Function at 0x1000169c
Capabilities:
Accept command line arguments
Get common file path
Link many functions at runtime
Resolve function by parsing pe exports
Set environment variable
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x69c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1002b728
mov ebx, 0x1002b714
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x1002b704
push ebx
mov dword [esp + 0x20], eax
call edi
push eax
call esi
push 0x1002b740
mov dword [esp + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100016fc
push str.BoxedAppSDK_SetContext
push edi
call esi
push 0x1002b778
call eax
jmp 0x10001706
push 0x1002b778
call fcn.100030e0
test edi, edi
je 0x10001725
push str.BoxedAppSDK_Init
push edi
call esi
call eax
push str.BoxedAppSDK_SetParam0
push edi
call esi
push str.This_EXE_is_created_by_the_demo_version_of_BoxedApp_Packer_r_n_r_n_r_nPurchase_a_license_to_remove_this_limitation_r_n_r_nVisit_our_web_site_at:_http:__boxedapp.com_boxedapppacker_order.html
call eax
jmp 0x10001734
call fcn.10003a80
push str.This_EXE_is_created_by_the_demo_version_of_BoxedApp_Packer_r_n_r_n_r_nPurchase_a_license_to_remove_this_limitation_r_n_r_nVisit_our_web_site_at:_http:__boxedapp.com_boxedapppacker_order.html
call fcn.100030a0
test edi, edi
push 4
pop ebx
jne 0x10001e07
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], edi
call fcn.10001509
pop ecx
pop ecx
push edi
push edi
push 1
push edi
push 1
push 0x40000000
mov esi, 0x1002b740
push esi
call fcn.100030c0
push edi
lea ecx, [esp + 0x28]
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x28], eax
push dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.BoxedAppSDK_EnableDebugLog
call fcn.10002780
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100030b0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_WriteLogA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003220
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_WriteLogW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
mov dword [esp + 0x1c], eax
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003520
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_SetLogFileA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003d80
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_SetLogFileW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, fcn.10003a90
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateVirtualFileA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003340
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateVirtualFileW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, fcn.100030c0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateVirtualRegKeyA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100033a0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateVirtualRegKeyW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100030d0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_RegisterCOMLibraryInVirtualRegistryA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003440
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_RegisterCOMLibraryInVirtualRegistryW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov ecx, 0x10003140
mov eax, dword [esp + 0x10]
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_EnableOption
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, fcn.10003150
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_IsOptionEnabled
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003160
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_AddHandler
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003170
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_RemoveHandler
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov ecx, 0x10003180
sub ecx, edi
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_Alloc
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003190
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_Free
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, fcn.100031a0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_DeleteFileFromVirtualFileSystemA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003480
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_DeleteFileFromVirtualFileSystemW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100031c0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateProcessFromMemoryA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003b30
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateProcessFromMemoryW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100031d0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateVirtualFileBasedOnIStreamA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100034c0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_CreateVirtualFileBasedOnIStreamW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100031e0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_AttachToProcess
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100031f0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_DetachFromProcess
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003210
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_ExecuteDotNetApplicationW
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, fcn.10008c90
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_ExecuteDotNetApplicationA
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10009280
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_GetInternalValue
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x100043a0
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_HookFunction
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003640
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_GetOriginalFunction
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003290
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_EnableHook
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003250
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
push str.BoxedAppSDK_UnhookFunction
call fcn.10002780
pop ecx
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0x10003570
sub ecx, edi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x10]
push ebx
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.BoxedAppSDK_CreateVirtualFileA
push edi
call esi
push str.BoxedAppSDK_CreateVirtualFileW
push edi
call esi
push str.BoxedAppSDK_RegisterCOMLibraryInVirtualRegistryA
push edi
call esi
push str.BoxedAppSDK_RegisterCOMLibraryInVirtualRegistryW
push edi
call esi
push str.BoxedAppSDK_SetLogFileA
push edi
mov dword [esp + 0x8c], eax
call esi
push str.BoxedAppSDK_SetLogFileW
push edi
call esi
push str.BoxedAppSDK_WriteLogA
push edi
mov dword [esp + 0x1c], eax
call esi
push str.BoxedAppSDK_EnableDebugLog
push edi
mov dword [esp + 0x18], eax
call esi
push str.BoxedAppSDK_EnableOption
push edi
mov dword [esp + 0x24], eax
call esi
push str.BoxedAppSDK_CreateVirtualRegKeyW
push edi
mov dword [0x1005c704], eax
call esi
push str.BoxedAppSDK_CreateVirtualFileW
push edi
mov dword [0x1005c708], eax
call esi
push str.BoxedAppSDK_DeleteFileFromVirtualFileSystemW
push edi
mov dword [0x1005c700], eax
call esi
push str.BoxedAppSDK_ExecuteDotNetApplicationW
push edi
mov dword [0x1005c6fc], eax
call esi
push ebx
push dword [ebp + 8]
mov dword [0x1005c6f8], eax
lea eax, [esp + 0x6c]
push eax
call dword [0x1005c6f0]
push dword [esp + 0x64]
add dword [ebp + 8], ebx
call dword [esp + 0x20]
cmp dword [esp + 0x64], 0
je 0x10001ee5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xa4]
push str.BoxedAppLog__d.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0xa0]
push eax
call dword [esp + 0x18]
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x90]
push eax
call dword [0x1005c6f0]
push dword [esp + 0x88]
add dword [ebp + 8], ebx
push 6
call dword [0x1005c704]
push str.Get_exe_dir..._r_n
call dword [esp + 0x14]
push 1
lea ecx, [esp + 0x34]
call fcn.100013e9
push 1
lea ecx, [esp + 0x2c]
call fcn.100013e9
mov ecx, dword [esp + 0x28]
xor eax, eax
push 0x11
pop edi
mov word [ecx], ax
push edi
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
call fcn.10002dc1
push 0x22
push dword [esp + 0x34]
call dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x10001f75
cmp eax, edi
jb 0x10001f84
add edi, 0x10
push edi
lea ecx, [esp + 0x34]
call fcn.10002dc1
lea eax, [edi + edi]
push eax
push dword [esp + 0x34]
call dword [esp + 0x20]
push edi
push dword [esp + 0x34]
push 0
call esi
test eax, eax
jne 0x10001f58
jmp 0x10001fd8
lea edi, [esp + 0x30]
lea esi, [esp + 0x74]
call fcn.10002d8f
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
dec esi
js 0x10001fd8
mov edi, dword [esp + 0x30]
cmp word [edi + esi*2], 0x5c
je 0x10001fb0
dec esi
jns 0x10001fa4
jmp 0x10001fd8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, esi
push eax
lea ecx, [esp + 0x2c]
call fcn.10001424
lea esi, [edi + esi*2]
lea eax, [esi + 2]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and word [esi], 0
push str.Get_exe_dir...done_r_n
call dword [esp + 0x14]
push 1
lea ecx, [esp + 0x3c]
call fcn.100013e9
mov eax, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x40]
mov word [eax], di
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call fcn.100014bb
cmp dword [esp + 0x2c], edi
jbe 0x10002037
push dword [esp + 0x2c]
lea ecx, [esp + 0x44]
call fcn.10002dc1
mov edx, dword [esp + 0x44]
cmp edx, edi
jbe 0x10002037
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov si, word [ecx + eax]
mov word [eax], si
inc eax
inc eax
dec edx
jne 0x1000202b
push str.Get_the_extension..._r_n
call dword [esp + 0x14]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
jmp 0x100020a9
mov eax, dword [esp + 0x28]
lea eax, [eax + esi*2]
cmp word [eax], 0x2e
mov dword [esp + 0x1c], eax
jne 0x100020a9
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, esi
push eax
lea ecx, [esp + 0x3c]
call fcn.10001424
mov eax, dword [esp + 0x1c]
add eax, 2
push eax
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x44]
call fcn.10001424
mov ecx, dword [esp + 0x40]
lea eax, [esi + esi]
push eax
push dword [esp + 0x2c]
mov word [ecx + eax], di
push ecx
call dword [esp + 0x54]
dec esi
jns 0x1000204e
push str.Get_the_extension...done_r_n
call dword [esp + 0x14]
push str.Get_current_dir..._r_n
call dword [esp + 0x14]
push 1
lea ecx, [esp + 0x5c]
call fcn.100013e9
push dword [esp + 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 1
call esi
mov dword [esp + 0x14], eax
inc eax
push eax
lea ecx, [esp + 0x5c]
call fcn.10002dc1
mov eax, dword [esp + 0x14]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x5c]
call dword [esp + 0x20]
push dword [esp + 0x58]
push dword [esp + 0x18]
call esi
push str.Get_current_dir...done_r_n
call dword [esp + 0x14]
push dword [esp + 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.CurDir
call esi
push dword [esp + 0x30]
push str.ExeDir
call esi
push dword [esp + 0x28]
push str.BoxedAppVar:ExeFileName
call esi
push dword [esp + 0x38]
push str.BoxedAppVar:ExeFileExtension
call esi
push dword [esp + 0x40]
push str.BoxedAppVar:ExeFileNameWithoutExtension
call esi
push dword [esp + 0x74]
push str.BoxedAppVar:ExeFullPath
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.BoxedAppVar:OldCmdLine
mov dword [esp + 0x1c], eax
call esi
push str.Get_old_args..._r_n
call dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
lea ecx, [esp + 0x90]
call fcn.100013e9
mov eax, dword [esp + 0x8c]
push dword [esp + 0x14]
mov word [eax], di
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [esp + 0x8c]
mov ecx, eax
movzx eax, word [eax]
xor edx, edx
cmp ax, di
je 0x100021d7
movzx eax, ax
cmp ax, 0x22
jne 0x100021bf
cmp edx, edi
jne 0x100021d5
xor edx, edx
inc edx
jmp 0x100021c9
cmp ax, 0x20
jne 0x100021c9
cmp edx, edi
je 0x100021d5
inc ecx
inc ecx
movzx eax, word [ecx]
cmp ax, di
jne 0x100021b0
jmp 0x100021d7
inc ecx
inc ecx
push ecx
push str.BoxedAppVar:OldArgs
call esi
push str.Get_old_args...done_r_n
call dword [esp + 0x14]
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x70]
push eax
call dword [0x1005c6f0]
add dword [ebp + 8], ebx
cmp dword [esp + 0x68], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x1c], edi
je 0x1000230c
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
call dword [0x1005c6f0]
mov eax, dword [esp + 0xc]
add dword [ebp + 8], ebx
inc eax
push eax
lea ecx, [esp + 0x98]
call fcn.100013e9
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x94]
lea eax, [eax + eax + 2]
push eax
push esi
call dword [0x1005c6f4]
mov eax, dword [esp + 0xc]
add eax, eax
push eax
push dword [ebp + 8]
push esi
call dword [0x1005c6f0]
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 0xc]
lea eax, [ecx + eax*2]
mov dword [ebp + 8], eax
mov eax, esi
call fcn.1000158d
push esi
lea eax, [esp + 0x80]
call fcn.1000154a
mov esi, dword [esp + 0x80]
pop ecx
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x28], esi
call dword [0x1005c6f0]
push dword [esp + 0x20]
add dword [ebp + 8], ebx
lea ecx, [esp + 0x4c]
call fcn.10002def
push dword [esp + 0x20]
push dword [ebp + 8]
push dword [esp + 0x50]
call dword [0x1005c6f0]
mov eax, dword [esp + 0x20]
add dword [ebp + 8], eax
push edi
push edi
push 2
push edi
push 1
push 0x40000000
push esi
call dword [0x1005c700]
push edi
mov esi, eax
lea eax, [esp + 0xa0]
push eax
push dword [esp + 0x28]
push dword [esp + 0x54]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x48]
call fcn.100014bb
lea ecx, [esp + 0x94]
call fcn.100014bb
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x68]
push eax
call dword [0x1005c6f0]
add dword [ebp + 8], ebx
cmp dword [esp + 0x60], edi
mov eax, 0x1002bf44
jne 0x1000232e
mov eax, 0x1002bf4c
push eax
lea eax, [esp + 0x2ac]
push str.The_command_line_overriding:__s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x2a8]
push eax
call dword [esp + 0x14]
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x2c]
push eax
call dword [0x1005c6f0]
add dword [ebp + 8], ebx
cmp dword [esp + 0x24], edi
jbe 0x100024db
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [esp + 0x24]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10002e89
mov esi, eax
mov eax, dword [esp + 0x28]
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
mov dword [esp + 0x50], esi
call dword [esp + 0x20]
mov eax, dword [esp + 0x24]
add eax, eax
push eax
push dword [ebp + 8]
push esi
call dword [0x1005c6f0]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x24]
xor edi, edi
cmp dword [esp + 0x60], edi
lea eax, [eax + ecx*2]
mov dword [ebp + 8], eax
je 0x100024db
mov eax, esi
call fcn.1000158d
push 8
call fcn.10002e89
cmp eax, edi
pop ecx
je 0x100023eb
mov dword [eax], edi
mov dword [eax + 4], edi
mov esi, eax
jmp 0x100023ed
xor esi, esi
push dword [esp + 0x48]
mov eax, esi
call fcn.1000154a
mov esi, dword [esi]
pop ecx
push esi
mov dword [0x1005c718], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push edi
push edi
push edi
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.10002e89
pop ecx
mov ecx, dword [esp + 0x14]
inc ecx
push ecx
push eax
mov dword [0x1005c714], eax
call dword [esp + 0x20]
push edi
push edi
push dword [esp + 0x1c]
push dword [0x1005c714]
push dword [esp + 0x24]
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push str.GetCommandLineW_preparing_to_intercept..._r_n
call dword [esp + 0x14]
push 0x1c
call fcn.10002e89
mov esi, eax
cmp esi, edi
pop ecx
je 0x10002473
push 0x1002bfa4
mov eax, 0x10001690
call fcn.10001077
jmp 0x10002475
xor eax, eax
mov ecx, dword [eax + 4]
cmp ecx, edi
je 0x1000248a
add eax, 0x11
push eax
mov edi, ecx
call fcn.10001034
pop ecx
xor edi, edi
push str.GetCommandLineW_preparing_to_intercept...done_r_n
call dword [esp + 0x14]
push str.GetCommandLineA_preparing_to_intercept..._r_n
call dword [esp + 0x14]
push 0x1c
call fcn.10002e89
mov esi, eax
cmp esi, edi
pop ecx
je 0x100024bb
push str.GetCommandLineA
mov eax, 0x10001696
call fcn.10001077
jmp 0x100024bd
xor eax, eax
mov ecx, dword [eax + 4]
cmp ecx, edi
je 0x100024d2
add eax, 0x11
push eax
mov edi, ecx
call fcn.10001034
pop ecx
xor edi, edi
push str.GetCommandLineA_preparing_to_intercept...done_r_n
call dword [esp + 0x14]
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x74]
push eax
call dword [0x1005c6f0]
add dword [ebp + 8], ebx
cmp dword [esp + 0x6c], edi
mov eax, 0x1002bf44
jne 0x100024fd
mov eax, 0x1002bf4c
push eax
lea eax, [esp + 0x2ac]
push str.The_embedding_BoxedApp_into_child_processes:__s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x2a8]
push eax
call dword [esp + 0x14]
push dword [esp + 0x6c]
push 2
call dword [0x1005c704]
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [ebp + 8]
push eax
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
call fcn.10002b73
add esp, 0xc
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x78]
push eax
call dword [0x1005c6f0]
push dword [esp + 0x70]
add dword [ebp + 8], ebx
push 5
call dword [0x1005c704]
cmp dword [esp + 0x70], edi
je 0x10002579
push edi
lea eax, [ebp + 8]
push edi
push eax
call fcn.100027cb
add esp, 0xc
mov eax, dword [esp + 0x50]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x1000261e
mov esi, dword [esp + 0x14]
cmp dword [esi + 8], edi
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
je 0x100025a2
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [esi + 0xc], edi
je 0x100025b1
push dword [esi + 0x14]
call dword [esp + 0x88]
cmp dword [esi + 0x10], edi
je 0x10002614
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
lea eax, [esp + 0x1c]
push eax
call dword [0x1005c6f4]
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
cmp dword [esp + 0x18], edi
je 0x1000260e
push 1
push 1
call fcn.10003150
push edi
push dword [esi + 0x14]
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
push edi
push 1
call fcn.10003150
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x1000260e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x18], edi
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x14], edi
jne 0x10002589
cmp dword [esp + 0x68], edi
je 0x10002701
push 0x1002c0a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x1002c0b8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
xor ebx, ebx
inc ebx
xor esi, esi
cmp dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
jle 0x10002676
mov eax, dword [esp + 0x14]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc ebx
cmp ebx, dword [esp + 0x18]
lea esi, [esi + eax + 3]
jl 0x1000265e
push esi
lea ecx, [esp + 0x3c]
call fcn.100013e9
cmp esi, edi
jne 0x1000268a
mov dword [esp + 0x10], edi
jmp 0x100026dd
mov eax, dword [esp + 0x38]
xor ebx, ebx
inc ebx
mov word [eax], di
cmp dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
jle 0x100026dd
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1002c0cc
push dword [esp + 0x3c]
call edi
mov eax, dword [esp + 0x14]
push dword [eax + ebx*4]
push dword [esp + 0x3c]
call edi
mov eax, dword [esp + 0x18]
dec eax
cmp eax, ebx
mov eax, 0x1002c0cc
je 0x100026cf
mov eax, 0x1002c0d0
push eax
push dword [esp + 0x3c]
call edi
inc ebx
cmp ebx, dword [esp + 0x18]
jl 0x100026a4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
neg esi
sbb esi, esi
and esi, dword [esp + 0x10]
push esi
push dword [esp + 0x20]
call dword [0x1005c6f8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [esp + 0x50]
cmp esi, edi
je 0x10002721
mov ebx, dword [esi + 4]
lea ecx, [esi + 0x14]
call fcn.100014bb
push esi
call fcn.10002e75
cmp ebx, edi
pop ecx
mov esi, ebx
jne 0x10002709
lea ecx, [esp + 0x7c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], edi
call fcn.100014bb
lea ecx, [esp + 0x8c]
call fcn.100014bb
lea ecx, [esp + 0x58]
call fcn.100014bb
lea ecx, [esp + 0x40]
call fcn.100014bb
lea ecx, [esp + 0x38]
call fcn.100014bb
lea ecx, [esp + 0x74]
call fcn.100014bb
lea ecx, [esp + 0x28]
call fcn.100014bb
lea ecx, [esp + 0x30]
call fcn.100014bb
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 4