Function at 0x42f73c
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Check os version
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Get file attributes
Get hostname
Get number of processors
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a94a4
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3054
call fcn.004916c0
mov eax, dword [0x4ccc64]
xor eax, esp
mov dword [esp + 0x3050], eax
push ebx
push esi
push edi
mov eax, dword [0x4ccc64]
xor eax, esp
push eax
lea eax, [esp + 0x3068]
mov dword fs:[0], eax
lea eax, [esp + 0xac]
push eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0xb0], 8
mov dword [esp + 0xb4], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x38]
call fcn.00486a8b
mov ebx, 0x4b04e0
push ebx
lea ecx, [esp + 0x88]
call fcn.00421197
xor edi, edi
push ebx
lea ecx, [esp + 0x64]
mov dword [esp + 0x3074], edi
call fcn.00421197
push ebx
lea ecx, [esp + 0x74]
mov byte [esp + 0x3074], 1
call fcn.00421197
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x3074], 2
call fcn.00452e90
pop ecx
lea eax, [esp + 0x64]
mov byte [esp + 0x3070], 3
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x50], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x38], edi
call fcn.00452e90
pop ecx
push dword [eax]
call fcn.0048cb7a
pop ecx
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
mov dword [0x4d1a10], eax
call fcn.0042001a
cmp esi, edi
je 0x430a6b
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jle 0x430a6b
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], 2
mov eax, dword [esp + 0x44]
push ecx
lea edi, [esi + eax*4]
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [edi]
call fcn.00421197
call fcn.0042eee1
mov dword [esp], 0x4b408c
call fcn.0048bfa0
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.0048ca33
add esp, 0xc
test eax, eax
jne 0x42f8ca
push 0x4b408c
call fcn.0048bfa0
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x40]
call fcn.004214a8
push str._Confirm
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42f8e4
mov dword [esp + 0x54], 1
push str._Quiet
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42f8ff
and dword [esp + 0x14], eax
jmp 0x430009
push str._AllUsers
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42f950
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00452ce0
test eax, eax
je 0x430024
call fcn.00452e40
test eax, eax
jne 0x430009
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Admin_rights_required
jmp 0x43003d
push str._ErrorsOnly
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42f96f
mov dword [esp + 0x14], 1
jmp 0x430009
push str._Stop
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x43004f
push str._Remove
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x430156
push str._Remove:Proc
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x430419
push str._Remove:Reg
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x43059a
push str._LearnStreaming
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x433ab0
push 0x4b46a4
call fcn.0048bfa0
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.0048ca33
add esp, 0xc
test eax, eax
je 0x433ab0
push str._UpdateBasicSettings
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42fa1f
mov dword [esp + 0x4c], 1
jmp 0x430009
push str._Repackage
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x43073c
push str._CreateDiff
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x4338ff
push 0x4b48d8
call fcn.0048bfa0
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.0048ca33
add esp, 0xc
test eax, eax
je 0x4338ff
push str._exec
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x43090a
push 0x4b4924
call fcn.0048bfa0
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.0048ca33
add esp, 0xc
test eax, eax
je 0x4333e2
push 0x4b493c
call fcn.0048bfa0
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.0048ca33
add esp, 0xc
test eax, eax
je 0x4333e2
push str._ShowStreaming
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x430b8d
push str._Break
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x430c73
push str._Unbreak
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x4311da
push str._Integrate
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x4330ed
push str._FullIntegrate
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x4330ed
push str._Unintegrate
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x43187f
push str._CreateShortcuts
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x4318cf
push str._Perf
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x431ca0
push str._ExtractLog
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432017
push str._Info
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432197
push str._EngineVer
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42fcfb
push 1
push eax
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
lea eax, [esp + 0x150]
push eax
call fcn.004229f3
mov byte [esp + 0x3070], 0xab
cmp dword [esp + 0x1d0], 0
je 0x432618
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str._s.AppVirtDll.dll
push eax
call fcn.00453c70
lea eax, [esp + 0x3c]
add esp, 0xc
push eax
call fcn.00453400
add esp, 4
mov byte [esp + 0x3074], 0xac
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3078], 0xad
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Main
call fcn.00421197
push 2
lea eax, [esp + 0x150]
push eax
mov byte [esp + 0x3080], 0xac
call fcn.00467fd0
push dword [esp + 0x14]
lea eax, [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421182
lea eax, [esp + 0x64]
push eax
call fcn.00478d80
add esp, 4
mov byte [esp + 0x3078], 0xae
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
mov byte [esp + 0x3070], 0xac
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421182
call fcn.00457070
pop ecx
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x144]
push eax
mov byte [esp + 0x3074], 3
call fcn.00422ab2
jmp 0x430009
push str._ChangeLoader
push dword [esi + 4]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42fd1c
mov eax, dword [esp + 0x50]
cmp dword [esp + 0x64], eax
jg 0x432628
push str._ChangeEngine
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42fd3c
mov eax, dword [esp + 0x50]
cmp dword [esp + 0x64], eax
jg 0x432926
push str._Debug
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432b47
push str._ForceMenu
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42fd71
mov dword [esp + 0x20], 1
jmp 0x430009
push str._ShowTree
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432be6
push str._DbgZip:
call fcn.0048c02b
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.0048ca33
add esp, 0xc
test eax, eax
je 0x432caa
push str._DbgNow
call fcn.0048c02b
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.0048ca33
add esp, 0xc
test eax, eax
jne 0x42fe88
push ebx
lea ecx, [esp + 0x34]
call fcn.00421197
lea eax, [esp + 0x2f4]
push eax
mov byte [esp + 0x3074], 0xcb
call fcn.00425e01
lea eax, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x3078], 0xcc
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Prog1._Prog1.._Prog1..._Prog2._Prog2.._Prog2...
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0xcd
mov ecx, esp
mov dword [esp + 0x54], esp
push str.FriendlyName
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0xce
mov ecx, esp
mov dword [esp + 0x28], esp
push str.AppID
call fcn.00421197
lea ecx, [esp + 0x304]
mov byte [esp + 0x3080], 0xcc
call fcn.004253a3
test eax, eax
je 0x42fe62
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], 0
jne 0x432ce9
lea eax, [esp + 0x2f4]
push eax
mov byte [esp + 0x3074], 0xcb
call fcn.00425f11
mov byte [esp + 0x3070], 3
mov ecx, dword [esp + 0x30]
jmp 0x430001
push str._Manager
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432d0a
push str._ProcessList
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432d14
push str._GfxSvr
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42ff05
call fcn.0042d81e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
push 0x401
mov ebx, 0x4d19d0
call fcn.00465d00
mov dword [esp], 0xbb8
call edi
push 0x403
call fcn.00465d00
mov dword [esp], 0x493e0
call edi
jmp 0x42ff6f
push 0x4b5c58
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x42ff79
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.open
xor edi, edi
xor ebx, ebx
call fcn.00421197
push edi
push ecx
mov byte [esp + 0x307c], 0xd9
mov ecx, esp
mov dword [esp + 0x28], esp
push str._Troubleshoot
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0xda
lea eax, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 3
call fcn.004526e0
add esp, 0x10
mov ebx, 0x4b04e0
jmp 0x430009
push str._Troubleshoot
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432faa
push str._AutoUpdate
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x432fca
push str._VirtRegSyncExport
push dword [edi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
je 0x433088
push 0x4b5248
lea ecx, [esp + 0x64]
call fcn.004211db
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [esi]
call fcn.00421197
lea eax, [esp + 0x44]
push eax
call fcn.00458da0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x3074], 0xdd
call fcn.00422361
mov byte [esp + 0x3070], 3
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
inc dword [esp + 0x44]
mov eax, dword [esp + 0x44]
inc dword [esp + 0x50]
cmp eax, dword [esp + 0x64]
jl 0x42f875
jmp 0x430a69
call fcn.00452d30
test eax, eax
jne 0x430047
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Elevation_failed
call fcn.00421197
call fcn.0042f6bc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.00421360
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x430081
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x43003d
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [0x4d1a10]
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 4
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [0x4d19d8]
call fcn.00421197
mov byte [esp + 0x3078], 3
call fcn.0042bda3
pop ecx
pop ecx
test eax, eax
je 0x4300e4
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str.Cannot_stop_application__s
push eax
call fcn.00453c70
add esp, 0xc
jmp 0x430042
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.__Stopped_successfully
call fcn.00421197
call fcn.0042eee1
pop ecx
xor esi, esi
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x84]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, esi
mov ecx, dword [esp + 0x3068]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3050]
xor ecx, esp
call fcn.0048b97b
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.00421360
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x430186
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x43007a
mov eax, dword [0x4d1a0c]
xor esi, esi
cmp word [eax], si
jne 0x4301ad
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str.Cannot_obtain_base_dir_for__s
jmp 0x4300d6
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421197
call fcn.00456490
pop ecx
cmp eax, esi
jne 0x4301ee
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d1a0c]
push dword [0x4d19d8]
push str.Application_is_not_deployed_on_this_machine:__s_n_n__s_
push eax
call fcn.00453c70
add esp, 0x10
jmp 0x430042
cmp dword [esp + 0x54], esi
je 0x430215
push 3
push dword [0x4d19d8]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x430215
push 0x14
pop esi
jmp 0x4300fd
lea eax, [esp + 0x4c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AllUsers
mov dword [esp + 0x58], esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 5
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4d19d8]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.00453c70
add esp, 0xc
mov byte [esp + 0x307c], 3
call fcn.00454da0
add esp, 0xc
cmp eax, esi
je 0x4302b4
cmp dword [esp + 0x4c], esi
je 0x4302b4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00452ce0
test eax, eax
jne 0x43029b
call fcn.00452d30
test eax, eax
jne 0x432191
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x430038
call fcn.00452e40
test eax, eax
jne 0x4302b4
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x42f946
call fcn.00429894
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d19d8]
push str.Removing__s
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042eee1
pop ecx
call fcn.0047dccb
push eax
lea ecx, [esp + 0x3c]
call fcn.00434103
push 0x4b11ac
mov byte [esp + 0x3074], 6
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [esp + 0x14]
push 1
push 1
push 1
lea eax, [esp + 0x44]
push eax
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push dword [0x4d1a10]
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 7
mov ecx, esp
mov dword [esp + 0x38], esp
push dword [0x4d1a0c]
call fcn.00421197
push ecx
mov byte [esp + 0x3090], 8
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d19d8]
call fcn.00421197
mov byte [esp + 0x3090], 6
call fcn.0042c0ee
add esp, 0x1c
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [0x4d1a0c]
call fcn.00421197
call fcn.004564d0
pop ecx
cmp eax, esi
je 0x430395
push ebx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x4300d6
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d19d8]
push edi
push eax
call fcn.00453c70
add esp, 0xc
call fcn.00455010
pop ecx
cmp eax, esi
je 0x4303ce
push ebx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str.Registry_could_not_be_emptied_for__s
jmp 0x4300d6
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.__Removed_successfully
call fcn.00421197
call fcn.0042eee1
pop ecx
push ebx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str.Application__s_removed_successfully
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x4300fd
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.00421360
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x430449
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x43007a
mov eax, dword [0x4d1a0c]
xor esi, esi
cmp word [eax], si
jne 0x430465
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
jmp 0x43019d
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421197
call fcn.00456490
pop ecx
cmp eax, esi
jne 0x43048c
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
jmp 0x4301cf
cmp dword [esp + 0x54], esi
je 0x4304af
push 3
push dword [0x4d19d8]
push str.Do_you_want_to_stop_the_application_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x43020d
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d19d8]
push str.Removing_processes:__s
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042eee1
pop ecx
call fcn.0047dccb
push eax
lea ecx, [esp + 0x50]
call fcn.00434103
push 0x4b11ac
mov byte [esp + 0x3074], 9
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push esi
push 1
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x24]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push dword [0x4d1a10]
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0xa
mov ecx, esp
mov dword [esp + 0x38], esp
push dword [0x4d1a0c]
call fcn.00421197
push ecx
mov byte [esp + 0x3090], 0xb
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d19d8]
call fcn.00421197
mov byte [esp + 0x3090], 9
call fcn.0042c0ee
add esp, 0x1c
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.__Stopped_successfully
call fcn.00421197
call fcn.0042eee1
pop ecx
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str.Application__s_stopped_successfully
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
mov ecx, dword [esp + 0x4c]
jmp 0x43040c
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.00421360
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x4305ca
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x43007a
mov eax, dword [0x4d1a0c]
xor esi, esi
cmp word [eax], si
jne 0x4305e6
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
jmp 0x43019d
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421197
call fcn.00456490
pop ecx
cmp eax, esi
jne 0x43060d
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
jmp 0x4301cf
cmp dword [esp + 0x54], esi
je 0x430630
push 3
push dword [0x4d19d8]
push str.Do_you_want_to_remove_the_applications_registry_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x43020d
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d19d8]
push str.Removing_registry:__s
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042eee1
pop ecx
call fcn.0047dccb
push eax
lea ecx, [esp + 0x50]
call fcn.00434103
push 0x4b11ac
mov byte [esp + 0x3074], 0xc
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push 1
push esi
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x24]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push dword [0x4d1a10]
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0xd
mov ecx, esp
mov dword [esp + 0x38], esp
push dword [0x4d1a0c]
call fcn.00421197
push ecx
mov byte [esp + 0x3090], 0xe
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d19d8]
call fcn.00421197
mov byte [esp + 0x3090], 0xc
call fcn.0042c0ee
add esp, 0x1c
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d19d8]
push str.SoftwareVOS_s
push eax
call fcn.00453c70
add esp, 0xc
call fcn.00455010
pop ecx
cmp eax, esi
je 0x43070a
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
jmp 0x4303be
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.__Registry_removed_successfully
call fcn.00421197
call fcn.0042eee1
pop ecx
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str.Application__ss_registry_removed_successfully
jmp 0x430581
call fcn.0047dccb
push eax
lea ecx, [esp + 0x54]
call fcn.00434103
mov byte [esp + 0x3070], 0x16
call fcn.0047dccb
push eax
lea ecx, [esp + 0x58]
call fcn.00434103
mov byte [esp + 0x3070], 0x17
mov eax, dword [esp + 0x44]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
lea ecx, [esp + 0x50]
jle 0x430786
push dword [esi + eax*4 + 4]
call fcn.004214a8
jmp 0x430790
lea eax, [esp + 0x3c]
push eax
call fcn.004226f7
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str..new.exe
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x18
lea eax, [esp + 0x58]
mov dword [esp + 0x24], esp
mov ecx, esp
push eax
call fcn.00421360
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x307c], 0x17
call fcn.00453fc0
add esp, 0xc
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x3074], 0x19
call fcn.004226f7
mov byte [esp + 0x3070], 0x17
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x50]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x54]
jne 0x43082e
push dword [esp + 0x14]
push ecx
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00421360
jmp 0x430042
push 0
push dword [esp + 0x50]
push ecx
mov dword [esp + 0x24], esp
mov ecx, esp
push eax
call fcn.00421360
push ecx
mov byte [esp + 0x3080], 0x1a
lea eax, [esp + 0x60]
mov dword [esp + 0x2c], esp
mov ecx, esp
push eax
call fcn.00421360
mov byte [esp + 0x3080], 0x17
call fcn.00429fee
add esp, 0x10
mov dword [esp + 0x40], eax
test eax, eax
jne 0x4308c4
push dword [esp + 0x14]
lea eax, [esp + 0x58]
push 0x5c
push ecx
mov dword [esp + 0x24], esp
mov ecx, esp
push eax
call fcn.00421360
lea eax, [esp + 0x4c]
push eax
call fcn.00454180
add esp, 8
mov byte [esp + 0x3078], 0x1b
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
mov ecx, dword [esp + 0x40]
jmp 0x433c41
push edi
call esi
mov edx, dword [esp + 0x40]
push dword [esp + 0x14]
cmp edx, 0x10
jne 0x4308e5
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x43003d
lea eax, [esp + 0x1c]
push eax
call fcn.00459fc0
mov byte [esp + 0x3078], 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x4300d7
mov eax, dword [esp + 0x44]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [esi + eax*4]
call fcn.00421197
lea eax, [esp + 0x44]
push eax
call fcn.00458da0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x3074], 0x24
call fcn.00422361
push eax
lea ecx, [esp + 0x64]
call fcn.00422361
push eax
lea ecx, [esp + 0x34]
call fcn.00421182
mov byte [esp + 0x3070], 0x26
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
push 1
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x38]
call fcn.00423bc8
push 0x4b2b58
push eax
call fcn.00422561
pop ecx
pop ecx
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
mov byte [esp + 0x5b], al
call fcn.0042001a
cmp byte [esp + 0x5b], 0
lea ecx, [esp + 0x60]
je 0x4309a1
push 1
push 0x22
jmp 0x4309a5
push 0
push 0x20
call fcn.00423b4d
mov esi, eax
cmp esi, 0xffffffff
je 0x430a14
push esi
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x68]
call fcn.00423bc8
push 0x4b491c
mov byte [esp + 0x3074], 0x27
call fcn.00429c4c
push eax
lea ecx, [esp + 0x64]
call fcn.00422361
mov byte [esp + 0x3070], 0x26
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
push 0
lea ecx, [esp + 0x74]
lea eax, [esi + 1]
push ecx
call fcn.00423ad1
lea eax, [esp + 0x70]
call fcn.004224aa
push eax
lea ecx, [esp + 0x74]
call fcn.00422361
jmp 0x430a36
push 0x4b491c
lea eax, [esp + 0x34]
call fcn.00429c4c
push eax
lea ecx, [esp + 0x64]
call fcn.00422361
push ebx
lea ecx, [esp + 0x74]
call fcn.004211db
xor ecx, ecx
lea eax, [esp + 0x60]
call fcn.00433d26
movzx eax, ax
cmp ax, 0x25
jne 0x430a55
lea eax, [esp + 0x60]
push eax
call fcn.0046bcd0
pop ecx
mov byte [esp + 0x3070], 3
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042001a
xor edi, edi
push 1
push edi
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x270]
push eax
call fcn.004229f3
push ecx
mov byte [esp + 0x3074], 0xde
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3078], 0xdf
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x307c], 0xe0
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421182
mov byte [esp + 0x307c], 0xe1
push dword [esp + 0x2c]
lea eax, [esp + 0x4c]
push ecx
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
call fcn.00421182
lea ecx, [esp + 0x278]
mov byte [esp + 0x3084], 0xde
call fcn.0042758d
add esp, 0x14
cmp eax, 2
jne 0x433c8d
call fcn.0042f63b
push edi
push dword [0x4d19d8]
push str.Application_is_now_integrated_into_your_system
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x264]
call fcn.00466ec0
lea eax, [esp + 0x264]
push eax
mov byte [esp + 0x3074], 3
call fcn.00422ab2
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x70]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x60]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x84]
add ecx, 0xfffffff0
call fcn.0042001a
xor eax, eax
jmp 0x430132
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ShowStreaming:
call fcn.00421197
call fcn.0042eee1
pop ecx
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421182
lea eax, [esp + 0xc0]
push eax
call fcn.004229f3
push ecx
mov byte [esp + 0x3074], 0x37
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x38
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x39
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421182
push 2
push ecx
mov byte [esp + 0x3084], 0x3a
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421182
lea ecx, [esp + 0xc8]
mov byte [esp + 0x3084], 0x37
call fcn.0042758d
lea eax, [esp + 0xc8]
add esp, 0x14
push eax
call fcn.00427419
pop ecx
lea eax, [esp + 0xb4]
call fcn.00466ec0
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x3074], 3
call fcn.00422ab2
jmp 0x4300fd
lea ecx, [esp + 0x2c]
call fcn.0042048a
mov byte [esp + 0x3070], 0x3b
mov eax, dword [esp + 0x44]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
lea ecx, [esp + 0x2c]
jle 0x430ca0
push dword [esi + eax*4 + 4]
call fcn.004211db
jmp 0x430caa
lea eax, [esp + 0x3c]
push eax
call fcn.00422361
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str..break
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x3c
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421182
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x307c], 0x3b
call fcn.00453fc0
add esp, 0xc
push 1
push 0
push ecx
mov byte [esp + 0x307c], 0x3d
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421182
lea eax, [esp + 0xc0]
push eax
call fcn.004229f3
mov byte [esp + 0x3070], 0x3e
cmp dword [esp + 0x140], 0
jne 0x430d3a
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Could_not_load_containers_
jmp 0x43003d
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421182
call fcn.00455ab0
pop ecx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430d79
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [esp + 0x28]
push str.Cant_empty__s
jmp 0x4300d6
mov esi, dword [esp + 0x20]
call fcn.00456520
test eax, eax
jne 0x430d9f
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [esp + 0x28]
push str.Cant_create__s
jmp 0x4300d6
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
mov esi, 0x4b11ac
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x3f
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x4b0b60
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x40
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x41
mov ecx, esp
mov dword [esp + 0x24], esp
mov ebx, str.Main
push ebx
call fcn.00421197
push 3
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x42
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll.dll
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x43
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x44
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push 2
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x45
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll64.dll
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x46
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x47
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push 8
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x48
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtFiles.db
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x49
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x4a
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push 4
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x4b
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SandboxCfg.db
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x4c
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x4d
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push 5
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x4e
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtReg.export
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x4f
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x50
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push 6
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x51
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SysDllSubdirs.txt
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x52
mov ecx, esp
lea eax, [esp + 0x30]
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x53
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push 7
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push ecx
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x54
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Core.zip
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x55
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x3e
call fcn.00453850
add esp, 8
mov byte [esp + 0x3078], 0x56
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421197
push 1
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0x3e
call fcn.00467fd0
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [esp + 0x28]
push 0x4b4cec
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
jmp 0x430047
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unbreak:
call fcn.00421197
call fcn.0042eee1
mov ecx, esp
mov dword [esp + 0x1c], esp
push str..break
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x57
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421182
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x307c], 3
call fcn.00453fc0
add esp, 0xc
mov byte [esp + 0x3070], 0x58
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43125e
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [esp + 0x28]
push str.Dir_doesnt_exist:__s
jmp 0x4300d6
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
call fcn.00421182
mov esi, str..old
push esi
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x307c], 0x59
call fcn.00424585
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
push esi
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.00424585
add esp, 0xc
push dword [eax]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x5c]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x4312ec
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Could_not_rename_myself_to_.old
jmp 0x43003d
push esi
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00424585
mov eax, dword [eax]
add esp, 0xc
push 0
push dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x40]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x43133b
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Could_not_copy_myself
jmp 0x43003d
and dword [esp + 0x4c], 0
push 1
push ecx
mov dword [esp + 0x20], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4b11ac
lea ebx, [esp + 0x5c]
lea esi, [esp + 0x40]
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0x5a
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4b0b60
call fcn.00421197
push ecx
mov byte [esp + 0x3084], 0x5b
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x3084], 0x59
call fcn.00453850
add esp, 0xc
mov edi, esi
call fcn.00454710
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x43186a
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43186a
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x4c]
push eax
call fcn.00454470
pop ecx
mov byte [esp + 0x3070], 0x5c
push dword [esp + 0x30]
call fcn.0048c1d3
pop ecx
push 1
push 1
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421182
lea eax, [esp + 0xc0]
push eax
call fcn.004229f3
mov byte [esp + 0x3070], 0x5d
cmp dword [esp + 0x140], 0
jne 0x43142c
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Could_not_begin_to_update_resource
jmp 0x43003d
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov ebx, str.Main
push ebx
call fcn.00421197
mov byte [esp + 0x3074], 0x5e
mov eax, dword [esp + 0x50]
mov eax, dword [eax - 0xc]
add eax, eax
push 0
push eax
lea ecx, [esp + 0x58]
call fcn.00423d2d
push eax
lea esi, [esp + 0xc4]
mov byte [esp + 0x3080], 0x5d
call fcn.004677f0
test eax, eax
je 0x431489
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Could_not_update_INI_resource
jmp 0x43003d
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
push 0
push 2
push ecx
mov byte [esp + 0x3080], 0x5f
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
mov esi, 0x4b11ac
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x3088], 0x60
mov ecx, esp
mov dword [esp + 0x60], esp
push str.AppVirtDll.dll
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x61
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x308c], 0x5f
call fcn.00453850
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0x5d
call fcn.004678e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
push 0
push 8
push ecx
mov byte [esp + 0x3080], 0x62
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x3088], 0x63
mov ecx, esp
mov dword [esp + 0x60], esp
push str.AppVirtDll64.dll
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x64
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x308c], 0x62
call fcn.00453850
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0x5d
call fcn.004678e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
push 0x4000
push 4
push ecx
mov byte [esp + 0x3080], 0x65
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x3088], 0x66
mov ecx, esp
mov dword [esp + 0x60], esp
push str.VirtFiles.db
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x67
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x308c], 0x65
call fcn.00453850
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0x5d
call fcn.004678e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
push 0x4000
push 5
push ecx
mov byte [esp + 0x3080], 0x68
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x3088], 0x69
mov ecx, esp
mov dword [esp + 0x60], esp
push str.SandboxCfg.db
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x6a
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x308c], 0x68
call fcn.00453850
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0x5d
call fcn.004678e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
push 0x4000
push 6
push ecx
mov byte [esp + 0x3080], 0x6b
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x3088], 0x6c
mov ecx, esp
mov dword [esp + 0x60], esp
push str.VirtReg.export
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x6d
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x308c], 0x6b
call fcn.00453850
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0x5d
call fcn.004678e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
push 0
push 7
push ecx
mov byte [esp + 0x3080], 0x6e
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x3088], 0x6f
mov ecx, esp
mov dword [esp + 0x60], esp
push str.SysDllSubdirs.txt
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x70
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x308c], 0x6e
call fcn.00453850
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0x5d
call fcn.004678e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00421197
mov byte [esp + 0x3074], 0x71
push 0x4000
push 1
push ecx
mov dword [esp + 0x2c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.00421197
push ecx
mov byte [esp + 0x3088], 0x72
mov ecx, esp
mov dword [esp + 0x60], esp
push str.Core.zip
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x73
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421182
mov byte [esp + 0x308c], 0x71
call fcn.00453850
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0x5d
call fcn.004678e0
lea eax, [esp + 0xb4]
call fcn.00466ec0
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
test eax, eax
je 0x43185b
push str.Could_not_commit_resource
jmp 0x43003d
push str.Success
call fcn.00421197
jmp 0x4311ce
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Could_not_load_VirtApp.ini
jmp 0x43003d
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421182
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x4318af
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x43007a
call fcn.00429894
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push dword [0x4d19d8]
push str._s_is_no_longer_integrated.
jmp 0x4311c5
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421182
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x4318ff
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x43007a
push dword [0x4d19dc]
lea ecx, [esp + 0x50]
call fcn.00421197
lea eax, [esp + 0x30]
push eax
push 0x4b0644
lea eax, [esp + 0x28]
mov byte [esp + 0x3078], 0x7f
and dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x58]
call fcn.004223f7
jmp 0x431c66
lea ecx, [esp + 0x2c]
call fcn.0042048a
lea ecx, [esp + 0x34]
call fcn.0042048a
lea ecx, [esp + 0x50]
call fcn.0042048a
lea ecx, [esp + 0x54]
call fcn.0042048a
push 0x3e
pop edi
push edi
push ecx
mov byte [esp + 0x3078], 0x84
and dword [esp + 0x4c], 0
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
lea esi, [esp + 0x50]
call fcn.00421182
lea eax, [esp + 0x48]
push eax
mov ecx, esi
call fcn.00457670
add esp, 0xc
mov byte [esp + 0x3070], 0x85
call fcn.004224aa
push eax
lea ecx, [esp + 0x30]
call fcn.00422361
mov byte [esp + 0x3070], 0x84
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x44], 0xffffffff
jne 0x4319e7
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
jmp 0x431c29
push edi
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
lea esi, [esp + 0x50]
call fcn.00421182
lea eax, [esp + 0x64]
push eax
mov ecx, esi
call fcn.00457670
add esp, 0xc
mov byte [esp + 0x3070], 0x86
call fcn.004224aa
push eax
lea ecx, [esp + 0x38]
call fcn.00422361
mov byte [esp + 0x3070], 0x84
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x44], 0xffffffff
je 0x4319c3
push edi
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421182
lea eax, [esp + 0x50]
push eax
mov ecx, esi
call fcn.00457670
add esp, 0xc
mov byte [esp + 0x3070], 0x87
call fcn.004224aa
push eax
lea ecx, [esp + 0x54]
call fcn.00422361
mov byte [esp + 0x3070], 0x84
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x44], 0xffffffff
jne 0x431a9d
push ebx
lea ecx, [esp + 0x54]
call fcn.004211db
jmp 0x431af4
push edi
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
lea esi, [esp + 0x50]
call fcn.00421182
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00457670
add esp, 0xc
mov byte [esp + 0x3070], 0x88
call fcn.004224aa
push eax
lea ecx, [esp + 0x58]
call fcn.00422361
mov byte [esp + 0x3070], 0x84
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x44], 0xffffffff
jne 0x431afe
push ebx
lea ecx, [esp + 0x58]
call fcn.004211db
push dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push str._exec___s_
push eax
call fcn.00453c70
add esp, 0xc
mov byte [esp + 0x3070], 0x89
mov esi, dword [esp + 0x34]
cmp dword [esi - 0xc], 0
je 0x431b42
push 0x4b1cdc
lea ecx, [esp + 0x3c]
call fcn.00424517
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
call fcn.00423abc
push ecx
lea eax, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3078], 0x8a
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x307c], 0x8b
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3080], 0x8c
mov dword [esp + 0x78], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x4b11ac
call fcn.00421197
push ecx
mov eax, esp
mov byte [esp + 0x3088], 0x8d
mov dword [esp + 0x8c], esp
push str..lnk
lea ecx, [esp + 0x6c]
push ecx
push eax
call fcn.00424585
add esp, 8
mov byte [esp + 0x308c], 0x8e
mov eax, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004530b0
pop ecx
mov byte [esp + 0x308c], 0x8c
call fcn.00453850
add esp, 0xc
mov byte [esp + 0x3080], 0x89
call fcn.0046ed60
mov ecx, dword [esp + 0x48]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [esi - 0x10]
call fcn.0042001a
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [esp + 0x3070], 0x7f
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x30]
push eax
push 0x4b0644
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x58]
call fcn.004223f7
cmp dword [esp + 0x30], 0xffffffff
jne 0x431938
mov byte [esp + 0x3070], 0x7f
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [0x4d19d8]
push str.Shortcuts_created_for__s.
jmp 0x4311c5
lea ecx, [esp + 0x38]
call fcn.0042048a
lea ecx, [esp + 0x4c]
call fcn.0042048a
mov byte [esp + 0x3070], 0x90
mov edi, dword [esp + 0x44]
or dword [esp + 0x34], 0xffffffff
lea eax, [edi + 1]
cmp dword [esp + 0x64], eax
jle 0x431cd9
push dword [esi + edi*4 + 4]
lea ecx, [esp + 0x3c]
call fcn.004211db
lea eax, [edi + 2]
cmp dword [esp + 0x64], eax
jle 0x431cee
push dword [esi + eax*4]
lea ecx, [esp + 0x50]
call fcn.004211db
lea ecx, [esp + 0x1c]
call fcn.0042048a
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x3074], 0x91
call fcn.00421182
push ecx
mov byte [esp + 0x3074], 0x92
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
mov edi, 0x4d19d0
mov esi, edi
call fcn.00423691
pop ecx
test al, al
jne 0x431d47
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x43007a
xor esi, esi
inc esi
push esi
push 0
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x150]
push eax
call fcn.004229f3
lea eax, [esp + 0x144]
push eax
mov byte [esp + 0x3074], 0x93
call fcn.004236fb
pop ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
je 0x431dab
push ecx
push 0x80
push 4
push ecx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x34], eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x24]
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push dword [0x4d1a10]
call fcn.00421197
push ecx
mov byte [esp + 0x308c], 0x94
mov ecx, esp
mov dword [esp + 0x90], esp
push dword [0x4d1a0c]
call fcn.00421197
push ecx
mov byte [esp + 0x3090], 0x95
mov ecx, esp
mov dword [esp + 0x88], esp
push dword [0x4d19d8]
call fcn.00421197
mov byte [esp + 0x3090], 0x93
call fcn.0042c0ee
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x20
call esi
mov dword [esp + 0x40], eax
lea eax, [esp + 0x144]
push eax
push dword [esp + 0x4c]
mov ecx, edi
call fcn.004263ef
pop ecx
pop ecx
test eax, eax
je 0x431e4d
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Failed_BasicDeploy_
jmp 0x43003d
call esi
mov edi, eax
sub edi, dword [esp + 0x40]
call esi
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x38]
cmp dword [eax - 0xc], 0
je 0x431f05
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x96
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x4b5248
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x97
mov ecx, esp
mov dword [esp + 0x74], esp
push ebx
call fcn.00421197
push 0
push ecx
mov byte [esp + 0x3084], 0x98
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
call fcn.00421182
lea ecx, [esp + 0x158]
mov byte [esp + 0x3084], 0x93
call fcn.0042758d
add esp, 0x14
xor ebx, ebx
push ebx
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421182
call fcn.00459900
pop ecx
pop ecx
cmp eax, ebx
jne 0x431f07
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x431edb
xor ebx, ebx
call esi
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [0x4d1a10]
mov esi, eax
sub esi, dword [esp + 0x50]
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x99
mov ecx, esp
mov dword [esp + 0x7c], esp
push dword [0x4d19d8]
call fcn.00421197
mov byte [esp + 0x3078], 0x93
call fcn.0042bda3
pop ecx
pop ecx
lea ecx, [esp + 0x2c]
call fcn.0042048a
lea ecx, [esp + 0x5c]
mov eax, pe_nt_image_headers32
push ecx
mov byte [esp + 0x3074], 0x9a
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x64], eax
call fcn.0042049e
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.00423c25
push esi
push edi
push dword [esp + 0x34]
lea eax, [esp + 0x5c]
push dword [0x4d19d8]
push str._s__s__d_d_r_n
push eax
call fcn.00453c70
add esp, 0x18
mov byte [esp + 0x3070], 0x9b
push dword [esp + 0x50]
lea ecx, [esp + 0x58]
call fcn.00433db4
mov byte [esp + 0x3070], 0x9c
mov esi, dword [esp + 0x34]
cmp esi, 0xffffffff
je 0x431ff5
push 2
push ebx
push ebx
push esi
mov dword [esp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax - 0xc]
push ebx
lea edx, [esp + 0x4c]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
lea eax, [esp + 0x54]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421182
call fcn.0042f6e0
pop ecx
pop ecx
push ebx
jmp 0x430049
lea ecx, [esp + 0x30]
call fcn.0042048a
mov byte [esp + 0x3070], 0x9d
mov eax, dword [esp + 0x44]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
lea ecx, [esp + 0x30]
jle 0x432044
push dword [esi + eax*4 + 4]
call fcn.004211db
jmp 0x43204e
lea eax, [esp + 0x3c]
push eax
call fcn.00422361
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str..Packager.log
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x9e
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.00421182
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x307c], 0x9d
call fcn.00453fc0
add esp, 0xc
mov byte [esp + 0x3070], 0x9f
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
xor edi, edi
call fcn.00421182
lea eax, [esp + 0x1e0]
push eax
call fcn.004229f3
lea eax, [esp + 0x1d4]
push eax
mov byte [esp + 0x3074], 0xa0
call fcn.004236fb
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x432156
push 0x2024
lea eax, [esp + 0x62c]
push esi
push eax
mov dword [esp + 0x630], esi
call fcn.0048cb00
lea eax, [esp + 0x630]
add esp, 0xc
push eax
lea edx, [esp + 0x50]
mov eax, ebx
mov dword [esp + 0x50], esi
call fcn.00465b20
pop ecx
test eax, eax
jne 0x43214f
lea eax, [esp + 0x1c]
push eax
call fcn.004530b0
pop ecx
push dword [eax]
mov eax, ebx
call fcn.00465be0
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [esp + 0x38]
mov edx, dword [esp + 0x50]
mov eax, ebx
call fcn.00465b60
pop ecx
test eax, eax
jne 0x43214f
inc edi
call fcn.00465c20
xor esi, esi
lea eax, [esp + 0x1d4]
call fcn.00466ec0
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [esp + 0x40]
cmp edi, esi
je 0x43217c
push str.Success:__s
jmp 0x432181
push str.Failed_saving__s
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
push esi
jmp 0x430049
lea ecx, [esp + 0x14]
call fcn.0042048a
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x3074], 0xa1
call fcn.00421182
mov byte [esp + 0x3070], 0xa2
mov eax, dword [esp + 0x44]
lea ecx, [eax + 1]
cmp dword [esp + 0x64], ecx
jle 0x4321d8
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x34]
call fcn.004211db
push 1
push 0
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0xc0]
push eax
call fcn.004229f3
mov byte [esp + 0x3070], 0xa3
cmp dword [esp + 0x140], 0
jne 0x432220
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x18]
call fcn.00422869
pop ecx
jmp 0x4322ce
lea eax, [esp + 0x24]
lea ecx, [esp + 0x128]
call fcn.00433d3c
jmp 0x4322ab
lea esi, [esp + 0x24]
call fcn.00424777
mov edi, eax
add edi, 0x18
call fcn.00424777
mov ebx, eax
call fcn.00424777
push dword [eax + 0xc]
push dword [eax + 8]
movzx eax, word [edi + 0xc]
push dword [ebx + 4]
push dword [ebx]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 8]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
movzx eax, word [edi + 6]
push eax
call fcn.00424777
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00424777
push dword [eax + 0x2c]
call fcn.00424777
mov eax, dword [eax + 0x28]
call fcn.00423a58
push eax
push str._s__s:_Size_lld__Time_.2d__.2d__.4d__.2d:_.2d:_.2d__Offset_lld__Allocated_lld_n
lea ebx, [esp + 0x50]
call fcn.00422869
add esp, 0x3c
call fcn.00433df8
lea eax, [esp + 0x74]
lea ecx, [esp + 0x128]
call fcn.00433d51
mov edi, eax
lea esi, [esp + 0x24]
call fcn.00433e23
test al, al
jne 0x432232
push str.______________________________n
lea ebx, [esp + 0x18]
call fcn.00422869
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x43230c
push str.Cannot_obtain_INI_info_from_resource__n
mov ecx, ebx
call fcn.00423c06
jmp 0x432600
lea ecx, [esp + 0x20]
call fcn.0042048a
mov byte [esp + 0x3070], 0xa4
call fcn.0045dc00
push dword [0x4d19d8]
lea ebx, [esp + 0x18]
push str.AppID___ws_n
call fcn.00422869
push dword [0x4d19e8]
push str.Publisher___ws_n
call fcn.00422869
push dword [0x4d19ec]
push str.Version___ws_n
call fcn.00422869
push dword [0x4d19e0]
push str.FriendlyName___ws_n
call fcn.00422869
push dword [0x4d19dc]
push str.AutoLaunch___ws_n
call fcn.00422869
push dword [0x4d19e4]
push str.Shortcuts___ws_n
call fcn.00422869
push dword [0x4d1a0c]
push str.BaseDirName___ws_n
call fcn.00422869
push dword [0x4d1a10]
push str.CarrierExeName___ws_n
call fcn.00422869
add esp, 0x40
push dword [0x4d19f0]
push str.OnStartVirtualizedCmds___ws_n
call fcn.00422869
push dword [0x4d19f4]
push str.OnStartUnvirtualizedCmds___ws_n
call fcn.00422869
push dword [0x4d19f8]
push str.OnStopVirtualizedCmds___ws_n
call fcn.00422869
push dword [0x4d19fc]
push str.OnStopUnvirtualizedCmds___ws_n
call fcn.00422869
push dword [0x4d1a00]
push str.StopInheritance___ws_n
call fcn.00422869
add esp, 0x24
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4d19d8]
push str._s.AppVirtDll.dll
push eax
call fcn.00453c70
lea eax, [esp + 0x2c]
add esp, 0xc
push eax
call fcn.00453400
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xa5
call fcn.00422361
mov byte [esp + 0x3070], 0xa4
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3078], 0xa6
mov esi, str.Main
mov ecx, esp
mov dword [esp + 0x7c], esp
push esi
call fcn.00421197
push 2
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0xa4
call fcn.00467fd0
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
lea eax, [esp + 0x20]
push eax
call fcn.00478d80
mov byte [esp + 0x3078], 0xa7
push dword [eax]
push str.EngineVersion_ws_n
call fcn.00422869
mov byte [esp + 0x3080], 0xa4
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
call fcn.00457070
pop ecx
lea ecx, [esp + 0x38]
call fcn.0042048a
push ecx
mov byte [esp + 0x3074], 0xa8
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4d19d8]
push str._s.SandboxCfg.db
push eax
call fcn.00453c70
lea eax, [esp + 0x2c]
add esp, 0xc
push eax
call fcn.00453400
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xa9
call fcn.00422361
mov byte [esp + 0x3070], 0xa8
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3078], 0xaa
mov ecx, esp
mov dword [esp + 0x7c], esp
push esi
call fcn.00421197
push 5
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0xa8
call fcn.00467fd0
and dword [esp + 0x90], 0
xor eax, eax
lea edi, [esp + 0x94]
stosd dword es:[edi], eax
mov esi, dword [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ebx, [esp + 0x90]
stosd dword es:[edi], eax
call fcn.0046efc0
lea eax, [esp + 0x38]
push eax
push 0x460970
push 0
push dword [esp + 0xa4]
mov eax, ebx
push eax
call fcn.0046fdb0
push dword [esp + 0x38]
lea ebx, [esp + 0x18]
push str.Sandbox:__ws_n
call fcn.00422869
pop ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
call fcn.00457070
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [esi - 0x10]
call fcn.0042001a
xor esi, esi
push esi
push str.Info
push dword [esp + 0x1c]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x432191
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x430d30
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
call fcn.00421182
push 0x2e
lea ecx, [esp + 0x30]
mov byte [esp + 0x3074], 0xaf
call fcn.00433d01
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
call fcn.00423bc8
push str..new.exe
push eax
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x307c], 0xb0
call fcn.00424585
add esp, 0xc
mov byte [esp + 0x3070], 0xb2
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0x44]
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x4c]
call fcn.00421197
push 0
mov byte [esp + 0x3074], 0xb3
push dword [esp + 0x38]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4326d1
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [esp + 0x3c]
push dword [esp + 0x38]
push str.Cant_copy__s_to__s
jmp 0x4301e0
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3078], 0xb4
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.00421182
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x307c], 0xb3
call fcn.00429e69
mov ecx, dword [esp + 0x28]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0042001a
push 1
push 0
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0xc0]
push eax
call fcn.004229f3
push 1
push 1
push ecx
mov byte [esp + 0x307c], 0xb5
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x1e0]
push eax
call fcn.004229f3
lea eax, [esp + 0x68]
lea ecx, [esp + 0x128]
mov byte [esp + 0x3070], 0xb6
call fcn.00433d3c
jmp 0x43288c
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.CEChangeEngine.tmp
call fcn.00421197
lea eax, [esp + 0x34]
push eax
call fcn.00453400
add esp, 4
mov byte [esp + 0x3074], 0xb7
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
lea esi, [esp + 0x6c]
mov byte [esp + 0x3074], 0xb8
call fcn.00424777
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.00421182
call fcn.00424777
push dword [eax + 0x28]
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x3080], 0xb7
call fcn.00467fd0
test eax, eax
jne 0x4328e3
call fcn.00424777
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
push 0x4000
mov byte [esp + 0x3078], 0xb9
call fcn.00424777
push dword [eax + 0x28]
lea eax, [esp + 0x3c]
push ecx
mov ecx, esp
mov dword [esp + 0x84], esp
push eax
call fcn.00421182
lea eax, [esp + 0x1e4]
push eax
mov byte [esp + 0x3084], 0xb7
call fcn.004678e0
test eax, eax
jne 0x43290d
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
call fcn.00457070
pop ecx
mov byte [esp + 0x3070], 0xb6
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042001a
call fcn.00433df8
lea eax, [esp + 0x88]
lea ecx, [esp + 0x128]
call fcn.00433d51
mov edi, eax
lea esi, [esp + 0x68]
call fcn.00433e23
test al, al
jne 0x432785
lea eax, [esp + 0xb4]
call fcn.00466ec0
lea eax, [esp + 0x1d4]
call fcn.00466ec0
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [esp + 0x3c]
push str.Successfully_changed_Loader:__s
jmp 0x4311c5
push dword [esp + 0x14]
call fcn.00424777
push ecx
mov edi, esp
mov dword [esp + 0x2c], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x74]
call fcn.00424777
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x4301e1
push dword [esp + 0x14]
lea esi, [esp + 0x6c]
call fcn.00424777
push ecx
mov edi, esp
mov dword [esp + 0x2c], esp
push dword [eax + 0x2c]
jmp 0x4328fa
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x34]
call fcn.00421182
push 0x2e
lea ecx, [esp + 0x34]
mov byte [esp + 0x3074], 0xba
call fcn.00433d01
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x38]
call fcn.00423bc8
push str..new.exe
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x307c], 0xbb
call fcn.00424585
add esp, 0xc
mov byte [esp + 0x3070], 0xbd
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0x44]
push dword [esi + eax*4 + 4]
lea ecx, [esp + 0x30]
call fcn.00421197
xor edi, edi
push edi
mov byte [esp + 0x3074], 0xbe
push dword [esp + 0x3c]
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4329cb
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [esp + 0x40]
push dword [esp + 0x3c]
jmp 0x4326c7
push 1
push 1
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0xc0]
push eax
call fcn.004229f3
mov byte [esp + 0x3070], 0xbf
cmp dword [esp + 0x140], edi
jne 0x432a13
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Cannot_open_PeContainer
jmp 0x43003d
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov esi, str.Main
push esi
call fcn.00421197
push edi
push 2
push ecx
mov byte [esp + 0x3080], 0xc0
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x84], esp
push eax
call fcn.00421182
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0xbf
call fcn.004678e0
cmp eax, edi
je 0x432a72
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x43003d
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.00421197
push edi
push 8
push ecx
mov byte [esp + 0x3080], 0xc1
mov dword [esp + 0x84], esp
mov esi, esp
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x88], esp
push eax
call fcn.00421182
push esi
call fcn.00460a90
pop ecx
pop ecx
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x3084], 0xbf
call fcn.004678e0
cmp eax, edi
je 0x432ade
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x43003d
lea eax, [esp + 0xb4]
call fcn.00466ec0
push dword [esp + 0x14]
lea eax, [esp + 0x30]
push ecx
mov dword [esp + 0x2c], esp
mov esi, esp
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00421182
lea eax, [esp + 0x2c]
push eax
call fcn.00478d80
pop ecx
pop ecx
mov byte [esp + 0x307c], 0xc2
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.00453c70
add esp, 0x10
call fcn.0042f6e0
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push edi
jmp 0x430049
lea eax, [esp + 0x48c]
push eax
call fcn.00425e01
lea ecx, [esp + 0x4c]
call fcn.0042048a
lea eax, [esp + 0x4c]
push eax
push ecx
mov byte [esp + 0x3078], 0xc4
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0xc5
mov ecx, esp
mov dword [esp + 0x80], esp
push str.Description
call fcn.00421197
push ecx
mov byte [esp + 0x3080], 0xc6
mov ecx, esp
mov dword [esp + 0x78], esp
push str.AppID
call fcn.00421197
lea ecx, [esp + 0x49c]
mov byte [esp + 0x3080], 0xc4
call fcn.004253a3
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x48c]
push eax
mov byte [esp + 0x3074], 3
call fcn.00425f11
jmp 0x4300fb
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x150]
push eax
call fcn.004229f3
push ecx
mov byte [esp + 0x3074], 0xc7
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0xc8
mov ecx, esp
mov dword [esp + 0x7c], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0xc9
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421182
push 2
push ecx
mov byte [esp + 0x3084], 0xca
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
call fcn.00421182
lea ecx, [esp + 0x158]
mov byte [esp + 0x3084], 0xc7
call fcn.0042758d
lea eax, [esp + 0x158]
add esp, 0x14
push eax
call fcn.0042744c
pop ecx
lea eax, [esp + 0x144]
call fcn.00466ec0
lea eax, [esp + 0x144]
jmp 0x430c60
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.DbgZip
call fcn.00421197
call fcn.0042eee1
mov dword [esp], str._DbgZip:
call fcn.0048c02b
pop ecx
mov ecx, dword [esp + 0x44]
mov ecx, dword [esi + ecx*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x88]
call fcn.004211db
jmp 0x430a69
lea eax, [esp + 0x2f4]
push eax
mov byte [esp + 0x3074], 0xcb
call fcn.00425f11
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
jmp 0x433c54
call fcn.0042f63b
jmp 0x430047
lea esi, [esp + 0x74]
call fcn.00466420
and dword [esp + 0x38], 0
lea ecx, [esp + 0x20]
call fcn.0042048a
mov byte [esp + 0x3070], 0xd0
jmp 0x432f54
lea eax, [esp + 0x2e5c]
push eax
lea eax, [esp + 0x20]
push str.__ws_n
push eax
call fcn.00453c70
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xd1
call fcn.00423abc
mov byte [esp + 0x3070], 0xd0
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [esp + 0x628]
lea eax, [esp + 0x4c]
push str.____SerialId:__d_n
push eax
call fcn.00453c70
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xd2
call fcn.00423abc
mov byte [esp + 0x3070], 0xd0
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0042001a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xe50]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x44]
push str.____Started:__d_sec_ago_n
push eax
call fcn.00453c70
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xd3
call fcn.00423abc
mov byte [esp + 0x3070], 0xd0
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0xe54]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x60]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.00453c70
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xd4
call fcn.00423abc
mov byte [esp + 0x3070], 0xd0
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x4c]
push str.____Processes:_n
push eax
call fcn.00453c70
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xd5
call fcn.00423abc
mov byte [esp + 0x3070], 0xd0
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042001a
xor edi, edi
cmp dword [esp + 0xe58], edi
jbe 0x432f54
push ebx
lea ecx, [esp + 0x34]
call fcn.00421197
mov byte [esp + 0x3070], 0xd6
push dword [esp + edi*4 + 0xe5c]
lea esi, [esp + 0x34]
call fcn.004525e0
pop ecx
test eax, eax
jne 0x432ec5
push 0x4b13a0
mov ecx, esi
call fcn.004211db
push 0x5c
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421182
lea eax, [esp + 0x3c]
push eax
call fcn.00454180
add esp, 0xc
mov byte [esp + 0x3070], 0xd7
push dword [eax]
lea eax, [esp + 0x30]
push dword [esp + edi*4 + 0xe60]
push str._______wd:__ws_n
push eax
call fcn.00453c70
add esp, 0x10
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3074], 0xd8
call fcn.00423abc
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [esp + 0x3070], 0xd0
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042001a
inc edi
cmp edi, dword [esp + 0xe58]
jb 0x432e92
lea eax, [esp + 0x624]
push eax
lea eax, [esp + 0x78]
push eax
lea esi, [esp + 0x40]
call fcn.004662b0
test eax, eax
jne 0x432d38
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
cmp dword [esp + 0x40], eax
jne 0x432f9b
push str.No_active_virtual_apps
call fcn.00421197
call fcn.0042f6e0
pop ecx
pop ecx
push 1
jmp 0x430049
lea eax, [esp + 0x28]
push eax
call fcn.00421182
jmp 0x4311ce
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 0x44]
call fcn.00425a4e
lea eax, [esp + 0x1c]
push eax
call fcn.00425b8b
jmp 0x430047
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.AutoUpdate
call fcn.00421197
call fcn.0042eee1
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x43300f
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x43007a
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4d1a04]
push str.SourceAddr_s
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042eee1
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [0x4d1a10]
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0xdb
mov ecx, esp
mov dword [esp + 0x7c], esp
push dword [0x4d1a0c]
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0xdc
mov ecx, esp
mov dword [esp + 0x74], esp
push 0x4d1a04
call fcn.00421182
mov byte [esp + 0x307c], 3
call fcn.0047b540
add esp, 0xc
jmp 0x4300fb
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.VirtRegSyncExport
call fcn.00421197
call fcn.0042eee1
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x4330cd
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x43007a
push esi
call fcn.0042cdb8
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.00453c70
add esp, 0xc
jmp 0x4300f5
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
call fcn.00421182
mov byte [esp + 0x3070], 0x74
mov eax, dword [esp + 0x44]
push str._FullIntegrate
push dword [esi + eax*4]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x4332b8
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
mov esi, 0x4d19d0
call fcn.00423691
pop ecx
test al, al
jne 0x43314e
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x43007a
push dword [0x4d1a0c]
lea ecx, [esp + 0x34]
call fcn.00421197
mov byte [esp + 0x3070], 0x75
cmp dword [esp + 0x34], 0
je 0x4331b0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [0x4d19d8]
call fcn.00421197
lea eax, [esp + 0x20]
push eax
call fcn.0042d0a4
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x3074], 0x76
call fcn.00422361
mov byte [esp + 0x3070], 0x75
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4b11ac
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x77
mov eax, esp
mov dword [esp + 0x7c], esp
push dword [0x4d19d8]
push str._s.host.exe
push eax
call fcn.00453c70
add esp, 8
mov byte [esp + 0x307c], 0x78
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421182
lea edi, [esp + 0x28]
mov byte [esp + 0x307c], 0x75
call fcn.00453850
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x3074], 0x79
call fcn.00422361
mov byte [esp + 0x3070], 0x75
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov esi, dword [esp + 0x30]
call fcn.00456520
test eax, eax
jne 0x433258
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Could_not_create_virtual_repository
jmp 0x43003d
lea eax, [esp + 0x1c]
push eax
call fcn.00452e90
mov eax, dword [eax]
pop ecx
push 0
push dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x1c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x5b], al
call fcn.0042001a
cmp byte [esp + 0x5b], 0
je 0x4332a4
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Could_not_copy_executable_to_repository
jmp 0x43003d
mov byte [esp + 0x3070], 0x74
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042001a
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x150]
push eax
call fcn.004229f3
push ecx
mov byte [esp + 0x3074], 0x7a
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x7b
mov ecx, esp
mov dword [esp + 0x7c], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x7c
mov ecx, esp
mov dword [esp + 0x74], esp
push ebx
call fcn.00421197
push 2
push ecx
mov byte [esp + 0x3084], 0x7d
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
call fcn.00421182
lea ecx, [esp + 0x158]
mov byte [esp + 0x3084], 0x7a
call fcn.0042758d
add esp, 0x14
xor eax, eax
cmp dword [esp + 0x34], esi
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.AllUsers
call fcn.00421197
push ecx
mov byte [esp + 0x307c], 0x7e
mov eax, esp
mov dword [esp + 0x80], esp
push dword [0x4d19d8]
push str.SoftwareVOS_s
push eax
call fcn.00453c70
add esp, 0xc
mov byte [esp + 0x307c], 0x7a
call fcn.00454f80
add esp, 0xc
push dword [esp + 0x34]
call fcn.00428369
pop ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x148]
call fcn.00428b31
pop ecx
lea eax, [esp + 0x144]
call fcn.00466ec0
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [0x4d19d8]
push str._s_is_now_integrated_into_your_system.
jmp 0x432181
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00452ce0
test eax, eax
jne 0x43345c
xor edi, edi
push edi
push edi
push edi
push ecx
mov ebx, esp
mov dword [esp + 0x34], esp
push ecx
mov ecx, esp
mov dword [esp + 0x88], esp
push dword [esi]
call fcn.00421197
push ebx
call fcn.00458da0
add esp, 4
mov byte [esp + 0x3084], 0x28
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x88], esp
push eax
call fcn.00421182
mov byte [esp + 0x3084], 3
call fcn.00452850
add esp, 0x14
cmp eax, edi
jne 0x432b41
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x430038
call fcn.00452e40
test eax, eax
jne 0x433475
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x42f946
mov eax, dword [esp + 0x44]
push 0x4b4924
lea esi, [esi + eax*4]
call fcn.0048bfa0
pop ecx
push eax
push str._Patch
push dword [esi]
call fcn.0048ca33
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x3c]
sbb edi, edi
push eax
lea ecx, [esp + 0x30]
inc edi
call fcn.00421182
push ecx
mov byte [esp + 0x3074], 0x29
mov ecx, esp
mov dword [esp + 0x28], esp
push str..new.exe
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x2a
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.00421182
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x307c], 0x29
call fcn.00453fc0
add esp, 0xc
mov byte [esp + 0x3070], 0x2b
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [esi]
call fcn.00421197
lea eax, [esp + 0x38]
push eax
call fcn.00458da0
pop ecx
pop ecx
push 1
push 0
push ecx
mov byte [esp + 0x307c], 0x2c
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x1e0]
push eax
call fcn.004229f3
push ecx
mov byte [esp + 0x3074], 0x2d
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x2e
mov ecx, esp
mov dword [esp + 0x7c], esp
push ebx
call fcn.00421197
mov byte [esp + 0x3078], 0x2f
push ecx
lea eax, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421182
push 2
push ecx
mov byte [esp + 0x3084], 0x30
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
call fcn.00421182
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x3084], 0x2d
call fcn.0042758d
add esp, 0x14
push dword [0x4d19d8]
lea eax, [esp + 0x3c]
push dword [0x4d1a0c]
push str._sAppVirtDll__s.dll
push eax
call fcn.00453c70
add esp, 0xc
mov byte [esp + 0x3074], 0x31
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
call fcn.00421074
pop ecx
test eax, eax
je 0x43365f
push dword [esp + 0x14]
cmp eax, 0x11
jne 0x433626
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.00453c70
pop ecx
pop ecx
jmp 0x430042
cmp eax, 0x12
jne 0x433639
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x433619
lea ecx, [esp + 0x28]
push ecx
mov edx, eax
call fcn.00459fc0
mov byte [esp + 0x3078], 0x32
mov ecx, esp
mov dword [esp + 0x7c], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x430904
push dword [esp + 0x34]
lea eax, [esp + 0x20]
push str._exec__s
push eax
call fcn.00453c70
mov eax, dword [eax]
add esp, 0xc
xor esi, esi
push esi
push esi
push eax
push dword [esp + 0x48]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
cmp eax, 0x20
setg bl
add ecx, 0xfffffff0
call fcn.0042001a
cmp ebx, esi
je 0x4336e7
cmp edi, esi
je 0x4336b2
push 1
push str.Cameyo
push str.Starting_installation..._nWhen_finished__click_OK_to_merge_result_back_into_the_virtual_package.
jmp 0x4336bd
push esi
push str.Cameyo
push str.When_installation_is_finished__click_OK.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x4336e7
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
call fcn.004210fb
pop ecx
push 0x14
jmp 0x430049
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421182
call fcn.004210fb
pop ecx
cmp eax, esi
je 0x433758
push dword [esp + 0x14]
cmp eax, 0x11
jne 0x43371c
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x433619
cmp eax, 0x12
jne 0x433732
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x433619
lea ecx, [esp + 0x28]
push ecx
mov edx, eax
call fcn.00459fc0
mov byte [esp + 0x3078], 0x33
mov ecx, esp
mov dword [esp + 0x7c], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x430904
cmp ebx, esi
jne 0x433775
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [esp + 0x3c]
push str.Failed_executing__s
jmp 0x4300d6
cmp edi, esi
mov edi, dword [esp + 0x2c]
je 0x433850
push esi
push dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x20]
jne 0x4337ab
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421182
jmp 0x430042
push esi
push dword [esp + 0x50]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3080], 0x34
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x84], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x31
call fcn.00429fee
mov ebx, eax
add esp, 0x10
cmp ebx, esi
jne 0x4338c1
push dword [esp + 0x14]
lea eax, [esp + 0x24]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x28]
push eax
call fcn.00454180
add esp, 8
mov byte [esp + 0x3078], 0x35
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
mov byte [esp + 0x3070], 0x31
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x1d4]
call fcn.00466ec0
push dword [esp + 0x14]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push dword [esp + 0x28]
push 0x4b4cec
push eax
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x1d4]
push eax
mov byte [esp + 0x3074], 0x2c
call fcn.00422ab2
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [edi - 0x10]
jmp 0x43040f
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x14]
cmp ebx, 0x10
jne 0x4338e0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x4308db
lea eax, [esp + 0x28]
push eax
mov edx, ebx
call fcn.00459fc0
mov byte [esp + 0x3078], 0x36
mov ecx, esp
mov dword [esp + 0x7c], esp
jmp 0x4308fd
lea ecx, [esp + 0x2c]
call fcn.0042048a
lea ecx, [esp + 0x34]
call fcn.0042048a
mov byte [esp + 0x3070], 0x1e
mov eax, dword [esp + 0x44]
lea esi, [esi + eax*4]
push str._CreateDiff
push dword [esi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x433942
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
call fcn.00422361
jmp 0x43395c
push 0x4b48d8
call fcn.0048bfa0
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x30]
call fcn.004211db
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str..mod
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x1f
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.00421182
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x307c], 0x1e
call fcn.00453fc0
add esp, 0xc
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x3074], 0x20
call fcn.00422361
mov byte [esp + 0x3070], 0x1e
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x2c]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x34]
jne 0x4339f4
push dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x4337a0
push 1
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
push ecx
mov byte [esp + 0x3080], 0x21
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x84], esp
push eax
call fcn.00421182
mov byte [esp + 0x3080], 0x1e
call fcn.00429fee
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x433a77
push dword [esp + 0x14]
lea eax, [esp + 0x38]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421182
lea eax, [esp + 0x28]
push eax
call fcn.00454180
add esp, 8
mov byte [esp + 0x3078], 0x22
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
jmp 0x433c2d
push edi
call esi
mov edx, dword [esp + 0x1c]
push dword [esp + 0x14]
cmp edx, 0x10
jne 0x433a93
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
jmp 0x4308db
lea eax, [esp + 0x28]
push eax
call fcn.00459fc0
mov byte [esp + 0x3078], 0x23
mov ecx, esp
mov dword [esp + 0x7c], esp
jmp 0x4308fd
call fcn.0047dccb
push eax
lea ecx, [esp + 0x30]
call fcn.00434103
mov byte [esp + 0x3070], 0xf
call fcn.0047dccb
push eax
lea ecx, [esp + 0x38]
call fcn.00434103
mov byte [esp + 0x3070], 0x10
mov eax, dword [esp + 0x44]
lea esi, [esi + eax*4]
push str._LearnStreaming
push dword [esi]
call fcn.0048c876
pop ecx
pop ecx
test eax, eax
jne 0x433b07
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
call fcn.004226f7
jmp 0x433b21
push 0x4b46a4
call fcn.0048bfa0
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x30]
call fcn.004214a8
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str..new.exe
call fcn.00421197
push ecx
mov byte [esp + 0x3078], 0x11
lea eax, [esp + 0x34]
mov dword [esp + 0x7c], esp
mov ecx, esp
push eax
call fcn.00421360
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x307c], 0x10
call fcn.00453fc0
add esp, 0xc
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x3074], 0x12
call fcn.004226f7
mov byte [esp + 0x3070], 0x10
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x2c]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x34]
jne 0x433bb7
push dword [esp + 0x14]
push ecx
mov dword [esp + 0x2c], esp
jmp 0x430821
push ecx
mov dword [esp + 0x28], esp
mov ecx, esp
push eax
call fcn.00421360
push ecx
mov byte [esp + 0x3078], 0x13
lea eax, [esp + 0x34]
mov dword [esp + 0x7c], esp
mov ecx, esp
push eax
call fcn.00421360
mov byte [esp + 0x3078], 0x10
call fcn.0042b902
pop ecx
pop ecx
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x433c5e
push dword [esp + 0x14]
lea eax, [esp + 0x38]
push 0x5c
push ecx
mov dword [esp + 0x30], esp
mov ecx, esp
push eax
call fcn.00421360
lea eax, [esp + 0x28]
push eax
call fcn.00454180
add esp, 8
mov byte [esp + 0x3078], 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.00453c70
add esp, 0xc
call fcn.0042f6e0
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [edi - 0x10]
call fcn.0042001a
lea ecx, [ebx - 0x10]
call fcn.0042001a
jmp 0x4300fb
push edi
call esi
push dword [esp + 0x14]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
call fcn.00459fc0
mov byte [esp + 0x3078], 0x15
mov ecx, esp
mov dword [esp + 0x7c], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x430904
cmp dword [0x4d1a08], edi
je 0x433cf1
cmp eax, 1
jne 0x433cf1
push 6
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x90], ebx
lea edi, [esp + 0x94]
push str.CLoaderApp:_Entering_wait_loop_n
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x433ce0
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x9c]
push eax
call esi
test eax, eax
jne 0x433cc4
push str.CLoaderApp:_Done._Bye__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x430047