Function at 0x43ac7b
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Get file attributes
Get hostname
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d6b80
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x28ac
call fcn.004b5fc0
mov eax, dword [0x50cc94]
xor eax, esp
mov dword [esp + 0x28a8], eax
push ebx
push esi
push edi
mov eax, dword [0x50cc94]
xor eax, esp
push eax
lea eax, [esp + 0x28c0]
mov dword fs:[0], eax
lea eax, [esp + 0x278]
xor esi, esi
mov dword [esp + 0x44], esi
push eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x27c], 8
mov dword [esp + 0x280], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x60]
call fcn.004aa120
mov ebx, 0x4e0608
push ebx
lea ecx, [esp + 0x60]
call fcn.004235f2
push ebx
lea ecx, [esp + 0x68]
mov dword [esp + 0x28cc], esi
call fcn.004235f2
xor edi, edi
push ebx
lea ecx, [esp + 0x74]
inc edi
mov byte [esp + 0x28cc], 1
call fcn.004235f2
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x28cc], 2
call fcn.00467720
pop ecx
lea ecx, [esp + 0x4c]
call fcn.0042148a
lea eax, [esp + 0x50]
mov byte [esp + 0x28c8], 4
push eax
mov dword [esp + 0x80], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1b8]
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x40], esi
call fcn.00467720
pop ecx
push eax
mov ecx, 0x5121f4
mov byte [esp + 0x28cc], 5
call fcn.00423636
mov byte [esp + 0x28c8], 4
mov ecx, dword [esp + 0x1b8]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x1a4]
push eax
call fcn.00467720
mov byte [esp + 0x28cc], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Loader:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.00439f21
pop ecx
mov byte [esp + 0x28c8], 4
mov ecx, dword [esp + 0x1a4]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x511e58], eax
cmp dword [esp + 0x2c], esi
je 0x43bc20
cmp dword [esp + 0x50], edi
jle 0x43bc20
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push ecx
lea edi, [eax + ecx*4]
mov ecx, esp
mov dword [esp + 0x38], esp
push dword [edi]
call fcn.004235f2
call fcn.00439f51
mov dword [esp], 0x4ea8b4
call fcn.004af8d0
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
jne 0x43ae7c
push 0x4ea8b4
call fcn.004af8d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x18]
jmp 0x43bc08
push str._Confirm
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43ae9b
mov dword [esp + 0x20], 1
jmp 0x43bc0e
push str._Quiet
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43aebd
or dword [esp + 0x3c], 2
mov dword [0x50e82c], esi
jmp 0x43bc0e
push str._AllUsers
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43af10
mov dword [esp + 0x48], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004673d0
test eax, eax
je 0x43bd16
call fcn.004676d0
test eax, eax
jne 0x43bc0e
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Admin_rights_required
jmp 0x43bd31
push str._ErrorsOnly
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43af31
mov dword [0x50e82c], 1
jmp 0x43bc0e
push str._Wait
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43af4d
or dword [esp + 0x3c], 1
jmp 0x43bc0e
push 0x4ea980
call fcn.004af8d0
pop ecx
push eax
push str._Password:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x43bbe9
push 0x4ea9a4
call fcn.004af8d0
pop ecx
push eax
push str._Password
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x43bbe9
push 0x4ea9e0
call fcn.004af8d0
pop ecx
push eax
push str._Properties:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
jne 0x43b2b8
push str._Properties_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x54]
call fcn.0042148a
lea ecx, [esp + 0x80]
call fcn.0042148a
push 0x4ea9e0
mov byte [esp + 0x28cc], 9
call fcn.004af8d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x110]
call fcn.004235f2
lea eax, [esp + 0x280]
push eax
mov byte [esp + 0x28cc], 0xa
call fcn.00429bc2
mov byte [esp + 0x28c8], 0xb
mov dword [esp + 0x148], esi
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4eaa28
lea edi, [esp + 0x150]
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0xc
lea eax, [esp + 0x114]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1b0]
push eax
mov byte [esp + 0x28d4], 0xb
call fcn.0046d740
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x28cc], 0xd
call fcn.00423636
mov byte [esp + 0x28c8], 0xb
mov ecx, dword [esp + 0x1a8]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
push 0x3d
lea ecx, [esp + 0x2c]
call fcn.00425cc8
mov edi, eax
cmp edi, 0xffffffff
je 0x43b142
push edi
lea eax, [esp + 0x1b4]
push eax
lea ecx, [esp + 0x2c]
call fcn.004237e1
mov byte [esp + 0x28c8], 0xe
call fcn.00423738
push eax
lea ecx, [esp + 0x58]
call fcn.00423636
mov byte [esp + 0x28c8], 0xb
mov ecx, dword [esp + 0x1b0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x54]
cmp dword [eax - 0xc], esi
je 0x43b142
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x84]
call fcn.00423636
push esi
lea ecx, [esp + 0x84]
lea eax, [edi + 1]
push ecx
call fcn.00423689
lea eax, [esp + 0x80]
push eax
push ecx
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x28c]
push eax
call fcn.00429bf8
pop ecx
mov ecx, eax
call fcn.00423636
cmp dword [esp + 0x148], 0xffffffff
jne 0x43b028
mov eax, dword [esp + 0x298]
mov eax, dword [eax]
lea edi, [esp + 0x280]
lea esi, [esp + 0x94]
call fcn.0042982e
jmp 0x43b230
lea esi, [esp + 0x94]
call fcn.00429f7a
push eax
lea ecx, [esp + 0xec]
call fcn.004235dd
mov byte [esp + 0x28c8], 0xf
call fcn.00429f7a
add eax, 4
push eax
lea ecx, [esp + 0x20]
call fcn.004235dd
push str.Branding
lea eax, [esp + 0xec]
mov byte [esp + 0x28cc], 0x10
call fcn.00423675
test eax, eax
je 0x43bd42
lea edi, [esp + 0xe8]
call fcn.0042939d
push dword [eax]
lea eax, [esp + 0x278]
push str.CAMEYO__s
push eax
call fcn.00468c80
mov esi, dword [esp + 0x28]
mov eax, dword [eax]
add esp, 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x274]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov byte [esp + 0x28c8], 0xb
mov ecx, dword [esp + 0xe8]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [esp + 0x94]
call fcn.0042a30e
mov eax, dword [esp + 0x298]
lea edi, [esp + 0x280]
lea esi, [esp + 0xf8]
call fcn.0042982e
mov edi, esi
lea esi, [esp + 0x94]
call fcn.0042a35b
test al, al
je 0x43b171
lea eax, [esp + 0x280]
push eax
mov byte [esp + 0x28cc], 0xa
call fcn.00429a2b
mov ecx, dword [esp + 0x10c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x80]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28c8], 4
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43b9c7
push str._SafeMode
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b304
push str._SafeMode_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x4e2358
push str.CAMEYO_LEGACYREG
call edi
push str.Disk
push str.CAMEYO_VIRTMODE
call edi
push 0x4e22cc
push str.CAMEYO_EARLYINJECTION
call edi
jmp 0x43bc0e
push 0x4eab10
call fcn.004af8d0
pop ecx
push eax
push str._Services:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
jne 0x43b378
push dword [edi]
lea ecx, [esp + 0xcc]
call fcn.004235f2
push 0x4eab10
mov byte [esp + 0x28cc], 0x11
call fcn.004af8d0
pop ecx
push esi
lea ecx, [esp + 0xcc]
push ecx
call fcn.00423689
push dword [esp + 0xc8]
push str.CAMEYO_SERVICES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x28c8], 4
mov ecx, dword [esp + 0xc8]
jmp 0x43bbdf
push str._Register
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43bd56
push str._Stop
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43be07
push str._Remove
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43bf2a
push str._Remove:Proc
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43c24e
push str._Remove:Reg
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43c40e
push str._LearnStreaming
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x441f2f
push 0x4eb0ac
call fcn.004af8d0
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x441f2f
push str._UpdateBasicSettings
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b43e
mov dword [esp + 0x30], 1
jmp 0x43bc0e
push str._Repackage
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43c60a
push str._CreateDiff
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x441d76
push 0x4eb2d0
call fcn.004af8d0
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x441d76
push str._exec
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43c7e6
push 0x4eb314
call fcn.004af8d0
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x4417c0
push 0x4eb32c
call fcn.004af8d0
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x4417c0
push str._ShowStreaming
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43c96a
push str._Break
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43ca4c
push str._Unbreak
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43d16f
push str._Integrate
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x44135e
push str._Integrate:once
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x44135e
push str._FullIntegrate
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x44135e
push str._Unintegrate
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43d99a
push str._CreateShortcuts
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440d06
push 0x4ebdf0
call fcn.004af8d0
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x440d06
push str._Perf
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43d9ff
push str._ExtractLog
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43de12
push str._ExtractAll
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43e003
push str._AutoUpdateXml
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43e0df
push str._Info
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43e23c
push str._Sandbox
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43e2f0
push 0x4ec0a8
call fcn.004af8d0
pop ecx
push eax
push str._GetProperty:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x43e3bf
push str._InfoLog
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43e5d9
push str._Ini
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440be8
push str._ShowIni
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440be8
push str._ExtractIni
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43e7cd
push str._csv
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43e957
push str._EngineVer
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43ed2d
push str._ChangeLoader
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b708
mov eax, dword [esp + 0x28]
inc eax
cmp dword [esp + 0x50], eax
jg 0x43ee6e
push str._ChangeEngine
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b729
mov eax, dword [esp + 0x28]
inc eax
cmp dword [esp + 0x50], eax
jg 0x43f198
push str._ChangeIni
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b74a
mov eax, dword [esp + 0x28]
inc eax
cmp dword [esp + 0x50], eax
jg 0x43f53f
push str._TestAutoUpdate
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b76d
mov eax, dword [esp + 0x28]
add eax, 5
cmp dword [esp + 0x50], eax
jg 0x43f6f8
push str._Debug
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43f807
push str._ForceMenu
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b7a2
mov dword [esp + 0x7c], 1
jmp 0x43bc0e
push str._ShowTree
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43f848
push str._RegDump
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43f914
push str._SetFileFlags
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b7f1
mov eax, dword [esp + 0x28]
add eax, 2
cmp dword [esp + 0x50], eax
jg 0x43f9ef
push str._DbgZip:
call fcn.004af97a
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x43fbf8
push str._DbgNow
call fcn.004af97a
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x43fc38
push str._Vintegrate
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440a69
push 0x4ec9c8
call fcn.004af8d0
pop ecx
push eax
push str._Vintegrate:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x440a69
push str._VintegrateRecursive
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440a69
push 0x4eca20
call fcn.004af8d0
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x440a69
push str._Vunintegrate
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43fd27
push str._Vmanager
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x43feb7
push 0x4ecae0
call fcn.004af8d0
pop ecx
push eax
push str._ProcessList
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x43ff64
push str._GfxSvr
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b952
call fcn.0042bdd7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov edi, 0x512190
call fcn.00485a80
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.00485a80
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43bc0e
push 0x4ecc78
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43b9ce
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.open
xor ebx, ebx
call fcn.004235f2
push esi
push ecx
mov dword [esp + 0x28d4], 0x158
mov ecx, esp
mov dword [esp + 0x40], esp
push str._Troubleshoot
xor edi, edi
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x59
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235dd
mov dword [esp + 0x28d8], 4
call fcn.00466dd0
add esp, 0x10
mov ebx, 0x4e0608
xor esi, esi
jmp 0x43bc0e
push str._Troubleshoot
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x4402ce
push str._AutoUpdate
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x4402f4
push str._VirtRegSyncExport
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440389
push str._StartStreaming
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x4403f1
push str._JumpTo
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x44040e
push str._SvcRegister
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x4404af
push str._SvcStart
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x4405b6
push str._SvcRegisterStart
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440671
push str._SvcStop
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x4407d0
push str._SvcRemove
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x44088d
push dword [edi]
lea ecx, [esp + 0xd4]
call fcn.004235f2
push esi
push ecx
mov dword [esp + 0x28d0], 0x162
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4df158
call fcn.004235f2
push ecx
mov edi, esp
mov byte [esp + 0x28d4], 0x63
mov dword [esp + 0x20], esp
push 0x5c
push ecx
lea eax, [esp + 0xe4]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235dd
push edi
call fcn.00469190
add esp, 0xc
mov byte [esp + 0x28d4], 0x62
call fcn.0046dbd0
add esp, 0xc
cmp eax, esi
je 0x43bb52
push 0x4ed0b0
push ecx
lea eax, [esp + 0xd8]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x230]
push eax
call fcn.00468d70
or dword [esp + 0x50], 4
pop ecx
pop ecx
call fcn.00423675
mov byte [esp + 0x43], 1
test eax, eax
je 0x43bb57
mov byte [esp + 0x43], 0
test byte [esp + 0x44], 4
je 0x43bb72
mov ecx, dword [esp + 0x228]
and dword [esp + 0x44], 0xfffffffb
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [esp + 0x43], 0
jne 0x44094b
push 0x4e6914
lea ecx, [esp + 0x68]
call fcn.0042364b
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.004235f2
lea eax, [esp + 0x158]
push eax
call fcn.0046f6f0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x28cc], 0x68
call fcn.00423636
mov ecx, dword [esp + 0x154]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [esp + 0x28c8], 4
mov ecx, dword [esp + 0xd0]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43bc0e
push str._Password_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4ea980
call fcn.004af8d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x4c]
push eax
call fcn.0042364b
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x50]
jl 0x43ae24
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xa80]
push eax
call fcn.00480850
push 0xffffffffffffffff
mov dword [esp + 0x28cc], 0x169
push dword [esp + 0x40]
lea eax, [esp + 0x78]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28d8], 0x6a
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28dc], 0x6b
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28dc], 0x6c
push dword [esp + 0x90]
lea eax, [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xa90]
push eax
mov byte [esp + 0x28e8], 0x69
call fcn.00430504
add esp, 0x20
cmp eax, 2
jne 0x442110
call fcn.0043a6f4
push esi
push dword [0x51219c]
push str.Application_is_now_integrated_into_your_system
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0xa74]
call fcn.00481a70
lea eax, [esp + 0xa74]
mov dword [esp + 0x28c8], 4
call fcn.004266f0
jmp 0x43bda5
call fcn.00467420
test eax, eax
jne 0x43bd3b
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Elevation_failed
call fcn.004235f2
call fcn.0043a771
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.License_required.
jmp 0x43bd31
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov esi, 0x512190
push esi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43bd8c
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x43bd31
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov ecx, esi
call fcn.0042fd52
pop ecx
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
mov ecx, dword [esp + 0x28c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28a8]
xor ecx, esp
call fcn.004af011
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43be3a
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5121e4
call fcn.004235dd
push ecx
mov byte [esp + 0x28d0], 0x12
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x5121f4
call fcn.004235dd
push ecx
mov byte [esp + 0x28d4], 0x13
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x5121e8
call fcn.004235dd
push ecx
mov byte [esp + 0x28d8], 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x51219c
call fcn.004235dd
mov byte [esp + 0x28d8], 4
call fcn.0043682b
add esp, 0x10
cmp eax, esi
je 0x43bed0
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Cannot_stop_application__s
push eax
call fcn.00468c80
add esp, 0xc
jmp 0x43bd36
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.004235f2
call fcn.00439f51
pop ecx
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
jmp 0x43bde3
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43bf5d
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
mov eax, dword [0x5121e8]
cmp dword [eax - 0xc], esi
jne 0x43bf84
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Cannot_obtain_base_dir_for__s
jmp 0x43bec2
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, 0x5121e8
push ebx
call fcn.004235dd
call fcn.0046bf20
pop ecx
cmp eax, esi
jne 0x43bfcf
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Application_is_not_deployed_on_this_machine:__s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
push 5
jmp 0x43bd3c
cmp dword [esp + 0x20], esi
je 0x43bff6
push 3
push dword [0x51219c]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x43bff6
push 0x14
pop esi
jmp 0x43bee7
push esi
lea eax, [esp + 0x11c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
mov dword [esp + 0x128], esi
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x15
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x51219c]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.00468c80
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x28dc], 4
call fcn.00469d30
add esp, 0x14
cmp eax, esi
je 0x43c0a8
cmp dword [esp + 0x118], esi
je 0x43c0a8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004673d0
test eax, eax
jne 0x43c08d
call fcn.00467420
test eax, eax
jne 0x43bd3b
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd2c
call fcn.004676d0
test eax, eax
jne 0x43c0a8
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43af06
call fcn.00433f69
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51219c]
push str.Removing__s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.00439f51
pop ecx
lea ecx, [esp + 0x120]
call fcn.0042148a
push 0x4dec30
mov byte [esp + 0x28cc], 0x16
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x12c]
push eax
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5121e4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e4], 0x17
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5121f4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e8], 0x18
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5121f0
call fcn.004235dd
push ecx
mov byte [esp + 0x28ec], 0x19
mov ecx, esp
mov dword [esp + 0x40], esp
push ebx
call fcn.004235dd
push ecx
mov byte [esp + 0x28f0], 0x1a
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51219c
call fcn.004235dd
mov byte [esp + 0x28f0], 0x16
call fcn.00436c2f
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.004235dd
call fcn.0046bf60
pop ecx
cmp eax, esi
je 0x43c1b8
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x43bec2
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51219c]
push edi
push eax
call fcn.00468c80
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.0046a070
pop ecx
cmp eax, esi
je 0x43c1fb
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Registry_could_not_be_emptied_for__s
jmp 0x43bec2
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Removed_successfully
call fcn.004235f2
call fcn.00439f51
pop ecx
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Application__s_removed_successfully
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x120]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43bee7
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43c281
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
mov eax, dword [0x5121e8]
cmp dword [eax - 0xc], esi
jne 0x43c29d
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43bf74
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, 0x5121e8
push ebx
call fcn.004235dd
call fcn.0046bf20
pop ecx
cmp eax, esi
jne 0x43c2cb
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43bfad
cmp dword [esp + 0x20], esi
je 0x43c2ee
push 3
push dword [0x51219c]
push str.Do_you_want_to_stop_the_application_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x43bfee
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51219c]
push str.Removing_processes:__s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.00439f51
pop ecx
lea ecx, [esp + 0x128]
call fcn.0042148a
push 0x4dec30
mov byte [esp + 0x28cc], 0x1b
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push esi
push 1
lea eax, [esp + 0x134]
push eax
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5121e4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e4], 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5121f4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e8], 0x1d
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5121f0
call fcn.004235dd
push ecx
mov byte [esp + 0x28ec], 0x1e
mov ecx, esp
mov dword [esp + 0x40], esp
push ebx
call fcn.004235dd
push ecx
mov byte [esp + 0x28f0], 0x1f
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51219c
call fcn.004235dd
mov byte [esp + 0x28f0], 0x1b
call fcn.00436c2f
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.004235f2
call fcn.00439f51
pop ecx
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Application__s_stopped_successfully
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x128]
jmp 0x43c241
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43c441
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
mov eax, dword [0x5121e8]
cmp dword [eax - 0xc], esi
jne 0x43c45d
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43bf74
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov ebx, 0x5121e8
push ebx
call fcn.004235dd
call fcn.0046bf20
pop ecx
cmp eax, esi
jne 0x43c48b
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43bfad
cmp dword [esp + 0x20], esi
je 0x43c4ae
push 3
push dword [0x51219c]
push str.Do_you_want_to_remove_the_applications_registry_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x43bfee
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51219c]
push str.Removing_registry:__s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.00439f51
pop ecx
lea ecx, [esp + 0x130]
call fcn.0042148a
push 0x4dec30
mov byte [esp + 0x28cc], 0x20
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push 1
push esi
lea eax, [esp + 0x13c]
push eax
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5121e4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e4], 0x21
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5121f4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e8], 0x22
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5121f0
call fcn.004235dd
push ecx
mov byte [esp + 0x28ec], 0x23
mov ecx, esp
mov dword [esp + 0x40], esp
push ebx
call fcn.004235dd
push ecx
mov byte [esp + 0x28f0], 0x24
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51219c
call fcn.004235dd
mov byte [esp + 0x28f0], 0x20
call fcn.00436c2f
add esp, 0x24
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51219c]
push str.SoftwareVOS_s
push eax
call fcn.00468c80
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.0046a070
pop ecx
cmp eax, esi
je 0x43c5bf
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x43c1eb
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Registry_removed_successfully
call fcn.004235f2
call fcn.00439f51
pop ecx
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Application__ss_registry_removed_successfully
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x130]
jmp 0x43c241
lea ecx, [esp + 0x20]
call fcn.0042148a
lea ecx, [esp + 0x3c]
call fcn.0042148a
mov byte [esp + 0x28c8], 0x2d
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43c644
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.0042364b
jmp 0x43c652
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.00423636
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0x2e
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1fc]
push eax
mov byte [esp + 0x28d4], 0x2d
call fcn.00468fd0
add esp, 0xc
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x28cc], 0x2f
call fcn.00423636
mov byte [esp + 0x28c8], 0x2d
mov ecx, dword [esp + 0x1f4]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.0046cc40
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
pop ecx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x3c]
jne 0x43c705
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
jmp 0x43bd36
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
call fcn.0043610a
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, esi
jne 0x43c792
push dword [0x50e82c]
lea eax, [esp + 0x40]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x168]
push eax
call fcn.00469190
add esp, 8
mov byte [esp + 0x28d0], 0x30
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x15c]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [edi - 0x10]
call fcn.0042101a
lea ecx, [ebx - 0x10]
jmp 0x43c244
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x30], 0x10
push dword [0x50e82c]
jne 0x43c7b7
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x43bd31
push dword [esp + 0x34]
lea eax, [esp + 0x2a8]
push eax
call fcn.00470d80
add esp, 4
mov byte [esp + 0x28d0], 0x31
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x43bec3
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax + edx*4]
call fcn.004235f2
lea eax, [esp + 0x200]
push eax
call fcn.0046f6f0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x28cc], 0x38
call fcn.00423636
push eax
lea ecx, [esp + 0x68]
call fcn.00423636
push eax
lea ecx, [esp + 0xdc]
call fcn.004235dd
mov byte [esp + 0x28c8], 0x3a
mov ecx, dword [esp + 0x1fc]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0xe0]
call fcn.004237e1
push 0x4e7164
push eax
call fcn.004238eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x164]
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], 0
lea ecx, [esp + 0x64]
je 0x43c893
push 1
push 0x22
jmp 0x43c896
push esi
push 0x20
call fcn.00425cc8
mov edi, eax
cmp edi, 0xffffffff
je 0x43c90a
push edi
lea eax, [esp + 0x208]
push eax
lea ecx, [esp + 0x6c]
call fcn.004237e1
push 0x4e7050
mov byte [esp + 0x28cc], 0x3b
call fcn.004341a9
push eax
lea ecx, [esp + 0x68]
call fcn.00423636
mov byte [esp + 0x28c8], 0x3a
mov ecx, dword [esp + 0x204]
add ecx, 0xfffffff0
call fcn.0042101a
push esi
lea ecx, [esp + 0x74]
lea eax, [edi + 1]
push ecx
call fcn.00423689
lea eax, [esp + 0x70]
call fcn.00423738
push eax
lea ecx, [esp + 0x74]
call fcn.00423636
jmp 0x43c92f
push 0x4e7050
lea eax, [esp + 0xdc]
call fcn.004341a9
push eax
lea ecx, [esp + 0x68]
call fcn.00423636
push ebx
lea ecx, [esp + 0x74]
call fcn.0042364b
xor ecx, ecx
lea eax, [esp + 0x64]
call fcn.004293e6
movzx eax, ax
cmp ax, 0x25
jne 0x43c94e
lea eax, [esp + 0x64]
push eax
call fcn.0047b300
pop ecx
mov byte [esp + 0x28c8], 4
mov ecx, dword [esp + 0xd8]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43bc20
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ShowStreaming:
call fcn.004235f2
call fcn.00439f51
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x8d0]
push eax
call fcn.00480850
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x28d4], 0x4a
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x4b
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x4c
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0x4d
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x8e0]
push eax
mov byte [esp + 0x28e8], 0x4a
call fcn.00430504
add esp, 0x20
lea ecx, [esp + 0x8c4]
call fcn.0042f865
lea eax, [esp + 0x8c4]
call fcn.00481a70
mov byte [esp + 0x28c8], 4
lea eax, [esp + 0x8c4]
call fcn.004266f0
jmp 0x43bee7
lea ecx, [esp + 0x20]
call fcn.0042148a
mov byte [esp + 0x28c8], 0x4e
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43ca7d
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.0042364b
jmp 0x43ca8b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.00423636
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0x4f
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x28d4], 0x4e
call fcn.00468fd0
add esp, 0xc
push 1
push esi
push ecx
mov byte [esp + 0x28d4], 0x50
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x2f0]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0x51
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x2f0]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0x36c], esi
jne 0x43cb44
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_containers_
jmp 0x43bd31
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.0046abf0
pop ecx
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43cb85
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_empty__s
jmp 0x43bec2
mov esi, dword [esp + 0x58]
call fcn.0046c000
test eax, eax
jne 0x43cbad
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_create__s
jmp 0x43bec2
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, 0x4dec30
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x52
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtApp.ini
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x53
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x54
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str.Main
push esi
call fcn.004235f2
push 3
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x55
mov ecx, esp
mov dword [esp + 0x40], esp
push str.AppVirtDll.dll
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x56
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x57
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 2
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x58
mov ecx, esp
mov dword [esp + 0x40], esp
push str.AppVirtDll64.dll
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x59
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x5a
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 8
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x5b
mov ecx, esp
mov dword [esp + 0x40], esp
push str.StubExe.exe
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x5c
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x5d
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 9
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x5e
mov ecx, esp
mov dword [esp + 0x40], esp
push str.StubExe64.exe
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x5f
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x60
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 0xa
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x61
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtFiles.db
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x62
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x63
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 4
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x64
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SandboxCfg.db
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x65
mov ecx, esp
lea eax, [esp + 0x68]
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x66
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 5
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x67
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtReg.export
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x68
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x69
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 6
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x6a
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtReg.dat
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x6b
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x6c
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 0xb
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x6d
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SysDllSubdirs.txt
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x6e
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x6f
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push 7
pop ecx
lea edi, [esp + 0x2ec]
mov byte [esp + 0x28d0], 0x51
call fcn.00483000
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0x70
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtFiles.vfc
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x71
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x51
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28d0], 0x72
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
mov byte [esp + 0x28d0], 0x51
xor ecx, ecx
inc ecx
lea edi, [esp + 0x2ec]
call fcn.00483000
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push 0x4eb804
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
push 0
jmp 0x43bd3c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Unbreak:
call fcn.004235f2
call fcn.00439f51
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0x73
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x28d4], 4
call fcn.00468fd0
add esp, 0xc
mov byte [esp + 0x28c8], 0x74
push dword [esp + 0x6c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43d1f5
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x74]
push str.Dir_doesnt_exist:__s
jmp 0x43bec2
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.004235dd
mov edi, str..old
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x174]
push eax
mov byte [esp + 0x28d4], 0x75
call fcn.00423841
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x16c]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x214]
push eax
call fcn.00423841
add esp, 0xc
push dword [eax]
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x20c]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x43d291
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_rename_myself_to_.old
jmp 0x43bd31
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x17c]
push eax
call fcn.00423841
mov eax, dword [eax]
add esp, 0xc
push esi
push dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x174]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x43d2e7
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_myself
jmp 0x43bd31
push 1
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [esp + 0xc4], esi
push 0x4dec30
lea ebx, [esp + 0xc8]
lea esi, [esp + 0x148]
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x76
mov ecx, esp
mov dword [esp + 0x24], esp
push str.VirtApp.ini
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x77
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28dc], 0x75
call fcn.004687d0
add esp, 0xc
mov edi, esi
call fcn.00469690
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x43d983
xor edi, edi
cmp dword [esp + 0xb8], edi
je 0x43d983
push dword [esp + 0xb8]
mov ecx, dword [esp + 0x13c]
lea eax, [esp + 0x34]
push eax
call fcn.004693f0
mov byte [esp + 0x28d0], 0x78
push dword [esp + 0x140]
call fcn.004b00c5
add esp, 0xc
push 1
push 1
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x380]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0x79
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x380]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0x3fc], edi
jne 0x43d41e
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_begin_to_update_resource
jmp 0x43bd31
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.004235f2
mov byte [esp + 0x28cc], 0x7a
mov eax, dword [esp + 0x34]
mov eax, dword [eax - 0xc]
add eax, eax
push edi
push eax
lea ecx, [esp + 0x3c]
call fcn.00423dbf
push eax
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.004824a0
cmp eax, edi
je 0x43d47d
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_update_INI_resource
jmp 0x43bd31
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0
push 2
push ecx
mov byte [esp + 0x28d8], 0x7b
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov ebx, 0x4dec30
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x7c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppVirtDll.dll
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x7d
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x7b
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0
push 8
push ecx
mov byte [esp + 0x28d8], 0x7e
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x7f
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppVirtDll64.dll
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x80
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x7e
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0
push 9
push ecx
mov byte [esp + 0x28d8], 0x81
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x82
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.StubExe.exe
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x83
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x81
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0
push 0xa
push ecx
mov byte [esp + 0x28d8], 0x84
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x85
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.StubExe64.exe
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x86
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x84
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0x4000
push 4
push ecx
mov byte [esp + 0x28d8], 0x87
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x88
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtFiles.db
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x89
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x87
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0x4000
push 5
push ecx
mov byte [esp + 0x28d8], 0x8a
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x8b
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.SandboxCfg.db
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x8c
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x8a
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
mov byte [esp + 0x28cc], 0x8d
push 0x4000
push 0xb
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x8e
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtReg.dat
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x8f
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x8d
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0
push 7
push ecx
mov byte [esp + 0x28d8], 0x90
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x91
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.SysDllSubdirs.txt
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x92
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x90
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0x4000
push 1
push ecx
mov byte [esp + 0x28d8], 0x93
mov edi, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28e0], 0x94
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtFiles.vfc
call fcn.004235f2
push ecx
mov byte [esp + 0x28e4], 0x95
lea eax, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e4], 0x93
call fcn.004687d0
add esp, 0xc
lea eax, [esp + 0x384]
push eax
mov byte [esp + 0x28dc], 0x79
call fcn.00482800
lea eax, [esp + 0x374]
call fcn.00481a70
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
je 0x43d974
push str.Could_not_commit_resource
jmp 0x43bd31
push str.Success
call fcn.004235f2
jmp 0x43d161
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_VirtApp.ini
jmp 0x43bd31
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43d9cd
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
call fcn.00433f69
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str._s_is_no_longer_integrated.
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
jmp 0x43bd3b
lea ecx, [esp + 0x54]
call fcn.0042148a
lea ecx, [esp + 0x30]
call fcn.0042148a
mov byte [esp + 0x28c8], 0xc0
mov edi, dword [esp + 0x28]
or dword [esp + 0x24], 0xffffffff
lea eax, [edi + 1]
cmp dword [esp + 0x50], eax
jle 0x43da3c
mov eax, dword [esp + 0x2c]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x58]
call fcn.0042364b
lea eax, [edi + 2]
cmp dword [esp + 0x50], eax
jle 0x43da55
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ecx, [esp + 0x34]
call fcn.0042364b
lea ecx, [esp + 0x214]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x28cc], 0xc1
call fcn.004235dd
push ecx
mov byte [esp + 0x28cc], 0xc2
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43dab2
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
xor edi, edi
inc edi
push edi
push esi
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xcc0]
push eax
call fcn.00480850
lea eax, [esp + 0xcb4]
push eax
mov byte [esp + 0x28cc], 0xc3
call fcn.004284d2
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
pop ecx
cmp dword [eax - 0xc], esi
je 0x43db13
push esi
push 0x80
push 4
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x24], eax
push edi
push edi
push edi
lea eax, [esp + 0x220]
push eax
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5121e4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e4], 0xc4
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5121f4
call fcn.004235dd
push ecx
mov byte [esp + 0x28e8], 0xc5
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x5121f0
call fcn.004235dd
push ecx
mov byte [esp + 0x28ec], 0xc6
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0x5121e8
call fcn.004235dd
push ecx
mov byte [esp + 0x28f0], 0xc7
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x51219c
call fcn.004235dd
mov byte [esp + 0x28f0], 0xc3
call fcn.00436c2f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x28
call edi
push esi
push 2
mov dword [esp + 0x88], eax
push 0x512190
lea eax, [esp + 0xcc0]
push eax
push dword [esp + 0x2c]
call fcn.0042dbb2
add esp, 0x14
cmp eax, esi
je 0x43dbf5
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Failed_BasicDeploy_
jmp 0x43bd31
call edi
sub eax, dword [esp + 0x80]
mov dword [esp + 0x80], eax
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
cmp dword [eax - 0xc], esi
je 0x43dcb6
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0xc8
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4e6914
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0xc9
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x28e4], 0xca
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xcd0]
push eax
mov byte [esp + 0x28e8], 0xc3
call fcn.00430504
add esp, 0x20
push esi
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
call fcn.00470470
pop ecx
pop ecx
cmp eax, esi
jne 0x43dcb6
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43dc8c
call edi
push ecx
mov edi, eax
sub edi, dword [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5121e4
call fcn.004235dd
push ecx
mov byte [esp + 0x28d0], 0xcb
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x5121f4
call fcn.004235dd
push ecx
mov byte [esp + 0x28d4], 0xcc
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x5121e8
call fcn.004235dd
push ecx
mov byte [esp + 0x28d8], 0xcd
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x51219c
call fcn.004235dd
mov byte [esp + 0x28d8], 0xc3
call fcn.0043682b
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.0042148a
lea ecx, [esp + 0x17c]
mov eax, 0x100
push ecx
mov byte [esp + 0x28cc], 0xce
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x184], eax
call fcn.004214d0
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x4c]
call fcn.00423900
push edi
push dword [esp + 0x84]
lea eax, [esp + 0x148]
push dword [esp + 0x50]
push dword [0x51219c]
push str._s__s__d_d_r_n
push eax
call fcn.00468c80
add esp, 0x18
mov byte [esp + 0x28c8], 0xcf
push dword [esp + 0x140]
lea ecx, [esp + 0x220]
call fcn.00424fef
mov byte [esp + 0x28c8], 0xd0
mov edi, dword [esp + 0x24]
cmp edi, 0xffffffff
je 0x43ddf3
push 2
push esi
push esi
push edi
mov dword [esp + 0x194], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x21c]
mov ecx, dword [eax - 0xc]
push esi
lea edx, [esp + 0x188]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x50e82c]
lea eax, [esp + 0x144]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
jmp 0x43d9f3
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Packager.log
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0xd1
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xf4]
push eax
mov byte [esp + 0x28d4], 4
call fcn.00468fd0
add esp, 8
mov byte [esp + 0x28cc], 0xd2
lea eax, [esp + 0xf0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.0046cc40
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
xor edi, edi
call fcn.004235dd
lea eax, [esp + 0x960]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xd3
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x960]
push eax
call fcn.0043a83a
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0xd4
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0xd5
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0xd6
mov ecx, esp
mov dword [esp + 0x38], esp
lea eax, [esp + 0x34]
push eax
call fcn.004235dd
lea eax, [esp + 0x970]
push eax
mov byte [esp + 0x28e8], 0xd3
call fcn.00430504
lea eax, [esp + 0x974]
push eax
call fcn.004284d2
mov ebx, eax
add esp, 0x24
cmp ebx, esi
je 0x43dfa9
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00467940
mov byte [esp + 0x28d0], 0xd7
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LogsPackager.log
call fcn.004235f2
push ebx
mov byte [esp + 0x28d4], 0xd3
call fcn.00426bc4
add esp, 0xc
cmp eax, esi
jne 0x43df9e
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_extract_Packager.log_
jmp 0x43bd31
xor edi, edi
push ebx
inc edi
call fcn.00485150
jmp 0x43dfcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.Loader__ExtractLog_:_OpenVfc_failed__LE_d
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.00439f21
pop ecx
lea eax, [esp + 0x954]
call fcn.00481a70
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xf4]
cmp edi, esi
je 0x43dff9
push str.Success:__s
jmp 0x43d9ea
push str.Failed_saving__s
jmp 0x43d9ea
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43e037
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x9f0]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xd8
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x9f0]
push eax
call fcn.0043a83a
lea eax, [esp + 0x9f4]
push eax
call fcn.004284d2
add esp, 0x14
push 1
push 2
push edi
lea ecx, [esp + 0x9f0]
push ecx
push eax
call fcn.0042dbb2
mov edi, eax
add esp, 0x14
lea eax, [esp + 0x9e4]
call fcn.00481a70
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
cmp edi, esi
jne 0x43e22a
push dword [0x5121e8]
push str.Success:_n_s
jmp 0x43d9ea
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43e113
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
lea eax, [esp + 0x22c]
push eax
mov ecx, edi
call fcn.004967d0
pop ecx
mov byte [esp + 0x28c8], 0xd9
push dword [eax]
lea ecx, [esp + 0x190]
call fcn.00424fef
mov byte [esp + 0x28c8], 0xdb
mov ecx, dword [esp + 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x18c]
mov ecx, dword [eax - 0xc]
push eax
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov dword [esp + 0x28], ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, str..xml
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0xdc
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00467720
pop ecx
push edi
mov byte [esp + 0x28dc], 0xdb
call fcn.00468fd0
mov edi, dword [esp + 0x30]
add esp, 0xc
call fcn.00469940
pop ecx
pop ecx
push dword [0x50e82c]
push ecx
mov dword [esp + 0x18], esp
cmp eax, esi
je 0x43e228
mov ecx, esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d4], 0xdd
mov eax, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00467720
pop ecx
lea eax, [esp + 0x240]
push eax
mov byte [esp + 0x28d8], 0xdb
call fcn.00468fd0
add esp, 8
mov byte [esp + 0x28d0], 0xde
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Success:_n_s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x234]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43bd3b
mov eax, esp
push str.Failed_extracting.
push eax
call fcn.00468c80
pop ecx
pop ecx
jmp 0x43d9f3
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.004235dd
mov byte [esp + 0x28c8], 0xdf
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43e270
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.0042364b
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1110]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xe0
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1110]
push eax
call fcn.0043a83a
lea eax, [esp + 0x1114]
push eax
lea eax, [esp + 0x1a8]
push eax
call fcn.0043a8d3
add esp, 0x18
push esi
push str.Info
push dword [esp + 0x19c]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x43bd3b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.004235dd
mov byte [esp + 0x28c8], 0xe1
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43e324
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.0042364b
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xde0]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xe2
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xde0]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0xe5c], esi
jne 0x43e396
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FAILED_LOADING_CONTAINERS_
jmp 0x43bd31
lea eax, [esp + 0xdd4]
push eax
lea eax, [esp + 0x240]
push eax
call fcn.0043aba2
pop ecx
pop ecx
push esi
push str.Sandbox
push dword [esp + 0x244]
jmp 0x43e2e4
push str._GetProperty_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4ec0a8
call fcn.004af8d0
mov edx, dword [esp + 0x2c]
pop ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x1a0]
call fcn.004235f2
push 1
push esi
push ecx
mov byte [esp + 0x28d4], 0xe3
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x12c0]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xe4
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x12c0]
push eax
call fcn.0043a83a
add esp, 0x10
lea ecx, [esp + 0x108]
call fcn.0042148a
lea eax, [esp + 0x2a8]
push eax
mov byte [esp + 0x28cc], 0xe5
call fcn.00429447
lea eax, [esp + 0x108]
push eax
push ecx
mov byte [esp + 0x28d0], 0xe6
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.004235f2
push 3
lea edi, [esp + 0x12c0]
call fcn.00482e60
mov ecx, dword [esp + 0x108]
mov eax, dword [ecx - 0xc]
cmp eax, esi
jne 0x43e4af
push 6
jmp 0x43bd3c
lea edx, [esp + 0x2a8]
push edx
push eax
push ecx
call fcn.00472950
mov eax, dword [esp + 0x2cc]
mov eax, dword [eax]
add esp, 0xc
lea edi, [esp + 0x2a8]
lea esi, [esp + 0x94]
call fcn.0042982e
mov eax, dword [esp + 0x2c0]
lea esi, [esp + 0xf8]
call fcn.0042982e
mov edi, esi
lea esi, [esp + 0x94]
call fcn.0042a35b
test al, al
jne 0x43bfc8
xor ebx, ebx
lea esi, [esp + 0x94]
call fcn.00429f7a
push dword [eax]
lea eax, [esp + 0x1a0]
call fcn.00423675
test eax, eax
jne 0x43e592
call fcn.00429f7a
add eax, 4
push dword [eax]
lea ecx, [esp + 0xf8]
call fcn.00424fef
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x43e583
mov ecx, dword [esp + 0xf4]
push ebx
mov dword [esp + 0x130], ebx
mov edx, dword [ecx - 0xc]
lea esi, [esp + 0x130]
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43e583
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0xf4]
cmp eax, dword [ecx - 0xc]
je 0x43e5d3
mov ecx, dword [esp + 0xf4]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [esp + 0x94]
call fcn.0042a30e
mov eax, dword [esp + 0x2c0]
lea edi, [esp + 0x2a8]
lea esi, [esp + 0xf8]
call fcn.0042982e
mov edi, esi
lea esi, [esp + 0x94]
call fcn.0042a35b
test al, al
je 0x43e508
jmp 0x43bfc8
push ebx
jmp 0x43bd3c
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.004235dd
mov byte [esp + 0x28c8], 0xe7
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43e60d
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.0042364b
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x840]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xe8
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x840]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0x8bc], esi
jne 0x43e67a
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43e38c
lea eax, [esp + 0x834]
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.0043a8d3
pop ecx
pop ecx
push str._n_nSandboxing:_n_n
lea ecx, [esp + 0xf4]
mov byte [esp + 0x28cc], 0xe9
call fcn.004292d5
lea eax, [esp + 0x834]
push eax
lea eax, [esp + 0x248]
push eax
call fcn.0043aba2
pop ecx
pop ecx
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x28cc], 0xea
call fcn.00423660
mov byte [esp + 0x28c8], 0xe9
mov ecx, dword [esp + 0x244]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xf0]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
add eax, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, str..txt
push ebx
mov dword [esp + 0x2c], eax
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0xeb
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00467720
pop ecx
push edi
mov byte [esp + 0x28dc], 0xe9
call fcn.00468fd0
mov edi, dword [esp + 0x30]
add esp, 0xc
call fcn.00469940
pop ecx
pop ecx
push esi
push str.Package_info
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0xec
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00467720
pop ecx
lea eax, [esp + 0x25c]
push eax
mov byte [esp + 0x28dc], 0xe9
call fcn.00468fd0
add esp, 0xc
mov byte [esp + 0x28d0], 0xed
push dword [eax]
lea eax, [esp + 0x158]
push str.Saved_in:__s
push eax
call fcn.00468c80
add esp, 0xc
push dword [eax]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x14c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24c]
jmp 0x43e21b
lea ecx, [esp + 0x10]
call fcn.0042148a
lea ecx, [esp + 0x114]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x28cc], 0xf3
call fcn.004235dd
mov byte [esp + 0x28c8], 0xf4
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x43e81e
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x24]
call fcn.0042364b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str..ini
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0xf5
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x144]
push eax
mov byte [esp + 0x28d4], 0xf4
call fcn.00468fd0
add esp, 8
mov byte [esp + 0x28cc], 0xf6
lea eax, [esp + 0x140]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
call fcn.0046cc40
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xe70]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xf7
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xe70]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0xeec], esi
jne 0x43e8ee
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x43e38c
lea eax, [esp + 0x114]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.004235f2
push 3
lea edi, [esp + 0xe70]
call fcn.00482e60
mov ecx, dword [esp + 0x114]
mov eax, dword [ecx - 0xc]
cmp eax, esi
jne 0x43e935
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x43bd85
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x144]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
call fcn.00469940
jmp 0x43d9f8
push str.AppID_ShortDesc_FriendlyName_Category_DownloadUrl_IconUrl_Version_BuildUid_Size_PopularityIndex_n
lea ecx, [esp + 0x6c]
call fcn.004235f2
lea ecx, [esp + 0x24]
mov dword [esp + 0x11c], esi
mov dword [esp + 0x1bc], esi
call fcn.0042148a
push 1
push esi
push ecx
mov byte [esp + 0x28d4], 0xf9
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x13e0]
push eax
call fcn.00480850
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x28d4], 0xfa
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0xfb
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0xfc
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0xfd
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x13f0]
push eax
mov byte [esp + 0x28e8], 0xfa
call fcn.00430504
mov edi, 0x4e3570
push edi
lea eax, [esp + 0x1d0]
push 0x51219c
push eax
call fcn.00423841
add esp, 0x2c
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x28cc], 0xfe
call fcn.00423660
mov byte [esp + 0x28c8], 0xfa
mov ecx, dword [esp + 0x1ac]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea ecx, [esp + 0x6c]
call fcn.004292d5
push edi
push 0x5121a4
lea eax, [esp + 0x25c]
push eax
call fcn.00423841
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x28cc], 0xff
call fcn.00423660
mov byte [esp + 0x28c8], 0xfa
mov ecx, dword [esp + 0x254]
add ecx, 0xfffffff0
call fcn.0042101a
push str.Productivity_
lea ecx, [esp + 0x6c]
call fcn.004292d5
mov ebx, dword [esp + 0x28]
lea eax, [ebx + 1]
cmp dword [esp + 0x50], eax
jle 0x43eae3
mov eax, dword [esp + 0x2c]
push dword [eax + ebx*4 + 4]
lea ebx, [esp + 0x6c]
push 0x4ec2a0
call fcn.00426566
mov ebx, dword [esp + 0x30]
pop ecx
pop ecx
xor esi, esi
jmp 0x43eaf1
push str._Download_URL_here__
lea ecx, [esp + 0x6c]
call fcn.004292d5
lea eax, [ebx + 2]
cmp dword [esp + 0x50], eax
jle 0x43eb15
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ebx, [esp + 0x6c]
push 0x4ec2a0
call fcn.00426566
pop ecx
pop ecx
xor esi, esi
jmp 0x43eb23
push str._Icon_here__
lea ecx, [esp + 0x6c]
call fcn.004292d5
push edi
lea eax, [esp + 0x1b8]
push 0x5121ac
push eax
call fcn.00423841
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x28cc], 0x100
call fcn.00423660
mov ebx, 0xfa
mov dword [esp + 0x28c8], ebx
mov ecx, dword [esp + 0x1b4]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
lea eax, [esp + 0x260]
push 0x5121dc
push eax
call fcn.00423841
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x28cc], 0x101
call fcn.00423660
mov dword [esp + 0x28c8], ebx
mov ecx, dword [esp + 0x25c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x120]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00467720
pop ecx
call fcn.0046cba0
add esp, 0xc
push dword [esp + 0x11c]
lea eax, [esp + 0x270]
push 0x4e17d8
push eax
call fcn.00468c80
add esp, 0xc
push edi
push eax
lea eax, [esp + 0x26c]
push eax
mov dword [esp + 0x28d4], 0x102
call fcn.00423841
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x28cc], 3
call fcn.00423660
mov ecx, dword [esp + 0x264]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [esp + 0x28c8], ebx
mov ecx, dword [esp + 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4e22cc
lea ecx, [esp + 0x6c]
call fcn.004292d5
mov eax, dword [esp + 0x28]
add eax, 3
cmp dword [esp + 0x50], eax
jle 0x43ecc9
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..csv
call fcn.004235f2
push ecx
mov dword [esp + 0x28d0], 0x104
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00467720
pop ecx
lea eax, [esp + 0x1d0]
push eax
mov dword [esp + 0x28d4], ebx
call fcn.00468fd0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x28cc], 0x105
call fcn.00423636
mov dword [esp + 0x28c8], ebx
mov ecx, dword [esp + 0x1c8]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43ecd9
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ecx, [esp + 0x28]
call fcn.0042364b
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
call fcn.00469940
pop ecx
pop ecx
push dword [0x50e82c]
push ecx
mov dword [esp + 0x18], esp
cmp eax, esi
jne 0x43ed22
mov eax, esp
lea ecx, [esp + 0x2c]
push ecx
push str.Could_not_save_to
push eax
call fcn.00423896
jmp 0x43bec8
mov ecx, esp
lea eax, [esp + 0x2c]
jmp 0x43de07
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xff0]
push eax
call fcn.00480850
mov dword [esp + 0x28c8], 0x106
cmp dword [esp + 0x106c], esi
jne 0x43ed74
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43cb3a
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51219c]
push str._s.AppVirtDll.dll
push eax
call fcn.00468c80
lea eax, [esp + 0xec]
add esp, 0xc
push eax
call fcn.00468380
add esp, 4
mov byte [esp + 0x28cc], 7
lea eax, [esp + 0xe0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28d0], 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.004235f2
push 2
pop ecx
lea edi, [esp + 0xfec]
mov byte [esp + 0x28d0], 7
call fcn.00483000
push dword [0x50e82c]
lea eax, [esp + 0xe0]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x228]
push eax
call fcn.0048ae70
add esp, 4
mov byte [esp + 0x28d0], 9
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov byte [esp + 0x28c8], 7
mov ecx, dword [esp + 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0xe0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.0046cc40
jmp 0x43d9f9
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004235dd
push 0x2e
lea ecx, [esp + 0x28]
mov dword [esp + 0x28cc], 0x10a
call fcn.00434184
push eax
lea eax, [esp + 0x1d4]
push eax
lea ecx, [esp + 0x2c]
call fcn.004237e1
push str..new.exe
push eax
lea eax, [esp + 0x94]
push eax
mov byte [esp + 0x28d4], 0xb
call fcn.00423841
add esp, 0xc
mov byte [esp + 0x28c8], 0xd
mov ecx, dword [esp + 0x1d0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x228]
call fcn.004235f2
push esi
mov byte [esp + 0x28cc], 0xe
push dword [esp + 0x90]
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43ef3d
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push dword [esp + 0x30]
push str.Cant_copy__s_to__s
push eax
call fcn.00468c80
add esp, 0x10
jmp 0x43bd36
push dword [esp + 0x8c]
push dword [esp + 0x28]
call fcn.00434352
pop ecx
pop ecx
xor esi, esi
inc esi
push esi
push 0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x4a0]
push eax
call fcn.00480850
push esi
push esi
push ecx
mov byte [esp + 0x28d4], 0xf
lea eax, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x11a0]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0x10
push dword [0x50e82c]
lea eax, [esp + 0x50]
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x4a0]
push eax
call fcn.0043a83a
add esp, 0x10
lea eax, [esp + 0x34]
lea ecx, [esp + 0x504]
call fcn.004421e1
jmp 0x43f0f5
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CEChangeEngine.tmp
call fcn.004235f2
lea eax, [esp + 0xa0]
push eax
call fcn.00468380
add esp, 4
mov byte [esp + 0x28cc], 0x11
lea eax, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
lea esi, [esp + 0x38]
mov byte [esp + 0x28cc], 0x12
call fcn.00423b61
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
call fcn.00423b61
mov byte [esp + 0x28d0], 0x11
mov ecx, dword [eax + 0x28]
lea edi, [esp + 0x49c]
call fcn.00483000
test eax, eax
jne 0x43f151
call fcn.00423b61
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x4000
mov byte [esp + 0x28d0], 0x13
call fcn.00423b61
push dword [eax + 0x28]
lea eax, [esp + 0xa8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x11a4]
push eax
mov byte [esp + 0x28dc], 0x11
call fcn.00482800
test eax, eax
jne 0x43f17d
push ecx
lea eax, [esp + 0xa0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.0046cc40
pop ecx
mov byte [esp + 0x28c8], 0x10
mov ecx, dword [esp + 0x9c]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.00442259
lea eax, [esp + 0x2cc]
lea ecx, [esp + 0x504]
call fcn.004421f6
mov edi, eax
lea esi, [esp + 0x34]
call fcn.00423bb4
test al, al
jne 0x43efe3
lea eax, [esp + 0x494]
call fcn.00481a70
lea eax, [esp + 0x1194]
call fcn.00481a70
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push str.Successfully_changed_Loader:__s
jmp 0x43d158
push dword [0x50e82c]
call fcn.00423b61
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x40]
call fcn.00423b61
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x43ef30
push dword [0x50e82c]
lea esi, [esp + 0x38]
call fcn.00423b61
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
jmp 0x43f16a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004235dd
push 0x2e
lea ecx, [esp + 0x24]
mov dword [esp + 0x28cc], 0x114
call fcn.00434184
push eax
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0x28]
call fcn.004237e1
push str..new.exe
push eax
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x28d4], 0x15
call fcn.00423841
add esp, 0xc
mov byte [esp + 0x28c8], 0x17
mov ecx, dword [esp + 0x1d8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0xa8]
call fcn.004235f2
push esi
mov byte [esp + 0x28cc], 0x18
push dword [esp + 0xa4]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43f256
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xa8]
push dword [esp + 0x2c]
jmp 0x43ef2a
push 1
push 1
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x410]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0x19
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x410]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0x48c], esi
jne 0x43f2cc
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_open_PeContainer
jmp 0x43bd31
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.004235f2
push 0
push 2
push ecx
mov byte [esp + 0x28d8], 0x1a
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x414]
push eax
mov byte [esp + 0x28dc], 0x19
call fcn.00482800
test eax, eax
je 0x43f32e
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x43bd31
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0
push 8
push ecx
mov byte [esp + 0x28d8], 0x1b
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
lea eax, [esp + 0xb8]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235dd
push edi
call fcn.004780c0
pop ecx
pop ecx
lea eax, [esp + 0x414]
push eax
mov byte [esp + 0x28dc], 0x19
call fcn.00482800
test eax, eax
je 0x43f39a
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x43bd31
lea ecx, [esp + 0x134]
call fcn.0042148a
lea ecx, [esp + 0x124]
call fcn.0042148a
lea eax, [esp + 0x134]
push eax
push ecx
mov byte [esp + 0x28d0], 0x1d
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.004235f2
push 3
lea edi, [esp + 0x410]
call fcn.00482e60
test eax, eax
je 0x43f3f8
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x43bd31
lea eax, [esp + 0x124]
push eax
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
lea eax, [esp + 0xb0]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235dd
push edi
call fcn.0048ae70
add esp, 4
mov byte [esp + 0x28d4], 0x1e
mov ecx, esp
mov dword [esp + 0x20], esp
push str.EngineVersion
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x1f
lea eax, [esp + 0x144]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d8], 0x1d
call fcn.0046df20
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004235f2
push 0x4000
push 3
pop esi
push ecx
mov byte [esp + 0x28d4], 0x20
lea eax, [esp + 0x130]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235dd
mov ecx, esi
lea ebx, [esp + 0x410]
mov byte [esp + 0x28d4], 0x1d
call fcn.004825e0
test eax, eax
je 0x43f4c9
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x43bd31
lea eax, [esp + 0x404]
call fcn.00481a70
push dword [0x50e82c]
lea eax, [esp + 0xa8]
push ecx
mov dword [esp + 0x18], esp
mov esi, esp
push dword [esp + 0xa8]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x260]
push eax
call fcn.0048ae70
pop ecx
pop ecx
mov byte [esp + 0x28d4], 0x21
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00468c80
add esp, 0x10
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43d168
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.004235dd
push 0x2e
lea ecx, [esp + 0x24]
mov dword [esp + 0x28cc], 0x122
call fcn.00434184
push eax
lea eax, [esp + 0x1e4]
push eax
lea ecx, [esp + 0x28]
call fcn.004237e1
push str..new.exe
push eax
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x28d4], 0x23
call fcn.00423841
add esp, 0xc
mov byte [esp + 0x28c8], 0x25
mov ecx, dword [esp + 0x1e0]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x234]
call fcn.004235f2
push esi
mov byte [esp + 0x28cc], 0x26
push dword [esp + 0xb0]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43f5fd
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xb4]
push dword [esp + 0x2c]
jmp 0x43ef2a
push 1
push 1
push ecx
lea eax, [esp + 0xb8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x720]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0x27
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x720]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0x79c], esi
jne 0x43f66e
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43f2c2
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Main
call fcn.004235f2
push esi
push 3
push ecx
mov byte [esp + 0x28d8], 0x28
lea eax, [esp + 0x240]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x724]
push eax
mov byte [esp + 0x28dc], 0x27
call fcn.00482800
cmp eax, esi
je 0x43f6ce
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEINI
jmp 0x43bd31
lea eax, [esp + 0x714]
call fcn.00481a70
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xb4]
push str.Successfully_changed_INI._nNew_package_saved_in:_n_s
jmp 0x43d9ea
lea esi, [esp + 0x5b4]
call fcn.0042cc9f
mov dword [esp + 0x28c8], 0x129
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
push dword [edi + esi*4 + 4]
lea ecx, [esp + 0x5fc]
call fcn.0042364b
push dword [edi + esi*4 + 8]
lea ecx, [esp + 0x5d4]
call fcn.0042364b
push dword [edi + esi*4 + 0xc]
lea ecx, [esp + 0x5cc]
call fcn.0042364b
push eax
lea ecx, [esp + 0x5c4]
call fcn.00423636
push dword [edi + esi*4 + 0x10]
lea ecx, [esp + 0x604]
call fcn.0042364b
push dword [edi + esi*4 + 0x14]
lea ecx, [esp + 0x600]
call fcn.0042364b
lea eax, [esp + 0xef4]
push eax
lea edi, [esp + 0x5b8]
call fcn.004952a0
lea eax, [esp + 0xef4]
push eax
mov byte [esp + 0x28cc], 0x2a
call fcn.00495440
test eax, eax
je 0x43f7ec
xor esi, esi
mov eax, 0x4ec790
cmp dword [esp + 0xef4], esi
jne 0x43f7b6
mov eax, 0x4ec798
push dword [esp + 0xf00]
push dword [esp + 0xf00]
push eax
lea eax, [esp + 0x1f4]
push str.Need_to_update:__s_nVersion:__s_nBuildUID:__s_n
push eax
call fcn.00468c80
add esp, 0x14
push esi
push str.Server_test:
push dword [esp + 0x1f0]
jmp 0x43e2e4
push 0
push str.Server_test:
push str.Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
jmp 0x43bd3c
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x43f83b
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push esi
push edi
call fcn.0043224f
pop ecx
jmp 0x43bee6
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x7b0]
push eax
call fcn.00480850
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x28d4], 0x12b
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x2c
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x2d
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0x2e
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x7c0]
push eax
mov byte [esp + 0x28e8], 0x2b
call fcn.00430504
add esp, 0x20
lea ecx, [esp + 0x7a4]
call fcn.0042f891
lea eax, [esp + 0x7a4]
call fcn.00481a70
mov dword [esp + 0x28c8], 4
lea eax, [esp + 0x7a4]
jmp 0x43ca42
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xc30]
push eax
call fcn.00480850
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x28d4], 0x12f
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x30
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x31
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0x32
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xc40]
push eax
mov byte [esp + 0x28e8], 0x2f
call fcn.00430504
add esp, 0x20
push esi
push esi
push esi
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push esi
push eax
call fcn.0047d260
pop ecx
pop ecx
call fcn.00494540
add esp, 0x10
lea eax, [esp + 0xc24]
call fcn.00481a70
mov dword [esp + 0x28c8], 4
lea eax, [esp + 0xc24]
jmp 0x43ca42
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x148]
call fcn.004235f2
mov dword [esp + 0x28c8], 0x133
mov eax, dword [esp + 0x2c]
push dword [eax + edi*4 + 8]
lea ecx, [esp + 0x8c]
call fcn.004235f2
push 0x10
mov byte [esp + 0x28cc], 0x34
push esi
push dword [esp + 0x14c]
call fcn.004b32ae
add esp, 8
mov edi, eax
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x8c]
push edi
push str.SetFileFlags:__0x_x____s_
push eax
call fcn.00468c80
add esp, 0x10
call fcn.00439f21
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xd50]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0x35
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xd50]
push eax
call fcn.0043a83a
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x36
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x37
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0x38
mov ecx, esp
lea eax, [esp + 0x34]
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xd60]
push eax
mov byte [esp + 0x28e8], 0x35
call fcn.00430504
call fcn.004758d0
mov ebx, 0x511a0c
mov eax, ebx
call fcn.00489730
mov eax, dword [esp + 0xa8]
push esi
call fcn.00476050
add esp, 0x24
cmp eax, esi
je 0x43fba0
mov eax, dword [eax + 0x24]
mov dword [eax], edi
push dword [0x511a0c]
mov eax, ebx
call fcn.0048a670
test eax, eax
je 0x43fb8a
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x90]
push edi
push str.Success:_n__x___s
push eax
call fcn.00468c80
add esp, 0x10
call fcn.0043a7c0
pop ecx
jmp 0x43fbc1
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str._SetFileFlags:_could_not_save_tree
push eax
call fcn.00468c80
pop ecx
pop ecx
jmp 0x43fbbc
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x8c]
push str._SetFileFlags:_could_not_find__s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.00439f21
pop ecx
mov eax, ebx
call fcn.00489740
lea eax, [esp + 0xd44]
mov byte [esp + 0x28c8], 0x34
call fcn.004266f0
mov ecx, dword [esp + 0x88]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x144]
jmp 0x43c241
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.DbgZip
call fcn.004235f2
call fcn.00439f51
mov dword [esp], str._DbgZip:
call fcn.004af97a
mov edx, dword [esp + 0x2c]
pop ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x60]
call fcn.0042364b
jmp 0x43bc20
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x690]
push eax
call fcn.00480850
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x28d4], 0x139
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x3a
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x3b
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x28e4], 0x3c
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x6a0]
push eax
mov byte [esp + 0x28e8], 0x39
call fcn.00430504
add esp, 0x20
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x690]
push eax
call fcn.0043a83a
lea eax, [esp + 0x694]
push eax
push dword [esp + 0x5c]
mov ecx, 0x512190
call fcn.00433de1
add esp, 0x18
mov dword [esp + 0x28c8], 4
lea eax, [esp + 0x684]
jmp 0x43ca42
push 1
xor edi, edi
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1230]
push eax
call fcn.00480850
push 0xffffffffffffffff
push edi
push ecx
mov dword [esp + 0x28d4], 0x143
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x44
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x45
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0x46
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1240]
push eax
mov byte [esp + 0x28e8], 0x43
call fcn.00430504
add esp, 0x20
lea esi, [esp + 0xf8]
call fcn.004869e0
mov byte [esp + 0x28c8], 0x47
mov dword [esp + 0x30], edi
jmp 0x43fe67
push dword [0x51219c]
lea eax, [esp + 0x26b8]
push eax
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x43fe67
xor edi, edi
cmp dword [esp + 0x22b0], edi
jbe 0x43fe67
lea esi, [esp + edi*8 + 0x22b4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x43fe5d
test byte [esp + edi*8 + 0x22b8], 3
je 0x43fe5d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5121e8
call fcn.004235dd
push ecx
mov byte [esp + 0x28d0], 0x48
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x51219c
call fcn.004235dd
mov byte [esp + 0x28d0], 0x47
mov ebx, dword [esi]
call fcn.004366ed
pop ecx
pop ecx
inc edi
cmp edi, dword [esp + 0x22b0]
jb 0x43fe07
push 1
lea eax, [esp + 0x1e90]
push eax
lea eax, [esp + 0x38]
lea ebx, [esp + 0x100]
call fcn.004864b0
test eax, eax
jne 0x43fde3
xor esi, esi
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, ebx
call fcn.00486a00
mov dword [esp + 0x28c8], 4
lea eax, [esp + 0x1224]
jmp 0x43ca42
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1350]
push eax
call fcn.00480850
push 0xffffffffffffffff
mov dword [esp + 0x28cc], 0x149
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x4a
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Vintegrate_
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x4b
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push esi
push ecx
mov byte [esp + 0x28e4], 0x4c
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1360]
push eax
mov byte [esp + 0x28e8], 0x49
call fcn.00430504
add esp, 0x20
call fcn.0043a6f4
jmp 0x43bd3b
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push str._ProcessList:all
push dword [eax + ecx*4]
call fcn.004af6c3
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
lea esi, [esp + 0xf8]
inc edi
call fcn.004869e0
mov dword [esp + 0x28c8], 0x14d
and dword [esp + 0x20], 0
lea ecx, [esp + 0x44]
call fcn.0042148a
xor eax, eax
test edi, edi
sete al
mov byte [esp + 0x28c8], 0x4e
mov dword [esp + 0x30], eax
jmp 0x440272
lea eax, [esp + 0x1c8c]
push eax
lea eax, [esp + 0x274]
push str._AppID_ws_n
push eax
call fcn.00468c80
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28cc], 0x4f
call fcn.00423660
mov byte [esp + 0x28c8], 0x4e
mov ecx, dword [esp + 0x270]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [esp + 0x1468]
lea eax, [esp + 0x1f4]
push str.____SerialId:__d_n
push eax
call fcn.00468c80
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28cc], 0x50
call fcn.00423660
mov byte [esp + 0x28c8], 0x4e
mov ecx, dword [esp + 0x1f0]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1880]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x23c]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00468c80
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28cc], 0x51
call fcn.00423660
mov byte [esp + 0x28c8], 0x4e
mov ecx, dword [esp + 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + 0x1884]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x1fc]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00468c80
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28cc], 0x52
call fcn.00423660
mov byte [esp + 0x28c8], 0x4e
mov ecx, dword [esp + 0x1f8]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x258]
push str.____Processes:_n
push eax
call fcn.00468c80
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28cc], 0x53
call fcn.00423660
mov byte [esp + 0x28c8], 0x4e
mov ecx, dword [esp + 0x258]
add ecx, 0xfffffff0
call fcn.0042101a
xor edi, edi
cmp dword [esp + 0x1888], edi
jbe 0x440272
push 0x4e0608
lea ecx, [esp + 0xb8]
call fcn.004235f2
mov byte [esp + 0x28c8], 0x54
lea ebx, [esp + edi*8 + 0x188c]
push dword [ebx]
lea esi, [esp + 0xb8]
call fcn.00466bb0
pop ecx
test eax, eax
jne 0x440176
push 0x4e2e50
mov ecx, esi
call fcn.0042364b
push 0x5c
push ecx
lea eax, [esp + 0xbc]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x248]
push eax
call fcn.00469190
add esp, 0xc
mov byte [esp + 0x28c8], 0x55
push dword [eax]
lea eax, [esp + 0x204]
push dword [ebx]
push str._______wd:__ws
push eax
call fcn.00468c80
add esp, 0x10
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28cc], 0x56
call fcn.00423660
mov ecx, dword [esp + 0x200]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28c8], 0x54
mov ecx, dword [esp + 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [esp + edi*8 + 0x1890]
test eax, eax
je 0x44023f
push eax
lea eax, [esp + 0x20c]
push str._0x_x_
push eax
call fcn.00468c80
add esp, 0xc
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x28cc], 0x57
call fcn.00423660
mov byte [esp + 0x28c8], 0x54
mov ecx, dword [esp + 0x208]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x4df154
lea ecx, [esp + 0x48]
call fcn.004292d5
mov byte [esp + 0x28c8], 0x4e
mov ecx, dword [esp + 0xb4]
add ecx, 0xfffffff0
call fcn.0042101a
inc edi
cmp edi, dword [esp + 0x1888]
jb 0x440137
push dword [esp + 0x30]
lea eax, [esp + 0x1468]
push eax
lea eax, [esp + 0x28]
lea ebx, [esp + 0x100]
call fcn.004864b0
test eax, eax
jne 0x43ffbf
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
cmp dword [esp + 0x28], eax
jne 0x4402bf
push str.No_active_virtual_apps
call fcn.004235f2
call fcn.0043a7c0
pop ecx
pop ecx
jmp 0x43f800
lea eax, [esp + 0x4c]
push eax
call fcn.004235dd
jmp 0x43d161
lea eax, [esp + 0x268]
push eax
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x44]
call fcn.0042c312
lea eax, [esp + 0x268]
push eax
call fcn.0042c44f
jmp 0x43bd3b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AutoUpdate
call fcn.004235f2
call fcn.00439f51
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x44033d
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x5121d4]
push str.AutoUpdate_s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.00439f51
mov ecx, 0x5121d4
mov dword [esp], str.https:__online.cameyo.com
call fcn.0042364b
push str.0000
mov ecx, 0x5121d8
call fcn.0042364b
mov ecx, edi
call fcn.00497670
jmp 0x43bee7
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.VirtRegSyncExport
call fcn.004235f2
call fcn.00439f51
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x4403d1
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
call fcn.00437a2e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00468c80
add esp, 0xc
jmp 0x43bee1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartStreaming:AppIDSkype
call fcn.004235f2
call fcn.0042641b
jmp 0x43f842
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x440441
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
xor ebx, ebx
call fcn.004235f2
push esi
push ecx
mov dword [esp + 0x28d4], 0x15a
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x5121e8]
xor edi, edi
push str._select___s_
push eax
call fcn.00468c80
add esp, 8
mov byte [esp + 0x28d8], 0x5b
mov ecx, esp
mov dword [esp + 0x44], esp
push str.explorer.exe
call fcn.004235f2
mov dword [esp + 0x28d8], 4
call fcn.00466dd0
add esp, 0x10
xor esi, esi
jmp 0x43bee7
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegister
call fcn.004235f2
call fcn.00439f51
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x4404f8
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
call fcn.0042906f
mov ebx, eax
cmp ebx, esi
jne 0x44051a
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_mount_virtual_registry
jmp 0x43bd31
call fcn.004758d0
push dword [0x50e82c]
push ebx
push edi
call fcn.004229ec
add esp, 0xc
push dword [0x50e82c]
mov edi, eax
cmp edi, esi
jne 0x440549
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Success
jmp 0x44055a
cmp edi, 5
jne 0x440568
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_register
call fcn.004235f2
call fcn.0043a7c0
pop ecx
pop ecx
jmp 0x4405b0
lea eax, [esp + 0x214]
push edi
push eax
call fcn.00470d80
add esp, 4
mov dword [esp + 0x28d0], 0x15c
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_registering_services:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x210]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
jmp 0x43bd3c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStart
call fcn.004235f2
call fcn.00439f51
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x4405ff
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
mov ecx, edi
call fcn.00423212
push dword [0x50e82c]
mov edi, eax
cmp edi, esi
je 0x44053b
cmp edi, 5
jne 0x44062c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_start
jmp 0x44055a
lea eax, [esp + 0x24c]
push edi
push eax
call fcn.00470d80
add esp, 4
mov dword [esp + 0x28d0], 0x15d
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_starting_services:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x248]
jmp 0x4405a8
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegisterStart
call fcn.004235f2
call fcn.00439f51
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x4406ba
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
call fcn.0042906f
mov ebx, eax
cmp ebx, esi
jne 0x4406d7
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x440510
call fcn.004758d0
push dword [0x50e82c]
push ebx
push edi
call fcn.004229ec
add esp, 0xc
mov ebx, str.Failed_registering_services:__s
cmp eax, 5
jne 0x440716
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_register
call fcn.004235f2
call fcn.0043a7c0
pop ecx
pop ecx
jmp 0x44076f
cmp eax, esi
je 0x44076f
push dword [0x50e82c]
push eax
lea eax, [esp + 0x220]
push eax
call fcn.00470d80
add esp, 4
mov dword [esp + 0x28d0], 0x15e
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push ebx
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov dword [esp + 0x28c8], 4
mov ecx, dword [esp + 0x218]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, edi
call fcn.00423212
push dword [0x50e82c]
mov edi, eax
cmp edi, esi
je 0x44053b
cmp edi, 5
je 0x44054e
lea eax, [esp + 0x264]
push edi
push eax
call fcn.00470d80
add esp, 4
mov dword [esp + 0x28d0], 0x15f
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push ebx
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x260]
jmp 0x4405a8
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStop
call fcn.004235f2
call fcn.00439f51
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x440819
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push esi
mov ecx, edi
call fcn.00422dba
mov edi, eax
pop ecx
push dword [0x50e82c]
cmp edi, esi
je 0x44053b
cmp edi, 5
jne 0x440848
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_stop
jmp 0x44055a
lea eax, [esp + 0x1c4]
push edi
push eax
call fcn.00470d80
add esp, 4
mov dword [esp + 0x28d0], 0x160
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_stopping_services:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c0]
jmp 0x4405a8
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRemove
call fcn.004235f2
call fcn.00439f51
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
mov edi, 0x512190
push edi
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x4408d6
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push 1
mov ecx, edi
call fcn.00422dba
mov edi, eax
pop ecx
push dword [0x50e82c]
cmp edi, esi
je 0x44053b
cmp edi, 5
jne 0x440906
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_remove
jmp 0x44055a
lea eax, [esp + 0x1c8]
push edi
push eax
call fcn.00470d80
add esp, 4
mov dword [esp + 0x28d0], 0x161
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_removing_services:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c4]
jmp 0x4405a8
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Cameyo.exe__UpgradePkg_
call fcn.004235f2
call fcn.00439f51
pop ecx
lea ecx, [esp + 0xc4]
call fcn.0042148a
mov byte [esp + 0x28c8], 0x64
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push dword [eax + ecx*4]
lea ecx, [esp + 0xc4]
call fcn.004235f2
push ecx
mov byte [esp + 0x28cc], 0x65
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.0046bf20
pop ecx
cmp eax, esi
jne 0x4409d1
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc8]
push str._s_not_found
jmp 0x43bec2
push esi
lea eax, [esp + 0xc8]
push eax
push ecx
lea eax, [esp + 0xcc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28d8], 0x66
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00467720
pop ecx
mov byte [esp + 0x28d8], 0x65
call fcn.00437d46
add esp, 0x10
push dword [0x50e82c]
cmp eax, esi
jne 0x440a36
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xcc]
push 0x4eb804
jmp 0x43d9ea
push eax
lea eax, [esp + 0x2e0]
push eax
call fcn.00470d80
add esp, 4
mov byte [esp + 0x28d0], 0x67
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xcc]
push dword [eax]
push str._s:__s
push ecx
jmp 0x43ef30
push str.Vintegrate:
lea ecx, [esp + 0xd0]
call fcn.004235f2
mov dword [esp + 0x28c8], 0x13d
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._VintegrateRecursive
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
je 0x440ac1
push 0x4eca20
call fcn.004af8d0
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
jne 0x440ad2
push str.VintegrateRecursive:
lea ecx, [esp + 0xd0]
call fcn.0042364b
push str._Windows_Explorer.exe
lea ecx, [esp + 0xe4]
call fcn.004235f2
mov byte [esp + 0x28c8], 0x3e
mov edi, dword [edi]
push 0x3a
push edi
call fcn.004b0428
pop ecx
pop ecx
cmp eax, esi
je 0x440b0b
add eax, 2
push eax
lea ecx, [esp + 0xe4]
call fcn.0042364b
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1080]
push eax
call fcn.00480850
push 0xffffffffffffffff
mov byte [esp + 0x28cc], 0x3f
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov eax, esp
mov byte [esp + 0x28d8], 0x40
mov dword [esp + 0x24], esp
lea ecx, [esp + 0xf0]
push ecx
lea ecx, [esp + 0xe0]
push ecx
push eax
call fcn.00429a78
add esp, 8
mov byte [esp + 0x28dc], 0x41
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push esi
push ecx
mov byte [esp + 0x28e4], 0x42
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1090]
push eax
mov byte [esp + 0x28e8], 0x3f
call fcn.00430504
add esp, 0x20
lea eax, [esp + 0x1074]
mov byte [esp + 0x28c8], 0x3e
call fcn.004266f0
mov ecx, dword [esp + 0xe0]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xcc]
jmp 0x43c241
lea ecx, [esp + 0x20]
call fcn.0042148a
lea ecx, [esp + 0xe4]
call fcn.0042148a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x28cc], 0xef
call fcn.004235dd
mov byte [esp + 0x28c8], 0xf0
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x440c39
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x64]
call fcn.0042364b
push 1
push esi
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xb10]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0xf1
push dword [0x50e82c]
lea eax, [esp + 0x50]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xb10]
push eax
call fcn.0043a83a
add esp, 0x10
cmp dword [esp + 0xb8c], esi
jne 0x440ca5
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x24]
call fcn.00426566
pop ecx
xor esi, esi
lea eax, [esp + 0xe4]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.004235f2
push 3
lea edi, [esp + 0xb10]
call fcn.00482e60
mov eax, dword [esp + 0xe4]
cmp dword [eax - 0xc], esi
jne 0x440ce6
push str.Cannot_obtain_INI_info_from_resource__n
lea ecx, [esp + 0x24]
call fcn.00429844
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x24]
call fcn.004241b4
push esi
push 0x4e2dd4
push dword [esp + 0x28]
jmp 0x43e2e4
lea eax, [esp + 0x20]
push eax
call fcn.00467940
mov byte [esp + 0x28cc], 0xa6
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
lea edi, [eax + ecx*4]
mov dword [esp], 0x4ebdf0
call fcn.004af8d0
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
test eax, eax
jne 0x440d65
push dword [edi]
lea ecx, [esp + 0x24]
call fcn.0042364b
push 0x4ebdf0
call fcn.004af8d0
pop ecx
push esi
lea ecx, [esp + 0x24]
push ecx
call fcn.00423689
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x440d98
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push 0x5121a0
lea ecx, [esp + 0x64]
call fcn.004235dd
lea eax, [esp + 0x54]
push eax
push 0x4e3570
lea eax, [esp + 0x7c]
mov byte [esp + 0x28d0], 0xa7
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x60], esi
call fcn.004292ea
jmp 0x441322
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x28]
call fcn.0042148a
lea ecx, [esp + 0x2c]
call fcn.0042148a
lea ecx, [esp + 0x3c]
call fcn.0042148a
push 0x3e
push ecx
mov byte [esp + 0x28d0], 0xac
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov dword [esp + 0x84], esi
lea edi, [esp + 0x84]
call fcn.004235dd
lea eax, [esp + 0x1d4]
push eax
mov ecx, edi
call fcn.0046d4c0
add esp, 0xc
mov byte [esp + 0x28c8], 0xad
call fcn.00423738
push eax
lea ecx, [esp + 0x28]
call fcn.00423636
mov byte [esp + 0x28c8], 0xac
mov ecx, dword [esp + 0x1cc]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
jne 0x440eac
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28c8], 0xa7
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x44130a
push 0x3e
push ecx
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x84]
call fcn.004235dd
lea eax, [esp + 0x1dc]
push eax
mov ecx, edi
call fcn.0046d4c0
add esp, 0xc
mov byte [esp + 0x28c8], 0xae
call fcn.00423738
push eax
lea ecx, [esp + 0x2c]
call fcn.00423636
mov byte [esp + 0x28c8], 0xac
mov ecx, dword [esp + 0x1d4]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
je 0x440e63
push 0x3e
push ecx
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1e4]
push eax
mov ecx, edi
call fcn.0046d4c0
add esp, 0xc
mov byte [esp + 0x28c8], 0xaf
call fcn.00423738
push eax
lea ecx, [esp + 0x30]
call fcn.00423636
mov byte [esp + 0x28c8], 0xac
mov ecx, dword [esp + 0x1dc]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
jne 0x440f77
push ebx
lea ecx, [esp + 0x30]
call fcn.0042364b
jmp 0x440fd1
push 0x3e
push ecx
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x84]
call fcn.004235dd
lea eax, [esp + 0x1ec]
push eax
mov ecx, edi
call fcn.0046d4c0
add esp, 0xc
mov byte [esp + 0x28c8], 0xb0
call fcn.00423738
push eax
lea ecx, [esp + 0x40]
call fcn.00423636
mov byte [esp + 0x28c8], 0xac
mov ecx, dword [esp + 0x1e4]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [esp + 0x78], 0xffffffff
jne 0x440fe2
push ebx
lea ecx, [esp + 0x40]
call fcn.0042364b
push dword [esp + 0x24]
lea eax, [esp + 0xb4]
push str._exec___s_
push eax
call fcn.00468c80
add esp, 0xc
mov byte [esp + 0x28c8], 0xb1
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], esi
je 0x44102e
push 0x4e43dc
lea ecx, [esp + 0xb4]
call fcn.004292d5
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xb4]
call fcn.00423660
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push ecx
mov edi, esp
mov byte [esp + 0x28d0], 0xb2
mov dword [esp + 0x1c], esp
push 0x5c
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004235dd
push edi
call fcn.00469190
lea eax, [esp + 0x124]
add esp, 0xc
push eax
mov byte [esp + 0x28d4], 0xb1
call fcn.00428c32
add esp, 8
mov byte [esp + 0x28cc], 0xb3
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4dec30
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0xb4
lea eax, [esp + 0x118]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28d4], 0xb5
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x5121e8
call fcn.004235dd
lea edi, [esp + 0xe0]
mov byte [esp + 0x28d4], 0xb3
call fcn.004687d0
add esp, 8
mov byte [esp + 0x28cc], 0xb6
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4dec30
call fcn.004235f2
push ecx
mov eax, esp
mov byte [esp + 0x28d0], 0xb7
mov dword [esp + 0x1c], esp
push str..lnk
lea ecx, [esp + 0x38]
push ecx
push eax
call fcn.00423841
add esp, 8
mov byte [esp + 0x28d4], 0xb8
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004235dd
lea edi, [esp + 0x1f8]
mov byte [esp + 0x28d4], 0xb6
call fcn.004687d0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x1ec]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [esp + 0xd8]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.0046bf20
pop ecx
cmp eax, esi
je 0x44118d
lea eax, [esp + 0xd4]
jmp 0x4411a7
push esi
lea ecx, [esp + 0x154]
call fcn.004235f2
mov byte [esp + 0x28c8], 0xb9
or dword [esp + 0x44], 2
mov esi, dword [eax]
push 0
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
push ecx
mov dword [esp + 0x28d4], 0xba
lea eax, [esp + 0xbc]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28d8], 0xbb
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28dc], 0xbc
mov dword [esp + 0x30], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4dec30
call fcn.004235f2
push ecx
mov eax, esp
mov byte [esp + 0x28e4], 0xbd
mov dword [esp + 0x98], esp
push str..lnk
lea ecx, [esp + 0x4c]
push ecx
push eax
call fcn.00423841
add esp, 8
mov byte [esp + 0x28e8], 0xbe
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28e8], 0xbc
call fcn.004687d0
add esp, 0xc
mov byte [esp + 0x28dc], 0xb9
call fcn.004932e0
add esp, 0x14
mov dword [esp + 0x28c8], 0xb6
test byte [esp + 0x44], 2
je 0x441297
mov ecx, dword [esp + 0x150]
and dword [esp + 0x44], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xd4]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x110]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0xb0]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [esp + 0x28c8], 0xa7
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
xor esi, esi
lea eax, [esp + 0x54]
push eax
push 0x4e3570
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x6c]
call fcn.004292ea
cmp dword [esp + 0x54], 0xffffffff
jne 0x440dcf
mov byte [esp + 0x28c8], 0xa7
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str.Shortcuts_created_for__s.
jmp 0x43d9ea
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004235dd
mov byte [esp + 0x28c8], 0x96
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._FullIntegrate
push dword [edi]
mov dword [esp + 0x5c], edi
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x44154b
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push 0x512190
call fcn.00428467
pop ecx
pop ecx
test al, al
jne 0x4413cc
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd85
push 0x5121e8
lea ecx, [esp + 0x24]
call fcn.004235dd
mov byte [esp + 0x28c8], 0x97
cmp dword [esp + 0x48], esi
je 0x441431
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x51219c
call fcn.004235dd
lea eax, [esp + 0x15c]
push eax
call fcn.00437cef
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x28cc], 0x98
call fcn.00423636
mov byte [esp + 0x28c8], 0x97
mov ecx, dword [esp + 0x158]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4dec30
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0x99
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x51219c]
push str._s.host.exe
push eax
call fcn.00468c80
add esp, 8
mov byte [esp + 0x28d4], 0x9a
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004235dd
lea edi, [esp + 0x16c]
mov byte [esp + 0x28d4], 0x97
call fcn.004687d0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x28cc], 0x9b
call fcn.00423636
mov byte [esp + 0x28c8], 0x97
mov ecx, dword [esp + 0x160]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [esp + 0x20]
call fcn.0046c000
test eax, eax
jne 0x4414e1
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_create_virtual_repository
jmp 0x43bd31
lea eax, [esp + 0x168]
push eax
call fcn.00467720
mov eax, dword [eax]
pop ecx
push 0
push dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x168]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042101a
cmp byte [esp + 0x43], 0
je 0x441535
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_executable_to_repository
jmp 0x43bd31
lea ecx, [esi - 0x10]
mov byte [esp + 0x28c8], 0x96
call fcn.0042101a
mov edi, dword [esp + 0x54]
xor esi, esi
push 1
push esi
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xba0]
push eax
call fcn.00480850
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x28d4], 0x9c
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x9d
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x9e
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.004235f2
push 2
push ecx
mov byte [esp + 0x28e4], 0x9f
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0xbb0]
push eax
mov byte [esp + 0x28e8], 0x9c
call fcn.00430504
push str._Integrate:once
push dword [edi]
call fcn.004af6c3
add esp, 0x28
mov edi, str.SoftwareVOS_s
test eax, eax
jne 0x44172f
push ebx
lea ecx, [esp + 0x94]
call fcn.004235f2
push esi
push esi
push esi
push ecx
mov byte [esp + 0x28d8], 0xa0
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Registered
lea ebx, [esp + 0xa4]
call fcn.004235f2
mov byte [esp + 0x28d8], 0xa1
push dword [0x51219c]
lea eax, [esp + 0x184]
push edi
push eax
call fcn.00468c80
add esp, 8
mov byte [esp + 0x28dc], 0xa2
or dword [esp + 0x58], 1
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Integrated
push eax
push ecx
call fcn.00423841
add esp, 0xc
mov dword [esp + 0x28dc], 0xa3
call fcn.0047bf30
push eax
mov byte [esp + 0x28e0], 0xa4
call fcn.00469a50
add esp, 0x18
test eax, eax
je 0x4416a1
mov eax, dword [esp + 0x90]
cmp dword [eax - 0xc], 0
je 0x4416a1
mov bl, 1
jmp 0x4416a3
xor bl, bl
mov dword [esp + 0x28c8], 0xa0
test byte [esp + 0x44], 1
je 0x4416c4
mov ecx, dword [esp + 0x170]
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x441716
push str.Success
lea eax, [esp + 0x94]
call fcn.00423675
push ecx
test eax, eax
mov dword [esp + 0x14], esp
mov eax, esp
jne 0x4416fb
push str._Integrate:once:_already_registered_successfully._Quitting.
push eax
call fcn.00468c80
pop ecx
pop ecx
call fcn.00439f21
jmp 0x43d167
push dword [esp + 0x94]
push str._Integrate:once:_already_attempted_registration_before__but_failed:__s._Trying_integration_again.
push eax
call fcn.00468c80
add esp, 0xc
call fcn.00439f21
pop ecx
mov byte [esp + 0x28c8], 0x9c
mov ecx, dword [esp + 0x90]
add ecx, 0xfffffff0
call fcn.0042101a
xor esi, esi
xor eax, eax
cmp dword [esp + 0x48], esi
push esi
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0xa5
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x51219c]
push edi
push eax
call fcn.00468c80
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x28dc], 0x9c
call fcn.00469f70
add esp, 0x14
lea eax, [esp + 0xb94]
push eax
push dword [esp + 0x4c]
mov ecx, 0x512190
call fcn.00433de1
pop ecx
pop ecx
lea eax, [esp + 0xb94]
call fcn.00481a70
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51219c]
push str._s_is_now_integrated_into_your_system.
jmp 0x43d9ea
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004673d0
test eax, eax
jne 0x441838
mov eax, dword [esp + 0x2c]
push esi
push esi
push esi
push ecx
mov edi, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [eax]
call fcn.004235f2
push edi
call fcn.0046f6f0
add esp, 4
mov byte [esp + 0x28dc], 0x3c
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28dc], 4
call fcn.00466f40
add esp, 0x14
cmp eax, esi
jne 0x43bd3b
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43bd2c
call fcn.004676d0
test eax, eax
jne 0x441853
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43af06
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push 0x4eb314
mov dword [esp + 0x58], edi
call fcn.004af8d0
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004b1ee6
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x18]
sbb edi, edi
push eax
lea ecx, [esp + 0x64]
inc edi
call fcn.004235dd
push ecx
mov byte [esp + 0x28cc], 0x3d
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0x3e
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x8c]
push eax
mov byte [esp + 0x28d4], 0x3d
call fcn.00468fd0
add esp, 0xc
mov byte [esp + 0x28c8], 0x3f
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x54]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.004235f2
lea eax, [esp + 0xc0]
push eax
call fcn.0046f6f0
pop ecx
pop ecx
push 1
push esi
push ecx
mov byte [esp + 0x28d4], 0x40
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x530]
push eax
call fcn.00480850
mov byte [esp + 0x28c8], 0x41
push dword [0x50e82c]
cmp dword [esp + 0x5b0], esi
jne 0x441967
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x20]
push str.Cannot_load_newly_created_package__s
jmp 0x43bec2
push 1
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x530]
push eax
call fcn.0043a83a
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28d8], 0x42
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004235f2
push ecx
mov byte [esp + 0x28dc], 0x43
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004235dd
push 2
push ecx
mov byte [esp + 0x28e4], 0x44
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x540]
push eax
mov byte [esp + 0x28e8], 0x41
call fcn.00430504
push dword [0x51219c]
lea eax, [esp + 0xcc]
push dword [0x5121e8]
push str._sAppVirtDll__s.dll
push eax
call fcn.00468c80
add esp, 0x2c
mov byte [esp + 0x28cc], 0x45
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.00425bba
pop ecx
cmp eax, esi
je 0x441aa0
push dword [0x50e82c]
cmp eax, 0x11
jne 0x441a62
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00468c80
pop ecx
pop ecx
jmp 0x43bd36
cmp eax, 0x12
jne 0x441a75
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x441a55
push eax
lea eax, [esp + 0x2e8]
push eax
call fcn.00470d80
add esp, 4
mov byte [esp + 0x28d0], 0x46
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x43c7e0
push dword [esp + 0xbc]
lea eax, [esp + 0x17c]
push str._exec__s
push eax
call fcn.00468c80
mov eax, dword [eax]
add esp, 0xc
push esi
push esi
push eax
push dword [esp + 0x24]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x178]
xor ebx, ebx
cmp eax, 0x20
setg bl
add ecx, 0xfffffff0
call fcn.0042101a
cmp ebx, esi
je 0x441b32
cmp edi, esi
je 0x441afa
push 1
push 0x4df158
push str.Installation_launched_in_virtual_mode..._nWhen_installation_is_done__click_OK_and_Cameyo_will_turn_it_into_a_virtual_package._nInstallation_will_not_truly_install_anything_on_your_hard_drive__it_is_simulated_.
jmp 0x441b05
push esi
push 0x4df158
push str.When_installation_is_done__click_OK.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x441b32
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.00425c41
pop ecx
push 0x14
jmp 0x43bd3c
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
call fcn.00425c41
pop ecx
cmp eax, esi
je 0x441bad
push dword [0x50e82c]
cmp eax, 0x11
jne 0x441b6c
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x441a55
cmp eax, 0x12
jne 0x441b82
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x441a55
push eax
lea eax, [esp + 0x2e4]
push eax
call fcn.00470d80
add esp, 4
mov byte [esp + 0x28d0], 0x47
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x43c7e0
cmp ebx, esi
jne 0x441bcf
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc4]
push str.Failed_executing__s
jmp 0x43bec2
mov ebx, dword [esp + 0x60]
cmp edi, esi
je 0x441cb3
call fcn.0042bdd7
push 0x407
mov edi, 0x512190
call fcn.00485a80
pop ecx
push esi
push dword [esp + 0x88]
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x84]
jne 0x441c1c
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c6fa
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
call fcn.0043610a
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, esi
jne 0x441d29
push dword [0x50e82c]
lea eax, [esp + 0x88]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x18c]
push eax
call fcn.00469190
add esp, 8
mov byte [esp + 0x28d0], 0x48
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov byte [esp + 0x28c8], 0x45
mov ecx, dword [esp + 0x180]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
call fcn.00485a80
pop ecx
lea eax, [esp + 0x524]
call fcn.00481a70
push dword [0x50e82c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x8c]
push 0x4eb804
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0xa8]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [esp + 0x524]
mov byte [esp + 0x28c8], 0x40
call fcn.004266f0
mov ecx, dword [esp + 0xbc]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [esp + 0x84]
add ecx, 0xfffffff0
jmp 0x43c785
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x30], 0x10
push dword [0x50e82c]
jne 0x441d4f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c7ad
push dword [esp + 0x34]
lea eax, [esp + 0x2ac]
push eax
call fcn.00470d80
add esp, 4
mov byte [esp + 0x28d0], 0x49
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c7d9
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x48]
call fcn.0042148a
mov byte [esp + 0x28c8], 0x33
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._CreateDiff
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x441dbd
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00423636
jmp 0x441dd7
push 0x4eb2d0
call fcn.004af8d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.0042364b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..mod
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0x34
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x190]
push eax
mov byte [esp + 0x28d4], 0x33
call fcn.00468fd0
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x28cc], 0x35
call fcn.00423636
mov byte [esp + 0x28c8], 0x33
mov ecx, dword [esp + 0x188]
add ecx, 0xfffffff0
call fcn.0042101a
mov ebx, dword [esp + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
push esi
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x48]
jne 0x441e75
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c6fa
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004235dd
call fcn.0043610a
pop ecx
pop ecx
mov dword [esp + 0x60], eax
cmp eax, esi
jne 0x441eec
push dword [0x50e82c]
lea eax, [esp + 0x4c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x19c]
push eax
call fcn.00469190
add esp, 8
mov byte [esp + 0x28d0], 0x36
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x190]
jmp 0x4420c0
push ebx
call edi
cmp dword [esp + 0x60], 0x10
push dword [0x50e82c]
jne 0x441f08
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c7ad
push dword [esp + 0x64]
lea eax, [esp + 0x2dc]
push eax
call fcn.00470d80
add esp, 4
mov byte [esp + 0x28d0], 0x37
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c7d9
lea ecx, [esp + 0x24]
call fcn.0042148a
lea ecx, [esp + 0x48]
call fcn.0042148a
mov byte [esp + 0x28c8], 0x26
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edi, [eax + ecx*4]
push str._LearnStreaming
push dword [edi]
call fcn.004af6c3
pop ecx
pop ecx
test eax, eax
jne 0x441f76
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00423636
jmp 0x441f90
push 0x4eb0ac
call fcn.004af8d0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.0042364b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.004235f2
push ecx
mov byte [esp + 0x28d0], 0x27
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1a0]
push eax
mov byte [esp + 0x28d4], 0x26
call fcn.00468fd0
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x28cc], 0x28
call fcn.00423636
mov byte [esp + 0x28c8], 0x26
mov ecx, dword [esp + 0x198]
add ecx, 0xfffffff0
call fcn.0042101a
mov ebx, dword [esp + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
push esi
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x48]
jne 0x44202e
push dword [0x50e82c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x43c6fa
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004235dd
push ecx
mov byte [esp + 0x28d0], 0x29
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
mov byte [esp + 0x28d0], 0x26
call fcn.004362f1
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, esi
jne 0x4420d9
push dword [0x50e82c]
lea eax, [esp + 0x4c]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004235dd
lea eax, [esp + 0x1ac]
push eax
call fcn.00469190
add esp, 8
mov byte [esp + 0x28d0], 0x2a
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0043a7c0
pop ecx
pop ecx
mov ecx, dword [esp + 0x1a0]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [ebx - 0x10]
call fcn.0042101a
mov ecx, dword [esp + 0x24]
jmp 0x43c241
push ebx
call edi
push dword [0x50e82c]
lea eax, [esp + 0x2cc]
push dword [esp + 0x20]
push eax
call fcn.00470d80
add esp, 4
mov byte [esp + 0x28d0], 0x2b
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x43c7e0
cmp dword [0x511e58], esi
je 0x442147
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x5121d4]
push str.CLoaderApp:_waiting_for_LoaderCanQuit__AutoUpdate_s_
push eax
call fcn.00468c80
add esp, 0xc
call fcn.00439f21
pop ecx
push 0xffffffffffffffff
push dword [0x511e58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CLoaderApp:_done._Bye_
call fcn.004235f2
call fcn.00439f21
mov eax, dword [0x50e83c]
pop ecx
cmp eax, 0xa2c2a
je 0x43bd3b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.CLoaderApp:_ExecWait:_g_LoaderExitCode_d
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.00439f21
pop ecx
push dword [0x50e83c]
jmp 0x43bd3c