Function at 0x42ccb4
Capabilities:
Copy file
Move file
Persist via application shimming

Disassembly:
push 0x118
mov eax, 0x4d1395
call fcn.004b17f0
xor ebx, ebx
mov dword [ebp - 0x44], ebx
call fcn.0049d1fb
push eax
lea ecx, [ebp - 0x48]
call fcn.0042149e
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Loader_BasicDeploy:_in
mov dword [ebp - 0x50], eax
call fcn.0042341f
call fcn.0042c5e1
mov dword [ebp - 0x24], esp
mov edi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
mov esi, str.EngineStamps
push esi
call fcn.0042341f
push edi
call fcn.00479360
add esp, 0xc
call fcn.004693c0
pop ecx
cmp eax, ebx
jne 0x42cd4f
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
call fcn.0042341f
lea eax, [ebp - 0x3c]
push eax
call fcn.00479360
mov esi, dword [eax]
add esp, 0xc
call fcn.00469460
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x24], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push ebx
call fcn.0042341f
push ebx
mov ecx, esi
call fcn.00479070
add esp, 0x14
call fcn.004693c0
pop ecx
cmp eax, ebx
jne 0x42cda6
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push ebx
call fcn.0042341f
push ebx
lea ecx, [ebp - 0x3c]
call fcn.00479070
mov esi, dword [eax]
add esp, 0x14
call fcn.00469460
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x24], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push ebx
call fcn.0042341f
xor esi, esi
inc esi
push esi
mov ecx, edi
call fcn.00479070
add esp, 0x14
call fcn.004693c0
pop ecx
cmp eax, ebx
jne 0x42ce03
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push ebx
mov dword [ebp - 0x34], esi
call fcn.0042341f
push esi
lea ecx, [ebp - 0x3c]
call fcn.00479070
mov esi, dword [eax]
add esp, 0x14
call fcn.00469460
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x24], esp
mov esi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
mov edi, str.VirtFiles.Prog.db
push edi
call fcn.0042341f
push esi
call fcn.00479360
add esp, 0xc
call fcn.00469380
pop ecx
mov esi, str.Main
cmp eax, ebx
je 0x42cece
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
call fcn.0042341f
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.0042341f
push dword [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.00427db6
add esp, 0xc
cmp eax, ebx
je 0x42cece
mov dword [ebp - 0x3c], 1
call fcn.0042b295
mov edi, dword [ebp + 0x10]
push 0x406
call fcn.00481ae0
pop ecx
mov eax, dword [edi + 0x4c]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42ced6
cmp dword [ebp + 0x14], 2
je 0x42ced6
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
push dword [edi + 0xc]
push str.StartStreaming:AppID_s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.00425da4
pop ecx
pop ecx
cmp eax, ebx
jne 0x42ced6
push dword [edi + 0xc]
lea eax, [ebp + 0x10]
push str.Cannot_stream_application__s_
push eax
call fcn.00466a00
add esp, 0xc
push dword [eax]
call fcn.0042c611
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], ebx
jmp 0x42ce7f
call fcn.0042cba7
add edi, 0xc
mov dword [ebp - 0x24], edi
jmp 0x42cee5
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [edi]
push str.AppVirtDll__s.dll
push eax
call fcn.00466a00
add esp, 8
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], bl
push 2
lea ebx, [ebp - 0x11]
call fcn.00427e3e
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
je 0x42cf50
cmp eax, 5
je 0x42cf50
push dword [ebp + 0x10]
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [edi]
push str.AppVirtDll__s.dll
push eax
call fcn.00466a00
add esp, 0xc
push 0xffffffffffffffff
call fcn.0042cac8
add esp, 0xc
test eax, eax
jne 0x42cee3
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [edi]
lea ebx, [ebp - 0x11]
push str.AppVirtDll64__s.dll
push eax
call fcn.00466a00
add esp, 8
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, dword [ebp + 0xc]
push 8
mov byte [ebp - 4], 0
call fcn.00427e3e
mov ebx, dword [ebp - 0x28]
add esp, 0xc
and ebx, eax
je 0x42cfe8
cmp ebx, 5
je 0x42cfe8
push dword [ebp + 0x10]
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [edi]
push str.AppVirtDll64__s.dll
push eax
call fcn.00466a00
add esp, 0xc
push 0xffffffffffffffff
call fcn.0042cac8
add esp, 0xc
test eax, eax
jne 0x42cee3
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Engine
call fcn.0042341f
call fcn.0042ca28
sub eax, 3
pop ecx
pop ecx
je 0x42d133
dec eax
je 0x42cee3
push dword [edi]
lea eax, [ebp - 0x30]
push str._s.exe
push eax
call fcn.00466a00
add esp, 8
mov byte [ebp - 4], 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
lea ebx, [ebp - 0x11]
call fcn.00423aca
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, dword [ebp + 0xc]
push 9
mov byte [ebp - 4], 4
call fcn.00427e3e
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
je 0x42d061
cmp eax, 5
je 0x42d061
push dword [ebp + 0x10]
lea eax, [ebp - 0x30]
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423aca
push 0xffffffffffffffff
call fcn.0042cac8
add esp, 0xc
test eax, eax
jne 0x42d109
push dword [edi]
lea eax, [ebp - 0x2c]
push str._s64.exe
push eax
call fcn.00466a00
add esp, 8
mov byte [ebp - 4], 6
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
lea ebx, [ebp - 0x11]
call fcn.00423aca
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, dword [ebp + 0xc]
push 0xa
mov byte [ebp - 4], 6
call fcn.00427e3e
mov ebx, dword [ebp - 0x28]
add esp, 0xc
and ebx, eax
je 0x42d145
cmp ebx, 5
je 0x42d145
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00423aca
push 0xffffffffffffffff
call fcn.0042cac8
add esp, 0xc
test eax, eax
jne 0x42d0fe
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Engine
call fcn.0042341f
call fcn.0042ca28
sub eax, 3
pop ecx
pop ecx
je 0x42d11d
dec eax
jne 0x42d145
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x42cee3
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
jmp 0x42daf3
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtFiles.Prog.db
lea ebx, [ebp - 0x12]
call fcn.0042341f
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, dword [ebp + 0xc]
push 4
mov byte [ebp - 4], 0
call fcn.00427e3e
add esp, 0xc
test eax, eax
je 0x42d1ab
mov esi, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
jmp 0x42daf3
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SandboxCfg.db
lea ebx, [ebp - 0x11]
call fcn.0042341f
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, dword [ebp + 0xc]
push 5
mov byte [ebp - 4], 0
call fcn.00427e3e
add esp, 8
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtReg.Prog.dat
lea ebx, [ebp - 0x11]
call fcn.0042341f
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, dword [ebp + 0xc]
push 0xb
mov byte [ebp - 4], 0
call fcn.00427e3e
add esp, 0xc
push 0x4d9c38
lea ecx, [ebp - 0x38]
call fcn.0042341f
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.ZipCache
lea ebx, [ebp - 0x38]
call fcn.0042341f
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
push 1
push dword [ebp + 0xc]
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.00427c30
xor ebx, ebx
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4c], ebx
cmp byte [ebp - 0x11], bl
je 0x42d40c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtReg.Prog.dat
mov dword [ebp - 0x28], eax
call fcn.0042341f
lea eax, [ebp - 0x30]
push eax
call fcn.00479360
add esp, 0xc
push ebx
push ebx
push 2
push ecx
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423aca
call fcn.004904d0
add esp, 0x10
cmp dword [0x50a1e0], ebx
jne 0x42d2c4
call fcn.0046a200
test eax, eax
jne 0x42d3ab
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Loader_BasicDeploy:_deploying_Legacy_virtual_registry
call fcn.0042341f
call fcn.0042c5e1
pop ecx
push dword [edi]
lea eax, [ebp - 0x2c]
push str.SoftwareVOS_s
push eax
mov dword [ebp - 0x40], ebx
call fcn.00466a00
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xe
push ebx
push dword [ebp - 0x2c]
call fcn.00478650
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42d3e3
push ebx
push dword [ebp - 0x40]
lea eax, [ebp - 0x30]
push 1
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423aca
call fcn.004904d0
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x42d393
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push edi
push dword [ebp - 0x2c]
push str.RegDatFileParse:_failed_parsing_hive_file__s:__d__LE_d
push ecx
call fcn.00466a00
add esp, 0x14
call fcn.0042c5e1
pop ecx
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
push 0xb
pop esi
jmp 0x42d199
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push str.Loader_BasicDeploy:_registry_deployment_took__dms
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.0042c5e1
pop ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x42d466
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push dword [ebp - 0x2c]
push str.RegDatFileParse:_cannot_create_key__s__LE_d
push ecx
call fcn.00466a00
add esp, 0x10
call fcn.0042c5e1
pop ecx
jmp 0x42d36a
push dword [edi]
lea eax, [ebp - 0x40]
push str.SoftwareVOS_s
push eax
call fcn.00466a00
add esp, 0xc
push ebx
lea ecx, [ebp - 0x4c]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
push ebx
push eax
call fcn.00478650
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb al, al
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x40]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x11], al
call fcn.0042101a
cmp byte [ebp - 0x11], bl
je 0x42d466
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, str.VirtFiles.db
cmp byte [ebp - 0x12], bl
je 0x42d5f2
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
mov dword [ebp - 0x28], eax
call fcn.0042341f
mov eax, dword [ebp - 0x28]
push 1
mov ecx, eax
call fcn.00479070
add esp, 0x14
call fcn.00469380
pop ecx
cmp eax, ebx
je 0x42d5ed
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Update:_VirtFilesDb_update
call fcn.0042341f
call fcn.0042c5e1
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtFiles.old.db
call fcn.0042341f
push 1
mov ecx, edi
call fcn.00479070
add esp, 0x14
call fcn.0046a050
pop ecx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtFiles.old.db
call fcn.0042341f
push 1
lea ecx, [ebp - 0x18]
call fcn.00479070
add esp, 0x14
mov byte [ebp - 4], 0x10
push dword [eax]
mov edi, str.VirtFiles.db
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042341f
push 1
lea ecx, [ebp - 0x28]
call fcn.00479070
add esp, 0x14
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x28]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x12], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x12], bl
je 0x42d571
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
push 7
jmp 0x42d38d
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042341f
push 1
lea ecx, [ebp - 0x28]
call fcn.00479070
add esp, 0x14
mov byte [ebp - 4], 0x11
push dword [eax]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtFiles.Prog.db
call fcn.0042341f
lea eax, [ebp - 0x18]
push eax
call fcn.00479360
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x18]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x12], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x12], bl
jne 0x42d55f
call fcn.0042bd78
jmp 0x42d5f2
mov edi, str.VirtFiles.db
cmp dword [ebp - 0x34], ebx
je 0x42d767
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Init:_Data_first_init
call fcn.0042341f
call fcn.0042c5e1
pop ecx
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042341f
push 1
lea ecx, [ebp - 0x34]
call fcn.00479070
add esp, 0x14
mov byte [ebp - 4], 0x12
push dword [eax]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtFiles.Prog.db
call fcn.0042341f
lea eax, [ebp - 0x18]
push eax
call fcn.00479360
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x18]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x12], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x12], bl
je 0x42d69f
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Init:_cannot_copy_VirtFiles.Prog.db_into_Data_repository
call fcn.0042341f
call fcn.0042c5e1
pop ecx
jmp 0x42d55f
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtReg.dat
call fcn.0042341f
push 1
lea ecx, [ebp - 0x34]
call fcn.00479070
add esp, 0x14
mov byte [ebp - 4], 0x13
push dword [eax]
mov dword [ebp - 0x44], 1
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtReg.Prog.dat
call fcn.0042341f
lea eax, [ebp - 0x18]
push eax
call fcn.00479360
add esp, 0xc
mov dword [ebp - 4], 0x14
push dword [eax]
mov dword [ebp - 0x44], 3
call edi
test eax, eax
jne 0x42d72f
push ecx
mov dword [ebp - 0x20], esp
mov edi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtReg.Prog.dat
call fcn.0042341f
push edi
call fcn.00479360
add esp, 0xc
call fcn.00469380
pop ecx
mov byte [ebp - 0x11], 1
cmp eax, ebx
jne 0x42d732
mov byte [ebp - 0x11], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x44], ebx
call fcn.0042101a
cmp byte [ebp - 0x11], bl
je 0x42d767
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Init:_cannot_copy_VirtReg.Prog.dat_into_Data_repository
jmp 0x42d68f
cmp dword [ebp - 0x1c], ebx
jne 0x42d7b4
cmp dword [ebp + 0x18], ebx
jne 0x42d7b4
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x94], ebx
jne 0x42d9f5
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.EngineStampsDiskModeDeploy.marker
mov dword [ebp - 0x1c], eax
call fcn.0042341f
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00479360
add esp, 0xc
call fcn.00469380
pop ecx
cmp eax, ebx
jne 0x42d9f5
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 0x20], esp
push dword [ecx + 0x50]
push str.Loader_BasicDeploy:_DEPLOYING_ZIPs_virtual_files_to:__s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.0042c5e1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
call edi
call fcn.004726a0
call edi
call fcn.0049d1fb
push eax
lea ecx, [ebp - 0x34]
call fcn.0042149e
lea eax, [ebp - 0x34]
push eax
push ecx
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.0042341f
mov edi, dword [ebp + 0xc]
push 7
call fcn.0047ee20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov eax, dword [0x509ea4]
mov dword [0x50a598], eax
xor eax, eax
mov dword [ebp - 0x124], ebx
lea edi, [ebp - 0x120]
lea esi, [ebp - 0x11c]
mov dword [0x509ea4], ebx
stosd dword es:[edi], eax
call fcn.0042c15a
xor eax, eax
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0049d1fb
push eax
lea ecx, [ebp - 0x58]
call fcn.0042149e
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x16
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x124], ebx
push edi
mov ebx, esi
mov dword [ebp - 0x120], eax
call fcn.0042dc3c
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x58]
call fcn.00423aeb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x124]
push eax
push 0x42df68
xor ebx, ebx
push ebx
push dword [0x509a14]
mov esi, 0x509a0c
push esi
call fcn.00486560
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x42d8f5
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x11c]
call fcn.0042daf9
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, dword [ebp - 0x28]
jmp 0x42d199
push dword [0x509a0c]
mov eax, esi
call fcn.004866e0
cmp dword [edi + 0x94], ebx
jne 0x42d940
push 0x4deff2
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.EngineStampsDiskModeDeploy.marker
xor esi, esi
mov dword [ebp - 0x1c], eax
call fcn.0042341f
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00479360
add esp, 0xc
mov edi, esi
call fcn.004676c0
pop ecx
pop ecx
mov eax, dword [0x50a598]
push 0x4d9c38
push ecx
mov dword [ebp - 0x20], esp
mov dword [0x509ea4], eax
mov eax, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
mov esi, str.ZipCache
push esi
xor edi, edi
mov dword [ebp - 0x1c], eax
call fcn.0042341f
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00479360
add esp, 0xc
call fcn.004676c0
pop ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00423aca
push ecx
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.0042341f
mov byte [ebp - 4], 0x16
call fcn.00427f7b
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
push str.Loader_BasicDeploy:_Files_deployment_took__dms
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.0042c5e1
pop ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x11c]
call fcn.0042daf9
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test byte [edi + 0x88], 2
je 0x42da88
mov esi, dword [ebp - 0x24]
push dword [esi]
lea eax, [ebp - 0x24]
push str.SoftwareVOS_s
push eax
call fcn.00466a00
add esp, 8
mov byte [ebp - 4], 0x18
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.RegistryMachineSystemCurrentControlSetServices
push eax
push ecx
mov dword [ebp - 0x44], 4
call fcn.0042366e
add esp, 0xc
mov dword [ebp - 4], 0x19
call fcn.00478650
mov edx, eax
mov byte [ebp - 4], 0x18
call fcn.00467df0
pop ecx
cmp eax, ebx
je 0x42da88
push 1
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push esi
call fcn.0042340a
call fcn.0042c30e
pop ecx
pop ecx
cmp eax, ebx
jne 0x42da88
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push esi
call fcn.0042340a
call fcn.0042c30e
pop ecx
pop ecx
mov byte [ebp + 0x13], 1
cmp eax, ebx
je 0x42da8b
mov byte [ebp + 0x13], bl
mov dword [ebp - 4], 0xb
test byte [ebp - 0x44], 4
je 0x42daa3
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp + 0x13], bl
je 0x42dab7
mov eax, dword [ebp + 8]
push eax
push edi
mov dword [edi + 8], eax
call fcn.00422a77
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x50]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push str.Loader_BasicDeploy:_out___dms_
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.0042c5e1
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
call fcn.004b18c8
ret