Function at 0x432324
Capabilities:
Check for time delay via gettickcount
Copy file
Move file
Persist via application shimming

Disassembly:
push 0x168
mov eax, 0x4d8bf4
call fcn.004b8118
call fcn.004a35be
push eax
lea ecx, [ebp - 0x50]
call fcn.0042249e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Loader_BasicDeploy:_in
mov dword [ebp - 0x4c], eax
call fcn.0042462c
call fcn.00431948
mov dword [ebp - 0x20], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
mov esi, str.EngineStamps
push esi
call fcn.0042462c
push edi
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
call fcn.004691c0
pop ecx
cmp eax, ebx
jne 0x4323bc
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.0042462c
lea eax, [ebp - 0x34]
push eax
mov ecx, ebx
call fcn.004779d0
mov esi, dword [eax]
pop ecx
pop ecx
call fcn.00469260
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov dword [ebp - 0x20], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.0042462c
push ebx
push esi
call fcn.004776d0
add esp, 0x18
call fcn.004691c0
pop ecx
cmp eax, ebx
jne 0x43244e
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.0042462c
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.004776d0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x1c]
call fcn.00469260
add esp, 0x14
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.004691c0
pop ecx
cmp eax, ebx
jne 0x432440
push dword [ebp - 0x1c]
push str.Cannot_create_directory__s
lea eax, [ebp - 0x4c]
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
call fcn.00431978
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov dword [ebp - 0x20], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.0042462c
xor esi, esi
inc esi
push esi
push edi
call fcn.004776d0
add esp, 0x18
call fcn.004691c0
pop ecx
cmp eax, ebx
je 0x4324a7
push ecx
mov dword [ebp - 0x20], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtFiles.db
call fcn.0042462c
push esi
push edi
call fcn.004776d0
add esp, 0x18
call fcn.00469180
pop ecx
cmp eax, ebx
jne 0x4324fc
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
mov dword [ebp - 0x30], esi
call fcn.0042462c
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.004776d0
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x1c]
call fcn.00469260
add esp, 0x14
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.004691c0
pop ecx
cmp eax, ebx
je 0x432425
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [ebp + 0x10]
push dword [eax + 0x50]
lea eax, [ebp - 0x48]
push str.BuildUID_s_n
push eax
call fcn.00466ad0
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x48]
mov eax, dword [ecx - 0xc]
push ecx
push ecx
mov dword [ebp - 0x20], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtApp.ini
lea edi, [eax + eax]
call fcn.0042462c
push esi
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
call fcn.004674a0
pop ecx
mov dword [ebp - 0x20], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
mov edi, str.VirtFiles.Prog.db
push edi
call fcn.0042462c
push esi
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
call fcn.00469180
pop ecx
cmp eax, ebx
je 0x4325ab
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042462c
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.Main
call fcn.0042462c
push dword [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.00429df2
add esp, 0xc
mov dword [ebp - 0x34], 1
cmp eax, ebx
jne 0x4325ae
mov dword [ebp - 0x34], ebx
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push str.Loader_BasicDeploy:_bInitDataRepository_d__bPatching_d
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.00431948
pop ecx
cmp dword [ebp - 0x34], ebx
je 0x4325f1
call fcn.00432003
test eax, eax
jne 0x4325f1
call fcn.0042f3c5
mov edi, dword [ebp + 0x10]
push 0x406
call fcn.00482ac0
pop ecx
jmp 0x4325f4
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x58]
cmp dword [eax - 0xc], ebx
je 0x432633
cmp dword [ebp + 0x14], 2
je 0x432633
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push dword [edi + 0xc]
push str.StartStreaming:AppID_s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.004273ff
pop ecx
pop ecx
cmp eax, ebx
jne 0x432633
push dword [edi + 0xc]
push str.Cannot_stream_application__s_
jmp 0x43242d
call fcn.00431ef5
mov edi, str.Main
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 0x20], esp
push dword [ecx + 0xc]
lea esi, [ebp - 0x21]
push str.AppVirtDll__s.dll
push eax
call fcn.00466ad0
add esp, 8
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x2c], esp
push edi
call fcn.0042462c
mov ecx, dword [ebp + 0xc]
push 2
mov byte [ebp - 4], 3
call fcn.00429e79
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x4326af
cmp eax, 5
je 0x4326af
mov eax, dword [ebp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push dword [eax + 0xc]
push str.AppVirtDll__s.dll
push ecx
call fcn.00466ad0
add esp, 0xc
push 0xffffffffffffffff
call fcn.00431e16
add esp, 0xc
cmp eax, ebx
jne 0x43263d
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 0x20], esp
push dword [ecx + 0xc]
lea esi, [ebp - 0x21]
push str.AppVirtDll64__s.dll
push eax
call fcn.00466ad0
add esp, 8
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.0042462c
mov ecx, dword [ebp + 0xc]
push 8
mov byte [ebp - 4], 3
call fcn.00429e79
add esp, 0xc
and dword [ebp - 0x2c], eax
je 0x43274e
cmp dword [ebp - 0x2c], 5
je 0x43274e
mov eax, dword [ebp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [eax + 0xc]
push str.AppVirtDll64__s.dll
push ecx
call fcn.00466ad0
add esp, 0xc
push 0xffffffffffffffff
call fcn.00431e16
add esp, 0xc
cmp eax, ebx
jne 0x43263d
push dword [ebp - 0x2c]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Engine
call fcn.0042462c
call fcn.00431d76
sub eax, 3
pop ecx
pop ecx
je 0x4328a2
dec eax
je 0x43263d
mov eax, dword [ebp + 0x10]
push dword [eax + 0xc]
lea eax, [ebp - 0x28]
push str._s.exe
push eax
call fcn.00466ad0
add esp, 8
mov byte [ebp - 4], 7
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
lea esi, [ebp - 0x21]
call fcn.00424d19
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042462c
mov ecx, dword [ebp + 0xc]
push 9
mov byte [ebp - 4], 7
call fcn.00429e79
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x4327cb
cmp eax, 5
je 0x4327cb
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
push 0xffffffffffffffff
call fcn.00431e16
add esp, 0xc
cmp eax, ebx
jne 0x432878
mov eax, dword [ebp + 0x10]
push dword [eax + 0xc]
lea eax, [ebp - 0x1c]
push str._s64.exe
push eax
call fcn.00466ad0
add esp, 8
mov byte [ebp - 4], 9
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
lea esi, [ebp - 0x21]
call fcn.00424d19
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042462c
mov ecx, dword [ebp + 0xc]
push 0xa
mov byte [ebp - 4], 9
call fcn.00429e79
add esp, 0xc
and dword [ebp - 0x2c], eax
je 0x4328c0
cmp dword [ebp - 0x2c], 5
je 0x4328c0
push dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
push 0xffffffffffffffff
call fcn.00431e16
add esp, 0xc
cmp eax, ebx
jne 0x43286d
push dword [ebp - 0x2c]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Engine
call fcn.0042462c
call fcn.00431d76
sub eax, 3
pop ecx
pop ecx
je 0x43288c
dec eax
jne 0x4328c0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
jmp 0x43263d
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [ebp - 0x2c]
jmp 0x4335ff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.Prog.db
lea esi, [ebp - 0x15]
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042462c
mov ecx, dword [ebp + 0xc]
push 4
mov byte [ebp - 4], 3
call fcn.00429e79
add esp, 0xc
cmp eax, ebx
je 0x432931
mov esi, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, esi
jmp 0x4335ff
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SandboxCfg.db
lea esi, [ebp - 0x21]
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042462c
mov ecx, dword [ebp + 0xc]
push 5
mov byte [ebp - 4], 3
call fcn.00429e79
add esp, 8
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e9c50
lea esi, [ebp - 0x21]
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042462c
mov ecx, dword [ebp + 0xc]
push 0xb
mov byte [ebp - 4], 3
call fcn.00429e79
add esp, 0xc
push 0x4e3948
lea ecx, [ebp - 0x3c]
call fcn.0042462c
lea eax, [ebp - 0x3c]
push eax
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.ZipCache
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0xf
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0042462c
xor esi, esi
inc esi
push esi
push dword [ebp + 0xc]
mov byte [ebp - 4], 0xe
call fcn.00429cda
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp byte [ebp - 0x15], bl
je 0x432b6e
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.db
mov dword [ebp - 0x1c], eax
call fcn.0042462c
mov eax, dword [ebp - 0x1c]
push esi
push eax
call fcn.004776d0
add esp, 0x18
call fcn.00469180
pop ecx
cmp eax, ebx
je 0x432b6e
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_Update:_VirtFilesDb_update
call fcn.0042462c
call fcn.00431948
mov eax, esp
mov dword [ebp - 0x14], esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.old.db
mov dword [ebp - 0x1c], eax
call fcn.0042462c
mov eax, dword [ebp - 0x1c]
push esi
push eax
call fcn.004776d0
add esp, 0x18
call fcn.00469bd0
pop ecx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.old.db
call fcn.0042462c
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004776d0
add esp, 0x18
mov byte [ebp - 4], 0x10
push dword [eax]
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.db
call fcn.0042462c
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.004776d0
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x1c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042201a
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x15], bl
je 0x432af5
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
push 7
pop esi
jmp 0x432914
push esi
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.db
call fcn.0042462c
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004776d0
add esp, 0x18
mov byte [ebp - 4], 0x11
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.Prog.db
call fcn.0042462c
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp - 0x1c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042201a
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x15], bl
jne 0x432ae2
call fcn.0042feab
cmp dword [ebp - 0x30], ebx
je 0x432c18
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_Init:_Data_first_init
call fcn.0042462c
call fcn.00431948
pop ecx
push esi
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.db
call fcn.0042462c
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004776d0
add esp, 0x18
mov byte [ebp - 4], 0x12
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.Prog.db
call fcn.0042462c
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp - 0x1c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042201a
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x15], bl
je 0x432c18
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_Init:_cannot_copy_VirtFiles.Prog.db_into_Data_repository
call fcn.0042462c
call fcn.00431948
pop ecx
jmp 0x432ae2
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.dat
call fcn.0042462c
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.004776d0
add esp, 0x18
push ebx
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.Transitory.dat
call fcn.0042462c
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.004776d0
add esp, 0x14
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x40]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.00469180
pop ecx
cmp eax, ebx
je 0x432d2e
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_pre_delete
call fcn.0042462c
call fcn.00431948
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.004320d5
pop ecx
cmp eax, ebx
je 0x432d2e
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_rename
call fcn.0042462c
call fcn.00431948
pop ecx
push dword [ebp - 0x38]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x432d01
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_renamed_back_to_normal.
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
lea eax, [ebp - 0x40]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.004320d5
pop ecx
jmp 0x432d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push str.Loader_BasicDeploy:_cannot_rename_back_to_normal._Continuing_to_use_transitory_reg_dat_file__LE_d_
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x38]
call fcn.00424d3a
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, 0x4e9c50
push esi
call fcn.0042462c
lea eax, [ebp - 0x44]
push eax
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x30], ebx
jne 0x432d5a
cmp byte [ebp - 0x21], bl
je 0x432da5
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
mov dword [ebp - 0x30], eax
call fcn.0042462c
mov eax, dword [ebp - 0x30]
push eax
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
call fcn.00469180
pop ecx
cmp eax, ebx
je 0x432da5
push ebx
push ebx
push ebx
push 2
pop esi
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
mov ecx, esi
call fcn.0048e690
add esp, 0x10
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.Base.dat
call fcn.0042462c
push 1
push esi
call fcn.004776d0
add esp, 0x18
call fcn.00469180
pop ecx
push ecx
mov esi, esp
mov dword [ebp - 0x14], esp
cmp eax, ebx
je 0x432f1f
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.VirtReg.Base.dat
call fcn.0042462c
push 1
push esi
call fcn.004776d0
add esp, 0x14
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x44]
mov dword [ebp - 0x30], esp
mov ecx, esp
push eax
call fcn.00424d19
mov byte [ebp - 4], 0x15
call fcn.00466750
pop ecx
pop ecx
cmp eax, ebx
je 0x43328d
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
xor esi, esi
push str.MergeRegistry:_merging_registry
inc esi
push eax
mov dword [ebp - 0x1c], esi
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.open
call fcn.0042462c
push esi
push ecx
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x28], esp
mov esi, str._Quiet__MergeRegistry
push esi
lea edi, [ebp - 0x1c]
call fcn.0042462c
mov eax, dword [ebp + 0x10]
push ecx
mov byte [ebp - 4], 0x18
add eax, 0x68
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
mov dword [ebp - 0x30], eax
call fcn.00424617
mov byte [ebp - 4], 0x15
call fcn.00465570
add esp, 0x10
push ecx
test eax, eax
mov dword [ebp - 0x14], esp
mov eax, esp
jne 0x432eb6
mov ecx, dword [ebp - 0x30]
push esi
push dword [ecx]
push str._Loader_BasicDeploy:_could_not_execute___s___s
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.00431948
pop ecx
xor ebx, ebx
jmp 0x4331c5
push dword [ebp - 0x1c]
push str.MergeRegistry:__MergeRegistry_returned:__d
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
cmp dword [ebp - 0x1c], 0
pop ecx
je 0x43328b
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
call fcn.0046d880
add esp, 4
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
push dword [edx]
push dword [eax]
push dword [ebp - 0x1c]
push str._Loader_BasicDeploy:_exitcode__d___s__return_by___s___s
push ecx
call fcn.00466ad0
add esp, 0x18
call fcn.00431948
pop ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042201a
jmp 0x432eaf
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e9c50
call fcn.0042462c
push esi
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
call fcn.00469180
pop ecx
cmp eax, ebx
je 0x43328d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
cmp dword [0x51efac], ebx
jne 0x432f7c
call fcn.0046a000
test eax, eax
je 0x432f7c
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_modern_virtual_registry__not_deploying_registry
call fcn.0042462c
call fcn.00431948
pop ecx
jmp 0x433080
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_deploying_Legacy_virtual_registry
call fcn.0042462c
call fcn.00431948
mov eax, dword [ebp + 0x10]
pop ecx
push dword [eax + 0xc]
lea eax, [ebp - 0x1c]
push str.SoftwareVOS_s
push eax
mov dword [ebp - 0x30], ebx
call fcn.00466ad0
add esp, 0xc
push ebx
lea eax, [ebp - 0x30]
push eax
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0x1a
push ebx
push dword [ebp - 0x1c]
call fcn.00476dd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x433262
push ebx
push ebx
push dword [ebp - 0x30]
lea eax, [ebp - 0x44]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
xor esi, esi
push eax
inc esi
call fcn.00424d19
mov ecx, esi
call fcn.0048e690
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x433068
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push esi
push dword [ebp - 0x1c]
push str.Loader_BasicDeploy:_RegDatFileParse:_failed_parsing_hive_file__s:__d__LE_d
push ecx
call fcn.00466ad0
add esp, 0x14
call fcn.00431948
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
push 0xb
jmp 0x432aef
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042201a
push ebx
push dword [ebp - 0x38]
mov esi, 0x4e9c50
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.0042462c
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
call fcn.004779d0
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp - 0x28]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042201a
cmp byte [ebp - 0x15], bl
je 0x4330e1
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp - 0x38]
push str.Loader_BasicDeploy:_Init_Update:_cannot_copy_VirtReg.Prog.dat_into_Data_repository:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
jmp 0x4331c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push str.Loader_BasicDeploy:_registry_deployment_took__dms
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
push ebx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.Base.dat
call fcn.0042462c
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.004776d0
add esp, 0x18
mov byte [ebp - 4], 0x1b
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.0042462c
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.004779d0
pop ecx
pop ecx
push dword [eax]
call edi
mov ecx, dword [ebp - 0x28]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042201a
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x15], bl
je 0x43328d
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.Base.dat
call fcn.0042462c
lea eax, [ebp - 0x34]
push 1
push eax
call fcn.004776d0
add esp, 0x14
mov byte [ebp - 4], 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [eax]
push str.Loader_BasicDeploy:_Init_Update:_cannot_copy_VirtReg.Prog.dat_into_Data_repository:__s
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042201a
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_deleting_EngineStamps_to_force_redeploy__bPatching__on_next_run
call fcn.0042462c
call fcn.00431948
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.Prog.dat
call fcn.0042462c
push ecx
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x4c], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.EngineStamps
call fcn.0042462c
push esi
mov ecx, ebx
call fcn.004779d0
pop ecx
pop ecx
mov byte [ebp - 4], 0x15
call fcn.00468d30
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0042201a
push 7
pop eax
jmp 0x4335ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push dword [ebp - 0x1c]
push str.Loader_BasicDeploy:_RegDatFileParse:_cannot_create_key__s__LE_d
push ecx
call fcn.00466ad0
add esp, 0x10
call fcn.00431948
pop ecx
jmp 0x43302a
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
jne 0x4332d6
cmp dword [ebp + 0x18], ebx
jne 0x4332d6
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0xa8], ebx
jne 0x433591
push ecx
mov dword [ebp - 0x14], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.0042462c
push edi
mov ecx, esi
call fcn.004779d0
pop ecx
pop ecx
call fcn.00469180
pop ecx
cmp eax, ebx
jne 0x433591
jmp 0x4332d9
mov esi, dword [ebp + 0x10]
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [esi + 0x5c]
push str.Loader_BasicDeploy:_DEPLOYING_ZIPs_virtual_files_to:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
call esi
call fcn.00471c10
call esi
push 1
push str._System_mscoree.dll
call fcn.00472360
pop ecx
pop ecx
cmp eax, ebx
je 0x43335a
push eax
call fcn.004b2405
pop ecx
call fcn.00465e00
test eax, eax
jne 0x43335a
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x13
jmp 0x432aef
call fcn.004a35be
push eax
lea ecx, [ebp - 0x28]
call fcn.0042249e
lea eax, [ebp - 0x28]
push eax
push ecx
mov byte [ebp - 4], 0x1d
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Main
call fcn.0042462c
mov edi, dword [ebp + 0xc]
push 7
call fcn.0047cc30
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x51ec0c]
mov dword [0x51f3a0], eax
xor eax, eax
mov dword [ebp - 0x174], ebx
lea edi, [ebp - 0x170]
lea esi, [ebp - 0x16c]
mov dword [0x51ec0c], ebx
stosd dword es:[edi], eax
call fcn.00431417
xor eax, eax
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004a35be
push eax
lea ecx, [ebp - 0x58]
call fcn.0042249e
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x174], ebx
mov ebx, esi
mov dword [ebp - 0x170], eax
call fcn.004337c1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
call fcn.00424d3a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x174]
push eax
push 0x433c19
xor ebx, ebx
push ebx
push dword [0x51e774]
mov esi, 0x51e76c
push esi
call fcn.00486600
mov edi, dword [ebp - 0x174]
cmp edi, ebx
je 0x43348c
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0042201a
lea esi, [ebp - 0x16c]
call fcn.00433605
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
mov esi, edi
jmp 0x432914
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [0x51e76c]
call fcn.0042462c
mov ecx, esi
call fcn.004721f0
mov esi, dword [ebp + 0x10]
pop ecx
cmp dword [esi + 0xa8], ebx
jne 0x4334de
push 0x4e9414
push ecx
mov dword [ebp - 0x14], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.0042462c
push edi
mov ecx, esi
call fcn.004779d0
pop ecx
pop ecx
xor edi, edi
call fcn.004674a0
pop ecx
pop ecx
mov eax, dword [0x51f3a0]
push 0x4e3948
push ecx
mov dword [ebp - 0x14], esp
mov dword [0x51ec0c], eax
mov eax, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, str.ZipCache
push esi
xor edi, edi
mov dword [ebp - 0x20], eax
call fcn.0042462c
mov eax, dword [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.004779d0
pop ecx
pop ecx
call fcn.004674a0
pop ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00424d19
push ecx
mov byte [ebp - 4], 0x1f
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.0042462c
mov byte [ebp - 4], 0x1e
call fcn.00429fb0
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push str.Loader_BasicDeploy:_Files_deployment_took__dms
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0042201a
lea esi, [ebp - 0x16c]
call fcn.00433605
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042201a
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x4c]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push str.Loader_BasicDeploy:_out___dms_
push ecx
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
call fcn.004b81f0
ret