Function at 0x4020b0
Capabilities:
Accept command line arguments
Access peb ldr_data
Create thread
Delete service
Get process heap flags
Get process heap force flags
Query or enumerate registry value
Read file on windows
Terminate process
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xe8
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
call sub.comctl32.dll_InitCommonControls
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x6c]
call fcn.00401100
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x80], eax
cmp eax, 1
jg 0x402519
mov dword [ebp - 0x98], 0
xor eax, eax
xor esi, esi
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 5
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
mov word [ebp - 0xc6], ax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
lea esi, [esi]
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x9c]
mov ebx, 1
mov dword [esp], eax
call sub.msi.dll_MsiSetInternalUI
mov eax, dword [ebp - 0x98]
sub esp, 8
mov edx, eax
test eax, eax
je 0x402e27
nop
cmp word [edx + 4], 0
lea ecx, [edx + 4]
je 0x4023f0
mov eax, ecx
add eax, 2
cmp word [eax], 0
jne 0x402200
sub eax, ecx
sar eax, 1
add eax, 3
mov edx, dword [edx]
add ebx, eax
test edx, edx
jne 0x4021f0
add ebx, ebx
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0xcc], eax
call eax
mov dword [ebp - 0xb0], esi
mov edi, dword [ebp - 0x98]
mov dword [ebp - 0x9c], eax
sub esp, 0xc
mov esi, eax
jmp 0x40226a
mov edi, dword [edi]
test edi, edi
je 0x40234b
lea edx, [edi + 4]
mov dword [esp + 4], 0x3d
mov dword [esp], edx
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ucrtbase.dll_wcschr]
mov ebx, eax
test eax, eax
je 0x402260
mov edx, 0x20
lea ecx, [esi + 2]
mov word [esi], dx
mov edx, dword [ebp - 0x7c]
mov esi, eax
mov dword [esp], ecx
sub esi, edx
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov dword [ebp - 0x7c], ecx
call sub.ucrtbase.dll_memcpy
mov ecx, dword [ebp - 0x7c]
add ecx, esi
mov esi, 0x3d
mov word [ecx], si
lea esi, [ebx + 2]
mov dword [ebp - 0x7c], ecx
mov dword [esp + 4], 0x20
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcschr]
mov ecx, dword [ebp - 0x7c]
test eax, eax
mov dword [ebp - 0x80], eax
je 0x4023d8
mov eax, 0x22
lea edx, [ecx + 4]
mov word [ecx + 2], ax
cmp word [ebx + 2], 0
je 0x402336
mov eax, esi
lea esi, [esi]
nop
mov ecx, eax
add eax, 2
cmp word [eax], 0
jne 0x4022f8
sub ecx, ebx
mov dword [esp + 8], ecx
mov dword [ebp - 0x88], ecx
mov dword [esp + 4], esi
mov dword [esp], edx
mov dword [ebp - 0x7c], edx
call sub.ucrtbase.dll_memcpy
mov edx, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x80]
add edx, ecx
mov esi, edx
test eax, eax
je 0x402260
mov eax, 0x22
lea esi, [edx + 2]
mov word [edx], ax
mov edi, dword [edi]
test edi, edi
jne 0x40226a
mov ecx, esi
xor eax, eax
mov ebx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xb0]
mov word [ecx], ax
test byte [section..data], 8
jne 0x40294d
test esi, esi
je 0x4023fa
mov eax, dword [ebp - 0xa8]
test eax, eax
jne 0x4024c0
mov eax, dword [ebp - 0xac]
test eax, eax
jne 0x402a96
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0xd4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call sub.msi.dll_MsiApplyPatchW
mov dword [ebp - 0x90], eax
sub esp, 0x10
mov eax, dword [ebp - 0x90]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp word [ebx + 2], 0
lea edx, [ecx + 2]
jne 0x4022f1
mov esi, edx
jmp 0x402260
mov eax, 3
jmp 0x402210
mov eax, dword [ebp - 0xa4]
test eax, eax
jne 0x402d77
mov edi, dword [ebp - 0xa8]
test edi, edi
jne 0x4024c0
mov esi, dword [ebp - 0xac]
test esi, esi
jne 0x402a96
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x40238f
mov eax, dword [ebp - 0xbc]
test eax, eax
jne 0x402e8a
mov edi, dword [ebp - 0xc0]
test edi, edi
jne 0x4030c3
mov esi, dword [ebp - 0x84]
test esi, esi
jne 0x40346e
mov ebx, dword [ebp - 0x8c]
test ebx, ebx
jne 0x403193
mov ecx, dword [ebp - 0xd8]
test ecx, ecx
jne 0x403a17
mov edx, dword [ebp - 0xc4]
test edx, edx
je 0x403da2
test byte [section..data], 1
je 0x402584
mov dword [esp + 0xc], str.Unknown_function__ignoring_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 0
call fcn.00401930
jmp 0x402584
mov eax, dword [ebp - 0x94]
cmp word [eax], 0
je 0x4024ea
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4024d0
mov ecx, dword [ebp - 0x94]
sub eax, ecx
cmp eax, 0x4c
je 0x402b90
mov eax, dword [ebp - 0xb8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sub.msi.dll_MsiReinstallProductW
sub esp, 8
cmp eax, 2
je 0x403797
mov dword [ebp - 0x90], eax
jmp 0x4023be
mov esi, dword [ebp - 0x68]
mov edx, dword [esi + 4]
mov dword [ebp - 0x7c], esi
movzx eax, word [edx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x4025eb
lea eax, [edx + 2]
mov edx, 0x407157
call fcn.00401280
test eax, eax
je 0x402bf5
mov esi, dword [esi + 8]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x84], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegOpenKeyW
sub esp, 0xc
test eax, eax
je 0x402f1d
mov dword [ebp - 0x90], 1
jmp 0x4023be
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x6c]
mov eax, ebx
call fcn.00401100
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x60]
sub esp, 0xc
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x6c]
sub esp, 4
mov dword [ebp - 0x80], eax
cmp eax, 3
je 0x402bff
cmp dword [ebp - 0x80], 1
jle 0x4020fa
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
xor ebx, ebx
mov edi, 1
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 5
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xb0], 0
mov word [ebp - 0xc6], bx
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xa4], 0
lea esi, [esi]
mov eax, dword [ebp - 0x7c]
lea esi, [edi*4]
lea ebx, [eax + esi]
test byte [section..data], 8
jne 0x402780
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
je 0x402740
mov edx, str.umtgl
call fcn.00401280
test eax, eax
je 0x403dbe
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
jne 0x403e09
mov dword [ebp - 0xb4], 1
mov eax, dword [ebx]
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x94], eax
jmp 0x40275f
add eax, 2
mov edx, str.regserver
call fcn.00401280
test eax, eax
je 0x402800
mov dword [ebp - 0x84], 1
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x402839
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
jmp 0x4026c8
mov edx, dword [ebx]
test edx, edx
je 0x402870
mov eax, edx
shr eax, 0x10
je 0x402858
mov dword [esp + 4], 0xffffffff
mov dword [esp], edx
mov dword [ebp - 0x88], edx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x4027c5
mov eax, dword [ebp - 0x88]
call fcn.00401770
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x4026e2
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, str.unregserver
call fcn.00401280
test eax, eax
je 0x402880
mov dword [ebp - 0x8c], 1
add edi, 1
cmp dword [ebp - 0x80], edi
jg 0x40276b
mov esi, dword [ebp - 0x98]
mov eax, dword [ebp - 0x90]
and esi, eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x98], eax
jmp 0x4021c0
mov dword [esp + 4], edx
mov dword [esp], str._04x
call fcn.00401d30
jmp 0x4027c5
mov eax, str._null_
jmp 0x4027c5
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, str.unregister
call fcn.00401280
test eax, eax
jne 0x402823
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, str.unreg
call fcn.00401280
test eax, eax
jne 0x402823
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, 0x407307
call fcn.004013d0
test eax, eax
je 0x4029e3
mov ecx, dword [ebx]
movzx eax, word [ecx]
mov edx, eax
and edx, 0xfffffffd
cmp dx, 0x2d
je 0x4029b3
mov edx, ecx
mov ebx, 8
test ax, ax
je 0x402d34
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x402920
sub eax, edx
sar eax, 1
cmp ebx, eax
jge 0x402d34
mov dword [ebp - 0xa4], 1
lea eax, [ecx + ebx*2]
mov dword [ebp - 0x94], eax
jmp 0x40275f
test ebx, ebx
je 0x40304d
mov eax, ebx
shr eax, 0x10
je 0x402be0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x402986
mov eax, ebx
call fcn.00401770
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.properties_____s_n
mov dword [esp + 8], str.build_properties
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x40236b
lea eax, [ecx + 2]
mov edx, 0x407307
mov dword [ebp - 0x88], ecx
call fcn.004013d0
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x88]
test eax, eax
movzx eax, word [edx]
je 0x402907
mov ebx, 2
jmp 0x40290c
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, str.package
call fcn.004013d0
test eax, eax
jne 0x4028f1
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, 0x407311
call fcn.00401280
test eax, eax
je 0x40336d
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea esi, [eax + esi + 4]
test byte [section..data], 8
jne 0x4032bb
mov eax, dword [esi]
mov edx, str.ACTIONADMIN
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x74]
call fcn.00401c50
test byte [section..data], 1
jne 0x403292
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x98], 1
mov dword [ebp - 0xa4], 1
jmp 0x40275f
mov edx, dword [ebp - 0x98]
mov ebx, 1
lea esi, [esi]
cmp word [edx + 4], 0
lea ecx, [edx + 4]
je 0x402d6b
mov eax, ecx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x402ac0
sub eax, ecx
sar eax, 1
add eax, 1
mov edx, dword [edx]
add ebx, eax
test edx, edx
jne 0x402aa8
add ebx, ebx
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0xcc]
call eax
mov esi, dword [ebp - 0x98]
mov dword [ebp - 0x80], eax
sub esp, 0xc
mov ecx, eax
lea esi, [esi]
nop
cmp word [esi + 4], 0
lea edx, [esi + 4]
je 0x402e20
mov eax, edx
add eax, 2
cmp word [eax], 0
jne 0x402b20
sub eax, edx
mov edi, eax
sar edi, 1
mov dword [ebp - 0x7c], edi
mov ebx, edi
lea edi, [ecx + eax]
cmp eax, 2
ja 0x402b5a
jmp 0x402ce0
sub ebx, 1
add ecx, 2
add edx, 2
mov word [ecx - 2], ax
cmp ebx, 1
je 0x402b62
movzx eax, word [edx]
test ax, ax
jne 0x402b48
xor eax, eax
mov word [ecx], ax
mov eax, dword [esi]
test eax, eax
je 0x402cf5
mov ebx, 0x3b
lea ecx, [edi + 2]
mov word [edi], bx
mov esi, dword [esi]
test esi, esi
jne 0x402b10
mov eax, dword [ebp - 0x80]
mov esi, ecx
jmp 0x402cfa
lea eax, [ebp - 0x48]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ole32.dll_CLSIDFromString
sub esp, 8
test eax, eax
jne 0x4024ea
test byte [section..data], 1
je 0x402584
mov dword [esp + 0xc], str.Product_code_treatment_not_implemented_yet_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 0
call fcn.00401930
jmp 0x402584
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call fcn.00401d30
jmp 0x402986
cmp dword [ebp - 0x80], 3
jne 0x4025e5
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
mov eax, dword [eax + 4]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x403162
add eax, 2
mov edx, str.Embedding
call fcn.00401280
test eax, eax
je 0x40315c
mov eax, dword [ebp - 0x7c]
mov ebx, dword [eax + 8]
test byte [section..data], 8
jne 0x4039b1
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstol]
mov dword [section..bss], eax
test eax, eax
jne 0x4035c6
test byte [section..data], 2
je 0x402584
test ebx, ebx
je 0x403d0e
mov eax, ebx
shr eax, 0x10
je 0x403ce5
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x402cac
mov eax, ebx
call fcn.00401770
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Invalid_parameter__s_n
mov dword [esp + 8], 0x4078e0
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401930
jmp 0x402584
mov eax, dword [ebp - 0x7c]
test eax, eax
jne 0x402b62
mov eax, dword [esi]
test eax, eax
jne 0x402b71
mov eax, dword [ebp - 0x80]
mov esi, edi
xor edx, edx
mov word [esi], dx
movzx edx, word [ebp - 0xc6]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0xb4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sub.msi.dll_MsiAdvertiseProductW
mov dword [ebp - 0x90], eax
sub esp, 0x10
jmp 0x4023be
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea esi, [eax + esi + 4]
test byte [section..data], 8
jne 0x403057
mov dword [ebp - 0xa4], 1
mov eax, dword [esi]
mov dword [ebp - 0x94], eax
jmp 0x40275f
mov eax, 1
jmp 0x402ad0
xor ebx, ebx
mov eax, dword [ebp - 0x94]
cmp word [eax], 0
je 0x402da2
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x402d88
mov ecx, dword [ebp - 0x94]
sub eax, ecx
cmp eax, 0x4c
je 0x403327
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sub.msi.dll_MsiInstallProductW
mov dword [ebp - 0x90], eax
sub esp, 8
cmp eax, 2
jne 0x4023be
mov eax, dword [ebp - 0x94]
call fcn.00401f40
mov esi, eax
test eax, eax
je 0x403a3c
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msi.dll_MsiInstallProductW
sub esp, 8
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x90], ebx
sub esp, 0xc
jmp 0x4023be
mov edi, ecx
jmp 0x402b67
test esi, esi
jne 0x403170
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
jne 0x402d75
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
jne 0x4024c0
mov edx, dword [ebp - 0xac]
xor ebx, ebx
test edx, edx
je 0x402424
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
jmp 0x402cfa
mov eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x48]
mov edx, str.DllRegisterServer
mov dword [ebp - 0x48], 0
call fcn.00401e00
call eax
test eax, eax
mov eax, dword [ebp - 0xa0]
js 0x403557
test eax, eax
je 0x40327e
shr eax, 0x10
je 0x4037f2
mov dword [esp + 4], 0xffffffff
mov esi, dword [ebp - 0xa0]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x402ef1
mov eax, esi
call fcn.00401770
mov dword [esp + 4], eax
mov dword [esp], str.Successfully_registered_dll__s_n
call fcn.00401590
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x4023be
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
jmp 0x4023be
lea eax, [ebp - 0x48]
lea edi, [ebp - 0x58]
mov dword [esp + 4], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x40303a
cmp dword [ebp - 0x48], 1
jne 0x40303a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
cmp word [eax], 0
je 0x403db0
mov ecx, eax
add ecx, 2
cmp word [ecx], 0
jne 0x402f70
sub ecx, eax
lea eax, [ecx + 2]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x88], ecx
mov esi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x88]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x40303a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [ebp - 0x7c], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.ucrtbase.dll_memcpy
mov ecx, dword [ebp - 0x7c]
mov edx, 0x20
mov word [ebx + ecx], dx
mov dword [esp + 0x14], edi
mov eax, dword [ebp - 0x80]
mov dword [esp + 8], 0
add eax, ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x402593
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x402584
mov eax, str._null_
jmp 0x402986
mov ebx, dword [esi]
test ebx, ebx
je 0x403288
mov eax, ebx
shr eax, 0x10
je 0x403a60
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x403092
mov eax, ebx
call fcn.00401770
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x402d54
mov eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x48]
mov edx, str.DllUnregisterServer
mov dword [ebp - 0x48], 0
call fcn.00401e00
call eax
test eax, eax
mov eax, dword [ebp - 0xa0]
js 0x40320f
test eax, eax
je 0x403c8d
shr eax, 0x10
je 0x403a21
mov dword [esp + 4], 0xffffffff
mov esi, dword [ebp - 0xa0]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40312a
mov eax, esi
call fcn.00401770
mov dword [esp + 4], eax
mov dword [esp], str.Successfully_unregistered_dll__s_n
call fcn.00401590
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x40314d
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
mov dword [ebp - 0x90], 0
jmp 0x4023be
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], 3
jmp 0x4025eb
mov eax, dword [ebp - 0xa8]
test eax, eax
jne 0x4024c0
mov edi, dword [ebp - 0xac]
xor ebx, ebx
test edi, edi
je 0x40238f
jmp 0x402e5b
mov dword [esp + 8], 1
mov dword [esp + 4], str.ServicesActive
mov dword [esp], 0
call sub.advapi32.dll_OpenSCManagerW
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x403b8e
mov dword [esp + 8], 0x10000
mov dword [esp + 4], 0x407066
mov dword [esp], eax
call sub.advapi32.dll_OpenServiceW
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x403b4d
mov dword [esp], eax
call sub.advapi32.dll_DeleteService
sub esp, 4
test eax, eax
je 0x403af8
mov dword [esp], esi
call sub.advapi32.dll_CloseServiceHandle
sub esp, 4
mov dword [esp], ebx
call sub.advapi32.dll_CloseServiceHandle
sub esp, 4
jmp 0x4023be
test eax, eax
je 0x403cfa
shr eax, 0x10
je 0x403bba
mov dword [esp + 4], 0xffffffff
mov esi, dword [ebp - 0xa0]
mov ebx, str._invalid_
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x40324c
mov eax, esi
call fcn.00401770
mov ebx, eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Failed_to_unregister_dll__s_n
mov dword [esp], eax
call fcn.00401550
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x90], eax
jmp 0x4023be
mov eax, str._null_
jmp 0x402ef1
mov eax, str._null_
jmp 0x403092
mov dword [esp + 0xc], str.Administrative_installs_are_not_currently_supported_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 0
call fcn.00401930
jmp 0x402a73
mov ebx, dword [esi]
test ebx, ebx
je 0x403bb0
mov eax, ebx
shr eax, 0x10
je 0x403a4b
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x4032f6
mov eax, ebx
call fcn.00401770
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x402a51
lea eax, [ebp - 0x48]
mov dword [esp], ecx
mov esi, ecx
mov dword [esp + 4], eax
call sub.ole32.dll_CLSIDFromString
sub esp, 8
test eax, eax
jne 0x402da2
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 5
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msi.dll_MsiConfigureProductExW
mov dword [ebp - 0x90], eax
sub esp, 0x10
jmp 0x4023be
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, 0x407365
call fcn.004013d0
test eax, eax
mov eax, dword [ebx]
je 0x4034c7
cmp word [eax], 0
je 0x403490
mov edx, eax
add edx, 2
cmp word [edx], 0
jne 0x4033a2
sub edx, eax
mov ecx, edx
sar ecx, 1
mov dword [ebp - 0x88], ecx
cmp edx, 4
jle 0x403a75
mov dword [ebp - 0xa8], esi
mov ecx, 2
mov edx, ebx
mov dword [ebp - 0x94], edi
mov edi, dword [ebp - 0xb8]
mov ebx, ecx
movzx esi, word [eax + ebx*2]
lea eax, [esi - 0x41]
cmp ax, 0x35
ja case.0x4033eb.1
movzx eax, ax
jmp dword [eax*4 + 0x407644]
mov dword [ebp - 0xb8], edx
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Unknown_option___c__in_Repair_mode_n
mov dword [esp], eax
call fcn.00401550
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x88]
add ebx, 1
cmp ebx, eax
jge 0x40347e
mov eax, dword [edx]
jmp 0x4033db
or edi, 0x400
jmp 0x40341f
or edi, 0x100
jmp 0x40341f
or edi, 0x200
jmp 0x40341f
or edi, 2
jmp 0x40341f
or edi, 4
jmp 0x40341f
or edi, 0x80
jmp 0x40341f
or edi, 8
jmp 0x40341f
or edi, 0x10
jmp 0x40341f
or edi, 0x20
jmp 0x40341f
or edi, 0x40
jmp 0x40341f
call fcn.004015e0
mov dword [ebp - 0x90], eax
jmp 0x4023be
mov dword [ebp - 0xb8], edi
mov esi, dword [ebp - 0xa8]
mov edi, dword [ebp - 0x94]
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea esi, [eax + esi + 4]
test byte [section..data], 8
jne 0x403a8c
mov dword [ebp - 0xa8], 1
mov eax, dword [esi]
mov dword [ebp - 0x94], eax
jmp 0x40275f
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, 0x40738c
call fcn.004013d0
test eax, eax
je 0x4038ba
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x40380d
add eax, 2
mov edx, 0x40738c
call fcn.004013d0
test eax, eax
je 0x40380d
mov eax, dword [ebx]
add eax, 4
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp word [eax], 0
je 0x40381b
test byte [section..data], 8
jne 0x40387d
mov edx, str.REMOVEALL
lea eax, [ebp - 0x74]
call fcn.00401c50
mov dword [ebp - 0xa4], 1
jmp 0x40275f
test eax, eax
je 0x403b43
shr eax, 0x10
je 0x403b26
mov dword [esp + 4], 0xffffffff
mov esi, dword [ebp - 0xa0]
mov ebx, str._invalid_
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x403594
mov eax, esi
call fcn.00401770
mov ebx, eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Failed_to_register_dll__s_n
mov dword [esp], eax
call fcn.00401550
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x90], eax
jmp 0x4023be
lea ebx, [ebp - 0x48]
mov dword [esp + 0x10], 0x20
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str..pipemsica__x__d
mov dword [esp + 4], 0x18
call fcn.00401230
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x403c07
mov dword [esp + 4], 0
lea edi, [ebp - 0x58]
lea esi, [ebp - 0x64]
mov dword [esp], 0
call sub.ole32.dll_CoInitializeEx
sub esp, 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x10
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403c4a
cmp dword [ebp - 0x64], 0x10
jne 0x403c4a
mov eax, dword [edi]
test eax, eax
jne 0x4036c0
mov eax, dword [edi + 4]
test eax, eax
jne 0x4036c0
mov eax, dword [edi + 8]
test eax, eax
jne 0x4036c0
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x4036c0
mov dword [ebp - 0x90], 0
call sub.ole32.dll_CoUninitialize
jmp 0x4023be
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [edi]
sub esp, 0xc
mov dword [eax], edx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov edx, dword [edi + 8]
mov dword [eax + 8], edx
mov edx, dword [edi + 0xc]
mov dword [eax + 0xc], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x401ed0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], eax
sub esp, 0x18
lea eax, [ebp - 0x60]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x403771
cmp dword [ebp - 0x64], 8
je 0x403651
test byte [section..data], 2
jne 0x403d6c
call sub.ole32.dll_CoUninitialize
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x90], eax
jmp 0x4023be
mov eax, dword [ebp - 0x94]
call fcn.00401f40
mov ebx, eax
test eax, eax
je 0x403a3c
mov eax, dword [ebp - 0xb8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msi.dll_MsiReinstallProductW
sub esp, 8
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x90], esi
sub esp, 0xc
jmp 0x4023be
mov eax, dword [ebp - 0xa0]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401d30
jmp 0x402ef1
mov ecx, dword [ebp - 0x94]
test ecx, ecx
jne 0x40351e
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + esi + 4]
mov dword [ebp - 0x94], eax
test byte [section..data], 8
je 0x40353b
mov edx, dword [ebp - 0x94]
mov eax, str._null_
test edx, edx
jne 0x40387d
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.PackageName___s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x40353b
mov eax, dword [ebp - 0x94]
shr eax, 0x10
je 0x403bec
mov dword [esp + 4], 0xffffffff
mov esi, dword [ebp - 0x94]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x403850
mov eax, esi
call fcn.00401770
jmp 0x403850
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, str.uninstall
call fcn.00401280
test eax, eax
jne 0x4034ec
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4026f0
add eax, 2
mov edx, 0x4073c0
call fcn.004013d0
test eax, eax
mov eax, dword [ebx]
je 0x4026f0
cmp word [eax], 0
je 0x403cb2
mov edx, eax
add edx, 2
cmp word [edx], 0
jne 0x403916
sub edx, eax
mov ecx, edx
sar ecx, 1
mov dword [ebp - 0x88], ecx
cmp edx, 4
jle 0x403cb2
mov ecx, 2
mov dword [ebp - 0x94], edi
mov edi, ebx
mov dword [ebp - 0xac], esi
mov esi, ecx
jmp 0x40398f
cmp bx, 0x4d
je 0x403c97
cmp bx, 0x55
je 0x4039a5
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Unknown_option___c__in_Advertise_mode_n
mov dword [esp], eax
call fcn.00401550
mov eax, dword [ebp - 0x88]
add esi, 1
cmp esi, eax
jge 0x403ca6
mov eax, dword [edi]
movzx ebx, word [eax + esi*2]
cmp bx, 0x6d
je 0x403c97
jbe 0x40394b
cmp bx, 0x75
jne 0x40395b
mov dword [ebp - 0xb4], 1
jmp 0x40397c
test ebx, ebx
je 0x403d04
mov eax, ebx
shr eax, 0x10
je 0x403bd7
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x4039ea
mov eax, ebx
call fcn.00401770
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4071ec
mov dword [esp + 8], 0x4078e0
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x402c40
call fcn.00404a10
jmp 0x40250e
mov eax, dword [ebp - 0xa0]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401d30
jmp 0x40312a
mov dword [ebp - 0x90], 2
jmp 0x4023be
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call fcn.00401d30
jmp 0x4032f6
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call fcn.00401d30
jmp 0x403092
mov eax, 0x2aa
cmovne eax, dword [ebp - 0xb8]
mov dword [ebp - 0xb8], eax
jmp 0x403490
mov ebx, dword [esi]
test ebx, ebx
je 0x403d62
mov eax, ebx
shr eax, 0x10
je 0x403d4d
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x403ac7
mov eax, ebx
call fcn.00401770
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x4034b0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_delete_MSI_service_n
mov dword [esp], eax
call fcn.00401550
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
jmp 0x4031f4
mov eax, dword [ebp - 0xa0]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401d30
mov ebx, eax
jmp 0x403594
mov ebx, str._null_
jmp 0x403594
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x424
je 0x4031ff
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_open_MSI_service_n
mov dword [esp], eax
call fcn.00401550
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
jmp 0x4031ff
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_open_service_control_manager_n
mov dword [esp], eax
call fcn.00401550
jmp 0x402584
mov eax, str._null_
jmp 0x4032f6
mov eax, dword [ebp - 0xa0]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401d30
mov ebx, eax
jmp 0x40324c
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call fcn.00401d30
jmp 0x4039ea
mov eax, dword [ebp - 0x94]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401d30
jmp 0x403850
test byte [section..data], 2
je 0x403783
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_create_custom_action_server_pipe:__lu_n
mov dword [esp + 8], 0x4078e0
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401930
jmp 0x403783
test byte [section..data], 2
je 0x40377e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_read_from_custom_action_server_pipe:__lu_n
mov dword [esp + 8], 0x4078e0
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401930
jmp 0x40377e
mov eax, str._null_
jmp 0x40312a
mov dword [ebp - 0xb4], 0
jmp 0x40397c
mov edi, dword [ebp - 0x94]
mov esi, dword [ebp - 0xac]
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
jne 0x403d18
mov dword [ebp - 0xac], 1
mov eax, dword [ebx]
mov dword [ebp - 0x94], eax
jmp 0x40275f
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call fcn.00401d30
jmp 0x402cac
mov ebx, str._null_
jmp 0x40324c
mov eax, str._null_
jmp 0x4039ea
mov eax, str._null_
jmp 0x402cac
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x403cce
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call fcn.00401d30
jmp 0x403ac7
mov eax, str._null_
jmp 0x403ac7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_write_to_custom_action_server_pipe:__lu_n
mov dword [esp + 8], 0x4078e0
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401930
jmp 0x40377e
mov eax, 1
call fcn.004019c0
lea esi, [esi]
mov dword [ebp - 0x80], 2
xor ecx, ecx
jmp 0x402f81
mov eax, dword [ebx]
mov edx, 0x4073ed
call fcn.00401280
test eax, eax
je 0x403e79
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
jne 0x403e41
mov dword [ebp - 0xac], 1
mov eax, dword [ebx]
mov dword [ebp - 0x94], eax
xor eax, eax
mov dword [ebp - 0xb4], eax
jmp 0x40275f
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x402722
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x403dea
mov eax, dword [ebx]
mov edx, 0x4073ef
call fcn.00401750
test eax, eax
je 0x403eb8
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
jne 0x403f3c
mov edx, dword [ebx]
lea eax, [ebp - 0x70]
call fcn.00401c50
jmp 0x40275f
mov eax, dword [ebx]
mov edx, 0x4073f1
call fcn.00401750
test eax, eax
jne 0x403fbb
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x403f74
add eax, 2
mov edx, 0x4073f3
call fcn.004013d0
test eax, eax
je 0x403f74
mov ecx, dword [ebx]
mov eax, ecx
jmp 0x403efc
add eax, 2
cmp word [eax], 0
jne 0x403ef9
sub eax, ecx
mov dword [ebp - 0x88], edi
mov edx, 2
sar eax, 1
mov ebx, eax
mov eax, dword [ebp - 0xb0]
cmp edx, ebx
jge 0x4043ad
movzx edi, word [ecx + edx*2]
sub edi, 0x21
cmp di, 0x56
ja case.0x403f35.1
movzx edi, di
jmp dword [edi*4 + 0x40771c]
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x403ea9
mov eax, dword [ebx]
mov edx, 0x40741d
call fcn.00401750
test eax, eax
je 0x40403b
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
jne 0x404003
mov dword [ebp - 0x90], 1
mov eax, dword [ebx]
mov dword [ebp - 0xd0], eax
jmp 0x40275f
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
jne 0x4040a4
mov ebx, dword [ebx]
xor eax, eax
jmp 0x403feb
imul eax, eax, 0xa
add ebx, 2
lea eax, [eax + edx - 0x30]
movzx edx, word [ebx]
lea ecx, [edx - 0x30]
cmp cx, 9
jbe 0x403fe1
mov word [ebp - 0xc6], ax
jmp 0x40275f
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x403fa4
mov eax, dword [ebx]
mov edx, str.update
call fcn.00401750
test eax, eax
jne 0x403f88
mov eax, dword [ebx]
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x4040dc
add eax, 2
mov edx, 0x407426
call fcn.004013d0
test eax, eax
je 0x4040dc
mov edx, dword [ebx]
mov eax, edx
jmp 0x404077
add eax, 2
cmp word [eax], 0
jne 0x404074
sub eax, edx
cmp eax, 4
je 0x404095
lea eax, [edx + 4]
mov edx, 0x407428
call fcn.00401280
test eax, eax
je 0x404108
mov dword [ebp - 0x9c], 2
jmp 0x40275f
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x403fdb
mov eax, dword [ebx]
mov edx, str.passive
call fcn.00401750
test eax, eax
je 0x404145
mov edx, str.REBOOTPROMPT_S_
lea eax, [ebp - 0x74]
call fcn.00401c50
mov dword [ebp - 0x9c], 0x63
jmp 0x40275f
mov eax, dword [ebx]
mov edx, str.uiet
add eax, 4
call fcn.00401280
test eax, eax
jne 0x404095
mov eax, dword [ebx]
mov edx, 0x40742f
add eax, 4
call fcn.00401280
test eax, eax
je 0x4042e7
mov dword [ebp - 0x9c], 4
jmp 0x40275f
mov eax, dword [ebx]
mov edx, 0x4074a2
call fcn.00401750
test eax, eax
je 0x4041bb
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
je 0x4041a4
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
mov dword [ebp - 0xbc], 1
mov eax, dword [ebx]
mov dword [ebp - 0xa0], eax
jmp 0x40275f
mov eax, dword [ebx]
mov edx, 0x4074a4
call fcn.00401750
test eax, eax
je 0x404231
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
je 0x40421a
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
mov dword [ebp - 0xc0], 1
mov eax, dword [ebx]
mov dword [ebp - 0xa0], eax
jmp 0x40275f
mov eax, dword [ebx]
mov edx, str.help
call fcn.00401750
test eax, eax
jne 0x4042e0
mov eax, dword [ebx]
mov edx, 0x4074ab
call fcn.00401750
test eax, eax
jne 0x4042e0
mov eax, dword [ebx]
mov edx, 0x4073ed
call fcn.00401750
test eax, eax
je 0x4042a3
test byte [section..data], 1
je 0x404294
xor eax, eax
mov dword [esp + 0xc], str.Unknown_parameter__m_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], eax
call fcn.00401930
mov dword [ebp - 0xc4], 1
jmp 0x40275f
mov eax, dword [ebx]
mov edx, 0x4074c3
call fcn.00401750
test eax, eax
je 0x404309
test byte [section..data], 1
je 0x404294
xor eax, eax
mov dword [esp + 0xc], str.Unknown_parameter__D_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], eax
call fcn.00401930
jmp 0x404294
xor eax, eax
call fcn.004019c0
mov eax, dword [ebx]
mov edx, 0x407365
add eax, 4
call fcn.00401280
test eax, eax
je 0x404328
mov dword [ebp - 0x9c], 0x85
jmp 0x40275f
mov eax, dword [ebx]
mov edx, 0x4074db
call fcn.00401750
test eax, eax
je 0x40434a
mov dword [ebp - 0xd8], 1
jmp 0x40275f
mov eax, dword [ebx]
mov edx, 0x407431
add eax, 4
call fcn.00401280
test eax, eax
je 0x404359
mov dword [ebp - 0x9c], 0x82
jmp 0x40275f
mov edx, dword [ebx]
lea eax, [ebp - 0x74]
call fcn.00401c50
jmp 0x40275f
mov eax, dword [ebx]
mov edx, 0x407434
add eax, 4
call fcn.004013d0
test eax, eax
mov eax, dword [ebx]
jne 0x4044f6
add eax, 4
call fcn.00401d90
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Unknown_option___s__for_UI_level_n
mov dword [esp], eax
call fcn.00401550
jmp 0x40275f
or eax, 4
add edx, 1
jmp 0x403f19
mov edi, dword [ebp - 0x88]
mov dword [ebp - 0xb0], eax
add edi, 1
cmp dword [ebp - 0x80], edi
jle 0x403da2
mov eax, dword [ebp - 0x7c]
lea ebx, [eax + esi + 4]
test byte [section..data], 8
jne 0x404487
mov eax, dword [ebp - 0xcc]
mov ebx, dword [ebx]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.msi.dll_MsiEnableLogW
sub esp, 0xc
test eax, eax
je 0x40275f
mov eax, ebx
call fcn.00401d90
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, dword [ebp - 0xcc]
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp - 0xb0]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], str.Logging_in__s__0x_08lx___lu__failed_n
mov dword [esp], eax
call fcn.00401550
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
or eax, 2
jmp case.0x403f35.1
mov eax, 0x7fdf
jmp case.0x403f35.1
or dword [ebp - 0xcc], 2
jmp case.0x403f35.1
or ah, 1
jmp case.0x403f35.1
or dword [ebp - 0xcc], 1
jmp case.0x403f35.1
or ah, 8
jmp case.0x403f35.1
mov eax, dword [ebx]
call fcn.00401d90
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.argvW__d____s_n
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401930
jmp 0x4043d9
or ah, 4
jmp case.0x403f35.1
or al, 0x80
jmp case.0x403f35.1
or eax, 1
jmp case.0x403f35.1
or eax, 0x10
jmp case.0x403f35.1
or eax, 8
jmp case.0x403f35.1
or ah, 2
jmp case.0x403f35.1
or ah, 0x10
jmp case.0x403f35.1
lea ebx, [eax + 6]
mov esi, 3
cmp word [ebx], 0
je 0x404570
mov edx, 0x407436
mov eax, ebx
call fcn.004013d0
test eax, eax
je 0x40451a
or esi, 0x80
mov edx, 0x407438
mov eax, ebx
call fcn.004013d0
test eax, eax
je 0x40452d
or esi, 0x40
mov edx, 0x40743a
mov eax, ebx
call fcn.004013d0
test eax, eax
je 0x40456b
test byte [section..data], 1
je 0x404568
xor eax, eax
mov dword [esp + 0xc], 0x40743c
mov dword [esp + 8], str.WinMain
mov dword [esp + 4], 0x406000
mov dword [esp], eax
call fcn.00401930
or esi, 0x20
add ebx, 2
jmp 0x4044fe
mov dword [ebp - 0x9c], esi
jmp 0x40275f