Function at 0x435082
Capabilities:
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create thread
Get file attributes
Set current directory
Set environment variable
Terminate process

Disassembly:
push 0x8c
mov eax, 0x4d8ec6
call fcn.004b8118
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
push 3
pop esi
mov dword [ebp - 4], esi
call fcn.004a35be
push eax
lea ecx, [ebp - 0x38]
call fcn.0042249e
mov byte [ebp - 4], 4
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call fcn.004a35be
push eax
lea ecx, [ebp - 0x44]
call fcn.0042249e
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.00465b10
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 0x18]
push dword [eax]
push str.Loader_Main:_in:_ProcessName_s__ExecCmd_s
push ecx
call fcn.00466ad0
add esp, 0x10
call fcn.00431948
pop ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
call fcn.00429b89
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x435129
lea eax, [ebp - 0x14]
push str.Cannot_open_virtual_app_data._Please_check_that_file_isnt_corrupted
push eax
call fcn.00466ad0
pop ecx
pop ecx
push dword [eax]
call fcn.00431978
lea eax, [ebp + 0xc]
push eax
mov ecx, 0x51ef68
call fcn.00424d3a
push 0x51ef00
mov ecx, edi
call fcn.00429a22
mov eax, dword [ebp + 0x24]
pop ecx
cmp eax, 0xffffffff
je 0x435151
mov dword [0x51ef98], eax
mov eax, dword [0x51efc8]
cmp eax, esi
je 0x435171
mov ecx, dword [ebp + 0x18]
cmp eax, 1
jne 0x435167
cmp dword [ecx - 0xc], ebx
jne 0x435171
cmp eax, 2
jne 0x43518e
cmp dword [ecx - 0xc], ebx
jne 0x43518e
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push str.Loader_Main:_activating_ExecWait
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
or dword [ebp + 0x20], 1
pop ecx
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push 0x51ef0c
xor esi, esi
call fcn.00424d19
mov ecx, esi
call fcn.00478560
pop ecx
cmp word [0x51ef70], bx
je 0x43520a
xor eax, eax
mov word [ebp - 0x6c], ax
lea edi, [ebp - 0x6a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [ebp - 0x6c]
cmp ax, word [0x51ef70]
jb 0x43520a
mov ax, word [ebp - 0x6a]
cmp ax, word [0x51ef72]
jb 0x43520a
mov ax, word [ebp - 0x66]
cmp ax, word [0x51ef76]
jb 0x43520a
push ebx
push str.Expiration
push str.Package_expired
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x14
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x51ef84], ebx
je 0x435217
call fcn.00434a77
mov esi, 0x51ef00
call fcn.004312cb
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x435281
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.AuthToken.dat
lea edi, [ebp - 0x1c]
call fcn.0042462c
push esi
xor ecx, ecx
call fcn.004779d0
mov edx, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, 0x51ef00
call fcn.00430b58
cmp eax, ebx
jne 0x435281
cmp dword [0x51efd8], ebx
je 0x43527d
mov eax, dword [0x51efdc]
cmp dword [eax - 0xc], ebx
je 0x43527d
push ebx
push dword [0x51ef0c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x11
jmp 0x435204
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Vintegrate:
call fcn.0042462c
push ecx
mov byte [ebp - 4], 7
lea eax, [ebp + 0x18]
mov dword [ebp - 0x48], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 5
call fcn.0046ad50
add esp, 0xc
cmp eax, ebx
je 0x4352be
mov dword [ebp - 0x58], 1
jmp 0x4352f9
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VintegrateRecursive:
call fcn.0042462c
push ecx
mov byte [ebp - 4], 8
lea eax, [ebp + 0x18]
mov dword [ebp - 0x48], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 5
call fcn.0046ad50
add esp, 0xc
cmp eax, ebx
je 0x43531b
mov dword [ebp - 0x58], 2
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.00424d3a
push ebx
push 0x3a
lea ecx, [ebp - 0x44]
call fcn.00426cae
push ebx
lea ecx, [ebp - 0x44]
inc eax
push ecx
call fcn.004246c3
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov esi, 0x51ef00
call fcn.00424d19
mov ecx, esi
call fcn.004348d0
lea ecx, [ebp - 0x4c]
mov dword [esp], 0x4e3948
call fcn.0042462c
push dword [ebp - 0x58]
lea eax, [ebp - 0x18]
push str.VintegrateMode_d_n
push eax
mov byte [ebp - 4], 9
call fcn.00466ad0
add esp, 0xc
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x4c]
push eax
call fcn.0042596c
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
push dword [ebp - 0x44]
lea eax, [ebp - 0x18]
push str.VintegrateTgtPattern_s_n
push eax
call fcn.00466ad0
add esp, 0xc
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x4c]
push eax
call fcn.0042596c
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x18]
push str.StartTickTime_d_n
push eax
call fcn.00466ad0
add esp, 0xc
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x4c]
push eax
call fcn.0042596c
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.RunningInfo.ini
lea edi, [eax + eax]
call fcn.0042462c
push 1
push esi
call fcn.004776d0
add esp, 0x18
call fcn.004674a0
pop ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtFiles.Prog.db
call fcn.0042462c
push esi
mov ecx, ebx
call fcn.004779d0
pop ecx
pop ecx
call fcn.00469180
pop ecx
cmp eax, ebx
jne 0x4354ee
call fcn.00432003
test eax, eax
jne 0x435474
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x5c], eax
call fcn.0042f3c5
push 0x405
mov edi, 0x51ef00
call fcn.00482ac0
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [0x51ef0c]
push str.AppVirtDll__s.dll
push eax
call fcn.00466ad0
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
mov ecx, ebx
call fcn.004779d0
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xd
call fcn.00424d3a
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
push dword [0x51ef18]
mov esi, dword [0x51ef0c]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x51ef6c]
push eax
mov eax, esi
call fcn.00482fa0
mov edi, 0x4e3948
cmp dword [0x51ef10], ebx
je 0x43554d
mov eax, 0x51ef10
jmp 0x435561
mov eax, dword [0x51ef58]
cmp dword [eax - 0xc], ebx
je 0x435474
cmp dword [ebp + 0x10], 2
je 0x435474
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [0x51ef0c]
push str.StartStreaming:AppID_s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004273ff
pop ecx
pop ecx
cmp eax, ebx
jne 0x435474
push dword [0x51ef0c]
lea eax, [ebp - 0x14]
push str.Cannot_stream_application__s_
push eax
call fcn.00466ad0
add esp, 0xc
jmp 0x435122
push edi
lea ecx, [ebp - 0x78]
call fcn.0042462c
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x2c], 1
push eax
lea ecx, [ebp - 0x34]
call fcn.00424d19
mov dword [ebp - 4], 0x10
test byte [ebp - 0x2c], 1
je 0x435586
mov ecx, dword [ebp - 0x78]
and dword [ebp - 0x2c], 0xfffffffe
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [ebp + 0x10], 2
mov dword [ebp - 0x3c], ebx
je 0x4357cf
mov eax, dword [ebp + 0x18]
cmp dword [eax - 0xc], ebx
jne 0x435664
push 0x3b
push dword [0x51ef10]
call fcn.004b2768
pop ecx
pop ecx
test eax, eax
jne 0x4355bc
cmp dword [ebp + 0x10], 1
jne 0x4357cf
push edi
lea ecx, [ebp - 0x30]
call fcn.0042462c
mov byte [ebp - 4], 0x11
cmp dword [0x51efcc], ebx
je 0x435635
cmp dword [ebp + 0x10], 1
je 0x435635
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.AutoLaunchAlways
lea edi, [ebp - 0x30]
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x12
mov eax, esp
mov dword [ebp - 0x48], esp
push dword [0x51ef0c]
push str.SoftwareVOS_s
push eax
call fcn.00466ad0
add esp, 0xc
push SysReAllocStringLen
mov byte [ebp - 4], 0x11
call fcn.004675b0
add esp, 0x18
cmp eax, ebx
je 0x435635
mov eax, dword [ebp - 0x30]
cmp dword [eax - 0xc], ebx
je 0x435635
mov eax, edi
push eax
lea ecx, [ebp - 0x34]
call fcn.00424d3a
jmp 0x435658
push 0x404
mov edi, 0x51ef00
call fcn.00482ac0
pop ecx
push ebx
push ebx
push ebx
push 0x434607
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x30]
jmp 0x4357c7
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x18]
call fcn.0042481b
push 0x4eb7ec
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.00424c44
neg eax
sbb al, al
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x18]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x21], al
call fcn.0042201a
cmp byte [ebp - 0x21], bl
je 0x4357cf
push ebx
lea eax, [ebp + 0x18]
push eax
xor eax, eax
inc eax
call fcn.004246c3
push dword [ebp + 0x18]
call fcn.004b4131
pop ecx
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ebx
call fcn.0042462c
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], ebx
jle 0x4357ab
mov esi, 0x4e7918
lea eax, [ebp - 0x20]
push eax
push 0x4e7908
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x34]
call fcn.0042aeb5
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x15
call fcn.00424d3a
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [ebp + 0x1c]
cmp dword [eax - 0xc], ebx
je 0x435786
lea eax, [ebp - 0x74]
push eax
push esi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x74], ebx
call fcn.0042aeb5
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x16
call fcn.0042487b
add esp, 0xc
lea ecx, [ebp + 0x1c]
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 0x17
call fcn.0042bbbd
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x18
call fcn.00424d3a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [ebp - 0x20], 0xffffffff
je 0x4358af
mov eax, dword [ebp - 0x28]
cmp dword [eax - 0xc], ebx
je 0x4358af
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x18]
jl 0x4356dd
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.00424d3a
push edi
lea ecx, [ebp + 0x18]
call fcn.00425210
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
mov dword [ebp - 0x84], ebx
lea edi, [ebp - 0x80]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x98], bl
xor eax, eax
lea edi, [ebp - 0x97]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea esi, [ebp - 0x98]
lea edi, [ebp - 0x84]
call fcn.0046d2b0
push dword [0x51ef0c]
lea eax, [ebp - 0x1c]
push 0x4eb7f0
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
mov eax, edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042201a
cmp esi, ebx
je 0x435871
push ecx
mov eax, esp
mov dword [ebp - 0x48], esp
push str.Loader_Main:_waiting_on_BasicDeployMutex
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
pop ecx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
mov eax, esp
mov dword [ebp - 0x48], esp
push str.Loader_Main:_done_waiting_on_BasicDeployMutex
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
pop ecx
push ebx
push dword [ebp + 0x10]
push 0x51ef00
push dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.00432324
add esp, 0x14
mov edi, eax
cmp esi, ebx
je 0x43589c
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x4358c8
cmp edi, 7
jne 0x4358b9
push str.Failed_deploying_files._Please_make_sure_application_is_not_currently_running_and_try_again.
jmp 0x435124
push 0xff
jmp 0x435204
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0046d880
jmp 0x435120
push 1
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, str.RequireManaged
push edi
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x19
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov esi, str.SoftwareCameyo
push esi
call fcn.0042462c
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x10
call fcn.00467830
add esp, 0x14
cmp eax, ebx
jne 0x435945
push 1
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x1a
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.0042462c
mov byte [ebp - 4], 0x1b
call fcn.00476dd0
push eax
mov byte [ebp - 4], 0x10
call fcn.00467830
add esp, 0x14
cmp eax, ebx
je 0x43598f
cmp dword [ebp - 0x50], ebx
je 0x43598f
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_Main:_RequireManaged
call fcn.0042462c
call fcn.00431948
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.004267b8
pop ecx
cmp eax, ebx
jne 0x43598f
push ebx
push 0x4e2490
push str.You_are_not_allowed_to_use_unmanaged_apps.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
jmp 0x435204
mov eax, dword [0x51ef9c]
cmp dword [eax - 0xc], ebx
je 0x4359af
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push 0x51ef9c
call fcn.00424d19
call fcn.0043443b
pop ecx
mov eax, dword [ebp + 0x18]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x4359f3
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0x18]
call fcn.0042481b
mov byte [ebp - 4], 0x1c
or dword [ebp - 0x2c], 2
push 0x4eb7ec
mov ecx, eax
call fcn.00424c44
test eax, eax
je 0x4359f3
push ebx
push 0x5c
lea ecx, [ebp + 0x18]
call fcn.00426cae
mov byte [ebp - 0x21], 1
cmp eax, 0xffffffff
je 0x4359f6
mov byte [ebp - 0x21], bl
mov dword [ebp - 4], 0x10
test byte [ebp - 0x2c], 2
je 0x435a0e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x21], bl
je 0x435af2
call fcn.004a35be
push eax
lea ecx, [ebp - 0x28]
call fcn.0042249e
mov byte [ebp - 4], 0x1d
call fcn.004a35be
push eax
lea ecx, [ebp - 0x20]
call fcn.0042249e
mov byte [ebp - 4], 0x1e
call fcn.00471c10
lea eax, [ebp - 0x20]
push eax
push 0x431d3e
push ebx
push dword [0x51e774]
push 0x51e76c
call fcn.00486600
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
push ecx
mov byte [ebp - 4], 0x1f
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 0x1e
call fcn.00472f10
add esp, 0x14
cmp eax, ebx
je 0x435ad8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x18]
call fcn.00424d3a
lea eax, [ebp + 0x18]
push eax
call fcn.00476570
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x14]
push eax
call fcn.00477300
pop ecx
pop ecx
push eax
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x20
call fcn.00424d3a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 0x18]
push dword [ebp - 0x34]
push dword [ebp + 0x10]
push str.Loader_Main:_AutoLaunchMode_d__AutoLaunchRaw_s__ExecCmd_s
push eax
call fcn.00466ad0
add esp, 0x14
call fcn.00431948
cmp dword [ebp + 0x10], 2
pop ecx
je 0x436354
mov eax, dword [0x51ef48]
cmp dword [eax - 0xc], ebx
je 0x435c5c
mov eax, dword [ebp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x435b4a
push 0x4ebaec
lea ecx, [ebp + 0x18]
call fcn.00424c44
test eax, eax
jne 0x435c5c
lea esi, [ebp - 0x6c]
call fcn.00483490
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x14], esp
mov ecx, esp
push 0x51ef0c
call fcn.00424d19
call fcn.00483010
mov esi, eax
cmp esi, ebx
je 0x435c13
cmp dword [esi + 0x424], ebx
je 0x435c13
call fcn.004a35be
push eax
lea ecx, [ebp - 0x18]
call fcn.0042249e
mov byte [ebp - 4], 0x22
cmp dword [esi + 0x424], ebx
mov dword [ebp - 0x20], ebx
jle 0x435beb
lea edi, [esi + 0x428]
push dword [edi]
lea eax, [ebp - 0x14]
push 0x4ebb48
push eax
call fcn.00466ad0
add esp, 0xc
mov byte [ebp - 4], 0x23
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
push eax
call fcn.0042596c
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add edi, 8
cmp eax, dword [esi + 0x424]
jl 0x435ba6
mov esi, dword [ebp - 0x18]
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push esi
push str.AutoUpdate:_app_already_running__aborting__PIDs_s_
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042201a
jmp 0x435c50
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.AutoUpdate:_triggering_async_autoupdate
call fcn.0042462c
call fcn.00431948
mov eax, dword [0x51ebb8]
pop ecx
cmp eax, ebx
je 0x435c39
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
push 0x4348b1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 0x10
call fcn.004834b0
test byte [0x51ef98], 2
je 0x435c6f
mov edi, 0x51ef00
call fcn.00434f8f
cmp dword [ebp - 0x58], ebx
je 0x435d0f
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x18]
call fcn.00424d19
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x24
call fcn.00476570
mov edi, dword [ebp - 0x18]
pop ecx
mov ecx, dword [ebp - 0x38]
push 1
push edi
call fcn.0042640e
pop ecx
pop ecx
test eax, eax
je 0x435cbd
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 0x54], 2
jmp 0x435d03
call fcn.004a35be
push eax
lea ecx, [ebp - 0x40]
call fcn.0042249e
mov byte [ebp - 4], 0x25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x40]
push str.Could_not_inject_explorer.exe__Error_d_
push eax
call fcn.00422613
mov esi, dword [ebp - 0x40]
add esp, 0xc
push ebx
push str.Error
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x54], ebx
call fcn.0042201a
mov byte [ebp - 4], 0x10
lea ecx, [edi - 0x10]
jmp 0x43634f
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], ebx
jne 0x435d23
mov eax, dword [ebp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x436354
cmp dword [ebp - 0x3c], ebx
je 0x435e17
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.Loader_Main:_Waiting_for_AutoLaunchMenu
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
mov edi, 0x51ef00
mov dword [esp], 0x404
call fcn.00482ac0
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x51ef10
lea ecx, [ebp - 0x34]
call fcn.00424d3a
push str._Cancel_
lea ecx, [ebp - 0x34]
call fcn.00424c44
test eax, eax
jne 0x435dfe
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_Main:_cancelled_n
call fcn.0042462c
call fcn.00431948
pop ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
inc eax
jmp 0x4363d3
call fcn.00432003
test eax, eax
jne 0x435e17
call fcn.0042f3c5
push 0x405
call fcn.00482ac0
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp - 0x34]
push str.Loader_Main:_AutoLaunchRaw_s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
mov dword [ebp - 0x20], ebx
call fcn.004a35be
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042249e
mov byte [ebp - 4], 0x26
call fcn.004a35be
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042249e
push 0x3e
push ecx
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
lea edi, [ebp - 0x20]
call fcn.00424d19
lea eax, [ebp - 0x14]
push eax
call fcn.0046a6d0
add esp, 0xc
mov byte [ebp - 4], 0x28
call fcn.00424772
push eax
lea ecx, [ebp - 0x2c]
call fcn.00424d3a
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x3e
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x14]
push eax
call fcn.0046a6d0
add esp, 0xc
mov byte [ebp - 4], 0x29
call fcn.00424772
push eax
lea ecx, [ebp - 0x3c]
call fcn.00424d3a
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
push 1
push 1
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x14]
push eax
call fcn.00477b60
add esp, 0x14
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0x2c]
call fcn.00424d3a
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp - 0x2c]
push str.Loader_Main:_AutoLaunchCmd_s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp - 0x38]
push str.Loader_Main:_Loading_DLL_to_get_myself_hooked:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [esp], str.TRUE
push str.CAMEYO_VIRTUALAPP
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x4e5978
mov edi, str.APPVIRTDLL_LOADED_BY_LOADER
push edi
call esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x38]
push str.Loader_Main:_LoadLibrary__s_0x_x__LE_d
push ecx
call fcn.00466ad0
add esp, 0x14
call fcn.00431948
mov dword [esp], 0x4e3948
push edi
call esi
call fcn.004a35be
push eax
lea ecx, [ebp - 0x20]
call fcn.0042249e
mov byte [ebp - 4], 0x2b
call fcn.004a35be
push eax
lea ecx, [ebp - 0x30]
call fcn.0042249e
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp + 0x18]
push ecx
mov dword [ebp - 0x14], esp
cmp dword [eax - 0xc], ebx
jne 0x436017
mov eax, esp
push dword [ebp - 0x2c]
push str.ExecName:_Taking_AutoLaunchCmd_s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00424d3a
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x30]
cmp dword [eax - 0xc], ebx
jne 0x43603d
lea eax, [ebp - 0x3c]
jmp 0x436040
mov ecx, esp
push eax
push str.ExecName:_Taking_ExecCmd_s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.00424d3a
lea ecx, [ebp - 0x30]
lea eax, [ebp + 0x1c]
push eax
call fcn.00424d3a
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x28]
call fcn.00424d19
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x2d
call fcn.00476570
pop ecx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
push str.Loader_Main:_GetFileAttributes__s__d
push ecx
call fcn.00466ad0
add esp, 0x10
call fcn.00431948
pop ecx
mov esi, str.Original
push esi
push dword [0x51efa4]
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x4360d4
push 0x5c
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x14]
push eax
call fcn.00466ee0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x50], eax
call fcn.0042201a
push ecx
mov dword [ebp - 0x14], esp
mov edi, esp
push dword [ebp - 0x50]
lea eax, [ebp - 0x28]
push 0x5c
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x14]
push eax
call fcn.00466ee0
add esp, 0xc
mov byte [ebp - 4], 0x2e
push dword [eax]
push str.Loader_Main:_SetCurrentDirectory__s__d
push edi
call fcn.00466ad0
add esp, 0x10
call fcn.00431948
pop ecx
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [0x51efa4]
cmp dword [eax - 0xc], ebx
je 0x43615e
push esi
push eax
call fcn.004b19fe
pop ecx
pop ecx
test eax, eax
je 0x43615e
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push 0x51efa4
call fcn.00424d19
call fcn.004691c0
pop ecx
cmp eax, ebx
je 0x43615e
mov eax, dword [0x51efa4]
mov dword [ebp - 0x18], eax
jmp 0x436161
mov dword [ebp - 0x18], ebx
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.C_License.txt
call fcn.0042462c
push ebx
push esi
call fcn.004776d0
add esp, 0x18
call fcn.00469180
mov dword [ebp - 0x14], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.License.accepted
mov esi, eax
call fcn.0042462c
push ebx
push edi
call fcn.004776d0
add esp, 0x18
call fcn.00469180
mov dword [ebp - 0x14], esp
mov edi, eax
mov eax, esp
push edi
push esi
push dword [0x51ebbc]
push str.Loader_Main:_EULA:_g_hEulaThread_d__EulaFile_d__EulaAccepted_d
push eax
call fcn.00466ad0
add esp, 0x14
call fcn.00431948
pop ecx
cmp dword [0x51ebbc], ebx
jne 0x4361f8
cmp esi, ebx
je 0x436230
cmp edi, ebx
jne 0x436230
push ebx
call fcn.004346ce
call fcn.00434a00
cmp dword [0x51ebbc], ebx
je 0x436230
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.Loader_Main:_waiting_for_EULA_to_be_accepted
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
pop ecx
push 0xffffffffffffffff
push dword [0x51ebbc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x51ebbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00434a00
mov esi, dword [ebp - 0x20]
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp - 0x38]
mov dword [ebp - 0x40], ebx
push esi
push str.Loader_Main:_ExecName_s__Dll32Name_s
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.00431948
pop ecx
push dword [ebp + 0x20]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x30]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
push ecx
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x38]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00424d19
push ecx
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x20]
mov dword [ebp - 0x48], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 0x2d
call fcn.0043199f
add esp, 0x18
cmp eax, ebx
je 0x4362e3
mov edi, dword [ebp - 0x5c]
mov dword [ebp - 0x54], 1
cmp edi, ebx
je 0x43631c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, edi
mov ecx, 0x1770
cmp edx, ecx
jae 0x4362d1
sub edi, eax
push 1
add edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push 0x404
mov edi, 0x51ef00
call fcn.00482ac0
pop ecx
jmp 0x43631c
test byte [ebp + 0x20], 2
jne 0x436319
push dword [ebp - 0x40]
lea eax, [ebp - 0x14]
push esi
push str.Could_not_execute__s__Error_d_
push eax
call fcn.00466ad0
mov eax, dword [eax]
add esp, 0x10
push ebx
push str.Error
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov dword [ebp - 0x54], ebx
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042201a
lea ecx, [esi - 0x10]
call fcn.0042201a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x404
mov edi, 0x51ef00
call fcn.00482ac0
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_Main:_out_n
call fcn.0042462c
call fcn.00431948
pop ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [ebp - 0x54]
call fcn.004b81f0
ret