Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x1d8
push 0
push 0xdef744
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0xdef748], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0xdef744], eax
mov eax, 0x492630
mov dword [0xdef7a4], eax
call fcn.00436410
call fcn.00435860
call fcn.004352d0
call fcn.00433c80
call fcn.00431db4
call fcn.00431540
call fcn.00430b24
call fcn.0042fb9a
call fcn.0042eec5
call fcn.004267f8
call fcn.0042644f
call fcn.00424b4d
call fcn.0042459d
call fcn.00423470
call fcn.00422aa2
call fcn.00421811
call fcn.0041e3c0
call fcn.0041be6e
call fcn.0041a79c
call fcn.00419c07
call fcn.004199f3
call fcn.004197eb
mov ebp, 0x4016e6
push ebp
call fcn.0041a3b0
lea eax, [0x413aac]
push eax
pop dword [0xdef7b0]
mov dword [0xdef768], 0xbb8
mov edx, str._vmeventmsg.dll
lea ecx, [0xdef828]
call fcn.00419008
mov dword [0xdef7f4], 0x14
mov edx, 0x48b326
lea ecx, [0xdef7bc]
call fcn.00419008
mov edx, str.Ivanovation.profileslicense.ivanovation
lea ecx, [0xdef7d4]
call fcn.00419008
mov dword [0xdef85c], 1
mov dword [0xdef880], 0x16e360
mov dword [0xdef7f0], 0xaf4d00
mov edx, str.starting_machine_...
lea ecx, [0xdef860]
call fcn.00419008
call fcn.00419843
mov dword [0xdef894], eax
call fcn.00419843
mov dword [0xdef878], eax
call fcn.00419843
mov dword [0xdef774], eax
call fcn.00419843
mov dword [0xdef810], eax
call fcn.00419843
mov dword [0xdef81c], eax
call fcn.00419843
mov dword [0xdef798], eax
mov edx, str.S_1_5_21_3480340030_401968098_2003394930_1000
lea ecx, [0xdef854]
call fcn.00419008
mov eax, 0x200
push eax
lea eax, [0xdef8dc]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8e0]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8e4]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8e8]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8ec]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8f0]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8f4]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8f8]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef8fc]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef900]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef904]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef908]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef90c]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef910]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x200
push eax
lea eax, [0xdef914]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
push 0xdef8d4
push 0x4925e8
push 8
push 1
push 4
call fcn.00426478
mov dword [0xdef890], 0xffffffff
mov edx, 0x48c512
lea ecx, [0xdef86c]
call fcn.00419008
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
call fcn.00422c80
push 0xdef8c0
call fcn.004364a0
mov dword [0xdef8a0], 7
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
mov eax, 0x48b61e
push eax
mov eax, 0x48b61e
push eax
push dword [0xdef8c0]
call fcn.00433f30
push eax
push dword [0xdef8c0]
call fcn.00433fc0
push 0xdef884
call fcn.004364a0
call fcn.0042540a
call fcn.0041d560
call fcn.0041db60
mov eax, 0x200
push eax
lea eax, [0xdef918]
push eax
push 0x4925e8
push 8
push 4
call fcn.00424b6c
mov eax, 0x48b41c
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.h5ULrmn
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b428
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.EqW9JDg
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b442
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.eTP8Fo
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b44e
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.ApHu2l
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b452
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.7zMSbR
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b456
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.QvYd0c
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b45a
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.y4ZXkf
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b46c
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.C1VxiG
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b480
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.N6wIjB
lea ecx, [ebp]
call fcn.00419008
mov eax, 0x48b498
push eax
push dword [0xdef918]
call fcn.00424c39
mov ebp, eax
mov edx, str.a3tOsK
lea ecx, [ebp]
call fcn.00419008
mov ebp, 0xdcc53c
push ebp
push 0xe
call fcn.0042f044
mov dword [0xdef830], eax
mov ebp, 0xde424e
push ebp
push 0xf
call fcn.0042f044
mov ebp, 0xde89ce
push ebp
push 0x10
call fcn.0042f044
mov eax, str.Advapi32.dll
push eax
push 0xffffffff
call fcn.0041a80f
mov dword [0xdef75c], eax
cmp dword [0xdef75c], 0
je 0x40164b
mov eax, str.RegDeleteKeyExW
push eax
push dword [0xdef75c]
call fcn.0041a869
mov dword [0xdef760], eax
mov eax, 0x48bbec
push eax
push dword [0xdef75c]
call fcn.0041a869
mov dword [0xdef750], eax
mov eax, str.RegDeleteTreeW
push eax
push dword [0xdef75c]
call fcn.0041a869
mov dword [0xdef758], eax
mov eax, 0x48d208
push eax
push dword [0xdef75c]
call fcn.0041a869
mov dword [0xdef74c], eax
mov eax, str.ExpandEnvironmentStringsW
push eax
push dword [0xdef75c]
call fcn.0041a869
mov dword [0xdef754], eax
mov eax, str.shell32.dll
push eax
push 0xffffffff
call fcn.0041a80f
mov dword [0xdef7e4], eax
mov eax, str.SHGetFolderPathW
push eax
push dword [0xdef7e4]
call fcn.0041a869
mov dword [0xdef820], eax
push edx
call fcn.00436460
pop edx
push eax
mov edx, dword [0xdef8c0]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
mov edx, str.Ivanovation.profiles
push edx
call fcn.00436530
call fcn.00419212
add dword [esp], edx
call fcn.004055f0
call fcn.00436590
mov edx, 0x492218
call fcn.00419230
mov ecx, eax
call fcn.00419240
jne 0x4016d5
mov eax, str.Missing__Ivanovation.profiles__Folder
push eax
mov eax, str.___Failed_to_start_the_virtual_machine
push eax
call fcn.00419a5d
jmp 0x401701
call fcn.00412af7
mov dword [0xdef85c], 1
jmp 0x401701
push 0
call 0x401720
call fcn.00436440
push dword [0xdef744]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004197a9
call fcn.0041a3d0
call fcn.0041a790
call fcn.0041a920
call fcn.0041ab11
call fcn.0041acea
call fcn.0041b819
call fcn.0041be22
call fcn.0041e2f7
call fcn.0041e36a
call fcn.004217ee
call fcn.00422a91
call fcn.00422cc5
call fcn.00423460
call fcn.0042457f
call fcn.0042eeb9
call fcn.00430b17
call fcn.00433ca0
call fcn.004358ee
call fcn.00435a45
call fcn.0041be11
call fcn.004352c0
ret