Function at 0x427c83
Capabilities:
Contain obfuscated stackstrings
Create directory
Get disk information
Parse pe header
Query environment variable
Set environment variable

Disassembly:
push 0x60
mov eax, 0x4d6b95
call fcn.004b8118
xor esi, esi
mov dword [ebp - 0x18], esi
call fcn.004a35be
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042249e
mov dword [ebp - 4], esi
call fcn.004a35be
push eax
lea ecx, [ebp - 0x28]
call fcn.0042249e
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 1
call fcn.0042aff3
mov ebx, dword [ebp + 8]
push 0x10
lea eax, [ebx + 0x70]
push esi
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x48], eax
call fcn.004b25f0
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x10]
mov dword [ebx + 0x84], esi
push dword [ebp + 0xc]
mov dword [ebx + 0x88], esi
call fcn.0046e690
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x44], eax
mov edi, eax
cmp word [eax], si
je 0x427e87
push edi
lea ecx, [ebp - 0x20]
call fcn.0042462c
push 1
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x40], esp
push 0x4e516c
call fcn.0042462c
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 3
call fcn.0046ad50
add esp, 0xc
cmp eax, esi
je 0x427e64
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.CAMEYO_RO_
call fcn.0042462c
push ecx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x20]
mov dword [ebp - 0x40], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 3
call fcn.0046ad50
add esp, 0xc
cmp eax, esi
jne 0x427e64
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.CAMEYO_PKGPROT
call fcn.0042462c
push ecx
mov byte [ebp - 4], 6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x40], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 3
call fcn.0046ad50
add esp, 0xc
cmp eax, esi
jne 0x427e64
push str.CAMEYO_
call fcn.004b1c10
pop ecx
push esi
lea ecx, [ebp - 0x20]
push ecx
call fcn.004246c3
lea eax, [ebp - 0x40]
push eax
push 0x4e51bc
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x40], esi
call fcn.0042aeb5
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.00424d19
push esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 8
push eax
mov eax, dword [ebp - 0x40]
call fcn.004246c3
lea eax, [ebp - 0x38]
push eax
lea ebx, [ebp - 0x6c]
call fcn.0042b029
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.00424d3a
mov esi, dword [ebp - 0x30]
push ecx
mov eax, esp
mov dword [ebp - 0x4c], esp
push esi
push dword [ebp - 0x38]
push dword [ebp - 0x20]
push 0x4e51c0
push eax
call fcn.00466ad0
add esp, 0x14
call fcn.0042772b
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ebx, dword [ebp + 8]
xor esi, esi
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042201a
push edi
call fcn.004b1cba
lea edi, [edi + eax*2 + 2]
pop ecx
cmp word [edi], si
jne 0x427d0b
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x6c]
lea edi, [ebp - 0x24]
lea esi, [ebp - 0x34]
mov dword [ebp - 0x24], eax
call fcn.0042b460
test al, al
jne 0x427f5e
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.PkgProt
call fcn.0042462c
mov byte [ebp - 4], 9
call fcn.0043ee66
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push eax
call fcn.00424617
mov byte [ebp - 4], 2
call fcn.0046ad50
add esp, 0xc
test eax, eax
jne 0x427f51
call fcn.0043ee66
push eax
lea ecx, [ebp - 0x40]
call fcn.00424d19
lea edi, [ebp - 0x40]
mov byte [ebp - 4], 0xa
call fcn.0042af68
push dword [eax]
lea eax, [ebp - 0x44]
push str.CAMEYO_RO_PROPERTY__s
push eax
call fcn.00466ad0
add esp, 0xc
mov edi, eax
call fcn.0043ee66
mov edi, dword [edi]
add eax, 4
mov eax, dword [eax]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
lea esi, [ebp - 0x34]
call fcn.0042e04d
jmp 0x427e9e
push str.AppID
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
lea esi, [ebx + 0xc]
mov byte [ebp - 4], 0xb
push eax
lea ebx, [ebp - 0x6c]
mov dword [ebp - 0x44], esi
call fcn.0042b029
push eax
mov ecx, esi
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.AutoLaunch
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0xc
call fcn.0042b029
mov esi, dword [ebp + 8]
push eax
lea ecx, [esi + 0x10]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.Streamer
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0xd
call fcn.0042b029
push eax
lea ecx, [esi + 0x58]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.Shortcuts
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0xe
call fcn.0042b029
push eax
lea ecx, [esi + 0x14]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.FriendlyName
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0xf
call fcn.0042b029
push eax
lea ecx, [esi + 0x18]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.BaseDirName
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x10
call fcn.0042b029
push eax
lea ecx, [ebp - 0x1c]
call fcn.00424d3a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.DefaultVosRoot
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x11
lea edi, [esi + 0x60]
call fcn.0042b029
push eax
mov ecx, edi
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.DataDirName
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x12
call fcn.0042b029
push eax
lea ecx, [ebp - 0x28]
call fcn.00424d3a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.Publisher
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x13
call fcn.0042b029
push eax
lea ecx, [esi + 0x1c]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.Version
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x14
call fcn.0042b029
push eax
lea ecx, [esi + 0x20]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnStartVirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x15
push eax
call fcn.0042b029
push eax
lea ecx, [esi + 0x24]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnStartUnvirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x16
call fcn.0042b029
push eax
lea ecx, [esi + 0x28]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnStopVirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x17
call fcn.0042b029
push eax
lea ecx, [esi + 0x2c]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnStopUnvirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x18
call fcn.0042b029
push eax
lea ecx, [esi + 0x30]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnProcessStartVirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x19
call fcn.0042b029
push eax
lea ecx, [esi + 0x34]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnProcessStartUnvirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x1a
call fcn.0042b029
push eax
lea ecx, [esi + 0x38]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnProcessStopVirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0042b029
push eax
lea ecx, [esi + 0x3c]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.OnProcessStopUnvirtualized
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x1c
call fcn.0042b029
push eax
lea ecx, [esi + 0x40]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.StopInheritance
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x1d
call fcn.0042b029
push eax
lea ecx, [esi + 0x44]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.AutoUpdate
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x1e
call fcn.0042b029
push eax
lea ecx, [esi + 0x48]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.CloudPkgId
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x1f
call fcn.0042b029
push eax
lea ecx, [esi + 0x4c]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.BuildUID
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x20
call fcn.0042b029
push eax
lea ecx, [esi + 0x50]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.EnvVariables
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x21
call fcn.0042b029
push eax
lea ecx, [esi + 0x9c]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.GlobalVirtEnvVars
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x22
call fcn.0042b029
push eax
lea ecx, [esi + 0xa0]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.StartingDir
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x23
call fcn.0042b029
push eax
lea ecx, [esi + 0xa4]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.VirtMachineName
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x24
call fcn.0042b029
push eax
lea ecx, [esi + 0xc0]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.VirtUserName
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x25
call fcn.0042b029
push eax
lea ecx, [esi + 0xc4]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, str.AuthDenyMsgMode
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x26
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x42852d
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x27
call fcn.0042b029
push dword [eax]
call fcn.004b4131
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [esi + 0xd8], eax
call fcn.0042201a
push str.AuthDenyMsg
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x28
lea edi, [esi + 0xdc]
call fcn.0042b029
push eax
mov ecx, edi
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x42857f
push 0x4e248c
push 0x4e55dc
push edi
call fcn.0042ad3b
mov edi, str.AuthForceOnPkgChange
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x29
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x4285ef
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x2a
call fcn.0042b029
push dword [eax]
call fcn.004b4131
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [esi + 0xe0], eax
call fcn.0042201a
mov edi, str.AuthMaxOfflineDays
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x2b
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x42865f
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x2c
call fcn.0042b029
push dword [eax]
call fcn.004b4131
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [esi + 0xd4], eax
call fcn.0042201a
push str.ADAllowedGroups
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x2d
call fcn.0042b029
push eax
lea ecx, [esi + 0xe4]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.ADDeniedGroups
lea ecx, [ebp - 0x38]
call fcn.0042462c
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x2e
call fcn.0042b029
push eax
lea ecx, [esi + 0xe8]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, str.ADNestedCheck
push edi
lea ecx, [ebp - 0x30]
call fcn.0042462c
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x2f
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428739
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x30
call fcn.0042b029
push dword [eax]
call fcn.004b4131
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [esi + 0xec], eax
call fcn.0042201a
push str.ADAllowedDomains
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x31
call fcn.0042b029
push eax
lea ecx, [esi + 0xf4]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, str.ADAllowedDomainsMode
push edi
lea ecx, [ebp - 0x38]
call fcn.0042462c
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x32
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x38]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x4287de
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x33
call fcn.0042b029
push dword [eax]
call fcn.004b4131
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [esi + 0xf0], eax
call fcn.0042201a
mov edi, str.DdeVirtualization
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x34
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x42884e
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x35
call fcn.0042b029
push dword [eax]
call fcn.004b4131
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [esi + 0xfc], eax
call fcn.0042201a
mov edi, str.IsolationMode
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x36
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428a1f
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x37
call fcn.0042b029
mov eax, dword [eax]
push str.Data
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x4288de
mov dword [esi + 0x80], 3
jmp 0x428a1f
push edi
lea ecx, [ebp - 0x38]
call fcn.0042462c
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x38
push eax
lea ebx, [ebp - 0x6c]
mov dword [ebp - 0x18], 1
call fcn.0042b029
mov eax, dword [eax]
push str.FullAccess
push eax
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x428948
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0x39
push eax
mov dword [ebp - 0x18], 3
call fcn.0042b029
mov eax, dword [eax]
push str.None
push eax
call fcn.004b19fe
pop ecx
pop ecx
mov byte [ebp - 0x11], 0
test eax, eax
jne 0x42894c
mov byte [ebp - 0x11], 1
push 2
pop ebx
test byte [ebp - 0x18], bl
je 0x428963
mov ecx, dword [ebp - 0x40]
and dword [ebp - 0x18], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042201a
mov dword [ebp - 4], ebx
test byte [ebp - 0x18], 1
je 0x42897b
mov ecx, dword [ebp - 0x38]
and dword [ebp - 0x18], 0xfffffffe
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x11], 0
je 0x42898c
mov dword [esi + 0x80], ebx
jmp 0x428a1f
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x3a
call fcn.0042b029
mov eax, dword [eax]
push str.Isolated
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x4289db
mov dword [esi + 0x80], 1
jmp 0x428a1f
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x3b
call fcn.0042b029
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push dword [eax]
push str._UnpackUtils_ReadIniFile:_incorrect_IsolationMode_property_value:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.0042772b
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
push str.EncryptionExts
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x3c
call fcn.0042b029
push eax
lea ecx, [esi + 0xf8]
call fcn.00424670
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, str.Services
push edi
lea ecx, [ebp - 0x38]
call fcn.0042462c
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x3d
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x38]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428add
or dword [ebp - 0x38], 0xffffffff
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x3e
lea edi, [ebp - 0x38]
call fcn.0042b029
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.00424617
call fcn.0042a273
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
je 0x428add
mov dword [esi + 0x98], eax
mov edi, str.Expiration
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x3f
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428c0c
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x40
call fcn.0042b029
push eax
lea ecx, [ebp - 0x30]
call fcn.00424d19
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
and dword [ebp - 0x20], 0
push 0x2f
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x20]
call fcn.00424d19
lea eax, [ebp - 0x38]
push eax
call fcn.0046a6d0
add esp, 0xc
push dword [eax]
call fcn.004b4131
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
mov word [esi + 0x76], ax
call fcn.0042201a
cmp dword [ebp - 0x20], 0xffffffff
je 0x428bfd
push 0x2f
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x38]
push eax
call fcn.0046a6d0
add esp, 0xc
push dword [eax]
call fcn.004b4131
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
mov word [esi + 0x72], ax
call fcn.0042201a
cmp dword [ebp - 0x20], 0xffffffff
je 0x428bfd
push 0x2f
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x38]
push eax
call fcn.0046a6d0
add esp, 0xc
push dword [eax]
call fcn.004b4131
pop ecx
mov ecx, dword [ebp - 0x48]
mov word [ecx], ax
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, str.TtlDays
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x43
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428c8f
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x44
call fcn.0042b029
push eax
lea ecx, [ebp - 0x48]
call fcn.00424d19
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, dword [ebp - 0x48]
push edi
call fcn.004b4131
pop ecx
lea ecx, [edi - 0x10]
mov dword [esi + 0x84], eax
call fcn.0042201a
mov edi, str.TtlResistRemove
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x45
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428d12
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x46
call fcn.0042b029
push eax
lea ecx, [ebp - 0x48]
call fcn.00424d19
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, dword [ebp - 0x48]
push edi
call fcn.004b4131
pop ecx
lea ecx, [edi - 0x10]
mov dword [esi + 0x88], eax
call fcn.0042201a
call fcn.0046ee50
mov edi, 0x4e58bc
test eax, eax
je 0x428d2d
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.EarlyInjection:_WINE__disabling.
jmp 0x428d7b
push str.EarlyInjection
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x47
call fcn.0042b029
mov eax, dword [eax]
push edi
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x428d8a
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x4e58c0
call fcn.0042462c
call fcn.0042772b
and dword [esi + 0x54], 0
pop ecx
push str.AutoLaunchAlwaysAllowed
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x48
call fcn.0042b029
mov eax, dword [eax]
push edi
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x428dd4
and dword [esi + 0xcc], 0
push str.AllowDbgMsgBox
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x49
call fcn.0042b029
push edi
mov ecx, eax
call fcn.00424c44
mov ebx, eax
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x428e1b
and dword [esi + 0xd0], 0
push str.RegMode
lea ecx, [ebp - 0x38]
call fcn.0042462c
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x4a
or dword [ebp - 0x18], 4
push eax
lea ebx, [ebp - 0x6c]
call fcn.0042b029
mov eax, dword [eax]
push str.Extract
push eax
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x428e87
push str.LegacyReg
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0x4b
or dword [ebp - 0x18], 8
push eax
call fcn.0042b029
mov eax, dword [eax]
push 0x4e5978
push eax
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x428e87
xor bl, bl
jmp 0x428e89
mov bl, 1
test byte [ebp - 0x18], 8
je 0x428e9e
mov ecx, dword [ebp - 0x40]
and dword [ebp - 0x18], 0xfffffff7
add ecx, 0xfffffff0
call fcn.0042201a
mov dword [ebp - 4], 2
test byte [ebp - 0x18], 4
je 0x428eb6
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428eda
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x4e597c
call fcn.0042462c
call fcn.0042772b
pop ecx
mov dword [esi + 0xac], 1
call fcn.0046ee50
test eax, eax
je 0x428ef3
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.VirtMode:_WINE._Forcing_DISK_mode
jmp 0x428fe2
mov edi, str.VirtMode
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x4c
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x428ff4
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x4d
call fcn.0042b029
mov eax, dword [eax]
push 0x4e59f8
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x428f94
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.VirtMode:_enabling_RAM_mode
call fcn.0042462c
call fcn.0042772b
pop ecx
mov dword [esi + 0xa8], 1
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x4e
call fcn.0042b029
mov eax, dword [eax]
push str.DISK
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x428ff4
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.VirtMode:_enabling_DISK_mode
call fcn.0042462c
call fcn.0042772b
and dword [esi + 0xa8], 0
pop ecx
mov edi, str.Branding
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x4f
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x4290f6
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x50
call fcn.0042b029
mov eax, dword [eax]
push str.None
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x429093
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.Branding:_None
call fcn.0042462c
call fcn.0042772b
and dword [esi + 0xbc], 0
jmp 0x4290f5
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x51
call fcn.0042b029
mov eax, dword [eax]
push 0x4e2490
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x4290f6
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.Branding:_Cameyo
call fcn.0042462c
call fcn.0042772b
mov dword [esi + 0xbc], 1
pop ecx
mov edi, str.ExecWait
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x52
call fcn.0042b029
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
setne bl
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x4292c6
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x53
call fcn.0042b029
mov eax, dword [eax]
push str.None
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x429198
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.ExecWait:_None
call fcn.0042462c
call fcn.0042772b
and dword [esi + 0xc8], 0
jmp 0x4292c5
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x54
call fcn.0042b029
mov eax, dword [eax]
push str.CmdLine
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x4291ff
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.ExecWait:_CmdLine
call fcn.0042462c
call fcn.0042772b
mov dword [esi + 0xc8], 1
jmp 0x4292c5
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x55
call fcn.0042b029
mov eax, dword [eax]
push str.AutoLaunch
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x429263
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.ExecWait:_AutoLaunch
call fcn.0042462c
call fcn.0042772b
mov dword [esi + 0xc8], 2
jmp 0x4292c5
push edi
lea ecx, [ebp - 0x40]
call fcn.0042462c
lea eax, [ebp - 0x40]
push eax
lea ebx, [ebp - 0x6c]
mov byte [ebp - 4], 0x56
call fcn.0042b029
mov eax, dword [eax]
push str.Always
push eax
call fcn.004b19fe
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x4292c6
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.ExecWait:_Always
call fcn.0042462c
call fcn.0042772b
mov dword [esi + 0xc8], 3
pop ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x429301
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
push ecx
mov edx, esp
mov dword [ebp - 0x4c], esp
push ecx
movzx ecx, word [eax + 4]
push ecx
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str.VirtIniSettings:_incorrect_data:_Str__0x_x_0x_x_0x_x_0x_x
push edx
call fcn.00466ad0
add esp, 0x18
call fcn.0042772b
pop ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str..changes
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x57
lea edi, [esi + 0x68]
mov ecx, esp
mov dword [ebp - 0x48], esp
push edi
call fcn.00424617
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.00466c90
add esp, 0xc
mov byte [ebp - 4], 0x58
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx - 0xc]
test eax, eax
jne 0x429551
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x429551
jge 0x42935e
push 0x80070057
call fcn.00422000
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x18]
push str._c:_
push eax
call fcn.00466ad0
add esp, 0xc
mov byte [ebp - 4], 0x59
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0x4e3948
lea ecx, [ebp - 0x20]
mov ebx, eax
call fcn.0042462c
mov byte [ebp - 4], 0x5a
cmp ebx, 2
jne 0x42939f
push str.REMOVABLE
jmp 0x4293a9
cmp ebx, 3
jne 0x4293b3
push str.FIXED
lea ecx, [ebp - 0x20]
call fcn.00425210
jmp 0x4293e1
push ebx
lea eax, [ebp - 0x48]
push 0x4e4b18
push eax
call fcn.00466ad0
add esp, 0xc
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x5b
call fcn.00424d3a
mov byte [ebp - 4], 0x5a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov eax, esp
mov dword [ebp - 0x4c], esp
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push str.UnpackUtils_ReadIniFile::BaseDirName:_RootDir__s_drive_type_s
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.0042772b
pop ecx
cmp ebx, 2
jne 0x429474
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str..data
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x5c
mov ecx, esp
mov dword [ebp - 0x48], esp
push edi
call fcn.00424617
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x5a
call fcn.00466c90
add esp, 0xc
push 0
mov byte [ebp - 4], 0x5d
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x429456
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42946c
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00424d3a
mov dword [esi + 0x8c], 2
mov ecx, dword [ebp - 0x38]
jmp 0x42952c
lea eax, [ebp - 0x30]
push eax
call fcn.00475ae0
pop ecx
push 0x5c
push ecx
mov byte [ebp - 4], 0x5e
mov ecx, esp
mov dword [ebp - 0x4c], esp
push edi
call fcn.00424617
lea eax, [ebp - 0x38]
push eax
call fcn.00466ee0
add esp, 0xc
mov byte [ebp - 4], 0x5f
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4294f3
push eax
push dword [ebp - 0x38]
push ecx
call fcn.004b4226
add esp, 0xc
test eax, eax
jne 0x4294f3
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4294d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4294ec
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00424d3a
mov dword [esi + 0x8c], 1
mov ecx, str.TRUE:_running_from_Dropbox_dir
jmp 0x4294f8
mov ecx, str.FALSE
mov edx, dword [ebp - 0x30]
mov eax, dword [edx - 0xc]
push ecx
mov ebx, esp
mov dword [ebp - 0x4c], esp
push ecx
push eax
push dword [ebp - 0x38]
push edx
push str.DropboxDir:_comparing__s_to__s___d_chars_compare_:__s
push ebx
call fcn.00466ad0
add esp, 0x18
call fcn.0042772b
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 0x58
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ebx, dword [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.004691c0
pop ecx
test eax, eax
je 0x429576
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00424d3a
push ecx
mov eax, esp
mov dword [ebp - 0x4c], esp
push dword [edi]
push ebx
push str.UnpackUtils_ReadIniFile:_INIs_BaseDirName_s__CarrierExeName_s
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.0042772b
cmp dword [ebx - 0xc], 0
pop ecx
jne 0x4295cd
mov eax, dword [esi + 0x60]
cmp dword [eax - 0xc], 0
jne 0x4295a7
mov eax, str._AppData_VOS_AppID_
push eax
lea ecx, [ebp - 0x1c]
call fcn.00425210
push ecx
mov eax, esp
mov dword [ebp - 0x4c], esp
push dword [ebp - 0x1c]
push str.UnpackUtils_ReadIniFile::BaseDirName:_Taking_default:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0042772b
pop ecx
push dword [ebp - 0x44]
mov ecx, 0x51ef0c
call fcn.00424d3a
push edi
mov ecx, 0x51ef68
call fcn.00424d3a
push 4
call fcn.00475080
pop ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.00476570
pop ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00476570
pop ecx
push 1
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x3c]
push eax
call fcn.00483640
add esp, 0xc
mov byte [ebp - 4], 0x60
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4296b3
push 0
push 0x5c
lea ecx, [ebp - 0x1c]
call fcn.00426cae
cmp eax, 0xffffffff
jne 0x429647
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax - 0xc]
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004246c3
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x61
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
call fcn.00424d19
push ecx
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], esp
mov ecx, esp
push eax
call fcn.00424d19
lea edi, [ebp - 0x48]
mov byte [ebp - 4], 0x60
call fcn.00466390
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x63
call fcn.00424d3a
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x1c]
lea ebx, [esi + 0x5c]
push eax
mov ecx, ebx
call fcn.00424d3a
lea eax, [ebp - 0x28]
lea edi, [esi + 0x64]
push eax
mov ecx, edi
call fcn.00424d3a
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x429736
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x64
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.CHANGES
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x65
mov ecx, esp
mov dword [ebp - 0x40], esp
push ebx
call fcn.00424617
lea edi, [ebp - 0x48]
mov byte [ebp - 4], 0x60
call fcn.00466390
add esp, 0xc
push eax
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 0x66
call fcn.00424670
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
push 2
lea eax, [ebp - 0x48]
push eax
mov ecx, ebx
call fcn.0042481b
push 0x4e5ed4
mov ecx, eax
mov byte [ebp - 4], 0x67
call fcn.00424c44
neg eax
sbb al, al
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x48]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x11], al
call fcn.0042201a
cmp byte [ebp - 0x11], 0
je 0x4297dc
push 2
lea eax, [ebp - 0x44]
push eax
mov ecx, ebx
call fcn.0042af8e
mov byte [ebp - 4], 0x68
push dword [eax]
lea eax, [ebp - 0x48]
push str.__UNC_sPROG_
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppIDPROG_], eax
call fcn.0042201a
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
push dword [ebx]
lea eax, [ebp - 0x40]
push str.__UNC_s_
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x40]
jmp 0x429825
push dword [ebx]
lea eax, [ebp - 0x48]
push str.___sPROG_
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppIDPROG_], eax
call fcn.0042201a
push dword [ebx]
lea eax, [ebp - 0x44]
push str.___s_
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
mov dword [str.C:UsersUserNameVOSAppID_], eax
call fcn.0042201a
push 2
lea eax, [ebp - 0x48]
lea edi, [esi + 0x64]
push eax
mov ecx, edi
call fcn.0042481b
push 0x4e5ed4
mov ecx, eax
mov byte [ebp - 4], 0x69
call fcn.00424c44
neg eax
sbb al, al
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x48]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x11], al
call fcn.0042201a
cmp byte [ebp - 0x11], 0
je 0x4298b5
push 2
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
call fcn.0042af8e
mov byte [ebp - 4], 0x6a
push dword [eax]
lea eax, [ebp - 0x48]
push str.__UNC_s_
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppIDCHANGES_], eax
call fcn.0042201a
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x44]
jmp 0x4298d8
push dword [edi]
lea eax, [ebp - 0x48]
push str.___s_
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x48]
mov dword [str.__C:UsersUserNameVOSAppIDCHANGES_], eax
add ecx, 0xfffffff0
call fcn.0042201a
push dword [ebx]
lea eax, [ebp - 0x48]
push str._sPROG_
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov dword [str.C:UsersUserNameVOSAppIDPROG_], eax
call fcn.0042201a
push dword [ebx]
mov ebx, 0x4e5f58
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppID_], eax
call fcn.0042201a
push dword [edi]
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.004b4759
pop ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [str.C:UsersUserNameVOSAppIDCHANGES_], eax
call fcn.0042201a
push dword [0x51b460]
mov ebx, 0x51eefc
mov ecx, ebx
call fcn.00425210
push 0
call fcn.00476260
pop ecx
push dword [0x51b46c]
mov ebx, 0x51f00c
mov ecx, ebx
call fcn.00425210
push 0
call fcn.00476260
pop ecx
push dword [0x51b468]
mov ebx, 0x51f008
mov ecx, ebx
call fcn.00425210
push 0
call fcn.00476260
pop ecx
push 0x10
call fcn.004a2eb2
pop ecx
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0x6b
test eax, eax
je 0x4299cb
mov esi, eax
call fcn.00483490
mov esi, dword [ebp + 8]
jmp 0x4299cd
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
mov dword [esi + 0x6c], eax
call fcn.0042201a
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 1
call fcn.0042b10b
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov al, 1
call fcn.004b81f0
ret