Function at 0x426c55
Capabilities:
Contain obfuscated stackstrings
Create directory
Get disk information
Parse pe header
Query environment variable
Set environment variable

Disassembly:
push 0x58
mov eax, 0x4d208b
call fcn.004b3b70
xor esi, esi
mov dword [ebp - 0x14], esi
call fcn.0049eef3
push eax
lea ecx, [ebp - 0x18]
call fcn.00425064
mov dword [ebp - 4], esi
call fcn.0049eef3
push eax
lea ecx, [ebp - 0x2c]
call fcn.00425064
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.00429f18
mov ebx, dword [ebp + 8]
push 0x10
lea eax, [ebx + 0x70]
push esi
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x40], eax
call fcn.004adf10
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x10]
mov dword [ebx + 0x84], esi
push dword [ebp + 0xc]
mov dword [ebx + 0x88], esi
call fcn.0046c570
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x3c], eax
mov edi, eax
cmp word [eax], si
je 0x426e59
push edi
lea ecx, [ebp - 0x1c]
call fcn.00423607
push 1
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x4e016c
call fcn.00423607
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
call fcn.00423d39
mov byte [ebp - 4], 3
call fcn.00468c10
add esp, 0xc
cmp eax, esi
je 0x426e36
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.CAMEYO_RO_
call fcn.00423607
push ecx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], esp
mov ecx, esp
push eax
call fcn.00423d39
mov byte [ebp - 4], 3
call fcn.00468c10
add esp, 0xc
cmp eax, esi
jne 0x426e36
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.CAMEYO_PKGPROT
call fcn.00423607
push ecx
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], esp
mov ecx, esp
push eax
call fcn.00423d39
mov byte [ebp - 4], 3
call fcn.00468c10
add esp, 0xc
cmp eax, esi
jne 0x426e36
push str.CAMEYO_
call fcn.004ad530
pop ecx
push esi
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0042369e
lea eax, [ebp - 0x34]
push eax
push 0x4e01bc
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x34], esi
call fcn.00429dbb
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.00423d39
push esi
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 8
push eax
mov eax, dword [ebp - 0x34]
call fcn.0042369e
lea eax, [ebp - 0x30]
push eax
lea ebx, [ebp - 0x64]
call fcn.00429f4e
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.00423d5a
mov esi, dword [ebp - 0x24]
push ecx
mov eax, esp
mov dword [ebp - 0x44], esp
push esi
push dword [ebp - 0x30]
push dword [ebp - 0x1c]
push 0x4e01c0
push eax
call fcn.00464a80
add esp, 0x14
call fcn.004266fd
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ebx, dword [ebp + 8]
xor esi, esi
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
call fcn.004ad5da
lea edi, [edi + eax*2 + 2]
pop ecx
cmp word [edi], si
jne 0x426cdd
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x64]
lea edi, [ebp - 0x20]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x20], eax
call fcn.0042a3ad
test al, al
jne 0x426f30
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.PkgProt
call fcn.00423607
mov byte [ebp - 4], 9
call fcn.0043d536
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.004235f2
mov byte [ebp - 4], 2
call fcn.00468c10
add esp, 0xc
test eax, eax
jne 0x426f23
call fcn.0043d536
push eax
lea ecx, [ebp - 0x34]
call fcn.00423d39
lea edi, [ebp - 0x34]
mov byte [ebp - 4], 0xa
call fcn.00429e6e
push dword [eax]
lea eax, [ebp - 0x3c]
push str.CAMEYO_RO_PROPERTY__s
push eax
call fcn.00464a80
add esp, 0xc
mov edi, eax
call fcn.0043d536
mov edi, dword [edi]
add eax, 4
mov eax, dword [eax]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x28]
call fcn.0042a360
jmp 0x426e70
push str.AppID
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
lea esi, [ebx + 0xc]
mov byte [ebp - 4], 0xb
push eax
lea ebx, [ebp - 0x64]
mov dword [ebp - 0x3c], esi
call fcn.00429f4e
push eax
mov ecx, esi
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.AutoLaunch
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0xc
call fcn.00429f4e
mov esi, dword [ebp + 8]
push eax
lea ecx, [esi + 0x10]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.Streamer
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0xd
call fcn.00429f4e
push eax
lea ecx, [esi + 0x58]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.Shortcuts
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0xe
call fcn.00429f4e
push eax
lea ecx, [esi + 0x14]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.FriendlyName
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0xf
call fcn.00429f4e
push eax
lea ecx, [esi + 0x18]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.BaseDirName
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x10
call fcn.00429f4e
push eax
lea ecx, [ebp - 0x18]
call fcn.00423d5a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.DefaultVosRoot
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x11
lea edi, [esi + 0x60]
call fcn.00429f4e
push eax
mov ecx, edi
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.DataDirName
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x12
call fcn.00429f4e
push eax
lea ecx, [ebp - 0x2c]
call fcn.00423d5a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.Publisher
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x13
call fcn.00429f4e
push eax
lea ecx, [esi + 0x1c]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.Version
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x14
call fcn.00429f4e
push eax
lea ecx, [esi + 0x20]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnStartVirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x15
push eax
call fcn.00429f4e
push eax
lea ecx, [esi + 0x24]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnStartUnvirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x16
call fcn.00429f4e
push eax
lea ecx, [esi + 0x28]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnStopVirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x17
call fcn.00429f4e
push eax
lea ecx, [esi + 0x2c]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnStopUnvirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x18
call fcn.00429f4e
push eax
lea ecx, [esi + 0x30]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnProcessStartVirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x19
call fcn.00429f4e
push eax
lea ecx, [esi + 0x34]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnProcessStartUnvirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00429f4e
push eax
lea ecx, [esi + 0x38]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnProcessStopVirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00429f4e
push eax
lea ecx, [esi + 0x3c]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.OnProcessStopUnvirtualized
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x1c
call fcn.00429f4e
push eax
lea ecx, [esi + 0x40]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.StopInheritance
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x1d
call fcn.00429f4e
push eax
lea ecx, [esi + 0x44]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.AutoUpdate
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00429f4e
push eax
lea ecx, [esi + 0x48]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.CloudPkgId
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00429f4e
push eax
lea ecx, [esi + 0x4c]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.BuildUID
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x20
call fcn.00429f4e
push eax
lea ecx, [esi + 0x50]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.EnvVariables
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x21
call fcn.00429f4e
push eax
lea ecx, [esi + 0x9c]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.StartingDir
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x22
call fcn.00429f4e
push eax
lea ecx, [esi + 0xa0]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.VirtMachineName
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x23
call fcn.00429f4e
push eax
lea ecx, [esi + 0xbc]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.VirtUserName
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x24
call fcn.00429f4e
push eax
lea ecx, [esi + 0xc0]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, str.AuthDenyMsgMode
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x25
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x4274ca
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x26
call fcn.00429f4e
push dword [eax]
call fcn.004afa51
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [esi + 0xd4], eax
call fcn.0042101a
push str.AuthDenyMsg
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x27
lea edi, [esi + 0xd8]
call fcn.00429f4e
push eax
mov ecx, edi
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x42751c
push 0x4dd494
push 0x4e05b8
push edi
call fcn.00429c41
mov edi, str.AuthForceOnPkgChange
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x28
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x42758c
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x29
call fcn.00429f4e
push dword [eax]
call fcn.004afa51
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [esi + 0xdc], eax
call fcn.0042101a
mov edi, str.AuthMaxOfflineDays
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x2a
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x4275fc
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x2b
call fcn.00429f4e
push dword [eax]
call fcn.004afa51
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [esi + 0xd0], eax
call fcn.0042101a
push str.ADAllowedGroups
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x2c
call fcn.00429f4e
push eax
lea ecx, [esi + 0xe0]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.ADDeniedGroups
lea ecx, [ebp - 0x30]
call fcn.00423607
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x2d
call fcn.00429f4e
push eax
lea ecx, [esi + 0xe4]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, str.ADNestedCheck
push edi
lea ecx, [ebp - 0x24]
call fcn.00423607
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x2e
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x4276d6
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x2f
call fcn.00429f4e
push dword [eax]
call fcn.004afa51
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [esi + 0xe8], eax
call fcn.0042101a
push str.ADAllowedDomains
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x30
call fcn.00429f4e
push eax
lea ecx, [esi + 0xf0]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, str.ADAllowedDomainsMode
push edi
lea ecx, [ebp - 0x30]
call fcn.00423607
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x31
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x42777b
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x32
call fcn.00429f4e
push dword [eax]
call fcn.004afa51
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [esi + 0xec], eax
call fcn.0042101a
mov edi, str.IsolationMode
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x33
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x42794c
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x34
call fcn.00429f4e
mov eax, dword [eax]
push str.Data
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x42780b
mov dword [esi + 0x80], 3
jmp 0x42794c
push edi
lea ecx, [ebp - 0x30]
call fcn.00423607
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x35
push eax
lea ebx, [ebp - 0x64]
mov dword [ebp - 0x14], 1
call fcn.00429f4e
mov eax, dword [eax]
push str.FullAccess
push eax
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x427875
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0x36
push eax
mov dword [ebp - 0x14], 3
call fcn.00429f4e
mov eax, dword [eax]
push str.None
push eax
call fcn.004ad328
pop ecx
pop ecx
mov byte [ebp - 0xd], 0
test eax, eax
jne 0x427879
mov byte [ebp - 0xd], 1
push 2
pop ebx
test byte [ebp - 0x14], bl
je 0x427890
mov ecx, dword [ebp - 0x34]
and dword [ebp - 0x14], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [ebp - 4], ebx
test byte [ebp - 0x14], 1
je 0x4278a8
mov ecx, dword [ebp - 0x30]
and dword [ebp - 0x14], 0xfffffffe
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0xd], 0
je 0x4278b9
mov dword [esi + 0x80], ebx
jmp 0x42794c
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x37
call fcn.00429f4e
mov eax, dword [eax]
push str.Isolated
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x427908
mov dword [esi + 0x80], 1
jmp 0x42794c
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x38
call fcn.00429f4e
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push dword [eax]
push str._UnpackUtils_ReadIniFile:_incorrect_IsolationMode_property_value:__s
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.004266fd
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push str.EncryptionExts
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x39
call fcn.00429f4e
push eax
lea ecx, [esi + 0xf4]
call fcn.0042364b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, str.Services
push edi
lea ecx, [ebp - 0x30]
call fcn.00423607
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x3a
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x427a0a
or dword [ebp - 0x30], 0xffffffff
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x3b
lea edi, [ebp - 0x30]
call fcn.00429f4e
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push eax
call fcn.004235f2
call fcn.00429149
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
je 0x427a0a
mov dword [esi + 0x98], eax
mov edi, str.Expiration
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x3c
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x427b39
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x3d
call fcn.00429f4e
push eax
lea ecx, [ebp - 0x24]
call fcn.00423d39
mov byte [ebp - 4], 0x3f
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
and dword [ebp - 0x1c], 0
push 0x2f
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x1c]
call fcn.00423d39
lea eax, [ebp - 0x30]
push eax
call fcn.004685a0
add esp, 0xc
push dword [eax]
call fcn.004afa51
pop ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov word [esi + 0x76], ax
call fcn.0042101a
cmp dword [ebp - 0x1c], 0xffffffff
je 0x427b2a
push 0x2f
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
call fcn.00423d39
lea eax, [ebp - 0x30]
push eax
call fcn.004685a0
add esp, 0xc
push dword [eax]
call fcn.004afa51
pop ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov word [esi + 0x72], ax
call fcn.0042101a
cmp dword [ebp - 0x1c], 0xffffffff
je 0x427b2a
push 0x2f
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
call fcn.00423d39
lea eax, [ebp - 0x30]
push eax
call fcn.004685a0
add esp, 0xc
push dword [eax]
call fcn.004afa51
pop ecx
mov ecx, dword [ebp - 0x40]
mov word [ecx], ax
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, str.TtlDays
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x40
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x427bbc
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x41
call fcn.00429f4e
push eax
lea ecx, [ebp - 0x40]
call fcn.00423d39
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [ebp - 0x40]
push edi
call fcn.004afa51
pop ecx
lea ecx, [edi - 0x10]
mov dword [esi + 0x84], eax
call fcn.0042101a
mov edi, str.TtlResistRemove
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x42
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x427c3f
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x43
call fcn.00429f4e
push eax
lea ecx, [ebp - 0x40]
call fcn.00423d39
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [ebp - 0x40]
push edi
call fcn.004afa51
pop ecx
lea ecx, [edi - 0x10]
mov dword [esi + 0x88], eax
call fcn.0042101a
call fcn.0046cd10
mov edi, 0x4e0874
test eax, eax
je 0x427c5a
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.EarlyInjection:_WINE__disabling.
jmp 0x427ca8
push str.EarlyInjection
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x44
call fcn.00429f4e
mov eax, dword [eax]
push edi
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x427cb7
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x4e0878
call fcn.00423607
call fcn.004266fd
and dword [esi + 0x54], 0
pop ecx
push str.AutoLaunchAlwaysAllowed
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x45
call fcn.00429f4e
mov eax, dword [eax]
push edi
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x427d01
and dword [esi + 0xc8], 0
push str.AllowDbgMsgBox
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x46
call fcn.00429f4e
push edi
mov ecx, eax
call fcn.00423c64
mov ebx, eax
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x427d48
and dword [esi + 0xcc], 0
push str.RegMode
lea ecx, [ebp - 0x30]
call fcn.00423607
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x47
or dword [ebp - 0x14], 4
push eax
lea ebx, [ebp - 0x64]
call fcn.00429f4e
mov eax, dword [eax]
push str.Extract
push eax
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x427db4
push str.LegacyReg
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0x48
or dword [ebp - 0x14], 8
push eax
call fcn.00429f4e
mov eax, dword [eax]
push 0x4e0930
push eax
call fcn.004ad328
pop ecx
pop ecx
test eax, eax
je 0x427db4
xor bl, bl
jmp 0x427db6
mov bl, 1
test byte [ebp - 0x14], 8
je 0x427dcb
mov ecx, dword [ebp - 0x34]
and dword [ebp - 0x14], 0xfffffff7
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [ebp - 4], 2
test byte [ebp - 0x14], 4
je 0x427de3
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x427e07
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x4e0934
call fcn.00423607
call fcn.004266fd
pop ecx
mov dword [esi + 0xa8], 1
call fcn.0046cd10
test eax, eax
je 0x427e20
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.VirtMode:_WINE._Forcing_DISK_mode
jmp 0x427f0f
mov edi, str.VirtMode
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x49
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x427f21
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x4a
call fcn.00429f4e
mov eax, dword [eax]
push 0x4e09b0
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x427ec1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.VirtMode:_enabling_RAM_mode
call fcn.00423607
call fcn.004266fd
pop ecx
mov dword [esi + 0xa4], 1
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x4b
call fcn.00429f4e
mov eax, dword [eax]
push str.DISK
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x427f21
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.VirtMode:_enabling_DISK_mode
call fcn.00423607
call fcn.004266fd
and dword [esi + 0xa4], 0
pop ecx
mov edi, str.Branding
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x4c
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x428023
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x4d
call fcn.00429f4e
mov eax, dword [eax]
push str.None
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x427fc0
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Branding:_None
call fcn.00423607
call fcn.004266fd
and dword [esi + 0xb8], 0
jmp 0x428022
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x4e
call fcn.00429f4e
mov eax, dword [eax]
push 0x4dd498
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x428023
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Branding:_Cameyo
call fcn.00423607
call fcn.004266fd
mov dword [esi + 0xb8], 1
pop ecx
mov edi, str.ExecWait
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x4f
call fcn.00429f4e
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
setne bl
add ecx, 0xfffffff0
call fcn.0042101a
test bl, bl
je 0x4281f3
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x50
call fcn.00429f4e
mov eax, dword [eax]
push str.None
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x4280c5
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.ExecWait:_None
call fcn.00423607
call fcn.004266fd
and dword [esi + 0xc4], 0
jmp 0x4281f2
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x51
call fcn.00429f4e
mov eax, dword [eax]
push str.CmdLine
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x42812c
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.ExecWait:_CmdLine
call fcn.00423607
call fcn.004266fd
mov dword [esi + 0xc4], 1
jmp 0x4281f2
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x52
call fcn.00429f4e
mov eax, dword [eax]
push str.AutoLaunch
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x428190
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.ExecWait:_AutoLaunch
call fcn.00423607
call fcn.004266fd
mov dword [esi + 0xc4], 2
jmp 0x4281f2
push edi
lea ecx, [ebp - 0x34]
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
lea ebx, [ebp - 0x64]
mov byte [ebp - 4], 0x53
call fcn.00429f4e
mov eax, dword [eax]
push str.Always
push eax
call fcn.004ad328
pop ecx
mov ebx, eax
pop ecx
neg ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042101a
test bl, bl
je 0x4281f3
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.ExecWait:_Always
call fcn.00423607
call fcn.004266fd
mov dword [esi + 0xc4], 3
pop ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x42822e
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
push ecx
mov edx, esp
mov dword [ebp - 0x44], esp
push ecx
movzx ecx, word [eax + 4]
push ecx
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str.VirtIniSettings:_incorrect_data:_Str__0x_x_0x_x_0x_x_0x_x
push edx
call fcn.00464a80
add esp, 0x18
call fcn.004266fd
pop ecx
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx - 0xc]
test eax, eax
jne 0x428454
lea edi, [esi + 0x68]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x428454
jge 0x428257
push 0x80070057
call fcn.00421000
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x34]
push str._c:_
push eax
call fcn.00464a80
add esp, 0xc
mov byte [ebp - 4], 0x54
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0x4de948
lea ecx, [ebp - 0x14]
mov ebx, eax
call fcn.00423607
mov byte [ebp - 4], 0x55
cmp ebx, 2
jne 0x428298
push str.REMOVABLE
jmp 0x4282a2
cmp ebx, 3
jne 0x4282ac
push str.FIXED
lea ecx, [ebp - 0x14]
call fcn.00424230
jmp 0x4282da
push ebx
lea eax, [ebp - 0x40]
push 0x4dfb18
push eax
call fcn.00464a80
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x56
call fcn.00423d5a
mov byte [ebp - 4], 0x55
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov eax, esp
mov dword [ebp - 0x44], esp
push dword [ebp - 0x14]
push dword [ebp - 0x34]
push str.UnpackUtils_ReadIniFile::BaseDirName:_RootDir__s_drive_type_s
push eax
call fcn.00464a80
add esp, 0x10
call fcn.004266fd
mov ecx, esp
mov dword [ebp - 0x44], esp
push str..data
call fcn.00423607
push ecx
mov byte [ebp - 4], 0x57
mov ecx, esp
mov dword [ebp - 0x40], esp
push edi
call fcn.004235f2
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x55
call fcn.00464c40
add esp, 0xc
mov byte [ebp - 4], 0x58
cmp ebx, 2
jne 0x42836c
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x428351
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42842c
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00423d5a
mov dword [esi + 0x8c], 2
jmp 0x42842c
lea eax, [ebp - 0x24]
push eax
call fcn.004736c0
pop ecx
push 0x5c
push ecx
mov byte [ebp - 4], 0x59
mov ecx, esp
mov dword [ebp - 0x44], esp
push edi
call fcn.004235f2
lea eax, [ebp - 0x30]
push eax
call fcn.00464e90
add esp, 0xc
mov byte [ebp - 4], 0x5a
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4283eb
push eax
push dword [ebp - 0x30]
push ecx
call fcn.004afb46
add esp, 0xc
test eax, eax
jne 0x4283eb
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4283ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4283e4
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00423d5a
mov dword [esi + 0x8c], 1
mov ecx, str.TRUE:_running_from_Dropbox_dir
jmp 0x4283f0
mov ecx, str.FALSE
mov edx, dword [ebp - 0x24]
mov eax, dword [edx - 0xc]
push ecx
mov edi, esp
mov dword [ebp - 0x44], esp
push ecx
push eax
push dword [ebp - 0x30]
push edx
push str.DropboxDir:_comparing__s_to__s___d_chars_compare_:__s
push edi
call fcn.00464a80
add esp, 0x18
call fcn.004266fd
pop ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov ebx, dword [ebp - 0x18]
push ecx
mov eax, esp
mov dword [ebp - 0x44], esp
lea edi, [esi + 0x68]
push dword [edi]
push ebx
push str.UnpackUtils_ReadIniFile:_INIs_BaseDirName_s__CarrierExeName_s
push eax
call fcn.00464a80
add esp, 0x10
call fcn.004266fd
cmp dword [ebx - 0xc], 0
pop ecx
jne 0x4284ae
mov eax, dword [esi + 0x60]
cmp dword [eax - 0xc], 0
jne 0x428488
mov eax, str._AppData_VOS_AppID_
push eax
lea ecx, [ebp - 0x18]
call fcn.00424230
push ecx
mov eax, esp
mov dword [ebp - 0x44], esp
push dword [ebp - 0x18]
push str.UnpackUtils_ReadIniFile::BaseDirName:_Taking_default:__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.004266fd
pop ecx
push dword [ebp - 0x3c]
mov ecx, 0x518f0c
call fcn.00423d5a
push edi
mov ecx, 0x518f68
call fcn.00423d5a
push 4
call fcn.00472c60
pop ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00474150
pop ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.00474150
pop ecx
push 1
push ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
call fcn.00423d39
lea eax, [ebp - 0x38]
push eax
call fcn.0047e2e0
add esp, 0xc
mov byte [ebp - 4], 0x5b
mov eax, dword [ebp - 0x38]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x428594
push 0
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00425cb6
cmp eax, 0xffffffff
jne 0x428528
mov eax, dword [ebp - 0x18]
mov eax, dword [eax - 0xc]
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042369e
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x4dcf70
call fcn.00423607
push ecx
mov byte [ebp - 4], 0x5c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x3c], esp
mov ecx, esp
push eax
call fcn.00423d39
push ecx
mov byte [ebp - 4], 0x5d
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], esp
mov ecx, esp
push eax
call fcn.00423d39
lea edi, [ebp - 0x40]
mov byte [ebp - 4], 0x5b
call fcn.004645d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x5e
call fcn.00423d5a
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [ebp - 0x18]
lea ebx, [esi + 0x5c]
push eax
mov ecx, ebx
call fcn.00423d5a
lea eax, [ebp - 0x2c]
lea edi, [esi + 0x64]
push eax
mov ecx, edi
call fcn.00423d5a
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x428617
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x4dcf70
call fcn.00423607
push ecx
mov byte [ebp - 4], 0x5f
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.CHANGES
call fcn.00423607
push ecx
mov byte [ebp - 4], 0x60
mov ecx, esp
mov dword [ebp - 0x34], esp
push ebx
call fcn.004235f2
lea edi, [ebp - 0x40]
mov byte [ebp - 4], 0x5b
call fcn.004645d0
add esp, 0xc
push eax
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 0x61
call fcn.0042364b
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push 2
lea eax, [ebp - 0x40]
push eax
mov ecx, ebx
call fcn.004237f6
push 0x4e0e7c
mov ecx, eax
mov byte [ebp - 4], 0x62
call fcn.00423c64
neg eax
sbb al, al
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x40]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0xd], al
call fcn.0042101a
cmp byte [ebp - 0xd], 0
je 0x4286bd
push 2
lea eax, [ebp - 0x3c]
push eax
mov ecx, ebx
call fcn.00429e94
mov byte [ebp - 4], 0x63
push dword [eax]
lea eax, [ebp - 0x40]
push str.__UNC_sPROG_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppIDPROG_], eax
call fcn.0042101a
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
push dword [ebx]
lea eax, [ebp - 0x34]
push str.__UNC_s_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x34]
jmp 0x428706
push dword [ebx]
lea eax, [ebp - 0x40]
push str.___sPROG_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppIDPROG_], eax
call fcn.0042101a
push dword [ebx]
lea eax, [ebp - 0x3c]
push str.___s_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
mov dword [str.C:UsersUserNameVOSAppID_], eax
call fcn.0042101a
push 2
lea eax, [ebp - 0x40]
lea edi, [esi + 0x64]
push eax
mov ecx, edi
call fcn.004237f6
push 0x4e0e7c
mov ecx, eax
mov byte [ebp - 4], 0x64
call fcn.00423c64
neg eax
sbb al, al
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x40]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0xd], al
call fcn.0042101a
cmp byte [ebp - 0xd], 0
je 0x428796
push 2
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.00429e94
mov byte [ebp - 4], 0x65
push dword [eax]
lea eax, [ebp - 0x40]
push str.__UNC_s_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppIDCHANGES_], eax
call fcn.0042101a
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x3c]
jmp 0x4287b9
push dword [edi]
lea eax, [ebp - 0x40]
push str.___s_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x40]
mov dword [str.__C:UsersUserNameVOSAppIDCHANGES_], eax
add ecx, 0xfffffff0
call fcn.0042101a
push dword [ebx]
lea eax, [ebp - 0x40]
push str._sPROG_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov dword [str.C:UsersUserNameVOSAppIDPROG_], eax
call fcn.0042101a
push dword [ebx]
mov ebx, 0x4e0f00
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
mov dword [str.__C:UsersUserNameVOSAppID_], eax
call fcn.0042101a
push dword [edi]
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.004b0079
pop ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [str.C:UsersUserNameVOSAppIDCHANGES_], eax
call fcn.0042101a
push dword [0x515470]
mov ebx, 0x518efc
mov ecx, ebx
call fcn.00424230
push 0
call fcn.00473e40
pop ecx
push dword [0x51547c]
mov ebx, 0x519004
mov ecx, ebx
call fcn.00424230
push 0
call fcn.00473e40
pop ecx
push dword [0x515478]
mov ebx, 0x519000
mov ecx, ebx
call fcn.00424230
push 0
call fcn.00473e40
pop ecx
push 0x10
call fcn.0049e7e2
pop ecx
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 0x66
test eax, eax
je 0x4288ac
mov esi, eax
call fcn.0047e130
mov esi, dword [ebp + 8]
jmp 0x4288ae
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
mov dword [esi + 0x6c], eax
call fcn.0042101a
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.0042a030
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov al, 1
call fcn.004b3c48
ret