Function at 0x42c067
Capabilities:
Check for time delay via gettickcount
Create thread
Get file attributes
Set current directory
Set environment variable
Terminate process

Disassembly:
push 0x274
mov eax, 0x4c3084
call fcn.004a9a35
mov ebx, ecx
mov edi, edx
xor esi, esi
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x234], esi
push 3
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x244], esi
call fcn.004964ca
push eax
lea ecx, [ebp - 0x250]
call fcn.004214a8
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 4
call fcn.004612c0
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x220], esp
push dword [eax]
push str.Loader_Main:_in:_ProcessName_s
push ecx
call fcn.00462190
add esp, 0xc
call fcn.0042a126
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.0042101a
push edi
call fcn.0042720b
pop ecx
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x42c110
push str.Cannot_open_ZIP__RESOURCE_COREZIP_
call fcn.0042a156
lea eax, [ebp + 8]
push eax
mov ecx, 0x4f3b10
call fcn.00423b12
push edi
push 0x4f3ac8
call fcn.004270cb
pop ecx
pop ecx
cmp ebx, 0xffffffff
je 0x42c136
mov dword [0x4f3b34], ebx
push ecx
mov dword [ebp - 0x23c], esp
mov ecx, esp
mov ebx, 0x4f3ad0
push ebx
call fcn.00423af1
mov ecx, esi
call fcn.00472de0
pop ecx
cmp word [0x4f3b18], si
je 0x42c1c5
xor eax, eax
mov word [ebp - 0x27c], ax
lea edi, [ebp - 0x27a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [ebp - 0x27c]
cmp ax, word [0x4f3b18]
jb 0x42c1c5
mov ax, word [ebp - 0x27a]
cmp ax, word [0x4f3b1a]
jb 0x42c1c5
mov ax, word [ebp - 0x276]
cmp ax, word [0x4f3b1e]
jb 0x42c1c5
push esi
push str.Expiration
push str.Package_expired
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.Vintegrate:
call fcn.00423456
push ecx
mov byte [ebp - 4], 6
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24c], esp
mov ecx, esp
push eax
call fcn.00423af1
mov byte [ebp - 4], 4
call fcn.00466520
add esp, 0xc
cmp eax, esi
je 0x42c20b
mov dword [ebp - 0x244], 1
jmp 0x42c24f
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.VintegrateRecursive:
call fcn.00423456
push ecx
mov byte [ebp - 4], 7
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24c], esp
mov ecx, esp
push eax
call fcn.00423af1
mov byte [ebp - 4], 4
call fcn.00466520
add esp, 0xc
cmp eax, esi
je 0x42c27a
mov dword [ebp - 0x244], 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x250]
call fcn.00423b12
push esi
push 0x3a
lea ecx, [ebp - 0x250]
call fcn.004255fd
push esi
lea ecx, [ebp - 0x250]
inc eax
push ecx
call fcn.004234ed
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
mov esi, 0x4f3ac8
call fcn.00423af1
mov ecx, esi
call fcn.0042bf37
pop ecx
xor edi, edi
push edi
push dword [ebp - 0x244]
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.VintegrateMode
call fcn.00423456
push ecx
mov byte [ebp - 4], 8
mov esi, esp
mov dword [ebp - 0x24c], esp
push ecx
mov dword [ebp - 0x258], esp
mov ecx, esp
push ebx
call fcn.00423af1
call fcn.0046f060
pop ecx
mov byte [ebp - 4], 9
call fcn.00472310
push eax
mov byte [ebp - 4], 4
call fcn.00463510
add esp, 0x14
push edi
push ecx
lea eax, [ebp - 0x250]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
call fcn.00423af1
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x24c], esp
push str.VintegrateTgtPattern
call fcn.00423456
push ecx
mov byte [ebp - 4], 0xb
mov esi, esp
mov dword [ebp - 0x258], esp
push ecx
mov dword [ebp - 0x26c], esp
mov ecx, esp
push ebx
call fcn.00423af1
call fcn.0046f060
pop ecx
mov byte [ebp - 4], 0xc
call fcn.00472310
push eax
mov byte [ebp - 4], 4
call fcn.004633e0
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push str.StartTickTime
call fcn.00423456
mov byte [ebp - 4], 0xd
push ecx
mov esi, esp
mov dword [ebp - 0x24c], esp
push ecx
mov dword [ebp - 0x258], esp
mov ecx, esp
push ebx
call fcn.00423af1
call fcn.0046f060
pop ecx
mov byte [ebp - 4], 0xe
call fcn.00472310
push eax
mov byte [ebp - 4], 4
call fcn.00463510
add esp, 0x10
mov dword [ebp - 0x23c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x23c], esp
push 0x4ca098
call fcn.00423456
push ecx
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x24c], esp
push 0x4ccac0
call fcn.00423456
push ecx
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x258], esp
mov ecx, esp
push 0x4f3b0c
call fcn.00423af1
mov byte [ebp - 4], 4
call fcn.00461ce0
add esp, 0xc
call fcn.00464b70
pop ecx
test eax, eax
jne 0x42c47f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x25c], eax
call fcn.0043465f
push 0x405
mov edi, 0x4f3ac8
call fcn.0047c840
pop ecx
xor ebx, ebx
push dword [0x4f3ad0]
lea eax, [ebp - 0x21c]
push dword [0x4f3b0c]
push str._sAppVirtDll__s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [0x4f3ad0]
add esp, 0x10
push dword [0x4f3ad8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x4f3b14]
push eax
mov eax, esi
call fcn.0047d160
mov esi, 0x4cc12c
cmp dword [0x4f3ad4], ebx
je 0x42c4e0
mov eax, 0x4f3ad4
jmp 0x42c4fa
mov eax, dword [0x4f3b08]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x42c427
cmp dword [ebp + 0xc], 2
je 0x42c427
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x23c], esp
push dword [0x4f3ad0]
push str.StartStreaming:AppID_s
push eax
call fcn.00462190
add esp, 0xc
call fcn.00425d7f
pop ecx
pop ecx
cmp eax, ebx
jne 0x42c427
push dword [0x4f3ad0]
lea eax, [ebp - 0x220]
push str.Cannot_stream_application__s_
push eax
call fcn.00462190
add esp, 0xc
push dword [eax]
jmp 0x42c10b
push esi
lea ecx, [ebp - 0x280]
call fcn.00423456
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x234], 1
push eax
lea ecx, [ebp - 0x240]
call fcn.00423af1
mov dword [ebp - 4], 0x13
test byte [ebp - 0x234], 1
je 0x42c52b
mov ecx, dword [ebp - 0x280]
and dword [ebp - 0x234], 0xfffffffe
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0x268], ebx
je 0x42c75a
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
jne 0x42c58b
push 0x3b
push dword [0x4f3ad4]
call fcn.004a536a
pop ecx
pop ecx
test eax, eax
jne 0x42c560
cmp dword [ebp + 0xc], 1
jne 0x42c75a
push 0x404
mov edi, 0x4f3ac8
call fcn.0047c840
pop ecx
push ebx
push ebx
push ebx
push 0x42be51
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x268], eax
jmp 0x42c75a
push 1
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp + 0x14]
call fcn.00423645
push 0x4ce7fc
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.00423a1c
neg eax
sbb al, al
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x230]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x221], al
call fcn.0042101a
cmp byte [ebp - 0x221], 0
je 0x42c75a
push ebx
lea eax, [ebp + 0x14]
push eax
xor eax, eax
inc eax
call fcn.004234ed
push dword [ebp + 0x14]
call fcn.004a55e0
pop ecx
push esi
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x228], ebx
call fcn.00423456
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
jle 0x42c72d
mov edi, 0x4cd710
lea eax, [ebp - 0x228]
push eax
push 0x4cd700
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x240]
call fcn.00427947
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x16
call fcn.00423b12
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x42c6fd
lea eax, [ebp - 0x258]
push eax
push edi
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x258], ebx
call fcn.00427947
push edi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 0x17
call fcn.004236a5
add esp, 0xc
lea ecx, [ebp + 0x18]
push ecx
push eax
lea eax, [ebp - 0x24c]
push eax
mov byte [ebp - 4], 0x18
call fcn.004296bf
add esp, 0xc
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x19
call fcn.00423b12
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x228], 0xffffffff
je 0x42c78a
mov eax, dword [ebp - 0x238]
cmp dword [eax - 0xc], ebx
je 0x42c78a
inc dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x230]
jl 0x42c620
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x240]
call fcn.00423b12
push esi
lea ecx, [ebp + 0x14]
call fcn.00423f1b
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
push ebx
push dword [ebp + 0xc]
mov ecx, 0x4f3ac8
push dword [ebp - 0x264]
push dword [ebp - 0x220]
call fcn.0042a7fe
add esp, 0x10
cmp eax, ebx
je 0x42c7a8
cmp eax, 7
jne 0x42c794
push 0x4ce800
jmp 0x42c10b
push 0xff
jmp 0x42c1bf
lea ecx, [ebp - 0x220]
push ecx
mov edx, eax
call fcn.00468f40
pop ecx
jmp 0x42c4d9
push 1
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
mov esi, str.RequireManaged
push esi
call fcn.00423456
push ecx
mov byte [ebp - 4], 0x1a
mov ecx, esp
mov dword [ebp - 0x264], esp
mov edi, str.SoftwareCameyo
push edi
call fcn.00423456
push SysReAllocStringLen
mov byte [ebp - 4], 0x13
call fcn.004632d0
add esp, 0x14
cmp eax, ebx
jne 0x42c837
push 1
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push esi
call fcn.00423456
push ecx
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ebp - 0x264], esp
push edi
call fcn.00423456
mov byte [ebp - 4], 0x1c
call fcn.00472310
push eax
mov byte [ebp - 4], 0x13
call fcn.004632d0
add esp, 0x14
cmp eax, ebx
je 0x42c88d
cmp dword [ebp - 0x260], ebx
je 0x42c88d
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_RequireManaged
call fcn.00423456
call fcn.0042a126
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
call fcn.00423456
call fcn.0042510c
pop ecx
cmp eax, ebx
jne 0x42c88d
push ebx
push 0x4ca5c0
push str.You_are_not_allowd_to_use_unmanaged_apps.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
jmp 0x42c1bf
mov eax, dword [0x4f3b38]
cmp dword [eax - 0xc], ebx
je 0x42c8b0
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f3b38
call fcn.00423af1
call fcn.0042bc85
pop ecx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42c8fd
push 1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp + 0x14]
call fcn.00423645
mov byte [ebp - 4], 0x1d
or dword [ebp - 0x234], 2
push 0x4ce7fc
mov ecx, eax
call fcn.00423a1c
test eax, eax
je 0x42c8fd
push ebx
push 0x5c
lea ecx, [ebp + 0x14]
call fcn.004255fd
mov byte [ebp - 0x221], 1
cmp eax, 0xffffffff
je 0x42c904
mov byte [ebp - 0x221], 0
mov dword [ebp - 4], 0x13
test byte [ebp - 0x234], 2
je 0x42c922
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x221], 0
je 0x42c9f8
call fcn.004964ca
push eax
lea ecx, [ebp - 0x228]
call fcn.004214a8
mov byte [ebp - 4], 0x1e
call fcn.004964ca
push eax
lea ecx, [ebp - 0x22c]
call fcn.004214a8
mov byte [ebp - 4], 0x1f
call fcn.0046c140
lea eax, [ebp - 0x22c]
push eax
push 0x42a4d7
push ebx
push dword [0x4f3418]
push 0x4f3410
call fcn.004811b0
push ebx
lea eax, [ebp - 0x228]
push eax
push ebx
push ecx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423af1
push ecx
mov byte [ebp - 4], 0x20
lea eax, [ebp + 0x14]
mov dword [ebp - 0x264], esp
mov ecx, esp
push eax
call fcn.00423af1
mov byte [ebp - 4], 0x1f
call fcn.0046e320
add esp, 0x14
cmp eax, ebx
je 0x42c9d8
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 0x14]
call fcn.00423b12
lea eax, [ebp + 0x14]
push eax
call fcn.00471cd0
pop ecx
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp + 0x14]
push dword [ebp - 0x240]
push dword [ebp + 0xc]
push str.Loader_Main:_AutoLaunchMode_d__AutoLaunchRaw_s__ExecCmd_s
push eax
call fcn.00462190
add esp, 0x14
call fcn.0042a126
cmp dword [ebp + 0xc], 2
pop ecx
je 0x42d249
mov eax, dword [0x4f3af8]
cmp dword [eax - 0xc], ebx
je 0x42cb76
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x42ca56
push 0x4cea34
lea ecx, [ebp + 0x14]
call fcn.00423a1c
test eax, eax
jne 0x42cb76
lea esi, [ebp - 0x27c]
call fcn.0047d8b0
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f3ad0
call fcn.00423af1
call fcn.0047d1d0
mov esi, eax
cmp esi, ebx
je 0x42cb40
cmp dword [esi + 0x834], ebx
je 0x42cb40
call fcn.004964ca
push eax
lea ecx, [ebp - 0x230]
call fcn.004214a8
mov byte [ebp - 4], 0x22
cmp dword [esi + 0x834], ebx
mov dword [ebp - 0x22c], ebx
jle 0x42cb12
lea edi, [esi + 0x838]
push dword [edi]
lea eax, [ebp - 0x220]
push 0x4cea3c
push eax
call fcn.00462190
add esp, 0xc
mov byte [ebp - 4], 0x23
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x230]
push eax
call fcn.0042449d
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
inc dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
add edi, 8
cmp eax, dword [esi + 0x834]
jl 0x42cabe
mov esi, dword [ebp - 0x230]
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push esi
push str.AutoUpdate:_app_already_running__aborting__PIDs_s_
push eax
call fcn.00462190
add esp, 0xc
call fcn.0042a126
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042101a
jmp 0x42cb67
mov eax, dword [0x4f384c]
cmp eax, ebx
je 0x42cb50
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
push 0x42bf18
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0x13
call fcn.0047d8d0
test byte [0x4f3b34], 2
je 0x42cb89
mov ecx, 0x4f3ac8
call fcn.0042311d
cmp dword [ebp - 0x244], ebx
je 0x42cc4a
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x230]
call fcn.00423af1
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 0x24
call fcn.00471cd0
mov edi, dword [ebp - 0x230]
pop ecx
push 1
push edi
lea ecx, [ebp - 0x21c]
call fcn.00424d73
pop ecx
pop ecx
test eax, eax
je 0x42cbec
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 0x254], 2
jmp 0x42cc3e
call fcn.004964ca
push eax
lea ecx, [ebp - 0x248]
call fcn.004214a8
mov byte [ebp - 4], 0x25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x248]
push str.Could_not_inject_explorer.exe__Error_d_
push eax
call fcn.0042161d
mov esi, dword [ebp - 0x248]
add esp, 0xc
push ebx
push str.Error
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x254], ebx
call fcn.0042101a
mov byte [ebp - 4], 0x13
lea ecx, [edi - 0x10]
jmp 0x42d244
mov eax, dword [ebp - 0x240]
cmp dword [eax - 0xc], ebx
jne 0x42cc61
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x42d249
cmp dword [ebp - 0x268], ebx
je 0x42cd51
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_Waiting_for_AutoLaunchMenu
push eax
call fcn.00462190
pop ecx
pop ecx
call fcn.0042a126
mov edi, 0x4f3ac8
mov dword [esp], 0x404
call fcn.0047c840
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4f3ad4
lea ecx, [ebp - 0x240]
call fcn.00423b12
push str._Cancel_
lea ecx, [ebp - 0x240]
call fcn.00423a1c
test eax, eax
jne 0x42cd41
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_cancelled_n
call fcn.00423456
call fcn.0042a126
pop ecx
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
inc eax
jmp 0x42d2be
call fcn.0043465f
push 0x405
call fcn.0047c840
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp - 0x240]
push str.Loader_Main:_AutoLaunchRaw_s
push eax
call fcn.00462190
add esp, 0xc
call fcn.0042a126
pop ecx
mov dword [ebp - 0x228], ebx
call fcn.004964ca
push eax
lea ecx, [ebp - 0x234]
call fcn.004214a8
mov byte [ebp - 4], 0x26
call fcn.004964ca
push eax
lea ecx, [ebp - 0x22c]
call fcn.004214a8
push 0x3e
push ecx
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x240]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x228]
call fcn.00423af1
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.00465e10
add esp, 0xc
mov byte [ebp - 4], 0x28
call fcn.0042359c
push eax
lea ecx, [ebp - 0x234]
call fcn.00423b12
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x3e
push ecx
lea eax, [ebp - 0x240]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423af1
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.00465e10
add esp, 0xc
mov byte [ebp - 4], 0x29
call fcn.0042359c
push eax
lea ecx, [ebp - 0x22c]
call fcn.00423b12
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
push 1
push ebx
lea edi, [ebp - 0x234]
call fcn.0047c5a0
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x220], esp
push dword [ebp - 0x234]
push str.Loader_Main:_AutoLaunchCmd_s
push eax
call fcn.00462190
add esp, 0xc
call fcn.0042a126
mov eax, esp
mov dword [ebp - 0x220], esp
lea ecx, [ebp - 0x21c]
push ecx
push str.Loader_Main:_Loading_DLL_to_get_myself_hooked:__s
push eax
call fcn.00462190
add esp, 0xc
call fcn.0042a126
mov dword [esp], str.TRUE
push str.CAMEYO_VIRTUALAPP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
lea eax, [ebp - 0x21c]
push eax
push str.Loader_Main:_LoadLibrary__s_0x_x
push ecx
call fcn.00462190
add esp, 0x10
call fcn.0042a126
pop ecx
call fcn.004964ca
push eax
lea ecx, [ebp - 0x228]
call fcn.004214a8
mov byte [ebp - 4], 0x2a
call fcn.004964ca
push eax
lea ecx, [ebp - 0x244]
call fcn.004214a8
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp + 0x14]
push ecx
mov dword [ebp - 0x220], esp
cmp dword [eax - 0xc], ebx
jne 0x42cf5a
mov eax, esp
push dword [ebp - 0x234]
push str.ExecName:_Taking_AutoLaunchCmd_s
push eax
call fcn.00462190
add esp, 0xc
call fcn.0042a126
pop ecx
mov eax, edi
push eax
lea ecx, [ebp - 0x228]
call fcn.00423b12
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x244]
cmp dword [eax - 0xc], ebx
jne 0x42cf86
lea eax, [ebp - 0x22c]
jmp 0x42cf89
mov ecx, esp
push eax
push str.ExecName:_Taking_ExecCmd_s
push ecx
call fcn.00462190
add esp, 0xc
call fcn.0042a126
pop ecx
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x228]
call fcn.00423b12
lea ecx, [ebp - 0x244]
lea eax, [ebp + 0x18]
push eax
call fcn.00423b12
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
call fcn.00423af1
lea eax, [ebp - 0x238]
push eax
mov byte [ebp - 4], 0x2c
call fcn.00471cd0
pop ecx
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push dword [ebp - 0x238]
mov dword [ebp - 0x260], eax
push str.Loader_Main:_GetFileAttributes__s__d
push ecx
call fcn.00462190
add esp, 0x10
call fcn.0042a126
pop ecx
push 0x5c
push ecx
lea eax, [ebp - 0x238]
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423af1
lea eax, [ebp - 0x220]
push eax
call fcn.004627d0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov dword [ebp - 0x260], eax
call fcn.0042101a
push ecx
mov dword [ebp - 0x220], esp
mov esi, esp
push dword [ebp - 0x260]
lea eax, [ebp - 0x238]
push 0x5c
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
call fcn.00423af1
lea eax, [ebp - 0x220]
push eax
call fcn.004627d0
add esp, 0xc
mov byte [ebp - 4], 0x2d
push dword [eax]
push str.Loader_Main:_SetCurrentDirectory__s__d
push esi
call fcn.00462190
add esp, 0x10
call fcn.0042a126
pop ecx
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [0x4f3b3c]
cmp dword [eax - 0xc], ebx
je 0x42d0bf
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push 0x4f3b3c
call fcn.00423af1
call fcn.00464bb0
pop ecx
cmp eax, ebx
je 0x42d0bf
mov eax, dword [0x4f3b3c]
mov dword [ebp - 0x230], eax
jmp 0x42d0c5
mov dword [ebp - 0x230], ebx
mov esi, dword [ebp - 0x228]
push ecx
mov eax, esp
mov dword [ebp - 0x220], esp
lea ecx, [ebp - 0x21c]
push ecx
push esi
push str.Loader_Main:_ExecName_s__Dll32Name_s
push eax
mov dword [ebp - 0x248], ebx
call fcn.00462190
add esp, 0x10
call fcn.0042a126
mov eax, dword [ebp + 0x1c]
pop ecx
and eax, 1
push eax
push dword [ebp - 0x230]
lea eax, [ebp - 0x244]
push ecx
mov dword [ebp - 0x220], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x248]
call fcn.00423af1
push ecx
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x264], esp
push eax
call fcn.00423456
push ecx
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x228]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
call fcn.00423af1
mov ecx, edi
mov byte [ebp - 4], 0x2c
call fcn.0042a17d
add esp, 0x14
cmp eax, ebx
je 0x42d1ac
mov edi, dword [ebp - 0x25c]
mov dword [ebp - 0x254], 1
cmp edi, ebx
je 0x42d205
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, edi
mov ecx, 0x1770
cmp edx, ecx
jae 0x42d19a
sub edi, eax
push 1
add edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push 0x404
mov edi, 0x4f3ac8
call fcn.0047c840
pop ecx
jmp 0x42d205
call fcn.004964ca
push eax
lea ecx, [ebp - 0x25c]
call fcn.004214a8
mov byte [ebp - 4], 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x248]
lea eax, [ebp - 0x25c]
push esi
push str.Could_not_execute__s__Error_d__MyPID_d_
push eax
call fcn.0042161d
mov edi, dword [ebp - 0x25c]
add esp, 0x14
push ebx
push str.Error
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x254], ebx
call fcn.0042101a
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x404
mov edi, 0x4f3ac8
call fcn.0047c840
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.Loader_Main:_out_n
call fcn.00423456
call fcn.0042a126
pop ecx
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp - 0x254]
call fcn.004a9ab8
ret