Function at 0x43ac4d
Capabilities:
Check for time delay via gettickcount
Copy file
Move file
Persist via application shimming

Disassembly:
push 0x1e8
mov eax, 0x4f6103
call fcn.004d382d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1cc], eax
call fcn.004bdbe3
push eax
lea ecx, [ebp - 0x1f4]
call fcn.004204a1
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push str.Loader_BasicDeploy:_in
mov dword [ebp - 0x1e8], eax
call fcn.00422827
call fcn.0043a245
mov dword [ebp - 0x1b8], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
mov esi, str.EngineStamps
push esi
call fcn.00422827
push edi
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
call fcn.0047a370
pop ecx
cmp eax, ebx
jne 0x43ad1b
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
lea eax, [ebp - 0x1e0]
push eax
mov ecx, ebx
call fcn.0048a080
mov esi, dword [eax]
pop ecx
pop ecx
call fcn.0047a410
mov ecx, dword [ebp - 0x1e0]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov dword [ebp - 0x1b8], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push ebx
call fcn.00422827
push ebx
push esi
call fcn.00489d60
add esp, 0x18
call fcn.0047a370
pop ecx
cmp eax, ebx
jne 0x43adcf
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push ebx
call fcn.00422827
lea eax, [ebp - 0x1b4]
push ebx
push eax
call fcn.00489d60
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x1b4]
call fcn.0047a410
add esp, 0x14
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1b8], esp
mov ecx, esp
push eax
call fcn.00422f20
call fcn.0047a370
pop ecx
cmp eax, ebx
jne 0x43adbe
push dword [ebp - 0x1b4]
push str.Cannot_create_directory__s
lea eax, [ebp - 0x1e8]
push eax
call fcn.004777e0
add esp, 0xc
push dword [eax]
call fcn.0043a275
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1b4]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov dword [ebp - 0x1b8], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push ebx
call fcn.00422827
xor esi, esi
inc esi
push esi
push edi
call fcn.00489d60
add esp, 0x18
call fcn.0047a370
pop ecx
cmp eax, ebx
je 0x43ae34
push ecx
mov dword [ebp - 0x1b8], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push str.VirtFiles.db
call fcn.00422827
push esi
push edi
call fcn.00489d60
add esp, 0x18
call fcn.0047a330
pop ecx
cmp eax, ebx
jne 0x43ae9e
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push ebx
mov dword [ebp - 0x1c8], esi
call fcn.00422827
lea eax, [ebp - 0x1b4]
push esi
push eax
call fcn.00489d60
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x1b4]
call fcn.0047a410
add esp, 0x14
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1b8], esp
mov ecx, esp
push eax
call fcn.00422f20
call fcn.0047a370
pop ecx
cmp eax, ebx
je 0x43ad9d
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1b4]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [ebp - 0x1cc]
push dword [eax + 0x50]
lea eax, [ebp - 0x1ec]
push str.BuildUID_s_n
push eax
call fcn.004777e0
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
mov dword [ebp - 0x1b8], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push str.VirtApp.ini
lea edi, [eax + eax]
call fcn.00422827
push esi
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
call fcn.004781b0
pop ecx
mov dword [ebp - 0x1b8], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push str.VirtFiles.Prog.db
call fcn.00422827
push esi
mov ecx, ebx
call fcn.0048a080
pop ecx
pop ecx
call fcn.0047a330
pop ecx
mov esi, str.Main
cmp eax, ebx
je 0x43af72
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push str.VirtFiles.Prog.db
call fcn.00422827
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x1e0], esp
push esi
call fcn.00422827
push dword [ebp - 0x1d0]
mov byte [ebp - 4], 3
call fcn.00428913
add esp, 0xc
mov dword [ebp - 0x1e0], 1
cmp eax, ebx
jne 0x43af78
mov dword [ebp - 0x1e0], ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1b8], esp
push dword [ebp - 0x1e0]
push dword [ebp - 0x1c8]
push str.Loader_BasicDeploy:_bInitDataRepository_d__bPatching_d
push eax
call fcn.004777e0
add esp, 0x10
call fcn.0043a245
pop ecx
cmp dword [ebp - 0x1e0], ebx
je 0x43afc8
call fcn.0043a900
test eax, eax
jne 0x43afc8
call fcn.004301c2
mov edi, dword [ebp - 0x1cc]
push 0x406
call fcn.004969c0
pop ecx
mov edi, dword [ebp - 0x1cc]
mov eax, dword [edi + 0x58]
cmp dword [eax - 0xc], ebx
je 0x43b010
cmp dword [ebp + 0x14], 2
je 0x43b010
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x1b8], esp
push dword [edi + 0xc]
push str.StartStreaming:AppID_s
push eax
call fcn.004777e0
add esp, 0xc
call fcn.004256e3
pop ecx
pop ecx
cmp eax, ebx
jne 0x43b010
push dword [edi + 0xc]
push str.Cannot_stream_application__s_
jmp 0x43ada8
call fcn.0043a7f2
push ecx
mov eax, esp
mov dword [ebp - 0x1b8], esp
push dword [edi + 0xc]
push str.AppVirtDll__s.dll
push eax
call fcn.004777e0
add esp, 8
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x1c4], esp
push esi
call fcn.00422827
mov edx, dword [ebp - 0x1d0]
push 2
lea ecx, [ebp - 0x1b9]
mov byte [ebp - 4], 3
call fcn.0042899a
add esp, 0xc
mov dword [ebp - 0x1c4], eax
cmp eax, ebx
je 0x43b093
cmp eax, 5
je 0x43b093
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x1b8], esp
push dword [edi + 0xc]
push str.AppVirtDll__s.dll
push eax
call fcn.004777e0
add esp, 0xc
push 0xffffffffffffffff
call fcn.0043a713
add esp, 0xc
cmp eax, ebx
jne 0x43b015
push ecx
mov eax, esp
mov dword [ebp - 0x1b8], esp
push dword [edi + 0xc]
push str.AppVirtDll64__s.dll
push eax
call fcn.004777e0
add esp, 8
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push esi
call fcn.00422827
mov edx, dword [ebp - 0x1d0]
push 8
lea ecx, [ebp - 0x1b9]
mov byte [ebp - 4], 3
call fcn.0042899a
add esp, 0xc
and dword [ebp - 0x1c4], eax
je 0x43b147
cmp dword [ebp - 0x1c4], 5
je 0x43b147
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x1ac], esp
push dword [edi + 0xc]
push str.AppVirtDll64__s.dll
push eax
call fcn.004777e0
add esp, 0xc
push 0xffffffffffffffff
call fcn.0043a713
add esp, 0xc
cmp eax, ebx
jne 0x43b015
push dword [ebp - 0x1c4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Engine
call fcn.00422827
call fcn.0043a673
sub eax, 3
pop ecx
pop ecx
je 0x43b2dc
dec eax
je 0x43b015
push dword [edi + 0xc]
lea eax, [ebp - 0x1c0]
push str._s.exe
push eax
call fcn.004777e0
add esp, 8
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
mov edx, dword [ebp - 0x1d0]
push 9
lea ecx, [ebp - 0x1b9]
mov byte [ebp - 4], 7
call fcn.0042899a
add esp, 0xc
mov dword [ebp - 0x1c4], eax
cmp eax, ebx
je 0x43b1da
cmp eax, 5
je 0x43b1da
push edi
push ecx
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
push 0xffffffffffffffff
call fcn.0043a713
add esp, 0xc
cmp eax, ebx
jne 0x43b2a9
push dword [edi + 0xc]
lea eax, [ebp - 0x1b4]
push str._s64.exe
push eax
call fcn.004777e0
add esp, 8
mov byte [ebp - 4], 9
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
mov edx, dword [ebp - 0x1d0]
push 0xa
lea ecx, [ebp - 0x1b9]
mov byte [ebp - 4], 9
call fcn.0042899a
add esp, 0xc
and dword [ebp - 0x1c4], eax
je 0x43b303
cmp dword [ebp - 0x1c4], 5
je 0x43b303
push edi
push ecx
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
push 0xffffffffffffffff
call fcn.0043a713
add esp, 0xc
cmp eax, ebx
jne 0x43b29b
push dword [ebp - 0x1c4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Engine
call fcn.00422827
call fcn.0043a673
sub eax, 3
pop ecx
pop ecx
je 0x43b2c0
dec eax
jne 0x43b303
mov ecx, dword [ebp - 0x1b4]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x43b015
mov ecx, dword [ebp - 0x1b4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1ec]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1f4]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [ebp - 0x1c4]
jmp 0x43c2e8
mov ecx, dword [ebp - 0x1b4]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.Prog.db
lea edi, [ebp - 0x1ad]
call fcn.00422827
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
mov edx, dword [ebp - 0x1d0]
push 4
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0042899a
add esp, 0xc
cmp eax, ebx
je 0x43b38e
mov esi, eax
mov ecx, dword [ebp - 0x1ec]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1f4]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, esi
jmp 0x43c2e8
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.SandboxCfg.db
lea edi, [ebp - 0x1b9]
call fcn.00422827
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
mov edx, dword [ebp - 0x1d0]
push 5
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0042899a
add esp, 8
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push 0x50ab80
lea edi, [ebp - 0x1b9]
call fcn.00422827
push ecx
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
mov edx, dword [ebp - 0x1d0]
push 0xb
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0042899a
add esp, 0xc
push 0x50206c
lea ecx, [ebp - 0x1d4]
call fcn.00422827
lea eax, [ebp - 0x1d4]
push eax
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.ZipCache
call fcn.00422827
push ecx
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
xor edi, edi
inc edi
push edi
push dword [ebp - 0x1d0]
mov byte [ebp - 4], 0xe
call fcn.004287fb
add esp, 0x14
mov dword [ebp - 0x1b8], eax
cmp byte [ebp - 0x1ad], bl
je 0x43b648
push ecx
mov eax, esp
mov dword [ebp - 0x1ac], esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.db
mov dword [ebp - 0x1b4], eax
call fcn.00422827
mov eax, dword [ebp - 0x1b4]
push edi
push eax
call fcn.00489d60
add esp, 0x18
call fcn.0047a330
pop ecx
cmp eax, ebx
je 0x43b648
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_Update:_VirtFilesDb_update
call fcn.00422827
call fcn.0043a245
mov eax, esp
mov dword [ebp - 0x1ac], esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.old.db
mov dword [ebp - 0x1b4], eax
call fcn.00422827
mov eax, dword [ebp - 0x1b4]
push edi
push eax
call fcn.00489d60
add esp, 0x18
call fcn.0047ad80
pop ecx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.old.db
call fcn.00422827
lea eax, [ebp - 0x1c0]
push edi
push eax
call fcn.00489d60
add esp, 0x18
mov byte [ebp - 4], 0x10
push dword [eax]
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.db
call fcn.00422827
lea eax, [ebp - 0x1b4]
push edi
push eax
call fcn.00489d60
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x1b4]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x1ad], al
call fcn.0042001a
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp - 0x1ad], bl
je 0x43b5b3
mov ecx, dword [ebp - 0x1d4]
add ecx, 0xfffffff0
call fcn.0042001a
push 7
pop esi
jmp 0x43b36b
push edi
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.db
call fcn.00422827
lea eax, [ebp - 0x1c0]
push edi
push eax
call fcn.00489d60
add esp, 0x18
mov byte [ebp - 4], 0x11
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.Prog.db
call fcn.00422827
lea eax, [ebp - 0x1b4]
push eax
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x1b4]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x1ad], al
call fcn.0042001a
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp - 0x1ad], bl
jne 0x43b59d
call fcn.00437f95
cmp dword [ebp - 0x1c8], ebx
je 0x43b717
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_Init:_Data_first_init
call fcn.00422827
call fcn.0043a245
pop ecx
push edi
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.db
call fcn.00422827
lea eax, [ebp - 0x1c0]
push edi
push eax
call fcn.00489d60
add esp, 0x18
mov byte [ebp - 4], 0x12
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtFiles.Prog.db
call fcn.00422827
lea eax, [ebp - 0x1b4]
push eax
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x1b4]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x1ad], al
call fcn.0042001a
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp - 0x1ad], bl
je 0x43b717
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_Init:_cannot_copy_VirtFiles.Prog.db_into_Data_repository
call fcn.00422827
call fcn.0043a245
pop ecx
jmp 0x43b59d
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtReg.dat
call fcn.00422827
lea eax, [ebp - 0x1d8]
push edi
push eax
call fcn.00489d60
add esp, 0x18
push ebx
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtReg.Transitory.dat
call fcn.00422827
lea eax, [ebp - 0x1dc]
push edi
push eax
call fcn.00489d60
add esp, 0x14
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x1dc]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
call fcn.0047a330
pop ecx
cmp eax, ebx
je 0x43b863
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_pre_delete
call fcn.00422827
call fcn.0043a245
lea eax, [ebp - 0x1d8]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
call fcn.0043a9fe
pop ecx
cmp eax, ebx
je 0x43b863
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_rename
call fcn.00422827
call fcn.0043a245
pop ecx
push dword [ebp - 0x1d8]
push dword [ebp - 0x1dc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x43b82d
push ecx
mov eax, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_renamed_back_to_normal.
push eax
call fcn.004777e0
pop ecx
pop ecx
call fcn.0043a245
lea eax, [ebp - 0x1dc]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
call fcn.0043a9fe
pop ecx
jmp 0x43b863
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push eax
push str.Loader_BasicDeploy:_cannot_rename_back_to_normal._Continuing_to_use_transitory_reg_dat_file__LE_d_
push ecx
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
pop ecx
lea eax, [ebp - 0x1dc]
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00422f41
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
mov edi, 0x50ab80
push edi
call fcn.00422827
lea eax, [ebp - 0x1e4]
push eax
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x1c8], ebx
jne 0x43b89b
cmp byte [ebp - 0x1b9], bl
je 0x43b8f8
push ecx
mov eax, esp
mov dword [ebp - 0x1ac], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push edi
mov dword [ebp - 0x1c8], eax
call fcn.00422827
mov eax, dword [ebp - 0x1c8]
push eax
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
call fcn.0047a330
pop ecx
cmp eax, ebx
je 0x43b8f8
push ebx
push ebx
push ebx
push 2
pop edi
push ecx
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
mov ecx, edi
call fcn.004a6ad0
add esp, 0x10
push ecx
mov dword [ebp - 0x1ac], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtReg.Base.dat
call fcn.00422827
push 1
push edi
call fcn.00489d60
add esp, 0x18
call fcn.0047a330
pop ecx
push ecx
mov edi, esp
mov dword [ebp - 0x1ac], esp
cmp eax, ebx
je 0x43bac6
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c8], esp
push str.VirtReg.Base.dat
call fcn.00422827
push 1
push edi
call fcn.00489d60
add esp, 0x14
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x1c8], esp
mov ecx, esp
push eax
call fcn.00422f20
mov byte [ebp - 4], 0x15
call fcn.00477460
pop ecx
pop ecx
cmp eax, ebx
je 0x43bee9
push ecx
mov eax, esp
mov dword [ebp - 0x1ac], esp
push str.MergeRegistry:_merging_registry
push eax
mov dword [ebp - 0x1b4], 1
call fcn.004777e0
pop ecx
pop ecx
call fcn.0043a245
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.open
call fcn.00422827
push 1
push ecx
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x1c0], esp
push str._Quiet__MergeRegistry
lea edi, [ebp - 0x1b4]
call fcn.00422827
mov eax, dword [ebp - 0x1cc]
push ecx
mov byte [ebp - 4], 0x18
add eax, 0x68
mov ecx, esp
mov dword [ebp - 0x1c4], esp
push eax
mov dword [ebp - 0x1c8], eax
call fcn.00422812
mov byte [ebp - 4], 0x15
call fcn.00476120
add esp, 0x10
push ecx
test eax, eax
mov dword [ebp - 0x1ac], esp
mov eax, esp
jne 0x43ba3e
mov ecx, dword [ebp - 0x1c8]
push str._Quiet__MergeRegistry
push dword [ecx]
push str._Loader_BasicDeploy:_could_not_execute___s___s
push eax
call fcn.004777e0
add esp, 0x10
call fcn.0043a245
pop ecx
xor ebx, ebx
jmp 0x43bdfd
push dword [ebp - 0x1b4]
push str.MergeRegistry:__MergeRegistry_returned:__d
push eax
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
cmp dword [ebp - 0x1b4], 0
pop ecx
je 0x43bee7
push dword [ebp - 0x1b4]
lea eax, [ebp - 0x1f0]
push eax
call fcn.0047ec40
add esp, 4
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x1c8]
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str._Quiet__MergeRegistry
push dword [edx]
push dword [eax]
push dword [ebp - 0x1b4]
push str._Loader_BasicDeploy:_exitcode__d___s__return_by___s___s
push ecx
call fcn.004777e0
add esp, 0x18
call fcn.0043a245
pop ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1f0]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x43ba37
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push 0x50ab80
call fcn.00422827
push edi
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
call fcn.0047a330
pop ecx
cmp eax, ebx
je 0x43bee9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c4], eax
cmp dword [0x547364], ebx
jne 0x43bb2c
call fcn.0047b1b0
test eax, eax
je 0x43bb2c
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_modern_virtual_registry__not_deploying_registry
call fcn.00422827
call fcn.0043a245
pop ecx
jmp 0x43bc6d
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_deploying_Legacy_virtual_registry
call fcn.00422827
call fcn.0043a245
mov eax, dword [ebp - 0x1cc]
pop ecx
push dword [eax + 0xc]
lea eax, [ebp - 0x1b4]
push str.SoftwareVOS_s
push eax
mov dword [ebp - 0x1c8], ebx
call fcn.004777e0
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0x1a
push ebx
push dword [ebp - 0x1b4]
call fcn.004893c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43beb8
push ebx
push ebx
push dword [ebp - 0x1c8]
lea eax, [ebp - 0x1e4]
push ecx
mov dword [ebp - 0x1ac], esp
mov ecx, esp
xor edi, edi
push eax
inc edi
call fcn.00422f20
mov ecx, edi
call fcn.004a6ad0
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x43bc4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push eax
push edi
push dword [ebp - 0x1b4]
push str.Loader_BasicDeploy:_RegDatFileParse:_failed_parsing_hive_file__s:__d__LE_d
push ecx
call fcn.004777e0
add esp, 0x14
call fcn.0043a245
pop ecx
push dword [ebp - 0x1c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1b4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1e4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1dc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d4]
add ecx, 0xfffffff0
call fcn.0042001a
push 0xb
jmp 0x43b5ad
push dword [ebp - 0x1c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1b4]
add ecx, 0xfffffff0
call fcn.0042001a
push ebx
push dword [ebp - 0x1d8]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push 0x50ab80
call fcn.00422827
lea eax, [ebp - 0x1c0]
push eax
mov ecx, ebx
call fcn.0048a080
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp - 0x1c0]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x1ad], al
call fcn.0042001a
cmp byte [ebp - 0x1ad], bl
je 0x43bceb
push ecx
mov eax, esp
mov dword [ebp - 0x1ac], esp
push dword [ebp - 0x1d8]
push str.Loader_BasicDeploy:_Init_Update:_cannot_copy_VirtReg.Prog.dat_into_Data_repository:__s
push eax
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
pop ecx
jmp 0x43bdfd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1c4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push eax
push str.Loader_BasicDeploy:_registry_deployment_took__dms
push ecx
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
pop ecx
push ebx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtReg.Base.dat
call fcn.00422827
lea eax, [ebp - 0x1c4]
push 1
push eax
call fcn.00489d60
add esp, 0x18
mov byte [ebp - 4], 0x1b
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push 0x50ab80
call fcn.00422827
lea eax, [ebp - 0x1c0]
push eax
xor ecx, ecx
call fcn.0048a080
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp - 0x1c0]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x1ad], al
call fcn.0042001a
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1c4]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp - 0x1ad], bl
je 0x43bee9
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtReg.Base.dat
call fcn.00422827
lea eax, [ebp - 0x1f0]
push 1
push eax
call fcn.00489d60
add esp, 0x14
mov byte [ebp - 4], 0x1c
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push dword [eax]
push str.Loader_BasicDeploy:_Init_Update:_cannot_copy_VirtReg.Prog.dat_into_Data_repository:__s
push ecx
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
pop ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1f0]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Loader_BasicDeploy:_deleting_EngineStamps_to_force_redeploy__bPatching__on_next_run
call fcn.00422827
call fcn.0043a245
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.VirtReg.Prog.dat
call fcn.00422827
push ecx
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x1e8], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1e8], esp
push str.EngineStamps
call fcn.00422827
push esi
mov ecx, ebx
call fcn.0048a080
pop ecx
pop ecx
mov byte [ebp - 4], 0x15
call fcn.00479a40
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1e4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1dc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1ec]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1f4]
add ecx, 0xfffffff0
call fcn.0042001a
push 7
pop eax
jmp 0x43c2e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push eax
push dword [ebp - 0x1b4]
push str.Loader_BasicDeploy:_RegDatFileParse:_cannot_create_key__s__LE_d
push ecx
call fcn.004777e0
add esp, 0x10
call fcn.0043a245
pop ecx
jmp 0x43bc02
xor ebx, ebx
cmp dword [ebp - 0x1b8], ebx
jne 0x43bf40
cmp dword [ebp + 0x18], ebx
jne 0x43bf40
mov eax, dword [ebp - 0x1cc]
cmp dword [eax + 0xa8], ebx
jne 0x43c259
push ecx
mov dword [ebp - 0x1ac], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.00422827
mov ecx, dword [ebp - 0x1cc]
push edi
call fcn.0048a080
pop ecx
pop ecx
call fcn.0047a330
pop ecx
cmp eax, ebx
jne 0x43c259
push ecx
mov ecx, dword [ebp - 0x1cc]
mov eax, esp
mov dword [ebp - 0x1ac], esp
push dword [ecx + 0x5c]
push str.Loader_BasicDeploy:_DEPLOYING_ZIPs_virtual_files_to:__s
push eax
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
call edi
call fcn.00483300
call edi
push 1
mov eax, str._System_mscoree.dll
call fcn.00483cb0
pop ecx
cmp eax, ebx
je 0x43bfd5
push eax
call fcn.004ccf97
pop ecx
call fcn.004769b0
test eax, eax
jne 0x43bfd5
mov ecx, dword [ebp - 0x1e4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1dc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d4]
add ecx, 0xfffffff0
call fcn.0042001a
push 0x13
jmp 0x43b5ad
call fcn.004bdbe3
push eax
lea ecx, [ebp - 0x1c0]
call fcn.004204a1
lea eax, [ebp - 0x1c0]
push eax
push ecx
mov byte [ebp - 4], 0x1d
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push esi
call fcn.00422827
mov edi, dword [ebp - 0x1d0]
push 7
call fcn.004924d0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1d0], eax
mov eax, dword [0x546f78]
mov dword [0x547800], eax
xor eax, eax
mov dword [ebp - 0x1a8], ebx
lea edi, [ebp - 0x1a4]
lea esi, [ebp - 0x1a0]
mov dword [0x546f78], ebx
stosd dword es:[edi], eax
call fcn.00439b8f
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004bdbe3
push eax
lea ecx, [ebp - 0x18]
call fcn.004204a1
push dword [ebp - 0x1cc]
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1a8], ebx
mov ebx, esi
mov dword [ebp - 0x1a4], eax
call fcn.0043c4d1
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0x18]
call fcn.00422f41
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1a8]
push eax
push 0x43ca2f
xor ebx, ebx
push ebx
push dword [0x546aa0]
mov esi, 0x546a98
push esi
call fcn.0049a780
mov edi, dword [ebp - 0x1a8]
cmp edi, ebx
je 0x43c12d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
lea esi, [ebp - 0x1a0]
call fcn.0043c2ee
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1e4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1dc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d4]
add ecx, 0xfffffff0
call fcn.0042001a
mov esi, edi
jmp 0x43b36b
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push dword [0x546a98]
call fcn.00422827
mov ecx, esi
call fcn.00483b90
mov esi, dword [ebp - 0x1cc]
pop ecx
cmp dword [esi + 0xa8], ebx
jne 0x43c18b
push 0x50a220
push ecx
mov dword [ebp - 0x1ac], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.00422827
push edi
mov ecx, esi
call fcn.0048a080
pop ecx
pop ecx
xor edi, edi
call fcn.004781b0
pop ecx
pop ecx
mov eax, dword [0x547800]
push 0x50206c
push ecx
mov dword [ebp - 0x1ac], esp
mov dword [0x546f78], eax
mov eax, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
mov esi, str.ZipCache
push esi
xor edi, edi
mov dword [ebp - 0x1b8], eax
call fcn.00422827
mov eax, dword [ebp - 0x1b8]
push eax
mov ecx, ebx
call fcn.0048a080
pop ecx
pop ecx
call fcn.004781b0
pop ecx
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x1ac], esp
mov ecx, esp
push eax
call fcn.00422f20
push ecx
mov byte [ebp - 4], 0x1f
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push esi
call fcn.00422827
mov byte [ebp - 4], 0x1e
call fcn.00428b18
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1d0]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push eax
push str.Loader_BasicDeploy:_Files_deployment_took__dms
push ecx
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
lea esi, [ebp - 0x1a0]
call fcn.0043c2ee
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x1cc]
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1e8]
push ecx
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push eax
push str.Loader_BasicDeploy:_out___dms_
push ecx
call fcn.004777e0
add esp, 0xc
call fcn.0043a245
pop ecx
mov ecx, dword [ebp - 0x1e4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1dc]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1d4]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1ec]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1f4]
add ecx, 0xfffffff0
call fcn.0042001a
xor eax, eax
call fcn.004d38b0
ret