Function at 0x441a66
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Get file attributes
Get hostname
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d9f23
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x34c4
call fcn.004b8990
mov eax, dword [0x518f10]
xor eax, esp
mov dword [esp + 0x34c0], eax
push ebx
push esi
push edi
mov eax, dword [0x518f10]
xor eax, esp
push eax
lea eax, [esp + 0x34d8]
mov dword fs:[0], eax
lea eax, [esp + 0x290]
xor esi, esi
mov dword [esp + 0x48], esi
push eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x294], 8
mov dword [esp + 0x298], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x60]
call fcn.004ac458
mov ebx, 0x4e3948
push ebx
lea ecx, [esp + 0x60]
call fcn.0042462c
push ebx
lea ecx, [esp + 0x68]
mov dword [esp + 0x34e4], esi
call fcn.0042462c
xor edi, edi
push ebx
lea ecx, [esp + 0x78]
inc edi
mov byte [esp + 0x34e4], 1
call fcn.0042462c
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34e4], 2
call fcn.00465b10
pop ecx
lea ecx, [esp + 0x44]
call fcn.0042248a
lea eax, [esp + 0x50]
mov byte [esp + 0x34e0], 4
push eax
mov dword [esp + 0x80], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1b8]
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x40], esi
call fcn.00465b10
pop ecx
push eax
mov ecx, 0x51ef68
mov byte [esp + 0x34e4], 5
call fcn.00424670
mov byte [esp + 0x34e0], 4
mov ecx, dword [esp + 0x1b8]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [esp + 0x1bc]
push eax
call fcn.00465b10
mov byte [esp + 0x34e4], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Loader:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.0044091a
pop ecx
mov byte [esp + 0x34e0], 4
mov ecx, dword [esp + 0x1bc]
add ecx, 0xfffffff0
call fcn.0042201a
push esi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x51ebb8], eax
cmp dword [esp + 0x2c], esi
je 0x442b18
cmp dword [esp + 0x50], edi
jle 0x442b18
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
push ecx
lea edi, [eax + ecx*4]
mov ecx, esp
mov dword [esp + 0x38], esp
push dword [edi]
call fcn.0042462c
call fcn.0044094a
mov dword [esp], 0x4f11cc
call fcn.004b1c10
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
jne 0x441c67
push 0x4f11cc
call fcn.004b1c10
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x18]
jmp 0x442b00
push str._Confirm
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x441c86
mov dword [esp + 0x54], 1
jmp 0x442b06
push str._Quiet
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x441ca8
or dword [esp + 0x3c], 2
mov dword [0x51b49c], esi
jmp 0x442b06
push str._AllUsers
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x441cfb
mov dword [esp + 0x4c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004658f0
test eax, eax
je 0x442c0e
call fcn.00465ac0
test eax, eax
jne 0x442b06
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Admin_rights_required
jmp 0x442c29
push str._ErrorsOnly
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x441d1c
mov dword [0x51b49c], 1
jmp 0x442b06
push str._Wait
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x441d38
or dword [esp + 0x3c], 1
jmp 0x442b06
push 0x4f1298
call fcn.004b1c10
pop ecx
push eax
push str._Password:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x442ae1
push 0x4f12bc
call fcn.004b1c10
pop ecx
push eax
push str._Password
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x442ae1
push 0x4f12f8
call fcn.004b1c10
pop ecx
push eax
push str._Properties:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
jne 0x4420fe
push str._Properties_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00424617
lea eax, [esp + 0xde8]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 7
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00424617
lea eax, [esp + 0xde8]
push eax
call fcn.00441232
add esp, 0x10
lea eax, [esp + 0xddc]
call fcn.0047b8c0
lea ecx, [esp + 0x28]
call fcn.0042248a
lea ecx, [esp + 0x24]
call fcn.0042248a
lea ecx, [esp + 0x68]
call fcn.0042248a
push 0x4f12f8
mov byte [esp + 0x34e4], 0xa
call fcn.004b1c10
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x144]
call fcn.0042462c
lea eax, [esp + 0x298]
push eax
mov byte [esp + 0x34e4], 0xb
call fcn.0043ed2e
mov byte [esp + 0x34e0], 0xc
mov dword [esp + 0x154], esi
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4f0be0
lea edi, [esp + 0x15c]
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0xd
lea eax, [esp + 0x148]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1b0]
push eax
mov byte [esp + 0x34ec], 0xc
call fcn.0046a820
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x34e4], 0xe
call fcn.00424670
mov byte [esp + 0x34e0], 0xc
mov ecx, dword [esp + 0x1a8]
add ecx, 0xfffffff0
call fcn.0042201a
push esi
push 0x3d
lea ecx, [esp + 0x30]
call fcn.00426cae
mov edi, eax
cmp edi, 0xffffffff
je 0x441f7f
push edi
lea eax, [esp + 0x1b4]
push eax
lea ecx, [esp + 0x30]
call fcn.0042481b
mov byte [esp + 0x34e0], 0xf
call fcn.00424772
push eax
lea ecx, [esp + 0x28]
call fcn.00424670
mov byte [esp + 0x34e0], 0xc
mov ecx, dword [esp + 0x1b0]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], esi
je 0x441f7f
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x6c]
call fcn.00424670
push esi
lea ecx, [esp + 0x6c]
lea eax, [edi + 1]
push ecx
call fcn.004246c3
lea eax, [esp + 0x68]
push eax
push ecx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2a4]
push eax
call fcn.0043ed7f
pop ecx
mov ecx, eax
call fcn.00424670
cmp dword [esp + 0x154], 0xffffffff
jne 0x441e6e
mov eax, dword [esp + 0x2b0]
mov eax, dword [eax]
lea edi, [esp + 0x298]
lea esi, [esp + 0x98]
call fcn.0042b44a
jmp 0x44206d
lea esi, [esp + 0x98]
call fcn.0043ee66
push eax
lea ecx, [esp + 0xf8]
call fcn.00424617
mov byte [esp + 0x34e0], 0x10
call fcn.0043ee66
add eax, 4
push eax
lea ecx, [esp + 0x20]
call fcn.00424617
push str.Branding
lea eax, [esp + 0xf8]
mov byte [esp + 0x34e4], 0x11
call fcn.004246af
test eax, eax
je 0x442c3a
lea edi, [esp + 0xf4]
call fcn.0042af68
push dword [eax]
lea eax, [esp + 0x290]
push str.CAMEYO__s
push eax
call fcn.00466ad0
mov esi, dword [esp + 0x28]
mov eax, dword [eax]
add esp, 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x28c]
add ecx, 0xfffffff0
call fcn.0042201a
lea ecx, [esi - 0x10]
call fcn.0042201a
mov byte [esp + 0x34e0], 0xc
mov ecx, dword [esp + 0xf4]
add ecx, 0xfffffff0
call fcn.0042201a
lea esi, [esp + 0x98]
call fcn.0042e04d
mov eax, dword [esp + 0x2b0]
lea edi, [esp + 0x298]
lea esi, [esp + 0xa8]
call fcn.0042b44a
mov edi, esi
lea esi, [esp + 0x98]
call fcn.0042b460
test al, al
je 0x441fae
lea eax, [esp + 0x298]
push eax
mov byte [esp + 0x34e4], 0xb
call fcn.0043ed1d
mov ecx, dword [esp + 0x140]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x68]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [esp + 0xddc]
mov byte [esp + 0x34e0], 4
call fcn.004276f3
jmp 0x44285c
push str._SafeMode
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x44214a
push str._SafeMode_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x4e5978
push str.CAMEYO_LEGACYREG
call edi
push str.Disk
push str.CAMEYO_VIRTMODE
call edi
push 0x4e58bc
push str.CAMEYO_EARLYINJECTION
call edi
jmp 0x442b06
push 0x4f13fc
call fcn.004b1c10
pop ecx
push eax
push str._Services:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
jne 0x4421be
push dword [edi]
lea ecx, [esp + 0x10c]
call fcn.0042462c
push 0x4f13fc
mov byte [esp + 0x34e4], 0x12
call fcn.004b1c10
pop ecx
push esi
lea ecx, [esp + 0x10c]
push ecx
call fcn.004246c3
push dword [esp + 0x108]
push str.CAMEYO_SERVICES
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x34e0], 4
mov ecx, dword [esp + 0x108]
jmp 0x442ad7
push str._Register
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x442c4e
push str._Stop
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x442cff
push str._Remove
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44931c
push str._RemoveSelf
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44931c
push str._Remove:Proc
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x442e22
push str._Remove:Reg
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44300a
push str._LearnStreaming
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44913b
push 0x4f19b4
call fcn.004b1c10
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x44913b
push str._UpdateBasicSettings
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x44229a
mov dword [esp + 0x30], 1
jmp 0x442b06
push str._Repackage
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x443211
push str._CreateDiff
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x448f82
push 0x4f1bd8
call fcn.004b1c10
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x448f82
push str._exec
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4433ed
push 0x4f1c1c
call fcn.004b1c10
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x448a36
push 0x4f1c34
call fcn.004b1c10
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x448a36
push str._ShowStreaming
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4435b2
push str._Break
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x443694
push str._Unbreak
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x443db7
push str._Integrate
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x448602
push str._Integrate:once
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x448602
push str._FullIntegrate
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x448602
push str._Unintegrate
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4445e2
push str._CreateShortcuts
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447fd8
push 0x4f26f8
call fcn.004b1c10
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x447fd8
push str._Perf
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44464a
push str._ExtractLog
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x444a50
push str._ExtractAll
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x444c4a
push str._AutoUpdateXml
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x444d2b
push str._Info
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x444e7e
push str._Sandbox
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x444f33
push 0x4f2998
call fcn.004b1c10
pop ecx
push eax
push str._GetProperty:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x445035
push 0x4f29e0
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44524f
push str._InfoLog
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44544f
push str._Ini
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447eba
push str._ShowIni
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447eba
push str._ExtractIni
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44564e
push str._csv
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4457d8
push str._EngineVer
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x445ba1
push str._ChangeLoader
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x44257a
mov eax, dword [esp + 0x20]
inc eax
cmp dword [esp + 0x50], eax
jg 0x445ce2
push str._ChangeEngine
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x44259b
mov eax, dword [esp + 0x20]
inc eax
cmp dword [esp + 0x50], eax
jg 0x44600c
push str._ChangeIni
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x4425bc
mov eax, dword [esp + 0x20]
inc eax
cmp dword [esp + 0x50], eax
jg 0x4463a4
push str._TestAutoUpdate
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x4425df
mov eax, dword [esp + 0x20]
add eax, 5
cmp dword [esp + 0x50], eax
jg 0x44655d
push str._Debug
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44666c
push str._ForceMenu
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x442614
mov dword [esp + 0x7c], 1
jmp 0x442b06
push str._ShowTree
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4466ad
push str._RegDump
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x446779
push str._SetFileFlags
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x442663
mov eax, dword [esp + 0x20]
add eax, 2
cmp dword [esp + 0x50], eax
jg 0x4468f4
push str._DbgZip:
call fcn.004b1cba
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x446b05
push str._DbgNow
call fcn.004b1cba
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x446b45
push str._Vintegrate
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447d3b
push 0x4f33e8
call fcn.004b1c10
pop ecx
push eax
push str._Vintegrate:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x447d3b
push str._VintegrateRecursive
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447d3b
push 0x4f3440
call fcn.004b1c10
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x447d3b
push str._Vunintegrate
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x446c33
push str._Vmanager
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x446de0
push 0x4f3500
call fcn.004b1c10
pop ecx
push eax
push str._ProcessList
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x446e8d
push 0x4f3688
call fcn.004b1c10
pop ecx
push eax
push str._WaitFor
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
je 0x4471fe
push str._GfxSvr
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x4427e7
call fcn.0042f3c5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov edi, 0x51ef00
call fcn.00482ac0
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.00482ac0
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x442b06
push 0x4f36b8
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x442863
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.open
xor ebx, ebx
call fcn.0042462c
push esi
push ecx
mov dword [esp + 0x34ec], 0x15f
mov ecx, esp
mov dword [esp + 0x40], esp
push str._Troubleshoot
xor edi, edi
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x60
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00424617
mov dword [esp + 0x34f0], 4
call fcn.00465570
add esp, 0x10
mov ebx, 0x4e3948
xor esi, esi
jmp 0x442b06
push str._Troubleshoot
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4472bf
push str._AutoUpdate
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4472e5
push str._VirtRegSyncExport
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44737a
push str._StartStreaming
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4473e2
push str._JumpTo
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447400
push str._SvcRegister
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x44749f
push str._SvcStart
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4475a8
push str._SvcRegisterStart
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447663
push str._SvcStop
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4477c4
push str._SvcRemove
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447881
push str._AuthCheck
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447c2d
push str._AuthCheck:Force
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447c2d
push str._RepoSync
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x44298c
mov eax, dword [esp + 0x20]
inc eax
cmp dword [esp + 0x50], eax
jg 0x44793f
push str._MergeRegistry
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447a17
push dword [edi]
lea ecx, [esp + 0xe0]
call fcn.0042462c
push esi
push ecx
mov dword [esp + 0x34e8], 0x170
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4e2490
call fcn.0042462c
push ecx
mov edi, esp
mov byte [esp + 0x34ec], 0x71
mov dword [esp + 0x20], esp
push 0x5c
push ecx
lea eax, [esp + 0xf0]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00424617
push edi
call fcn.00466e00
add esp, 0xc
mov byte [esp + 0x34ec], 0x70
call fcn.0046ad50
add esp, 0xc
cmp eax, esi
je 0x442a4a
push 0x4ed50c
push ecx
lea eax, [esp + 0xe4]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
lea eax, [esp + 0x270]
push eax
call fcn.00466b60
or dword [esp + 0x54], 4
pop ecx
pop ecx
call fcn.004246af
mov byte [esp + 0x43], 1
test eax, eax
je 0x442a4f
mov byte [esp + 0x43], 0
test byte [esp + 0x48], 4
je 0x442a6a
mov ecx, dword [esp + 0x268]
and dword [esp + 0x48], 0xfffffffb
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [esp + 0x43], 0
jne 0x447b0f
push 0x4ebaec
lea ecx, [esp + 0x68]
call fcn.00424685
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.0042462c
lea eax, [esp + 0x218]
push eax
call fcn.0046c4d0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x34e4], 0x76
call fcn.00424670
mov ecx, dword [esp + 0x214]
add ecx, 0xfffffff0
call fcn.0042201a
mov dword [esp + 0x34e0], 4
mov ecx, dword [esp + 0xdc]
add ecx, 0xfffffff0
call fcn.0042201a
jmp 0x442b06
push str._Password_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4f1298
call fcn.004b1c10
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x44]
push eax
call fcn.00424685
inc dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x50]
jl 0x441c0f
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xf08]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
mov dword [esp + 0x34e4], 0x177
push dword [esp + 0x40]
lea eax, [esp + 0x7c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34f0], 0x78
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34f4], 0x79
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f4], 0x7a
push dword [esp + 0x90]
lea eax, [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0xf18]
push eax
mov byte [esp + 0x3500], 0x77
call fcn.00435082
add esp, 0x20
cmp eax, 2
jne 0x449654
call fcn.004410ec
push esi
push dword [0x51ef0c]
push str.Application_is_now_integrated_into_your_system
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0xefc]
call fcn.0047b8c0
lea eax, [esp + 0xefc]
mov dword [esp + 0x34e0], 4
call fcn.004276f3
jmp 0x442c9d
call fcn.00465940
test eax, eax
jne 0x442c33
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Elevation_failed
call fcn.0042462c
call fcn.00441169
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.License_required.
jmp 0x442c29
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov esi, 0x51ef00
push esi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x442c84
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x442c29
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov ecx, esi
call fcn.004348d0
pop ecx
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
mov ecx, dword [esp + 0x34d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x34c0]
xor ecx, esp
call fcn.004b134c
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x442d32
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x51ef58
call fcn.00424617
push ecx
mov byte [esp + 0x34e8], 0x13
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x51ef68
call fcn.00424617
push ecx
mov byte [esp + 0x34ec], 0x14
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x51ef5c
call fcn.00424617
push ecx
mov byte [esp + 0x34f0], 0x15
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x51ef0c
call fcn.00424617
mov byte [esp + 0x34f0], 4
call fcn.0043cc29
add esp, 0x10
cmp eax, esi
je 0x442dc8
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Cannot_stop_application__s
push eax
call fcn.00466ad0
add esp, 0xc
jmp 0x442c2e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.0042462c
call fcn.0044094a
pop ecx
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x64]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, esi
jmp 0x442cdb
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x442e55
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
mov eax, dword [0x51ef5c]
cmp dword [eax - 0xc], esi
jne 0x442e7c
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Cannot_obtain_base_dir_for__s
jmp 0x442dba
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov edi, 0x51ef5c
push edi
call fcn.00424617
call fcn.00469180
pop ecx
cmp eax, esi
jne 0x442ec7
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Application_is_not_deployed_on_this_machine:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
push 5
jmp 0x442c34
cmp dword [esp + 0x54], esi
je 0x442eea
push 3
push dword [0x51ef0c]
push str.Do_you_want_to_stop_the_application_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4493e7
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef0c]
push str.Removing_processes:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0044094a
pop ecx
lea ecx, [esp + 0x124]
call fcn.0042248a
push 0x4e1f68
mov byte [esp + 0x34e4], 0x1c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push esi
push 1
lea eax, [esp + 0x130]
push eax
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x51ef58
call fcn.00424617
push ecx
mov byte [esp + 0x34fc], 0x1d
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51ef68
call fcn.00424617
push ecx
mov byte [esp + 0x3500], 0x1e
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x51ef64
call fcn.00424617
push ecx
mov byte [esp + 0x3504], 0x1f
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.00424617
push ecx
mov byte [esp + 0x3508], 0x20
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51ef0c
call fcn.00424617
mov byte [esp + 0x3508], 0x1c
call fcn.0043d02e
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Stopped_successfully
call fcn.0042462c
call fcn.0044094a
pop ecx
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Application__s_stopped_successfully
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x124]
jmp 0x449647
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x44303d
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
mov eax, dword [0x51ef5c]
cmp dword [eax - 0xc], esi
jne 0x443059
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x442e6c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov edi, 0x51ef5c
push edi
call fcn.00424617
call fcn.00469180
pop ecx
cmp eax, esi
jne 0x443087
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x442ea5
cmp dword [esp + 0x54], esi
je 0x4430aa
push 3
push dword [0x51ef0c]
push str.Do_you_want_to_remove_the_applications_registry_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4493e7
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef0c]
push str.Removing_registry:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0044094a
pop ecx
lea ecx, [esp + 0x12c]
call fcn.0042248a
push 0x4e1f68
mov byte [esp + 0x34e4], 0x21
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push 1
push esi
lea eax, [esp + 0x138]
push eax
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x51ef58
call fcn.00424617
push ecx
mov byte [esp + 0x34fc], 0x22
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51ef68
call fcn.00424617
push ecx
mov byte [esp + 0x3500], 0x23
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x51ef64
call fcn.00424617
push ecx
mov byte [esp + 0x3504], 0x24
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.00424617
push ecx
mov byte [esp + 0x3508], 0x25
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51ef0c
call fcn.00424617
mov byte [esp + 0x3508], 0x21
call fcn.0043d02e
add esp, 0x24
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef0c]
push str.SoftwareVOS_s
push eax
call fcn.00466ad0
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00467bb0
pop ecx
cmp eax, esi
je 0x4431c6
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Registry_could_not_be_emptied_for__s
jmp 0x442dba
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Registry_removed_successfully
call fcn.0042462c
call fcn.0044094a
pop ecx
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Application__ss_registry_removed_successfully
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x12c]
jmp 0x449647
lea ecx, [esp + 0x24]
call fcn.0042248a
lea ecx, [esp + 0x3c]
call fcn.0042248a
mov byte [esp + 0x34e0], 0x2e
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x44324b
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x28]
call fcn.00424685
jmp 0x443259
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00424670
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0x2f
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x16c]
push eax
mov byte [esp + 0x34ec], 0x2e
call fcn.00466c90
add esp, 0xc
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34e4], 0x30
call fcn.00424670
mov byte [esp + 0x34e0], 0x2e
mov ecx, dword [esp + 0x164]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00469bd0
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x28]
pop ecx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x3c]
jne 0x44330c
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
jmp 0x442c2e
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
call fcn.0043c512
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, esi
jne 0x443399
push dword [0x51b49c]
lea eax, [esp + 0x40]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x228]
push eax
call fcn.00466e00
add esp, 8
mov byte [esp + 0x34e8], 0x31
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x21c]
add ecx, 0xfffffff0
call fcn.0042201a
lea ecx, [edi - 0x10]
call fcn.0042201a
lea ecx, [ebx - 0x10]
jmp 0x44964a
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x30], 0x10
push dword [0x51b49c]
jne 0x4433be
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x442c29
push dword [esp + 0x34]
lea eax, [esp + 0x2c0]
push eax
call fcn.0046d880
add esp, 4
mov byte [esp + 0x34e8], 0x32
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x442dbb
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax + edx*4]
call fcn.0042462c
lea eax, [esp + 0x170]
push eax
call fcn.0046c4d0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x34e4], 0x39
call fcn.00424670
push eax
lea ecx, [esp + 0x68]
call fcn.00424670
push eax
lea ecx, [esp + 0xe8]
call fcn.00424617
mov byte [esp + 0x34e0], 0x3b
mov ecx, dword [esp + 0x16c]
add ecx, 0xfffffff0
call fcn.0042201a
push 1
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0xec]
call fcn.0042481b
push 0x4ec364
push eax
call fcn.00424925
pop ecx
pop ecx
mov ecx, dword [esp + 0x224]
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042201a
cmp byte [esp + 0x43], 0
lea ecx, [esp + 0x64]
je 0x44349a
push 1
push 0x22
jmp 0x44349d
push esi
push 0x20
call fcn.00426cae
mov edi, eax
cmp edi, 0xffffffff
je 0x443511
push edi
lea eax, [esp + 0x178]
push eax
lea ecx, [esp + 0x6c]
call fcn.0042481b
push 0x4ec250
mov byte [esp + 0x34e4], 0x3c
call fcn.0043a598
push eax
lea ecx, [esp + 0x68]
call fcn.00424670
mov byte [esp + 0x34e0], 0x3b
mov ecx, dword [esp + 0x174]
add ecx, 0xfffffff0
call fcn.0042201a
push esi
lea ecx, [esp + 0x78]
lea eax, [edi + 1]
push ecx
call fcn.004246c3
lea eax, [esp + 0x74]
call fcn.00424772
push eax
lea ecx, [esp + 0x78]
call fcn.00424670
jmp 0x443536
push 0x4ec250
lea eax, [esp + 0xe8]
call fcn.0043a598
push eax
lea ecx, [esp + 0x68]
call fcn.00424670
push ebx
lea ecx, [esp + 0x78]
call fcn.00424685
xor ecx, ecx
lea eax, [esp + 0x64]
call fcn.0042afb1
movzx eax, ax
cmp ax, 0x25
jne 0x443555
lea eax, [esp + 0x64]
push eax
call fcn.00476570
pop ecx
push ecx
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
lea eax, [esp + 0x230]
push eax
call fcn.00477300
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x34e4], 0x3d
call fcn.00424670
mov ecx, dword [esp + 0x22c]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [esp + 0x34e0], 4
mov ecx, dword [esp + 0xe4]
add ecx, 0xfffffff0
call fcn.0042201a
jmp 0x442b18
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ShowStreaming:
call fcn.0042462c
call fcn.0044094a
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x860]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x34ec], 0x4b
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x4c
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x4d
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 0x4e
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0x870]
push eax
mov byte [esp + 0x3500], 0x4b
call fcn.00435082
add esp, 0x20
lea ecx, [esp + 0x854]
call fcn.004343e3
lea eax, [esp + 0x854]
call fcn.0047b8c0
mov byte [esp + 0x34e0], 4
lea eax, [esp + 0x854]
call fcn.004276f3
jmp 0x442ddf
lea ecx, [esp + 0x24]
call fcn.0042248a
mov byte [esp + 0x34e0], 0x4f
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x4436c5
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x28]
call fcn.00424685
jmp 0x4436d3
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00424670
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0x50
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x34ec], 0x4f
call fcn.00466c90
add esp, 0xc
push 1
push esi
push ecx
mov byte [esp + 0x34ec], 0x51
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x398]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0x52
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x398]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0x414], esi
jne 0x44378c
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_containers_
jmp 0x442c29
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00468860
pop ecx
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4437cd
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_empty__s
jmp 0x442dba
mov esi, dword [esp + 0x58]
call fcn.00469260
test eax, eax
jne 0x4437f5
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push str.Cant_create__s
jmp 0x442dba
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, 0x4e1f68
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x53
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtApp.ini
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x54
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x55
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str.Main
push esi
call fcn.0042462c
push 3
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x56
mov ecx, esp
mov dword [esp + 0x40], esp
push str.AppVirtDll.dll
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x57
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x58
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 2
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x59
mov ecx, esp
mov dword [esp + 0x40], esp
push str.AppVirtDll64.dll
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x5a
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x5b
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 8
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x5c
mov ecx, esp
mov dword [esp + 0x40], esp
push str.StubExe.exe
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x5d
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x5e
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 9
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x5f
mov ecx, esp
mov dword [esp + 0x40], esp
push str.StubExe64.exe
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x60
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x61
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 0xa
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x62
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtFiles.db
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x63
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x64
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 4
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x65
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SandboxCfg.db
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x66
mov ecx, esp
lea eax, [esp + 0x68]
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x67
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 5
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x68
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtReg.export
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x69
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x6a
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 6
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x6b
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtReg.dat
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x6c
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x6d
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 0xb
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x6e
mov ecx, esp
mov dword [esp + 0x40], esp
push str.SysDllSubdirs.txt
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x6f
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x70
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push 7
pop ecx
lea edi, [esp + 0x394]
mov byte [esp + 0x34e8], 0x52
call fcn.0047cdd0
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x71
mov ecx, esp
mov dword [esp + 0x40], esp
push str.VirtFiles.vfc
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x72
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f0], 0x52
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e8], 0x73
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
mov byte [esp + 0x34e8], 0x52
xor ecx, ecx
inc ecx
lea edi, [esp + 0x394]
call fcn.0047cdd0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x60]
push 0x4f210c
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
push 0
jmp 0x442c34
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Unbreak:
call fcn.0042462c
call fcn.0044094a
mov ecx, esp
mov dword [esp + 0x14], esp
push str..break
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0x74
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x78]
push eax
mov byte [esp + 0x34ec], 4
call fcn.00466c90
add esp, 0xc
mov byte [esp + 0x34e0], 0x75
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x443e3d
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x78]
push str.Dir_doesnt_exist:__s
jmp 0x442dba
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.00424617
mov edi, str..old
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x184]
push eax
mov byte [esp + 0x34ec], 0x76
call fcn.0042487b
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x17c]
add ecx, 0xfffffff0
call fcn.0042201a
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x23c]
push eax
call fcn.0042487b
add esp, 0xc
push dword [eax]
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x234]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x443ed9
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_rename_myself_to_.old
jmp 0x442c29
push edi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x18c]
push eax
call fcn.0042487b
mov eax, dword [eax]
add esp, 0xc
push esi
push dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x184]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x443f2f
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_myself
jmp 0x442c29
push 1
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [esp + 0xf8], esi
push 0x4e1f68
lea ebx, [esp + 0xfc]
lea esi, [esp + 0x144]
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x77
mov ecx, esp
mov dword [esp + 0x24], esp
push str.VirtApp.ini
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x78
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f4], 0x76
call fcn.00466390
add esp, 0xc
mov edi, esi
call fcn.00467260
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x4445cb
xor edi, edi
cmp dword [esp + 0xec], edi
je 0x4445cb
push dword [esp + 0xec]
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x34]
push eax
call fcn.00466fc0
mov byte [esp + 0x34e8], 0x79
push dword [esp + 0x13c]
call fcn.004b2405
add esp, 0xc
push 1
push 1
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x308]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0x7a
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x308]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0x384], edi
jne 0x444066
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_begin_to_update_resource
jmp 0x442c29
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.0042462c
mov byte [esp + 0x34e4], 0x7b
mov eax, dword [esp + 0x34]
mov eax, dword [eax - 0xc]
add eax, eax
push edi
push eax
lea ecx, [esp + 0x3c]
call fcn.00424db4
push eax
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c290
cmp eax, edi
je 0x4440c5
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_update_INI_resource
jmp 0x442c29
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0
push 2
push ecx
mov byte [esp + 0x34f0], 0x7c
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov ebx, 0x4e1f68
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x7d
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppVirtDll.dll
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x7e
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x7c
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0
push 8
push ecx
mov byte [esp + 0x34f0], 0x7f
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x80
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.AppVirtDll64.dll
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x81
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x7f
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0
push 9
push ecx
mov byte [esp + 0x34f0], 0x82
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x83
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.StubExe.exe
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x84
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x82
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0
push 0xa
push ecx
mov byte [esp + 0x34f0], 0x85
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x86
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.StubExe64.exe
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x87
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x85
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0x4000
push 4
push ecx
mov byte [esp + 0x34f0], 0x88
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x89
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtFiles.db
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x8a
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x88
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0x4000
push 5
push ecx
mov byte [esp + 0x34f0], 0x8b
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x8c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.SandboxCfg.db
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x8d
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x8b
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
mov byte [esp + 0x34e4], 0x8e
push 0x4000
push 0xb
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x8f
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtReg.dat
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x90
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x8e
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0
push 7
push ecx
mov byte [esp + 0x34f0], 0x91
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x92
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.SysDllSubdirs.txt
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x93
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x91
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0x4000
push 1
push ecx
mov byte [esp + 0x34f0], 0x94
mov edi, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f8], 0x95
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.VirtFiles.vfc
call fcn.0042462c
push ecx
mov byte [esp + 0x34fc], 0x96
lea eax, [esp + 0x8c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
mov byte [esp + 0x34fc], 0x94
call fcn.00466390
add esp, 0xc
lea eax, [esp + 0x30c]
push eax
mov byte [esp + 0x34f4], 0x7a
call fcn.0047c5f0
lea eax, [esp + 0x2fc]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test eax, eax
je 0x4445bc
push str.Could_not_commit_resource
jmp 0x442c29
push str.Success
call fcn.0042462c
jmp 0x443da9
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_load_VirtApp.ini
jmp 0x442c29
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x444616
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push edi
call fcn.00438e89
pop ecx
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str._s_is_no_longer_integrated.
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
jmp 0x442c33
lea ecx, [esp + 0x24]
call fcn.0042248a
lea ecx, [esp + 0x30]
call fcn.0042248a
mov byte [esp + 0x34e0], 0xc0
mov edi, dword [esp + 0x20]
or dword [esp + 0x28], 0xffffffff
lea eax, [edi + 1]
cmp dword [esp + 0x50], eax
jle 0x444687
mov eax, dword [esp + 0x2c]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x28]
call fcn.00424685
lea eax, [edi + 2]
cmp dword [esp + 0x50], eax
jle 0x4446a0
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ecx, [esp + 0x34]
call fcn.00424685
lea ecx, [esp + 0x23c]
call fcn.0042248a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x34e4], 0xc1
call fcn.00424617
push ecx
mov byte [esp + 0x34e4], 0xc2
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x4446fd
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push 1
push esi
push ecx
lea eax, [esp + 0x60]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xe78]
push eax
call fcn.0047a9e0
lea edi, [esp + 0xe6c]
mov byte [esp + 0x34e0], 0xc3
call fcn.00429b89
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], esi
je 0x44475a
push esi
push 0x80
push 4
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x28], eax
push 1
push 1
push 1
lea eax, [esp + 0x248]
push eax
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x51ef58
call fcn.00424617
push ecx
mov byte [esp + 0x34fc], 0xc4
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51ef68
call fcn.00424617
push ecx
mov byte [esp + 0x3500], 0xc5
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x51ef64
call fcn.00424617
push ecx
mov byte [esp + 0x3504], 0xc6
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0x51ef5c
call fcn.00424617
push ecx
mov byte [esp + 0x3508], 0xc7
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x51ef0c
call fcn.00424617
mov byte [esp + 0x3508], 0xc3
call fcn.0043d02e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x28
call edi
push esi
push 2
mov dword [esp + 0x70], eax
push 0x51ef00
lea eax, [esp + 0xe78]
push eax
push dword [esp + 0x2c]
call fcn.00432324
add esp, 0x14
cmp eax, esi
je 0x44483c
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Failed_BasicDeploy_
jmp 0x442c29
call edi
sub eax, dword [esp + 0x68]
mov dword [esp + 0x68], eax
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], esi
je 0x4448f7
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0xc8
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4ebaec
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0xc9
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.0042462c
push 2
push ecx
mov byte [esp + 0x34fc], 0xca
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x98], esp
push eax
call fcn.00424617
lea eax, [esp + 0xe88]
push eax
mov byte [esp + 0x3500], 0xc3
call fcn.00435082
add esp, 0x20
push esi
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
call fcn.0046cf80
pop ecx
pop ecx
cmp eax, esi
jne 0x4448f7
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4448cd
call edi
push ecx
mov edi, eax
sub edi, dword [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x51ef58
call fcn.00424617
push ecx
mov byte [esp + 0x34e8], 0xcb
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x51ef68
call fcn.00424617
push ecx
mov byte [esp + 0x34ec], 0xcc
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x51ef5c
call fcn.00424617
push ecx
mov byte [esp + 0x34f0], 0xcd
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x51ef0c
call fcn.00424617
mov byte [esp + 0x34f0], 0xc3
call fcn.0043cc29
add esp, 0x10
lea ecx, [esp + 0x4c]
call fcn.0042248a
lea ecx, [esp + 0x18c]
mov eax, 0x100
push ecx
mov byte [esp + 0x34e4], 0xce
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x194], eax
call fcn.004224c6
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x50]
call fcn.0042493a
push edi
push dword [esp + 0x6c]
lea eax, [esp + 0x144]
push dword [esp + 0x54]
push dword [0x51ef0c]
push str._s__s__d_d_r_n
push eax
call fcn.00466ad0
add esp, 0x18
mov byte [esp + 0x34e0], 0xcf
push dword [esp + 0x13c]
lea ecx, [esp + 0x248]
call fcn.00425fc5
mov byte [esp + 0x34e0], 0xd0
mov edi, dword [esp + 0x28]
cmp edi, 0xffffffff
je 0x444a31
push 2
push esi
push esi
push edi
mov dword [esp + 0x1a4], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x244]
mov ecx, dword [eax - 0xc]
push esi
lea edx, [esp + 0x198]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x51b49c]
lea eax, [esp + 0x140]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
jmp 0x44463e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..Packager.log
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0xd1
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xd4]
push eax
mov byte [esp + 0x34ec], 4
call fcn.00466c90
add esp, 8
mov byte [esp + 0x34e4], 0xd2
lea eax, [esp + 0xd0]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00469bd0
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov dword [esp + 0x40], esi
call fcn.00424617
lea eax, [esp + 0x980]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xd3
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x980]
push eax
call fcn.00441232
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0xd4
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0xd5
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 0xd6
mov ecx, esp
mov dword [esp + 0x38], esp
lea eax, [esp + 0x34]
push eax
call fcn.00424617
lea eax, [esp + 0x990]
push eax
mov byte [esp + 0x3500], 0xd3
call fcn.00435082
add esp, 0x20
lea edi, [esp + 0x974]
call fcn.00429b89
mov ebx, eax
cmp ebx, esi
je 0x444bee
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00465c00
mov byte [esp + 0x34e8], 0xd7
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LogsPackager.log
call fcn.0042462c
push ebx
mov byte [esp + 0x34ec], 0xd3
call fcn.00427bc7
add esp, 0xc
cmp eax, esi
jne 0x444bdd
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_extract_Packager.log_
jmp 0x442c29
mov dword [esp + 0x30], 1
call fcn.0047f310
xor esi, esi
jmp 0x444c10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.Loader__ExtractLog_:_OpenVfc_failed__LE_d
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.0044091a
pop ecx
lea eax, [esp + 0x974]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xd4]
cmp dword [esp + 0x3c], esi
je 0x444c40
push str.Success:__s
jmp 0x444635
push str.Failed_saving__s
jmp 0x444635
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov ebx, 0x51ef00
push ebx
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x444c7e
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x7d0]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xd8
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x7d0]
push eax
call fcn.00441232
lea edi, [esp + 0x7d4]
call fcn.00429b89
push 1
push 2
push ebx
mov ecx, edi
push ecx
push eax
call fcn.00432324
mov edi, eax
add esp, 0x24
lea eax, [esp + 0x7c4]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
cmp edi, esi
jne 0x444d19
push dword [0x51ef5c]
push str.Success:_n_s
jmp 0x444635
push str.Failed_extracting.
push eax
call fcn.00466ad0
pop ecx
pop ecx
jmp 0x44463e
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov esi, 0x51ef00
push esi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x444d5f
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
lea eax, [esp + 0x24c]
push eax
call fcn.00491410
pop ecx
mov byte [esp + 0x34e0], 0xd9
push dword [eax]
lea ecx, [esp + 0x1a0]
call fcn.00425fc5
mov byte [esp + 0x34e0], 0xdb
mov ecx, dword [esp + 0x24c]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [esp + 0x19c]
mov edi, dword [eax - 0xc]
push eax
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov esi, str..xml
push esi
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0xdc
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00465b10
pop ecx
push ebx
mov byte [esp + 0x34f4], 0xdb
call fcn.00466c90
add esp, 0xc
call fcn.004674a0
pop ecx
pop ecx
push dword [0x51b49c]
push ecx
mov dword [esp + 0x18], esp
test eax, eax
je 0x444e6a
mov ecx, esp
push esi
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0xdd
mov eax, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00465b10
pop ecx
lea eax, [esp + 0x260]
push eax
mov byte [esp + 0x34f0], 0xdb
call fcn.00466c90
add esp, 8
mov byte [esp + 0x34e8], 0xde
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Success:_n_s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x254]
add ecx, 0xfffffff0
call fcn.0042201a
jmp 0x443db0
mov eax, esp
push str.Failed_extracting.
push eax
call fcn.00466ad0
pop ecx
pop ecx
jmp 0x443da9
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.00424617
mov byte [esp + 0x34e0], 0xdf
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x444eb2
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.00424685
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x12f8]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xe0
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x12f8]
push eax
call fcn.00441232
push esi
lea eax, [esp + 0x1300]
push eax
lea eax, [esp + 0x1bc]
push eax
call fcn.004412cb
add esp, 0x1c
push esi
push str.Info
push dword [esp + 0x1ac]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x442c33
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x444f66
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.00424617
mov byte [esp + 0x34e0], 0xe1
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x444f9a
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.00424685
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1028]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xe2
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1028]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0x10a4], esi
jne 0x44500c
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.FAILED_LOADING_CONTAINERS_
jmp 0x442c29
lea eax, [esp + 0x101c]
push eax
lea eax, [esp + 0x260]
push eax
call fcn.00441652
pop ecx
pop ecx
push esi
push str.Sandbox
push dword [esp + 0x264]
jmp 0x444f27
push str._GetProperty_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4f2998
call fcn.004b1c10
mov edx, dword [esp + 0x24]
pop ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x1b0]
call fcn.0042462c
push 1
push esi
push ecx
mov byte [esp + 0x34ec], 0xe3
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1388]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xe4
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1388]
push eax
call fcn.00441232
add esp, 0x10
lea ecx, [esp + 0x144]
call fcn.0042248a
lea eax, [esp + 0x2dc]
push eax
mov byte [esp + 0x34e4], 0xe5
call fcn.0042aff3
lea eax, [esp + 0x144]
push eax
push ecx
mov byte [esp + 0x34e8], 0xe6
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.0042462c
push 3
lea edi, [esp + 0x1388]
call fcn.0047cc30
mov ecx, dword [esp + 0x144]
mov eax, dword [ecx - 0xc]
cmp eax, esi
jne 0x445125
push 6
jmp 0x442c34
lea edx, [esp + 0x2dc]
push edx
push eax
push ecx
call fcn.0046e690
mov eax, dword [esp + 0x300]
mov eax, dword [eax]
add esp, 0xc
lea edi, [esp + 0x2dc]
lea esi, [esp + 0x98]
call fcn.0042b44a
mov eax, dword [esp + 0x2f4]
lea esi, [esp + 0xa8]
call fcn.0042b44a
mov edi, esi
lea esi, [esp + 0x98]
call fcn.0042b137
test al, al
je 0x442ec0
xor ebx, ebx
lea esi, [esp + 0x98]
call fcn.0043ee66
push dword [eax]
lea eax, [esp + 0x1b0]
call fcn.004246af
test eax, eax
jne 0x445208
call fcn.0043ee66
add eax, 4
push dword [eax]
lea ecx, [esp + 0x100]
call fcn.00425fc5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x4451f9
mov ecx, dword [esp + 0xfc]
push ebx
mov dword [esp + 0x150], ebx
mov edx, dword [ecx - 0xc]
lea esi, [esp + 0x150]
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4451f9
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0xfc]
cmp eax, dword [ecx - 0xc]
je 0x445249
mov ecx, dword [esp + 0xfc]
add ecx, 0xfffffff0
call fcn.0042201a
lea esi, [esp + 0x98]
call fcn.0042e04d
mov eax, dword [esp + 0x2f4]
lea edi, [esp + 0x2dc]
lea esi, [esp + 0xa8]
call fcn.0042b44a
mov edi, esi
lea esi, [esp + 0x98]
call fcn.0042b137
test al, al
jne 0x44517e
jmp 0x442ec0
push ebx
jmp 0x442c34
push str._ExportProperties_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x80]
call fcn.0042248a
push str._ExportProperties
mov byte [esp + 0x34e4], 0xe7
call fcn.004b1c10
mov edx, dword [esp + 0x24]
pop ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x84]
call fcn.00424685
lea eax, [esp + 0x80]
call fcn.00424772
push eax
lea ecx, [esp + 0x84]
call fcn.00424670
mov eax, dword [esp + 0x80]
cmp dword [eax - 0xc], esi
jne 0x445327
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..xml
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0xe8
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x274]
push eax
mov byte [esp + 0x34ec], 0xe7
call fcn.00466c90
add esp, 0xc
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x34e4], 0xe9
call fcn.00424670
mov byte [esp + 0x34e0], 0xe7
mov ecx, dword [esp + 0x26c]
add ecx, 0xfffffff0
call fcn.0042201a
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x8f0]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xea
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x8f0]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0x96c], esi
jne 0x445394
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x445002
sub esp, 0x90
mov eax, esp
mov dword [esp + 0xa0], esp
lea ecx, [esp + 0x974]
push ecx
push eax
call fcn.004496d9
push esi
push ecx
mov byte [esp + 0x3578], 0xeb
lea eax, [esp + 0xdc]
mov ecx, esp
mov dword [esp + 0xac], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x357c], 0xec
lea eax, [esp + 0x11c]
mov ecx, esp
mov dword [esp + 0xd0], esp
push eax
call fcn.00424617
mov byte [esp + 0x357c], 0xea
call fcn.0042a9c1
add esp, 0x9c
cmp eax, esi
jne 0x445425
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x88]
push str.Cannot_save_into:__s
jmp 0x442dba
lea eax, [esp + 0x8e4]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x88]
push str.Properties_exported_to:_n_s
jmp 0x444635
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.00424617
mov byte [esp + 0x34e0], 0xed
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x445483
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.00424685
push 1
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x6b0]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xee
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x6b0]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0x72c], esi
jne 0x4454f0
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x445002
push 1
lea eax, [esp + 0x6a8]
push eax
lea eax, [esp + 0x10c]
push eax
call fcn.004412cb
add esp, 0xc
push str._n_nSandboxing:_n_n
lea ecx, [esp + 0x108]
mov byte [esp + 0x34e4], 0xef
call fcn.0042ad26
lea eax, [esp + 0x6a4]
push eax
lea eax, [esp + 0x1b8]
push eax
call fcn.00441652
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x108]
mov byte [esp + 0x34e4], 0xf0
call fcn.0042469a
mov byte [esp + 0x34e0], 0xef
mov ecx, dword [esp + 0x1b4]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x104]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
add eax, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, str..txt
push ebx
mov dword [esp + 0x2c], eax
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0xf1
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00465b10
pop ecx
push edi
mov byte [esp + 0x34f4], 0xef
call fcn.00466c90
mov edi, dword [esp + 0x30]
add esp, 0xc
call fcn.004674a0
pop ecx
pop ecx
push esi
push str.Package_info
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0xf2
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00465b10
pop ecx
lea eax, [esp + 0x168]
push eax
mov byte [esp + 0x34f4], 0xef
call fcn.00466c90
add esp, 0xc
mov byte [esp + 0x34e8], 0xf3
push dword [eax]
lea eax, [esp + 0x280]
push str.Saved_in:__s
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x274]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x158]
add ecx, 0xfffffff0
call fcn.0042201a
jmp 0x442c33
lea ecx, [esp + 0x10]
call fcn.0042248a
lea ecx, [esp + 0x110]
call fcn.0042248a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x34e4], 0xf9
call fcn.00424617
mov byte [esp + 0x34e0], 0xfa
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x44569f
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x58]
call fcn.00424685
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str..ini
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0xfb
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x120]
push eax
mov byte [esp + 0x34ec], 0xfa
call fcn.00466c90
add esp, 8
mov byte [esp + 0x34e4], 0xfc
lea eax, [esp + 0x11c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
call fcn.00469bd0
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x60]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00424617
lea eax, [esp + 0xd58]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xfd
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00424617
lea eax, [esp + 0xd58]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0xdd4], esi
jne 0x44576f
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x445002
lea eax, [esp + 0x110]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.0042462c
push 3
lea edi, [esp + 0xd58]
call fcn.0047cc30
mov ecx, dword [esp + 0x110]
mov eax, dword [ecx - 0xc]
cmp eax, esi
jne 0x4457b6
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x442c7d
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
call fcn.004674a0
jmp 0x444643
push str.AppID_ShortDesc_FriendlyName_Category_DownloadUrl_IconUrl_Version_BuildUid_Size_PopularityIndex_n
lea ecx, [esp + 0x70]
call fcn.0042462c
lea ecx, [esp + 0x28]
mov dword [esp + 0x138], esi
mov dword [esp + 0x1d0], esi
call fcn.0042248a
push 1
push esi
push ecx
mov byte [esp + 0x34ec], 0xff
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x15d0]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x34ec], 0x100
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 1
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 2
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 3
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0x15e0]
push eax
mov byte [esp + 0x3500], 0
call fcn.00435082
mov esi, 0x4e7908
push esi
lea eax, [esp + 0x2a0]
push 0x51ef0c
push eax
call fcn.0042487b
add esp, 0x2c
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x34e4], 4
call fcn.0042469a
mov byte [esp + 0x34e0], 0
mov ecx, dword [esp + 0x27c]
add ecx, 0xfffffff0
call fcn.0042201a
push esi
lea ecx, [esp + 0x70]
call fcn.0042ad26
push esi
push 0x51ef18
lea eax, [esp + 0x28c]
push eax
call fcn.0042487b
add esp, 0xc
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x34e4], 5
call fcn.0042469a
mov byte [esp + 0x34e0], 0
mov ecx, dword [esp + 0x284]
add ecx, 0xfffffff0
call fcn.0042201a
push str.Productivity_
lea ecx, [esp + 0x70]
call fcn.0042ad26
mov ebx, dword [esp + 0x20]
lea eax, [ebx + 1]
cmp dword [esp + 0x50], eax
mov edi, 0x4f2c50
jle 0x445966
mov eax, dword [esp + 0x2c]
push dword [eax + ebx*4 + 4]
lea ebx, [esp + 0x70]
push edi
call fcn.0042754a
mov ebx, dword [esp + 0x28]
pop ecx
pop ecx
jmp 0x445974
push str._Download_URL_here__
lea ecx, [esp + 0x70]
call fcn.0042ad26
lea eax, [ebx + 2]
cmp dword [esp + 0x50], eax
jle 0x445992
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ebx, [esp + 0x70]
push edi
call fcn.0042754a
pop ecx
pop ecx
jmp 0x4459a0
push str._Icon_here__
lea ecx, [esp + 0x70]
call fcn.0042ad26
push esi
lea eax, [esp + 0x1cc]
push 0x51ef20
push eax
call fcn.0042487b
add esp, 0xc
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x34e4], 6
call fcn.0042469a
mov byte [esp + 0x34e0], 0
mov ecx, dword [esp + 0x1c8]
add ecx, 0xfffffff0
call fcn.0042201a
push esi
lea eax, [esp + 0x234]
push 0x51ef50
push eax
call fcn.0042487b
add esp, 0xc
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x34e4], 7
call fcn.0042469a
mov byte [esp + 0x34e0], 0
mov ecx, dword [esp + 0x230]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
lea edi, [esp + 0x1d8]
lea esi, [esp + 0x140]
call fcn.00465b10
pop ecx
call fcn.00469ad0
pop ecx
push dword [esp + 0x138]
lea eax, [esp + 0x1dc]
push 0x4e4b18
push eax
call fcn.00466ad0
add esp, 0xc
push 0x4e7908
push eax
lea eax, [esp + 0x268]
push eax
mov byte [esp + 0x34ec], 8
call fcn.0042487b
add esp, 0xc
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x34e4], 9
call fcn.0042469a
mov ecx, dword [esp + 0x260]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [esp + 0x34e0], 0
mov ecx, dword [esp + 0x1d8]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x4e58bc
lea ecx, [esp + 0x70]
call fcn.0042ad26
mov eax, dword [esp + 0x20]
add eax, 3
cmp dword [esp + 0x50], eax
jle 0x445adf
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4]
lea ecx, [esp + 0x2c]
call fcn.00424685
jmp 0x445b47
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..csv
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0xa
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00465b10
pop ecx
lea eax, [esp + 0x240]
push eax
mov byte [esp + 0x34ec], 0
call fcn.00466c90
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x34e4], 0xb
call fcn.00424670
mov byte [esp + 0x34e0], 0
mov ecx, dword [esp + 0x238]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
lea edi, [eax + eax]
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
call fcn.004674a0
pop ecx
pop ecx
push dword [0x51b49c]
push ecx
mov dword [esp + 0x18], esp
test eax, eax
jne 0x445b90
mov eax, esp
lea ecx, [esp + 0x30]
push ecx
push str.Could_not_save_to
push eax
call fcn.004248d0
jmp 0x442dc0
mov ecx, esp
lea eax, [esp + 0x30]
push eax
call fcn.00424617
jmp 0x443da9
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x10b8]
push eax
call fcn.0047a9e0
mov dword [esp + 0x34e0], 0x10c
cmp dword [esp + 0x1134], esi
jne 0x445be8
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x443782
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef0c]
push str._s.AppVirtDll.dll
push eax
call fcn.00466ad0
lea eax, [esp + 0x11c]
add esp, 0xc
push eax
call fcn.004661a0
add esp, 4
mov byte [esp + 0x34e4], 0xd
lea eax, [esp + 0x110]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34e8], 0xe
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Main
call fcn.0042462c
push 2
pop ecx
lea edi, [esp + 0x10b4]
mov byte [esp + 0x34e8], 0xd
call fcn.0047cdd0
push dword [0x51b49c]
lea eax, [esp + 0x110]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1e8]
push eax
call fcn.00486f30
add esp, 4
mov byte [esp + 0x34e8], 0xf
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov byte [esp + 0x34e0], 0xd
mov ecx, dword [esp + 0x1e0]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
lea eax, [esp + 0x110]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00469bd0
jmp 0x444644
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
call fcn.00424617
push 0x2e
lea ecx, [esp + 0x2c]
mov dword [esp + 0x34e4], 0x110
call fcn.0043a573
push eax
lea eax, [esp + 0x268]
push eax
lea ecx, [esp + 0x30]
call fcn.0042481b
push str..new.exe
push eax
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x34ec], 0x11
call fcn.0042487b
add esp, 0xc
mov byte [esp + 0x34e0], 0x13
mov ecx, dword [esp + 0x264]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x1ec]
call fcn.0042462c
push esi
mov byte [esp + 0x34e4], 0x14
push dword [esp + 0x94]
push dword [esp + 0x1f0]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x445db1
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x98]
push dword [esp + 0x34]
push str.Cant_copy__s_to__s
push eax
call fcn.00466ad0
add esp, 0x10
jmp 0x442c2e
push dword [esp + 0x90]
push dword [esp + 0x2c]
call fcn.0043a794
pop ecx
pop ecx
xor esi, esi
inc esi
push esi
push 0
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x500]
push eax
call fcn.0047a9e0
push esi
push esi
push ecx
mov byte [esp + 0x34ec], 0x15
lea eax, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1268]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0x16
push dword [0x51b49c]
lea eax, [esp + 0x48]
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x500]
push eax
call fcn.00441232
add esp, 0x10
lea eax, [esp + 0x34]
lea ecx, [esp + 0x564]
call fcn.004498ac
jmp 0x445f69
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CEChangeEngine.tmp
call fcn.0042462c
lea eax, [esp + 0xa4]
push eax
call fcn.004661a0
add esp, 4
mov byte [esp + 0x34e4], 0x17
lea eax, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
lea esi, [esp + 0x38]
mov byte [esp + 0x34e4], 0x18
call fcn.00449965
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
call fcn.00449965
mov byte [esp + 0x34e8], 0x17
mov ecx, dword [eax + 0x28]
lea edi, [esp + 0x4fc]
call fcn.0047cdd0
test eax, eax
jne 0x445fc5
call fcn.00449965
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x4000
mov byte [esp + 0x34e8], 0x19
call fcn.00449965
push dword [eax + 0x28]
lea eax, [esp + 0xac]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00424617
lea eax, [esp + 0x126c]
push eax
mov byte [esp + 0x34f4], 0x17
call fcn.0047c5f0
test eax, eax
jne 0x445ff1
push ecx
lea eax, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00469bd0
pop ecx
mov byte [esp + 0x34e0], 0x16
mov ecx, dword [esp + 0xa0]
add ecx, 0xfffffff0
call fcn.0042201a
call fcn.0044998d
lea eax, [esp + 0x2c0]
lea ecx, [esp + 0x564]
call fcn.004498c1
mov edi, eax
lea esi, [esp + 0x34]
call fcn.004499b8
test al, al
jne 0x445e57
lea eax, [esp + 0x4f4]
call fcn.0047b8c0
lea eax, [esp + 0x125c]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x98]
push str.Successfully_changed_Loader:__s
jmp 0x443da0
push dword [0x51b49c]
call fcn.00449965
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x40]
call fcn.00449965
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x445da4
push dword [0x51b49c]
lea esi, [esp + 0x38]
call fcn.00449965
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push dword [eax + 0x2c]
jmp 0x445fde
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00424617
push 0x2e
lea ecx, [esp + 0x28]
mov dword [esp + 0x34e4], 0x11a
call fcn.0043a573
push eax
lea eax, [esp + 0x244]
push eax
lea ecx, [esp + 0x2c]
call fcn.0042481b
push str..new.exe
push eax
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x34ec], 0x1b
call fcn.0042487b
add esp, 0xc
mov byte [esp + 0x34e0], 0x1d
mov ecx, dword [esp + 0x240]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0xa8]
call fcn.0042462c
push esi
mov byte [esp + 0x34e4], 0x1e
push dword [esp + 0xc0]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4460ca
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc4]
push dword [esp + 0x30]
jmp 0x445d9e
push 1
push 1
push ecx
lea eax, [esp + 0xc8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x470]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0x1f
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x470]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0x4ec], esi
jne 0x446140
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_open_PeContainer
jmp 0x442c29
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov esi, str.Main
push esi
call fcn.0042462c
push 0
push 2
push ecx
mov byte [esp + 0x34f0], 0x20
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00424617
lea eax, [esp + 0x474]
push eax
mov byte [esp + 0x34f4], 0x1f
call fcn.0047c5f0
test eax, eax
je 0x4461a2
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x442c29
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0
push 8
push ecx
mov byte [esp + 0x34f0], 0x21
mov dword [esp + 0x24], esp
mov edi, esp
push ecx
lea eax, [esp + 0xb8]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00424617
push edi
call fcn.00473fd0
pop ecx
pop ecx
lea eax, [esp + 0x474]
push eax
mov byte [esp + 0x34f4], 0x1f
call fcn.0047c5f0
test eax, eax
je 0x44620e
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x442c29
lea ecx, [esp + 0x120]
call fcn.0042248a
lea ecx, [esp + 0x148]
call fcn.0042248a
lea eax, [esp + 0x120]
push eax
push ecx
mov byte [esp + 0x34e8], 0x23
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0042462c
push 3
lea edi, [esp + 0x470]
call fcn.0047cc30
test eax, eax
je 0x44626c
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x442c29
push ecx
mov edi, esp
mov dword [esp + 0x14], esp
push ecx
lea eax, [esp + 0xac]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
lea ebx, [esp + 0x154]
call fcn.00424617
push edi
call fcn.00486f30
add esp, 4
mov byte [esp + 0x34e8], 0x24
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.EngineVersion
call fcn.0042462c
push ecx
mov byte [esp + 0x34ec], 0x25
lea eax, [esp + 0x12c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00424617
mov byte [esp + 0x34ec], 0x23
call fcn.0046b1c0
pop ecx
pop ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.0042462c
push 0x4000
push 3
pop esi
push ecx
mov byte [esp + 0x34ec], 0x26
mov eax, ebx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00424617
mov ecx, esi
lea ebx, [esp + 0x470]
mov byte [esp + 0x34ec], 0x23
call fcn.0047c3d0
test eax, eax
je 0x446336
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x442c29
lea eax, [esp + 0x464]
call fcn.0047b8c0
push dword [0x51b49c]
lea eax, [esp + 0xa8]
push ecx
mov dword [esp + 0x18], esp
mov esi, esp
push dword [esp + 0xc4]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00424617
lea eax, [esp + 0x200]
push eax
call fcn.00486f30
pop ecx
pop ecx
mov byte [esp + 0x34ec], 0x27
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00466ad0
add esp, 0x10
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x1f0]
jmp 0x444e5d
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00424617
push 0x2e
lea ecx, [esp + 0x28]
mov dword [esp + 0x34e4], 0x128
call fcn.0043a573
push eax
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x2c]
call fcn.0042481b
push str..new.exe
push eax
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x34ec], 0x29
call fcn.0042487b
add esp, 0xc
mov byte [esp + 0x34e0], 0x2b
mov ecx, dword [esp + 0x288]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x1fc]
call fcn.0042462c
push esi
mov byte [esp + 0x34e4], 0x2c
push dword [esp + 0xbc]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x446462
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc0]
push dword [esp + 0x30]
jmp 0x445d9e
push 1
push 1
push ecx
lea eax, [esp + 0xc4]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x740]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0x2d
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x740]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0x7bc], esi
jne 0x4464d3
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x446136
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Main
call fcn.0042462c
push esi
push 3
push ecx
mov byte [esp + 0x34f0], 0x2e
lea eax, [esp + 0x208]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00424617
lea eax, [esp + 0x744]
push eax
mov byte [esp + 0x34f4], 0x2d
call fcn.0047c5f0
cmp eax, esi
je 0x446533
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEINI
jmp 0x442c29
lea eax, [esp + 0x734]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xc0]
push str.Successfully_changed_INI._nNew_package_saved_in:_n_s
jmp 0x444635
lea esi, [esp + 0xa94]
call fcn.00431417
mov dword [esp + 0x34e0], 0x12f
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x20]
push dword [edi + esi*4 + 4]
lea ecx, [esp + 0xae0]
call fcn.00424685
push dword [edi + esi*4 + 8]
lea ecx, [esp + 0xab8]
call fcn.00424685
push dword [edi + esi*4 + 0xc]
lea ecx, [esp + 0xab0]
call fcn.00424685
push eax
lea ecx, [esp + 0xaa4]
call fcn.00424670
push dword [edi + esi*4 + 0x10]
lea ecx, [esp + 0xae8]
call fcn.00424685
push dword [edi + esi*4 + 0x14]
lea ecx, [esp + 0xae4]
call fcn.00424685
lea eax, [esp + 0x140c]
push eax
lea edi, [esp + 0xa98]
call fcn.00490000
lea eax, [esp + 0x140c]
push eax
mov byte [esp + 0x34e4], 0x30
call fcn.004901a0
test eax, eax
je 0x446651
xor esi, esi
mov eax, 0x4f3140
cmp dword [esp + 0x140c], esi
jne 0x44661b
mov eax, 0x4f3148
push dword [esp + 0x1418]
push dword [esp + 0x1418]
push eax
lea eax, [esp + 0x254]
push str.Need_to_update:__s_nVersion:__s_nBuildUID:__s_n
push eax
call fcn.00466ad0
add esp, 0x14
push esi
push str.Server_test:
push dword [esp + 0x250]
jmp 0x444f27
push 0
push str.Server_test:
push str.Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
jmp 0x442c34
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x4466a0
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push esi
mov ecx, edi
call fcn.00436f66
jmp 0x442dde
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x620]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x34ec], 0x131
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x32
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x33
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 0x34
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0x630]
push eax
mov byte [esp + 0x3500], 0x31
call fcn.00435082
add esp, 0x20
lea ecx, [esp + 0x614]
call fcn.0043440f
lea eax, [esp + 0x614]
call fcn.0047b8c0
mov dword [esp + 0x34e0], 4
lea eax, [esp + 0x614]
jmp 0x44368a
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xf98]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x34ec], 0x135
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x36
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x37
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 0x38
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0xfa8]
push eax
mov byte [esp + 0x3500], 0x35
call fcn.00435082
add esp, 0x20
push esi
push esi
push esi
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
xor ecx, ecx
call fcn.00477db0
pop ecx
mov ecx, esi
call fcn.0048e690
add esp, 0x10
lea eax, [esp + 0xf8c]
call fcn.0047b8c0
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x446878
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Cannot_obtain_INI_info_from_resource_
call fcn.0042462c
call fcn.0044091a
pop ecx
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str.MountVirtReg
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.0044091a
mov eax, esp
mov dword [esp + 0x14], esp
push str._____________
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.0044091a
pop ecx
mov ecx, edi
call fcn.0042a78d
mov edi, eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
cmp edi, esi
jne 0x4468cf
push str.Cannot_mount_virtual_registry
call fcn.0042462c
call fcn.0044091a
jmp 0x4468dc
push ebx
call fcn.0042462c
push edi
call fcn.0044173f
pop ecx
pop ecx
mov dword [esp + 0x34e0], 4
lea eax, [esp + 0xf8c]
jmp 0x44368a
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
push dword [eax + edi*4 + 4]
lea ecx, [esp + 0x12c]
call fcn.0042462c
mov dword [esp + 0x34e0], 0x139
mov eax, dword [esp + 0x2c]
push dword [eax + edi*4 + 8]
lea ecx, [esp + 0x90]
call fcn.0042462c
push 0x10
mov byte [esp + 0x34e4], 0x3a
push esi
push dword [esp + 0x130]
call fcn.004b5c0e
add esp, 8
mov edi, eax
mov eax, esp
mov dword [esp + 0x14], esp
push dword [esp + 0x90]
push edi
push str.SetFileFlags:__0x_x____s_
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.0044091a
pop ecx
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xc38]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0x3b
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xc38]
push eax
call fcn.00441232
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x3c
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x3d
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 0x3e
mov ecx, esp
lea eax, [esp + 0x34]
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0xc48]
push eax
mov byte [esp + 0x3500], 0x3b
call fcn.00435082
call fcn.00471c10
mov ebx, 0x51e76c
mov eax, ebx
call fcn.004856c0
mov eax, dword [esp + 0xac]
push esi
call fcn.004722c0
add esp, 0x24
push ecx
mov dword [esp + 0x14], esp
cmp eax, esi
je 0x446ab2
mov eax, dword [eax + 0x24]
mov dword [eax], edi
mov ecx, esp
push dword [0x51e76c]
call fcn.0042462c
mov ecx, ebx
call fcn.004721f0
pop ecx
cmp eax, esi
je 0x446a9c
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x94]
push edi
push str.Success:_n__x___s
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.004411b8
pop ecx
jmp 0x446ace
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str._SetFileFlags:_could_not_save_tree
push eax
call fcn.00466ad0
pop ecx
pop ecx
jmp 0x446ac9
mov eax, esp
push dword [esp + 0x90]
push str._SetFileFlags:_could_not_find__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0044091a
pop ecx
mov eax, ebx
call fcn.004856d0
lea eax, [esp + 0xc2c]
mov byte [esp + 0x34e0], 0x3a
call fcn.004276f3
mov ecx, dword [esp + 0x8c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x128]
jmp 0x449647
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.DbgZip
call fcn.0042462c
call fcn.0044094a
mov dword [esp], str._DbgZip:
call fcn.004b1cba
mov edx, dword [esp + 0x24]
pop ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + edx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x60]
call fcn.00424685
jmp 0x442b18
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xa10]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
push esi
push ecx
mov dword [esp + 0x34ec], 0x13f
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x40
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x41
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.0042462c
push 2
push ecx
mov byte [esp + 0x34fc], 0x42
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0xa20]
push eax
mov byte [esp + 0x3500], 0x3f
call fcn.00435082
add esp, 0x20
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xa10]
push eax
call fcn.00441232
push dword [esp + 0x5c]
lea edx, [esp + 0xa18]
mov ecx, 0x51ef00
call fcn.00438d04
add esp, 0x14
mov dword [esp + 0x34e0], 4
lea eax, [esp + 0xa04]
jmp 0x44368a
push 1
xor edi, edi
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1148]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
push edi
push ecx
mov dword [esp + 0x34ec], 0x149
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x4a
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x4b
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 0x4c
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1158]
push eax
mov byte [esp + 0x3500], 0x49
call fcn.00435082
add esp, 0x20
lea esi, [esp + 0xa8]
call fcn.00483490
mov byte [esp + 0x34e0], 0x4d
mov dword [esp + 0x30], edi
jmp 0x446d85
push dword [0x51ef0c]
lea eax, [esp + 0x28a8]
push eax
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x446d85
mov dword [esp + 0x24], edi
cmp dword [esp + 0x24a0], edi
jbe 0x446d85
mov ebx, dword [esp + 0x24]
shl ebx, 3
lea esi, [esp + ebx + 0x24a4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x446d74
test byte [esp + ebx + 0x24a8], 3
je 0x446d74
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x51ef5c
call fcn.00424617
push ecx
mov byte [esp + 0x34e8], 0x4e
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x51ef0c
call fcn.00424617
mov byte [esp + 0x34e8], 0x4d
mov ebx, dword [esi]
call fcn.0043caeb
pop ecx
pop ecx
xor edi, edi
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x24a0]
jb 0x446d15
push 1
lea eax, [esp + 0x2080]
push eax
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x3c]
call fcn.004831b0
test eax, eax
jne 0x446cef
push edi
push edi
push edi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [esp + 0xa8]
call fcn.004834b0
lea eax, [esp + 0x113c]
mov dword [esp + 0x34e0], 4
call fcn.004276f3
xor esi, esi
jmp 0x442ddf
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1540]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
mov dword [esp + 0x34e4], 0x14f
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x50
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Vintegrate_
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x51
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push esi
push ecx
mov byte [esp + 0x34fc], 0x52
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1550]
push eax
mov byte [esp + 0x3500], 0x4f
call fcn.00435082
add esp, 0x20
call fcn.004410ec
jmp 0x442c33
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push str._ProcessList:all
push dword [eax + ecx*4]
call fcn.004b19fe
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
lea esi, [esp + 0xa8]
inc edi
call fcn.00483490
mov dword [esp + 0x34e0], 0x153
and dword [esp + 0x24], 0
lea ecx, [esp + 0x48]
call fcn.0042248a
xor eax, eax
test edi, edi
sete al
mov byte [esp + 0x34e0], 0x54
mov dword [esp + 0x30], eax
jmp 0x4471a7
lea eax, [esp + 0x1e7c]
push eax
lea eax, [esp + 0x204]
push str._AppID_ws_n
push eax
call fcn.00466ad0
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34e4], 0x55
call fcn.0042469a
mov byte [esp + 0x34e0], 0x54
mov ecx, dword [esp + 0x200]
add ecx, 0xfffffff0
call fcn.0042201a
push dword [esp + 0x1658]
lea eax, [esp + 0x274]
push str.____SerialId:__d_n
push eax
call fcn.00466ad0
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34e4], 0x56
call fcn.0042469a
mov byte [esp + 0x34e0], 0x54
mov ecx, dword [esp + 0x270]
add ecx, 0xfffffff0
call fcn.0042201a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1a70]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x20c]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00466ad0
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34e4], 0x57
call fcn.0042469a
mov byte [esp + 0x34e0], 0x54
mov ecx, dword [esp + 0x208]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [esp + 0x1a74]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x254]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00466ad0
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34e4], 0x58
call fcn.0042469a
mov byte [esp + 0x34e0], 0x54
mov ecx, dword [esp + 0x250]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [esp + 0x210]
push str.____Processes:_n
push eax
call fcn.00466ad0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34e4], 0x59
call fcn.0042469a
mov byte [esp + 0x34e0], 0x54
mov ecx, dword [esp + 0x210]
add ecx, 0xfffffff0
call fcn.0042201a
and dword [esp + 0x54], 0
cmp dword [esp + 0x1a78], 0
jbe 0x4471a7
push ebx
lea ecx, [esp + 0xc4]
call fcn.0042462c
mov byte [esp + 0x34e0], 0x5a
mov edi, dword [esp + 0x54]
lea edi, [esp + edi*8 + 0x1a7c]
push dword [edi]
lea esi, [esp + 0xc4]
call fcn.00465350
pop ecx
test eax, eax
jne 0x4470a3
push 0x4e6418
mov ecx, esi
call fcn.00424685
push 0x5c
push ecx
lea eax, [esp + 0xc8]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
lea eax, [esp + 0x220]
push eax
call fcn.00466e00
add esp, 0xc
mov byte [esp + 0x34e0], 0x5b
push dword [eax]
lea eax, [esp + 0x284]
push dword [edi]
push str._______wd:__ws
push eax
call fcn.00466ad0
add esp, 0x10
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34e4], 0x5c
call fcn.0042469a
mov ecx, dword [esp + 0x280]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [esp + 0x34e0], 0x5a
mov ecx, dword [esp + 0x218]
add ecx, 0xfffffff0
call fcn.0042201a
mov esi, dword [esp + 0x54]
mov eax, dword [esp + esi*8 + 0x1a80]
test eax, eax
je 0x447170
push eax
lea eax, [esp + 0x25c]
push str._0x_x_
push eax
call fcn.00466ad0
add esp, 0xc
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34e4], 0x5d
call fcn.0042469a
mov byte [esp + 0x34e0], 0x5a
mov ecx, dword [esp + 0x258]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x4e248c
lea ecx, [esp + 0x4c]
call fcn.0042ad26
mov byte [esp + 0x34e0], 0x54
mov ecx, dword [esp + 0xc0]
add ecx, 0xfffffff0
call fcn.0042201a
inc esi
mov dword [esp + 0x54], esi
cmp esi, dword [esp + 0x1a78]
jb 0x447064
push dword [esp + 0x30]
lea eax, [esp + 0x1658]
push eax
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x30]
call fcn.004831b0
test eax, eax
jne 0x446ee8
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
cmp dword [esp + 0x2c], eax
jne 0x4471f5
push str.No_active_virtual_apps
call fcn.0042462c
call fcn.004411b8
pop ecx
pop ecx
jmp 0x446665
lea eax, [esp + 0x50]
jmp 0x445b96
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x447231
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
lea esi, [esp + 0xa8]
call fcn.00483490
mov dword [esp + 0x34e0], 0x15e
and dword [esp + 0x30], 0
jmp 0x447268
push dword [0x51ef0c]
lea eax, [esp + 0x32d0]
push eax
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447298
push 1
lea eax, [esp + 0x2aa8]
push eax
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x3c]
call fcn.004831b0
test eax, eax
jne 0x44724f
lea eax, [esp + 0xa8]
call fcn.004834b0
jmp 0x443db0
push 0x2bc
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0xa8]
mov dword [esp + 0x34e0], 4
call fcn.004834b0
jmp 0x447231
lea eax, [esp + 0x220]
push eax
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x44]
call fcn.0042f900
lea eax, [esp + 0x220]
push eax
call fcn.0042fa3d
jmp 0x442c33
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AutoUpdate
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x44732e
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef48]
push str.AutoUpdate_s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0044094a
mov ecx, 0x51ef48
mov dword [esp], str.https:__online.cameyo.com
call fcn.00424685
push str.0000
mov ecx, 0x51ef4c
call fcn.00424685
mov ecx, edi
call fcn.00491e10
jmp 0x442ddf
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.VirtRegSyncExport
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x4473c2
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
call fcn.0043de0e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00466ad0
add esp, 0xc
jmp 0x442dd9
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StartStreaming:AppIDSkype
call fcn.0042462c
call fcn.004273ff
pop ecx
jmp 0x442dde
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x447433
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.open
xor ebx, ebx
call fcn.0042462c
push esi
push ecx
mov dword [esp + 0x34ec], 0x161
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x51ef5c]
xor edi, edi
push str._select___s_
push eax
call fcn.00466ad0
add esp, 8
mov byte [esp + 0x34f0], 0x62
mov ecx, esp
mov dword [esp + 0x44], esp
push str.explorer.exe
call fcn.0042462c
mov dword [esp + 0x34f0], 4
call fcn.00465570
add esp, 0x10
jmp 0x446dd9
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegister
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x4474e8
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
mov ecx, edi
call fcn.0042a78d
mov ebx, eax
cmp ebx, esi
jne 0x44750c
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Cannot_mount_virtual_registry
jmp 0x442c29
call fcn.00471c10
push dword [0x51b49c]
push ebx
push edi
call fcn.004239e3
add esp, 0xc
push dword [0x51b49c]
mov edi, eax
cmp edi, esi
jne 0x44753b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Success
jmp 0x44754c
cmp edi, 5
jne 0x44755a
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_register
call fcn.0042462c
call fcn.004411b8
pop ecx
pop ecx
jmp 0x4475a2
lea eax, [esp + 0x27c]
push edi
push eax
call fcn.0046d880
add esp, 4
mov dword [esp + 0x34e8], 0x163
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_registering_services:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x278]
add ecx, 0xfffffff0
call fcn.0042201a
push edi
jmp 0x442c34
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStart
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x4475f1
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
mov ecx, edi
call fcn.00424235
push dword [0x51b49c]
mov edi, eax
cmp edi, esi
je 0x44752d
cmp edi, 5
jne 0x44761e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_start
jmp 0x44754c
lea eax, [esp + 0x22c]
push edi
push eax
call fcn.0046d880
add esp, 4
mov dword [esp + 0x34e8], 0x164
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_starting_services:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x228]
jmp 0x44759a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRegisterStart
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x4476ac
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
mov ecx, edi
call fcn.0042a78d
mov ebx, eax
cmp ebx, esi
jne 0x4476cb
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x447502
call fcn.00471c10
push dword [0x51b49c]
push ebx
push edi
call fcn.004239e3
add esp, 0xc
mov ebx, str.Failed_registering_services:__s
cmp eax, 5
jne 0x44770a
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_register
call fcn.0042462c
call fcn.004411b8
pop ecx
pop ecx
jmp 0x447763
cmp eax, esi
je 0x447763
push dword [0x51b49c]
push eax
lea eax, [esp + 0x1c8]
push eax
call fcn.0046d880
add esp, 4
mov dword [esp + 0x34e8], 0x165
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push ebx
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov dword [esp + 0x34e0], 4
mov ecx, dword [esp + 0x1c0]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, edi
call fcn.00424235
push dword [0x51b49c]
mov edi, eax
cmp edi, esi
je 0x44752d
cmp edi, 5
je 0x447540
lea eax, [esp + 0x1c8]
push edi
push eax
call fcn.0046d880
add esp, 4
mov dword [esp + 0x34e8], 0x166
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push ebx
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c4]
jmp 0x44759a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcStop
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x44780d
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push esi
mov ecx, edi
call fcn.00423dd5
mov edi, eax
pop ecx
push dword [0x51b49c]
cmp edi, esi
je 0x44752d
cmp edi, 5
jne 0x44783c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_stop
jmp 0x44754c
lea eax, [esp + 0x1d0]
push edi
push eax
call fcn.0046d880
add esp, 4
mov dword [esp + 0x34e8], 0x167
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_stopping_services:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x1cc]
jmp 0x44759a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.SvcRemove
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x4478ca
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push 1
mov ecx, edi
call fcn.00423dd5
mov edi, eax
pop ecx
push dword [0x51b49c]
cmp edi, esi
je 0x44752d
cmp edi, 5
jne 0x4478fa
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_services_to_remove
jmp 0x44754c
lea eax, [esp + 0x1d8]
push edi
push eax
call fcn.0046d880
add esp, 4
mov dword [esp + 0x34e8], 0x168
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed_removing_services:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x1d4]
jmp 0x44759a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.RepoSync
call fcn.0042462c
call fcn.0044094a
mov eax, dword [esp + 0x30]
pop ecx
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4 + 4]
lea ecx, [esp + 0x134]
call fcn.0042462c
lea eax, [esp + 0x44c]
push eax
mov dword [esp + 0x34e4], 0x169
call fcn.0042499a
lea eax, [esp + 0x41c]
push eax
mov byte [esp + 0x34e4], 0x6a
call fcn.0042499a
lea eax, [esp + 0x434]
push eax
mov byte [esp + 0x34e4], 0x6b
call fcn.0042499a
push esi
lea eax, [esp + 0x438]
push eax
lea eax, [esp + 0x424]
push eax
lea eax, [esp + 0x458]
push eax
push ecx
mov byte [esp + 0x34f4], 0x6c
lea eax, [esp + 0x144]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34f8], 0x6d
lea eax, [esp + 0x148]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34f8], 0x6c
call fcn.00439023
add esp, 0x18
push eax
jmp 0x442c34
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.MergeRegistry
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov edi, 0x51ef00
push edi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x447a60
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push edi
call fcn.0043a320
pop ecx
mov edi, eax
lea eax, [esp + 0x1dc]
push edi
push eax
call fcn.0046d880
add esp, 4
mov ecx, esp
mov dword [esp + 0x34e4], 0x16e
mov dword [esp + 0x14], esp
push dword [eax]
push edi
push str.Loader_MergeRegistry___d__s_
push ecx
call fcn.00466ad0
add esp, 0x10
call fcn.0044091a
pop ecx
mov dword [esp + 0x34e0], 4
mov ecx, dword [esp + 0x1dc]
add ecx, 0xfffffff0
call fcn.0042201a
push dword [0x51b49c]
cmp edi, esi
je 0x44752d
lea eax, [esp + 0x1e8]
push edi
push eax
call fcn.0046d880
add esp, 4
mov dword [esp + 0x34e8], 0x16f
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Failed:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x1e4]
jmp 0x44759a
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Cameyo.exe__UpgradePkg_
call fcn.0042462c
call fcn.0044094a
pop ecx
lea ecx, [esp + 0xd4]
call fcn.0042248a
mov byte [esp + 0x34e0], 0x72
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push dword [eax + ecx*4]
lea ecx, [esp + 0xf4]
call fcn.0042462c
push ecx
mov byte [esp + 0x34e4], 0x73
lea eax, [esp + 0xf4]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00469180
pop ecx
cmp eax, esi
jne 0x447b95
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xf8]
push str._s_not_found
jmp 0x442dba
push esi
lea eax, [esp + 0xd8]
push eax
push ecx
lea eax, [esp + 0xfc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34f0], 0x74
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00465b10
pop ecx
mov byte [esp + 0x34f0], 0x73
call fcn.0043e125
add esp, 0x10
push dword [0x51b49c]
cmp eax, esi
jne 0x447bfa
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xdc]
push 0x4f210c
jmp 0x444635
push eax
lea eax, [esp + 0x2e0]
push eax
call fcn.0046d880
add esp, 4
mov byte [esp + 0x34e8], 0x75
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xdc]
push dword [eax]
push str._s:__s
push ecx
jmp 0x445da4
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.AuthCheck
call fcn.0042462c
call fcn.0044094a
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
mov esi, 0x51ef00
push esi
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x447c76
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
call fcn.004312cb
mov dword [esp + 0x1c], eax
test eax, eax
je 0x447d24
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push str._AuthCheck:Force
push dword [eax + ecx*4]
call fcn.004b19fe
and dword [esp + 0x1f4], 0
add esp, 4
mov dword [esp + 0x14], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.AuthToken.dat
lea edi, [esp + 0x1f8]
call fcn.0042462c
push ebx
xor ecx, ecx
call fcn.004779d0
mov edx, dword [esp + 0x28]
pop ecx
pop ecx
mov ecx, esi
call fcn.00430b58
push dword [0x51b49c]
mov esi, eax
push ecx
mov dword [esp + 0x18], esp
test esi, esi
je 0x447cf9
mov ecx, esp
push str.Allowed_to_run_this_package
call fcn.0042462c
jmp 0x447d0e
mov eax, esp
push 0x51efdc
push str.Denied:_n
push eax
call fcn.004248d0
add esp, 0xc
call fcn.004411b8
neg esi
sbb esi, esi
pop ecx
and esi, 0xffffffef
pop ecx
add esi, 0x11
jmp 0x442c33
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.No_authentication_server_specified_in_this_package
jmp 0x442c29
push str.Vintegrate:
lea ecx, [esp + 0x104]
call fcn.0042462c
mov dword [esp + 0x34e0], 0x143
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
lea edi, [eax + ecx*4]
push str._VintegrateRecursive
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x447d93
push 0x4f3440
call fcn.004b1c10
pop ecx
push eax
push str._VintegrateRecursive:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
jne 0x447da4
push str.VintegrateRecursive:
lea ecx, [esp + 0x104]
call fcn.00424685
push str._Windows_Explorer.exe
lea ecx, [esp + 0xdc]
call fcn.0042462c
mov byte [esp + 0x34e0], 0x44
mov edi, dword [edi]
push 0x3a
push edi
call fcn.004b2768
pop ecx
pop ecx
cmp eax, esi
je 0x447ddd
add eax, 2
push eax
lea ecx, [esp + 0xdc]
call fcn.00424685
push 1
push esi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x11d8]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
mov byte [esp + 0x34e4], 0x45
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov eax, esp
mov byte [esp + 0x34f0], 0x46
mov dword [esp + 0x24], esp
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0x114]
push ecx
push eax
call fcn.0042bbbd
add esp, 8
mov byte [esp + 0x34f4], 0x47
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push esi
push ecx
mov byte [esp + 0x34fc], 0x48
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0x11e8]
push eax
mov byte [esp + 0x3500], 0x45
call fcn.00435082
add esp, 0x20
lea eax, [esp + 0x11cc]
mov byte [esp + 0x34e0], 0x44
call fcn.004276f3
mov ecx, dword [esp + 0xd8]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x100]
jmp 0x449647
lea ecx, [esp + 0x24]
call fcn.0042248a
lea ecx, [esp + 0xe0]
call fcn.0042248a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x34e4], 0xf5
call fcn.00424617
mov byte [esp + 0x34e0], 0xf6
mov eax, dword [esp + 0x20]
lea ecx, [eax + 1]
cmp dword [esp + 0x50], ecx
jle 0x447f0b
mov ecx, dword [esp + 0x2c]
push dword [ecx + eax*4 + 4]
lea ecx, [esp + 0x64]
call fcn.00424685
push 1
push esi
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xcc8]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0xf7
push dword [0x51b49c]
lea eax, [esp + 0x48]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xcc8]
push eax
call fcn.00441232
add esp, 0x10
cmp dword [esp + 0xd44], esi
jne 0x447f77
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x28]
call fcn.0042754a
pop ecx
xor esi, esi
lea eax, [esp + 0xe0]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Main
call fcn.0042462c
push 3
lea edi, [esp + 0xcc8]
call fcn.0047cc30
mov eax, dword [esp + 0xe0]
cmp dword [eax - 0xc], esi
jne 0x447fb8
push str.Cannot_obtain_INI_info_from_resource__n
lea ecx, [esp + 0x28]
call fcn.0042b47b
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x28]
call fcn.004251a9
push esi
push 0x4e639c
push dword [esp + 0x2c]
jmp 0x444f27
lea eax, [esp + 0x24]
push eax
call fcn.00465c00
mov byte [esp + 0x34e4], 0xa6
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
lea edi, [eax + ecx*4]
mov dword [esp], 0x4f26f8
call fcn.004b1c10
pop ecx
push eax
push str._CreateShortcuts:
push dword [edi]
call fcn.004b4226
add esp, 0xc
test eax, eax
jne 0x448037
push dword [edi]
lea ecx, [esp + 0x28]
call fcn.00424685
push 0x4f26f8
call fcn.004b1c10
pop ecx
push esi
lea ecx, [esp + 0x28]
push ecx
call fcn.004246c3
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x44806a
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push 0x51ef10
lea ecx, [esp + 0x64]
call fcn.00424617
lea eax, [esp + 0x68]
push eax
push 0x4e7908
lea eax, [esp + 0x80]
mov byte [esp + 0x34e8], 0xa7
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x74], esi
call fcn.0042aeb5
jmp 0x4485c6
lea ecx, [esp + 0x28]
call fcn.0042248a
lea ecx, [esp + 0x20]
call fcn.0042248a
lea ecx, [esp + 0x2c]
call fcn.0042248a
lea ecx, [esp + 0x3c]
call fcn.0042248a
push 0x3e
push ecx
mov byte [esp + 0x34e8], 0xac
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov dword [esp + 0x90], esi
lea edi, [esp + 0x90]
call fcn.00424617
lea eax, [esp + 0x1fc]
push eax
call fcn.0046a6d0
add esp, 0xc
mov byte [esp + 0x34e0], 0xad
call fcn.00424772
push eax
lea ecx, [esp + 0x2c]
call fcn.00424670
mov byte [esp + 0x34e0], 0xac
mov ecx, dword [esp + 0x1f4]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [esp + 0x84], 0xffffffff
je 0x448567
push 0x3e
push ecx
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
lea eax, [esp + 0x204]
push eax
call fcn.0046a6d0
add esp, 0xc
mov byte [esp + 0x34e0], 0xae
call fcn.00424772
push eax
lea ecx, [esp + 0x24]
call fcn.00424670
mov byte [esp + 0x34e0], 0xac
mov ecx, dword [esp + 0x1fc]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [esp + 0x84], 0xffffffff
je 0x448567
push 0x3e
push ecx
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
lea eax, [esp + 0x20c]
push eax
call fcn.0046a6d0
add esp, 0xc
mov byte [esp + 0x34e0], 0xaf
call fcn.00424772
push eax
lea ecx, [esp + 0x30]
call fcn.00424670
mov byte [esp + 0x34e0], 0xac
mov ecx, dword [esp + 0x204]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [esp + 0x84], 0xffffffff
jne 0x44820c
push ebx
lea ecx, [esp + 0x30]
call fcn.00424685
jmp 0x448267
push 0x3e
push ecx
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
lea edi, [esp + 0x90]
call fcn.00424617
lea eax, [esp + 0x214]
push eax
call fcn.0046a6d0
add esp, 0xc
mov byte [esp + 0x34e0], 0xb0
call fcn.00424772
push eax
lea ecx, [esp + 0x40]
call fcn.00424670
mov byte [esp + 0x34e0], 0xac
mov ecx, dword [esp + 0x20c]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [esp + 0x84], 0xffffffff
jne 0x44827b
push ebx
lea ecx, [esp + 0x40]
call fcn.00424685
push dword [esp + 0x28]
lea eax, [esp + 0xcc]
push str._exec___s_
push eax
call fcn.00466ad0
add esp, 0xc
mov byte [esp + 0x34e0], 0xb1
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], esi
je 0x4482c7
push 0x4e9460
lea ecx, [esp + 0xcc]
call fcn.0042ad26
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xcc]
call fcn.0042469a
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push ecx
mov edi, esp
mov byte [esp + 0x34e8], 0xb2
mov dword [esp + 0x1c], esp
push 0x5c
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00424617
push edi
call fcn.00466e00
lea eax, [esp + 0x164]
add esp, 0xc
push eax
mov byte [esp + 0x34ec], 0xb1
call fcn.0042a350
add esp, 8
mov byte [esp + 0x34e4], 0xb3
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0xb4
lea eax, [esp + 0x158]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34ec], 0xb5
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x51ef5c
call fcn.00424617
lea edi, [esp + 0x104]
mov byte [esp + 0x34ec], 0xb3
call fcn.00466390
add esp, 8
mov byte [esp + 0x34e4], 0xb6
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov eax, esp
mov byte [esp + 0x34e8], 0xb7
mov dword [esp + 0x1c], esp
push str..lnk
lea ecx, [esp + 0x38]
push ecx
push eax
call fcn.0042487b
add esp, 8
mov byte [esp + 0x34ec], 0xb8
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00424617
lea edi, [esp + 0x168]
mov byte [esp + 0x34ec], 0xb6
call fcn.00466390
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x15c]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
lea eax, [esp + 0xfc]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00469180
pop ecx
cmp eax, esi
je 0x448426
lea eax, [esp + 0xf8]
jmp 0x448440
push esi
lea ecx, [esp + 0x164]
call fcn.0042462c
mov byte [esp + 0x34e0], 0xb9
or dword [esp + 0x48], 2
mov eax, dword [eax]
push esi
push ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
push ecx
mov dword [esp + 0x34ec], 0xba
lea eax, [esp + 0xd4]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34f0], 0xbb
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34f4], 0xbc
mov dword [esp + 0x90], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x94], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov eax, esp
mov byte [esp + 0x34fc], 0xbd
mov dword [esp + 0x4c], esp
push str..lnk
lea ecx, [esp + 0x4c]
push ecx
push eax
call fcn.0042487b
add esp, 8
mov byte [esp + 0x3500], 0xbe
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00424617
mov byte [esp + 0x3500], 0xbc
call fcn.00466390
mov ecx, dword [esp + 0x3c]
add esp, 0xc
mov byte [esp + 0x34f4], 0xb9
call fcn.0048f320
add esp, 0x14
mov dword [esp + 0x34e0], 0xb6
test byte [esp + 0x48], 2
je 0x44853a
mov ecx, dword [esp + 0x160]
and dword [esp + 0x48], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0xf8]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x150]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0xc8]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [esp + 0x34e0], 0xa7
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [esp + 0x68]
push eax
push 0x4e7908
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x6c]
call fcn.0042aeb5
cmp dword [esp + 0x68], 0xffffffff
jne 0x4480a4
mov byte [esp + 0x34e0], 0xa7
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.0042201a
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Shortcuts_created_for__s.
jmp 0x444635
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
call fcn.00424617
mov byte [esp + 0x34e0], 0x97
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
lea edi, [eax + ecx*4]
push str._FullIntegrate
push dword [edi]
mov dword [esp + 0x5c], edi
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x4487c3
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x448670
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
push dword [esp + 0x4c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x51ef0c
call fcn.00424617
lea eax, [esp + 0xf0]
push eax
call fcn.0043e0cf
add esp, 8
mov byte [esp + 0x34e4], 0x98
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0x99
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x51ef0c]
push str._s.host.exe
push eax
call fcn.00466ad0
add esp, 8
mov byte [esp + 0x34ec], 0x9a
lea eax, [esp + 0xf4]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00424617
lea edi, [esp + 0x174]
mov byte [esp + 0x34ec], 0x98
call fcn.00466390
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x34e4], 0x9b
call fcn.00424670
mov byte [esp + 0x34e0], 0x98
mov ecx, dword [esp + 0x168]
add ecx, 0xfffffff0
call fcn.0042201a
mov esi, dword [esp + 0xe8]
call fcn.00469260
test eax, eax
jne 0x448752
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_create_virtual_repository
jmp 0x442c29
lea eax, [esp + 0x170]
push eax
call fcn.00465b10
mov eax, dword [eax]
pop ecx
push 0
push dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x170]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x43], al
call fcn.0042201a
cmp byte [esp + 0x43], 0
je 0x4487a6
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Could_not_copy_executable_to_repository
jmp 0x442c29
mov byte [esp + 0x34e0], 0x97
mov ecx, dword [esp + 0xe8]
add ecx, 0xfffffff0
call fcn.0042201a
mov edi, dword [esp + 0x54]
xor esi, esi
push 1
push esi
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0xba8]
push eax
call fcn.0047a9e0
push 0xffffffffffffffff
push esi
push ecx
mov byte [esp + 0x34ec], 0x9c
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x9d
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x9e
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.0042462c
push 2
push ecx
mov byte [esp + 0x34fc], 0x9f
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0xbb8]
push eax
mov byte [esp + 0x3500], 0x9c
call fcn.00435082
push str._Integrate:once
push dword [edi]
call fcn.004b19fe
add esp, 0x28
test eax, eax
jne 0x4489a3
push ebx
lea ecx, [esp + 0x98]
call fcn.0042462c
push esi
push esi
push esi
push ecx
mov byte [esp + 0x34f0], 0xa0
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Registered
lea edi, [esp + 0xa8]
call fcn.0042462c
mov byte [esp + 0x34f0], 0xa1
push dword [0x51ef0c]
lea eax, [esp + 0x18c]
push str.SoftwareVOS_s
push eax
call fcn.00466ad0
add esp, 8
mov byte [esp + 0x34f4], 0xa2
or dword [esp + 0x5c], 1
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Integrated
push eax
push ecx
call fcn.0042487b
add esp, 0xc
mov dword [esp + 0x34f4], 0xa3
call fcn.00476dd0
push eax
mov byte [esp + 0x34f8], 0xa4
call fcn.004675b0
add esp, 0x18
cmp eax, esi
je 0x448917
mov eax, dword [esp + 0x94]
cmp dword [eax - 0xc], esi
je 0x448917
mov bl, 1
jmp 0x448919
xor bl, bl
mov dword [esp + 0x34e0], 0xa0
test byte [esp + 0x48], 1
je 0x44893a
mov ecx, dword [esp + 0x178]
add ecx, 0xfffffff0
call fcn.0042201a
test bl, bl
je 0x44898c
push str.Success
lea eax, [esp + 0x98]
call fcn.004246af
push ecx
test eax, eax
mov dword [esp + 0x14], esp
mov eax, esp
jne 0x448971
push str._Integrate:once:_already_registered_successfully._Quitting.
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.0044091a
jmp 0x444644
push dword [esp + 0x98]
push str._Integrate:once:_already_attempted_registration_before__but_failed:__s._Trying_integration_again.
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0044091a
pop ecx
mov byte [esp + 0x34e0], 0x9c
mov ecx, dword [esp + 0x94]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
cmp dword [esp + 0x4c], esi
push esi
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0xa5
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x51ef0c]
push str.SoftwareVOS_s
push eax
call fcn.00466ad0
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x34f4], 0x9c
call fcn.00467ab0
add esp, 0x14
push dword [esp + 0x4c]
lea edx, [esp + 0xba0]
mov ecx, 0x51ef00
call fcn.00438d04
pop ecx
lea eax, [esp + 0xb9c]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str._s_is_now_integrated_into_your_system.
jmp 0x444635
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004658f0
test eax, eax
jne 0x448ab0
mov eax, dword [esp + 0x2c]
push esi
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
call fcn.0042462c
push edi
call fcn.0046c4d0
add esp, 4
mov byte [esp + 0x34ec], 0x3e
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00424617
mov ecx, esi
xor edx, edx
mov byte [esp + 0x34ec], 4
call fcn.004656e0
add esp, 0xc
cmp eax, esi
jne 0x442c33
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c24
call fcn.00465ac0
test eax, eax
jne 0x448acb
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x441cf1
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
lea edi, [eax + ecx*4]
push 0x4f1c1c
mov dword [esp + 0x58], edi
call fcn.004b1c10
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.004b4226
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x18]
sbb edi, edi
push eax
lea ecx, [esp + 0x64]
inc edi
call fcn.00424617
push ecx
mov byte [esp + 0x34e4], 0x3f
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0x40
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x90]
push eax
mov byte [esp + 0x34ec], 0x3f
call fcn.00466c90
add esp, 0xc
mov byte [esp + 0x34e0], 0x41
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x54]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push dword [eax]
call fcn.0042462c
lea eax, [esp + 0xd4]
push eax
call fcn.0046c4d0
pop ecx
pop ecx
push 1
push esi
push ecx
mov byte [esp + 0x34ec], 0x42
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x590]
push eax
call fcn.0047a9e0
mov byte [esp + 0x34e0], 0x43
push dword [0x51b49c]
cmp dword [esp + 0x610], esi
jne 0x448bdf
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x20]
push str.Cannot_load_newly_created_package__s
jmp 0x442dba
push 1
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x590]
push eax
call fcn.00441232
add esp, 0x10
push 0xffffffffffffffff
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x44
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.0042462c
push ecx
mov byte [esp + 0x34f4], 0x45
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00424617
push 2
push ecx
mov byte [esp + 0x34fc], 0x46
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00424617
lea eax, [esp + 0x5a0]
push eax
mov byte [esp + 0x3500], 0x43
call fcn.00435082
push dword [0x51ef0c]
lea eax, [esp + 0xe8]
push dword [0x51ef5c]
push str._sAppVirtDll__s.dll
push eax
call fcn.00466ad0
add esp, 0x2c
mov byte [esp + 0x34e4], 0x47
lea eax, [esp + 0xc8]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00426ba0
pop ecx
cmp eax, esi
je 0x448d18
push dword [0x51b49c]
cmp eax, 0x11
jne 0x448cda
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00466ad0
pop ecx
pop ecx
jmp 0x442c2e
cmp eax, 0x12
jne 0x448ced
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x448ccd
push eax
lea eax, [esp + 0x2d8]
push eax
call fcn.0046d880
add esp, 4
mov byte [esp + 0x34e8], 0x48
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x4433e7
push dword [esp + 0xd0]
lea eax, [esp + 0x184]
push str._exec__s
push eax
call fcn.00466ad0
mov eax, dword [eax]
add esp, 0xc
push esi
push esi
push eax
push dword [esp + 0x24]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x180]
xor ebx, ebx
cmp eax, 0x20
setg bl
add ecx, 0xfffffff0
call fcn.0042201a
cmp ebx, esi
je 0x448daa
cmp edi, esi
je 0x448d72
push 1
push 0x4e2490
push str.Installation_launched_in_virtual_mode..._nWhen_installation_is_done__click_OK_and_Cameyo_will_turn_it_into_a_virtual_package._nInstallation_will_not_truly_install_anything_on_your_hard_drive__it_is_simulated_.
jmp 0x448d7d
push esi
push 0x4e2490
push str.When_installation_is_done__click_OK.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x448daa
push ecx
lea eax, [esp + 0xc8]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00426c27
pop ecx
push 0x14
jmp 0x442c34
push ecx
lea eax, [esp + 0xc8]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
call fcn.00426c27
pop ecx
cmp eax, esi
je 0x448e25
push dword [0x51b49c]
cmp eax, 0x11
jne 0x448de4
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x448ccd
cmp eax, 0x12
jne 0x448dfa
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x448ccd
push eax
lea eax, [esp + 0x2c4]
push eax
call fcn.0046d880
add esp, 4
mov byte [esp + 0x34e8], 0x49
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x4433e7
cmp ebx, esi
jne 0x448e47
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0xd8]
push str.Failed_executing__s
jmp 0x442dba
mov ebx, dword [esp + 0x60]
cmp edi, esi
je 0x448f0c
call fcn.0042f3c5
push 0x407
mov edi, 0x51ef00
call fcn.00482ac0
pop ecx
push esi
push dword [esp + 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x88]
jne 0x448e94
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x443301
push dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
call fcn.0043c512
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, esi
je 0x448f01
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x30], 0x10
push dword [0x51b49c]
jne 0x448eda
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4433b4
push dword [esp + 0x34]
lea eax, [esp + 0x2dc]
push eax
call fcn.0046d880
add esp, 4
mov byte [esp + 0x34e8], 0x4a
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4433e0
push 0x404
call fcn.00482ac0
pop ecx
lea eax, [esp + 0x584]
call fcn.0047b8c0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [esp + 0x90]
push 0x4f210c
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0xc4]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [esp + 0x584]
mov byte [esp + 0x34e0], 0x42
call fcn.004276f3
mov ecx, dword [esp + 0xd0]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [esp + 0x88]
add ecx, 0xfffffff0
jmp 0x44338c
lea ecx, [esp + 0x28]
call fcn.0042248a
lea ecx, [esp + 0x4c]
call fcn.0042248a
mov byte [esp + 0x34e0], 0x34
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
lea edi, [eax + ecx*4]
push str._CreateDiff
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x448fc9
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
call fcn.00424670
jmp 0x448fe3
push 0x4f1bd8
call fcn.004b1c10
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x2c]
call fcn.00424685
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..mod
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0x35
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x190]
push eax
mov byte [esp + 0x34ec], 0x34
call fcn.00466c90
add esp, 0xc
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x34e4], 0x36
call fcn.00424670
mov byte [esp + 0x34e0], 0x34
mov ecx, dword [esp + 0x188]
add ecx, 0xfffffff0
call fcn.0042201a
mov ebx, dword [esp + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
push esi
push ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x4c]
jne 0x449081
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x443301
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00424617
call fcn.0043c512
pop ecx
pop ecx
mov dword [esp + 0x60], eax
cmp eax, esi
jne 0x4490f8
push dword [0x51b49c]
lea eax, [esp + 0x50]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x19c]
push eax
call fcn.00466e00
add esp, 8
mov byte [esp + 0x34e8], 0x37
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x190]
jmp 0x4492cc
push ebx
call edi
cmp dword [esp + 0x60], 0x10
push dword [0x51b49c]
jne 0x449114
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4433b4
push dword [esp + 0x64]
lea eax, [esp + 0x2d4]
push eax
call fcn.0046d880
add esp, 4
mov byte [esp + 0x34e8], 0x38
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x4433e0
lea ecx, [esp + 0x28]
call fcn.0042248a
lea ecx, [esp + 0x4c]
call fcn.0042248a
mov byte [esp + 0x34e0], 0x27
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
lea edi, [eax + ecx*4]
push str._LearnStreaming
push dword [edi]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
jne 0x449182
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
call fcn.00424670
jmp 0x44919c
push 0x4f19b4
call fcn.004b1c10
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x2c]
call fcn.00424685
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str..new.exe
call fcn.0042462c
push ecx
mov byte [esp + 0x34e8], 0x28
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1a0]
push eax
mov byte [esp + 0x34ec], 0x27
call fcn.00466c90
add esp, 0xc
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x34e4], 0x29
call fcn.00424670
mov byte [esp + 0x34e0], 0x27
mov ecx, dword [esp + 0x198]
add ecx, 0xfffffff0
call fcn.0042201a
mov ebx, dword [esp + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
push esi
push ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x4c]
jne 0x44923a
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x443301
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00424617
push ecx
mov byte [esp + 0x34e8], 0x2a
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
mov byte [esp + 0x34e8], 0x27
call fcn.0043c6f9
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, esi
jne 0x4492e5
push dword [0x51b49c]
lea eax, [esp + 0x50]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00424617
lea eax, [esp + 0x1ac]
push eax
call fcn.00466e00
add esp, 8
mov byte [esp + 0x34e8], 0x2b
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x1a0]
add ecx, 0xfffffff0
call fcn.0042201a
lea ecx, [ebx - 0x10]
call fcn.0042201a
mov ecx, dword [esp + 0x28]
jmp 0x449647
push ebx
call edi
push dword [0x51b49c]
lea eax, [esp + 0x2cc]
push dword [esp + 0x20]
push eax
call fcn.0046d880
add esp, 4
mov byte [esp + 0x34e8], 0x2c
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x4433e7
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push str._RemoveSelf
push dword [eax + ecx*4]
call fcn.004b19fe
mov ebx, eax
neg ebx
sbb ebx, ebx
add esp, 4
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
inc ebx
call fcn.00424617
push 0x51ef00
call fcn.00429b1e
pop ecx
pop ecx
test al, al
jne 0x44936d
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c7d
mov eax, dword [0x51ef5c]
cmp dword [eax - 0xc], esi
jne 0x449389
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x442e6c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov edi, 0x51ef5c
push edi
call fcn.00424617
call fcn.00469180
pop ecx
cmp eax, esi
jne 0x4493c8
cmp ebx, esi
je 0x4493b6
call fcn.00469ca0
test eax, eax
jne 0x442c33
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x442ea5
cmp dword [esp + 0x54], esi
je 0x4493ef
push 3
push dword [0x51ef0c]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x4493ef
push 0x14
pop esi
jmp 0x442ddf
push esi
lea eax, [esp + 0x118]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.AllUsers
mov dword [esp + 0x124], esi
call fcn.0042462c
push ecx
mov byte [esp + 0x34f0], 0x16
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x51ef0c]
push str.SoftwareVOS_s
push eax
call fcn.00466ad0
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x34f4], 4
call fcn.00467830
add esp, 0x14
cmp eax, esi
je 0x4494a0
cmp dword [esp + 0x114], esi
je 0x4494a0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004658f0
test eax, eax
jne 0x449485
call fcn.00465940
test eax, eax
jne 0x442c33
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x442c24
call fcn.00465ac0
test eax, eax
jne 0x4494a0
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
jmp 0x441cf1
push 0x51ef00
call fcn.00438e89
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef0c]
push str.Removing__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0044094a
pop ecx
lea ecx, [esp + 0x11c]
call fcn.0042248a
push 0x4e1f68
mov byte [esp + 0x34e4], 0x17
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x128]
push eax
push dword [0x51b49c]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x51ef58
call fcn.00424617
push ecx
mov byte [esp + 0x34fc], 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x51ef68
call fcn.00424617
push ecx
mov byte [esp + 0x3500], 0x19
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x51ef64
call fcn.00424617
push ecx
mov byte [esp + 0x3504], 0x1a
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.00424617
push ecx
mov byte [esp + 0x3508], 0x1b
mov ecx, esp
mov dword [esp + 0xa4], esp
push 0x51ef0c
call fcn.00424617
mov byte [esp + 0x3508], 0x17
call fcn.0043d02e
add esp, 0x24
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
call fcn.00424617
call fcn.004691c0
pop ecx
cmp eax, esi
je 0x4495b4
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x442dba
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef0c]
push str.SoftwareVOS_s
push eax
call fcn.00466ad0
add esp, 0xc
mov edx, SysReAllocStringLen
call fcn.00467bb0
pop ecx
cmp eax, esi
je 0x4495f0
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
jmp 0x4431b6
cmp ebx, esi
je 0x449601
call fcn.00469ca0
test eax, eax
jne 0x442c33
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.__Removed_successfully
call fcn.0042462c
call fcn.0044094a
pop ecx
push dword [0x51b49c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x51ef0c]
push str.Application__s_removed_successfully
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004411b8
pop ecx
pop ecx
mov ecx, dword [esp + 0x11c]
add ecx, 0xfffffff0
call fcn.0042201a
jmp 0x442ddf
cmp dword [0x51ebb8], esi
je 0x44968b
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push dword [0x51ef48]
push str.CLoaderApp:_waiting_for_LoaderCanQuit__AutoUpdate_s_
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.0044091a
pop ecx
push 0xffffffffffffffff
push dword [0x51ebb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.CLoaderApp:_done._Bye_
call fcn.0042462c
call fcn.0044091a
mov eax, dword [0x51b4ac]
pop ecx
cmp eax, 0xa2c2a
je 0x442c33
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
push str.CLoaderApp:_ExecWait:_g_LoaderExitCode_d
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.0044091a
pop ecx
push dword [0x51b4ac]
jmp 0x442c34