Function at 0x409370
Capabilities:
Create pipe
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x40e03c]
push ebx
push esi
mov esi, dword [0x40e00c]
mov ecx, eax
mov edx, dword [0x40e008]
or ecx, esi
mov esi, dword [0x40e004]
xor esi, ecx
push edi
mov edi, dword [0x40e030]
mov dword [ebp - 0x20], 0x96
lea ecx, [esi - 0x2d0]
mov ebx, edi
or ecx, 0x24b
mov dword [ebp - 0x38], 0x85
and edx, ecx
mov ecx, dword [0x40e034]
shl ebx, cl
mov ecx, dword [0x40e00c]
xor edx, 0x282
or edx, 0x50
sub ecx, ebx
mov ebx, 0x35a
sub ebx, eax
mov eax, dword [0x40e018]
or ebx, 0x234
mov dword [0x40e00c], ecx
imul eax, ebx
mov ecx, dword [0x40e028]
add eax, 0x15a
and ecx, eax
mov dword [0x40e01c], ebx
mov dword [0x40e028], ecx
mov ecx, dword [0x40e034]
mov eax, ecx
shr eax, 0x14
sub esi, eax
mov eax, ecx
shl eax, 4
add eax, ecx
mov dword [0x40e004], esi
lea ecx, [eax + eax*2]
mov eax, 0xd5
shl ecx, 3
sub ecx, esi
mov esi, dword [0x40e024]
add esi, ecx
mov ecx, esi
shl eax, cl
mov ecx, dword [0x40e014]
sar eax, 0xcc
add ecx, eax
mov eax, edi
and eax, 0x2d
mov dword [0x40e014], ecx
mov dword [0x40e034], eax
mov eax, dword [0x40e040]
and eax, edx
mov edx, 0xffffff7f
sar edx, cl
mov ecx, dword [0x40e02c]
mov dword [0x40e040], eax
mov eax, dword [0x40e020]
add ecx, edx
mov edx, 0x150
mov dword [0x40e02c], ecx
mov ecx, dword [0x40e03c]
sar edx, cl
mov ecx, dword [0x40e014]
and eax, ecx
mov ecx, dword [0x40e034]
and eax, ecx
and edx, edi
add edx, 0xf51e0
mov ecx, edx
xor edx, edx
div ecx
mov dword [0x40e020], eax
mov eax, dword [0x40e02c]
mov edx, dword [0x40e040]
mov dword [ebp - 0x18], 0x69961a8
mov dword [ebp - 4], 0x1a3
mov dword [ebp - 8], 0x280
lea ecx, [eax + edx]
mov dword [ebp - 0x40], 0x255
and ecx, ebx
mov ebx, dword [0x40e014]
mov dword [0x40e008], ecx
lea ecx, [esi + esi*8]
shl ecx, 4
sub ecx, esi
mov edx, ebx
shr edx, cl
mov ecx, dword [0x40e004]
mov dword [ebp - 0x48], 0x70
add edx, ecx
mov ecx, dword [0x40e03c]
imul edx, eax
or esi, edx
mov edx, dword [0x40e00c]
imul edi, edx
mov eax, ebx
add ecx, edi
or eax, 0x106
mov dword [0x40e03c], ecx
mov ecx, ebx
mov dword [0x40e004], eax
sar eax, cl
mov dword [0x40e024], esi
add edx, eax
mov eax, 0x44
mov ecx, edx
mov dword [0x40e00c], edx
mov edx, dword [0x40e040]
shl eax, cl
xor edx, eax
lea eax, [esi + esi*2]
shl eax, 5
add eax, esi
mov dword [0x40e040], edx
mov edx, 0x31c
lea ecx, [eax + eax*4]
mov eax, dword [0x40e010]
shl ecx, 1
sar edx, cl
or eax, edx
mov dword [0x40e010], eax
call fcn.0040abb0
xor esi, esi
mov dword [ebp - 0x30], 0xed
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x44], 0x65ed1
mov dword [ebp - 0x3c], 0x8af0
mov dword [ebp - 0x14], 0x282
push dword [ebp - 4]
push 0x523
push dword [ebp - 8]
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov dword [ebp - 0xc], 0xfffab36a
push dword [ebp - 0x3c]
push dword [ebp - 0x2c]
push dword [ebp - 0x38]
push dword [ebp - 0xc]
call dword [sym.imp.RPCRT4.dll_I_RpcSendReceive]
mov dword [ebp - 0x50], 0x5fc
mov dword [ebp - 0x34], 0x699edff
push dword [ebp - 0x14]
push 0xbbf
push 0xdd4
push 0x8c6
call dword [sym.imp.RPCRT4.dll_NdrUserMarshalUnmarshall]
mov dword [ebp - 8], 0xb86
mov dword [ebp - 0x24], 0xffffff21
push dword [ebp - 0x14]
push dword [ebp - 0x3c]
push dword [ebp - 8]
push dword [ebp - 0x24]
call dword [sub.NDdeApi.dll_Ordinal_601]
push 0xdcd
push dword [ebp - 0x48]
push 0x4b0
call dword [sym.imp.RPCRT4.dll_UuidIsNil]
mov dword [ebp - 8], 0xa82
mov dword [ebp - 0x2c], 0x3f9
push dword [ebp - 0x14]
push 0x9ff
push dword [ebp - 0x34]
push dword [ebp - 0x50]
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
push 0xceb
push 0x813
push dword [ebp - 0x18]
push dword [ebp - 0x40]
call dword [sym.imp.RPCRT4.dll_NdrNonEncapsulatedUnionUnmarshall]
mov dword [ebp - 0x28], 0xffffffbf
mov dword [ebp - 0x10], esi
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
call dword [sub.NDdeApi.dll_Ordinal_605]
mov dword [ebp - 0x4c], esi
push 0x7ad
push dword [ebp - 0x50]
push dword [ebp - 0x28]
call dword [sym.imp.RPCRT4.dll_I_RpcBindingCopy]
push dword [ebp - 0x4c]
push 0x74f
call dword [sub.Msi.dll_MsiGetFeatureCostW]
push 0x946
push 0x512
push dword [ebp - 4]
call dword [sym.imp.RPCRT4.dll_RpcSmSetThreadHandle]
push 0xb26
push dword [ebp - 0x44]
push 0xdc4
push dword [ebp - 0x40]
call dword [sym.imp.RPCRT4.dll_NdrInterfacePointerMarshall]
mov dword [ebp - 0x50], 0x30fb
push 0x765
push dword [ebp - 0x24]
call dword [sym.imp.RPCRT4.dll_NdrPointerMemorySize]
push 0xd3c
push 0xcc7
push 0x885
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xae0
push 0xcc6
push dword [ebp - 0x2c]
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [ebp - 0x3c], 0x44
push 0xc4e
push dword [ebp - 0x20]
push 0xc39
push 0x569
call dword [sym.imp.RPCRT4.dll_NdrServerMarshall]
push 0x903
push 0xdf2
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [ebp - 0x18], 0x11d
push dword [ebp - 0x18]
push 0xf2f
push dword [ebp - 0x3c]
call dword [sym.imp.RPCRT4.dll_NDRSContextUnmarshall]
mov dword [ebp - 0x1c], 0x9ff7
push 0x404
push 0x90e
push dword [ebp - 0x50]
call dword [sym.imp.RPCRT4.dll_NdrVaryingArrayBufferSize]
mov dword [ebp - 0x48], esi
mov dword [ebp - 4], 0xabdf
push dword [ebp - 0x30]
push dword [ebp - 0x18]
call dword [sym.imp.RPCRT4.dll_I_RpcClearMutex]
mov edi, 0x106
mov dword [ebp - 0x54], edi
push dword [ebp - 0x30]
push dword [ebp - 0x18]
call dword [sym.imp.RPCRT4.dll_NdrServerInitialize]
push 0x6af
push dword [ebp - 8]
push dword [ebp - 0x48]
call dword [sym.imp.RPCRT4.dll_NdrServerCall2]
mov dword [ebp - 0x18], 0x1d
push 0x83e
push 0x7c2
push 0xf77
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_I_RpcGetBuffer]
push dword [ebp - 4]
push 0x4d0
push 0xf70
push 0x86f
call dword [sub.Msi.dll_MsiDatabaseApplyTransformW]
mov ebx, 0x3be
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x58], ebx
push dword [ebp - 8]
push dword [ebp - 0x1c]
call dword [sym.imp.RPCRT4.dll_NdrVaryingArrayFree]
mov dword [ebp - 0xc], esi
push dword [ebp - 0x20]
push 0x483
push 0x901
push dword [ebp - 0x54]
call dword [sym.imp.RPCRT4.dll_RpcBindingInqObject]
mov dword [ebp - 0x34], 0xabdf
push 0xec3
push 0xffa
call dword [sym.imp.ADVAPI32.dll_AddAce]
mov dword [ebp - 0x2c], 0x278
mov dword [ebp - 0x1c], 0xa3c2
push dword [ebp - 0x58]
push 0x47a
push dword [ebp - 0x1c]
call dword [sub.Msi.dll_MsiEvaluateConditionW]
push dword [ebp - 0x2c]
push 0xea8
push dword [ebp - 0x18]
call dword [sym.imp.RPCRT4.dll_I_RpcPauseExecution]
mov dword [ebp - 0x28], 0x4b13e
mov dword [ebp - 4], esi
push 0x524
push 0x929
call dword [sub.Msi.dll_MsiGetProductInfoW]
push 0xe88
push dword [ebp - 0xc]
push 0xa96
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x73b
push dword [ebp - 0x34]
push dword [ebp - 8]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoA]
push 0xf5f
push dword [ebp - 4]
call dword [sym.imp.RPCRT4.dll_I_RpcConnectionInqSockBuffSize]
mov dword [ebp - 0x30], 0x333
push dword [ebp - 0x48]
push 0x7c3
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0x40], esi
push dword [ebp - 0x30]
push 0xd59
call dword [sub.Msi.dll_MsiEnumClientsW]
push 0xc0c
push 0xb15
push 0xdcf
call dword [sym.imp.RPCRT4.dll_RpcSmGetThreadHandle]
mov dword [ebp - 0x3c], esi
push 0x44f
push 0xb34
push 0x8cb
push 0x5f0
call dword [sub.NDdeApi.dll_Ordinal_509]
mov dword [ebp - 8], esi
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.RPCRT4.dll_NdrByteCountPointerUnmarshall]
mov dword [ebp - 0x24], 0xa926
push 0xccd
push dword [ebp - 0x28]
call dword [sym.imp.RPCRT4.dll_RpcObjectSetInqFn]
mov dword [ebp - 0x14], 0x2337be
push 0x7fe
push 0xe9f
push dword [ebp - 0x30]
push dword [ebp - 0x3c]
call dword [sym.imp.RPCRT4.dll_NdrConformantVaryingArrayBufferSize]
mov dword [ebp - 0x28], 0x4af3e
push dword [ebp - 0x14]
push 0x668
push dword [ebp - 0x24]
call dword [sym.imp.RPCRT4.dll_RpcSmDestroyClientContext]
mov dword [ebp - 0x18], 0x33f
push 0xc80
push dword [ebp - 0x3c]
call dword [sym.imp.COMCTL32.dll_CreateToolbarEx]
push dword [ebp - 0x18]
push dword [ebp - 0x34]
push 0xdf3
push dword [ebp - 0x38]
call dword [sym.imp.RPCRT4.dll_tree_size_ndr]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0xc], edi
push 0x552
push 0xf21
push dword [ebp - 0x40]
push 0x85e
call dword [sub.NDdeApi.dll_Ordinal_611]
mov dword [ebp - 0x2c], 0x1ca
mov dword [ebp - 0x10], esi
push dword [ebp - 0x44]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
mov ebx, 0xfffffcc2
mov dword [ebp - 0x4c], ebx
push 0x7d3
push dword [ebp - 0x4c]
push 0x4c7
call dword [sub.RPCRT4.dll_MesDecodeBufferHandleCreate]
mov dword [ebp - 0x38], esi
push dword [ebp - 0x38]
push 0x769
push dword [ebp - 0xc]
call dword [sym.imp.RPCRT4.dll_NdrGetBuffer]
push dword [ebp - 0x54]
push 0x677
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
mov dword [ebp - 0x54], edi
push dword [ebp - 0x38]
push 0x940
call dword [sub.Msi.dll_MsiEnumComponentQualifiersA]
push dword [ebp - 0x54]
push dword [ebp - 0x3c]
call dword [sym.imp.RPCRT4.dll_RpcNetworkInqProtseqsW]
mov dword [ebp - 0x14], 0x2337be
push 0x888
push 0x684
push 0x9d0
call dword [sym.imp.RPCRT4.dll_NdrFullPointerQueryPointer]
push dword [ebp - 0x3c]
push 0xe73
push dword [ebp - 0xc]
call dword [sym.imp.RPCRT4.dll_I_RpcFreePipeBuffer]
mov dword [ebp - 0x1c], 0x1ca
push 0x55c
push dword [ebp - 0x4c]
push 0xdef
call dword [sub.Msi.dll_MsiGetSummaryInformationA]
mov dword [ebp - 0x48], 0x100
mov dword [ebp - 0x44], 0x3be
push 0x879
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 0xfeb
call dword [sym.imp.RPCRT4.dll_NdrConformantArrayMemorySize]
mov dword [ebp - 8], esi
push dword [ebp - 0x14]
push 0x470
push dword [ebp - 0x2c]
call dword [sym.imp.RPCRT4.dll_short_from_ndr]
mov dword [ebp - 0x20], esi
push dword [ebp - 0x14]
push dword [ebp - 0x28]
call dword [sub.NDdeApi.dll_Ordinal_513]
push 0x84f
push 0xeb8
push 0xca9
call dword [sym.imp.RPCRT4.dll_DceErrorInqTextA]
mov dword [ebp - 0x24], 0xfffffd48
mov dword [ebp - 0x40], 0x15b
push 0x715
push dword [ebp - 0x58]
push dword [ebp - 0x4c]
push 0x6da
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpExW]
mov edi, 0x4b33d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
push 0x66f
push dword [ebp - 0x40]
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call dword [sub.RPCRT4.dll_IUnknown_Release_Proxy]
push 0xf45
push 0xf4a
push 0x76d
call dword [sub.NDdeApi.dll_Ordinal_500]
mov dword [ebp - 0x4c], 0x109f
mov dword [ebp - 0x50], ebx
push dword [ebp - 0x4c]
push dword [ebp - 4]
push 0x5cf
call dword [sym.imp.RPCRT4.dll_NdrConformantArrayMarshall]
mov dword [ebp - 0x3c], esi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.RPCRT4.dll_NdrNonConformantStringUnmarshall]
push 0xeb7
push 0xb50
call dword [sym.imp.RPCRT4.dll_NdrConvert2]
mov dword [ebp - 0x28], edi
push dword [ebp - 0x48]
push 0xe51
push dword [ebp - 0x10]
push dword [ebp - 0x44]
call dword [sym.imp.RPCRT4.dll_NdrConformantVaryingArrayFree]
mov ebx, 0x6d3b6
mov dword [ebp - 0x34], ebx
push dword [ebp - 0x20]
push dword [ebp - 0x34]
push 0xd3c
push dword [ebp - 0x28]
call dword [sym.imp.RPCRT4.dll_NdrConformantStructMemorySize]
mov dword [ebp - 0x30], 0xfffffffd
push dword [ebp - 0x10]
push dword [ebp - 0x30]
call dword [sym.imp.RPCRT4.dll_NdrXmitOrRepAsFree]
mov dword [ebp - 0x10], 0x37c
push dword [ebp - 0x48]
push dword [ebp - 0x40]
call dword [sym.imp.RPCRT4.dll_RpcMgmtEpEltInqBegin]
mov dword [ebp - 0x54], 0xfffffec8
mov dword [ebp - 0x38], 0xfffff5b4
push dword [ebp - 0x34]
push 0x8b5
push 0x706
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov dword [ebp - 4], esi
push dword [ebp - 0x3c]
push dword [ebp - 0x1c]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0xc5a
push dword [ebp - 0x38]
push dword [ebp - 0x54]
push dword [ebp - 0x50]
call dword [sym.imp.RPCRT4.dll_RpcMgmtEnableIdleCleanup]
push dword [ebp - 0x58]
push 0xf87
call dword [sym.imp.RPCRT4.dll_I_RpcConnectionSetSockBuffSize]
push 0xbed
push 0xf26
push 0x85f
call dword [sym.imp.RPCRT4.dll_RpcBindingServerFromClient]
mov dword [ebp - 0x14], 0x233674
push 0x70d
push dword [ebp - 0x14]
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov dword [ebp - 0xc], 0xfffb4fb7
push dword [ebp - 4]
push dword [ebp - 0x1c]
push 0xf69
call dword [sym.imp.RPCRT4.dll_RpcTestCancel]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x54], 0x20e
push dword [ebp - 0x2c]
push dword [ebp - 0x50]
push 0xb76
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_NdrInterfacePointerUnmarshall]
mov dword [ebp - 0x24], 0x35ae
push dword [ebp - 0x10]
push 0x799
call dword [sym.imp.RPCRT4.dll_NdrFixedArrayUnmarshall]
push 0x9ef
push 0x591
push dword [ebp - 0x54]
call dword [sym.imp.RPCRT4.dll_NdrXmitOrRepAsMemorySize]
mov dword [ebp - 0x1c], 0x6d580
mov dword [ebp - 0x3c], 0x231000
push 0xfb7
push 0x783
push 0x508
push dword [ebp - 0x38]
call dword [sub.RPCRT4.dll_MesInqProcEncodingId]
mov edi, 0x233434
mov dword [ebp - 0x14], edi
push dword [ebp - 0xc]
push 0xadf
call dword [sym.imp.RPCRT4.dll_NdrXmitOrRepAsUnmarshall]
push dword [ebp - 8]
push dword [ebp - 0x58]
push 0xb6a
push dword [ebp - 0x1c]
call dword [sym.imp.RPCRT4.dll_I_RpcReallocPipeBuffer]
mov dword [ebp - 0x58], 0x33c
push 0xe96
push 0xd24
call dword [sym.imp.RPCRT4.dll_RpcServerUseAllProtseqs]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 8], 0xfffb5375
push dword [ebp - 4]
push dword [ebp - 0x20]
push 0xad9
call dword [sub.Msi.dll_MsiGetSummaryInformationW]
mov dword [ebp - 0x28], esi
push 0x4fa
push 0x5e3
call dword [sub.Msi.dll_MsiGetComponentStateA]
push 0xf30
push dword [ebp - 4]
push 0x8c5
push 0x72e
call dword [sym.imp.RPCRT4.dll_NdrRpcSmClientFree]
mov dword [ebp - 0x40], esi
push 0x621
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.RPCRT4.dll_NdrComplexArrayBufferSize]
mov dword [ebp - 0x48], 0xa046b25d
push dword [ebp - 0x40]
push dword [ebp - 8]
push dword [ebp - 0x34]
push 0x518
call dword [sym.imp.RPCRT4.dll_long_from_ndr_temp]
push dword [ebp - 0x28]
push 0x91c
push dword [ebp - 0x40]
call dword [sym.imp.RPCRT4.dll_I_RpcReceive]
mov dword [ebp - 0x18], 0xfffb51da
mov dword [ebp - 0x44], 0x5fb38b17
push 0xb76
push dword [ebp - 0x44]
push dword [ebp - 0x1c]
call dword [sym.imp.RPCRT4.dll_NdrComplexArrayUnmarshall]
mov ebx, 0x1228
mov dword [ebp - 0x10], ebx
push 0x911
push dword [ebp - 0x34]
push 0x419
call dword [sym.imp.RPCRT4.dll_NdrComplexStructBufferSize]
mov dword [ebp - 4], esi
push 0xf22
push 0xac3
call dword [sym.imp.RPCRT4.dll_RpcMgmtEpEltInqNextW]
mov dword [ebp - 0x30], 0xfffe287c
push 0xa76
push 0x649
push 0x427
call dword [sub.Msi.dll_MsiGetComponentStateW]
push 0x64d
push 0x65b
call dword [sub.Msi.dll_MsiGetSourcePathW]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0xc], 0xeb8a3af7
push dword [ebp - 0x18]
push 0x516
push dword [ebp - 0x3c]
push dword [ebp - 0x58]
call dword [sym.imp.RPCRT4.dll_RpcAsyncAbortCall]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], esi
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push 0x6bd
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpExA]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x3c]
push 0xaa9
push 0x549
call dword [sym.imp.RPCRT4.dll_NdrVaryingArrayUnmarshall]
mov dword [ebp - 0x54], 0x189
mov dword [ebp - 0x4c], 0x405d93aa
push dword [ebp - 0x48]
push 0xd9c
call dword [sym.imp.RPCRT4.dll_RpcCancelThread]
push dword [ebp - 0x54]
push dword [ebp - 0x34]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
push 0x57f
push dword [ebp - 0x4c]
push dword [ebp - 8]
call dword [sym.imp.RPCRT4.dll_NdrByteCountPointerFree]
push dword [ebp - 4]
push 0xca9
push dword [ebp - 0xc]
push dword [ebp - 0x38]
call dword [sub.Msi.dll_MsiEnumFeaturesA]
push 0xad7
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_NdrRpcSsDefaultAllocate]
push 0x4a0
push 0xa20
call dword [sym.imp.RPCRT4.dll_NdrFullPointerXlatInit]
mov dword [ebp - 0x28], 4
push 0x903
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x14]
call dword [sym.imp.RPCRT4.dll_NdrInterfacePointerMemorySize]
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x1c]
push 0xc9c
call dword [sub.Msi.dll_MsiApplyPatchW]
mov dword [ebp - 0x20], 0xfffa4f95
push dword [ebp - 0x4c]
push dword [ebp - 0x4c]
push 0xc8a
call dword [sym.imp.RPCRT4.dll_NdrByteCountPointerMarshall]
mov dword [ebp - 8], 0xffffffff
push 0xace
push dword [ebp - 0x20]
push dword [ebp - 0x30]
call dword [sym.imp.RPCRT4.dll_I_RpcIfInqTransferSyntaxes]
mov dword [ebp - 0x34], pe_nt_image_headers32
push dword [ebp - 0x20]
push 0xb8c
call dword [sym.imp.RPCRT4.dll_NdrServerContextMarshall]
mov dword [ebp - 0x40], 0xfffffc42
push dword [ebp - 0x54]
push 0x772
push dword [ebp - 0xc]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov dword [ebp - 4], esi
mov dword [ebp - 0x38], 0xfffffefe
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp - 4]
push dword [ebp - 0x20]
call dword [sym.imp.RPCRT4.dll_NdrComplexStructFree]
mov edi, 0xffffefde
mov dword [ebp - 0x10], edi
push 0xad7
push 0xadb
call dword [sym.imp.RPCRT4.dll_RpcSsAllocate]
push 0x485
push 0x87d
push 0xa30
push dword [ebp - 0x38]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetCancelTimeout]
push dword [ebp - 0x10]
push dword [ebp - 0x40]
call dword [sub.Msi.dll_MsiGetFeatureValidStatesA]
push 0xf7c
push 0xd0b
call dword [sym.imp.RPCRT4.dll_NdrComplexArrayMemorySize]
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x4c], 0x431
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push 0xc02
call dword [sym.imp.RPCRT4.dll_NdrNonConformantStringBufferSize]
mov dword [ebp - 0x58], 0x233437
push 0x883
push dword [ebp - 0x40]
push dword [ebp - 0x54]
call dword [sub.Msi.dll_MsiDatabaseImportA]
push dword [ebp - 0x20]
push dword [ebp - 4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov dword [ebp - 0x24], 0xdc856398
push 0x8c3
push dword [ebp - 0x48]
push dword [ebp - 0x54]
call dword [sub.ADVAPI32.dll_LsaClose]
mov dword [ebp - 0x50], 0xfffffd4e
mov dword [ebp - 0x10], edi
push dword [ebp - 0x28]
push 0xd08
push 0xb2c
push dword [ebp - 0x24]
call dword [sym.imp.RPCRT4.dll_RpcIfInqId]
push dword [ebp - 0x24]
push 0xac5
call dword [sub.Msi.dll_MsiDatabaseOpenViewA]
push dword [ebp - 4]
push 0x627
call dword [sym.imp.RPCRT4.dll_NdrEncapsulatedUnionBufferSize]
mov dword [ebp - 0x20], esi
push 0xddc
push dword [ebp - 0x34]
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov dword [ebp - 0x18], 0xfffff538
push 0xacf
push dword [ebp - 4]
call dword [sym.imp.RPCRT4.dll_NdrPointerMarshall]
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 0x1b22
push dword [ebp - 0x58]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0xa0d
push dword [ebp - 0x14]
push dword [ebp - 0x48]
call dword [sub.NDdeApi.dll_Ordinal_606]
push 0x500
push 0xb3b
call dword [sym.imp.RPCRT4.dll_RpcStringBindingComposeA]
mov dword [ebp - 0x40], 0xfffffc60
mov dword [ebp - 0x38], 0x1887
push 0x49c
push 0x5d0
call dword [sym.imp.RPCRT4.dll_NdrEncapsulatedUnionMarshall]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], esi
push dword [ebp - 0x54]
push dword [ebp - 0x34]
push 0x7c3
push 0x603
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
push 0x43b
push 0xecd
push 0xbb3
push dword [ebp - 0xc]
call dword [sub.NDdeApi.dll_Ordinal_610]
push 0x991
push 0x943
call dword [sym.imp.COMCTL32.dll_ImageList_DrawEx]
mov dword [ebp - 0x3c], 0x12010
push dword [ebp - 0x10]
push dword [ebp - 0x38]
push dword [ebp - 0x40]
call dword [sym.imp.RPCRT4.dll_RpcSsDestroyClientContext]
mov dword [ebp - 0x34], esi
push 0x804
push dword [ebp - 0x10]
call dword [sub.Msi.dll_MsiGetMode]
push 0x666
push 0x8fa
call dword [sub.Msi.dll_MsiDatabaseGetPrimaryKeysW]
push 0x930
push dword [ebp - 0x34]
push 0xb0e
call dword [sym.imp.RPCRT4.dll_NdrComplexStructMemorySize]
mov edi, 0xffffefdf
mov dword [ebp - 0x10], edi
push dword [ebp - 0x18]
push dword [ebp - 4]
call dword [sym.imp.RPCRT4.dll_NdrVaryingArrayMarshall]
mov dword [ebp - 0x28], esi
push 0x447
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [sym.imp.RPCRT4.dll_RpcSmSwapClientAllocFree]
push dword [ebp - 0x44]
push 0x76f
push 0xc8f
push 0xfbf
call dword [sym.imp.RPCRT4.dll_UuidCreateNil]
push 0x950
push dword [ebp - 0x28]
push 0x660
push dword [ebp - 0x3c]
call dword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoA]
mov dword [ebp - 4], 0x41e4e
push dword [ebp - 0x20]
push 0xe3e
push 0xc7b
push 0x545
call dword [sym.imp.RPCRT4.dll_NdrServerInitializeMarshall]
mov dword [ebp - 0x14], 0xffffff35
push 0xcab
push 0x400
push 0x94e
call dword [sym.imp.RPCRT4.dll_NdrNonEncapsulatedUnionBufferSize]
push 0x7f2
push 0xd9a
push 0x7dc
push 0xee4
call dword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov dword [ebp - 0x20], 0x1793a
mov dword [ebp - 0x30], esi
push 0xf69
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_NdrConformantVaryingStructBufferSize]
push 0xbde
push dword [ebp - 0x44]
push dword [ebp - 0x20]
call dword [sub.Msi.dll_MsiEnumClientsA]
push 0x41f
push dword [ebp - 0x3c]
push 0x787
push dword [ebp - 0x1c]
call dword [sym.imp.RPCRT4.dll_NdrStubCall2]
mov dword [ebp - 8], 0x69dd0
push dword [ebp - 0x4c]
push dword [ebp - 0x14]
push 0x69a
push dword [ebp - 0x30]
call dword [sym.imp.RPCRT4.dll_DceErrorInqTextW]
mov dword [ebp - 0x50], 0x138ae
push 0xff0
push 0x6c3
push 0xa62
call dword [sym.imp.RPCRT4.dll_NdrByteCountPointerBufferSize]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x17028
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0x8ba
call dword [sym.imp.RPCRT4.dll_char_from_ndr]
push dword [ebp - 8]
push 0xfa5
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x44], esi
push 0x406
push 0x5fe
push 0x931
push dword [ebp - 0x44]
call dword [sub.Msi.dll_MsiDatabaseGenerateTransformA]
mov dword [ebp - 0x44], 0xfffe92d7
push 0x91d
push dword [ebp - 0x30]
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqIfExA]
push 0x470
push 0x403
push dword [ebp - 4]
push 0x40b
call dword [sub.RPCRT4.dll_NdrMesTypeEncode]
mov dword [ebp - 0x1c], esi
push 0xf5e
push dword [ebp - 0x58]
call dword [sym.imp.RPCRT4.dll_RpcAsyncRegisterInfo]
push 0x544
push dword [ebp - 0x28]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov dword [ebp - 0x30], 0x40cb6
push 0x91d
push dword [ebp - 0x58]
push 0x97b
call dword [sym.imp.RPCRT4.dll_data_into_ndr]
mov dword [ebp - 0x4c], 0x170e7
mov dword [ebp - 4], esi
push dword [ebp - 0x30]
push dword [ebp - 4]
call dword [sym.imp.RPCRT4.dll_NdrXmitOrRepAsMarshall]
mov dword [ebp - 0x18], ebx
push 0xfff
push dword [ebp - 0x30]
push 0x73c
push dword [ebp - 0x44]
call dword [sym.imp.RPCRT4.dll_NDRSContextMarshall]
push 0xbaf
push dword [ebp - 0x50]
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_NdrServerCall]
mov dword [ebp - 0xc], esi
push 0x779
push dword [ebp - 0x4c]
push 0xe67
push 0x637
call dword [sym.imp.RPCRT4.dll_NdrOleFree]
push 0x62b
push dword [ebp - 0x30]
call dword [sym.imp.RPCRT4.dll_RpcBindingInqOption]
mov dword [ebp - 0x24], 0x408d9
push 0x452
push 0xdeb
call dword [sym.imp.RPCRT4.dll_RpcMgmtInqComTimeout]
mov ebx, 0xd57ac569
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x2c], ebx
push dword [ebp - 0xc]
push dword [ebp - 0x50]
push 0xe75
call dword [sub.Msi.dll_MsiDoActionW]
mov dword [ebp - 0x38], 0xfffbd164
push dword [ebp - 0x2c]
push dword [ebp - 0x50]
call dword [sym.imp.RPCRT4.dll_NdrContextHandleSize]
mov dword [ebp - 0x48], 0xa89
push dword [ebp - 0x1c]
push 0x54f
push dword [ebp - 0x48]
push 0xbf6
call dword [sym.imp.RPCRT4.dll_I_RpcFreeBuffer]
push dword [ebp - 0x38]
push 0x578
call dword [sym.imp.RPCRT4.dll_NdrPointerUnmarshall]
push 0x8cc
push dword [ebp - 0x1c]
call dword [sym.imp.RPCRT4.dll_NdrNonConformantStringMarshall]
push dword [ebp - 0x1c]
push 0x6d7
push dword [ebp - 0x4c]
push 0xb48
call dword [sub.NDdeApi.dll_Ordinal_510]
push 0x63e
push dword [ebp - 0x18]
call dword [sym.imp.RPCRT4.dll_I_RpcServerRegisterForwardFunction]
mov dword [ebp - 0x18], 0xfffbd377
push 0x7de
push 0x935
push 0x8e6
push dword [ebp - 4]
call dword [sym.imp.RPCRT4.dll_NdrServerInitializePartial]
mov dword [ebp - 0x10], edi
push dword [ebp - 0x2c]
push 0x738
push 0xdca
call dword [sub.NDdeApi.dll_Ordinal_600]
mov dword [ebp - 8], 0x407fa
push 0x413
push 0x7fb
push 0xd60
push dword [ebp - 0x20]
call dword [sym.imp.RPCRT4.dll_NdrClearOutParameters]
mov dword [ebp - 0x4c], 0x170e7
push dword [ebp - 0x24]
push 0x91f
push dword [ebp - 0x20]
push 0xcbd
call dword [sym.imp.RPCRT4.dll_NdrSimpleStructMarshall]
mov dword [ebp - 0x14], esi
push 0x7df
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push 0x55c
call dword [sub.Msi.dll_MsiGetFeatureCostA]
push dword [ebp - 0x10]
push dword [ebp - 0x28]
push 0xc43
call dword [sub.Msi.dll_MsiEvaluateConditionA]
push 0x981
push 0x7d9
call dword [sym.imp.RPCRT4.dll_NdrEncapsulatedUnionMemorySize]
push 0x92a
push dword [ebp - 0x24]
push 0x52b
call dword [sym.imp.RPCRT4.dll_RpcBindingToStringBindingA]
mov dword [ebp - 0x30], 0x40cb6
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0x5ec
call dword [sym.imp.RPCRT4.dll_NDRSContextUnmarshallEx]
mov dword [ebp - 0x20], 0x1008
push 0x798
push 0xaee
push dword [ebp - 0x18]
call dword [sym.imp.RPCRT4.dll_NdrRpcSsDisableAllocate]
mov dword [ebp - 0x58], ebx
push 0xee2
push dword [ebp - 0x30]
push 0xd40
push 0x909
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
push dword [ebp - 8]
push dword [ebp - 0x54]
push dword [ebp - 0x18]
call dword [sym.imp.RPCRT4.dll_I_RpcBindingInqDynamicEndpointA]
push dword [ebp - 0x20]
push 0x9be
push dword [ebp - 8]
push 0x9fe
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0xc], 0x2642
mov dword [ebp - 0x34], 0x40a41
push 0x965
push 0xe35
push dword [ebp - 0xc]
call dword [sym.imp.RPCRT4.dll_RpcObjectSetType]
mov dword [ebp - 0x2c], 0xd57bd72f
push 0x79b
push dword [ebp - 0x34]
push 0x86f
push 0xa75
call dword [sym.imp.RPCRT4.dll_double_array_from_ndr]
mov dword [ebp - 0x30], 0xd57ff49b
mov dword [ebp - 8], 0xfffbf805
push dword [ebp - 0x2c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x3c], 0x11e4
push dword [ebp - 0x34]
push dword [ebp - 0xc]
call dword [sub.Msi.dll_MsiGetProductPropertyA]
mov dword [ebp - 0x44], 0x16e3
mov dword [ebp - 0x10], edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.RPCRT4.dll_NdrSimpleStructUnmarshall]
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x44]
push 0x54c
push 0xd2a
call dword [sym.imp.RPCRT4.dll_NdrConformantVaryingStructMarshall]
mov dword [ebp - 0x48], 0x405ce
push dword [ebp - 0x14]
push 0x9dc
push 0x97e
call dword [sym.imp.RPCRT4.dll_I_RpcDeleteMutex]
mov dword [ebp - 0x54], 0xfffffffe
push 0x62c
push dword [ebp - 0x58]
push 0x8fd
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
mov dword [ebp - 0x28], 0xfffbf97f
push 0xb73
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov dword [ebp - 0xc], 0x9a5a9ee5
push dword [ebp - 0x48]
push dword [ebp - 0x28]
push dword [ebp - 0x18]
call dword [sym.imp.RPCRT4.dll_NdrInterfacePointerFree]
push 0x75e
push dword [ebp - 0x3c]
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_RpcSsSwapClientAllocFree]
mov dword [ebp - 0x28], 0xfffbfd7f
push dword [ebp - 0xc]
push dword [ebp - 0x24]
push 0xadd
push 0xf4c
call dword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingA]
push 0x5f6
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [ebp - 0x30]
push 0x88a
push 0xb86
push dword [ebp - 0x28]
call dword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 0x20800001
push dword [ebp - 0x24]
push 0xf29
call dword [sub.NDdeApi.dll_Ordinal_602]
mov dword [ebp - 0x48], 0x56936
push 0x88d
push 0xb57
push dword [ebp - 8]
push dword [ebp - 0x4c]
call dword [sym.imp.RPCRT4.dll_MIDL_wchar_strcpy]
mov dword [ebp - 0x34], 0x2a841453
push 0x45f
push dword [ebp - 0x48]
call dword [sub.NDdeApi.dll_Ordinal_603]
push dword [ebp - 0x4c]
push 0x91a
call dword [sym.imp.RPCRT4.dll_NdrSimpleStructBufferSize]
mov dword [ebp - 0x50], 0x44802
push dword [ebp - 0x24]
push dword [ebp - 0xc]
push 0xbba
push dword [ebp - 0x1c]
call dword [sym.imp.RPCRT4.dll_data_from_ndr]
mov dword [ebp - 4], 0xd57fed5f
mov dword [ebp - 8], esi
push 0xaa3
push dword [ebp - 8]
push 0xdc2
push dword [ebp - 0x34]
call dword [sym.imp.RPCRT4.dll_RpcMgmtWaitServerListen]
mov dword [ebp - 0x10], esi
push 0xc32
push 0xd44
push dword [ebp - 0x2c]
push 0xb45
call dword [sub.RPCRT4.dll_IUnknown_QueryInterface_Proxy]
push 0xe9b
push 0x90c
call dword [sym.imp.RPCRT4.dll_I_RpcBindingInqDynamicEndpointW]
push dword [ebp - 0x50]
push 0xaf6
push dword [ebp - 4]
call dword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExA]
mov dword [ebp - 0x50], 0x2a857816
push 0xb09
push dword [ebp - 0x10]
call dword [sub.RPCRT4.dll_IUnknown_AddRef_Proxy]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0xdfffdd79
push 0xb91
push 0xcdc
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov edi, 0x9a5a8641
mov dword [ebp - 0x2c], 0x11246
mov dword [ebp - 0xc], edi
push dword [ebp - 0x54]
push 0x5fe
push dword [ebp - 0x2c]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x40], 0x20
push dword [ebp - 0x40]
push 0xf9c
call dword [sym.imp.RPCRT4.dll_NdrUserMarshalMarshall]
push dword [ebp - 0x44]
push 0x8d0
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_NDRcopy]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], esi
push dword [ebp - 0xc]
push 0x4f3
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push dword [ebp - 0x50]
push dword [ebp - 0x38]
push 0x785
call dword [sub.RPCRT4.dll_MesHandleFree]
mov dword [ebp - 0x18], 1
push 0x79f
push dword [ebp - 0x50]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp - 8], edi
push 0x623
push dword [ebp - 0x18]
push 0x95a
call dword [sub.Msi.dll_MsiGetComponentPathA]
mov dword [ebp - 4], 0xd57fedff
push dword [ebp - 0xc]
push 0xbc3
push dword [ebp - 4]
call dword [sub.Msi.dll_MsiDatabaseGetPrimaryKeysA]
mov dword [ebp - 0x58], 0x27fb2b
mov dword [ebp - 0x2c], 0xf4639eef
push 0x75b
push 0x7b2
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 0xfffbec26
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push 0xcb8
call dword [sym.imp.RPCRT4.dll_I_RpcNsBindingSetEntryNameA]
mov dword [ebp - 0x24], 0xfffffd5c
push dword [ebp - 4]
push 0xf65
push 0x9b3
call dword [sub.NDdeApi.dll_Ordinal_506]
push 0x9a6
push dword [ebp - 0x40]
push 0xf68
push dword [ebp - 0x14]
call dword [sym.imp.RPCRT4.dll_RpcSmAllocate]
push dword [ebp - 0x2c]
push 0x846
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
push dword [ebp - 0x58]
push 0x8f6
push 0xce8
call dword [sub.NDdeApi.dll_Ordinal_604]
push 0x8af
push 0x55e
push 0xfa1
push dword [ebp - 0x14]
call dword [sym.imp.RPCRT4.dll_NdrStubCall]
mov dword [ebp - 4], 0x14a
push dword [ebp - 8]
push dword [ebp - 0x24]
call dword [sym.imp.RPCRT4.dll_RpcEpRegisterNoReplaceA]
mov dword [ebp - 0x14], esi
push 0xf91
push dword [ebp - 0x40]
call dword [sym.imp.RPCRT4.dll_NdrConformantStringBufferSize]
mov dword [ebp - 0x18], 0xfffffe76
push 0xa0a
push dword [ebp - 0x10]
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov dword [ebp - 0x50], 0x5bf
push dword [ebp - 0x24]
push 0x8cc
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [ebp - 0x1c], esi
push dword [ebp - 4]
push 0x67d
push 0x9b4
call dword [sub.RPCRT4.dll_I_RpcAsyncSetHandle]
mov dword [ebp - 0x4c], 0x364
push 0x6c7
push 0x715
push dword [ebp - 0x2c]
push 0xa77
call dword [sym.imp.RPCRT4.dll_RpcSsDisableAllocate]
push 0x6ab
push 0xaab
call dword [sym.imp.RPCRT4.dll_RpcMgmtEpEltInqDone]
mov dword [ebp - 0x40], 0xfffffb19
push dword [ebp - 0x4c]
push 0xfde
push 0xe94
push 0x93b
call dword [sub.RPCRT4.dll_MesBufferHandleReset]
mov dword [ebp - 0xc], 0xc32
mov dword [ebp - 0x34], 0x1e2
push 0x84d
push dword [ebp - 0x18]
push 0x996
push dword [ebp - 0x4c]
call dword [sub.Msi.dll_MsiEnableLogW]
mov dword [ebp - 0x24], 0x26e1
mov dword [ebp - 0x44], 0xdfffdec3
push dword [ebp - 0x18]
push 0x811
push 0x796
push 0x4bd
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov dword [ebp - 0x58], 0xf465c8e8
push dword [ebp - 0x40]
push 0x7c6
push dword [ebp - 0x14]
push dword [ebp - 0x24]
call dword [sym.imp.RPCRT4.dll_RpcMgmtInqStats]
push 0xfc5
push dword [ebp - 0xc]
push dword [ebp - 0xc]
push 0x8a0
call dword [sub.Msi.dll_MsiGetFeatureInfoW]
push 0x82f
push dword [ebp - 0x20]
call dword [sym.imp.RPCRT4.dll_NdrConformantVaryingStructMemorySize]
push 0x6a7
push 0xc4f
push dword [ebp - 0x2c]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
push dword [ebp - 0xc]
push 0xca7
push 0xbdb
call dword [sym.imp.RPCRT4.dll_RpcServerUseAllProtseqsEx]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], 0x11155
push 0x886
push 0xec0
push dword [ebp - 0xc]
call dword [sym.imp.RPCRT4.dll_RpcNsBindingInqEntryNameW]
push 0x50d
push 0x7ea
push 0xcd7
call dword [sym.imp.RPCRT4.dll_NDRSContextMarshallEx]
mov dword [ebp - 0x28], 0xfffeeb30
push 0xbfa
push 0xa2c
call dword [sym.imp.RPCRT4.dll_RpcBindingInqAuthClientW]
mov dword [ebp - 0x20], 0x2000251c
mov dword [ebp - 0x3c], 0x200227db
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call dword [sym.imp.RPCRT4.dll_RpcStringFreeA]
push 0xd6c
push dword [ebp - 0x18]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [ebp - 0x38], 0xd4639f21
mov dword [ebp - 0x30], 0x1e65
push dword [ebp - 0x30]
push 0x7e2
push dword [ebp - 4]
push dword [ebp - 0x38]
call dword [sym.imp.RPCRT4.dll_I_RpcSsDontSerializeContext]
push 0x6bd
push dword [ebp - 0x3c]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0xf99
push 0xac5
call dword [sym.imp.RPCRT4.dll_NdrComplexStructUnmarshall]
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
call dword [sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate]
mov dword [ebp - 0x30], esi
push dword [ebp - 4]
push dword [ebp - 0x18]
push dword [ebp - 0x18]
push dword [ebp - 0x30]
call dword [sym.imp.RPCRT4.dll_RpcBindingInqAuthInfoExW]
push 0x869
push 0x52e
push 0xe47
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqW]
mov dword [ebp - 0x48], esi
push 0xff2
push 0x443
push 0x4cb
call dword [sym.imp.RPCRT4.dll_NdrFreeBuffer]
push dword [ebp - 0x20]
push dword [ebp - 0x48]
push 0x93a
push dword [ebp - 0x28]
call dword [sym.imp.RPCRT4.dll_RpcMgmtEpEltInqNextA]
mov dword [ebp - 0x24], esi
push 0x643
push dword [ebp - 0x44]
push 0x954
push dword [ebp - 0x20]
call dword [sym.imp.RPCRT4.dll_RpcMgmtInqDefaultProtectLevel]
mov dword [ebp - 0x2c], 0xbe06def3
push dword [ebp - 0x50]
push dword [ebp - 0x2c]
push 0x6da
call dword [sym.imp.RPCRT4.dll_NdrSimpleStructMemorySize]
push dword [ebp - 0x48]
push dword [ebp - 0x24]
call dword [sub.NDdeApi.dll_Ordinal_504]
push dword [ebp - 0x48]
push 0x4cc
push 0xe27
push dword [ebp - 0x58]
call dword [sym.imp.RPCRT4.dll_RpcSsDontSerializeContext]
call fcn.00405d70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret