Function at 0x1001f090
Capabilities:
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100657db
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x3bc]
push eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c0], 0
call fcn.1000b5f0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x14c], xmm0
mov byte [ebp - 0x134], 0
movq qword [ebp - 0x13c], xmm0
mov byte [ebp - 4], 1
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov word [ebp - 0x130], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
mov byte [ebp - 4], 2
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0xfc], 7
push eax
movups xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0x3d4], 0x407
call fcn.10002c50
mov ecx, dword [ebp - 0x3d4]
mov edx, eax
mov dword [ebp - 0xfc], ecx
xor eax, eax
mov dword [ebp - 0x110], edx
mov ecx, 0x200
mov dword [ebp - 0x100], 0x401
mov edi, edx
rep stosd dword es:[edi], eax
add esp, 8
stosw word es:[edi], ax
xor eax, eax
mov word [edx + 0x802], ax
mov byte [ebp - 4], 3
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], al
mov byte [ebp - 4], 4
xorps xmm0, xmm0
push 0xf
push 0x10096900
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x16c], eax
movups xmmword [ebp - 0x17c], xmm0
mov dword [ebp - 0x168], eax
call fcn.10002cb0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x17c]
mov edx, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x2fc]
push eax
call fcn.1000bf20
add esp, 4
mov byte [ebp - 4], 6
cmp byte [ebp - 0x130], 0
jne 0x1001f34f
lea ecx, [ebp - 0x12c]
mov byte [ebp - 0x12f], 1
cmp ecx, eax
je 0x1001f251
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x1001f244
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10006eb0
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001c600
mov byte [ebp - 4], 7
cmp byte [ebp - 0x12f], 0
je 0x1001f2b8
cmp dword [ebp - 0xc4], 7
lea eax, [ebp - 0xd8]
push 0
cmova eax, dword [ebp - 0xd8]
push 0x1388
push 0x400
push 0x400
push 0xff
push 6
push 3
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp byte [ebp - 0x12f], 0
mov dword [ebp - 0x114], eax
jne 0x1001f801
cmp dword [ebp - 0xc4], 7
lea eax, [ebp - 0xd8]
push 0
cmova eax, dword [ebp - 0xd8]
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
jne 0x1001f801
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xc4]
cmp eax, 7
jbe 0x1001f332
mov ecx, dword [ebp - 0xd8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x1001f327
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x1001f332
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2fc]
call fcn.10005610
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x17c]
call fcn.10005610
xorps xmm0, xmm0
mov dword [ebp - 0xb0], 0
xor eax, eax
mov dword [ebp - 0xac], 0
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov byte [ebp - 4], 8
movups xmmword [ebp - 0xa8], xmm0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x404], eax
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x400], eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x3fc], eax
nop word [eax + eax]
call fcn.1001cdb0
cmp byte [eax + 0x1c], 0
je 0x1001f530
call fcn.1001cdb0
mov dword [ebp - 0x3c4], eax
call fcn.1000a250
mov edi, eax
test edi, edi
je 0x10021165
mov edx, dword [edi]
mov esi, dword [edx + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3d4]
push 0x15
push str.WAITING_HANDLE_ACCESS
call fcn.10011800
call fcn.1000a250
mov edi, eax
test edi, edi
je 0x10021165
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x3f0]
push 0
push 0x10093cf4
call fcn.10011800
mov esi, dword [ebp - 0x3c4]
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1001f4d4
push str.AiEmbeddedDirectCall
push eax
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
cmp eax, 1
je 0x1001f4d4
lea eax, [ebp - 0x3d4]
mov ecx, esi
push eax
call fcn.1001cfd0
mov byte [ebp - 4], 0xc
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3f0]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f502
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
mov byte [ebp - 4], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3d4]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f530
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
mov byte [ebp - 0x3c9], al
call fcn.1001cdb0
cmp byte [eax + 0x1c], 0
je 0x1001f6a3
call fcn.1001cdb0
mov dword [ebp - 0x3c4], eax
call fcn.1000a250
mov edi, eax
test edi, edi
je 0x10021165
mov edx, dword [edi]
mov esi, dword [edx + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3d8], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x3d8]
push 0x16
push str.RECEIVE_HANDLE_ACCESS
call fcn.10011800
cmp dword [ebp - 0xac], 7
lea edx, [ebp - 0xc0]
jbe 0x1001f5ba
mov edx, dword [ebp - 0xc0]
test edx, edx
je 0x1001f5dc
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f5c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3d8]
call fcn.10011800
call fcn.1000a250
mov edi, eax
test edi, edi
je 0x10021165
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x3ec]
push 0
push 0x10093cf4
call fcn.10011800
mov esi, dword [ebp - 0x3c4]
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1001f647
push str.AiEmbeddedDirectCall
push eax
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
cmp eax, 1
je 0x1001f647
lea eax, [ebp - 0x3d8]
mov ecx, esi
push eax
call fcn.1001cfd0
mov byte [ebp - 4], 0x16
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3ec]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f675
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
mov byte [ebp - 4], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3d8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f6a3
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
cmp dword [ebp - 0x94], 7
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x98], 0
cmova eax, dword [ebp - 0xa8]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0xac]
cmp ecx, 7
mov edx, dword [ebp - 0xb0]
cmova eax, dword [ebp - 0xc0]
cmp edx, 7
jne 0x1001f8bc
mov edi, edx
mov esi, str.Resolve
test edi, edi
je 0x1001f71e
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001f8b6
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001f700
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
cmp dword [ebp - 0xac], 7
lea edi, [ebp - 0xc0]
mov ecx, dword [ebp - 0xb0]
cmova edi, dword [ebp - 0xc0]
test ecx, ecx
je 0x1001f84b
xor esi, esi
mov edx, edi
test ecx, ecx
je 0x1001f781
cmp word [edi], 0x5b
je 0x1001f77f
nop dword [eax + eax]
cmp ecx, 1
je 0x1001f781
add edx, 2
dec ecx
cmp word [edx], 0x5b
jne 0x1001f770
mov esi, edx
test esi, esi
je 0x1001f84b
sub esi, edi
sar esi, 1
cmp esi, 0xffffffff
je 0x1001f84b
mov edx, dword [ebp - 0x3c8]
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x35c]
call fcn.1000bc30
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x1001f7f2
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x35c]
jmp 0x10020f62
mov byte [ebp - 0x130], 1
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xc4]
cmp eax, 7
jbe 0x1001f332
mov ecx, dword [ebp - 0xd8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x1001f327
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
jmp 0x1001f327
mov edx, dword [ebp - 0x3c8]
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x314]
call fcn.1000bf20
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x1001f8a7
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x314]
jmp 0x10020f62
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
lea eax, [ebp - 0xc0]
cmp ecx, 7
cmova eax, esi
cmp edx, 4
jne 0x1001fa3c
mov edi, edx
mov esi, str.Eval
test edi, edi
je 0x1001f90e
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop word [eax + eax]
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fa30
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001f8f0
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
cmp dword [ebp - 0xac], 7
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x1fc], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1f8], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x20c], xmm0
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f990
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x20c]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 1
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x20c]
xor eax, eax
and esi, 0xfffffffe
mov word [ebp - 0x20c], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1fc]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 9
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f8], 7
mov word [ebp - 0x20c], ax
jmp 0x10020f67
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0xf
jne 0x1001fa9c
mov edi, edx
mov esi, str.GetFeatureState
test edi, edi
je 0x1001fa7a
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fa90
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001fa60
push dword [sym.imp.msi.dll_MsiGetFeatureValidStatesW]
lea ecx, [ebp - 0x408]
call fcn.10021170
jmp 0x10020f67
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0x15
jne 0x1001fd15
mov edi, edx
mov esi, str.GetFeatureValidStates
test edi, edi
je 0x1001fae2
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fd09
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001fac4
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
cmp dword [ebp - 0xac], 7
lea ecx, [ebp - 0x3f8]
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
push ecx
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiGetProductCodeW]
mov ecx, dword [ebp - 0x3f8]
mov esi, eax
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push ecx
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1e0], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1f4], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fb70
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1f4]
call fcn.10002cb0
mov edi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or edi, 8
mov dword [ebp - 0x3c0], edi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1f4]
xor eax, eax
and edi, 0xfffffff7
mov word [ebp - 0x1f4], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1e4]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 7
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa8]
push 0x100968fc
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], 7
mov word [ebp - 0x1f4], ax
call fcn.10006e30
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push esi
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x274], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x270], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x284], xmm0
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fc60
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x284]
call fcn.10002cb0
lea eax, [ebp - 0x284]
or edi, 4
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064e0
and edi, 0xfffffffb
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x270]
cmp eax, 7
jbe 0x1001fce7
mov ecx, dword [ebp - 0x284]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x1001fcdc
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x1001fce7
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
jmp 0x10020f67
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0x11
jne 0x1001fd7c
mov edi, edx
mov esi, str.GetComponentState
test edi, edi
je 0x1001fd5a
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop dword [eax]
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fd70
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001fd40
push dword [sym.imp.msi.dll_MsiGetFeatureInfoA]
lea ecx, [ebp - 0x408]
call fcn.10021170
jmp 0x10020f67
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0xb
jne 0x1001ff48
mov edi, edx
mov esi, str.DoMsiAction
test edi, edi
je 0x1001fdc2
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001ff3c
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001fda4
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
push 0x10093d00
push str.AiEmbeddedDirectCall
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x3c8]
mov edi, dword [ebp - 0x3c0]
or edi, 0x20
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x3c0], edi
and edi, 0xffffffdf
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 4], 0x23
sub esp, 0x18
or edi, 0x10
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x3c0], edi
mov ecx, esp
mov esi, dword [ebp - 0x3c8]
mov dword [ebp - 0x418], esp
push eax
call fcn.100057f0
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x23
mov ecx, esi
call fcn.1001e890
add esp, 0x18
lea ecx, [ebp - 0xa8]
push 1
push 0x10096a20
call fcn.10006eb0
cmp dword [ebp - 0x94], 7
lea edx, [ebp - 0xa8]
xorps xmm0, xmm0
mov dword [ebp - 0x2a4], 0
cmova edx, dword [ebp - 0xa8]
mov ecx, edx
mov dword [ebp - 0x2a0], 0
movups xmmword [ebp - 0x2b4], xmm0
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001feb0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2b4]
call fcn.10002cb0
mov byte [ebp - 4], 0x26
lea edx, [ebp - 0x3dc]
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x2a0], 7
push 0
push edx
lea ecx, [eax + eax]
lea eax, [ebp - 0x2b4]
cmova eax, dword [ebp - 0x2b4]
push ecx
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2b4]
call fcn.10005610
and edi, 0xffffffef
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x410]
call fcn.100225e0
jmp 0x10020f67
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0xb
jne 0x1001ff9a
mov edi, edx
mov esi, 0x10096a24
test edi, edi
je 0x1001ff90
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop dword [eax]
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001ff94
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001ff70
mov ecx, dword [ebp - 0xac]
mov al, 1
jmp 0x1001ff9c
mov ecx, dword [ebp - 0xac]
xor al, al
test al, al
je 0x1002013c
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
lea ecx, [ebp - 0x14c]
call fcn.1001c510
xorps xmm0, xmm0
mov dword [ebp - 0x214], 0
xor eax, eax
mov dword [ebp - 0x210], 0
movups xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 7
mov word [ebp - 0x224], ax
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
cmp dword [ebp - 0x210], 7
lea ecx, [ebp - 0x224]
lea eax, [ebp - 0xc0]
cmova ecx, dword [ebp - 0x224]
cmp dword [ebp - 0xac], 7
push ecx
cmova eax, dword [ebp - 0xc0]
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1c8], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1dc], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020092
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1dc]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 0x40
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1dc]
xor eax, eax
and esi, 0xffffffbf
mov word [ebp - 0x1dc], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1cc]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], 7
mov word [ebp - 0x1dc], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x224]
jmp 0x10020f62
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
cmp edx, 0xd
jne 0x1002018e
mov edi, edx
mov esi, str.SetTargetPath
test edi, edi
je 0x10020184
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x10020188
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x10020164
mov ecx, dword [ebp - 0xac]
mov al, 1
jmp 0x10020190
mov ecx, dword [ebp - 0xac]
xor al, al
test al, al
je 0x10020610
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
lea ecx, [ebp - 0x14c]
call fcn.1001c510
xorps xmm0, xmm0
mov dword [ebp - 0x184], 0
xor eax, eax
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x194], xmm0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 7
mov word [ebp - 0x194], ax
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
mov edi, dword [ebp - 0x184]
test edi, edi
je 0x10020520
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x2bc], 0
push str.AiDelayedActions
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0x2b8], 0
movups xmmword [ebp - 0x2cc], xmm0
call fcn.10002cb0
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x2cc]
mov edx, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x32c]
push eax
call fcn.1000bf20
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x100202af
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x32c]
call fcn.10005610
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x2cc]
call fcn.10005610
push str._SetTargetPath_
lea ecx, [ebp - 0xa8]
call fcn.10006e30
cmp dword [ebp - 0xac], 7
lea ecx, [ebp - 0xc0]
mov esi, dword [ebp - 0x98]
cmova ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0xb0]
sub eax, esi
mov dword [ebp - 0x3d0], edx
mov dword [ebp - 0x3f4], ecx
mov dword [ebp - 0x3c4], esi
cmp edx, eax
ja 0x10020368
cmp dword [ebp - 0x94], 7
lea eax, [edx + esi]
mov dword [ebp - 0x98], eax
lea esi, [ebp - 0xa8]
cmova esi, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x3c4]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x3f4]
push ecx
call fcn.1004f320
mov eax, dword [ebp - 0x3d0]
add esp, 0xc
add eax, dword [ebp - 0x3c4]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x1002037c
push edx
push ecx
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xa8]
push edx
call fcn.10006600
push 0x100968fc
lea ecx, [ebp - 0xa8]
call fcn.10006e30
cmp dword [ebp - 0x180], 7
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x98]
cmova edx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x94]
sub eax, ecx
mov dword [ebp - 0x3d0], ecx
cmp edi, eax
ja 0x100203f6
cmp dword [ebp - 0x94], 7
lea eax, [edi + ecx]
lea esi, [ebp - 0xa8]
mov dword [ebp - 0x98], eax
cmova esi, dword [ebp - 0xa8]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.1004f320
mov eax, dword [ebp - 0x3d0]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x1002040a
push edi
push edx
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xa8]
push edi
call fcn.10006600
cmp dword [ebp - 0x94], 7
lea eax, [ebp - 0xa8]
cmova eax, dword [ebp - 0xa8]
push eax
push str.AiDelayedActions
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1b0], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1c4], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020470
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 0x80
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1c4]
xor eax, eax
and esi, 0xffffff7f
mov word [ebp - 0x1c4], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1b4]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], 7
mov word [ebp - 0x1c4], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x194]
jmp 0x10020f62
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push 0xd
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x19c], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x198], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1ac], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020560
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1ac]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 0x100
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1ac]
xor eax, eax
and esi, 0xfffffeff
mov word [ebp - 0x1ac], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x19c]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], 7
mov word [ebp - 0x1ac], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x194]
jmp 0x10020f62
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
cmp edx, 0xc
jne 0x1002066a
mov edi, edx
mov esi, str.EnumCompCost
test edi, edi
je 0x10020660
sub eax, esi
mov dword [ebp - 0x3d0], eax
nop dword [eax + eax]
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x10020664
mov eax, dword [ebp - 0x3d0]
add esi, 2
sub edi, 1
jne 0x10020640
mov ecx, dword [ebp - 0xac]
mov al, 1
jmp 0x1002066c
mov ecx, dword [ebp - 0xac]
xor al, al
test al, al
je 0x10020cf9
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
lea ecx, [ebp - 0x14c]
call fcn.1001c510
xorps xmm0, xmm0
mov dword [ebp - 0xc8], 0
xor eax, eax
mov dword [ebp - 0xc4], 0
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
lea ecx, [ebp - 0x14c]
call fcn.1001c510
cmp dword [ebp - 0xc4], 7
lea eax, [ebp - 0xd8]
cmova eax, dword [ebp - 0xd8]
push eax
call fcn.100553a1
mov edi, eax
mov dword [ebp - 0x154], 0
xorps xmm0, xmm0
mov dword [ebp - 0x150], 0
xor eax, eax
mov dword [ebp - 0x154], 0
movups xmmword [ebp - 0x164], xmm0
add esp, 4
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
cmp dword [ebp - 0x150], 7
lea eax, [ebp - 0x164]
cmova eax, dword [ebp - 0x164]
push eax
call fcn.100553a1
mov esi, eax
mov dword [ebp - 0xe0], 0
xorps xmm0, xmm0
mov dword [ebp - 0xdc], 0
xor eax, eax
mov dword [ebp - 0x3e4], 0
movups xmmword [ebp - 0xf0], xmm0
add esp, 4
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 7
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xf0]
push eax
mov eax, 0x64
mov dword [ebp - 0x3e8], 0x64
sub eax, dword [ebp - 0xe0]
push eax
call fcn.100070d0
cmp dword [ebp - 0xdc], 7
lea ecx, [ebp - 0xf0]
lea edx, [ebp - 0x3e0]
cmova ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xc0]
cmp dword [ebp - 0xac], 7
push edx
cmova eax, dword [ebp - 0xc0]
lea edx, [ebp - 0x3e4]
push edx
lea edx, [ebp - 0x3e8]
push edx
push ecx
push esi
push edi
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiProvideAssemblyA]
mov edx, dword [ebp - 0x3e8]
mov esi, eax
mov ecx, dword [ebp - 0xe0]
cmp edx, ecx
ja 0x1002087d
cmp dword [ebp - 0xdc], 7
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xe0], edx
cmova ecx, dword [ebp - 0xf0]
xor eax, eax
mov word [ecx + edx*2], ax
jmp 0x1002088d
sub edx, ecx
lea ecx, [ebp - 0xf0]
push 0
push edx
call fcn.100070d0
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.100057f0
mov edi, dword [ebp - 0x3c0]
lea eax, [ebp - 0x2fc]
or edi, 0x200
lea ecx, [ebp - 0xa8]
push eax
mov dword [ebp - 0x3c0], edi
call fcn.100064e0
and edi, 0xfffffdff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x2fc]
call fcn.10005610
push 0x100968fc
lea ecx, [ebp - 0xa8]
call fcn.10006e30
mov eax, dword [ebp - 0x3e4]
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x258], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x26c], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020937
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.10002cb0
lea eax, [ebp - 0x26c]
or edi, 0x400
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064e0
and edi, 0xfffffbff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x258]
cmp eax, 7
jbe 0x100209c4
mov ecx, dword [ebp - 0x26c]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x100209b9
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x100209c4
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x25c], 0
push 0x100968fc
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], ax
call fcn.10006e30
mov eax, dword [ebp - 0x3e0]
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x240], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x254], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020a36
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.10002cb0
lea eax, [ebp - 0x254]
or edi, 0x800
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064e0
and edi, 0xfffff7ff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x240]
cmp eax, 7
jbe 0x10020ac3
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020ab8
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x10020ac3
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x244], 0
push 0x100968fc
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
call fcn.10006e30
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push esi
call fcn.100546de
xorps xmm0, xmm0
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x228], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x23c], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020b30
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.10002cb0
lea eax, [ebp - 0x23c]
or edi, 0x1000
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064e0
and edi, 0xffffefff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x228]
cmp eax, 7
jbe 0x10020bbd
mov ecx, dword [ebp - 0x23c]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020bb2
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x10020bbd
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0xdc]
cmp eax, 7
jbe 0x10020c1b
mov ecx, dword [ebp - 0xf0]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020c10
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x10020c1b
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 7
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x150]
cmp eax, 7
jbe 0x10020c79
mov ecx, dword [ebp - 0x164]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020c6e
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x10020c79
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xc4]
cmp eax, 7
jbe 0x10020cd7
mov ecx, dword [ebp - 0xd8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020ccc
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1002115b
test ecx, ecx
je 0x10020cd7
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
jmp 0x10020f67
test edx, edx
je 0x10020f67
cmp ecx, 7
lea edi, [ebp - 0xc0]
cmova edi, dword [ebp - 0xc0]
cmp edx, 0xf
jne 0x10020d39
mov esi, str.SetFeatureState
test edx, edx
je 0x10020d35
sub edi, esi
movzx ecx, word [edi + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x10020d39
add esi, 2
sub edx, 1
jne 0x10020d21
mov al, 1
jmp 0x10020d3b
xor al, al
test al, al
je 0x10020f67
lea ecx, [ebp - 0x14c]
call fcn.1001c510
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
lea ecx, [ebp - 0x14c]
call fcn.1001c510
xorps xmm0, xmm0
mov dword [ebp - 0x28c], 0
xor eax, eax
mov dword [ebp - 0x288], 0
movups xmmword [ebp - 0x29c], xmm0
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be70
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], 0
push str.AiDelayedActions
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
call fcn.10002cb0
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x2e4]
mov edx, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x344]
push eax
call fcn.1000bf20
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x10020e4c
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x344]
call fcn.10005610
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2e4]
call fcn.10005610
push str._SetFeatureState_
lea ecx, [ebp - 0xa8]
call fcn.10006e30
cmp dword [ebp - 0xac], 7
lea edx, [ebp - 0xc0]
mov ecx, dword [ebp - 0x98]
cmova edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x94]
mov edi, dword [ebp - 0xb0]
sub eax, ecx
mov dword [ebp - 0x3d0], ecx
cmp edi, eax
ja 0x10020eea
cmp dword [ebp - 0x94], 7
lea eax, [ecx + edi]
lea esi, [ebp - 0xa8]
mov dword [ebp - 0x98], eax
cmova esi, dword [ebp - 0xa8]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.1004f320
mov eax, dword [ebp - 0x3d0]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x10020efe
push edi
push edx
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xa8]
push edi
call fcn.10006600
push 0x100968fc
lea ecx, [ebp - 0xa8]
call fcn.10006e30
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.100064e0
cmp dword [ebp - 0x94], 7
lea eax, [ebp - 0xa8]
cmova eax, dword [ebp - 0xa8]
push eax
push str.AiDelayedActions
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
push 1
push 0x10096a20
lea ecx, [ebp - 0xa8]
call fcn.10006eb0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x29c]
call fcn.10005610
cmp dword [ebp - 0x94], 7
lea edx, [ebp - 0xa8]
xorps xmm0, xmm0
mov dword [ebp - 0x16c], 0
cmova edx, dword [ebp - 0xa8]
mov ecx, edx
mov dword [ebp - 0x168], 0
movups xmmword [ebp - 0x17c], xmm0
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020fa0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x17c]
call fcn.10002cb0
mov byte [ebp - 4], 0x38
lea edx, [ebp - 0x414]
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x168], 7
push 0
push edx
lea ecx, [eax + eax]
lea eax, [ebp - 0x17c]
cmova eax, dword [ebp - 0x17c]
push ecx
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17c]
call fcn.10005610
cmp byte [ebp - 0x3c9], 0
je 0x1001f410
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x94]
cmp eax, 7
jbe 0x1002105d
mov ecx, dword [ebp - 0xa8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10021052
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x10021160
test ecx, ecx
je 0x1002105d
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xac]
cmp eax, 7
jbe 0x100210bb
mov ecx, dword [ebp - 0xc0]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x100210b0
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x10021160
test ecx, ecx
je 0x100210bb
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x14c]
call fcn.1001c690
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x110]
call fcn.10005610
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x12c]
call fcn.10005610
mov byte [ebp - 4], 0
mov al, byte [ebp - 0x134]
test al, al
je 0x10021120
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor al, al
lea ecx, [ebp - 0x134]
xchg byte [ecx], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3bc]
call fcn.1000b940
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d46a
mov esp, ebp
pop ebp
ret 4
call fcn.10050fef
call fcn.10050fef
push 0x80004005
call fcn.10005390
int3