Function at 0x100fbd70
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create process on windows
Get common file path
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101269e5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x1016e750]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, esp
push eax
lea eax, [esp + 0x2d0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x28], 0
cmp eax, 1
jne 0x100fcfb3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x30], eax
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100fbdf1
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x34], eax
push 0x820
mov dword [esp + 0x2dc], 0
call fcn.10104809
mov edi, eax
mov dword [esp + 0x4c], 0
xor eax, eax
mov dword [esp + 0x48], edi
add esp, 4
mov word [esp + 0xac], ax
mov dword [esp + 0xb6], eax
xorps xmm0, xmm0
mov word [esp + 0xba], ax
lea eax, [esp + 0xac]
movq qword [esp + 0xae], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xb8]
push eax
movzx eax, word [esp + 0xba]
push eax
movzx eax, word [esp + 0xbc]
push eax
movzx eax, word [esp + 0xb8]
push eax
movzx eax, word [esp + 0xbe]
push eax
movzx eax, word [esp + 0xc6]
push eax
lea eax, [esp + 0x38]
push str._.2d__.2d__.4d__.2d:_.2d:_.2d
push eax
call fcn.10044f30
add esp, 0x20
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2dc], 1
call fcn.100244b0
mov byte [esp + 0x2d8], 0
or ebx, 0xffffffff
mov edx, dword [esp + 0x20]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100fbeda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push str.APPVIRTDLL_LOADED_BY_LOADER
call fcn.10023fc0
mov edx, 0x104
lea ecx, [esp + 0x24]
call fcn.10049050
add esp, 4
mov ecx, 0x1013de80
mov eax, dword [eax]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100fbf26
test dx, dx
je 0x100fbf22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100fbf26
add eax, 4
add ecx, 4
test dx, dx
jne 0x100fbf00
xor eax, eax
jmp 0x100fbf2b
sbb eax, eax
or eax, 1
mov edx, dword [esp + 0x20]
test eax, eax
mov ecx, ebx
sete byte [esp + 0x1b]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fbf4f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x1b], 0
lea eax, [esp + 0x14]
push dword [esp + 0x34]
je 0x100fbfc1
push str.DllMain:_called_by_Loader___s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x2d8], 2
mov ecx, str.DllMain
mov edx, dword [esp + 0x14]
call fcn.10043b30
mov byte [esp + 0x2d8], 0
mov ecx, ebx
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fbfa7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x1012ec60
push str.APPVIRTDLL_LOADED_BY_LOADER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [esp + 0x48], 1
jmp 0x100fc00a
push str.DllMain:_not_called_by_Loader___s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x2d8], 3
mov ecx, str.DllMain
mov edx, dword [esp + 0x14]
call fcn.10043b30
mov byte [esp + 0x2d8], 0
mov ecx, ebx
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc00a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10021f14
call fcn.10021cd8
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x410
push 0x101746d8
push 0
call esi
push 0x1012ec60
push 0x410
push 0x10173e98
call fcn.10104b58
add esp, 0xc
push 0x410
push 0x10173e98
push dword [esp + 0x54]
call esi
push 0x101746d8
push 0x104
push 0x10173668
call fcn.10104b58
add esp, 0xc
push 0x5c
push 0x10173668
call fcn.101058d2
add esp, 8
xor ecx, ecx
lea esi, [eax + 2]
mov word [eax], cx
push edi
push 0x410
mov dword [esp + 0x58], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100fc0a9
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x4c], edi
mov byte [esp + 0x2d8], 4
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, 0xf3c
or eax, ecx
jge 0x100fc0e5
push 0xf3c
lea ecx, [esp + 0x50]
call fcn.100249c0
mov edi, dword [esp + 0x4c]
push 0xf3c
push edi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [edi - 8]
push edi
call fcn.1010374b
add esp, 8
test eax, eax
js 0x100fcfa9
cmp eax, dword [edi - 8]
jg 0x100fcfa9
push dword [esp + 0x44]
mov dword [edi - 0xc], eax
xor ecx, ecx
push 0x10173e98
push 0x101746d8
mov word [edi + eax*2], cx
lea eax, [esp + 0x20]
push str.DllMain:_ProcessName_s__Dll_s__CurDir_s
push eax
call fcn.10044f30
add esp, 0x14
mov byte [esp + 0x2d8], 5
mov ecx, str.DllMain
mov edx, dword [esp + 0x14]
call fcn.10043b30
mov byte [esp + 0x2d8], 4
mov ecx, ebx
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc177
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x18]
push str.DllMain:_CmdLine_s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x2d8], 6
mov ecx, str.DllMain
mov edx, dword [esp + 0x14]
call fcn.10043b30
mov byte [esp + 0x2d8], 4
mov ecx, ebx
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc1cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push edi
lea eax, [esp + 0x18]
push str.DllMain:_Path_s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x2d8], 7
mov ecx, str.DllMain
mov edx, dword [esp + 0x14]
call fcn.10043b30
mov byte [esp + 0x2d8], 4
mov ecx, ebx
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc219
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x100fc249
push str.DBGVIEW.EXE
push esi
call fcn.10103523
add esp, 8
test eax, eax
je 0x100fc91c
push str.DEBUGRECEIVER.EXE
push esi
call fcn.10103523
add esp, 8
test eax, eax
je 0x100fc91c
push 0x5c
push 0x10173e98
call fcn.101058d2
add eax, 2
push eax
call fcn.10104bb4
add esp, 0xc
mov dword [esp + 0x2c], eax
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100fc281
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x38], esi
push 0xb
push str.AppVirtDll_
push dword [esp + 0x34]
mov byte [esp + 0x2e4], 8
call fcn.1010465a
add esp, 0xc
test eax, eax
jne 0x100fc2b7
mov eax, dword [esp + 0x2c]
add eax, 0x16
jmp 0x100fc2d5
push 0xd
push str.AppVirtDll64_
push dword [esp + 0x34]
call fcn.1010465a
add esp, 0xc
test eax, eax
jne 0x100fc2eb
mov eax, dword [esp + 0x2c]
add eax, 0x1a
push 0x2e
push eax
mov dword [esp + 0x34], eax
call fcn.101058d2
add esp, 8
xor ecx, ecx
mov word [eax], cx
jmp 0x100fc34f
push 0x410
push dword [esp + 0x48]
push str.CAMEYO_RO_APPID
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x100fc32e
mov ecx, dword [esp + 0x44]
cmp word [ecx], 0
je 0x100fc32e
push ecx
mov eax, esp
push ecx
push str._Taking_AppID_from_environment__debug_:__ws
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], eax
jmp 0x100fc34c
push ecx
mov eax, esp
push str._Cant_find_my_AppID__n_You_can_set_environment_variable_CAMEYO_RO_APPID
push eax
call fcn.10044f30
add esp, 8
call fcn.100f5890
mov dword [esp + 0x30], 0x1012ec60
add esp, 4
push ecx
mov ecx, esp
push dword [esp + 0x30]
call fcn.10023fc0
mov ecx, 1
call fcn.10025980
mov ecx, esp
push 0x101746d8
call fcn.10023fc0
call fcn.1003d290
add esp, 4
test eax, eax
je 0x100fc3aa
push ecx
mov eax, esp
push dword [esp + 0x30]
push str.ENVSETTING_VIRTUALAPP:_flagging_missed_process
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
push 0x1012ed24
push str.CAMEYO_VIRTUALAPP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [esp + 0x2e0], 9
push 0x101746d8
call fcn.10023fc0
mov byte [esp + 0x2e0], 8
call fcn.100f9e70
add esp, 8
test eax, eax
je 0x100fc3f9
push dword [esp + 0x2c]
mov ecx, 0x1017507c
call fcn.100240c0
jmp 0x100fc8fb
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100fc415
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x54], ebx
mov byte [esp + 0x2d8], 0xa
mov ecx, 1
mov eax, dword [ebx - 8]
sub ecx, dword [ebx - 4]
sub eax, 0x104
or eax, ecx
jge 0x100fc451
push 0x104
lea ecx, [esp + 0x58]
call fcn.100249c0
mov ebx, dword [esp + 0x54]
push 0x104
push ebx
push str.CAMEYO_VIRTUALAPP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ecx
lea ecx, [esp + 0x58]
call fcn.10024210
cmp dword [ebx - 0xc], 0
jne 0x100fc624
mov dword [esp + 0x24], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call fcn.10031520
mov dword [esp + 0x3c], eax
push ecx
mov esi, esp
mov byte [esp + 0x2dc], 0xb
push 0x10175070
push 0
push 0
push ecx
mov ecx, esp
push str.RunningInfo.ini
call fcn.10023fc0
mov edx, 1
mov ecx, esi
call fcn.1003d3b0
add esp, 0x10
lea ecx, [esp + 0x40]
call fcn.1004a170
add esp, 4
test eax, eax
je 0x100fc565
push str.VintegrateMode
lea ecx, [esp + 0x18]
call fcn.10023fc0
lea eax, [esp + 0x14]
mov byte [esp + 0x2d8], 0xc
push eax
lea ecx, [esp + 0x40]
call fcn.1004a7a0
lea ecx, [esp + 0x14]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov byte [esp + 0x2d8], 0xb
setne byte [esp + 0x1b]
call fcn.10024080
cmp byte [esp + 0x1b], 0
je 0x100fc565
push str.VintegrateMode
lea ecx, [esp + 0x18]
call fcn.10023fc0
lea eax, [esp + 0x14]
mov byte [esp + 0x2d8], 0xd
push eax
lea ecx, [esp + 0x40]
call fcn.1004a7a0
push dword [eax]
call fcn.1010463d
add esp, 4
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d8], 0xb
call fcn.10024080
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push str.VintegrateTgtPattern
mov dword [0x10175100], esi
call fcn.10023fc0
lea eax, [esp + 0x14]
mov byte [esp + 0x2d8], 0xe
push eax
lea ecx, [esp + 0x40]
call fcn.1004a7a0
push eax
mov ecx, 0x10175104
call fcn.100244b0
mov byte [esp + 0x2d8], 0xb
or ecx, 0xffffffff
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc5c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
cmp esi, 1
push dword [0x10175104]
mov esi, dword [esp + 0x34]
mov edx, str.VINTEGRATE_RECURSIVE
mov eax, str.VINTEGRATE_PROCESS_ONLY
cmovne eax, edx
push eax
push esi
push str.___Vintegrate_satellite:_AppID_s_Mode_s__TgtPattern_s._Disabling_sandbox.
push ecx
call fcn.10044f30
add esp, 0x14
call fcn.100f5890
add esp, 4
mov byte [esp + 0x2d8], 0xa
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push dword [eax]
lea eax, [esp + 0x24]
push eax
call fcn.10030c00
push dword [esp + 0x3c]
call fcn.1010338d
add esp, 4
jmp 0x100fc628
mov esi, dword [esp + 0x2c]
call fcn.1004a520
push 0
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.BaseDirName
mov dword [0x101746d4], eax
call fcn.10023fc0
push ecx
mov eax, esp
mov byte [esp + 0x2ec], 0xf
mov dword [esp + 0x50], esp
push esi
push str.SoftwareVOS_s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x2ec], 0x10
call fcn.1002ec70
lea edx, [esp + 0x4c]
mov byte [esp + 0x2ec], 0xa
mov ecx, eax
call fcn.10045b00
add esp, 0x14
push 0
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.CarrierExeName
call fcn.10023fc0
push ecx
mov eax, esp
mov byte [esp + 0x2ec], 0x11
mov dword [esp + 0x50], esp
push esi
push str.SoftwareVOS_s
push eax
call fcn.10044f30
add esp, 0xc
mov byte [esp + 0x2ec], 0x12
call fcn.1002ec70
lea edx, [esp + 0x48]
mov byte [esp + 0x2ec], 0xa
mov ecx, eax
call fcn.10045b00
add esp, 0x14
lea eax, [esp + 0x34]
mov ecx, 0x101750d8
push eax
call fcn.100244b0
or ecx, 0xffffffff
call fcn.1002d0e0
mov esi, dword [esp + 0x38]
push ecx
mov eax, esp
push dword [0x101750d8]
push esi
push str.AppVirt_Loader:_AppDir_s__CarrierExeName_s
push eax
call fcn.10044f30
add esp, 0x10
call fcn.100f5890
mov ecx, dword [0x101750d8]
mov dword [esp + 0x24], esp
lea ecx, [ecx - 0x10]
call fcn.10024750
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
mov ecx, 0x10175070
call fcn.100c6a20
add esp, 4
call fcn.10028930
push ecx
mov ecx, esp
push 0x101746d8
call fcn.10023fc0
call fcn.1003d290
add esp, 4
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [esp + 0x2e0], 0x13
push 0x101746d8
call fcn.10023fc0
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x2e0], 0xa
call fcn.100fa0f0
add esp, 8
test eax, eax
jne 0x100fc8d7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x1012ec40
call fcn.10023fc0
push ecx
mov byte [esp + 0x2e0], 0x14
mov ecx, esp
mov dword [esp + 0x44], esp
push str.services.exe
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [esp + 0x2e4], 0x15
call fcn.100447b0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2e4], 0xa
call fcn.10044c80
add esp, 0xc
push dword [eax]
push 0x101746d8
call fcn.10103523
mov edx, dword [esp + 0x28]
add esp, 8
test eax, eax
sete byte [esp + 0x1b]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc824
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x1b], 0
je 0x100fc96c
push ecx
mov ecx, esp
mov byte [0x10172223], 1
push str.___Services.exe:_waiting_in_MsiTracker_mode.
call fcn.10023fc0
call fcn.100f5890
add esp, 4
push str.CreateProcessAsUserW
push 0x1013a6dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
mov edx, str.Advapi32.dll
push 1
push ecx
sbb eax, eax
mov ecx, str.Kernel32.dll
neg eax
push 0x101733d4
cmove ecx, edx
mov edx, str.CreateProcessAsUserW
push fcn.100ef880
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bcd4
push 1
push ecx
push 0x101733d0
push 0x100ef0d0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bd14
push 1
push ecx
push 0x101733cc
push 0x100ef1b0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov dword [0x101750dc], 0
lea edx, [ebx - 0x10]
mov byte [esp + 0x2d8], 8
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc8fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [esp + 0x2d8], 4
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc91c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [esp + 0x2d8], 0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fc93d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x2d8], 0xffffffff
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x100fd4ed
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x100fd4ed
mov ecx, dword [0x10175100]
xor eax, eax
lea edx, [eax + 2]
cmp ecx, 1
jne 0x100fc980
mov eax, ecx
jmp 0x100fc985
cmp ecx, edx
cmove eax, edx
push eax
push ecx
push dword [esp + 0x34]
mov ecx, dword [0x101750dc]
call fcn.1004b9a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], eax
push eax
push dword [0x10175118]
push 0x10173e98
push 0x101746d8
push str.ProcessName_s__Dll_s__VirtMode_d__TotalProcesses_d
push ecx
call fcn.10044f30
add esp, 0x18
call fcn.100f5890
mov ecx, esp
push str._Scripts_
call fcn.10023fc0
call fcn.1002afc0
add esp, 4
mov dword [esp + 0x14], eax
cmp dword [esp + 0x20], 1
jne 0x100fc9f0
mov edx, eax
mov ecx, 2
call fcn.10023c70
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, 6
call fcn.10023c70
cmp dword [0x10175118], 1
sete al
cmp dword [0x10175174], 0
mov byte [0x10172222], al
mov byte [0x10174f38], al
je 0x100fca58
push ecx
mov ecx, 0x10175178
call fcn.10049ce0
add esp, 4
test eax, eax
je 0x100fca58
lea eax, [esp + 0x28]
push str.Warning:_encryption_key_was_not_transferred_to_child_process_
push eax
call fcn.10044f30
add esp, 8
push 0
push dword [0x1017507c]
push dword [eax]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x28]
call fcn.10024080
call fcn.100f8b50
test eax, eax
jne 0x100fca7b
push ecx
mov ecx, esp
push str._InstallHooks_failed._Quitting_
call fcn.10023fc0
call fcn.100f5890
add esp, 4
jmp 0x100fc8d7
mov eax, dword [0x10173428]
test eax, eax
je 0x100fca9d
call eax
push 0x1013d354
push eax
call fcn.10103a8d
add esp, 8
test eax, eax
je 0x100fca9d
call fcn.100f8a60
push 1
xor edx, edx
mov ecx, str._Fonts_
call fcn.100295e0
add esp, 4
test eax, eax
je 0x100fcb62
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
test eax, eax
je 0x100fcb62
or esi, 0xffffffff
mov edi, eax
lea ebx, [ebx]
push dword [edi + 8]
lea ecx, [esp + 0x28]
call fcn.10023fc0
push ecx
mov eax, esp
mov byte [esp + 0x2dc], 0x16
push dword [esp + 0x28]
push str.VirtFonts:_MatrixFileName_s
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
lea ecx, [esp + 0x24]
call fcn.1002e5d0
push ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x2c], esp
lea ecx, [ecx - 0x10]
call fcn.10024750
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
call fcn.100fb830
mov edi, dword [edi + 0x1c]
add esp, 4
mov byte [esp + 0x2d8], 0xa
mov ecx, esi
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fcb52
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x100fcad0
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x38]
push str.AcroRd32.exe
push ecx
mov ecx, esp
call fcn.100446a0
mov eax, 0x5c
lea ecx, [esp + 0x24]
movzx edx, ax
call fcn.10045200
add esp, 4
mov ecx, 1
mov byte [esp + 0x2dc], 0x17
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov ecx, eax
call fcn.10024160
test eax, eax
je 0x100fcbfe
push str.AcroRd32.exe
push ecx
mov ecx, dword [0x10175444]
mov dword [esp + 0x2c], esp
lea ecx, [ecx - 0x10]
call fcn.10024750
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
mov eax, 0x5c
movzx edx, ax
lea ecx, [esp + 0x44]
call fcn.10045200
add esp, 4
mov ecx, 3
mov dword [esp + 0x2dc], 0x18
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov ecx, eax
call fcn.10024160
mov byte [esp + 0x1b], 0
test eax, eax
jne 0x100fcc03
mov byte [esp + 0x1b], 1
mov eax, dword [esp + 0x24]
test al, 2
je 0x100fcc1f
and eax, 0xfffffffd
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], eax
call fcn.10024080
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2d8], 0xa
test al, 1
je 0x100fcc37
lea ecx, [esp + 0x1c]
call fcn.10024080
cmp byte [esp + 0x1b], 0
je 0x100fcd26
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
push 0
push 1
push 0
push ecx
mov ecx, esp
mov byte [esp + 0x2e8], 0x19
push str.SoftwareAdobeAcrobat_Reader
lea esi, [esp + 0x6c]
call fcn.10023fc0
mov edx, esi
call fcn.10046580
mov esi, dword [esp + 0x68]
add esp, 0x10
cmp esi, dword [esp + 0x5c]
je 0x100fcd11
push dword [esi]
lea eax, [esp + 0x2c]
push str.SoftwareAdobeAcrobat_Reader_sPrivileged
push eax
call fcn.10044f30
add esp, 0xc
push 0
push ecx
mov byte [esp + 0x2e0], 0x1a
mov ecx, esp
mov dword [esp + 0x44], esp
push str.bProtectedMode
call fcn.10023fc0
push ecx
mov byte [esp + 0x2e4], 0x1b
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], esp
lea ecx, [ecx - 0x10]
call fcn.10024750
mov ecx, esp
add eax, 0x10
xor edx, edx
mov dword [ecx], eax
mov ecx, SysFreeString
mov byte [esp + 0x2e4], 0x1a
call fcn.10045f50
add esp, 0xc
mov byte [esp + 0x2d8], 0x19
lea ecx, [esp + 0x28]
call fcn.10024080
add esi, 4
cmp esi, dword [esp + 0x5c]
jne 0x100fcc91
lea ecx, [esp + 0x58]
mov byte [esp + 0x2d8], 0xa
call fcn.10039d60
mov esi, dword [esp + 0x38]
cmp dword [esp + 0x48], 0
je 0x100fcd55
mov ecx, dword [0x10175110]
cmp dword [ecx - 0xc], 0
je 0x100fcd55
push ecx
add ecx, 0xfffffff0
mov dword [esp + 0x20], esp
call fcn.10024750
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
call fcn.100fb950
add esp, 4
cmp dword [esp + 0x20], 1
jne 0x100fcd9a
mov edx, dword [esp + 0x14]
mov ecx, 1
call fcn.10023c70
test byte [0x10175108], 0x20
je 0x100fcd9a
mov eax, dword [0x10173428]
test eax, eax
je 0x100fcd9a
call eax
push 0x1013d354
push eax
call fcn.10103a8d
add esp, 8
test eax, eax
jne 0x100fcd9a
mov ecx, 0x10175070
call fcn.1003f0f0
mov edx, dword [esp + 0x14]
mov ecx, 5
call fcn.10023c70
push 0x1013804c
lea ecx, [esp + 0x38]
call fcn.100240c0
mov edx, dword [0x10172238]
lea eax, [esp + 0x34]
push eax
push 0x1002b290
push 0
mov ecx, 0x10172230
call fcn.10034300
push ecx
mov eax, esp
push dword [esp + 0x38]
push str.Sandbox:__s
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
mov eax, dword [esp + 0x54]
add esp, 4
test eax, eax
je 0x100fce1c
push str.xxxxxxxx.exe
push eax
call fcn.10103523
movzx ecx, byte [0x10172221]
add esp, 8
test eax, eax
mov eax, 1
cmove ecx, eax
mov byte [0x10172221], cl
call fcn.100f9c70
test byte [0x10174f3c], 2
je 0x100fcef3
lea ecx, [esp + 0x14]
call fcn.10023f70
xor eax, eax
mov byte [esp + 0x2d8], 0x1c
push 0x206
push eax
mov word [esp + 0xc4], ax
lea eax, [esp + 0xc6]
push eax
call fcn.101078f0
add esp, 0xc
lea eax, [esp + 0xbc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x410
push dword [esp + 0x48]
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x30]
push eax
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x101746d8
push dword [esp + 0x3c]
lea eax, [esp + 0xd0]
push eax
push esi
push 0x10173e98
lea eax, [esp + 0x34]
push str.g_MyDllName_s_nAppDir_s_nCurrentDir_s_nAppID_s_nGetModuleName_s_nCommandLine_s_nPath_s_nTook__d_ms_to_initialize
push eax
call fcn.10036910
add esp, 0x28
push 0
push 0x101746d8
push dword [esp + 0x1c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x14]
mov dword [0x10174f3c], 1
mov byte [esp + 0x2d8], 0xa
call fcn.10024080
push dword [esp + 0x44]
call fcn.10103713
mov eax, esp
push str.DllMain:_DLL_PROCESS_ATTACH_done
push eax
call fcn.10044f30
add esp, 8
call fcn.100f5890
lea edx, [ebx - 0x10]
mov byte [esp + 0x2dc], 8
or ebx, 0xffffffff
lea eax, [edx + 0xc]
add esp, 4
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fcf38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [esp + 0x2d8], 4
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fcf59
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [esp + 0x2d8], 0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fcf7a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x2d8], 0xffffffff
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x100fd4ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100fd4ed
push 0x80070057
call fcn.100223c0
test eax, eax
jne 0x100fd4ed
lea eax, [esp + 0x20]
push str.DllMain:_DLL_PROCESS_DETACH
push eax
call fcn.10044f30
add esp, 8
mov dword [esp + 0x2d8], 0x1d
mov ecx, str.DllMain
mov edx, dword [esp + 0x20]
call fcn.10043b30
mov dword [esp + 0x2d8], 0xffffffff
or ebx, 0xffffffff
mov edx, dword [esp + 0x20]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100fd011
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x10173660]
test eax, eax
je 0x100fd026
cmp eax, 0xffffffff
je 0x100fd026
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1017045d], 0
call fcn.100f8950
push ecx
mov ecx, esp
push str._Scripts_
call fcn.10023fc0
call fcn.1002afc0
add esp, 4
mov edi, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edi
push dword [0x101750ac]
push str.DllMain_DETACH_:_OnProcessStopVirtualized_s
push eax
call fcn.10044f30
add esp, 0xc
mov dword [esp + 0x2d8], 0x1e
mov ecx, str.DllMain
mov edx, dword [esp + 0x20]
call fcn.10043b30
mov dword [esp + 0x2d8], 0xffffffff
mov ecx, ebx
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fd0a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, edi
mov ecx, 7
call fcn.10023c70
mov eax, dword [0x101750dc]
mov dword [esp + 0x14], eax
test eax, eax
je 0x100fd46e
xor edi, edi
push 1
push 0
push ecx
mov ecx, dword [0x1017507c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.10024750
mov ecx, dword [esp + 0x20]
add eax, 0x10
mov dword [esi], eax
call fcn.1004bdb0
mov esi, eax
lea eax, [esp + 0x20]
push esi
push dword [0x1017507c]
push str.DllMain_DETACH_:_CActiveVirtApp:_pVirtApp__s__.8x
push eax
call fcn.10044f30
add esp, 0x10
mov dword [esp + 0x2d8], 0x1f
mov ecx, str.DllMain
mov edx, dword [esp + 0x20]
call fcn.10043b30
mov dword [esp + 0x2d8], 0xffffffff
mov ecx, ebx
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fd144
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x100fd417
mov eax, dword [esp + 0x14]
mov esi, dword [esi + 0x424]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push dword [0x1017507c]
lea eax, [esp + 0x50]
push str.DllMain_DETACH_:__s.TotalProcesses_d
push eax
call fcn.10044f30
add esp, 0x10
mov dword [esp + 0x2d8], 0x20
mov ecx, str.DllMain
mov edx, dword [esp + 0x48]
call fcn.10043b30
mov dword [esp + 0x2d8], 0xffffffff
mov ecx, ebx
mov edx, dword [esp + 0x48]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fd1b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp esi, 1
ja 0x100fd410
mov eax, edi
inc edi
cmp eax, 5
jge 0x100fd229
push str.DllMain_DETACH_:_CActiveVirtApp:_Re_checking_if_this_is_the_last_process_for_this_app__Recheck_.
lea ecx, [esp + 0x2c]
call fcn.10023fc0
mov dword [esp + 0x2d8], 0x21
mov ecx, str.DllMain
mov edx, dword [esp + 0x28]
call fcn.10043b30
mov dword [esp + 0x2d8], 0xffffffff
mov ecx, ebx
mov edx, dword [esp + 0x28]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100fd219
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100fd0c5
push ecx
mov ecx, esp
push str.DllMain_DETACH_:_CActiveVirtApp:_This_is_the_last_process_for_this_app.
call fcn.10023fc0
call fcn.100f5890
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.10023fc0
push ecx
mov ecx, esp
mov dword [esp + 0x2e0], 0x22
push 0x101746d8
call fcn.10023fc0
mov dword [esp + 0x2e0], 0xffffffff
call fcn.100f9e70
add esp, 8
test eax, eax
je 0x100fd29f
push ecx
mov ecx, esp
push str.DllMain_DETACH_:_AVOIDING_VirtRegSync__CustomEvents_because_were_rundll32_injector
call fcn.10023fc0
call fcn.100f5890
add esp, 4
mov ecx, 1
jmp 0x100fd412
cmp dword [0x1017511c], 0
jne 0x100fd2b5
call fcn.10047730
test eax, eax
jne 0x100fd3a8
push dword [0x101750d8]
lea eax, [esp + 0x3c]
push str.__s___VirtRegSyncExport
push eax
call fcn.10044f30
add esp, 0xc
push 0x40
lea eax, [esp + 0x6c]
mov dword [esp + 0x2dc], 0x23
push 0
push eax
call fcn.101078f0
mov eax, dword [esp + 0x44]
xorps xmm0, xmm0
add esp, 0xc
mov dword [esp + 0x64], 0x44
movdqu xmmword [esp + 0xac], xmm0
cmp dword [eax - 4], 1
jle 0x100fd317
push dword [eax - 0xc]
lea ecx, [esp + 0x3c]
call fcn.10024570
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100fd394
mov eax, dword [0x1017509c]
cmp dword [eax - 0xc], 0
jne 0x100fd353
mov eax, dword [0x101750a0]
cmp dword [eax - 0xc], 0
je 0x100fd394
push ecx
mov eax, esp
push str.DllMain_DETACH_:_OnStop_events_exist__waiting_for_VirtRegSyncExport_to_finish...
push eax
call fcn.10044f30
add esp, 8
call fcn.100f5890
add esp, 4
push 0xffffffffffffffff
push dword [esp + 0xb0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov eax, esp
push str.DllMain_DETACH_:_VirtRegSyncExport_finished
push eax
call fcn.10044f30
add esp, 8
call fcn.100f5890
add esp, 4
lea ecx, [esp + 0x38]
mov dword [esp + 0x2d8], 0xffffffff
call fcn.10024080
push ecx
mov eax, esp
push dword [0x1017509c]
push str.DllMain_DETACH_:_OnStopVirtualized_s
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
mov edx, dword [esp + 0x28]
add esp, 4
mov ecx, 3
call fcn.10023c70
push ecx
mov eax, esp
mov byte [0x1017045c], 0
push dword [0x101750a0]
push str.DllMain_DETACH_:_OnStopUnvirtualized_s
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
mov edx, dword [esp + 0x28]
add esp, 4
mov ecx, 4
call fcn.10023c70
mov ecx, 1
jmp 0x100fd412
xor ecx, ecx
call fcn.10028c60
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
push ecx
mov edx, esp
push eax
push dword [0x1017507c]
push str.DllMain_DETACH_:_CActiveVirtApp:_UnregisterAppProcess__s___d_
push edx
call fcn.10044f30
add esp, 0x10
call fcn.100f5890
mov esi, dword [0x1017507c]
add esp, 4
call edi
mov ecx, dword [esp + 0x14]
push eax
push esi
call fcn.1004bc40
cmp dword [0x10175100], 0
je 0x100fd46a
mov ecx, dword [0x101751e0]
test ecx, ecx
je 0x100fd46a
call fcn.10035ac0
mov edi, dword [esp + 0x24]
push dword [0x101750b0]
lea eax, [esp + 0x18]
mov byte [0x1017045c], 0
push str.DllMain_DETACH_:_OnProcessStopUnvirtualized_s
push eax
call fcn.10044f30
add esp, 0xc
mov dword [esp + 0x2d8], 0x24
mov ecx, str.DllMain
mov edx, dword [esp + 0x14]
call fcn.10043b30
mov dword [esp + 0x2d8], 0xffffffff
mov esi, dword [esp + 0x14]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x100fd4cc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, edi
mov ecx, 8
call fcn.10023c70
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10021f14
call fcn.10021d28
mov eax, 1
mov ecx, dword [esp + 0x2d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.10103392
mov esp, ebp
pop ebp
ret 0xc