Function at 0x42e56b
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Enumerate pe sections
Get file attributes
Get hostname
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a21d2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x303c
call fcn.0048ab40
mov eax, dword [0x4c3c64]
xor eax, esp
mov dword [esp + 0x3038], eax
push ebx
push esi
push edi
mov eax, dword [0x4c3c64]
xor eax, esp
push eax
lea eax, [esp + 0x3050]
mov dword fs:[0], eax
lea eax, [esp + 0x94]
push eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x98], 8
mov dword [esp + 0x9c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x58]
call fcn.00480026
mov edi, 0x4a94b0
push edi
lea ecx, [esp + 0x78]
call fcn.004211c4
xor ebx, ebx
push edi
lea ecx, [esp + 0x64]
mov dword [esp + 0x305c], ebx
call fcn.004211c4
push edi
lea ecx, [esp + 0x70]
mov byte [esp + 0x305c], 1
call fcn.004211c4
lea eax, [esp + 0x64]
mov byte [esp + 0x3058], 2
push eax
mov dword [esp + 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x1c], 2
mov dword [esp + 0x74], ebx
mov dword [esp + 0x60], ebx
call fcn.00451660
pop ecx
push dword [eax]
call fcn.00485eaa
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
mov dword [0x4c8998], eax
call fcn.0042001a
cmp esi, ebx
je 0x42f3ae
cmp dword [esp + 0x64], 1
jle 0x42f3ae
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
mov dword [esp + 0x48], eax
jle 0x42f3ae
mov dword [esp + 0x14], 2
mov eax, dword [esp + 0x48]
push ecx
lea ebx, [esi + eax*4]
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [ebx]
call fcn.004211c4
call fcn.0042dd23
mov dword [esp], 0x4ac9b4
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42e6cb
mov dword [esp + 0x5c], 1
push str._Quiet
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42e6e6
and dword [esp + 0x18], eax
jmp 0x42ed3e
push str._ErrorsOnly
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42e705
mov dword [esp + 0x18], 1
jmp 0x42ed3e
push str._Stop
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x42ed59
push str._Remove
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x42ee30
push str._LearnStreaming
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x431d7e
push 0x4accf4
call fcn.00485480
pop ecx
push eax
push str._LearnStreaming:
push dword [ebx]
call fcn.004882c2
add esp, 0xc
test eax, eax
je 0x431d7e
push str._UpdateBasicSettings
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42e789
mov dword [esp + 0x70], 1
jmp 0x42ed3e
push str._Repackage
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x42f035
push str._CreateDiff
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x431b9b
push 0x4acf28
call fcn.00485480
pop ecx
push eax
push str._CreateDiff:
push dword [ebx]
call fcn.004882c2
add esp, 0xc
test eax, eax
je 0x431b9b
push str._exec
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x42f22a
push 0x4acf74
call fcn.00485480
pop ecx
push eax
push str._Patch
push dword [ebx]
call fcn.004882c2
add esp, 0xc
test eax, eax
je 0x4316a3
push 0x4acf8c
call fcn.00485480
pop ecx
push eax
push str._InstSandbox
push dword [ebx]
call fcn.004882c2
add esp, 0xc
test eax, eax
je 0x4316a3
push str._ShowStreaming
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x42f4b8
push str._Break
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x42f5b9
push str._Unbreak
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x42fb50
push str._Integrate
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x4314a9
push str._FullIntegrate
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x4314a9
push str._Unintegrate
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x4301f2
push str._Perf
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x430253
push str._ExtractLog
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x43059b
push str._Info
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x430764
push str._EngineVer
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42ea4c
push 1
push eax
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00451660
pop ecx
lea eax, [esp + 0x138]
push eax
call fcn.00422a4a
mov byte [esp + 0x3058], 0x94
cmp dword [esp + 0x1b8], 0
je 0x430c0d
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4c8960]
push str._s.AppVirtDll.dll
push eax
call fcn.00452370
lea eax, [esp + 0x34]
add esp, 0xc
push eax
call fcn.00451bd0
add esp, 4
mov byte [esp + 0x305c], 0x95
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004211af
push ecx
mov byte [esp + 0x3060], 0x96
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4aa0a8
call fcn.004211c4
push 2
lea eax, [esp + 0x138]
push eax
mov byte [esp + 0x3068], 0x95
call fcn.00466150
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004211af
lea eax, [esp + 0x3c]
push eax
call fcn.00473d90
add esp, 4
mov byte [esp + 0x3060], 0x97
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
mov byte [esp + 0x3058], 0x95
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004211af
call fcn.004555b0
pop ecx
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0x305c], 2
call fcn.00422b09
jmp 0x42ed3e
push str._ChangeLoader
push dword [esi + 4]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42ea6d
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x64], eax
jg 0x430c1d
push str._ChangeEngine
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42ea8d
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x64], eax
jg 0x430efb
push str._Debug
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x431110
push str._ForceMenu
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42eac2
mov dword [esp + 0x68], 1
jmp 0x42ed3e
push str._ShowTree
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x4311ac
push str._DbgZip:
call fcn.0048550b
pop ecx
push eax
push str._DbgZip:
push dword [ebx]
call fcn.004882c2
add esp, 0xc
test eax, eax
je 0x431275
push str._DbgNow
call fcn.0048550b
pop ecx
push eax
push str._DbgNow
push dword [ebx]
call fcn.004882c2
add esp, 0xc
test eax, eax
jne 0x42ebd9
push edi
lea ecx, [esp + 0x50]
call fcn.004211c4
lea eax, [esp + 0x2dc]
push eax
mov byte [esp + 0x305c], 0xb4
call fcn.00425c3d
lea eax, [esp + 0x4c]
push eax
push ecx
mov byte [esp + 0x3060], 0xb5
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Prog1._Prog1.._Prog1..._Prog2._Prog2.._Prog2...
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0xb6
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.FriendlyName
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0xb7
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppID
call fcn.004211c4
lea ecx, [esp + 0x2ec]
mov byte [esp + 0x3068], 0xb5
call fcn.004251e0
test eax, eax
je 0x42ebb3
mov eax, dword [esp + 0x4c]
cmp dword [eax - 0xc], 0
jne 0x4312b1
lea eax, [esp + 0x2dc]
push eax
mov byte [esp + 0x305c], 0xb4
call fcn.00425d4d
mov byte [esp + 0x3058], 2
mov ecx, dword [esp + 0x4c]
jmp 0x42ed36
push str._Manager
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x4312d2
push str._ProcessList
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x4312dc
push str._GfxSvr
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42ec6e
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
call fcn.004211c4
call fcn.0042c67e
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x401
mov ebx, 0x4c8958
call fcn.00464010
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x403
call fcn.00464010
mov dword [esp], 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42ed3e
push 0x4ae1a8
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x42ecda
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.open
call fcn.004211c4
xor edi, edi
push edi
push ecx
mov byte [esp + 0x3064], 0xbb
mov ecx, esp
mov dword [esp + 0x28], esp
push str._Troubleshoot
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0xbc
mov eax, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00451660
pop ecx
mov byte [esp + 0x3068], 2
call fcn.00451030
add esp, 0x10
mov edi, 0x4a94b0
jmp 0x42ed3e
push str._Troubleshoot
push dword [ebx]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
je 0x431489
push 0x4ad7d0
lea ecx, [esp + 0x64]
call fcn.00421208
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push dword [esi]
call fcn.004211c4
lea eax, [esp + 0x54]
push eax
call fcn.00457680
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x305c], 0xbd
call fcn.004223cd
mov byte [esp + 0x3058], 2
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
inc dword [esp + 0x14]
cmp eax, dword [esp + 0x64]
jl 0x42e695
jmp 0x42f3ac
push ecx
mov eax, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00451660
pop ecx
mov esi, 0x4c8958
call fcn.00423555
pop ecx
test al, al
jne 0x42ed90
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Cannot_obtain_INI_info_from_resource_
call fcn.004211c4
call fcn.0042e4eb
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push dword [0x4c8960]
call fcn.004211c4
call fcn.0042b6de
pop ecx
test eax, eax
je 0x42edcd
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8960]
push str.Cannot_stop_application__s
push eax
call fcn.00452370
add esp, 0xc
jmp 0x42ed8b
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.__Stopped_successfully
call fcn.004211c4
call fcn.0042dd23
pop ecx
xor esi, esi
mov ecx, dword [esp + 0x6c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, esi
mov ecx, dword [esp + 0x3050]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3038]
xor ecx, esp
call fcn.00484f14
mov esp, ebp
pop ebp
ret
push ecx
mov eax, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00451660
pop ecx
mov esi, 0x4c8958
call fcn.00423555
pop ecx
test al, al
jne 0x42ee5d
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
jmp 0x42ed81
mov eax, dword [0x4c8994]
xor esi, esi
cmp word [eax], si
jne 0x42ee84
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8960]
push str.Cannot_obtain_base_dir_for__s
jmp 0x42edc2
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004211c4
call fcn.00454a50
pop ecx
cmp eax, esi
jne 0x42eec5
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8994]
push dword [0x4c8960]
push str.Application_is_not_deployed_on_this_machine:__s_n_n__s_
push eax
call fcn.00452370
add esp, 0x10
jmp 0x42ed8b
cmp dword [esp + 0x5c], esi
je 0x42eeec
push 3
push dword [0x4c8960]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x42eeec
push 0x14
pop esi
jmp 0x42ede6
push ecx
mov eax, esp
mov dword [esp + 0x3c], esp
push dword [0x4c8960]
push str.Removing__s
push eax
call fcn.00452370
add esp, 0xc
call fcn.0042dd23
pop ecx
call fcn.0047727e
push eax
lea ecx, [esp + 0x60]
call fcn.0042049e
push 0x4aa0a4
mov byte [esp + 0x305c], 3
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x5c]
push eax
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push dword [0x4c8994]
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [0x4c8960]
call fcn.004211c4
mov byte [esp + 0x3068], 3
call fcn.0042b8d8
call fcn.004294c3
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x3c], esp
push dword [0x4c8994]
call fcn.004211c4
call fcn.00454a90
pop ecx
cmp eax, esi
je 0x42efad
push edi
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8960]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x42edc2
push ecx
mov eax, esp
mov dword [esp + 0x3c], esp
push dword [0x4c8960]
push str.SoftwareVOS_s
push eax
call fcn.00452370
add esp, 0xc
call fcn.004535d0
pop ecx
cmp eax, esi
je 0x42efea
push edi
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8960]
push str.Registry_could_not_be_emptied_for__s
jmp 0x42edc2
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.__Removed_successfully
call fcn.004211c4
call fcn.0042dd23
pop ecx
push edi
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8960]
push str.Application__s_removed_successfully
push eax
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x42ede6
call fcn.0047727e
push eax
lea ecx, [esp + 0x18]
call fcn.0042049e
mov byte [esp + 0x3058], 0xd
call fcn.0047727e
push eax
lea ecx, [esp + 0x28]
call fcn.0042049e
mov byte [esp + 0x3058], 0xe
mov eax, dword [esp + 0x48]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
jle 0x42f07f
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x18]
call fcn.0042149d
jmp 0x42f0b0
lea eax, [esp + 0x50]
push eax
call fcn.00451660
pop ecx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x305c], 0xf
call fcn.0042274e
mov byte [esp + 0x3058], 0xe
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str..new.exe
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x10
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x3064], 0xe
call fcn.004526c0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x305c], 0x11
call fcn.0042274e
mov byte [esp + 0x3058], 0xe
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x14]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x24]
jne 0x42f14e
push dword [esp + 0x18]
push ecx
mov dword [esp + 0x40], esp
mov ecx, esp
push eax
call fcn.00421355
jmp 0x42ed8b
push 0
push dword [esp + 0x74]
push ecx
mov dword [esp + 0x44], esp
mov ecx, esp
push eax
call fcn.00421355
push ecx
mov byte [esp + 0x3068], 0x12
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0xe
call fcn.00429929
add esp, 0x10
mov dword [esp + 0x50], eax
test eax, eax
jne 0x42f1e4
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push 0x5c
push ecx
mov dword [esp + 0x44], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x5c]
push eax
call fcn.00452880
add esp, 8
mov byte [esp + 0x3060], 0x13
mov ecx, esp
mov dword [esp + 0x40], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
mov ecx, dword [esp + 0x50]
jmp 0x431f32
push edi
call esi
mov edx, dword [esp + 0x50]
push dword [esp + 0x18]
cmp edx, 0x10
jne 0x42f205
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x42ed86
lea eax, [esp + 0x3c]
push eax
call fcn.00458630
mov byte [esp + 0x3060], 0x14
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x42edc3
mov eax, dword [esp + 0x48]
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push dword [esi + eax*4]
call fcn.004211c4
lea eax, [esp + 0x54]
push eax
call fcn.00457680
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x305c], 0x1d
call fcn.0042274e
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x64]
call fcn.0042274e
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x38]
call fcn.00421355
mov byte [esp + 0x3058], 0x1f
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
push 1
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00423a58
push 0x4ab9d0
mov ecx, eax
mov byte [esp + 0x305c], 0x20
call fcn.00422668
mov ebx, eax
neg ebx
mov byte [esp + 0x3058], 0x1f
mov ecx, dword [esp + 0x58]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
lea ecx, [esp + 0x60]
test bl, bl
je 0x42f2d9
push 1
push 0x22
jmp 0x42f2dd
push 0
push 0x20
call fcn.00429564
mov esi, eax
cmp esi, 0xffffffff
je 0x42f34e
push esi
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x68]
call fcn.00423a58
push 0x4acf6c
mov ebx, eax
mov byte [esp + 0x305c], 0x21
call fcn.00429598
push eax
lea ecx, [esp + 0x64]
call fcn.0042274e
mov byte [esp + 0x3058], 0x1f
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042001a
push 0
lea ecx, [esp + 0x70]
lea eax, [esi + 1]
push ecx
call fcn.00423995
lea eax, [esp + 0x6c]
call fcn.00422516
push eax
lea ecx, [esp + 0x70]
call fcn.0042274e
jmp 0x42f370
push 0x4acf6c
lea ebx, [esp + 0x38]
call fcn.00429598
push eax
lea ecx, [esp + 0x64]
call fcn.0042274e
push edi
lea ecx, [esp + 0x70]
call fcn.0042149d
mov eax, dword [esp + 0x60]
cmp dword [eax - 0xc], 0
jge 0x42f384
push 0x80070057
call fcn.00420000
movzx eax, word [eax]
cmp ax, 0x25
jne 0x42f398
lea eax, [esp + 0x60]
push eax
call fcn.00469170
pop ecx
mov byte [esp + 0x3058], 2
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
xor ebx, ebx
push 1
push ebx
push ecx
mov eax, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00451660
pop ecx
lea eax, [esp + 0x258]
push eax
call fcn.00422a4a
push ecx
mov byte [esp + 0x305c], 0xbe
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004211af
push ecx
mov byte [esp + 0x3060], 0xbf
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004211af
push ecx
mov byte [esp + 0x3064], 0xc0
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004211af
mov byte [esp + 0x3064], 0xc1
push dword [esp + 0x74]
push ecx
mov eax, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00451660
pop ecx
lea ecx, [esp + 0x260]
mov byte [esp + 0x306c], 0xbe
call fcn.00427371
add esp, 0x14
cmp eax, 2
jne 0x431f7e
call fcn.0042e46a
push ebx
push dword [0x4c8960]
push str.Application_is_now_integrated_into_your_system
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x24c]
call fcn.00465040
lea eax, [esp + 0x24c]
push eax
mov byte [esp + 0x305c], 2
call fcn.00422b09
mov ecx, dword [esp + 0x6c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042001a
xor eax, eax
jmp 0x42ee0c
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.ShowStreaming:
call fcn.004211c4
call fcn.0042dd23
pop ecx
push 1
xor ebx, ebx
push ebx
push ecx
mov eax, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00451660
pop ecx
lea eax, [esp + 0xa8]
push eax
call fcn.00422a4a
push ecx
mov byte [esp + 0x305c], 0x32
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x33
mov ecx, esp
mov dword [esp + 0x24], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x34
lea eax, [esp + 0x80]
mov dword [esp + 0x3c], esp
mov ecx, esp
push eax
call fcn.00421355
push 2
push ecx
mov byte [esp + 0x306c], 0x35
mov eax, esp
mov dword [esp + 0x64], esp
push eax
call fcn.00451660
pop ecx
lea ecx, [esp + 0xb0]
mov byte [esp + 0x306c], 0x32
call fcn.00427371
lea eax, [esp + 0xb0]
add esp, 0x14
push eax
mov esi, 0x4c8958
call fcn.00423483
pop ecx
call fcn.0045bf70
push ebx
push 0x427127
push ebx
push dword [0x4c82bc]
push 0x4c82b4
call fcn.0046adc0
lea eax, [esp + 0x9c]
call fcn.00465040
lea eax, [esp + 0x9c]
push eax
mov byte [esp + 0x305c], 2
call fcn.00422b09
jmp 0x42ede4
call fcn.0047727e
push eax
lea ecx, [esp + 0x28]
call fcn.0042049e
mov byte [esp + 0x3058], 0x36
mov eax, dword [esp + 0x48]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
jle 0x42f5ec
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x28]
call fcn.0042149d
jmp 0x42f61d
lea eax, [esp + 0x50]
push eax
call fcn.00451660
pop ecx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x305c], 0x37
call fcn.0042274e
mov byte [esp + 0x3058], 0x36
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str..break
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3064], 0x36
call fcn.004526c0
add esp, 0xc
push 1
push 0
push ecx
mov byte [esp + 0x3064], 0x39
lea eax, [esp + 0x30]
mov dword [esp + 0x44], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0xa8]
push eax
call fcn.00422a4a
mov byte [esp + 0x3058], 0x3a
cmp dword [esp + 0x128], 0
jne 0x42f6ad
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Could_not_load_containers_
jmp 0x42ed86
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x3c], esp
mov ecx, esp
push eax
call fcn.00421355
call fcn.00454070
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42f6ec
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [esp + 0x1c]
push str.Cant_empty__s
jmp 0x42edc2
mov esi, dword [esp + 0x14]
call fcn.00454ae0
test eax, eax
jne 0x42f712
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [esp + 0x1c]
push str.Cant_create__s
jmp 0x42edc2
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
mov esi, 0x4aa0a4
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x3b
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x4a9b30
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x3c
lea eax, [esp + 0x24]
mov dword [esp + 0x60], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x3d
mov ecx, esp
mov dword [esp + 0x24], esp
mov ebx, 0x4aa0a8
push ebx
call fcn.004211c4
push 3
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x3e
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.AppVirtDll.dll
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x3f
lea eax, [esp + 0x24]
mov dword [esp + 0x60], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x40
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004211c4
push 2
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x41
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.AppVirtDll64.dll
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x42
lea eax, [esp + 0x24]
mov dword [esp + 0x60], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x43
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004211c4
push 8
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x44
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.VirtFiles.db
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x45
lea eax, [esp + 0x24]
mov dword [esp + 0x60], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x46
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004211c4
push 4
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x47
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.SandboxCfg.db
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x48
lea eax, [esp + 0x24]
mov dword [esp + 0x60], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x49
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004211c4
push 5
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x4a
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.VirtReg.export
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x4b
lea eax, [esp + 0x24]
mov dword [esp + 0x60], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x4c
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004211c4
push 6
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x4d
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.SysDllSubdirs.txt
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x4e
mov dword [esp + 0x60], esp
lea eax, [esp + 0x24]
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x4f
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004211c4
push 7
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x50
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.Core.zip
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x51
lea eax, [esp + 0x24]
mov dword [esp + 0x60], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x3a
call fcn.00452020
add esp, 8
mov byte [esp + 0x3060], 0x52
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.004211c4
push 1
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x3a
call fcn.00466150
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [esp + 0x1c]
push 0x4ad33c
push eax
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.Unbreak:
call fcn.004211c4
call fcn.0042dd23
mov ecx, esp
mov dword [esp + 0x3c], esp
push str..break
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x53
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00451660
pop ecx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3064], 2
call fcn.004526c0
add esp, 0xc
mov byte [esp + 0x3058], 0x54
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42fbd1
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [esp + 0x1c]
push str.Dir_doesnt_exist:__s
jmp 0x42edc2
lea eax, [esp + 0x48]
push eax
call fcn.00451660
pop ecx
mov esi, str..old
push esi
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x3064], 0x55
call fcn.00423a96
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
push esi
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.00423a96
add esp, 0xc
push dword [eax]
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x68]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x42fc5c
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Could_not_rename_myself_to_.old
jmp 0x42ed86
push esi
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.00423a96
mov eax, dword [eax]
add esp, 0xc
push 0
push dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x50]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x42fcab
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Could_not_copy_myself
jmp 0x42ed86
and dword [esp + 0x5c], 0
push 1
push ecx
mov dword [esp + 0x40], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x4aa0a4
lea ebx, [esp + 0x6c]
lea esi, [esp + 0x80]
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x56
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4a9b30
call fcn.004211c4
push ecx
mov byte [esp + 0x306c], 0x57
lea eax, [esp + 0x28]
mov dword [esp + 0x44], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x306c], 0x55
call fcn.00452020
add esp, 0xc
mov edi, esi
call fcn.00452e10
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x4301dd
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4301dd
mov edx, dword [esp + 0x70]
lea eax, [esp + 0x5c]
push eax
call fcn.00452b70
pop ecx
mov byte [esp + 0x3058], 0x58
push dword [esp + 0x70]
call fcn.004856b3
pop ecx
push 1
push 1
push ecx
lea eax, [esp + 0x54]
mov dword [esp + 0x44], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0xa8]
push eax
call fcn.00422a4a
mov byte [esp + 0x3058], 0x59
cmp dword [esp + 0x128], 0
jne 0x42fd9f
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Could_not_begin_to_update_resource
jmp 0x42ed86
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
mov ebx, 0x4aa0a8
push ebx
call fcn.004211c4
mov byte [esp + 0x305c], 0x5a
mov eax, dword [esp + 0x60]
mov eax, dword [eax - 0xc]
add eax, eax
push 0
push eax
lea ecx, [esp + 0x68]
call fcn.00423c12
push eax
lea esi, [esp + 0xac]
mov byte [esp + 0x3068], 0x59
call fcn.00465970
test eax, eax
je 0x42fdfc
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Could_not_update_INI_resource
jmp 0x42ed86
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.004211c4
push 0
push 2
push ecx
mov byte [esp + 0x3068], 0x5b
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
mov esi, 0x4aa0a4
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3070], 0x5c
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll.dll
call fcn.004211c4
push ecx
mov byte [esp + 0x3074], 0x5d
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3074], 0x5b
call fcn.00452020
add esp, 0xc
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0x59
call fcn.00465a60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.004211c4
push 0
push 8
push ecx
mov byte [esp + 0x3068], 0x5e
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3070], 0x5f
mov ecx, esp
mov dword [esp + 0x48], esp
push str.AppVirtDll64.dll
call fcn.004211c4
push ecx
mov byte [esp + 0x3074], 0x60
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3074], 0x5e
call fcn.00452020
add esp, 0xc
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0x59
call fcn.00465a60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.004211c4
push 0x4000
push 4
push ecx
mov byte [esp + 0x3068], 0x61
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3070], 0x62
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtFiles.db
call fcn.004211c4
push ecx
mov byte [esp + 0x3074], 0x63
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3074], 0x61
call fcn.00452020
add esp, 0xc
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0x59
call fcn.00465a60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.004211c4
push 0x4000
push 5
push ecx
mov byte [esp + 0x3068], 0x64
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3070], 0x65
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SandboxCfg.db
call fcn.004211c4
push ecx
mov byte [esp + 0x3074], 0x66
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3074], 0x64
call fcn.00452020
add esp, 0xc
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0x59
call fcn.00465a60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.004211c4
push 0x4000
push 6
push ecx
mov byte [esp + 0x3068], 0x67
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3070], 0x68
mov ecx, esp
mov dword [esp + 0x48], esp
push str.VirtReg.export
call fcn.004211c4
push ecx
mov byte [esp + 0x3074], 0x69
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3074], 0x67
call fcn.00452020
add esp, 0xc
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0x59
call fcn.00465a60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.004211c4
push 0
push 7
push ecx
mov byte [esp + 0x3068], 0x6a
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3070], 0x6b
mov ecx, esp
mov dword [esp + 0x48], esp
push str.SysDllSubdirs.txt
call fcn.004211c4
push ecx
mov byte [esp + 0x3074], 0x6c
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3074], 0x6a
call fcn.00452020
add esp, 0xc
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0x59
call fcn.00465a60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.004211c4
mov byte [esp + 0x305c], 0x6d
push 0x4000
push 1
push ecx
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.004211c4
push ecx
mov byte [esp + 0x3070], 0x6e
mov ecx, esp
mov dword [esp + 0x48], esp
push str.Core.zip
call fcn.004211c4
push ecx
mov byte [esp + 0x3074], 0x6f
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3074], 0x6d
call fcn.00452020
add esp, 0xc
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0x59
call fcn.00465a60
lea eax, [esp + 0x9c]
call fcn.00465040
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
test eax, eax
je 0x4301ce
push str.Could_not_commit_resource
jmp 0x42ed86
push str.Success
call fcn.004211c4
jmp 0x42fb41
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Could_not_load_VirtApp.ini
jmp 0x42ed86
lea eax, [esp + 0x50]
push eax
call fcn.00451660
mov byte [esp + 0x305c], 0x78
lea eax, [esp + 0x54]
mov dword [esp + 0x3c], esp
mov ecx, esp
push eax
call fcn.00421355
mov esi, 0x4c8958
call fcn.00423555
pop ecx
test al, al
jne 0x430233
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
jmp 0x42ed81
call fcn.004294c3
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8960]
push str._s_is_no_longer_integrated.
jmp 0x42fb38
call fcn.0047727e
push eax
lea ecx, [esp + 0x50]
call fcn.0042049e
mov byte [esp + 0x3058], 0x79
call fcn.0047727e
push eax
lea ecx, [esp + 0x60]
call fcn.0042049e
mov byte [esp + 0x3058], 0x7a
mov ebx, dword [esp + 0x48]
or dword [esp + 0x70], 0xffffffff
lea eax, [ebx + 1]
cmp dword [esp + 0x64], eax
jle 0x4302a0
push dword [esi + ebx*4 + 4]
lea ecx, [esp + 0x50]
call fcn.0042149d
lea eax, [ebx + 2]
cmp dword [esp + 0x64], eax
jle 0x4302b5
push dword [esi + eax*4]
lea ecx, [esp + 0x60]
call fcn.0042149d
call fcn.0047727e
push eax
lea ecx, [esp + 0x54]
call fcn.0042049e
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x305c], 0x7b
call fcn.00451660
mov byte [esp + 0x305c], 0x7c
lea eax, [esp + 0x38]
mov dword [esp + 0x3c], esp
mov ecx, esp
push eax
call fcn.00421355
mov esi, 0x4c8958
call fcn.00423555
pop ecx
test al, al
jne 0x43030d
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
jmp 0x42ed81
push 1
xor ebx, ebx
push ebx
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x44], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x138]
push eax
call fcn.00422a4a
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0x305c], 0x7d
call fcn.004235bf
pop ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x68], eax
mov eax, dword [ecx - 0xc]
cmp eax, ebx
je 0x430370
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1c]
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push dword [0x4c8994]
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0x7e
mov ecx, esp
mov dword [esp + 0x34], esp
push dword [0x4c8960]
call fcn.004211c4
mov byte [esp + 0x3068], 0x7d
call fcn.0042b8d8
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x10
call esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x12c]
push eax
push dword [esp + 0x6c]
mov ecx, 0x4c8958
call fcn.00426236
pop ecx
pop ecx
cmp eax, ebx
je 0x4303f2
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Failed_BasicDeploy_
jmp 0x42ed86
call esi
sub eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
call esi
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x4c]
cmp dword [eax - 0xc], ebx
je 0x4304a5
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x7f
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4ad7d0
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x80
mov ecx, esp
mov dword [esp + 0x54], esp
push edi
call fcn.004211c4
push ebx
push ecx
mov byte [esp + 0x306c], 0x81
lea eax, [esp + 0x48]
mov dword [esp + 0x3c], esp
mov ecx, esp
push eax
call fcn.00421355
lea ecx, [esp + 0x140]
mov byte [esp + 0x306c], 0x7d
call fcn.00427371
add esp, 0x14
push ebx
push ecx
lea eax, [esp + 0x54]
mov dword [esp + 0x30], esp
mov ecx, esp
push eax
call fcn.00421355
call fcn.00457f90
pop ecx
pop ecx
cmp eax, ebx
jne 0x4304a5
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43047b
call esi
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [0x4c8960]
mov esi, eax
sub esi, dword [esp + 0x70]
call fcn.004211c4
call fcn.0042b6de
pop ecx
call fcn.0047727e
push eax
lea ecx, [esp + 0x18]
call fcn.0042049e
lea ecx, [esp + 0x30]
mov eax, 0x100
push ecx
mov byte [esp + 0x305c], 0x82
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], eax
call fcn.004204c6
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.00423b0a
push esi
push dword [esp + 0x28]
lea eax, [esp + 0x60]
push dword [esp + 0x1c]
push dword [0x4c8960]
push str._s__s__d_d_r_n
push eax
call fcn.00452370
add esp, 0x18
mov byte [esp + 0x3058], 0x83
push dword [esp + 0x58]
lea ecx, [esp + 0x20]
call fcn.004320c0
mov byte [esp + 0x3058], 0x84
mov esi, dword [esp + 0x70]
cmp esi, 0xffffffff
je 0x430579
push 2
push ebx
push ebx
push esi
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 0xc]
push ebx
lea edx, [esp + 0x6c]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
lea eax, [esp + 0x5c]
push ecx
mov dword [esp + 0x30], esp
mov ecx, esp
push eax
call fcn.00421355
call fcn.0042e50f
pop ecx
pop ecx
push ebx
jmp 0x42fb4a
call fcn.0047727e
push eax
lea ecx, [esp + 0x28]
call fcn.0042049e
mov byte [esp + 0x3058], 0x85
mov eax, dword [esp + 0x48]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
jle 0x4305ce
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x28]
call fcn.0042149d
jmp 0x4305ff
lea eax, [esp + 0x1c]
push eax
call fcn.00451660
pop ecx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x305c], 0x86
call fcn.0042274e
mov byte [esp + 0x3058], 0x85
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str..Packager.log
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x87
lea eax, [esp + 0x2c]
mov dword [esp + 0x40], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3064], 0x85
call fcn.004526c0
add esp, 0xc
mov byte [esp + 0x3058], 0x88
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x30]
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
xor edi, edi
call fcn.00421355
lea eax, [esp + 0x1c8]
push eax
call fcn.00422a4a
lea eax, [esp + 0x1bc]
push eax
mov byte [esp + 0x305c], 0x89
call fcn.004235bf
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x430723
push 0x2024
lea eax, [esp + 0x614]
push esi
push eax
mov dword [esp + 0x618], esi
call fcn.00485e30
add esp, 0xc
cmp dword [ebx], 1
mov dword [esp + 0x58], esi
je 0x4306c7
mov dword [0x4c8710], 0x80000
jmp 0x43071c
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x60c]
push eax
lea edx, [esp + 0x5c]
call fcn.004633e0
mov dword [0x4c8710], eax
cmp eax, esi
jne 0x43071c
lea eax, [esp + 0x1c]
push eax
call fcn.00451880
pop ecx
push dword [eax]
mov eax, ebx
call fcn.00463ef0
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [esp + 0x14]
mov edx, dword [esp + 0x5c]
mov eax, ebx
call fcn.00463e70
pop ecx
test eax, eax
jne 0x43071c
xor edi, edi
inc edi
call fcn.00463f30
xor esi, esi
lea eax, [esp + 0x1bc]
call fcn.00465040
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x1c]
cmp edi, esi
je 0x430749
push str.Success:__s
jmp 0x43074e
push str.Failed_saving__s
push eax
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
push esi
jmp 0x42fb4a
call fcn.0047727e
push eax
lea ecx, [esp + 0x1c]
call fcn.0042049e
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x305c], 0x8a
call fcn.00451660
pop ecx
mov byte [esp + 0x3058], 0x8b
mov eax, dword [esp + 0x48]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
jle 0x4307a8
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x38]
call fcn.0042149d
push 1
push 0
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0xa8]
push eax
call fcn.00422a4a
mov byte [esp + 0x3058], 0x8c
cmp dword [esp + 0x128], 0
jne 0x43082d
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x1c]
call fcn.004228c0
pop ecx
push str.______________________________n
lea ebx, [esp + 0x1c]
call fcn.004228c0
lea eax, [esp + 0x38]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
mov esi, 0x4c8958
call fcn.00423555
pop ecx
test al, al
jne 0x430904
push str.Cannot_obtain_INI_info_from_resource__n
mov ecx, ebx
call fcn.00423aeb
jmp 0x430bf5
mov esi, dword [esp + 0x11c]
cmp esi, dword [esp + 0x120]
jbe 0x430842
call fcn.00485682
mov eax, dword [esp + 0x110]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x120]
cmp dword [esp + 0x11c], esi
jbe 0x430866
call fcn.00485682
mov eax, dword [esp + 0x110]
mov dword [esp + 0x3c], esi
lea edi, [esp + 0x38]
lea esi, [esp + 0x28]
mov dword [esp + 0x38], eax
call fcn.00424632
test al, al
je 0x4307eb
call fcn.00432104
mov edi, eax
add edi, 0x18
call fcn.00432104
mov ebx, eax
call fcn.00432104
push dword [eax + 0xc]
push dword [eax + 8]
movzx eax, word [edi + 0xc]
push dword [ebx + 4]
push dword [ebx]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 8]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
movzx eax, word [edi + 6]
push eax
call fcn.00432104
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00432104
push dword [eax + 0x2c]
call fcn.00432104
mov eax, dword [eax + 0x28]
call fcn.0042391c
push eax
push str._s__s:_Size_lld__Time_.2d__.2d__.4d__.2d:_.2d:_.2d__Offset_lld__Allocated_lld_n
lea ebx, [esp + 0x54]
call fcn.004228c0
add esp, 0x3c
call fcn.0043212c
jmp 0x430851
call fcn.0047727e
push eax
lea ecx, [esp + 0x18]
call fcn.0042049e
mov byte [esp + 0x3058], 0x8d
call fcn.0045bf70
push dword [0x4c8960]
lea ebx, [esp + 0x1c]
push str.AppID___ws_n
call fcn.004228c0
push dword [0x4c8970]
push str.Publisher___ws_n
call fcn.004228c0
push dword [0x4c8974]
push str.Version___ws_n
call fcn.004228c0
push dword [0x4c8968]
push str.FriendlyName___ws_n
call fcn.004228c0
push dword [0x4c8964]
push str.AutoLaunch___ws_n
call fcn.004228c0
push dword [0x4c896c]
push str.Shortcuts___ws_n
call fcn.004228c0
push dword [0x4c8994]
push str.BaseDirName___ws_n
call fcn.004228c0
push dword [0x4c8998]
push str.CarrierExeName___ws_n
call fcn.004228c0
add esp, 0x40
push dword [0x4c8978]
push str.OnStartVirtualizedCmds___ws_n
call fcn.004228c0
push dword [0x4c897c]
push str.OnStartUnvirtualizedCmds___ws_n
call fcn.004228c0
push dword [0x4c8980]
push str.OnStopVirtualizedCmds___ws_n
call fcn.004228c0
push dword [0x4c8984]
push str.OnStopUnvirtualizedCmds___ws_n
call fcn.004228c0
push dword [0x4c8988]
push str.StopInheritance___ws_n
call fcn.004228c0
add esp, 0x24
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [0x4c8960]
push str._s.AppVirtDll.dll
push eax
call fcn.00452370
lea eax, [esp + 0x2c]
add esp, 0xc
push eax
call fcn.00451bd0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x305c], 0x8e
call fcn.0042274e
mov byte [esp + 0x3058], 0x8d
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
push ecx
mov byte [esp + 0x3060], 0x8f
mov ecx, esp
mov dword [esp + 0x40], esp
mov esi, 0x4aa0a8
push esi
call fcn.004211c4
push 2
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x8d
call fcn.00466150
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x20]
push eax
call fcn.00473d90
mov byte [esp + 0x3060], 0x90
push dword [eax]
push str.EngineVersion_ws_n
call fcn.004228c0
mov byte [esp + 0x3068], 0x8d
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
call fcn.004555b0
pop ecx
lea ecx, [esp + 0x4c]
call fcn.0042048a
push ecx
mov byte [esp + 0x305c], 0x91
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [0x4c8960]
push str._s.SandboxCfg.db
push eax
call fcn.00452370
lea eax, [esp + 0x2c]
add esp, 0xc
push eax
call fcn.00451bd0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x305c], 0x92
call fcn.004223cd
mov byte [esp + 0x3058], 0x91
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004211af
push ecx
mov byte [esp + 0x3060], 0x93
mov ecx, esp
mov dword [esp + 0x40], esp
push esi
call fcn.004211c4
push 5
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0x91
call fcn.00466150
and dword [esp + 0x78], 0
xor eax, eax
mov esi, dword [esp + 0x14]
lea edi, [esp + 0x7c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ebx, [esp + 0x78]
stosd dword es:[edi], eax
call fcn.00469fd0
lea eax, [esp + 0x4c]
push eax
push 0x45ecc0
push 0
push dword [esp + 0x8c]
mov eax, ebx
push eax
call fcn.0046adc0
push dword [esp + 0x4c]
lea ebx, [esp + 0x1c]
push str.Sandbox:__ws_n
call fcn.004228c0
pop ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004211af
call fcn.004555b0
pop ecx
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [esi - 0x10]
call fcn.0042001a
xor esi, esi
push esi
push str.Info
push dword [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x43075e
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jmp 0x42f6a3
lea eax, [esp + 0x24]
push eax
call fcn.00451660
pop ecx
push 0x2e
lea ecx, [esp + 0x28]
mov byte [esp + 0x305c], 0x98
call fcn.00431fe2
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.00423a58
push str..new.exe
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3064], 0x99
call fcn.00423a96
add esp, 0xc
mov byte [esp + 0x3058], 0x9b
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0x48]
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.004211c4
push 0
mov byte [esp + 0x305c], 0x9c
push dword [esp + 0x18]
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x430cc3
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x1c]
push dword [esp + 0x30]
push str.Cant_copy__s_to__s
jmp 0x42eeb7
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004211af
push ecx
mov byte [esp + 0x3060], 0x9d
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004211af
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x3064], 0x9c
call fcn.004297a4
mov ecx, dword [esp + 0x28]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0042001a
push 1
push 0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.004211af
lea eax, [esp + 0xa8]
push eax
call fcn.00422a4a
push 1
push 1
push ecx
mov byte [esp + 0x3064], 0x9e
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.004211af
lea eax, [esp + 0x1c8]
push eax
call fcn.00422a4a
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x110]
mov byte [esp + 0x3058], 0x9f
call fcn.00432007
jmp 0x430e64
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.CEChangeEngine.tmp
call fcn.004211c4
lea eax, [esp + 0x38]
push eax
call fcn.00451bd0
add esp, 4
mov byte [esp + 0x305c], 0xa0
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004211af
lea esi, [esp + 0x20]
mov byte [esp + 0x305c], 0xa1
call fcn.00432104
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004211af
call fcn.00432104
push dword [eax + 0x28]
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x3068], 0xa0
call fcn.00466150
test eax, eax
jne 0x430eb8
call fcn.00432104
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.004211af
push 0x4000
mov byte [esp + 0x3060], 0xa2
call fcn.00432104
push dword [eax + 0x28]
lea eax, [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004211af
lea eax, [esp + 0x1cc]
push eax
mov byte [esp + 0x306c], 0xa0
call fcn.00465a60
test eax, eax
jne 0x430ee2
mov byte [esp + 0x3058], 0x9f
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
call fcn.0043212c
lea eax, [esp + 0x50]
lea ecx, [esp + 0x110]
call fcn.0043201c
mov edi, eax
lea esi, [esp + 0x1c]
call fcn.00424632
test al, al
jne 0x430d77
lea eax, [esp + 0x9c]
call fcn.00465040
lea eax, [esp + 0x1bc]
call fcn.00465040
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x1c]
push str.Successfully_changed_Loader:__s
jmp 0x42fb38
push dword [esp + 0x18]
call fcn.00432104
push ecx
mov edi, esp
mov dword [esp + 0x30], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x28]
call fcn.00432104
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x42eeb8
push dword [esp + 0x18]
lea esi, [esp + 0x20]
call fcn.00432104
push ecx
mov edi, esp
mov dword [esp + 0x30], esp
push dword [eax + 0x2c]
jmp 0x430ecf
lea eax, [esp + 0x24]
push eax
call fcn.00451660
pop ecx
push 0x2e
lea ecx, [esp + 0x28]
mov byte [esp + 0x305c], 0xa3
call fcn.00431fe2
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.00423a58
push str..new.exe
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3064], 0xa4
call fcn.00423a96
add esp, 0xc
mov byte [esp + 0x3058], 0xa6
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0x48]
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x38]
call fcn.004211c4
xor edi, edi
push edi
mov byte [esp + 0x305c], 0xa7
push dword [esp + 0x18]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x430f9d
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x1c]
push dword [esp + 0x30]
jmp 0x430cb9
push 1
push 1
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.004211af
lea eax, [esp + 0xa8]
push eax
call fcn.00422a4a
mov byte [esp + 0x3058], 0xa8
cmp dword [esp + 0x128], edi
jne 0x430fe5
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Cannot_open_PeContainer
jmp 0x42ed86
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov esi, 0x4aa0a8
push esi
call fcn.004211c4
push edi
push 2
push ecx
mov byte [esp + 0x3068], 0xa9
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.004211af
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0xa8
call fcn.00465a60
cmp eax, edi
je 0x431041
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x42ed86
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.004211c4
push edi
push 8
push ecx
mov byte [esp + 0x3068], 0xaa
mov dword [esp + 0x48], esp
mov esi, esp
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.004211af
push esi
call fcn.0045ede0
pop ecx
pop ecx
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x306c], 0xa8
call fcn.00465a60
cmp eax, edi
je 0x4310a7
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x42ed86
lea eax, [esp + 0x9c]
call fcn.00465040
push dword [esp + 0x18]
lea eax, [esp + 0x38]
push ecx
mov dword [esp + 0x30], esp
mov esi, esp
push dword [esp + 0x1c]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004211af
lea eax, [esp + 0x2c]
push eax
call fcn.00473d90
pop ecx
pop ecx
mov byte [esp + 0x3064], 0xab
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00452370
add esp, 0x10
call fcn.0042e50f
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push edi
jmp 0x42fb4a
lea eax, [esp + 0x474]
push eax
call fcn.00425c3d
lea ecx, [esp + 0x58]
call fcn.0042048a
lea eax, [esp + 0x58]
push eax
push ecx
mov byte [esp + 0x3060], 0xad
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0xae
mov ecx, esp
mov dword [esp + 0x44], esp
push str.Description
call fcn.004211c4
push ecx
mov byte [esp + 0x3068], 0xaf
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AppID
call fcn.004211c4
lea ecx, [esp + 0x484]
mov byte [esp + 0x3068], 0xad
call fcn.004251e0
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x474]
push eax
mov byte [esp + 0x305c], 2
call fcn.00425d4d
jmp 0x42ede4
push 1
xor esi, esi
push esi
push ecx
mov eax, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00451660
pop ecx
lea eax, [esp + 0x138]
push eax
call fcn.00422a4a
push ecx
mov byte [esp + 0x305c], 0xb0
mov ecx, esp
mov dword [esp + 0x2c], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0xb1
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0xb2
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004211af
push 2
push ecx
mov byte [esp + 0x306c], 0xb3
mov eax, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00451660
pop ecx
lea ecx, [esp + 0x140]
mov byte [esp + 0x306c], 0xb0
call fcn.00427371
lea eax, [esp + 0x140]
add esp, 0x14
push eax
call fcn.00427230
pop ecx
lea eax, [esp + 0x12c]
call fcn.00465040
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0x305c], 2
call fcn.00422b09
jmp 0x42ede6
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.DbgZip
call fcn.004211c4
call fcn.0042dd23
mov dword [esp], str._DbgZip:
call fcn.0048550b
pop ecx
mov ecx, dword [esp + 0x48]
mov ecx, dword [esi + ecx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x78]
call fcn.00421208
jmp 0x42f3ac
lea eax, [esp + 0x2dc]
push eax
mov byte [esp + 0x305c], 0xb4
call fcn.00425d4d
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
jmp 0x431f45
call fcn.0042e46a
jmp 0x42fb48
lea eax, [esp + 0x38]
call fcn.004645a0
mov byte [esp + 0x3058], 0xb8
and dword [esp + 0x58], 0
jmp 0x431466
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
lea ecx, [esp + 0x2e48]
push ecx
push str.__ws
push eax
call fcn.00452370
add esp, 0xc
call fcn.0042dd23
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [esp + 0x614]
push str.____SerialId:__d
push eax
call fcn.00452370
add esp, 0xc
call fcn.0042dd23
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xe38]
mov esi, 0x3e8
mov ecx, esi
xor edx, edx
div ecx
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
push str.____Started:__d_sec_ago
push ecx
call fcn.00452370
add esp, 0xc
call fcn.0042dd23
mov eax, dword [esp + 0xe40]
xor edx, edx
div esi
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
push str.____Blocking_buffering:__d_sec
push ecx
call fcn.00452370
add esp, 0xc
call fcn.0042dd23
mov eax, esp
mov dword [esp + 0x2c], esp
push str.____Processes:
push eax
call fcn.00452370
pop ecx
pop ecx
call fcn.0042dd23
xor ebx, ebx
pop ecx
cmp dword [esp + 0xe40], ebx
jbe 0x431466
push edi
lea ecx, [esp + 0x50]
call fcn.004211c4
mov byte [esp + 0x3058], 0xb9
push dword [esp + ebx*4 + 0xe44]
lea esi, [esp + 0x50]
call fcn.00450f30
pop ecx
test eax, eax
jne 0x4313ed
push 0x4aa288
mov ecx, esi
call fcn.00421208
push 0x5c
push ecx
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004211af
lea eax, [esp + 0x24]
push eax
call fcn.00452880
add esp, 8
mov byte [esp + 0x305c], 0xba
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [eax]
push dword [esp + ebx*4 + 0xe4c]
push str._______wd:__ws
push ecx
call fcn.00452370
add esp, 0x10
call fcn.0042dd23
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [esp + 0x3058], 0xb8
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042001a
inc ebx
cmp ebx, dword [esp + 0xe40]
jb 0x4313ba
lea eax, [esp + 0x60c]
push eax
lea eax, [esp + 0x3c]
push eax
lea esi, [esp + 0x60]
call fcn.00464430
test eax, eax
jne 0x4312f7
jmp 0x42fb48
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x44]
call fcn.0042588a
lea eax, [esp + 0x1c]
push eax
call fcn.004259c7
jmp 0x42fb48
lea eax, [esp + 0x4c]
push eax
call fcn.00451660
mov byte [esp + 0x305c], 0x70
mov eax, dword [esp + 0x4c]
mov dword [esp], str._FullIntegrate
push dword [esi + eax*4]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x4315d8
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00451660
pop ecx
mov esi, 0x4c8958
call fcn.00423555
pop ecx
test al, al
jne 0x431505
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jmp 0x42ed81
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4aa0a4
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x71
mov eax, esp
mov dword [esp + 0x40], esp
push dword [0x4c8960]
push str._s.host.exe
push eax
call fcn.00452370
add esp, 8
mov byte [esp + 0x3064], 0x72
mov ecx, esp
mov dword [esp + 0x5c], esp
push dword [0x4c8994]
call fcn.004211c4
lea edi, [esp + 0x28]
mov byte [esp + 0x3064], 0x70
call fcn.00452020
add esp, 0xc
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x305c], 0x73
call fcn.0042274e
mov byte [esp + 0x3058], 0x70
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x30]
push eax
call fcn.00451660
mov eax, dword [eax]
pop ecx
push 0
push dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x30]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x4315d3
push dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Could_not_copy_executable_to_repository
jmp 0x42ed86
mov edi, 0x4a94b0
push 1
push 0
push ecx
lea eax, [esp + 0x58]
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x138]
push eax
call fcn.00422a4a
push ecx
mov byte [esp + 0x305c], 0x74
mov ecx, esp
mov dword [esp + 0x2c], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x75
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x76
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.004211c4
push 2
push ecx
mov byte [esp + 0x306c], 0x77
lea eax, [esp + 0x60]
mov dword [esp + 0x44], esp
mov ecx, esp
push eax
call fcn.00421355
lea ecx, [esp + 0x140]
mov byte [esp + 0x306c], 0x74
call fcn.00427371
add esp, 0x14
call fcn.004280f4
lea ecx, [esp + 0x12c]
call fcn.004287cd
lea eax, [esp + 0x12c]
call fcn.00465040
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push dword [0x4c8960]
push str._s_is_now_integrated_into_your_system.
jmp 0x42fb38
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00451610
test eax, eax
jne 0x431700
xor edi, edi
push edi
push edi
push ecx
mov ebx, esp
mov dword [esp + 0x34], esp
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push dword [esi]
call fcn.004211c4
push ebx
call fcn.00457680
add esp, 4
mov byte [esp + 0x3068], 0x22
mov eax, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00451660
pop ecx
mov byte [esp + 0x3068], 2
call fcn.00451190
add esp, 0x10
jmp 0x43110a
mov eax, dword [esp + 0x48]
push 0x4acf74
lea esi, [esi + eax*4]
call fcn.00485480
pop ecx
push eax
push str._Patch
push dword [esi]
call fcn.004882c2
mov ebx, eax
add esp, 0xc
neg ebx
lea eax, [esp + 0x34]
sbb ebx, ebx
push eax
inc ebx
call fcn.00451660
mov byte [esp + 0x305c], 0x23
mov ecx, esp
mov dword [esp + 0x2c], esp
push str..new.exe
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x24
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3064], 0x23
call fcn.004526c0
add esp, 0xc
mov byte [esp + 0x3058], 0x25
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [esi]
call fcn.004211c4
lea eax, [esp + 0x60]
push eax
call fcn.00457680
pop ecx
pop ecx
push 1
push 0
push ecx
mov byte [esp + 0x3064], 0x26
mov eax, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00451660
pop ecx
lea eax, [esp + 0x1c8]
push eax
call fcn.00422a4a
push ecx
mov byte [esp + 0x305c], 0x27
mov ecx, esp
mov dword [esp + 0x2c], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x28
mov ecx, esp
mov dword [esp + 0x40], esp
push edi
call fcn.004211c4
push ecx
mov byte [esp + 0x3064], 0x29
mov dword [esp + 0x28], esp
lea eax, [esp + 0x80]
mov ecx, esp
push eax
call fcn.00421355
push 2
push ecx
mov byte [esp + 0x306c], 0x2a
mov eax, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00451660
pop ecx
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x306c], 0x27
call fcn.00427371
add esp, 0x14
push dword [0x4c8960]
lea eax, [esp + 0x28]
push dword [0x4c8994]
push str._sAppVirtDll__s.dll
push eax
call fcn.00452370
add esp, 0xc
mov byte [esp + 0x305c], 0x2b
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
call fcn.004210a1
pop ecx
test eax, eax
je 0x4318dc
push dword [esp + 0x18]
cmp eax, 0x11
jne 0x4318a3
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00452370
pop ecx
pop ecx
jmp 0x42ed8b
cmp eax, 0x12
jne 0x4318b6
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x431896
lea ecx, [esp + 0x2c]
push ecx
mov edx, eax
call fcn.00458630
mov byte [esp + 0x3060], 0x2c
mov ecx, esp
mov dword [esp + 0x40], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x42f224
push dword [esp + 0x5c]
lea eax, [esp + 0x34]
push str._exec__s
push eax
call fcn.00452370
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x305c], 0x2d
call fcn.00451660
mov eax, dword [eax]
pop ecx
mov ecx, dword [esi]
xor esi, esi
push esi
push esi
push ecx
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov edi, ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [esp + 0x3058], 0x2b
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042001a
cmp edi, esi
je 0x43198e
cmp ebx, esi
je 0x431959
push 1
push str.Cameyo
push str.Starting_installation..._nWhen_finished__click_OK_to_merge_result_back_into_the_virtual_package.
jmp 0x431964
push esi
push str.Cameyo
push str.When_installation_is_finished__click_OK.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x43198e
push ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
call fcn.00421128
pop ecx
push 0x14
jmp 0x42fb4a
push ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
call fcn.00421128
pop ecx
cmp eax, esi
je 0x4319ff
push dword [esp + 0x18]
cmp eax, 0x11
jne 0x4319c3
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x431896
cmp eax, 0x12
jne 0x4319d9
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x431896
lea ecx, [esp + 0x2c]
push ecx
mov edx, eax
call fcn.00458630
mov byte [esp + 0x3060], 0x2e
mov ecx, esp
mov dword [esp + 0x40], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x42f224
cmp edi, esi
jne 0x431a1c
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x64]
push str.Failed_executing__s
jmp 0x42edc2
cmp ebx, esi
je 0x431aeb
push esi
push dword [esp + 0x18]
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x14]
jne 0x431a49
push dword [esp + 0x18]
push ecx
mov dword [esp + 0x30], esp
jmp 0x42f141
push esi
push dword [esp + 0x74]
push ecx
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
call fcn.00421355
push ecx
mov byte [esp + 0x3068], 0x2f
lea eax, [esp + 0x44]
mov dword [esp + 0x48], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x2b
call fcn.00429929
mov edi, eax
add esp, 0x10
cmp edi, esi
jne 0x431b5d
push dword [esp + 0x18]
lea eax, [esp + 0x18]
push 0x5c
push ecx
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x28]
push eax
call fcn.00452880
add esp, 8
mov byte [esp + 0x3060], 0x30
mov ecx, esp
mov dword [esp + 0x30], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
mov byte [esp + 0x3058], 0x2b
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x1bc]
call fcn.00465040
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push dword [esp + 0x1c]
push 0x4ad33c
push eax
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x1bc]
push eax
mov byte [esp + 0x305c], 0x26
call fcn.00422b09
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x34]
jmp 0x42f028
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x18]
cmp edi, 0x10
jne 0x431b7c
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jmp 0x42f1fb
lea eax, [esp + 0x2c]
push eax
mov edx, edi
call fcn.00458630
mov byte [esp + 0x3060], 0x31
mov ecx, esp
mov dword [esp + 0x40], esp
jmp 0x42f21d
call fcn.0047727e
push eax
lea ecx, [esp + 0x28]
call fcn.0042049e
mov byte [esp + 0x3058], 0x15
call fcn.0047727e
push eax
lea ecx, [esp + 0x18]
call fcn.0042049e
mov byte [esp + 0x3058], 0x16
mov eax, dword [esp + 0x48]
lea esi, [esi + eax*4]
push str._CreateDiff
push dword [esi]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x431c15
lea eax, [esp + 0x1c]
push eax
call fcn.00451660
pop ecx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x305c], 0x17
call fcn.0042274e
mov byte [esp + 0x3058], 0x16
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x431c2f
push 0x4acf28
call fcn.00485480
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.0042149d
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str..mod
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 0x18
lea eax, [esp + 0x2c]
mov dword [esp + 0x40], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x3064], 0x16
call fcn.004526c0
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x305c], 0x19
call fcn.0042274e
mov byte [esp + 0x3058], 0x16
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x24]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x14]
jne 0x431cc5
push dword [esp + 0x18]
push ecx
mov dword [esp + 0x30], esp
jmp 0x42f141
push 1
push 0
push ecx
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
call fcn.00421355
push ecx
mov byte [esp + 0x3068], 0x1a
lea eax, [esp + 0x34]
mov dword [esp + 0x48], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3068], 0x16
call fcn.00429929
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x431d45
push dword [esp + 0x18]
lea eax, [esp + 0x18]
push 0x5c
push ecx
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x28]
push eax
call fcn.00452880
add esp, 8
mov byte [esp + 0x3060], 0x1b
mov ecx, esp
mov dword [esp + 0x30], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
jmp 0x431f1e
push edi
call esi
mov edx, dword [esp + 0x1c]
push dword [esp + 0x18]
cmp edx, 0x10
jne 0x431d61
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jmp 0x42f1fb
lea eax, [esp + 0x2c]
push eax
call fcn.00458630
mov byte [esp + 0x3060], 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
jmp 0x42f21d
call fcn.0047727e
push eax
lea ecx, [esp + 0x28]
call fcn.0042049e
mov byte [esp + 0x3058], 5
call fcn.0047727e
push eax
lea ecx, [esp + 0x18]
call fcn.0042049e
mov byte [esp + 0x3058], 6
mov eax, dword [esp + 0x48]
lea esi, [esi + eax*4]
push str._LearnStreaming
push dword [esi]
call fcn.00485d30
pop ecx
pop ecx
test eax, eax
jne 0x431df8
lea eax, [esp + 0x1c]
push eax
call fcn.00451660
pop ecx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x305c], 7
call fcn.0042274e
mov byte [esp + 0x3058], 6
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x431e12
push 0x4accf4
call fcn.00485480
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x28]
call fcn.0042149d
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str..new.exe
call fcn.004211c4
push ecx
mov byte [esp + 0x3060], 8
lea eax, [esp + 0x2c]
mov dword [esp + 0x40], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x3064], 6
call fcn.004526c0
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x305c], 9
call fcn.0042274e
mov byte [esp + 0x3058], 6
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x24]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x14]
jne 0x431ea8
push dword [esp + 0x18]
push ecx
mov dword [esp + 0x30], esp
jmp 0x42f141
push ecx
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421355
push ecx
mov byte [esp + 0x3060], 0xa
lea eax, [esp + 0x2c]
mov dword [esp + 0x40], esp
mov ecx, esp
push eax
call fcn.00421355
mov byte [esp + 0x3060], 6
call fcn.0042b23d
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x431f4f
push dword [esp + 0x18]
lea eax, [esp + 0x18]
push 0x5c
push ecx
mov dword [esp + 0x34], esp
mov ecx, esp
push eax
call fcn.00421355
lea eax, [esp + 0x28]
push eax
call fcn.00452880
add esp, 8
mov byte [esp + 0x3060], 0xb
mov ecx, esp
mov dword [esp + 0x30], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00452370
add esp, 0xc
call fcn.0042e50f
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [edi - 0x10]
call fcn.0042001a
lea ecx, [ebx - 0x10]
call fcn.0042001a
jmp 0x42ede4
push edi
call esi
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
call fcn.00458630
mov byte [esp + 0x3060], 0xc
mov ecx, esp
mov dword [esp + 0x40], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x42f224
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x4c8990], ebx
je 0x431fd6
cmp eax, 1
jne 0x431fd6
push 6
pop ecx
xor eax, eax
mov dword [esp + 0x78], ebx
lea edi, [esp + 0x7c]
push str.CLoaderApp:_Entering_wait_loop_n
rep stosd dword es:[edi], eax
call esi
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x431fc5
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x84]
push eax
call edi
test eax, eax
jne 0x431faf
push str.CLoaderApp:_Done._Bye__n
call esi
jmp 0x430595