Function at 0x43074b
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if file exists
Check os version
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Get file attributes
Get hostname
Get number of processors
Move file
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Set current directory
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4abd78
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x718c
call fcn.00493a40
mov eax, dword [0x4cfc64]
xor eax, esp
mov dword [esp + 0x7188], eax
push ebx
push esi
push edi
mov eax, dword [0x4cfc64]
xor eax, esp
push eax
lea eax, [esp + 0x71a0]
mov dword fs:[0], eax
lea eax, [esp + 0x9c]
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0xa0], 8
mov dword [esp + 0xa4], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [esp + 0x34]
call fcn.00488df4
mov ebx, 0x4b263c
push ebx
lea ecx, [esp + 0x78]
call fcn.00421017
xor edi, edi
push ebx
lea ecx, [esp + 0x60]
mov dword [esp + 0x71ac], edi
call fcn.00421017
xor esi, esi
push ebx
lea ecx, [esp + 0x7c]
inc esi
mov byte [esp + 0x71ac], 1
call fcn.00421017
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x71ac], 2
call fcn.00454b90
pop ecx
lea eax, [esp + 0x60]
mov byte [esp + 0x71a8], 3
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x44], edi
call fcn.00454b90
pop ecx
push dword [eax]
call fcn.0048f20a
pop ecx
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
mov dword [0x4d49d0], eax
call fcn.0042001a
cmp dword [esp + 0x38], edi
je 0x431c4c
cmp dword [esp + 0x60], esi
jle 0x431c4c
mov dword [esp + 0x4c], 2
mov eax, dword [esp + 0x38]
push ecx
lea edi, [eax + esi*4]
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [edi]
call fcn.00421017
call fcn.0042feb8
mov dword [esp], 0x4b6aa4
call fcn.0048e300
pop ecx
push eax
push str._ExeFile:
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
jne 0x4308ce
push 0x4b6aa4
call fcn.0048e300
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x34]
call fcn.00421149
push str._Confirm
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x4308e8
mov dword [esp + 0x50], 1
push str._Quiet
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430905
and dword [0x4d14a8], eax
jmp 0x4310ca
push str._AllUsers
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430958
mov dword [esp + 0x40], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004549e0
test eax, eax
je 0x4310de
call fcn.00454b40
test eax, eax
jne 0x4310ca
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Admin_rights_required
jmp 0x4310f9
push str._ErrorsOnly
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430979
mov dword [0x4d14a8], 1
jmp 0x4310ca
push str._Register
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x43110b
push str._Stop
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4311ac
push str._Remove
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4312c8
push str._Remove:Proc
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4315b0
push str._Remove:Reg
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x431769
push str._LearnStreaming
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4353c6
push 0x4b712c
call fcn.0048e300
pop ecx
push eax
push str._LearnStreaming:
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
je 0x4353c6
push str._UpdateBasicSettings
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430a3f
mov dword [esp + 0x3c], 1
jmp 0x4310ca
push str._Repackage
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x43192b
push str._CreateDiff
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x435212
push 0x4b7360
call fcn.0048e300
pop ecx
push eax
push str._CreateDiff:
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
je 0x435212
push str._exec
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x431aeb
push 0x4b73ac
call fcn.0048e300
pop ecx
push eax
push str._Patch
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
je 0x434ceb
push 0x4b73c4
call fcn.0048e300
pop ecx
push eax
push str._InstSandbox
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
je 0x434ceb
push str._ShowStreaming
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x431d42
push str._Break
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x431e28
push str._Unbreak
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x432397
push str._Integrate
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4349e6
push str._FullIntegrate
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4349e6
push str._Unintegrate
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x432a4a
push str._CreateShortcuts
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x432a9e
push str._Perf
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x432e76
push str._ExtractLog
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x433257
push str._Info
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4333d9
push str._EngineVer
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430d1d
push 1
push eax
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x140]
push eax
call fcn.004227dd
mov byte [esp + 0x71a8], 0xb3
cmp dword [esp + 0x1c0], 0
je 0x43385a
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str._s.AppVirtDll.dll
push eax
call fcn.004559f0
lea eax, [esp + 0x38]
add esp, 0xc
push eax
call fcn.00455180
add esp, 4
mov byte [esp + 0x71ac], 0xb4
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 0xb5
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Main
call fcn.00421017
push 2
lea eax, [esp + 0x140]
push eax
mov byte [esp + 0x71b8], 0xb4
call fcn.0046bbe0
push dword [0x4d14a8]
lea eax, [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x60]
push eax
call fcn.00476720
add esp, 4
mov byte [esp + 0x71b0], 0xb6
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.EngineVersion_s
push ecx
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
mov byte [esp + 0x71a8], 0xb4
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421d56
call fcn.00458ee0
pop ecx
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x134]
push eax
mov byte [esp + 0x71ac], 3
call fcn.0042289c
jmp 0x4310ca
mov eax, dword [esp + 0x38]
push str._ChangeLoader
push dword [eax + 4]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430d42
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x60], eax
jg 0x43386c
push str._ChangeEngine
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430d62
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x60], eax
jg 0x433b7b
push str._Debug
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x433eb5
push str._ForceMenu
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430d97
mov dword [esp + 0x1c], 1
jmp 0x4310ca
push str._ShowTree
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x433f54
push str._DbgZip:
call fcn.0048e8dc
pop ecx
push eax
push str._DbgZip:
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
je 0x43401b
push str._DbgNow
call fcn.0048e8dc
pop ecx
push eax
push str._DbgNow
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
jne 0x430eae
push ebx
lea ecx, [esp + 0x30]
call fcn.00421017
lea eax, [esp + 0x404]
push eax
mov byte [esp + 0x71ac], 0xd8
call fcn.00426090
lea eax, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x71b0], 0xd9
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Prog1._Prog1.._Prog1..._Prog2._Prog2.._Prog2...
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0xda
mov ecx, esp
mov dword [esp + 0x54], esp
push str.FriendlyName
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0xdb
mov ecx, esp
mov dword [esp + 0x24], esp
push str.AppID
call fcn.00421017
lea ecx, [esp + 0x414]
mov byte [esp + 0x71b8], 0xd9
call fcn.00425674
test eax, eax
je 0x430e88
mov eax, dword [esp + 0x2c]
cmp dword [eax - 0xc], 0
jne 0x434057
lea eax, [esp + 0x404]
push eax
mov byte [esp + 0x71ac], 0xd8
call fcn.004261a0
mov byte [esp + 0x71a8], 3
mov ecx, dword [esp + 0x2c]
jmp 0x4310c2
push str._Vintegrate
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4348de
push str._Vintegrate:Full
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4348de
push str._Vunintegrate
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x434078
push str._Vmanager
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4341ff
push str._ProcessList
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4342ad
push str._GfxSvr
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430f6d
call fcn.0042e824
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
push 0x401
mov ebx, 0x4d4988
call fcn.0046d700
mov dword [esp], 0xbb8
call edi
push 0x403
call fcn.0046d700
mov dword [esp], 0x493e0
call edi
jmp 0x430fd7
push 0x4b87a8
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x430fe1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.open
xor edi, edi
xor ebx, ebx
call fcn.00421017
push edi
push ecx
mov byte [esp + 0x71b4], 0xf6
mov ecx, esp
mov dword [esp + 0x24], esp
push str._Troubleshoot
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0xf7
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 3
call fcn.004543e0
add esp, 0x10
mov ebx, 0x4b263c
jmp 0x4310ca
push str._Troubleshoot
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x43459f
push str._AutoUpdate
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4345bf
push str._VirtRegSyncExport
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x434682
push str._StartStreaming
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x4346e9
push 0x4b88cc
call fcn.0048e300
pop ecx
push eax
push str._MakeStreamable:
push dword [edi]
call fcn.0048f0b7
add esp, 0xc
test eax, eax
je 0x434707
push str._JumpTo
push dword [edi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
je 0x43483d
push 0x4b7c50
lea ecx, [esp + 0x60]
call fcn.0042105b
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax]
call fcn.00421017
lea eax, [esp + 0x48]
push eax
call fcn.0045ac10
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x7c]
mov dword [esp + 0x71ac], 0x101
call fcn.00423a98
mov dword [esp + 0x71a8], 3
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042001a
inc esi
inc dword [esp + 0x4c]
cmp esi, dword [esp + 0x60]
jl 0x430879
jmp 0x431c4a
call fcn.00454a30
test eax, eax
jne 0x431103
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Elevation_failed
call fcn.00421017
call fcn.004306cb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.00421e00
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x43113f
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Cannot_obtain_INI_info_from_resource_
jmp 0x4310f9
push ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.00421e00
call fcn.00427cf8
pop ecx
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042001a
xor eax, eax
mov ecx, dword [esp + 0x71a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7188]
xor ecx, esp
call fcn.0048dce1
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.00421e00
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x4311de
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x431138
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [0x4d49c8]
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [0x4d49d0]
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 5
mov ecx, esp
mov dword [esp + 0x54], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 6
mov ecx, esp
mov dword [esp + 0x54], esp
push dword [0x4d4990]
call fcn.00421017
mov byte [esp + 0x71b8], 3
call fcn.0042cbe2
add esp, 0x10
test eax, eax
je 0x431278
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Cannot_stop_application__s
push eax
call fcn.004559f0
add esp, 0xc
jmp 0x4310fe
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.__Stopped_successfully
call fcn.00421017
call fcn.0042feb8
pop ecx
xor esi, esi
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x78]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x5c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x74]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, esi
jmp 0x431188
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x4312fa
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x431138
mov eax, dword [0x4d49cc]
xor esi, esi
cmp word [eax], si
jne 0x431323
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Cannot_obtain_base_dir_for__s
jmp 0x43126a
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421017
call fcn.00458300
pop ecx
cmp eax, esi
jne 0x431357
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Application_is_not_deployed_on_this_machine:__s
jmp 0x43126a
cmp dword [esp + 0x50], esi
je 0x43137e
push 3
push dword [0x4d4990]
push str.Do_you_want_to_remove_the_application_and_all_of_its_settings__files_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x43137e
push 0x14
pop esi
jmp 0x431291
push esi
lea eax, [esp + 0x40]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.AllUsers
mov dword [esp + 0x4c], esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 7
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4d4990]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.004559f0
add esp, 0xc
push SysReAllocStringLen
mov byte [esp + 0x71bc], 3
call fcn.00456bb0
add esp, 0x14
cmp eax, esi
je 0x431427
cmp dword [esp + 0x3c], esi
je 0x431427
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004549e0
test eax, eax
jne 0x43140c
call fcn.00454a30
test eax, eax
jne 0x4333d3
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x4310f4
call fcn.00454b40
test eax, eax
jne 0x431427
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x43094e
call fcn.0042a27f
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4d4990]
push str.Removing__s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.0042feb8
pop ecx
lea ecx, [esp + 0x34]
call fcn.0042048a
push 0x4b280c
mov byte [esp + 0x71ac], 8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push 1
push 1
lea eax, [esp + 0x40]
push eax
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [0x4d49c8]
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 9
mov ecx, esp
mov dword [esp + 0x34], esp
push dword [0x4d49d0]
call fcn.00421017
push ecx
mov byte [esp + 0x71c8], 0xa
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71cc], 0xb
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d4990]
call fcn.00421017
mov byte [esp + 0x71cc], 8
call fcn.0042cfea
add esp, 0x20
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [0x4d49cc]
call fcn.00421017
call fcn.00458340
pop ecx
cmp eax, esi
je 0x431522
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Base_dir_could_not_be_emptied_for__s
jmp 0x43126a
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4d4990]
push edi
push eax
call fcn.004559f0
add esp, 0xc
call fcn.00456e80
pop ecx
cmp eax, esi
je 0x431560
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Registry_could_not_be_emptied_for__s
jmp 0x43126a
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.__Removed_successfully
call fcn.00421017
call fcn.0042feb8
pop ecx
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Application__s_removed_successfully
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x431291
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x4315e2
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x431138
mov eax, dword [0x4d49cc]
xor esi, esi
cmp word [eax], si
jne 0x431600
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
jmp 0x431313
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421017
call fcn.00458300
pop ecx
cmp eax, esi
jne 0x431643
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d49cc]
push dword [0x4d4990]
push str.Application_is_not_deployed_on_this_machine:__s_n_n__s_
push eax
call fcn.004559f0
add esp, 0x10
jmp 0x4310fe
cmp dword [esp + 0x50], esi
je 0x431666
push 3
push dword [0x4d4990]
push str.Do_you_want_to_stop_the_application_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431376
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4d4990]
push str.Removing_processes:__s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.0042feb8
pop ecx
lea ecx, [esp + 0x3c]
call fcn.0042048a
push 0x4b280c
mov byte [esp + 0x71ac], 0xc
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push esi
push 1
lea eax, [esp + 0x48]
push eax
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [0x4d49c8]
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0xd
mov ecx, esp
mov dword [esp + 0x34], esp
push dword [0x4d49d0]
call fcn.00421017
push ecx
mov byte [esp + 0x71c8], 0xe
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71cc], 0xf
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d4990]
call fcn.00421017
mov byte [esp + 0x71cc], 0xc
call fcn.0042cfea
add esp, 0x20
mov ecx, esp
mov dword [esp + 0x18], esp
push str.__Stopped_successfully
call fcn.00421017
call fcn.0042feb8
pop ecx
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Application__s_stopped_successfully
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
mov ecx, dword [esp + 0x3c]
jmp 0x4315a3
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x43179b
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x431138
mov eax, dword [0x4d49cc]
xor esi, esi
cmp word [eax], si
jne 0x4317b9
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
jmp 0x431313
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421017
call fcn.00458300
pop ecx
cmp eax, esi
jne 0x4317e2
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
jmp 0x431624
cmp dword [esp + 0x50], esi
je 0x431805
push 3
push dword [0x4d4990]
push str.Do_you_want_to_remove_the_applications_registry_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431376
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4d4990]
push str.Removing_registry:__s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.0042feb8
pop ecx
lea ecx, [esp + 0x3c]
call fcn.0042048a
push 0x4b280c
mov byte [esp + 0x71ac], 0x10
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push 1
push esi
lea eax, [esp + 0x48]
push eax
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [0x4d49c8]
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x11
mov ecx, esp
mov dword [esp + 0x34], esp
push dword [0x4d49d0]
call fcn.00421017
push ecx
mov byte [esp + 0x71c8], 0x12
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71cc], 0x13
mov ecx, esp
mov dword [esp + 0x68], esp
push dword [0x4d4990]
call fcn.00421017
mov byte [esp + 0x71cc], 0x10
call fcn.0042cfea
add esp, 0x20
mov eax, esp
mov dword [esp + 0x18], esp
push dword [0x4d4990]
push str.SoftwareVOS_s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.00456e80
pop ecx
cmp eax, esi
je 0x4318f7
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
jmp 0x431550
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.__Registry_removed_successfully
call fcn.00421017
call fcn.0042feb8
pop ecx
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str.Application__ss_registry_removed_successfully
jmp 0x431750
lea ecx, [esp + 0x4c]
call fcn.0042048a
lea ecx, [esp + 0x50]
call fcn.0042048a
lea eax, [esi + 1]
mov byte [esp + 0x71a8], 0x1c
cmp dword [esp + 0x60], eax
lea ecx, [esp + 0x4c]
jle 0x431961
mov eax, dword [esp + 0x38]
push dword [eax + esi*4 + 4]
call fcn.0042105b
jmp 0x43196b
lea eax, [esp + 0x30]
push eax
call fcn.00423a98
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str..new.exe
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x1d
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x71b4], 0x1c
call fcn.00455d40
add esp, 0xc
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x71ac], 0x1e
call fcn.00423a98
mov byte [esp + 0x71a8], 0x1c
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x4c]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x50]
jne 0x431a0b
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421d56
jmp 0x4310fe
push 0
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b8], 0x1f
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x1c
call fcn.0042ad2e
add esp, 0x10
mov dword [esp + 0x44], eax
test eax, eax
jne 0x431aa3
push dword [0x4d14a8]
lea eax, [esp + 0x54]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x50]
push eax
call fcn.00455f00
add esp, 8
mov byte [esp + 0x71b0], 0x20
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
mov ecx, dword [esp + 0x44]
jmp 0x435549
push edi
call esi
mov edx, dword [esp + 0x44]
push dword [0x4d14a8]
cmp edx, 0x10
jne 0x431ac6
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Application_not_deployed_on_this_machine._Nothing_to_repackage.
jmp 0x4310f9
lea eax, [esp + 0x18]
push eax
call fcn.0045be10
mov byte [esp + 0x71b0], 0x21
mov ecx, esp
mov dword [esp + 0x20], esp
push dword [eax]
push str.Could_not_repackage:__s
push ecx
jmp 0x43126b
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push dword [eax + esi*4]
call fcn.00421017
lea eax, [esp + 0x48]
push eax
call fcn.0045ac10
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x7c]
mov byte [esp + 0x71ac], 0x29
call fcn.00423a98
push eax
lea ecx, [esp + 0x60]
call fcn.00423a98
push eax
lea ecx, [esp + 0x30]
call fcn.00421d56
mov byte [esp + 0x71a8], 0x2b
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042001a
push 1
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x34]
call fcn.00423c6c
push 0x4b5360
push eax
call fcn.0042a9c6
pop ecx
pop ecx
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
mov byte [esp + 0x57], al
call fcn.0042001a
cmp byte [esp + 0x57], 0
lea ecx, [esp + 0x5c]
je 0x431b82
push 1
push 0x22
jmp 0x431b86
push 0
push 0x20
call fcn.00423bf1
mov esi, eax
cmp esi, 0xffffffff
je 0x431bf5
push esi
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x64]
call fcn.00423c6c
push 0x4b73a4
mov byte [esp + 0x71ac], 0x2c
call fcn.0042a90d
push eax
lea ecx, [esp + 0x60]
call fcn.00423a98
mov byte [esp + 0x71a8], 0x2b
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042001a
push 0
lea ecx, [esp + 0x7c]
lea eax, [esi + 1]
push ecx
call fcn.00423ac2
lea eax, [esp + 0x78]
call fcn.0042580f
push eax
lea ecx, [esp + 0x7c]
call fcn.00423a98
jmp 0x431c17
push 0x4b73a4
lea eax, [esp + 0x30]
call fcn.0042a90d
push eax
lea ecx, [esp + 0x60]
call fcn.00423a98
push ebx
lea ecx, [esp + 0x7c]
call fcn.0042105b
xor ecx, ecx
lea eax, [esp + 0x5c]
call fcn.004355cd
movzx eax, ax
cmp ax, 0x25
jne 0x431c36
lea eax, [esp + 0x5c]
push eax
call fcn.00464b90
pop ecx
mov byte [esp + 0x71a8], 3
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042001a
xor edi, edi
push 1
push edi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x2f0]
push eax
call fcn.004227dd
push ecx
mov dword [esp + 0x71ac], 0x102
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 3
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b4], 4
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b4], 5
push dword [esp + 0x28]
lea eax, [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x2f8]
mov byte [esp + 0x71bc], 2
call fcn.00427de0
add esp, 0x14
cmp eax, 2
jne 0x435597
call fcn.0043064a
push edi
push dword [0x4d4990]
push str.Application_is_now_integrated_into_your_system
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x2e4]
call fcn.0046a940
lea eax, [esp + 0x2e4]
push eax
mov dword [esp + 0x71ac], 3
call fcn.0042289c
jmp 0x431156
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.ShowStreaming:
call fcn.00421017
call fcn.0042feb8
pop ecx
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0xb0]
push eax
call fcn.004227dd
push ecx
mov byte [esp + 0x71ac], 0x3c
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x3d
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x3e
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
push 2
push ecx
mov byte [esp + 0x71bc], 0x3f
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0xb8]
mov byte [esp + 0x71bc], 0x3c
call fcn.00427de0
lea eax, [esp + 0xb8]
add esp, 0x14
push eax
call fcn.00427b84
pop ecx
lea eax, [esp + 0xa4]
call fcn.0046a940
lea eax, [esp + 0xa4]
push eax
mov byte [esp + 0x71ac], 3
call fcn.0042289c
jmp 0x431291
lea ecx, [esp + 0x28]
call fcn.0042048a
lea eax, [esi + 1]
mov byte [esp + 0x71a8], 0x40
cmp dword [esp + 0x60], eax
lea ecx, [esp + 0x28]
jle 0x431e55
mov eax, dword [esp + 0x38]
push dword [eax + esi*4 + 4]
call fcn.0042105b
jmp 0x431e5f
lea eax, [esp + 0x30]
push eax
call fcn.00423a98
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str..break
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x41
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x71b4], 0x40
call fcn.00455d40
add esp, 0xc
push 1
push 0
push ecx
mov byte [esp + 0x71b4], 0x42
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0xb0]
push eax
call fcn.004227dd
mov byte [esp + 0x71a8], 0x43
cmp dword [esp + 0x130], 0
jne 0x431ef1
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Could_not_load_containers_
jmp 0x4310f9
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421d56
call fcn.00457920
pop ecx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x431f32
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [esp + 0x24]
push str.Cant_empty__s
jmp 0x43126a
mov esi, dword [esp + 0x1c]
call fcn.00458390
test eax, eax
jne 0x431f5a
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [esp + 0x24]
push str.Cant_create__s
jmp 0x43126a
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov esi, 0x4b280c
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x44
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x4b2ff8
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x45
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x46
mov ecx, esp
mov dword [esp + 0x20], esp
mov ebx, str.Main
push ebx
call fcn.00421017
push 3
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x47
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll.dll
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x48
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x49
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push 2
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x4a
mov ecx, esp
mov dword [esp + 0x54], esp
push str.AppVirtDll64.dll
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x4b
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x4c
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push 8
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x4d
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtFiles.db
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x4e
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x4f
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push 4
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x50
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SandboxCfg.db
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x51
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x52
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push 5
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x53
mov ecx, esp
mov dword [esp + 0x54], esp
push str.VirtReg.export
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x54
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x55
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push 6
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x56
mov ecx, esp
mov dword [esp + 0x54], esp
push str.SysDllSubdirs.txt
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x57
mov ecx, esp
lea eax, [esp + 0x2c]
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x58
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push 7
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push ecx
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x59
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Core.zip
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x5a
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x43
call fcn.004555d0
add esp, 8
mov byte [esp + 0x71b0], 0x5b
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00421017
push 1
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0x43
call fcn.0046bbe0
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [esp + 0x24]
push 0x4b7774
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
jmp 0x431103
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Unbreak:
call fcn.00421017
call fcn.0042feb8
mov ecx, esp
mov dword [esp + 0x18], esp
push str..break
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x5c
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x71b4], 3
call fcn.00455d40
add esp, 0xc
mov byte [esp + 0x71a8], 0x5d
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43241d
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [esp + 0x24]
push str.Dir_doesnt_exist:__s
jmp 0x43126a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x3c]
call fcn.00421d56
mov esi, str..old
push esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x71b4], 0x5e
call fcn.00424858
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042001a
push esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.00424858
add esp, 0xc
push dword [eax]
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x58]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x4324ad
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Could_not_rename_myself_to_.old
jmp 0x4310f9
push esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00424858
mov eax, dword [eax]
add esp, 0xc
push 0
push dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x44]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x4324fe
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Could_not_copy_myself
jmp 0x4310f9
and dword [esp + 0x3c], 0
push 1
push ecx
mov dword [esp + 0x1c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4b280c
lea ebx, [esp + 0x4c]
lea esi, [esp + 0x3c]
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0x5f
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4b2ff8
call fcn.00421017
push ecx
mov byte [esp + 0x71bc], 0x60
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71bc], 0x5e
call fcn.004555d0
add esp, 0xc
mov edi, esi
call fcn.00456520
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x432a33
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x432a33
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push eax
call fcn.00456280
pop ecx
mov byte [esp + 0x71a8], 0x61
push dword [esp + 0x2c]
call fcn.0048e6f5
pop ecx
push 1
push 1
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00421d56
lea eax, [esp + 0xb0]
push eax
call fcn.004227dd
mov byte [esp + 0x71a8], 0x62
cmp dword [esp + 0x130], 0
jne 0x4325f1
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Could_not_begin_to_update_resource
jmp 0x4310f9
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
mov ebx, str.Main
push ebx
call fcn.00421017
mov byte [esp + 0x71ac], 0x63
mov eax, dword [esp + 0x40]
mov eax, dword [eax - 0xc]
add eax, eax
push 0
push eax
lea ecx, [esp + 0x48]
call fcn.00423f55
push eax
lea esi, [esp + 0xb4]
mov byte [esp + 0x71b8], 0x62
call fcn.0046b270
test eax, eax
je 0x432650
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Could_not_update_INI_resource
jmp 0x4310f9
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
push 0
push 2
push ecx
mov byte [esp + 0x71b8], 0x64
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov esi, 0x4b280c
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71c0], 0x65
mov ecx, esp
mov dword [esp + 0x60], esp
push str.AppVirtDll.dll
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x66
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71c4], 0x64
call fcn.004555d0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0x62
call fcn.0046b4f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
push 0
push 8
push ecx
mov byte [esp + 0x71b8], 0x67
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71c0], 0x68
mov ecx, esp
mov dword [esp + 0x60], esp
push str.AppVirtDll64.dll
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x69
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71c4], 0x67
call fcn.004555d0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0x62
call fcn.0046b4f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
push 0x4000
push 4
push ecx
mov byte [esp + 0x71b8], 0x6a
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71c0], 0x6b
mov ecx, esp
mov dword [esp + 0x60], esp
push str.VirtFiles.db
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x6c
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71c4], 0x6a
call fcn.004555d0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0x62
call fcn.0046b4f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
push 0x4000
push 5
push ecx
mov byte [esp + 0x71b8], 0x6d
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71c0], 0x6e
mov ecx, esp
mov dword [esp + 0x60], esp
push str.SandboxCfg.db
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x6f
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71c4], 0x6d
call fcn.004555d0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0x62
call fcn.0046b4f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
push 0x4000
push 6
push ecx
mov byte [esp + 0x71b8], 0x70
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71c0], 0x71
mov ecx, esp
mov dword [esp + 0x60], esp
push str.VirtReg.export
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x72
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71c4], 0x70
call fcn.004555d0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0x62
call fcn.0046b4f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
push 0
push 7
push ecx
mov byte [esp + 0x71b8], 0x73
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71c0], 0x74
mov ecx, esp
mov dword [esp + 0x60], esp
push str.SysDllSubdirs.txt
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x75
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71c4], 0x73
call fcn.004555d0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0x62
call fcn.0046b4f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00421017
mov byte [esp + 0x71ac], 0x76
push 0x4000
push 1
push ecx
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00421017
push ecx
mov byte [esp + 0x71c0], 0x77
mov ecx, esp
mov dword [esp + 0x60], esp
push str.Core.zip
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x78
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71c4], 0x76
call fcn.004555d0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0x62
call fcn.0046b4f0
lea eax, [esp + 0xa4]
call fcn.0046a940
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
test eax, eax
je 0x432a24
push str.Could_not_commit_resource
jmp 0x4310f9
push str.Success
call fcn.00421017
jmp 0x43238b
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Could_not_load_VirtApp.ini
jmp 0x4310f9
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x432a7c
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x431138
call fcn.0042a27f
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push dword [0x4d4990]
push str._s_is_no_longer_integrated.
jmp 0x432382
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x432ad0
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x431138
push dword [0x4d4994]
lea ecx, [esp + 0x40]
call fcn.00421017
lea eax, [esp + 0x2c]
push eax
push 0x4b3adc
lea eax, [esp + 0x24]
mov byte [esp + 0x71b0], 0x84
and dword [esp + 0x34], 0
push eax
lea ecx, [esp + 0x48]
call fcn.00423b3e
jmp 0x432e3a
lea ecx, [esp + 0x28]
call fcn.0042048a
lea ecx, [esp + 0x40]
call fcn.0042048a
lea ecx, [esp + 0x4c]
call fcn.0042048a
lea ecx, [esp + 0x50]
call fcn.0042048a
push 0x3e
pop edi
push edi
push ecx
mov byte [esp + 0x71b0], 0x89
and dword [esp + 0x40], 0
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
lea esi, [esp + 0x44]
call fcn.00421d56
lea eax, [esp + 0x4c]
push eax
mov ecx, esi
call fcn.004594e0
add esp, 0xc
mov byte [esp + 0x71a8], 0x8a
call fcn.0042580f
push eax
lea ecx, [esp + 0x2c]
call fcn.00423a98
mov byte [esp + 0x71a8], 0x89
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x38], 0xffffffff
jne 0x432bb8
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
jmp 0x432dfd
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
lea esi, [esp + 0x44]
call fcn.00421d56
lea eax, [esp + 0x60]
push eax
mov ecx, esi
call fcn.004594e0
add esp, 0xc
mov byte [esp + 0x71a8], 0x8b
call fcn.0042580f
push eax
lea ecx, [esp + 0x44]
call fcn.00423a98
mov byte [esp + 0x71a8], 0x89
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x38], 0xffffffff
je 0x432b94
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x50]
push eax
mov ecx, esi
call fcn.004594e0
add esp, 0xc
mov byte [esp + 0x71a8], 0x8c
call fcn.0042580f
push eax
lea ecx, [esp + 0x50]
call fcn.00423a98
mov byte [esp + 0x71a8], 0x89
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x38], 0xffffffff
jne 0x432c6e
push ebx
lea ecx, [esp + 0x50]
call fcn.0042105b
jmp 0x432cc5
push edi
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
lea esi, [esp + 0x44]
call fcn.00421d56
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.004594e0
add esp, 0xc
mov byte [esp + 0x71a8], 0x8d
call fcn.0042580f
push eax
lea ecx, [esp + 0x54]
call fcn.00423a98
mov byte [esp + 0x71a8], 0x89
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
cmp dword [esp + 0x38], 0xffffffff
jne 0x432ccf
push ebx
lea ecx, [esp + 0x54]
call fcn.0042105b
push dword [esp + 0x28]
lea eax, [esp + 0x38]
push str._exec___s_
push eax
call fcn.004559f0
add esp, 0xc
mov byte [esp + 0x71a8], 0x8e
mov esi, dword [esp + 0x40]
cmp dword [esi - 0xc], 0
je 0x432d13
push 0x4b4208
lea ecx, [esp + 0x38]
call fcn.004247ea
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x38]
call fcn.00423aad
push ecx
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 0x8f
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b4], 0x90
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x88], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b8], 0x91
mov dword [esp + 0x94], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [esp + 0x98], esp
push 0x4b280c
call fcn.00421017
push ecx
mov eax, esp
mov byte [esp + 0x71c0], 0x92
mov dword [esp + 0x7c], esp
push str..lnk
lea ecx, [esp + 0x68]
push ecx
push eax
call fcn.00424858
add esp, 8
mov byte [esp + 0x71c4], 0x93
mov eax, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00454db0
pop ecx
mov byte [esp + 0x71c4], 0x91
call fcn.004555d0
add esp, 0xc
mov byte [esp + 0x71b8], 0x8e
call fcn.00472160
mov ecx, dword [esp + 0x44]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x50]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [esi - 0x10]
call fcn.0042001a
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [esp + 0x71a8], 0x84
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x2c]
push eax
push 0x4b3adc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.00423b3e
cmp dword [esp + 0x2c], 0xffffffff
jne 0x432b09
mov byte [esp + 0x71a8], 0x84
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4d4990]
push str.Shortcuts_created_for__s.
jmp 0x432382
lea ecx, [esp + 0x34]
call fcn.0042048a
lea ecx, [esp + 0x3c]
call fcn.0042048a
mov byte [esp + 0x71a8], 0x95
or dword [esp + 0x40], 0xffffffff
lea eax, [esi + 1]
cmp dword [esp + 0x60], eax
jle 0x432eaf
mov eax, dword [esp + 0x38]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x38]
call fcn.0042105b
add esi, 2
cmp dword [esp + 0x60], esi
jle 0x432ec8
mov eax, dword [esp + 0x38]
push dword [eax + esi*4]
lea ecx, [esp + 0x40]
call fcn.0042105b
lea ecx, [esp + 0x18]
call fcn.0042048a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x71ac], 0x96
call fcn.00421d56
push ecx
mov byte [esp + 0x71ac], 0x97
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
mov edi, 0x4d4988
mov esi, edi
call fcn.004234f7
pop ecx
test al, al
jne 0x432f23
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431138
xor esi, esi
inc esi
push esi
push 0
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x140]
push eax
call fcn.004227dd
lea eax, [esp + 0x134]
push eax
mov byte [esp + 0x71ac], 0x98
call fcn.00423561
pop ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x3c]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
je 0x432f87
push ecx
push 0x80
push 4
push ecx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x40], eax
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push dword [0x4d49c8]
call fcn.00421017
push ecx
mov byte [esp + 0x71c4], 0x99
mov ecx, esp
mov dword [esp + 0x80], esp
push dword [0x4d49d0]
call fcn.00421017
push ecx
mov byte [esp + 0x71c8], 0x9a
mov ecx, esp
mov dword [esp + 0xa4], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71cc], 0x9b
mov ecx, esp
mov dword [esp + 0xa0], esp
push dword [0x4d4990]
call fcn.00421017
mov byte [esp + 0x71cc], 0x98
call fcn.0042cfea
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x24
call esi
mov dword [esp + 0x44], eax
push 0
lea eax, [esp + 0x138]
push eax
push dword [esp + 0x50]
mov ecx, edi
call fcn.004268e4
add esp, 0xc
test eax, eax
je 0x43304d
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Failed_BasicDeploy_
jmp 0x4310f9
call esi
mov edi, eax
sub edi, dword [esp + 0x44]
call esi
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x34]
cmp dword [eax - 0xc], 0
je 0x433108
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x9c
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x4b7c50
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x9d
mov ecx, esp
mov dword [esp + 0x90], esp
push ebx
call fcn.00421017
push 0
push ecx
mov byte [esp + 0x71bc], 0x9e
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x148]
mov byte [esp + 0x71bc], 0x98
call fcn.00427de0
add esp, 0x14
xor ebx, ebx
push ebx
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421d56
call fcn.0045b770
pop ecx
pop ecx
cmp eax, ebx
jne 0x43310a
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4330de
xor ebx, ebx
call esi
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [0x4d49c8]
mov esi, eax
sub esi, dword [esp + 0x50]
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x9f
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [0x4d49d0]
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0xa0
mov ecx, esp
mov dword [esp + 0x90], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0xa1
mov ecx, esp
mov dword [esp + 0x8c], esp
push dword [0x4d4990]
call fcn.00421017
mov byte [esp + 0x71b8], 0x98
call fcn.0042cbe2
add esp, 0x10
lea ecx, [esp + 0x28]
call fcn.0042048a
lea ecx, [esp + 0x58]
mov eax, pe_nt_image_headers32
push ecx
mov byte [esp + 0x71ac], 0xa2
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x60], eax
call fcn.0042049e
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.00423cc9
push esi
push edi
push dword [esp + 0x30]
lea eax, [esp + 0x58]
push dword [0x4d4990]
push str._s__s__d_d_r_n
push eax
call fcn.004559f0
add esp, 0x18
mov byte [esp + 0x71a8], 0xa3
push dword [esp + 0x4c]
lea ecx, [esp + 0x54]
call fcn.004207d4
mov byte [esp + 0x71a8], 0xa4
mov esi, dword [esp + 0x40]
cmp esi, 0xffffffff
je 0x433233
push 2
push ebx
push ebx
push esi
mov dword [esp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax - 0xc]
push ebx
lea edx, [esp + 0x4c]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x4d14a8]
lea eax, [esp + 0x50]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421d56
call fcn.004306ef
pop ecx
pop ecx
push ebx
jmp 0x431105
lea ecx, [esp + 0x2c]
call fcn.0042048a
lea eax, [esi + 1]
mov byte [esp + 0x71a8], 0xa5
cmp dword [esp + 0x60], eax
lea ecx, [esp + 0x2c]
jle 0x433284
mov eax, dword [esp + 0x38]
push dword [eax + esi*4 + 4]
call fcn.0042105b
jmp 0x43328e
lea eax, [esp + 0x30]
push eax
call fcn.00423a98
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str..Packager.log
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xa6
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x71b4], 0xa5
call fcn.00455d40
add esp, 0xc
mov byte [esp + 0x71a8], 0xa7
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
xor edi, edi
call fcn.00421d56
lea eax, [esp + 0x1d0]
push eax
call fcn.004227dd
lea eax, [esp + 0x1c4]
push eax
mov byte [esp + 0x71ac], 0xa8
call fcn.00423561
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x433396
push 0x2024
lea eax, [esp + 0x73c]
push esi
push eax
mov dword [esp + 0x740], esi
call fcn.0048ea70
lea eax, [esp + 0x740]
add esp, 0xc
push eax
lea edx, [esp + 0x40]
mov eax, ebx
mov dword [esp + 0x40], esi
call fcn.00469d70
pop ecx
test eax, eax
jne 0x43338f
lea eax, [esp + 0x18]
push eax
call fcn.00454db0
pop ecx
push dword [eax]
mov eax, ebx
call fcn.00469e30
pop ecx
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [esp + 0x34]
mov edx, dword [esp + 0x40]
mov eax, ebx
call fcn.00469db0
pop ecx
test eax, eax
jne 0x43338f
inc edi
call fcn.00469e70
xor esi, esi
lea eax, [esp + 0x1c4]
call fcn.0046a940
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [esp + 0x3c]
cmp edi, esi
je 0x4333be
push str.Success:__s
jmp 0x4333c3
push str.Failed_saving__s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
push esi
jmp 0x431105
lea ecx, [esp + 0x1c]
call fcn.0042048a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x71ac], 0xa9
call fcn.00421d56
lea eax, [esi + 1]
mov byte [esp + 0x71a8], 0xaa
cmp dword [esp + 0x60], eax
jle 0x43341a
mov eax, dword [esp + 0x38]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x30]
call fcn.0042105b
push 1
push 0
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0xb0]
push eax
call fcn.004227dd
mov byte [esp + 0x71a8], 0xab
cmp dword [esp + 0x130], 0
jne 0x433462
push str.FAILED_LOADING_CONTAINERS__n
lea ebx, [esp + 0x20]
call fcn.0042267f
pop ecx
jmp 0x433510
lea eax, [esp + 0x20]
lea ecx, [esp + 0x118]
call fcn.004355e3
jmp 0x4334ed
lea esi, [esp + 0x20]
call fcn.00421da3
mov edi, eax
add edi, 0x18
call fcn.00421da3
mov ebx, eax
call fcn.00421da3
push dword [eax + 0xc]
push dword [eax + 8]
movzx eax, word [edi + 0xc]
push dword [ebx + 4]
push dword [ebx]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 8]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
movzx eax, word [edi + 6]
push eax
call fcn.00421da3
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00421da3
push dword [eax + 0x2c]
call fcn.00421da3
mov eax, dword [eax + 0x28]
call fcn.00423a34
push eax
push str._s__s:_Size_lld__Time_.2d__.2d__.4d__.2d:_.2d:_.2d__Offset_lld__Allocated_lld_n
lea ebx, [esp + 0x58]
call fcn.0042267f
add esp, 0x3c
call fcn.0043569c
lea eax, [esp + 0x64]
lea ecx, [esp + 0x118]
call fcn.004355f8
mov edi, eax
lea esi, [esp + 0x20]
call fcn.00424a75
test al, al
jne 0x433474
push str.______________________________n
lea ebx, [esp + 0x20]
call fcn.0042267f
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x43354e
push str.Cannot_obtain_INI_info_from_resource__n
mov ecx, ebx
call fcn.00423caa
jmp 0x433842
lea ecx, [esp + 0x38]
call fcn.0042048a
mov byte [esp + 0x71a8], 0xac
call fcn.0045fa00
push dword [0x4d4990]
lea ebx, [esp + 0x20]
push str.AppID___ws_n
call fcn.0042267f
push dword [0x4d49a0]
push str.Publisher___ws_n
call fcn.0042267f
push dword [0x4d49a4]
push str.Version___ws_n
call fcn.0042267f
push dword [0x4d4998]
push str.FriendlyName___ws_n
call fcn.0042267f
push dword [0x4d4994]
push str.AutoLaunch___ws_n
call fcn.0042267f
push dword [0x4d499c]
push str.Shortcuts___ws_n
call fcn.0042267f
push dword [0x4d49cc]
push str.BaseDirName___ws_n
call fcn.0042267f
push dword [0x4d49d0]
push str.CarrierExeName___ws_n
call fcn.0042267f
add esp, 0x40
push dword [0x4d49a8]
push str.OnStartVirtualizedCmds___ws_n
call fcn.0042267f
push dword [0x4d49ac]
push str.OnStartUnvirtualizedCmds___ws_n
call fcn.0042267f
push dword [0x4d49b0]
push str.OnStopVirtualizedCmds___ws_n
call fcn.0042267f
push dword [0x4d49b4]
push str.OnStopUnvirtualizedCmds___ws_n
call fcn.0042267f
push dword [0x4d49b8]
push str.StopInheritance___ws_n
call fcn.0042267f
add esp, 0x24
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x4d4990]
push str._s.AppVirtDll.dll
push eax
call fcn.004559f0
lea eax, [esp + 0x28]
add esp, 0xc
push eax
call fcn.00455180
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x71ac], 0xad
call fcn.00423a98
mov byte [esp + 0x71a8], 0xac
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 0xae
mov esi, str.Main
mov ecx, esp
mov dword [esp + 0x6c], esp
push esi
call fcn.00421017
push 2
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0xac
call fcn.0046bbe0
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x1c]
push eax
call fcn.00476720
mov byte [esp + 0x71b0], 0xaf
push dword [eax]
push str.EngineVersion_ws_n
call fcn.0042267f
mov byte [esp + 0x71b8], 0xac
mov ecx, dword [esp + 0x28]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
call fcn.00458ee0
pop ecx
lea ecx, [esp + 0x34]
call fcn.0042048a
push ecx
mov byte [esp + 0x71ac], 0xb0
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x4d4990]
push str._s.SandboxCfg.db
push eax
call fcn.004559f0
lea eax, [esp + 0x28]
add esp, 0xc
push eax
call fcn.00455180
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x71ac], 0xb1
call fcn.00423a98
mov byte [esp + 0x71a8], 0xb0
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 0xb2
mov ecx, esp
mov dword [esp + 0x6c], esp
push esi
call fcn.00421017
push 5
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0xb0
call fcn.0046bbe0
and dword [esp + 0x84], 0
xor eax, eax
lea edi, [esp + 0x88]
stosd dword es:[edi], eax
mov esi, dword [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ebx, [esp + 0x84]
stosd dword es:[edi], eax
call fcn.00470710
lea eax, [esp + 0x34]
push eax
push 0x462770
push 0
push dword [esp + 0x98]
mov eax, ebx
push eax
call fcn.00471500
push dword [esp + 0x34]
lea ebx, [esp + 0x20]
push str.Sandbox:__ws_n
call fcn.0042267f
pop ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
call fcn.00458ee0
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [esi - 0x10]
call fcn.0042001a
xor esi, esi
push esi
push str.Info
push dword [esp + 0x24]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4333d3
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431ee7
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call fcn.00421d56
push 0x2e
lea ecx, [esp + 0x2c]
mov byte [esp + 0x71ac], 0xb7
call fcn.004355a8
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.00423c6c
push str..new.exe
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x71b4], 0xb8
call fcn.00424858
add esp, 0xc
mov byte [esp + 0x71a8], 0xba
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0x38]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x4c]
call fcn.00421017
push 0
mov byte [esp + 0x71ac], 0xbb
push dword [esp + 0x44]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x433917
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [esp + 0x48]
push dword [esp + 0x34]
push str.Cant_copy__s_to__s
jmp 0x431635
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 0xbc
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x71b4], 0xbb
call fcn.0042aba9
mov ecx, dword [esp + 0x24]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0042001a
push 1
push 0
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0xb0]
push eax
call fcn.004227dd
push 1
push 1
push ecx
mov byte [esp + 0x71b4], 0xbd
lea eax, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x1d0]
push eax
call fcn.004227dd
lea eax, [esp + 0x84]
lea ecx, [esp + 0x118]
mov byte [esp + 0x71a8], 0xbe
call fcn.004355e3
jmp 0x433ad5
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.CEChangeEngine.tmp
call fcn.00421017
lea eax, [esp + 0x30]
push eax
call fcn.00455180
add esp, 4
mov byte [esp + 0x71ac], 0xbf
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
lea esi, [esp + 0x88]
mov byte [esp + 0x71ac], 0xc0
call fcn.00421da3
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
call fcn.00421da3
push dword [eax + 0x28]
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x71b8], 0xbf
call fcn.0046bbe0
test eax, eax
jne 0x433b2e
call fcn.00421da3
push ecx
add eax, 0x2c
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
push 0x4000
mov byte [esp + 0x71b0], 0xc1
call fcn.00421da3
push dword [eax + 0x28]
lea eax, [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x1d4]
push eax
mov byte [esp + 0x71bc], 0xbf
call fcn.0046b4f0
test eax, eax
jne 0x433b5d
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
call fcn.00458ee0
pop ecx
mov byte [esp + 0x71a8], 0xbe
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042001a
call fcn.0043569c
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x118]
call fcn.004355f8
mov edi, eax
lea esi, [esp + 0x84]
call fcn.00424a75
test al, al
jne 0x4339ce
lea eax, [esp + 0xa4]
call fcn.0046a940
lea eax, [esp + 0x1c4]
call fcn.0046a940
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [esp + 0x48]
push str.Successfully_changed_Loader:__s
jmp 0x432382
push dword [0x4d14a8]
call fcn.00421da3
push ecx
mov edi, esp
mov dword [esp + 0x28], esp
push dword [eax + 0x2c]
lea esi, [esp + 0x90]
call fcn.00421da3
push dword [eax + 0x28]
push str.Cannot_read_container__d__s_to_file
push edi
jmp 0x431636
push dword [0x4d14a8]
lea esi, [esp + 0x88]
call fcn.00421da3
push ecx
mov edi, esp
mov dword [esp + 0x28], esp
push dword [eax + 0x2c]
jmp 0x433b4a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x30]
call fcn.00421d56
push 0x2e
lea ecx, [esp + 0x30]
mov byte [esp + 0x71ac], 0xc2
call fcn.004355a8
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
call fcn.00423c6c
push str..new.exe
push eax
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x71b4], 0xc3
call fcn.00424858
add esp, 0xc
mov byte [esp + 0x71a8], 0xc5
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0x38]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x2c]
call fcn.00421017
xor edi, edi
push edi
mov byte [esp + 0x71ac], 0xc6
push dword [esp + 0x38]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x433c22
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [esp + 0x3c]
push dword [esp + 0x38]
jmp 0x43390d
push 1
push 1
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0xb0]
push eax
call fcn.004227dd
mov byte [esp + 0x71a8], 0xc7
cmp dword [esp + 0x130], edi
jne 0x433c6c
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Cannot_open_PeContainer
jmp 0x4310f9
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
mov esi, str.Main
push esi
call fcn.00421017
push edi
push 2
push ecx
mov byte [esp + 0x71b8], 0xc8
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421d56
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0xc7
call fcn.0046b4f0
cmp eax, edi
je 0x433cca
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL
jmp 0x4310f9
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421017
push edi
push 8
push ecx
mov byte [esp + 0x71b8], 0xc9
mov dword [esp + 0x74], esp
mov ebx, esp
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x78], esp
push eax
call fcn.00421d56
push ebx
call fcn.00462890
pop ecx
pop ecx
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x71bc], 0xc7
call fcn.0046b4f0
cmp eax, edi
je 0x433d32
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Cannot_Add_PeContainer_PECONTAINER_ENGINEDLL64
jmp 0x4310f9
lea ecx, [esp + 0x3c]
call fcn.0042048a
lea ecx, [esp + 0x40]
call fcn.0042048a
push ecx
mov byte [esp + 0x71ac], 0xcb
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
lea ebx, [esp + 0x44]
call fcn.00421017
push 3
lea edi, [esp + 0xac]
call fcn.0046bac0
test eax, eax
je 0x433d86
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Cannot_Read_PeContainer_PECONTAINER_INI
jmp 0x4310f9
lea eax, [esp + 0x40]
push eax
push ecx
mov edi, esp
mov dword [esp + 0x28], esp
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x70], esp
push eax
call fcn.00421d56
push edi
call fcn.00476720
add esp, 4
mov byte [esp + 0x71b4], 0xcc
mov ecx, esp
mov dword [esp + 0x70], esp
push str.EngineVersion
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0xcd
lea eax, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0xcb
call fcn.00459ae0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00421017
push 0x4000
push 3
push ecx
mov byte [esp + 0x71b8], 0xce
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421d56
lea esi, [esp + 0xb4]
mov byte [esp + 0x71b8], 0xcb
call fcn.0046b360
test eax, eax
je 0x433e4b
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Cannot_Add_PeContainerStr_PECONTAINER_INI
jmp 0x4310f9
lea eax, [esp + 0xa4]
call fcn.0046a940
push dword [0x4d14a8]
lea eax, [esp + 0x2c]
push ecx
mov dword [esp + 0x28], esp
mov esi, esp
push dword [esp + 0x3c]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x28]
push eax
call fcn.00476720
pop ecx
pop ecx
mov byte [esp + 0x71b4], 0xcf
push dword [eax]
push str.Successfully_changed_to_Engine__s._nNew_package_saved_in:_n_s
push esi
call fcn.004559f0
add esp, 0x10
call fcn.004306ef
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x431103
lea eax, [esp + 0x59c]
push eax
call fcn.00426090
lea ecx, [esp + 0x3c]
call fcn.0042048a
lea eax, [esp + 0x3c]
push eax
push ecx
mov byte [esp + 0x71b0], 0xd1
mov ecx, esp
mov dword [esp + 0x28], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0xd2
mov ecx, esp
mov dword [esp + 0x70], esp
push str.Description
call fcn.00421017
push ecx
mov byte [esp + 0x71b8], 0xd3
mov ecx, esp
mov dword [esp + 0x94], esp
push str.AppID
call fcn.00421017
lea ecx, [esp + 0x5ac]
mov byte [esp + 0x71b8], 0xd1
call fcn.00425674
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x59c]
push eax
mov byte [esp + 0x71ac], 3
call fcn.004261a0
jmp 0x43128f
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x140]
push eax
call fcn.004227dd
push ecx
mov byte [esp + 0x71ac], 0xd4
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xd5
mov ecx, esp
mov dword [esp + 0x6c], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0xd6
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
push 2
push ecx
mov byte [esp + 0x71bc], 0xd7
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x148]
mov byte [esp + 0x71bc], 0xd4
call fcn.00427de0
lea eax, [esp + 0x148]
add esp, 0x14
push eax
call fcn.00427bb7
pop ecx
lea eax, [esp + 0x134]
call fcn.0046a940
lea eax, [esp + 0x134]
jmp 0x431e15
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.DbgZip
call fcn.00421017
call fcn.0042feb8
mov dword [esp], str._DbgZip:
call fcn.0048e8dc
pop ecx
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + esi*4]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x78]
call fcn.0042105b
jmp 0x431c4a
lea eax, [esp + 0x404]
push eax
mov byte [esp + 0x71ac], 0xd8
call fcn.004261a0
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
jmp 0x43555c
push 1
push 0
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x380]
push eax
call fcn.004227dd
push ecx
mov byte [esp + 0x71ac], 0xe1
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xe2
mov ecx, esp
mov dword [esp + 0x6c], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0xe3
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
push 2
push ecx
mov byte [esp + 0x71bc], 0xe4
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x388]
mov byte [esp + 0x71bc], 0xe1
call fcn.00427de0
add esp, 0x14
lea esi, [esp + 0x84]
call fcn.0046e1f0
mov byte [esp + 0x71a8], 0xe5
and dword [esp + 0x3c], 0
jmp 0x4341bc
push dword [0x4d4990]
lea eax, [esp + 0x6f98]
push eax
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x4341bc
xor edi, edi
cmp dword [esp + 0x2f90], edi
jbe 0x4341bc
lea esi, [esp + edi*8 + 0x2f94]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x4341b2
test byte [esp + edi*8 + 0x2f98], 3
je 0x4341b2
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xe6
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [0x4d4990]
call fcn.00421017
mov ecx, dword [esi]
mov byte [esp + 0x71b0], 0xe5
call fcn.0042caed
pop ecx
pop ecx
inc edi
cmp edi, dword [esp + 0x2f90]
jb 0x43415a
lea eax, [esp + 0x275c]
push eax
lea esi, [esp + 0x40]
lea ebx, [esp + 0x88]
call fcn.0046de50
test eax, eax
jne 0x434136
xor esi, esi
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, ebx
call fcn.0046e210
lea eax, [esp + 0x374]
jmp 0x431e15
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x260]
push eax
call fcn.004227dd
push ecx
mov byte [esp + 0x71ac], 0xe7
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xe8
mov ecx, esp
mov dword [esp + 0x6c], esp
push str._Vintegrate_
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0xe9
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
push esi
push ecx
mov byte [esp + 0x71bc], 0xea
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x268]
mov byte [esp + 0x71bc], 0xe7
call fcn.00427de0
add esp, 0x14
call fcn.0043064a
jmp 0x4333d3
lea esi, [esp + 0x64]
call fcn.0046e1f0
and dword [esp + 0x34], 0
lea ecx, [esp + 0x1c]
call fcn.0042048a
mov byte [esp + 0x71a8], 0xec
jmp 0x434548
lea eax, [esp + 0x6f94]
push eax
lea eax, [esp + 0x1c]
push str._AppID_ws_n
push eax
call fcn.004559f0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x71ac], 0xed
call fcn.00423aad
mov byte [esp + 0x71a8], 0xec
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [esp + 0x2760]
lea eax, [esp + 0x4c]
push str.____SerialId:__d_n
push eax
call fcn.004559f0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x71ac], 0xee
call fcn.00423aad
mov byte [esp + 0x71a8], 0xec
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0042001a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x2f88]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
push eax
lea eax, [esp + 0x48]
push str.____Started:__d_sec_ago_n
push eax
call fcn.004559f0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x71ac], 0xef
call fcn.00423aad
mov byte [esp + 0x71a8], 0xec
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + 0x2f8c]
xor edx, edx
div esi
push eax
lea eax, [esp + 0x5c]
push str.____Blocking_buffering:__d_sec_n
push eax
call fcn.004559f0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x71ac], 0xf0
call fcn.00423aad
mov byte [esp + 0x71a8], 0xec
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x3c]
push str.____Processes:_n
push eax
call fcn.004559f0
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x71ac], 0xf1
call fcn.00423aad
mov byte [esp + 0x71a8], 0xec
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.0042001a
xor ebx, ebx
cmp dword [esp + 0x2f90], ebx
jbe 0x434548
push 0x4b263c
lea ecx, [esp + 0x30]
call fcn.00421017
mov byte [esp + 0x71a8], 0xf2
lea edi, [esp + ebx*8 + 0x2f94]
push dword [edi]
lea esi, [esp + 0x30]
call fcn.004542e0
pop ecx
test eax, eax
jne 0x434464
push 0x4b38d0
mov ecx, esi
call fcn.0042105b
push 0x5c
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x48]
push eax
call fcn.00455f00
add esp, 0xc
mov byte [esp + 0x71a8], 0xf3
push dword [eax]
lea eax, [esp + 0x2c]
push dword [edi]
push str._______wd:__ws
push eax
call fcn.004559f0
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x71ac], 0xf4
call fcn.00423aad
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [esp + 0x71a8], 0xf2
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [esp + ebx*8 + 0x2f98]
test eax, eax
je 0x434518
push eax
lea eax, [esp + 0x50]
push str._0x_x_
push eax
call fcn.004559f0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x71ac], 0xf5
call fcn.00423aad
mov byte [esp + 0x71a8], 0xf2
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.0042001a
push 0x4b5910
lea ecx, [esp + 0x20]
call fcn.004247ea
mov byte [esp + 0x71a8], 0xec
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042001a
inc ebx
cmp ebx, dword [esp + 0x2f90]
jb 0x43442b
lea eax, [esp + 0x275c]
push eax
lea esi, [esp + 0x38]
lea ebx, [esp + 0x68]
call fcn.0046de50
test eax, eax
jne 0x4342d1
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
cmp dword [esp + 0x3c], eax
jne 0x434590
push str.No_active_virtual_apps
call fcn.00421017
call fcn.004306ef
pop ecx
pop ecx
push 1
jmp 0x431105
lea eax, [esp + 0x24]
push eax
call fcn.00421d56
jmp 0x43238b
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 0x44]
call fcn.00425de2
lea eax, [esp + 0x18]
push eax
call fcn.00425f1f
jmp 0x431103
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.AutoUpdate
call fcn.00421017
call fcn.0042feb8
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x434606
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431138
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push dword [0x4d49bc]
push str.SourceAddr_s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.0042feb8
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [0x4d49d0]
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xf8
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [0x4d49cc]
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0xf9
mov ecx, esp
mov dword [esp + 0x90], esp
push 0x4d49bc
call fcn.00421d56
mov byte [esp + 0x71b4], 3
call fcn.0047d8a0
add esp, 0xc
jmp 0x43128f
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.VirtRegSyncExport
call fcn.00421017
call fcn.0042feb8
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x4346c9
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431138
push esi
call fcn.0042dd4b
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
push str.VirtRegSyncExport:_bRet_d
push ecx
call fcn.004559f0
add esp, 0xc
jmp 0x431289
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.StartStreaming:AppIDSkype
call fcn.00421017
call fcn.0042255e
pop ecx
jmp 0x43128e
lea ecx, [esp + 0x3c]
call fcn.0042048a
lea ecx, [esp + 0x34]
call fcn.0042048a
mov byte [esp + 0x71a8], 0xfb
mov eax, dword [esp + 0x38]
push 0x4b88cc
lea edi, [eax + esi*4 + 4]
call fcn.0048e300
pop ecx
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x40]
call fcn.0042105b
inc esi
cmp dword [esp + 0x60], esi
jle 0x434757
push dword [edi]
lea ecx, [esp + 0x38]
call fcn.0042105b
jmp 0x4347bc
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str..Streamed
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xfc
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x71b4], 0xfb
call fcn.00455d40
add esp, 0xc
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x71ac], 0xfd
call fcn.00423a98
mov byte [esp + 0x71a8], 0xfb
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 0xfe
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b0], 0xfb
call fcn.0042a5c2
pop ecx
pop ecx
push dword [0x4d14a8]
push ecx
mov dword [esp + 0x28], esp
test eax, eax
jne 0x434831
mov esi, dword [esp + 0x3c]
mov eax, esp
push esi
push str.Success:_n_s
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.0042001a
mov ecx, dword [esp + 0x3c]
jmp 0x434070
mov ecx, esp
push str.Failed
jmp 0x4310f9
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x43486f
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431138
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.open
xor edi, edi
xor ebx, ebx
call fcn.00421017
push edi
push ecx
mov byte [esp + 0x71b4], 0xff
mov eax, esp
mov dword [esp + 0x70], esp
push dword [0x4d49cc]
push str._select___s_
push eax
call fcn.004559f0
add esp, 8
mov dword [esp + 0x71b8], 0x100
mov ecx, esp
mov dword [esp + 0x94], esp
push str.explorer.exe
call fcn.00421017
mov dword [esp + 0x71b8], 3
call fcn.004543e0
add esp, 0x10
jmp 0x43128f
lea ecx, [esp + 0x34]
call fcn.0042048a
push 0x4b85ec
mov byte [esp + 0x71ac], 0xdc
call fcn.0048e300
pop ecx
push eax
mov eax, dword [esp + 0x3c]
push str._Vintegrate:
push dword [eax + esi*4]
call fcn.0048f0b7
add esp, 0xc
lea ecx, [esp + 0x34]
test eax, eax
jne 0x43491e
push str._Vintegrate:Full_
jmp 0x434923
push str._Vintegrate_
call fcn.0042105b
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x260]
push eax
call fcn.004227dd
push ecx
mov byte [esp + 0x71ac], 0xdd
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0xde
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b4], 0xdf
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
push esi
push ecx
mov byte [esp + 0x71bc], 0xe0
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x268]
mov byte [esp + 0x71bc], 0xdd
call fcn.00427de0
add esp, 0x14
lea eax, [esp + 0x254]
push eax
mov byte [esp + 0x71ac], 0xdc
call fcn.0042289c
jmp 0x43159f
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call fcn.00421d56
mov byte [esp + 0x71a8], 0x79
mov eax, dword [esp + 0x38]
push str._FullIntegrate
push dword [eax + esi*4]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x434bba
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
mov esi, 0x4d4988
call fcn.004234f7
pop ecx
test al, al
jne 0x434a49
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431138
push dword [0x4d49cc]
lea ecx, [esp + 0x30]
call fcn.00421017
mov byte [esp + 0x71a8], 0x7a
cmp dword [esp + 0x40], 0
je 0x434aab
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [0x4d4990]
call fcn.00421017
lea eax, [esp + 0x1c]
push eax
call fcn.0042e040
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x71ac], 0x7b
call fcn.00423a98
mov byte [esp + 0x71a8], 0x7a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4b280c
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x7c
mov eax, esp
mov dword [esp + 0x6c], esp
push dword [0x4d4990]
push str._s.host.exe
push eax
call fcn.004559f0
add esp, 8
mov byte [esp + 0x71b4], 0x7d
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea edi, [esp + 0x24]
mov byte [esp + 0x71b4], 0x7a
call fcn.004555d0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x71ac], 0x7e
call fcn.00423a98
mov byte [esp + 0x71a8], 0x7a
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov esi, dword [esp + 0x2c]
call fcn.00458390
test eax, eax
jne 0x434b58
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Could_not_create_virtual_repository
jmp 0x4310f9
lea eax, [esp + 0x18]
push eax
call fcn.00454b90
mov eax, dword [eax]
pop ecx
push 0
push dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x18]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [esp + 0x57], al
call fcn.0042001a
cmp byte [esp + 0x57], 0
je 0x434ba6
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Could_not_copy_executable_to_repository
jmp 0x4310f9
mov byte [esp + 0x71a8], 0x79
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0042001a
push 1
xor esi, esi
push esi
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x140]
push eax
call fcn.004227dd
push ecx
mov byte [esp + 0x71ac], 0x7f
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x80
mov ecx, esp
mov dword [esp + 0x6c], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x81
mov ecx, esp
mov dword [esp + 0x90], esp
push ebx
call fcn.00421017
push 2
push ecx
mov byte [esp + 0x71bc], 0x82
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x148]
mov byte [esp + 0x71bc], 0x7f
call fcn.00427de0
add esp, 0x14
xor eax, eax
cmp dword [esp + 0x40], esi
setne al
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.AllUsers
call fcn.00421017
push ecx
mov byte [esp + 0x71b4], 0x83
mov eax, esp
mov dword [esp + 0x70], esp
push dword [0x4d4990]
push str.SoftwareVOS_s
push eax
call fcn.004559f0
add esp, 0xc
mov edx, SysReAllocStringLen
mov byte [esp + 0x71b4], 0x7f
call fcn.00456df0
add esp, 0xc
push dword [esp + 0x40]
call fcn.00428ca9
pop ecx
push dword [esp + 0x40]
lea ecx, [esp + 0x138]
call fcn.004294f8
pop ecx
lea eax, [esp + 0x134]
call fcn.0046a940
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [0x4d4990]
push str._s_is_now_integrated_into_your_system.
jmp 0x4333c3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.004549e0
test eax, eax
jne 0x434d65
mov eax, dword [esp + 0x38]
xor esi, esi
push esi
push esi
push esi
push ecx
mov edi, esp
mov dword [esp + 0x30], esp
push ecx
mov ecx, esp
mov dword [esp + 0x78], esp
push dword [eax]
call fcn.00421017
push edi
call fcn.0045ac10
add esp, 4
mov byte [esp + 0x71bc], 0x2d
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x78], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71bc], 3
call fcn.00454550
add esp, 0x14
cmp eax, esi
jne 0x4333d3
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x4310f4
call fcn.00454b40
test eax, eax
jne 0x434d80
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x43094e
mov eax, dword [esp + 0x38]
push 0x4b73ac
lea esi, [eax + esi*4]
call fcn.0048e300
pop ecx
push eax
push str._Patch
push dword [esi]
call fcn.0048f0b7
add esp, 0xc
mov edi, eax
neg edi
lea eax, [esp + 0x30]
sbb edi, edi
push eax
lea ecx, [esp + 0x2c]
inc edi
call fcn.00421d56
push ecx
mov byte [esp + 0x71ac], 0x2e
mov ecx, esp
mov dword [esp + 0x24], esp
push str..new.exe
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x2f
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x71b4], 0x2e
call fcn.00455d40
add esp, 0xc
mov byte [esp + 0x71a8], 0x30
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push dword [esi]
call fcn.00421017
lea eax, [esp + 0x44]
push eax
call fcn.0045ac10
pop ecx
pop ecx
push 1
push 0
push ecx
mov byte [esp + 0x71b4], 0x31
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x1d0]
push eax
call fcn.004227dd
push ecx
mov byte [esp + 0x71ac], 0x32
mov ecx, esp
mov dword [esp + 0x24], esp
push ebx
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x33
mov ecx, esp
mov dword [esp + 0x6c], esp
push ebx
call fcn.00421017
mov byte [esp + 0x71b0], 0x34
push ecx
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
push 2
push ecx
mov byte [esp + 0x71bc], 0x35
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call fcn.00421d56
lea ecx, [esp + 0x1d8]
mov byte [esp + 0x71bc], 0x32
call fcn.00427de0
add esp, 0x14
push dword [0x4d4990]
lea eax, [esp + 0x38]
push dword [0x4d49cc]
push str._sAppVirtDll__s.dll
push eax
call fcn.004559f0
add esp, 0xc
mov byte [esp + 0x71ac], 0x36
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
call fcn.00421c48
pop ecx
test eax, eax
je 0x434f6f
push dword [0x4d14a8]
cmp eax, 0x11
jne 0x434f36
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push str.MsiTrackerStart:_Insufficient_permissions_
push eax
call fcn.004559f0
pop ecx
pop ecx
jmp 0x4310fe
cmp eax, 0x12
jne 0x434f49
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push str.MsiTrackerStart:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x434f29
lea ecx, [esp + 0x24]
push ecx
mov edx, eax
call fcn.0045be10
mov byte [esp + 0x71b0], 0x37
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [eax]
push str.MsiTrackerStart:_Failed:__s
jmp 0x431ae5
push dword [esp + 0x40]
lea eax, [esp + 0x1c]
push str._exec__s
push eax
call fcn.004559f0
mov eax, dword [eax]
add esp, 0xc
xor esi, esi
push esi
push esi
push eax
push dword [esp + 0x3c]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
cmp eax, 0x20
setg bl
add ecx, 0xfffffff0
call fcn.0042001a
cmp ebx, esi
je 0x434ff7
cmp edi, esi
je 0x434fc2
push 1
push str.Cameyo
push str.Starting_installation..._nWhen_finished__click_OK_to_merge_result_back_into_the_virtual_package.
jmp 0x434fcd
push esi
push str.Cameyo
push str.When_installation_is_finished__click_OK.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x434ff7
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
call fcn.00421ccf
pop ecx
push 0x14
jmp 0x431105
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
call fcn.00421ccf
pop ecx
cmp eax, esi
je 0x43506a
push dword [0x4d14a8]
cmp eax, 0x11
jne 0x43502e
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push str.MsiTrackerStop:_Insufficient_permissions_
jmp 0x434f29
cmp eax, 0x12
jne 0x435044
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push str.MsiTrackerStop:_Cant_access_services.exe._32_64_bit_mismatch_
jmp 0x434f29
lea ecx, [esp + 0x24]
push ecx
mov edx, eax
call fcn.0045be10
mov byte [esp + 0x71b0], 0x38
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [eax]
push str.MsiTrackerStop:_Failed:__s
jmp 0x431ae5
cmp ebx, esi
jne 0x435089
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [esp + 0x48]
push str.Failed_executing__s
jmp 0x43126a
cmp edi, esi
mov edi, dword [esp + 0x28]
je 0x43515f
push esi
push dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x1c]
jne 0x4350bb
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431a00
push esi
push dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b8], 0x39
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x36
call fcn.0042ad2e
mov ebx, eax
add esp, 0x10
cmp ebx, esi
jne 0x4351d2
push dword [0x4d14a8]
lea eax, [esp + 0x20]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x24]
push eax
call fcn.00455f00
add esp, 8
mov byte [esp + 0x71b0], 0x3a
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
push ecx
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
mov byte [esp + 0x71a8], 0x36
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x1c4]
call fcn.0046a940
push dword [0x4d14a8]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push dword [esp + 0x24]
push 0x4b7774
push eax
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [esp + 0x1c4]
push eax
mov byte [esp + 0x71ac], 0x31
call fcn.0042289c
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [edi - 0x10]
jmp 0x4315a6
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [0x4d14a8]
cmp ebx, 0x10
jne 0x4351f3
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431abc
lea eax, [esp + 0x24]
push eax
mov edx, ebx
call fcn.0045be10
mov byte [esp + 0x71b0], 0x3b
mov ecx, esp
mov dword [esp + 0x6c], esp
jmp 0x431ade
lea ecx, [esp + 0x28]
call fcn.0042048a
lea ecx, [esp + 0x40]
call fcn.0042048a
mov byte [esp + 0x71a8], 0x23
mov eax, dword [esp + 0x38]
lea esi, [eax + esi*4]
push str._CreateDiff
push dword [esi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x435255
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call fcn.00423a98
jmp 0x43526f
push 0x4b7360
call fcn.0048e300
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x2c]
call fcn.0042105b
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str..mod
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x24
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x71b4], 0x23
call fcn.00455d40
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x71ac], 0x25
call fcn.00423a98
mov byte [esp + 0x71a8], 0x23
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x28]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x40]
jne 0x435309
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431a00
push 1
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b8], 0x26
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b8], 0x23
call fcn.0042ad2e
add esp, 0x10
mov dword [esp + 0x18], eax
test eax, eax
jne 0x43538b
push dword [0x4d14a8]
lea eax, [esp + 0x44]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x24]
push eax
call fcn.00455f00
add esp, 8
mov byte [esp + 0x71b0], 0x27
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [eax]
push str.Successfully_repackaged_into:__s
jmp 0x435535
push edi
call esi
mov edx, dword [esp + 0x18]
push dword [0x4d14a8]
cmp edx, 0x10
jne 0x4353a9
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431abc
lea eax, [esp + 0x24]
push eax
call fcn.0045be10
mov byte [esp + 0x71b0], 0x28
mov ecx, esp
mov dword [esp + 0x6c], esp
jmp 0x431ade
lea ecx, [esp + 0x28]
call fcn.0042048a
lea ecx, [esp + 0x40]
call fcn.0042048a
mov byte [esp + 0x71a8], 0x15
mov eax, dword [esp + 0x38]
lea esi, [eax + esi*4]
push str._LearnStreaming
push dword [esi]
call fcn.0048ef19
pop ecx
pop ecx
test eax, eax
jne 0x435409
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call fcn.00423a98
jmp 0x435423
push 0x4b712c
call fcn.0048e300
pop ecx
mov ecx, dword [esi]
lea eax, [ecx + eax*2]
push eax
lea ecx, [esp + 0x2c]
call fcn.0042105b
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str..new.exe
call fcn.00421017
push ecx
mov byte [esp + 0x71b0], 0x16
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x71b4], 0x15
call fcn.00455d40
add esp, 0xc
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x71ac], 0x17
call fcn.00423a98
mov byte [esp + 0x71a8], 0x15
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov edi, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
mov ebx, dword [esp + 0x28]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [esp + 0x40]
jne 0x4354bd
push dword [0x4d14a8]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x431a00
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00421d56
push ecx
mov byte [esp + 0x71b0], 0x18
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00421d56
mov byte [esp + 0x71b0], 0x15
call fcn.0042c64c
pop ecx
pop ecx
mov dword [esp + 0x18], eax
test eax, eax
jne 0x435566
push dword [0x4d14a8]
lea eax, [esp + 0x44]
push 0x5c
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421d56
lea eax, [esp + 0x24]
push eax
call fcn.00455f00
add esp, 8
mov byte [esp + 0x71b0], 0x19
mov ecx, esp
mov dword [esp + 0x28], esp
push dword [eax]
push str.Successfully_learned_streaming_into:__s
push ecx
call fcn.004559f0
add esp, 0xc
call fcn.004306ef
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
lea ecx, [edi - 0x10]
call fcn.0042001a
lea ecx, [ebx - 0x10]
call fcn.0042001a
jmp 0x43128f
push edi
call esi
push dword [0x4d14a8]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
call fcn.0045be10
mov byte [esp + 0x71b0], 0x1a
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [eax]
push str.Could_not_learn_streaming:__s
jmp 0x431ae5
push str.CLoaderApp:_Done._Bye__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
jmp 0x431105