call fcn.00462050
add esp, 8
mov byte [esp + 0x70cc], 0x80
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0xa0], esp
push eax
call fcn.00423401
lea edi, [esp + 0x1c]
mov byte [esp + 0x70cc], 0x7d
call fcn.00461ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70c4], 0x81
call fcn.0042345a
mov byte [esp + 0x70c0], 0x7d
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0x2c]
call fcn.00464ba0
test eax, eax
jne 0x43b34d
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.Could_not_create_virtual_repository
jmp 0x4372da
lea eax, [esp + 0x10]
push eax
call fcn.00460f60
mov eax, dword [eax]
pop ecx
push ebx
push dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x10]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], bl
je 0x43b399
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.Could_not_copy_executable_to_repository
jmp 0x4372da
lea ecx, [esi - 0x10]
mov byte [esp + 0x70c0], 0x7c
call fcn.0042101a
mov edi, dword [esp + 0x50]
mov esi, 0x4cd12c
push 1
push ebx
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x268]
push eax
call fcn.00426032
push ebx
push ecx
mov byte [esp + 0x70c8], 0x82
mov ecx, esp
mov dword [esp + 0x68], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x83
mov ecx, esp
mov dword [esp + 0x90], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x84
mov ecx, esp
mov dword [esp + 0xa4], esp
push esi
call fcn.00423416
push 2
push ecx
mov byte [esp + 0x70d8], 0x85
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
call fcn.00423401
or ecx, 0xffffffff
lea edx, [esp + 0x274]
mov byte [esp + 0x70d8], 0x82
call fcn.0042c04e
push str._Integrate:once
push dword [edi]
call fcn.004a4b43
add esp, 0x20
mov edi, str.SoftwareVOS_s
test eax, eax
jne 0x43b586
push esi
lea ecx, [esp + 0x58]
call fcn.00423416
push ebx
push ebx
push ebx
push ecx
mov byte [esp + 0x70d0], 0x86
mov ecx, esp
mov dword [esp + 0x70], esp
push str.Registered
lea ebx, [esp + 0x68]
call fcn.00423416
mov byte [esp + 0x70d0], 0x87
push dword [0x4f4ad0]
lea eax, [esp + 0x24]
push edi
push eax
call fcn.00462050
add esp, 8
mov byte [esp + 0x70d4], 0x88
mov ecx, esp
mov dword [esp + 0x98], esp
push str.Integrated
push eax
push ecx
mov dword [esp + 0x3c], 1
call fcn.00423665
add esp, 0xc
mov dword [esp + 0x70d4], 0x89
call fcn.00472430
push eax
mov byte [esp + 0x70d8], 0x8a
call fcn.00462f40
add esp, 0x18
test eax, eax
je 0x43b50b
mov eax, dword [esp + 0x54]
cmp dword [eax - 0xc], 0
je 0x43b50b
mov bl, 1
jmp 0x43b50d
xor bl, bl
mov dword [esp + 0x70c0], 0x86
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x43b570
push str.Success
lea eax, [esp + 0x58]
call fcn.00423499
push ecx
test eax, eax
mov dword [esp + 0x64], esp
mov eax, esp
jne 0x43b558
push str._Integrate:once:_already_registered_successfully._Quitting.
push eax
call fcn.00462050
pop ecx
pop ecx
call fcn.00435ce9
jmp 0x438b87
push dword [esp + 0x58]
push str._Integrate:once:_already_attempted_registration_before__but_failed:__s._Trying_integration_again.
push eax
call fcn.00462050
add esp, 0xc
call fcn.00435ce9
pop ecx
mov byte [esp + 0x70c0], 0x82
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
xor ebx, ebx
xor eax, eax
cmp dword [esp + 0x4c], ebx
push ebx
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push str.AllUsers
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x8b
mov eax, esp
mov dword [esp + 0x94], esp
push dword [0x4f4ad0]
push edi
push eax
call fcn.00462050
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x70d4], 0x82
call fcn.00463460
add esp, 0x14
lea eax, [esp + 0x25c]
push eax
push dword [esp + 0x50]
push 0x4f4ac8
call fcn.0042fcbc
add esp, 0xc
lea eax, [esp + 0x25c]
call fcn.00479af0
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [0x4f4ad0]
push str._s_is_now_integrated_into_your_system.
jmp 0x4384cf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00460c10
test eax, eax
jne 0x43b699
mov eax, dword [esp + 0x44]
push ebx
push ebx
push ebx
push ecx
mov esi, esp
mov dword [esp + 0x70], esp
push ecx
mov ecx, esp
mov dword [esp + 0x98], esp
push dword [eax]
call fcn.00423416
push esi
call fcn.00467c40
add esp, 4
mov byte [esp + 0x70d4], 0x30
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d4], 3
call fcn.00460780
add esp, 0x14
cmp eax, ebx
jne 0x4372e4
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x4372d5
call fcn.00460f10
test eax, eax
jne 0x43b6b4
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x436985
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea edi, [eax + ecx*4]
push 0x4d2ef4
mov dword [esp + 0x54], edi
call fcn.004a4ce0
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004a5945
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x24]
sbb edi, edi
push eax
lea ecx, [esp + 0x24]
inc edi
call fcn.00423401
push ecx
mov byte [esp + 0x70c4], 0x31
mov ecx, esp
mov dword [esp + 0x64], esp
push str..new.exe
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x32
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x70cc], 0x31
call fcn.004623a0
add esp, 0xc
mov byte [esp + 0x70c0], 0x33
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x50]
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push dword [eax]
call fcn.00423416
lea eax, [esp + 0x20]
push eax
call fcn.00467c40
pop ecx
pop ecx
push 1
push ebx
push ecx
mov byte [esp + 0x70cc], 0x34
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1d8]
push eax
call fcn.00426032
push ebx
push ecx
mov byte [esp + 0x70c8], 0x35
mov ecx, esp
mov dword [esp + 0x68], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70cc], 0x36
mov ecx, esp
mov dword [esp + 0x90], esp
push esi
call fcn.00423416
push ecx
mov byte [esp + 0x70d0], 0x37
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0xa4], esp
push eax
call fcn.00423401
push 2
push ecx
mov byte [esp + 0x70d8], 0x38
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
call fcn.00423401
or ecx, 0xffffffff
lea edx, [esp + 0x1e4]
mov byte [esp + 0x70d8], 0x35
call fcn.0042c04e
push dword [0x4f4ad0]
lea eax, [esp + 0x54]
push dword [0x4f4b0c]
push str._sAppVirtDll__s.dll
push eax
call fcn.00462050
add esp, 0x24
mov byte [esp + 0x70c4], 0x39
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
call fcn.00425505
pop ecx
cmp eax, ebx
je 0x43b8b8
push dword [0x4f1564]
cmp eax, 0x11
jne 0x43b87c
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00462050
pop ecx
pop ecx
jmp 0x4372df
cmp eax, 0x12
jne 0x43b88f
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x43b86f
lea ecx, [esp + 0x64]
push ecx
mov edx, eax
call fcn.00469060
mov byte [esp + 0x70c8], 0x3a
mov ecx, esp
mov dword [esp + 0x8c], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x437ce5
push dword [esp + 0x1c]
lea eax, [esp + 0x14]
push str._exec__s
push eax
call fcn.00462050
mov eax, dword [eax]
add esp, 0xc
push ebx
push ebx
push eax
push dword [esp + 0x30]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
cmp esi, ebx
je 0x43b940
cmp edi, ebx
je 0x43b90b
push 1
push 0x4cb5c0
push str.Starting_installation_in_virtual_mode..._nWhen_installation_is_done__click_OK_and_Cameyo_will_turn_it_into_a_virtual_package._nInstallation_will_not_truly_install_anything_on_your_hard_drive__it_is_simulated_.
jmp 0x43b916
push ebx
push 0x4cb5c0
push str.When_installation_is_done__click_OK.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x43b940
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
call fcn.0042558c
pop ecx
push 0x14
jmp 0x4372e5
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
call fcn.0042558c
pop ecx
cmp eax, ebx
je 0x43b9b6
push dword [0x4f1564]
cmp eax, 0x11
jne 0x43b977
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x43b86f
cmp eax, 0x12
jne 0x43b98d
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x43b86f
lea ecx, [esp + 0x64]
push ecx
mov edx, eax
call fcn.00469060
mov byte [esp + 0x70c8], 0x3b
mov ecx, esp
mov dword [esp + 0x8c], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x437ce5
cmp esi, ebx
jne 0x43b9d5
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [esp + 0x24]
push str.Failed_executing__s
jmp 0x437451
mov esi, dword [esp + 0x20]
cmp edi, ebx
je 0x43bad0
call fcn.00434639
push 0x407
mov edi, 0x4f4ac8
call fcn.0047c8d0
pop ecx
push ebx
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x14]
jne 0x43ba1c
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437bed
push ebx
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70d0], 0x3c
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x39
call fcn.00430a1a
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x43bb43
push dword [0x4f1564]
lea eax, [esp + 0x18]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1c]
push eax
call fcn.00462560
add esp, 8
mov byte [esp + 0x70c8], 0x3d
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov byte [esp + 0x70c0], 0x39
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
call fcn.0047c8d0
pop ecx
lea eax, [esp + 0x1cc]
call fcn.00479af0
push dword [0x4f1564]
push ecx
mov eax, esp
mov dword [esp + 0x68], esp
push dword [esp + 0x1c]
push 0x4d3394
push eax
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x1cc]
push eax
mov byte [esp + 0x70c4], 0x34
call fcn.004260f1
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
jmp 0x43778d
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esp + 0x10]
push dword [0x4f1564]
cmp edx, 0x10
jne 0x43bb68
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437cbc
lea eax, [esp + 0x64]
push eax
call fcn.00469060
mov byte [esp + 0x70c8], 0x3e
mov ecx, esp
mov dword [esp + 0x8c], esp
jmp 0x437cde
lea ecx, [esp + 0x1c]
call fcn.00421487
lea ecx, [esp + 0x28]
call fcn.00421487
mov byte [esp + 0x70c0], 0x26
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea esi, [eax + ecx*4]
push str._CreateDiff
push dword [esi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x43bbcf
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.0042345a
jmp 0x43bbe9
push 0x4d2eb0
call fcn.004a4ce0
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x20]
call fcn.0042346f
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push str..mod
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x27
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x70cc], 0x26
call fcn.004623a0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70c4], 0x28
call fcn.0042345a
mov byte [esp + 0x70c0], 0x26
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x28]
jne 0x43bc84
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437bed
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70d0], 0x29
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.00423401
mov byte [esp + 0x70d0], 0x26
call fcn.00430a1a
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x43bd08
push dword [0x4f1564]
lea eax, [esp + 0x2c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1c]
push eax
call fcn.00462560
add esp, 8
mov byte [esp + 0x70c8], 0x2a
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
jmp 0x43bebd
push edi
call esi
mov edx, dword [esp + 0x10]
push dword [0x4f1564]
cmp edx, 0x10
jne 0x43bd26
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437cbc
lea eax, [esp + 0x64]
push eax
call fcn.00469060
mov byte [esp + 0x70c8], 0x2b
mov ecx, esp
mov dword [esp + 0x8c], esp
jmp 0x437cde
lea ecx, [esp + 0x1c]
call fcn.00421487
lea ecx, [esp + 0x28]
call fcn.00421487
mov byte [esp + 0x70c0], 0x18
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
lea esi, [eax + ecx*4]
push str._LearnStreaming
push dword [esi]
call fcn.004a4b43
pop ecx
pop ecx
test eax, eax
jne 0x43bd8d
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.0042345a
jmp 0x43bda7
push 0x4d2c7c
call fcn.004a4ce0
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x20]
call fcn.0042346f
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push str..new.exe
call fcn.00423416
push ecx
mov byte [esp + 0x70c8], 0x19
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x70cc], 0x18
call fcn.004623a0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70c4], 0x1a
call fcn.0042345a
mov byte [esp + 0x70c0], 0x18
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
push ebx
push edi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x28]
jne 0x43be42
push dword [0x4f1564]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
jmp 0x437bed
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00423401
push ecx
mov byte [esp + 0x70c8], 0x1b
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.00423401
mov byte [esp + 0x70c8], 0x18
call fcn.004323b3
pop ecx
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x43beea
push dword [0x4f1564]
lea eax, [esp + 0x2c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00423401
lea eax, [esp + 0x1c]
push eax
call fcn.00462560
add esp, 8
mov byte [esp + 0x70c8], 0x1c
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00462050
add esp, 0xc
call fcn.004366ae
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
mov ecx, dword [esp + 0x1c]
jmp 0x43778a
push edi
call esi
push dword [0x4f1564]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x64]
push eax
call fcn.00469060
mov byte [esp + 0x70c8], 0x1d
mov ecx, esp
mov dword [esp + 0x8c], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x437ce5
push str.CLoaderApp:_Done._Bye__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
push dword [0x4f484c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4372e4