Function at 0x42d8f9
Capabilities:
Copy file
Move file
Persist via application shimming

Disassembly:
push 0x128
mov eax, 0x4d444a
call fcn.004b4442
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
call fcn.0049ff8a
push eax
lea ecx, [ebp - 0x40]
call fcn.00425004
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_in
mov dword [ebp - 0x4c], eax
call fcn.004235bf
call fcn.0042d0ea
mov dword [ebp - 0x14], esp
mov edi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, str.EngineStamps
push esi
call fcn.004235bf
push edi
call fcn.0047bf10
add esp, 0xc
call fcn.0046b0c0
pop ecx
cmp eax, ebx
jne 0x42d994
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004235bf
lea eax, [ebp - 0x34]
push eax
call fcn.0047bf10
mov esi, dword [eax]
add esp, 0xc
call fcn.0046b160
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.004235bf
push ebx
mov ecx, esi
call fcn.0047bc30
add esp, 0x14
call fcn.0046b0c0
pop ecx
cmp eax, ebx
jne 0x42d9eb
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.004235bf
push ebx
lea ecx, [ebp - 0x34]
call fcn.0047bc30
mov esi, dword [eax]
add esp, 0x14
call fcn.0046b160
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x14], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.004235bf
xor esi, esi
inc esi
push esi
mov ecx, edi
call fcn.0047bc30
add esp, 0x14
call fcn.0046b0c0
pop ecx
cmp eax, ebx
jne 0x42da48
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
mov dword [ebp - 0x3c], esi
call fcn.004235bf
push esi
lea ecx, [ebp - 0x34]
call fcn.0047bc30
mov esi, dword [eax]
add esp, 0x14
call fcn.0046b160
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, str.VirtFiles.Prog.db
push edi
call fcn.004235bf
push esi
call fcn.0047bf10
add esp, 0xc
call fcn.0046b080
pop ecx
mov esi, str.Main
cmp eax, ebx
je 0x42dacb
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.004235bf
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
push dword [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.00428617
add esp, 0xc
cmp eax, ebx
je 0x42dacb
mov dword [ebp - 0x34], 1
call fcn.0042d825
test eax, eax
jne 0x42dace
call fcn.0042bd82
mov edi, dword [ebp + 0x10]
push 0x406
call fcn.00484750
pop ecx
jmp 0x42dad1
mov dword [ebp - 0x34], ebx
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x54]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42db20
cmp dword [ebp + 0x14], 2
je 0x42db20
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.StartStreaming:AppID_s
push eax
call fcn.00468700
add esp, 0xc
call fcn.004263ad
pop ecx
pop ecx
cmp eax, ebx
jne 0x42db20
push dword [edi + 0xc]
lea eax, [ebp + 0x10]
push str.Cannot_stream_application__s_
push eax
call fcn.00468700
add esp, 0xc
push dword [eax]
call fcn.0042d11a
call fcn.0042d718
jmp 0x42db29
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.AppVirtDll__s.dll
push eax
call fcn.00468700
add esp, 8
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], bl
push 2
lea ebx, [ebp - 0xd]
call fcn.0042869f
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x42db94
cmp eax, 5
je 0x42db94
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.AppVirtDll__s.dll
push eax
call fcn.00468700
add esp, 0xc
push 0xffffffffffffffff
call fcn.0042d639
add esp, 0xc
test eax, eax
jne 0x42db27
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
lea ebx, [ebp - 0xd]
push str.AppVirtDll64__s.dll
push eax
call fcn.00468700
add esp, 8
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov ecx, dword [ebp + 0xc]
push 8
mov byte [ebp - 4], 0
call fcn.0042869f
mov ebx, dword [ebp - 0x20]
add esp, 0xc
and ebx, eax
je 0x42dc2c
cmp ebx, 5
je 0x42dc2c
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.AppVirtDll64__s.dll
push eax
call fcn.00468700
add esp, 0xc
push 0xffffffffffffffff
call fcn.0042d639
add esp, 0xc
test eax, eax
jne 0x42db27
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Engine
call fcn.004235bf
call fcn.0042d599
sub eax, 3
pop ecx
pop ecx
je 0x42dd75
dec eax
je 0x42db27
push dword [edi + 0xc]
lea eax, [ebp - 0x2c]
push str._s.exe
push eax
call fcn.00468700
add esp, 8
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
lea ebx, [ebp - 0xd]
call fcn.00423cb9
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov ecx, dword [ebp + 0xc]
push 9
mov byte [ebp - 4], 4
call fcn.0042869f
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x42dca4
cmp eax, 5
je 0x42dca4
push edi
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00423cb9
push 0xffffffffffffffff
call fcn.0042d639
add esp, 0xc
test eax, eax
jne 0x42dd4b
push dword [edi + 0xc]
lea eax, [ebp - 0x28]
push str._s64.exe
push eax
call fcn.00468700
add esp, 8
mov byte [ebp - 4], 6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
lea ebx, [ebp - 0xd]
call fcn.00423cb9
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov ecx, dword [ebp + 0xc]
push 0xa
mov byte [ebp - 4], 6
call fcn.0042869f
mov ebx, dword [ebp - 0x20]
add esp, 0xc
and ebx, eax
je 0x42dd87
cmp ebx, 5
je 0x42dd87
push edi
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00423cb9
push 0xffffffffffffffff
call fcn.0042d639
add esp, 0xc
test eax, eax
jne 0x42dd40
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Engine
call fcn.004235bf
call fcn.0042d599
sub eax, 3
pop ecx
pop ecx
je 0x42dd5f
dec eax
jne 0x42dd87
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x42db27
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
jmp 0x42e69f
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.Prog.db
lea ebx, [ebp - 0x15]
call fcn.004235bf
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov ecx, dword [ebp + 0xc]
push 4
mov byte [ebp - 4], 0
call fcn.0042869f
add esp, 0xc
test eax, eax
je 0x42dded
mov esi, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
jmp 0x42e69f
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SandboxCfg.db
lea ebx, [ebp - 0xd]
call fcn.004235bf
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov ecx, dword [ebp + 0xc]
push 5
mov byte [ebp - 4], 0
call fcn.0042869f
add esp, 8
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.Prog.dat
lea ebx, [ebp - 0xd]
call fcn.004235bf
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov ecx, dword [ebp + 0xc]
push 0xb
mov byte [ebp - 4], 0
call fcn.0042869f
add esp, 0xc
push 0x4df5f8
lea ecx, [ebp - 0x30]
call fcn.004235bf
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.ZipCache
lea ebx, [ebp - 0x30]
call fcn.004235bf
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
push 1
push dword [ebp + 0xc]
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.00428491
xor ebx, ebx
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ebx
cmp byte [ebp - 0xd], bl
je 0x42e052
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtReg.Prog.dat
mov dword [ebp - 0x1c], eax
call fcn.004235bf
lea eax, [ebp - 0x2c]
push eax
call fcn.0047bf10
add esp, 0xc
push ebx
push ebx
push 2
push ecx
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00423cb9
call fcn.00493240
add esp, 0x10
cmp dword [0x510230], ebx
jne 0x42df06
call fcn.0046bf50
test eax, eax
jne 0x42dff1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Loader_BasicDeploy:_deploying_Legacy_virtual_registry
call fcn.004235bf
call fcn.0042d0ea
pop ecx
push dword [edi + 0xc]
lea eax, [ebp - 0x28]
push str.SoftwareVOS_s
push eax
mov dword [ebp - 0x44], ebx
call fcn.00468700
add esp, 0xc
push ebx
lea eax, [ebp - 0x44]
push eax
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xe
push ebx
push dword [ebp - 0x28]
call fcn.0047b220
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42e029
push ebx
push dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
push 1
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00423cb9
call fcn.00493240
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x42dfd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push str.RegDatFileParse:_failed_parsing_hive_file__s:__d__LE_d
push ecx
call fcn.00468700
add esp, 0x14
call fcn.0042d0ea
pop ecx
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
push 0xb
pop esi
jmp 0x42dddb
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1c]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push str.Loader_BasicDeploy:_registry_deployment_took__dms
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0042d0ea
pop ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x42e0ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push dword [ebp - 0x28]
push str.RegDatFileParse:_cannot_create_key__s__LE_d
push ecx
call fcn.00468700
add esp, 0x10
call fcn.0042d0ea
pop ecx
jmp 0x42dfb0
push dword [edi + 0xc]
lea eax, [ebp - 0x1c]
push str.SoftwareVOS_s
push eax
call fcn.00468700
add esp, 0xc
push ebx
lea ecx, [ebp - 0x48]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
push ebx
push eax
call fcn.0047b220
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb al, al
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1c]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x35], al
call fcn.0042101a
cmp byte [ebp - 0x35], bl
je 0x42e0ad
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x15], bl
je 0x42e22e
push ecx
mov dword [ebp - 0x1c], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtFiles.db
call fcn.004235bf
push 1
mov ecx, edi
call fcn.0047bc30
add esp, 0x14
call fcn.0046b080
pop ecx
cmp eax, ebx
je 0x42e22b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Update:_VirtFilesDb_update
call fcn.004235bf
call fcn.0042d0ea
mov dword [ebp - 0x1c], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtFiles.old.db
call fcn.004235bf
push 1
mov ecx, edi
call fcn.0047bc30
add esp, 0x14
call fcn.0046bda0
pop ecx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.VirtFiles.old.db
call fcn.004235bf
push 1
lea ecx, [ebp - 0x20]
call fcn.0047bc30
add esp, 0x14
mov byte [ebp - 4], 0x10
push dword [eax]
mov edi, str.VirtFiles.db
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
call fcn.004235bf
push 1
lea ecx, [ebp - 0x1c]
call fcn.0047bc30
add esp, 0x14
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x1c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x15], bl
je 0x42e1b1
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
push 7
jmp 0x42dfd3
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
call fcn.004235bf
push 1
lea ecx, [ebp - 0x20]
call fcn.0047bc30
add esp, 0x14
mov byte [ebp - 4], 0x11
push dword [eax]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.VirtFiles.Prog.db
call fcn.004235bf
lea eax, [ebp - 0x1c]
push eax
call fcn.0047bf10
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x1c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x15], bl
jne 0x42e19f
call fcn.0042c865
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 0x3c], ebx
je 0x42e2dd
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Init:_Data_first_init
call fcn.004235bf
call fcn.0042d0ea
pop ecx
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.VirtFiles.db
call fcn.004235bf
push 1
lea ecx, [ebp - 0x3c]
call fcn.0047bc30
add esp, 0x14
mov byte [ebp - 4], 0x12
push dword [eax]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.VirtFiles.Prog.db
call fcn.004235bf
lea eax, [ebp - 0x1c]
push eax
call fcn.0047bf10
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x1c]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x15], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x15], bl
je 0x42e2e6
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Init:_cannot_copy_VirtFiles.Prog.db_into_Data_repository
call fcn.004235bf
call fcn.0042d0ea
pop ecx
jmp 0x42e19f
cmp byte [ebp - 0xd], bl
je 0x42e3b1
push ebx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.VirtReg.dat
call fcn.004235bf
push 1
lea ecx, [ebp - 0x20]
call fcn.0047bc30
add esp, 0x14
mov byte [ebp - 4], 0x13
push dword [eax]
mov dword [ebp - 0x3c], 1
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.VirtReg.Prog.dat
call fcn.004235bf
lea eax, [ebp - 0x1c]
push eax
call fcn.0047bf10
add esp, 0xc
mov dword [ebp - 4], 0x14
push dword [eax]
mov dword [ebp - 0x3c], 3
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x42e37c
push ecx
mov dword [ebp - 0x24], esp
mov edi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.VirtReg.Prog.dat
call fcn.004235bf
push edi
call fcn.0047bf10
add esp, 0xc
call fcn.0046b080
mov edi, dword [ebp + 0x10]
pop ecx
mov byte [ebp - 0xd], 1
cmp eax, ebx
jne 0x42e37f
mov byte [ebp - 0xd], bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042101a
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0xd], bl
je 0x42e3b1
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Init:_cannot_copy_VirtReg.Prog.dat_into_Data_repository
jmp 0x42e2cd
cmp dword [ebp - 0x14], ebx
jne 0x42e3fe
cmp dword [ebp + 0x18], ebx
jne 0x42e3fe
cmp dword [edi + 0x9c], ebx
jne 0x42e65d
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.EngineStampsDiskModeDeploy.marker
mov dword [ebp - 0x14], eax
call fcn.004235bf
mov eax, dword [ebp - 0x14]
push eax
call fcn.0047bf10
add esp, 0xc
call fcn.0046b080
mov edi, dword [ebp + 0x10]
pop ecx
cmp eax, ebx
jne 0x42e65d
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
push dword [edi + 0x58]
push str.Loader_BasicDeploy:_DEPLOYING_ZIPs_virtual_files_to:__s
push eax
call fcn.00468700
add esp, 0xc
call fcn.0042d0ea
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
call edi
call fcn.00474a30
call edi
push 1
push str._System_mscoree.dll
call fcn.00475240
pop ecx
pop ecx
cmp eax, ebx
je 0x42e45e
push eax
call fcn.004aedc5
pop ecx
call fcn.00467810
test eax, eax
jne 0x42e45e
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x13
jmp 0x42dfd3
call fcn.0049ff8a
push eax
lea ecx, [ebp - 0x20]
call fcn.00425004
lea eax, [ebp - 0x20]
push eax
push ecx
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
call fcn.004235bf
mov edi, dword [ebp + 0xc]
push 7
call fcn.00481b30
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [0x50fea4]
mov dword [0x5105e8], eax
xor eax, eax
mov dword [ebp - 0x130], ebx
lea edi, [ebp - 0x12c]
lea esi, [ebp - 0x128]
mov dword [0x50fea4], ebx
stosd dword es:[edi], eax
call fcn.0042cc47
xor eax, eax
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0049ff8a
push eax
lea ecx, [ebp - 0x58]
call fcn.00425004
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x16
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x130], ebx
push edi
mov ebx, esi
mov dword [ebp - 0x12c], eax
call fcn.0042e7fc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x58]
call fcn.00423cda
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x130]
push eax
push 0x42eb58
push 0
push dword [0x50fa14]
mov esi, 0x50fa0c
push esi
call fcn.00489230
mov ebx, dword [ebp - 0x130]
test ebx, ebx
je 0x42e56b
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x128]
call fcn.0042e6a5
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, ebx
jmp 0x42dddb
push dword [0x50fa0c]
mov eax, esi
call fcn.004893b0
xor esi, esi
cmp dword [edi + 0x9c], esi
jne 0x42e5b0
push 0x4e3362
push ecx
mov dword [ebp - 0x24], esp
mov ebx, esp
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.004235bf
push ebx
call fcn.0047bf10
add esp, 0xc
mov edi, esi
call fcn.004693c0
pop ecx
pop ecx
mov eax, dword [0x5105e8]
push 0x4df5f8
push ecx
mov dword [ebp - 0x24], esp
mov ebx, esp
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
mov esi, str.ZipCache
push esi
mov dword [0x50fea4], eax
xor edi, edi
call fcn.004235bf
push ebx
call fcn.0047bf10
add esp, 0xc
call fcn.004693c0
pop ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], esp
mov ecx, esp
push eax
call fcn.00423cb9
push ecx
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004235bf
mov byte [ebp - 4], 0x16
call fcn.004287dc
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
push str.Loader_BasicDeploy:_Files_deployment_took__dms
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0042d0ea
pop ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x128]
call fcn.0042e6a5
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x4c]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push str.Loader_BasicDeploy:_out___dms_
push ecx
call fcn.00468700
add esp, 0xc
call fcn.0042d0ea
pop ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
call fcn.004b451a
ret