Function at 0x430f13
Capabilities:
Copy file
Move file
Persist via application shimming

Disassembly:
push 0x168
mov eax, 0x4d40ab
call fcn.004b3b70
xor ebx, ebx
mov dword [ebp - 0x54], ebx
call fcn.0049eef3
push eax
lea ecx, [ebp - 0x50]
call fcn.00425064
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Loader_BasicDeploy:_in
mov dword [ebp - 0x5c], eax
call fcn.00423607
call fcn.00430537
mov dword [ebp - 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov esi, str.EngineStamps
push esi
call fcn.00423607
push edi
xor ecx, ecx
call fcn.004755b0
pop ecx
pop ecx
call fcn.004670f0
pop ecx
cmp eax, ebx
jne 0x430fae
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00423607
lea eax, [ebp - 0x48]
push eax
mov ecx, ebx
call fcn.004755b0
mov esi, dword [eax]
pop ecx
pop ecx
call fcn.00467190
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x18], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call fcn.00423607
push ebx
push esi
call fcn.004752b0
add esp, 0x18
call fcn.004670f0
pop ecx
cmp eax, ebx
jne 0x431005
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call fcn.00423607
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.004752b0
mov esi, dword [eax]
add esp, 0x18
call fcn.00467190
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call fcn.00423607
xor esi, esi
inc esi
push esi
push edi
call fcn.004752b0
add esp, 0x18
call fcn.004670f0
pop ecx
cmp eax, ebx
je 0x43105e
push ecx
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtFiles.db
call fcn.00423607
push esi
push edi
call fcn.004752b0
add esp, 0x18
call fcn.004670b0
pop ecx
cmp eax, ebx
jne 0x43108f
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
mov dword [ebp - 0x30], esi
call fcn.00423607
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.004752b0
mov esi, dword [eax]
add esp, 0x18
call fcn.00467190
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x18], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov esi, str.VirtFiles.Prog.db
push esi
call fcn.00423607
push edi
xor ecx, ecx
call fcn.004755b0
pop ecx
pop ecx
call fcn.004670b0
pop ecx
cmp eax, ebx
je 0x4310f3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00423607
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Main
call fcn.00423607
push dword [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.00428cc8
add esp, 0xc
mov dword [ebp - 0x48], 1
cmp eax, ebx
jne 0x4310f6
mov dword [ebp - 0x48], ebx
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x48]
push dword [ebp - 0x30]
push str.Loader_BasicDeploy:_bInitDataRepository_d__bPatching_d
push eax
call fcn.00464a80
add esp, 0x10
call fcn.00430537
pop ecx
cmp dword [ebp - 0x48], ebx
je 0x43113b
call fcn.00430bf2
test eax, eax
jne 0x43113b
call fcn.0042e05c
mov edi, dword [ebp + 0x10]
push 0x406
call fcn.0047d760
pop ecx
mov esi, edi
jmp 0x43113e
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x43118d
cmp dword [ebp + 0x14], 2
je 0x43118d
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [esi + 0xc]
push str.StartStreaming:AppID_s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.004263d1
pop ecx
pop ecx
cmp eax, ebx
jne 0x43118d
push dword [esi + 0xc]
lea eax, [ebp + 0x10]
push str.Cannot_stream_application__s_
push eax
call fcn.00464a80
add esp, 0xc
push dword [eax]
call fcn.00430567
mov edi, dword [ebp + 0x10]
call fcn.00430ae4
mov edi, str.Main
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [ecx + 0xc]
lea esi, [ebp - 0x11]
push str.AppVirtDll__s.dll
push eax
call fcn.00464a80
add esp, 8
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
mov ecx, dword [ebp + 0xc]
push 2
mov byte [ebp - 4], bl
call fcn.00428d4f
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x43120b
cmp eax, 5
je 0x43120b
mov eax, dword [ebp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [eax + 0xc]
push str.AppVirtDll__s.dll
push ecx
call fcn.00464a80
add esp, 0xc
push 0xffffffffffffffff
call fcn.00430a05
add esp, 0xc
cmp eax, ebx
jne 0x43119a
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [ecx + 0xc]
lea esi, [ebp - 0x11]
push str.AppVirtDll64__s.dll
push eax
call fcn.00464a80
add esp, 8
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
mov ecx, dword [ebp + 0xc]
push 8
mov byte [ebp - 4], bl
call fcn.00428d4f
add esp, 0xc
and dword [ebp - 0x28], eax
je 0x4312a9
cmp dword [ebp - 0x28], 5
je 0x4312a9
mov eax, dword [ebp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [eax + 0xc]
push str.AppVirtDll64__s.dll
push ecx
call fcn.00464a80
add esp, 0xc
push 0xffffffffffffffff
call fcn.00430a05
add esp, 0xc
cmp eax, ebx
jne 0x43119a
push dword [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Engine
call fcn.00423607
call fcn.00430965
sub eax, 3
pop ecx
pop ecx
je 0x4313fc
dec eax
je 0x43119a
mov eax, dword [ebp + 0x10]
push dword [eax + 0xc]
lea eax, [ebp - 0x34]
push str._s.exe
push eax
call fcn.00464a80
add esp, 8
mov byte [ebp - 4], 4
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
lea esi, [ebp - 0x11]
call fcn.00423d39
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
mov ecx, dword [ebp + 0xc]
push 9
mov byte [ebp - 4], 4
call fcn.00428d4f
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x431326
cmp eax, 5
je 0x431326
push dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d39
push 0xffffffffffffffff
call fcn.00430a05
add esp, 0xc
cmp eax, ebx
jne 0x4313d3
mov eax, dword [ebp + 0x10]
push dword [eax + 0xc]
lea eax, [ebp - 0x38]
push str._s64.exe
push eax
call fcn.00464a80
add esp, 8
mov byte [ebp - 4], 6
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
lea esi, [ebp - 0x11]
call fcn.00423d39
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
mov ecx, dword [ebp + 0xc]
push 0xa
mov byte [ebp - 4], 6
call fcn.00428d4f
add esp, 0xc
and dword [ebp - 0x28], eax
je 0x43140f
cmp dword [ebp - 0x28], 5
je 0x43140f
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d39
push 0xffffffffffffffff
call fcn.00430a05
add esp, 0xc
cmp eax, ebx
jne 0x4313c8
push dword [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Engine
call fcn.00423607
call fcn.00430965
sub eax, 3
pop ecx
pop ecx
je 0x4313e6
dec eax
jne 0x43140f
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43119a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp - 0x28]
jmp 0x431f69
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtFiles.Prog.db
lea esi, [ebp - 0x21]
call fcn.00423607
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
mov ecx, dword [ebp + 0xc]
push 4
mov byte [ebp - 4], bl
call fcn.00428d4f
add esp, 0xc
cmp eax, ebx
je 0x431473
mov esi, eax
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
jmp 0x431f69
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SandboxCfg.db
lea esi, [ebp - 0x11]
call fcn.00423607
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
mov ecx, dword [ebp + 0xc]
push 5
mov byte [ebp - 4], bl
call fcn.00428d4f
add esp, 8
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtReg.Prog.dat
lea esi, [ebp - 0x11]
call fcn.00423607
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
mov ecx, dword [ebp + 0xc]
push 0xb
mov byte [ebp - 4], bl
call fcn.00428d4f
add esp, 0xc
push 0x4de948
lea ecx, [ebp - 0x40]
call fcn.00423607
lea eax, [ebp - 0x40]
push eax
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.ZipCache
call fcn.00423607
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.00423607
xor edi, edi
inc edi
push edi
push dword [ebp + 0xc]
mov byte [ebp - 4], 0xb
call fcn.00428bb0
add esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x58], ebx
cmp byte [ebp - 0x11], bl
je 0x4316ec
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.VirtReg.Prog.dat
mov dword [ebp - 0x20], eax
call fcn.00423607
lea eax, [ebp - 0x34]
push eax
xor ecx, ecx
call fcn.004755b0
pop ecx
pop ecx
push ebx
push ebx
push 2
push ecx
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2c], esp
mov ecx, esp
push eax
call fcn.00423d39
call fcn.0048ac20
add esp, 0x10
cmp dword [0x518fa8], ebx
jne 0x4315a2
call fcn.00467ed0
test eax, eax
je 0x4315a2
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.Loader_BasicDeploy:_modern_virtual_registry__not_deploying_registry
call fcn.00423607
call fcn.00430537
pop ecx
jmp 0x43168f
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.Loader_BasicDeploy:_deploying_Legacy_virtual_registry
call fcn.00423607
call fcn.00430537
mov eax, dword [ebp + 0x10]
pop ecx
push dword [eax + 0xc]
lea eax, [ebp - 0x38]
push str.SoftwareVOS_s
push eax
mov dword [ebp - 0x28], ebx
call fcn.00464a80
add esp, 0xc
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xe
push ebx
push dword [ebp - 0x38]
call fcn.004749b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4316c3
push ebx
push dword [ebp - 0x28]
lea eax, [ebp - 0x34]
push edi
push ecx
mov dword [ebp - 0x2c], esp
mov ecx, esp
push eax
call fcn.00423d39
call fcn.0048ac20
add esp, 0x10
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x431677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x38]
push str.Loader_BasicDeploy:_RegDatFileParse:_failed_parsing_hive_file__s:__d__LE_d
push ecx
call fcn.00464a80
add esp, 0x14
call fcn.00430537
pop ecx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push 0xb
pop esi
jmp 0x431461
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
call esi
sub eax, dword [ebp - 0x20]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
push str.Loader_BasicDeploy:_registry_deployment_took__dms
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.00430537
pop ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x43174a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push dword [ebp - 0x38]
push str.Loader_BasicDeploy:_RegDatFileParse:_cannot_create_key__s__LE_d
push ecx
call fcn.00464a80
add esp, 0x10
call fcn.00430537
pop ecx
jmp 0x43164e
mov eax, dword [ebp + 0x10]
push dword [eax + 0xc]
lea eax, [ebp - 0x20]
push str.SoftwareVOS_s
push eax
call fcn.00464a80
add esp, 0xc
push ebx
lea ecx, [ebp - 0x58]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
push ebx
push eax
call fcn.004749b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb al, al
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x20]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x49], al
call fcn.0042101a
cmp byte [ebp - 0x49], bl
je 0x43174a
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, str.VirtFiles.db
cmp byte [ebp - 0x21], bl
je 0x4318ce
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push ebx
push ebx
push ebx
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
push esi
mov dword [ebp - 0x20], eax
call fcn.00423607
mov eax, dword [ebp - 0x20]
xor edi, edi
inc edi
push edi
push eax
call fcn.004752b0
add esp, 0x18
call fcn.004670b0
pop ecx
cmp eax, ebx
je 0x4318ce
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Loader_BasicDeploy:_Update:_VirtFilesDb_update
call fcn.00423607
call fcn.00430537
mov eax, esp
mov dword [ebp - 0x20], esp
push ebx
push ebx
push ebx
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
push str.VirtFiles.old.db
mov dword [ebp - 0x20], eax
call fcn.00423607
mov eax, dword [ebp - 0x20]
push edi
push eax
call fcn.004752b0
add esp, 0x18
call fcn.00467aa0
pop ecx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtFiles.old.db
call fcn.00423607
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.004752b0
add esp, 0x18
mov byte [ebp - 4], 0x10
push dword [eax]
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00423607
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004752b0
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x20]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x21], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x21], bl
je 0x431855
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push 7
jmp 0x431671
push edi
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00423607
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.004752b0
add esp, 0x18
mov byte [ebp - 4], 0x11
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtFiles.Prog.db
call fcn.00423607
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
call fcn.004755b0
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x20]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x21], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x21], bl
jne 0x431843
call fcn.0042eb42
cmp dword [ebp - 0x30], ebx
je 0x431978
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Loader_BasicDeploy:_Init:_Data_first_init
call fcn.00423607
call fcn.00430537
pop ecx
push edi
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00423607
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.004752b0
add esp, 0x18
mov byte [ebp - 4], 0x12
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtFiles.Prog.db
call fcn.00423607
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.004755b0
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x20]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x21], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x21], bl
je 0x431978
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Loader_BasicDeploy:_Init:_cannot_copy_VirtFiles.Prog.db_into_Data_repository
call fcn.00423607
call fcn.00430537
pop ecx
jmp 0x431843
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtReg.dat
call fcn.00423607
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004752b0
add esp, 0x18
push ebx
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtReg.Transitory.dat
call fcn.00423607
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.004752b0
add esp, 0x14
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423d39
call fcn.004670b0
pop ecx
cmp eax, ebx
je 0x431a8e
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_pre_delete
call fcn.00423607
call fcn.00430537
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423d39
call fcn.00430cc4
pop ecx
cmp eax, ebx
je 0x431a8e
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_rename
call fcn.00423607
call fcn.00430537
pop ecx
push dword [ebp - 0x3c]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x431a61
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push str.Loader_BasicDeploy:_renamed_back_to_normal.
push eax
call fcn.00464a80
pop ecx
pop ecx
call fcn.00430537
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423d39
call fcn.00430cc4
pop ecx
jmp 0x431a8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push str.Loader_BasicDeploy:_cannot_rename_back_to_normal._Continuing_to_use_transitory_reg_dat_file__LE_d_
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.00430537
pop ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00423d5a
cmp dword [ebp - 0x30], ebx
jne 0x431a9c
cmp byte [ebp - 0x11], bl
je 0x431c25
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtReg.Prog.dat
call fcn.00423607
push esi
xor ecx, ecx
call fcn.004755b0
pop ecx
pop ecx
call fcn.004670b0
pop ecx
cmp eax, ebx
je 0x431c25
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], ebx
call fcn.00423c64
test eax, eax
je 0x431b35
push ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423d39
call fcn.00430cc4
pop ecx
cmp eax, ebx
jne 0x431b35
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push str.Loader_BasicDeploy:_Init_Update:_target_CHANGES_VirtReg.dat_is_held__probably_by_running_app_instance_._Attempting_transitory_mode:_VirtReg.Transitory.dat
push eax
call fcn.00464a80
pop ecx
pop ecx
call fcn.00430537
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423d39
call fcn.00430cc4
pop ecx
cmp eax, ebx
je 0x431bfc
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00423d5a
push ebx
push dword [ebp - 0x3c]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtReg.Prog.dat
call fcn.00423607
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.004755b0
pop ecx
pop ecx
push dword [eax]
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 0x11], 1
test eax, eax
je 0x431b6c
mov byte [ebp - 0x11], bl
test byte [ebp - 0x54], 1
je 0x431b7d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x11], bl
je 0x431ba2
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x3c]
push str.Loader_BasicDeploy:_Init_Update:_cannot_copy_VirtReg.Prog.dat_into_Data_repository:__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.00430537
pop ecx
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], ebx
je 0x431c25
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Loader_BasicDeploy:_deleting_EngineStamps_to_force_redeploy__bPatching__on_next_run
call fcn.00423607
call fcn.00430537
mov dword [ebp + 0x10], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.EngineStamps
call fcn.00423607
push esi
mov ecx, ebx
call fcn.004755b0
pop ecx
pop ecx
call fcn.00466c40
pop ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x431843
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push str._Loader_BasicDeploy:_transitory_file_unavailable__Rolling_back_and_failing._LE_d
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.00430537
pop ecx
mov dword [ebp - 0x30], edi
jmp 0x431b69
cmp dword [ebp - 0x18], ebx
jne 0x431c6d
cmp dword [ebp + 0x18], ebx
jne 0x431c6d
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0xa4], ebx
jne 0x431f0e
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.00423607
mov ecx, dword [ebp + 0x10]
push esi
call fcn.004755b0
pop ecx
pop ecx
call fcn.004670b0
pop ecx
cmp eax, ebx
jne 0x431f0e
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [ecx + 0x5c]
push str.Loader_BasicDeploy:_DEPLOYING_ZIPs_virtual_files_to:__s
push eax
call fcn.00464a80
add esp, 0xc
call fcn.00430537
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
call esi
call fcn.0046f7f0
call esi
push edi
push str._System_mscoree.dll
call fcn.0046ff40
pop ecx
pop ecx
cmp eax, ebx
je 0x431ce5
push eax
call fcn.004add25
pop ecx
call fcn.00464040
test eax, eax
jne 0x431ce5
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x13
jmp 0x431671
call fcn.0049eef3
push eax
lea ecx, [ebp - 0x30]
call fcn.00425064
lea eax, [ebp - 0x30]
push eax
push ecx
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Main
call fcn.00423607
mov edi, dword [ebp + 0xc]
push 7
call fcn.0047a5b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x518c0c]
mov dword [0x519390], eax
xor eax, eax
mov dword [ebp - 0x174], ebx
lea edi, [ebp - 0x170]
lea esi, [ebp - 0x16c]
mov dword [0x518c0c], ebx
stosd dword es:[edi], eax
call fcn.00430017
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0049eef3
push eax
lea ecx, [ebp - 0x60]
call fcn.00425064
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x16
push dword [ebp + 0x10]
mov dword [ebp - 0x174], ebx
mov ebx, esi
mov dword [ebp - 0x170], eax
call fcn.0043211e
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x60]
call fcn.00423d5a
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x174]
push eax
push 0x432558
xor ebx, ebx
push ebx
push dword [0x518774]
mov esi, 0x51876c
push esi
call fcn.004812f0
mov edi, dword [ebp - 0x174]
cmp edi, ebx
je 0x431e0c
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x16c]
call fcn.00431f6f
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, edi
jmp 0x431461
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push dword [0x51876c]
call fcn.00423607
mov ecx, esi
call fcn.0046fdd0
mov esi, dword [ebp + 0x10]
pop ecx
cmp dword [esi + 0xa4], ebx
jne 0x431e5e
push 0x4e43d4
push ecx
mov dword [ebp - 0x1c], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.00423607
push edi
mov ecx, esi
call fcn.004755b0
pop ecx
pop ecx
xor edi, edi
call fcn.00465450
pop ecx
pop ecx
mov eax, dword [0x519390]
push 0x4de948
push ecx
mov dword [ebp - 0x1c], esp
mov dword [0x518c0c], eax
mov eax, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov esi, str.ZipCache
push esi
xor edi, edi
mov dword [ebp - 0x18], eax
call fcn.00423607
mov eax, dword [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.004755b0
pop ecx
pop ecx
call fcn.00465450
pop ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423d39
push ecx
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00423607
mov byte [ebp - 4], 0x16
call fcn.00428e86
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push str.Loader_BasicDeploy:_Files_deployment_took__dms
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.00430537
pop ecx
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x16c]
call fcn.00431f6f
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x5c]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push str.Loader_BasicDeploy:_out___dms_
push ecx
call fcn.00464a80
add esp, 0xc
call fcn.00430537
pop ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
call fcn.004b3c48
ret