Function at 0x42c02f
Capabilities:
Check for time delay via gettickcount
Create thread
Get file attributes
Set current directory
Set environment variable
Terminate process

Disassembly:
push 0x274
mov eax, 0x4c3084
call fcn.004a9a34
mov ebx, ecx
mov edi, edx
xor esi, esi
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x234], esi
push 3
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x244], esi
call fcn.004964ca
push eax
lea ecx, [ebp - 0x250]
call fcn.004249f9
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 4
call fcn.004613d0
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x220], esp
push dword [eax]
push str.Loader_Main:_in:_ProcessName_s
push ecx
call fcn.004622a0
add esp, 0xc
call fcn.0042a0ee
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
call fcn.004271d3
pop ecx
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x42c0d8
push str.Cannot_open_ZIP__RESOURCE_COREZIP_
call fcn.0042a11e
lea eax, [ebp + 8]
push eax
mov ecx, 0x4f3b10
call fcn.00423b22
push edi
push 0x4f3ac8
call fcn.00427093
pop ecx
pop ecx
cmp ebx, 0xffffffff
je 0x42c0fe
mov dword [0x4f3b34], ebx
push ecx
mov dword [ebp - 0x23c], esp
mov ecx, esp
mov ebx, 0x4f3ad0
push ebx
call fcn.00423b01
mov ecx, esi
call fcn.00472e70
pop ecx
cmp word [0x4f3b18], si
je 0x42c18d
xor eax, eax
mov word [ebp - 0x27c], ax
lea edi, [ebp - 0x27a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [ebp - 0x27c]
cmp ax, word [0x4f3b18]
jb 0x42c18d
mov ax, word [ebp - 0x27a]
cmp ax, word [0x4f3b1a]
jb 0x42c18d
mov ax, word [ebp - 0x276]
cmp ax, word [0x4f3b1e]
jb 0x42c18d
push esi
push str.Expiration
push str.Package_expired
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.Vintegrate:
call fcn.0042342e
push ecx
mov byte [ebp - 4], 6
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24c], esp
mov ecx, esp
push eax
call fcn.00423b01
mov byte [ebp - 4], 4
call fcn.00466630
add esp, 0xc
cmp eax, esi
je 0x42c1d3
mov dword [ebp - 0x244], 1
jmp 0x42c217
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.VintegrateRecursive:
call fcn.0042342e
push ecx
mov byte [ebp - 4], 7
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24c], esp
mov ecx, esp
push eax
call fcn.00423b01
mov byte [ebp - 4], 4
call fcn.00466630
add esp, 0xc
cmp eax, esi
je 0x42c242
mov dword [ebp - 0x244], 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x250]
call fcn.00423b22
push esi
push 0x3a
lea ecx, [ebp - 0x250]
call fcn.00425635
push esi
lea ecx, [ebp - 0x250]
inc eax
push ecx
call fcn.004234c5
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
mov esi, 0x4f3ac8
call fcn.00423b01
mov ecx, esi
call fcn.0042beff
pop ecx
xor edi, edi
push edi
push dword [ebp - 0x244]
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.VintegrateMode
call fcn.0042342e
push ecx
mov byte [ebp - 4], 8
mov esi, esp
mov dword [ebp - 0x24c], esp
push ecx
mov dword [ebp - 0x258], esp
mov ecx, esp
push ebx
call fcn.00423b01
call fcn.0046f0f0
pop ecx
mov byte [ebp - 4], 9
call fcn.004723a0
push eax
mov byte [ebp - 4], 4
call fcn.00463620
add esp, 0x14
push edi
push ecx
lea eax, [ebp - 0x250]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
call fcn.00423b01
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x24c], esp
push str.VintegrateTgtPattern
call fcn.0042342e
push ecx
mov byte [ebp - 4], 0xb
mov esi, esp
mov dword [ebp - 0x258], esp
push ecx
mov dword [ebp - 0x26c], esp
mov ecx, esp
push ebx
call fcn.00423b01
call fcn.0046f0f0
pop ecx
mov byte [ebp - 4], 0xc
call fcn.004723a0
push eax
mov byte [ebp - 4], 4
call fcn.004634f0
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.StartTickTime
call fcn.0042342e
mov byte [ebp - 4], 0xd
push ecx
mov esi, esp
mov dword [ebp - 0x24c], esp
push ecx
mov dword [ebp - 0x258], esp
mov ecx, esp
push ebx
call fcn.00423b01
call fcn.0046f0f0
pop ecx
mov byte [ebp - 4], 0xe
call fcn.004723a0
push eax
mov byte [ebp - 4], 4
call fcn.00463620
add esp, 0x10
mov dword [ebp - 0x23c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push 0x4ca098
call fcn.0042342e
push ecx
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x24c], esp
push 0x4ccac0
call fcn.0042342e
push ecx
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x258], esp
mov ecx, esp
push 0x4f3b0c
call fcn.00423b01
mov byte [ebp - 4], 4
call fcn.00461df0
add esp, 0xc
call fcn.00464c80
pop ecx
test eax, eax
jne 0x42c447
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x25c], eax
call fcn.00434627
push 0x405
mov edi, 0x4f3ac8
call fcn.0047c8d0
pop ecx
xor ebx, ebx
push dword [0x4f3ad0]
lea eax, [ebp - 0x21c]
push dword [0x4f3b0c]
push str._sAppVirtDll__s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [0x4f3ad0]
add esp, 0x10
push dword [0x4f3ad8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x4f3b14]
push eax
mov eax, esi
call fcn.0047d1f0
mov esi, 0x4cc12c
cmp dword [0x4f3ad4], ebx
je 0x42c4a8
mov eax, 0x4f3ad4
jmp 0x42c4c2
mov eax, dword [0x4f3b08]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x42c3ef
cmp dword [ebp + 0xc], 2
je 0x42c3ef
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x23c], esp
push dword [0x4f3ad0]
push str.StartStreaming:AppID_s
push eax
call fcn.004622a0
add esp, 0xc
call fcn.00425d47
pop ecx
pop ecx
cmp eax, ebx
jne 0x42c3ef
push dword [0x4f3ad0]
lea eax, [ebp - 0x220]
push str.Cannot_stream_application__s_
push eax
call fcn.004622a0
add esp, 0xc
push dword [eax]
jmp 0x42c0d3
push esi
lea ecx, [ebp - 0x280]
call fcn.0042342e
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x234], 1
push eax
lea ecx, [ebp - 0x240]
call fcn.00423b01
mov dword [ebp - 4], 0x13
test byte [ebp - 0x234], 1
je 0x42c4f3
mov ecx, dword [ebp - 0x280]
and dword [ebp - 0x234], 0xfffffffe
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0x268], ebx
je 0x42c722
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
jne 0x42c553
push 0x3b
push dword [0x4f3ad4]
call fcn.004a536a
pop ecx
pop ecx
test eax, eax
jne 0x42c528
cmp dword [ebp + 0xc], 1
jne 0x42c722
push 0x404
mov edi, 0x4f3ac8
call fcn.0047c8d0
pop ecx
push ebx
push ebx
push ebx
push 0x42be19
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x268], eax
jmp 0x42c722
push 1
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp + 0x14]
call fcn.0042361d
push 0x4ce7fc
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.00423a2c
neg eax
sbb al, al
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x230]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x221], al
call fcn.0042101a
cmp byte [ebp - 0x221], 0
je 0x42c722
push ebx
lea eax, [ebp + 0x14]
push eax
xor eax, eax
inc eax
call fcn.004234c5
push dword [ebp + 0x14]
call fcn.004a55e0
pop ecx
push esi
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x228], ebx
call fcn.0042342e
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
jle 0x42c6f5
mov edi, 0x4cd710
lea eax, [ebp - 0x228]
push eax
push 0x4cd700
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x240]
call fcn.0042790f
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x16
call fcn.00423b22
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x42c6c5
lea eax, [ebp - 0x258]
push eax
push edi
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x258], ebx
call fcn.0042790f
push edi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 0x17
call fcn.0042367d
add esp, 0xc
lea ecx, [ebp + 0x18]
push ecx
push eax
lea eax, [ebp - 0x24c]
push eax
mov byte [ebp - 4], 0x18
call fcn.00429687
add esp, 0xc
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x19
call fcn.00423b22
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x228], 0xffffffff
je 0x42c752
mov eax, dword [ebp - 0x238]
cmp dword [eax - 0xc], ebx
je 0x42c752
inc dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x230]
jl 0x42c5e8
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x240]
call fcn.00423b22
push esi
lea ecx, [ebp + 0x14]
call fcn.00423f2b
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
push dword [ebp + 0xc]
mov ecx, 0x4f3ac8
push dword [ebp - 0x264]
push dword [ebp - 0x220]
call fcn.0042a7c6
add esp, 0x10
cmp eax, ebx
je 0x42c770
cmp eax, 7
jne 0x42c75c
push 0x4ce800
jmp 0x42c0d3
push 0xff
jmp 0x42c187
lea ecx, [ebp - 0x220]
push ecx
mov edx, eax
call fcn.00469030
pop ecx
jmp 0x42c4a1
push 1
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
mov esi, str.RequireManaged
push esi
call fcn.0042342e
push ecx
mov byte [ebp - 4], 0x1a
mov ecx, esp
mov dword [ebp - 0x264], esp
mov edi, str.SoftwareCameyo
push edi
call fcn.0042342e
push SysReAllocStringLen
mov byte [ebp - 4], 0x13
call fcn.004633e0
add esp, 0x14
cmp eax, ebx
jne 0x42c7ff
push 1
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push esi
call fcn.0042342e
push ecx
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ebp - 0x264], esp
push edi
call fcn.0042342e
mov byte [ebp - 4], 0x1c
call fcn.004723a0
push eax
mov byte [ebp - 4], 0x13
call fcn.004633e0
add esp, 0x14
cmp eax, ebx
je 0x42c855
cmp dword [ebp - 0x260], ebx
je 0x42c855
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_RequireManaged
call fcn.0042342e
call fcn.0042a0ee
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
call fcn.0042342e
call fcn.00425144
pop ecx
cmp eax, ebx
jne 0x42c855
push ebx
push 0x4ca5c0
push str.You_are_not_allowd_to_use_unmanaged_apps.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
jmp 0x42c187
mov eax, dword [0x4f3b38]
cmp dword [eax - 0xc], ebx
je 0x42c878
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f3b38
call fcn.00423b01
call fcn.0042bc4d
pop ecx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42c8c5
push 1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp + 0x14]
call fcn.0042361d
mov byte [ebp - 4], 0x1d
or dword [ebp - 0x234], 2
push 0x4ce7fc
mov ecx, eax
call fcn.00423a2c
test eax, eax
je 0x42c8c5
push ebx
push 0x5c
lea ecx, [ebp + 0x14]
call fcn.00425635
mov byte [ebp - 0x221], 1
cmp eax, 0xffffffff
je 0x42c8cc
mov byte [ebp - 0x221], 0
mov dword [ebp - 4], 0x13
test byte [ebp - 0x234], 2
je 0x42c8ea
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x221], 0
je 0x42c9c0
call fcn.004964ca
push eax
lea ecx, [ebp - 0x228]
call fcn.004249f9
mov byte [ebp - 4], 0x1e
call fcn.004964ca
push eax
lea ecx, [ebp - 0x22c]
call fcn.004249f9
mov byte [ebp - 4], 0x1f
call fcn.0046c1d0
lea eax, [ebp - 0x22c]
push eax
push 0x42a49f
push ebx
push dword [0x4f3418]
push 0x4f3410
call fcn.004811b0
push ebx
lea eax, [ebp - 0x228]
push eax
push ebx
push ecx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423b01
push ecx
mov byte [ebp - 4], 0x20
lea eax, [ebp + 0x14]
mov dword [ebp - 0x264], esp
mov ecx, esp
push eax
call fcn.00423b01
mov byte [ebp - 4], 0x1f
call fcn.0046e3b0
add esp, 0x14
cmp eax, ebx
je 0x42c9a0
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 0x14]
call fcn.00423b22
lea eax, [ebp + 0x14]
push eax
call fcn.00471d60
pop ecx
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp + 0x14]
push dword [ebp - 0x240]
push dword [ebp + 0xc]
push str.Loader_Main:_AutoLaunchMode_d__AutoLaunchRaw_s__ExecCmd_s
push eax
call fcn.004622a0
add esp, 0x14
call fcn.0042a0ee
cmp dword [ebp + 0xc], 2
pop ecx
je 0x42d211
mov eax, dword [0x4f3af8]
cmp dword [eax - 0xc], ebx
je 0x42cb3e
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x42ca1e
push 0x4cea34
lea ecx, [ebp + 0x14]
call fcn.00423a2c
test eax, eax
jne 0x42cb3e
lea esi, [ebp - 0x27c]
call fcn.0047d940
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f3ad0
call fcn.00423b01
call fcn.0047d260
mov esi, eax
cmp esi, ebx
je 0x42cb08
cmp dword [esi + 0x834], ebx
je 0x42cb08
call fcn.004964ca
push eax
lea ecx, [ebp - 0x230]
call fcn.004249f9
mov byte [ebp - 4], 0x22
cmp dword [esi + 0x834], ebx
mov dword [ebp - 0x22c], ebx
jle 0x42cada
lea edi, [esi + 0x838]
push dword [edi]
lea eax, [ebp - 0x220]
push 0x4cea3c
push eax
call fcn.004622a0
add esp, 0xc
mov byte [ebp - 4], 0x23
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x230]
push eax
call fcn.004244ad
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
inc dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
add edi, 8
cmp eax, dword [esi + 0x834]
jl 0x42ca86
mov esi, dword [ebp - 0x230]
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push esi
push str.AutoUpdate:_app_already_running__aborting__PIDs_s_
push eax
call fcn.004622a0
add esp, 0xc
call fcn.0042a0ee
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042101a
jmp 0x42cb2f
mov eax, dword [0x4f384c]
cmp eax, ebx
je 0x42cb18
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
push 0x42bee0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0x13
call fcn.0047d960
test byte [0x4f3b34], 2
je 0x42cb51
mov ecx, 0x4f3ac8
call fcn.004230f5
cmp dword [ebp - 0x244], ebx
je 0x42cc12
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x230]
call fcn.00423b01
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 0x24
call fcn.00471d60
mov edi, dword [ebp - 0x230]
pop ecx
push 1
push edi
lea ecx, [ebp - 0x21c]
call fcn.00424dab
pop ecx
pop ecx
test eax, eax
je 0x42cbb4
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 0x254], 2
jmp 0x42cc06
call fcn.004964ca
push eax
lea ecx, [ebp - 0x248]
call fcn.004249f9
mov byte [ebp - 4], 0x25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x248]
push str.Could_not_inject_explorer.exe__Error_d_
push eax
call fcn.00421614
mov esi, dword [ebp - 0x248]
add esp, 0xc
push ebx
push str.Error
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x254], ebx
call fcn.0042101a
mov byte [ebp - 4], 0x13
lea ecx, [edi - 0x10]
jmp 0x42d20c
mov eax, dword [ebp - 0x240]
cmp dword [eax - 0xc], ebx
jne 0x42cc29
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x42d211
cmp dword [ebp - 0x268], ebx
je 0x42cd19
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_Waiting_for_AutoLaunchMenu
push eax
call fcn.004622a0
pop ecx
pop ecx
call fcn.0042a0ee
mov edi, 0x4f3ac8
mov dword [esp], 0x404
call fcn.0047c8d0
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4f3ad4
lea ecx, [ebp - 0x240]
call fcn.00423b22
push str._Cancel_
lea ecx, [ebp - 0x240]
call fcn.00423a2c
test eax, eax
jne 0x42cd09
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_cancelled_n
call fcn.0042342e
call fcn.0042a0ee
pop ecx
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
inc eax
jmp 0x42d286
call fcn.00434627
push 0x405
call fcn.0047c8d0
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp - 0x240]
push str.Loader_Main:_AutoLaunchRaw_s
push eax
call fcn.004622a0
add esp, 0xc
call fcn.0042a0ee
pop ecx
mov dword [ebp - 0x228], ebx
call fcn.004964ca
push eax
lea ecx, [ebp - 0x234]
call fcn.004249f9
mov byte [ebp - 4], 0x26
call fcn.004964ca
push eax
lea ecx, [ebp - 0x22c]
call fcn.004249f9
push 0x3e
push ecx
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x240]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x228]
call fcn.00423b01
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.00465f20
add esp, 0xc
mov byte [ebp - 4], 0x28
call fcn.00423574
push eax
lea ecx, [ebp - 0x234]
call fcn.00423b22
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x3e
push ecx
lea eax, [ebp - 0x240]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423b01
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.00465f20
add esp, 0xc
mov byte [ebp - 4], 0x29
call fcn.00423574
push eax
lea ecx, [ebp - 0x22c]
call fcn.00423b22
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
push 1
push ebx
lea edi, [ebp - 0x234]
call fcn.0047c630
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp - 0x234]
push str.Loader_Main:_AutoLaunchCmd_s
push eax
call fcn.004622a0
add esp, 0xc
call fcn.0042a0ee
mov eax, esp
mov dword [ebp - 0x220], esp
lea ecx, [ebp - 0x21c]
push ecx
push str.Loader_Main:_Loading_DLL_to_get_myself_hooked:__s
push eax
call fcn.004622a0
add esp, 0xc
call fcn.0042a0ee
mov dword [esp], str.TRUE
push str.CAMEYO_VIRTUALAPP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
lea eax, [ebp - 0x21c]
push eax
push str.Loader_Main:_LoadLibrary__s_0x_x
push ecx
call fcn.004622a0
add esp, 0x10
call fcn.0042a0ee
pop ecx
call fcn.004964ca
push eax
lea ecx, [ebp - 0x228]
call fcn.004249f9
mov byte [ebp - 4], 0x2a
call fcn.004964ca
push eax
lea ecx, [ebp - 0x244]
call fcn.004249f9
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp + 0x14]
push ecx
mov dword [ebp - 0x220], esp
cmp dword [eax - 0xc], ebx
jne 0x42cf22
mov eax, esp
push dword [ebp - 0x234]
push str.ExecName:_Taking_AutoLaunchCmd_s
push eax
call fcn.004622a0
add esp, 0xc
call fcn.0042a0ee
pop ecx
mov eax, edi
push eax
lea ecx, [ebp - 0x228]
call fcn.00423b22
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x244]
cmp dword [eax - 0xc], ebx
jne 0x42cf4e
lea eax, [ebp - 0x22c]
jmp 0x42cf51
mov ecx, esp
push eax
push str.ExecName:_Taking_ExecCmd_s
push ecx
call fcn.004622a0
add esp, 0xc
call fcn.0042a0ee
pop ecx
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x228]
call fcn.00423b22
lea ecx, [ebp - 0x244]
lea eax, [ebp + 0x18]
push eax
call fcn.00423b22
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
call fcn.00423b01
lea eax, [ebp - 0x238]
push eax
mov byte [ebp - 4], 0x2c
call fcn.00471d60
pop ecx
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push dword [ebp - 0x238]
mov dword [ebp - 0x260], eax
push str.Loader_Main:_GetFileAttributes__s__d
push ecx
call fcn.004622a0
add esp, 0x10
call fcn.0042a0ee
pop ecx
push 0x5c
push ecx
lea eax, [ebp - 0x238]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423b01
lea eax, [ebp - 0x220]
push eax
call fcn.004628e0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov dword [ebp - 0x260], eax
call fcn.0042101a
push ecx
mov dword [ebp - 0x220], esp
mov esi, esp
push dword [ebp - 0x260]
lea eax, [ebp - 0x238]
push 0x5c
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423b01
lea eax, [ebp - 0x220]
push eax
call fcn.004628e0
add esp, 0xc
mov byte [ebp - 4], 0x2d
push dword [eax]
push str.Loader_Main:_SetCurrentDirectory__s__d
push esi
call fcn.004622a0
add esp, 0x10
call fcn.0042a0ee
pop ecx
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [0x4f3b3c]
cmp dword [eax - 0xc], ebx
je 0x42d087
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f3b3c
call fcn.00423b01
call fcn.00464cc0
pop ecx
cmp eax, ebx
je 0x42d087
mov eax, dword [0x4f3b3c]
mov dword [ebp - 0x230], eax
jmp 0x42d08d
mov dword [ebp - 0x230], ebx
mov esi, dword [ebp - 0x228]
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
lea ecx, [ebp - 0x21c]
push ecx
push esi
push str.Loader_Main:_ExecName_s__Dll32Name_s
push eax
mov dword [ebp - 0x248], ebx
call fcn.004622a0
add esp, 0x10
call fcn.0042a0ee
mov eax, dword [ebp + 0x1c]
pop ecx
and eax, 1
push eax
push dword [ebp - 0x230]
lea eax, [ebp - 0x244]
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x248]
call fcn.00423b01
push ecx
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x264], esp
push eax
call fcn.0042342e
push ecx
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x228]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
call fcn.00423b01
mov ecx, edi
mov byte [ebp - 4], 0x2c
call fcn.0042a145
add esp, 0x14
cmp eax, ebx
je 0x42d174
mov edi, dword [ebp - 0x25c]
mov dword [ebp - 0x254], 1
cmp edi, ebx
je 0x42d1cd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, edi
mov ecx, 0x1770
cmp edx, ecx
jae 0x42d162
sub edi, eax
push 1
add edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push 0x404
mov edi, 0x4f3ac8
call fcn.0047c8d0
pop ecx
jmp 0x42d1cd
call fcn.004964ca
push eax
lea ecx, [ebp - 0x25c]
call fcn.004249f9
mov byte [ebp - 4], 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x248]
lea eax, [ebp - 0x25c]
push esi
push str.Could_not_execute__s__Error_d__MyPID_d_
push eax
call fcn.00421614
mov edi, dword [ebp - 0x25c]
add esp, 0x14
push ebx
push str.Error
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x254], ebx
call fcn.0042101a
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
mov edi, 0x4f3ac8
call fcn.0047c8d0
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_out_n
call fcn.0042342e
call fcn.0042a0ee
pop ecx
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp - 0x254]
call fcn.004a9ab7
ret