Function at 0x42dbb2
Capabilities:
Copy file
Move file
Persist via application shimming

Disassembly:
push 0x138
mov eax, 0x4d5901
call fcn.004b5742
xor ebx, ebx
mov dword [ebp - 0x54], ebx
call fcn.004a1286
push eax
lea ecx, [ebp - 0x4c]
call fcn.0042149e
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Loader_BasicDeploy:_in
mov dword [ebp - 0x58], eax
call fcn.004235f2
call fcn.0042d153
mov dword [ebp - 0x14], esp
mov edi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, str.EngineStamps
push esi
call fcn.004235f2
push edi
call fcn.0047ccf0
add esp, 0xc
call fcn.0046bf60
pop ecx
cmp eax, ebx
jne 0x42dc4d
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004235f2
lea eax, [ebp - 0x40]
push eax
call fcn.0047ccf0
mov esi, dword [eax]
add esp, 0xc
call fcn.0046c000
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.004235f2
push ebx
push esi
call fcn.0047c9b0
add esp, 0x18
call fcn.0046bf60
pop ecx
cmp eax, ebx
jne 0x42dca4
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.004235f2
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.0047c9b0
mov esi, dword [eax]
add esp, 0x18
call fcn.0046c000
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x14], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.004235f2
xor esi, esi
inc esi
push esi
push edi
call fcn.0047c9b0
add esp, 0x18
call fcn.0046bf60
pop ecx
cmp eax, ebx
jne 0x42dd01
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
mov dword [ebp - 0x44], esi
call fcn.004235f2
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0047c9b0
mov esi, dword [eax]
add esp, 0x18
call fcn.0046c000
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, str.VirtFiles.Prog.db
push edi
call fcn.004235f2
push esi
call fcn.0047ccf0
add esp, 0xc
call fcn.0046bf20
pop ecx
mov esi, str.Main
cmp eax, ebx
je 0x42dd66
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.004235f2
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
push dword [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.004286ce
add esp, 0xc
mov dword [ebp - 0x40], 1
cmp eax, ebx
jne 0x42dd69
mov dword [ebp - 0x40], ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push str.Loader_BasicDeploy:_bInitDataRepository_d__bPatching_d
push eax
call fcn.00468c80
add esp, 0x10
call fcn.0042d153
pop ecx
cmp dword [ebp - 0x40], ebx
je 0x42ddac
call fcn.0042d88f
test eax, eax
jne 0x42ddac
call fcn.0042bdd7
mov edi, dword [ebp + 0x10]
push 0x406
call fcn.00485a80
pop ecx
jmp 0x42ddaf
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x54]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42ddfe
cmp dword [ebp + 0x14], 2
je 0x42ddfe
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.StartStreaming:AppID_s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0042641b
pop ecx
pop ecx
cmp eax, ebx
jne 0x42ddfe
push dword [edi + 0xc]
lea eax, [ebp + 0x10]
push str.Cannot_stream_application__s_
push eax
call fcn.00468c80
add esp, 0xc
push dword [eax]
call fcn.0042d183
call fcn.0042d782
mov edi, dword [ebp + 0x10]
jmp 0x42de0a
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.AppVirtDll__s.dll
push eax
call fcn.00468c80
add esp, 8
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], bl
push 2
lea ebx, [ebp - 0xd]
call fcn.00428756
add esp, 0xc
mov dword [ebp - 0x24], eax
test eax, eax
je 0x42de75
cmp eax, 5
je 0x42de75
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.AppVirtDll__s.dll
push eax
call fcn.00468c80
add esp, 0xc
push 0xffffffffffffffff
call fcn.0042d6a2
add esp, 0xc
test eax, eax
jne 0x42de08
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
lea ebx, [ebp - 0xd]
push str.AppVirtDll64__s.dll
push eax
call fcn.00468c80
add esp, 8
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov ecx, dword [ebp + 0xc]
push 8
mov byte [ebp - 4], 0
call fcn.00428756
add esp, 0xc
and dword [ebp - 0x24], eax
je 0x42df0e
cmp dword [ebp - 0x24], 5
je 0x42df0e
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0xc]
push str.AppVirtDll64__s.dll
push eax
call fcn.00468c80
add esp, 0xc
push 0xffffffffffffffff
call fcn.0042d6a2
add esp, 0xc
test eax, eax
jne 0x42de08
push dword [ebp - 0x24]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Engine
call fcn.004235f2
call fcn.0042d602
sub eax, 3
pop ecx
pop ecx
je 0x42e058
dec eax
je 0x42de08
push dword [edi + 0xc]
lea eax, [ebp - 0x28]
push str._s.exe
push eax
call fcn.00468c80
add esp, 8
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
lea ebx, [ebp - 0xd]
call fcn.00423d24
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov ecx, dword [ebp + 0xc]
push 9
mov byte [ebp - 4], 4
call fcn.00428756
add esp, 0xc
mov dword [ebp - 0x24], eax
test eax, eax
je 0x42df86
cmp eax, 5
je 0x42df86
push edi
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00423d24
push 0xffffffffffffffff
call fcn.0042d6a2
add esp, 0xc
test eax, eax
jne 0x42e02e
push dword [edi + 0xc]
lea eax, [ebp - 0x2c]
push str._s64.exe
push eax
call fcn.00468c80
add esp, 8
mov byte [ebp - 4], 6
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
lea ebx, [ebp - 0xd]
call fcn.00423d24
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov ecx, dword [ebp + 0xc]
push 0xa
mov byte [ebp - 4], 6
call fcn.00428756
add esp, 0xc
and dword [ebp - 0x24], eax
je 0x42e06b
cmp dword [ebp - 0x24], 5
je 0x42e06b
push edi
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00423d24
push 0xffffffffffffffff
call fcn.0042d6a2
add esp, 0xc
test eax, eax
jne 0x42e023
push dword [ebp - 0x24]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Engine
call fcn.004235f2
call fcn.0042d602
sub eax, 3
pop ecx
pop ecx
je 0x42e042
dec eax
jne 0x42e06b
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x42de08
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp - 0x24]
jmp 0x42ebbc
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtFiles.Prog.db
lea ebx, [ebp - 0x19]
call fcn.004235f2
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov ecx, dword [ebp + 0xc]
push 4
mov byte [ebp - 4], 0
call fcn.00428756
add esp, 0xc
test eax, eax
je 0x42e0d1
mov esi, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
jmp 0x42ebbc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SandboxCfg.db
lea ebx, [ebp - 0xd]
call fcn.004235f2
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov ecx, dword [ebp + 0xc]
push 5
mov byte [ebp - 4], 0
call fcn.00428756
add esp, 8
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.VirtReg.Prog.dat
lea ebx, [ebp - 0xd]
call fcn.004235f2
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov ecx, dword [ebp + 0xc]
push 0xb
mov byte [ebp - 4], 0
call fcn.00428756
add esp, 0xc
push 0x4e0608
lea ecx, [ebp - 0x3c]
call fcn.004235f2
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.ZipCache
lea ebx, [ebp - 0x3c]
call fcn.004235f2
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
push 1
push dword [ebp + 0xc]
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.00428548
xor ebx, ebx
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x50], ebx
cmp byte [ebp - 0xd], bl
je 0x42e34a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtReg.Prog.dat
mov dword [ebp - 0x34], eax
call fcn.004235f2
lea eax, [ebp - 0x28]
push eax
call fcn.0047ccf0
add esp, 0xc
push ebx
push ebx
push 2
push ecx
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00423d24
call fcn.00494540
add esp, 0x10
cmp dword [0x512230], ebx
jne 0x42e201
call fcn.0046cdf0
test eax, eax
je 0x42e201
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Loader_BasicDeploy:_modern_virtual_registry__not_deploying_registry
call fcn.004235f2
call fcn.0042d153
pop ecx
jmp 0x42e2e9
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Loader_BasicDeploy:_deploying_Legacy_virtual_registry
call fcn.004235f2
call fcn.0042d153
pop ecx
push dword [edi + 0xc]
lea eax, [ebp - 0x2c]
push str.SoftwareVOS_s
push eax
mov dword [ebp - 0x24], ebx
call fcn.00468c80
add esp, 0xc
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xe
push ebx
push dword [ebp - 0x2c]
call fcn.0047bf30
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42e321
push ebx
push dword [ebp - 0x24]
lea eax, [ebp - 0x28]
push 1
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00423d24
call fcn.00494540
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x42e2d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push edi
push dword [ebp - 0x2c]
push str.Loader_BasicDeploy:_RegDatFileParse:_failed_parsing_hive_file__s:__d__LE_d
push ecx
call fcn.00468c80
add esp, 0x14
call fcn.0042d153
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
push 0xb
pop esi
jmp 0x42e0bf
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0042101a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x34]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
push str.Loader_BasicDeploy:_registry_deployment_took__dms
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0042d153
pop ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x42e3a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push dword [ebp - 0x2c]
push str.Loader_BasicDeploy:_RegDatFileParse:_cannot_create_key__s__LE_d
push ecx
call fcn.00468c80
add esp, 0x10
call fcn.0042d153
pop ecx
jmp 0x42e2a8
push dword [edi + 0xc]
lea eax, [ebp - 0x34]
push str.SoftwareVOS_s
push eax
call fcn.00468c80
add esp, 0xc
push ebx
lea ecx, [ebp - 0x50]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
push ebx
push eax
call fcn.0047bf30
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb al, al
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x45], al
call fcn.0042101a
cmp byte [ebp - 0x45], bl
je 0x42e3a5
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, str.VirtFiles.db
cmp byte [ebp - 0x19], bl
je 0x42e532
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
mov dword [ebp - 0x34], eax
call fcn.004235f2
mov eax, dword [ebp - 0x34]
push 1
push eax
call fcn.0047c9b0
add esp, 0x18
call fcn.0046bf20
pop ecx
cmp eax, ebx
je 0x42e52d
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Loader_BasicDeploy:_Update:_VirtFilesDb_update
call fcn.004235f2
call fcn.0042d153
mov dword [ebp - 0x20], esp
mov edi, esp
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtFiles.old.db
call fcn.004235f2
push 1
push edi
call fcn.0047c9b0
add esp, 0x18
call fcn.0046cc40
pop ecx
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.VirtFiles.old.db
call fcn.004235f2
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.0047c9b0
add esp, 0x18
mov byte [ebp - 4], 0x10
push dword [eax]
mov edi, str.VirtFiles.db
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.004235f2
lea eax, [ebp - 0x34]
push 1
push eax
call fcn.0047c9b0
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x34]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x19], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x19], bl
je 0x42e4b0
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
push 7
jmp 0x42e2cb
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.004235f2
lea eax, [ebp - 0x34]
push 1
push eax
call fcn.0047c9b0
add esp, 0x18
mov byte [ebp - 4], 0x11
push dword [eax]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtFiles.Prog.db
call fcn.004235f2
lea eax, [ebp - 0x20]
push eax
call fcn.0047ccf0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x20]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x19], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x19], bl
jne 0x42e49e
call fcn.0042c8bb
jmp 0x42e532
mov edi, str.VirtFiles.db
cmp dword [ebp - 0x44], ebx
je 0x42e5de
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Loader_BasicDeploy:_Init:_Data_first_init
call fcn.004235f2
call fcn.0042d153
pop ecx
push 1
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.004235f2
lea eax, [ebp - 0x34]
push 1
push eax
call fcn.0047c9b0
add esp, 0x18
mov byte [ebp - 4], 0x12
push dword [eax]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtFiles.Prog.db
call fcn.004235f2
lea eax, [ebp - 0x20]
push eax
call fcn.0047ccf0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x20]
neg eax
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0x19], al
call fcn.0042101a
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x19], bl
je 0x42e5de
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Loader_BasicDeploy:_Init:_cannot_copy_VirtFiles.Prog.db_into_Data_repository
call fcn.004235f2
call fcn.0042d153
pop ecx
jmp 0x42e49e
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtReg.dat
call fcn.004235f2
lea eax, [ebp - 0x30]
push 1
push eax
call fcn.0047c9b0
add esp, 0x18
push ebx
push ebx
push ebx
push ecx
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtReg.Transitory.dat
call fcn.004235f2
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.0047c9b0
add esp, 0x14
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d24
call fcn.0046bf20
pop ecx
cmp eax, ebx
je 0x42e6f6
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_pre_delete
call fcn.004235f2
call fcn.0042d153
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d24
call fcn.0042d963
pop ecx
cmp eax, ebx
je 0x42e6f6
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Loader_BasicDeploy:_transitory_reg_dat_file_exists._Trying_to_rename_it_back_to_normal:_attempting_rename
call fcn.004235f2
call fcn.0042d153
pop ecx
push dword [ebp - 0x30]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x42e6c9
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push str.Loader_BasicDeploy:_renamed_back_to_normal.
push eax
call fcn.00468c80
pop ecx
pop ecx
call fcn.0042d153
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d24
call fcn.0042d963
pop ecx
jmp 0x42e6f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push str.Loader_BasicDeploy:_cannot_rename_back_to_normal._Continuing_to_use_transitory_reg_dat_file__LE_d_
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0042d153
pop ecx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
call fcn.00423d45
cmp dword [ebp - 0x44], ebx
jne 0x42e704
cmp byte [ebp - 0xd], bl
je 0x42e88f
push ecx
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtReg.Prog.dat
call fcn.004235f2
push edi
call fcn.0047ccf0
add esp, 0xc
call fcn.0046bf20
pop ecx
cmp eax, ebx
je 0x42e88f
push dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
xor edi, edi
call fcn.00423c4f
test eax, eax
je 0x42e79c
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d24
call fcn.0042d963
pop ecx
cmp eax, ebx
jne 0x42e79c
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push str.Loader_BasicDeploy:_Init_Update:_target_CHANGES_VirtReg.dat_is_held__probably_by_running_app_instance_._Attempting_transitory_mode:_VirtReg.Transitory.dat
push eax
call fcn.00468c80
pop ecx
pop ecx
call fcn.0042d153
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d24
call fcn.0042d963
pop ecx
cmp eax, ebx
je 0x42e866
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
call fcn.00423d45
push ebx
push dword [ebp - 0x30]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VirtReg.Prog.dat
call fcn.004235f2
lea eax, [ebp - 0x20]
push eax
call fcn.0047ccf0
add esp, 0xc
push dword [eax]
mov dword [ebp - 0x54], 1
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 0xd], 1
test eax, eax
je 0x42e7d7
mov byte [ebp - 0xd], bl
test byte [ebp - 0x54], 1
je 0x42e7e8
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0xd], bl
je 0x42e80d
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x30]
push str.Loader_BasicDeploy:_Init_Update:_cannot_copy_VirtReg.Prog.dat_into_Data_repository:__s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0042d153
xor edi, edi
pop ecx
inc edi
cmp edi, ebx
je 0x42e88f
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.Loader_BasicDeploy:_deleting_EngineStamps_to_force_redeploy__bPatching__on_next_run
call fcn.004235f2
call fcn.0042d153
mov dword [ebp + 0x10], esp
mov esi, esp
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push str.EngineStamps
call fcn.004235f2
push esi
call fcn.0047ccf0
add esp, 0xc
call fcn.0046b600
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
jmp 0x42e49e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push str._Loader_BasicDeploy:_transitory_file_unavailable__Rolling_back_and_failing._LE_d
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0042d153
xor edi, edi
pop ecx
inc edi
jmp 0x42e7d4
cmp dword [ebp - 0x14], ebx
jne 0x42e8d6
cmp dword [ebp + 0x18], ebx
jne 0x42e8d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], ebx
jne 0x42eb61
push ecx
mov dword [ebp - 0x18], esp
mov edi, esp
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.004235f2
push edi
call fcn.0047ccf0
add esp, 0xc
call fcn.0046bf20
pop ecx
cmp eax, ebx
jne 0x42eb61
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [ecx + 0x58]
push str.Loader_BasicDeploy:_DEPLOYING_ZIPs_virtual_files_to:__s
push eax
call fcn.00468c80
add esp, 0xc
call fcn.0042d153
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
call edi
call fcn.004758d0
call edi
push 1
push str._System_mscoree.dll
call fcn.004760f0
pop ecx
pop ecx
cmp eax, ebx
je 0x42e94f
push eax
call fcn.004b00c5
pop ecx
call fcn.00467d90
test eax, eax
jne 0x42e94f
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x13
jmp 0x42e2cb
call fcn.004a1286
push eax
lea ecx, [ebp - 0x44]
call fcn.0042149e
lea eax, [ebp - 0x44]
push eax
push ecx
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.004235f2
mov edi, dword [ebp + 0xc]
push 7
call fcn.00482e60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [0x511ea4]
mov dword [0x5125f0], eax
xor eax, eax
mov dword [ebp - 0x140], ebx
lea edi, [ebp - 0x13c]
lea esi, [ebp - 0x138]
mov dword [0x511ea4], ebx
stosd dword es:[edi], eax
call fcn.0042cc9f
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004a1286
push eax
lea ecx, [ebp - 0x60]
call fcn.0042149e
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x16
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x140], ebx
push edi
mov ebx, esi
mov dword [ebp - 0x13c], eax
call fcn.0042ed26
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x60]
call fcn.00423d45
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x140]
push eax
push 0x42f0a0
push 0
push dword [0x511a14]
mov esi, 0x511a0c
push esi
call fcn.0048a4f0
mov ebx, dword [ebp - 0x140]
test ebx, ebx
je 0x42ea72
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x138]
call fcn.0042ebc2
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov esi, ebx
jmp 0x42e0bf
push dword [0x511a0c]
mov eax, esi
call fcn.0048a670
xor esi, esi
cmp dword [edi + 0x9c], esi
jne 0x42eab7
push 0x4e4392
push ecx
mov dword [ebp - 0x18], esp
mov ebx, esp
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.EngineStampsDiskModeDeploy.marker
call fcn.004235f2
push ebx
call fcn.0047ccf0
add esp, 0xc
mov edi, esi
call fcn.00469940
pop ecx
pop ecx
mov eax, dword [0x5125f0]
push 0x4e0608
push ecx
mov dword [ebp - 0x18], esp
mov ebx, esp
xor edi, edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov esi, str.ZipCache
push esi
mov dword [0x511ea4], eax
call fcn.004235f2
push ebx
call fcn.0047ccf0
add esp, 0xc
call fcn.00469940
pop ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423d24
push ecx
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.004235f2
mov byte [ebp - 4], 0x16
call fcn.00428893
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push str.Loader_BasicDeploy:_Files_deployment_took__dms
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0042d153
pop ecx
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
call fcn.0042101a
lea esi, [ebp - 0x138]
call fcn.0042ebc2
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x58]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
push str.Loader_BasicDeploy:_out___dms_
push ecx
call fcn.00468c80
add esp, 0xc
call fcn.0042d153
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
call fcn.004b581a
ret