Function at 0x10000b6f4
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x24b0
call fcn.100017d70
sub rsp, rax
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x24a0], rax
mov rdi, rcx
lea rax, [rsp + 0x108]
lea rcx, [rsp + 0x770]
mov r12d, 1
mov dword [rsp + 0x770], 0x11c
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x100], r12d
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx edx, byte [0x10001db85]
xor r14d, r14d
mov r13d, 0x104
cmp eax, r14d
mov rax, qword [0x10001c0a0]
cmovne edx, r12d
mov byte [0x10001db85], dl
mov word [rax], r14w
mov rax, qword [0x10001c8b0]
mov word [rax], r14w
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea esi, [r12 + 0x1f]
lea ecx, [rsi + 2]
mov rbx, rax
cmp word [rax], cx
jne 0x10000b7cc
add rbx, 2
jmp 0x10000b7cf
mov cx, si
mov ax, word [rbx]
cmp ax, r14w
je 0x10000b7f4
cmp ax, cx
je 0x10000b7ea
add rbx, 2
mov ax, word [rbx]
cmp ax, r14w
jne 0x10000b7d8
cmp word [rbx], r14w
je 0x10000b7f4
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x10001db60], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x10001e0a0], rax
cmp rax, 0xffffffffffffffff
je 0x10000b821
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, r14d
jne 0x10000b828
mov qword [0x10001e0a0], r14
mov edi, 0x7fe
lea rcx, [rsp + 0xca2]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0xb4], r14d
mov word [rsp + 0xca0], r14w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x14a2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x14a0], r14w
call sub.msvcrt.dll_memset
lea r11, [rsp + 0xca0]
lea r15, [rsp + 0x14a0]
mov qword [rsp + 0x80], r11
mov dword [rsp + 0x88], r14d
mov dword [0x10001db78], r14d
mov ebp, 9
cmp word [rbx], si
je 0x10000b8a1
cmp word [rbx], bp
jne 0x10000b8a7
add rbx, 2
jmp 0x10000b897
cmp word [rbx], 0x2f
je 0x10000b8b7
cmp word [rbx], 0x2d
jne 0x10000bb72
lea rax, [rbx + 2]
cmp rax, r14
je 0x10000bb72
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x10000bb72
add rbx, 4
mov qword [rsp + 0x60], rbx
cmp word [rbx], si
je 0x10000b8e7
cmp word [rbx], bp
jne 0x10000b8ed
add rbx, 2
jmp 0x10000b8d8
lea rax, [rsp + 0xca0]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x78], rax
call fcn.10000b348
cmp al, r14b
jne 0x10000b96f
xor edx, edx
xor ecx, ecx
call fcn.100007d7c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000b935
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000b965
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x667
jmp 0x10000deb5
mov eax, dword [rsp + reloc.msi.dll_MsiBeginTransactionA]
lea rdx, [0x100002b50]
mov r9d, 0x20019
add eax, eax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x9c], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x10000bb23
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
jne 0x10000ba8c
mov ebx, dword [rsp + 0x98]
shr ebx, 1
cmp ebx, r13d
jle 0x10000ba1f
mov edx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000ba27
lea rdi, [rsp + 0x120]
cmp rdi, r14
je 0x10000bad1
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000ba4b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x110], rdi
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r14d
jne 0x10000bb23
cmp dword [rsp + 0x9c], r12d
jne 0x10000bb23
mov rbx, qword [rsp + 0x110]
mov rdx, rsi
movzx edi, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, dx
je 0x10000bacb
cmp di, bp
jne 0x10000c1da
add rbx, 2
jmp 0x10000bab5
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000bae9
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000bb19
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0xe
jmp 0x10000deb5
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000bb3b
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000bb6b
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10000deb5
mov ebp, 0x7fffffff
mov rax, rbx
mov rcx, rbp
cmp word [rax], r14w
je 0x10000bb8c
add rax, 2
sub rcx, r12
jne 0x10000bb7d
cmp rcx, r14
je 0x10000de68
mov rsi, rbp
sub rsi, rcx
inc esi
cmp esi, r13d
jle 0x10000bbb8
movsxd rdx, esi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000bbc0
lea rdi, [rsp + 0x120]
cmp rdi, r14
je 0x10000bad1
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000bbe4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [0x100000000]
lea rax, [0x100002bd8]
lea rcx, [rsp + 0xab0]
mov qword [rsp + 0xb00], rax
lea rax, [0x100002be8]
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0xb18], rax
lea rax, [0x100002c10]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], esi
mov qword [rsp + 0xb38], rax
mov word [rdi], r14w
lea rax, [0x100002c18]
mov qword [rsp + 0xb48], rax
lea rax, [0x100002c24]
lea rdi, [0x100002c00]
mov qword [rsp + 0xb50], rax
lea rax, [0x100002c30]
mov r8d, 0x20
mov qword [rsp + 0xb60], rax
lea rax, [0x100002c40]
mov qword [rsp + 0xb08], r14
mov qword [rsp + 0xb68], rax
lea rax, [0x100002c48]
mov byte [rsp + 0xb10], r14b
mov qword [rsp + 0xb78], rax
lea rax, [0x100002c58]
mov qword [rsp + 0xb20], r14
mov qword [rsp + 0xb80], rax
lea rax, [0x100002c88]
mov byte [rsp + 0xb28], r14b
mov qword [rsp + 0xb90], rax
lea rax, [0x100002ca0]
mov qword [rsp + 0xb30], rdi
mov qword [rsp + 0xb98], rax
lea rax, [0x100002cd0]
mov byte [rsp + 0xb40], r12b
mov qword [rsp + 0xba8], rax
lea rax, [0x100002cf0]
mov byte [rsp + 0xb58], r12b
mov qword [rsp + 0xbb0], rax
lea rax, [0x100002d10]
mov byte [rsp + 0xb70], r12b
mov qword [rsp + 0xbc0], rax
lea rax, [0x100002d30]
mov byte [rsp + 0xb88], r12b
mov qword [rsp + 0xbc8], rax
lea rax, [0x100002d50]
mov byte [rsp + 0xba0], r12b
mov qword [rsp + 0xbd8], rax
lea rax, [0x100002d58]
mov byte [rsp + 0xbb8], r12b
mov qword [rsp + 0xbe0], rax
mov eax, dword [rdx + 0x2d60]
mov byte [rsp + 0xbd0], r12b
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d64]
mov byte [rsp + 0xbe8], r12b
mov word [rcx + 4], ax
mov eax, dword [rdx + 0x2d68]
lea rcx, [rsp + 0xab8]
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d6c]
mov word [rcx + 4], ax
mov rax, qword [rdx + 0x2d70]
lea rcx, [rsp + 0xad0]
mov qword [rcx], rax
mov eax, dword [rdx + 0x2d78]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x2d7c]
lea rdx, [0x100002d80]
mov word [rcx + 0xc], ax
lea rcx, [rsp + 0xae0]
call sub.msvcrt.dll_memcpy
mov r11, rbp
mov rax, rdi
cmp word [rax], r14w
je 0x10000bdf7
add rax, 2
sub r11, r12
jne 0x10000bde8
cmp r11, r14
je 0x10000de68
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
sub rbp, r11
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], r14
call fcn.100007b0c
mov rdi, rax
cmp rax, r14
je 0x10000beee
mov rsi, qword [rsp + 0x68]
cmp word [rdi], r14w
je 0x10000beee
cmp word [rdi], 0x2d
je 0x10000be43
cmp word [rdi], 0x2f
jne 0x10000beba
lea r12, [rsi - 1]
mov ecx, 1
cmp r12, rcx
jne 0x10000be80
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x100002da0]
mov edx, ecx
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bfd9
cmp rbp, r12
mov r12d, 1
jne 0x10000beba
lea rax, [0x100002c00]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bfdf
mov rsi, r14
mov qword [rsp + 0x68], r14
cmp qword [rsp + 0x78], r14
je 0x10000bee2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.100007b0c
mov rsi, qword [rsp + 0x68]
mov rdi, rax
jmp 0x10000bee5
mov rdi, r14
cmp rdi, r14
jne 0x10000be2d
lea rax, [rsp + 0xab8]
mov byte [rsp + 0xb10], r12b
mov byte [rsp + 0xb28], r12b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xab0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0xb20], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], r14
call fcn.100007b0c
mov rbx, rax
cmp rax, r14
je 0x10000c0ce
mov rdi, qword [rsp + 0x68]
cmp word [rbx], r14w
je 0x10000c0ce
cmp word [rbx], 0x2d
je 0x10000bf5e
cmp word [rbx], 0x2f
jne 0x10000bfb6
mov ebp, r14d
mov rsi, r14
lea r12, [rsp + 0xb00]
mov rax, qword [r12]
or dword [rsp + 0x28], 0xffffffff
lea r9d, [rdi - 1]
lea r8, [rbx + 2]
mov edx, 1
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000c00c
mov eax, 1
add r12, 0x18
add ebp, eax
add rsi, rax
cmp ebp, 0xa
jb 0x10000bf6c
xor r14d, r14d
mov r13d, 0x104
mov r12, rax
lea rcx, [rsp + 0x110]
mov r9b, r12b
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x11c], r13d
call fcn.100007c0c
jmp 0x10000c087
mov r12d, 1
lea rax, [rsp + 0xad0]
mov byte [rsp + 0xb10], r14b
mov byte [rsp + 0xb28], r14b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xae0]
jmp 0x10000bf16
lea rax, [rsi + rsi*2]
xor r14d, r14d
mov r13d, 0x104
mov r10, qword [rsp + rax*8 + 0xb08]
mov r9b, byte [rsp + rax*8 + 0xb10]
mov dword [rsp + 0x11c], r13d
mov r8, r14
cmp r10, r14
je 0x10000c063
mov r11d, 0x7fffffff
mov rcx, r10
mov edx, r14d
mov rax, r11
lea r8d, [r14 + 1]
cmp word [rcx], r14w
je 0x10000c05b
add rcx, 2
sub rax, r8
jne 0x10000c04c
cmp rax, r14
jne 0x10000c0ba
mov r8, r14
mov edx, 0x80070057
cmp edx, r14d
jl 0x10000c124
lea rcx, [rsp + 0x110]
mov rdx, r10
call fcn.100007c0c
mov r12d, 1
mov ebx, eax
cmp eax, r14d
jne 0x10000c129
mov rdi, r14
mov qword [rsp + 0x68], r14
cmp qword [rsp + 0x78], r14
je 0x10000c0c2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.100007b0c
mov rdi, qword [rsp + 0x68]
mov rbx, rax
jmp 0x10000c0c5
mov r8, r11
sub r8, rax
jmp 0x10000c068
mov rbx, r14
cmp rbx, r14
jne 0x10000bf48
mov rbx, qword [rsp + 0x110]
mov rax, r14
cmp rbx, r14
je 0x10000c104
mov r8d, 0x7fffffff
mov rax, rbx
mov edx, r14d
mov rcx, r8
cmp word [rax], r14w
je 0x10000c0fc
add rax, 2
sub rcx, r12
jne 0x10000c0ed
cmp rcx, r14
jne 0x10000c17c
mov rax, r14
mov edx, 0x80070057
cmp edx, r14d
jge 0x10000c184
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000de80
mov rcx, rbx
jmp 0x10000de7a
mov ebx, 0x65b
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000c141
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
jle 0x10000c175
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
jmp 0x10000deb5
mov rax, r8
sub rax, rcx
jmp 0x10000c109
mov edx, 0x20
cmp rax, r14
jbe 0x10000c1b7
lea rcx, [rbx + rax*2 - 2]
lea eax, [rdx - 0x17]
cmp word [rcx], dx
je 0x10000c1a0
cmp word [rcx], ax
jne 0x10000c1cc
cmp rcx, rbx
jb 0x10000c1cc
mov word [rcx], r14w
mov rbx, qword [rsp + 0x110]
sub rcx, 2
jmp 0x10000c196
mov eax, 9
jmp 0x10000c1cc
cmp di, dx
je 0x10000c1c8
cmp di, ax
jne 0x10000c1da
add rbx, 2
mov di, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, r14w
jne 0x10000c1be
mov r12, qword [0x10001e0a8]
mov eax, MsiGetPropertyW
mov esi, r14d
mov ebp, 0x667
lea r8, [0x100001a30]
lea r9d, [rax + 0xd]
cmp di, r14w
je 0x10000c8e0
cmp di, 0x2f
je 0x10000c34c
cmp di, 0x2d
je 0x10000c34c
lea rcx, [rsp + 0x8a0]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x8a0]
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x890], rax
mov dword [rsp + 0x898], r13d
mov dword [rsp + 0x89c], r13d
call fcn.10000b418
cmp eax, r14d
je 0x10000c7dd
mov r12, qword [rsp + 0x890]
cmp r12, r14
je 0x10000c2ef
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10001db94]
lea edx, [rax + rcx + 2]
lea rcx, [0x10001c0a0]
mov edi, eax
call fcn.10000f2c8
cmp al, r14b
je 0x10000c2e7
mov rax, qword [0x10001c0a0]
movsxd rbx, dword [0x10001db94]
mov r8d, 0x20
mov rcx, rbx
inc ebx
mov word [rax + rcx*2], r8w
lea eax, [rdi + 1]
movsxd rcx, ebx
movsxd rdx, eax
mov rax, qword [0x10001c0a0]
mov r8, r12
lea rcx, [rax + rcx*2]
mov dword [0x10001db94], ebx
call fcn.100004db8
cmp eax, r14d
jl 0x10000c2e7
add ebx, edi
mov dword [0x10001db94], ebx
mov r12, qword [rsp + 0x890]
mov rbx, qword [rsp + 0x60]
mov edx, 0x20
lea r14d, [rdx - 0x17]
mov di, word [rbx]
cmp di, dx
je 0x10000c30b
cmp di, r14w
jne 0x10000c316
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c2fd
cmp dword [rsp + 0x898], r13d
mov r14d, 0
jle 0x10000c340
cmp r12, r14
je 0x10000c340
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12, qword [0x10001e0a8]
jmp 0x10000c7bc
mov r12, qword [0x10001e0a8]
jmp 0x10000c7c1
add rbx, 2
mov qword [rsp + 0x60], rbx
movzx eax, word [rbx]
mov ecx, eax
or ecx, edx
cmp r14w, ax
je 0x10000c36b
add rbx, 2
mov qword [rsp + 0x60], rbx
mov r13, r8
mov eax, r9d
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x10000c389
add r13, 2
mov ax, word [r13]
cmp ax, r14w
jne 0x10000c371
cmp word [r13], r14w
je 0x10000c675
mov ecx, 9
cmp word [rbx], dx
je 0x10000c3b1
cmp word [rbx], r14w
je 0x10000c3b1
cmp word [rbx], cx
je 0x10000c3b1
lea edi, [rcx - 8]
mov r14d, edi
jmp 0x10000c3b6
mov edi, 1
cmp word [rbx], dx
je 0x10000c3c0
cmp word [rbx], cx
jne 0x10000c3cb
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c3b6
lea rax, [rsp + 0xca0]
mov qword [rsp + 0x78], rax
xor eax, eax
cmp word [r13], 0x63
jne 0x10000c3eb
cmp r14d, eax
jne 0x10000c80f
cmp word [r13], 0x50
jne 0x10000c48d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 0xa]
mov eax, 1
cmp edi, eax
jle 0x10000c420
movsxd rdx, edi
lea ecx, [rax + 0x3f]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
jmp 0x10000c428
lea r12, [rsp + 0x108]
xor eax, eax
cmp r12, rax
je 0x10000c882
mov rcx, qword [rsp + 0xf8]
lea rax, [rsp + 0x108]
cmp rcx, rax
je 0x10000c44e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0xf8], r12
mov dword [rsp + 0x100], edi
mov qword [rsp + 0xa8], r12
call fcn.10000b348
xor ecx, ecx
cmp al, cl
je 0x10000c822
mov r12, qword [0x10001e0a8]
jmp 0x10000c4c1
cmp word [r13], 0x71
je 0x10000c49d
cmp word [r13], 0x63
jne 0x10000c4a2
cmp r14d, eax
je 0x10000c4d0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b348
xor ecx, ecx
cmp al, cl
je 0x10000c889
mov rbx, qword [rsp + 0x60]
mov ecx, 9
xor eax, eax
lea edx, [rcx + 0x17]
mov di, word [rbx]
cmp di, dx
je 0x10000c4dd
cmp di, cx
jne 0x10000c4e8
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c4d0
cmp word [r13], 0x46
je 0x10000c508
cmp word [r13], 0x71
je 0x10000c508
cmp word [r13], 0x4a
je 0x10000c508
cmp word [r13], 0x6c
jne 0x10000c582
cmp r14d, eax
je 0x10000c582
cmp word [r13], 0x71
lea rax, [rsp + 0x14a0]
lea rdx, [rsp + 0x14a0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
lea r15, [rsp + 0xca0]
je 0x10000c58a
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b348
xor r14d, r14d
cmp al, r14b
je 0x10000c8c4
mov rbx, qword [rsp + 0x60]
lea r8d, [r14 + 0x20]
lea r14d, [r8 - 0x17]
mov di, word [rbx]
cmp di, r8w
je 0x10000c577
cmp di, r14w
jne 0x10000c582
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c568
mov rdx, qword [rsp + 0x80]
xor r14d, r14d
cmp word [r13], 0x61
jb 0x10000c5d1
cmp word [r13], 0x7a
ja 0x10000c5d1
lea rax, [0x100001a30]
mov rcx, r15
lea r15, [0x100000000]
sub r13, rax
sar r13, 1
call qword [r15 + r13*8 + 0x1bfd0]
cmp eax, r14d
jne 0x10000c8cb
mov r12, qword [0x10001e0a8]
jmp 0x10000c78c
cmp r12, r14
je 0x10000c6cb
cmp word [r13], 0x50
mov eax, 0x41
jne 0x10000c656
cmp word [r12], ax
jne 0x10000c656
lea rdx, [rsp + 0x1ca0]
mov ecx, eax
call fcn.100009a4c
cmp eax, r14d
jne 0x10000c675
lea rdx, [rsp + 0xc00]
mov ecx, 0x1e
mov r12, r13
mov qword [0x10001e0a8], r13
lea rax, [rsp + 0xc00]
sub r15, rdx
lea r8d, [rcx - 0x1d]
cmp rcx, r14
je 0x10000c649
movzx edx, word [rax + r15]
cmp dx, r14w
je 0x10000c644
mov word [rax], dx
add rax, 2
sub rcx, r8
jne 0x10000c628
cmp rcx, r14
jne 0x10000c64d
sub rax, 2
mov word [rax], r14w
jmp 0x10000c78c
cmp word [r12], 0x50
jne 0x10000c675
cmp word [r13], ax
jne 0x10000c675
mov ecx, eax
call fcn.100009a4c
cmp eax, r14d
je 0x10000c78c
xor edx, edx
xor ecx, ecx
call fcn.100007d7c
mov esi, ebp
lea r15, [0x100000000]
call fcn.10000b6a0
cmp esi, r14d
jne 0x10000c99e
cmp qword [0x10001e0a8], r14
jne 0x10000ca76
xor edx, edx
xor ecx, ecx
call fcn.100007d7c
mov esi, ebp
mov edi, dword [rsp + 0x88]
cmp esi, r14d
jne 0x10000c99e
cmp edi, r14d
jne 0x10000ca8a
jmp 0x10000ca7d
cmp word [r13], 0x50
mov r12, r13
mov qword [0x10001e0a8], r13
je 0x10000c735
lea r8, [rsp + 0x1ca0]
mov ecx, 0x400
lea rax, [rsp + 0x1ca0]
sub rdx, r8
mov r8d, 1
mov qword [rsp + 0x80], rdx
cmp rcx, r14
je 0x10000c72b
movzx edx, word [rdx + rax]
cmp dx, r14w
je 0x10000c726
mov word [rax], dx
mov rdx, qword [rsp + 0x80]
add rax, 2
sub rcx, r8
jne 0x10000c703
cmp rcx, r14
jne 0x10000c72f
sub rax, 2
mov word [rax], r14w
jmp 0x10000c73b
mov r8d, 1
lea rdx, [rsp + 0xc00]
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r14
je 0x10000c774
movzx edx, word [r15 + rax]
cmp dx, r14w
je 0x10000c76f
mov word [rax], dx
add rax, 2
sub rcx, r8
jne 0x10000c753
cmp rcx, r14
jne 0x10000c778
sub rax, 2
mov word [rax], r14w
mov eax, MsiGetPropertyW
cmp word [r13], ax
je 0x10000c8e0
lea r11, [rsp + 0xca0]
mov word [rsp + 0xca0], r14w
lea r15, [rsp + 0x14a0]
mov word [rsp + 0x14a0], r14w
mov r13d, 0x104
mov qword [rsp + 0x80], r11
mov edx, 0x20
cmp di, r14w
je 0x10000c8db
lea r8, [0x100001a30]
mov r9d, 0x52
jmp 0x10000c203
xor edx, edx
xor ecx, ecx
call fcn.100007d7c
cmp dword [rsp + 0x898], r13d
mov esi, ebp
jle 0x10000c805
mov rcx, qword [rsp + 0x890]
cmp rcx, r14
je 0x10000c805
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x60]
jmp 0x10000c680
xor edx, edx
xor ecx, ecx
call fcn.100007d7c
mov esi, ebp
xor r14d, r14d
jmp 0x10000c680
xor edx, edx
call fcn.100007d7c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c844
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c87b
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebp
jmp 0x10000deb5
mov esi, 0xe
jmp 0x10000c81a
xor edx, edx
call fcn.100007d7c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c8ab
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], edi
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000c860
xor ecx, ecx
jmp 0x10000c822
xor edx, edx
xor ecx, ecx
call fcn.100007d7c
mov esi, ebp
jmp 0x10000c687
mov eax, MsiGetPropertyW
cmp r12, r14
je 0x10000c680
mov ebp, 0x59
lea edi, [rbp + 1]
cmp ax, word [r12]
je 0x10000c912
cmp bp, word [r12]
je 0x10000c912
cmp di, word [r12]
je 0x10000c912
call fcn.10000b6a0
mov r12, qword [0x10001e0a8]
cmp word [r12], 0x50
lea rax, [0x100001a30]
lea rdx, [rsp + 0x1ca0]
cmove rdx, qword [rsp + 0xf8]
sub r12, rax
lea r15, [0x100000000]
lea rcx, [rsp + 0xc00]
sar r12, 1
call qword [r15 + r12*8 + 0x1bfd0]
mov rcx, qword [0x10001e0a8]
mov esi, eax
cmp word [rcx], bp
je 0x10000c99e
cmp word [rcx], di
je 0x10000c99e
cmp eax, r14d
jne 0x10000c98d
mov eax, MsiGetPropertyW
cmp word [rcx], ax
mov eax, 1
jne 0x10000c97f
mov dword [0x10001db78], eax
jmp 0x10000c6ad
mov edi, eax
mov dword [rsp + 0x88], eax
jmp 0x10000c6b4
cmp eax, 0x8000
jne 0x10000c9f7
mov dword [0x10001db78], r14d
mov esi, r14d
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c9b9
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
jle 0x10000c9f0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x10000deb5
mov eax, 0x52
cmp word [rcx], ax
je 0x10000ca6a
cmp word [rcx], 0x55
je 0x10000ca6a
mov eax, 0x4eb
cmp esi, eax
jg 0x10000ca3e
je 0x10000c6ad
cmp esi, 0xfffffffe
jl 0x10000ca6a
cmp esi, r14d
jl 0x10000c6ad
mov eax, 1
cmp esi, eax
jle 0x10000ca6a
cmp esi, 3
jle 0x10000ca37
cmp esi, 0x7b
jne 0x10000ca6a
mov esi, 0x653
jmp 0x10000ca6a
cmp esi, 0x642
jl 0x10000ca6a
cmp esi, 0x644
jle 0x10000c6ad
cmp esi, 0x669
je 0x10000c6ad
cmp esi, 0xbc2
je 0x10000c6ad
mov ecx, esi
call fcn.10000ae6c
jmp 0x10000c6ad
mov edi, dword [rsp + 0x88]
cmp dword [0x10001db78], r14d
je 0x10000c99e
xor ecx, ecx
cmp dword [0x10001db78], r14d
je 0x10000ca9f
xor edx, edx
call qword [0x10001a420]
jmp 0x10000cab1
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [0x100002da8]
call fcn.100016fe0
cmp edi, r14d
je 0x10000cb16
cmp dword [0x10001db78], r14d
jne 0x10000cb29
mov edi, r14d
mov r13d, 1
movsxd rcx, edi
lea r8, [0x1000019a8]
mov r9d, r13d
lea rax, [r15 + rcx*4 + 0x1d928]
lea rdx, [r15 + rcx*8 + 0x1c088]
shl rcx, 4
add rcx, r8
mov r8d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
cmp eax, r14d
jne 0x10000cb0c
add edi, r13d
cmp edi, r13d
jl 0x10000cac8
jmp 0x10000cb1c
mov dword [rsp + 0xb4], r13d
jmp 0x10000cb1c
mov r13d, 1
cmp dword [0x10001db78], r14d
je 0x10000de0e
xor eax, eax
mov r9d, r14d
lea edi, [rax + 0x20]
lea r11d, [rax + 0x30]
lea r10d, [rax + 1]
mov qword [rsp + 0xac0], rax
mov qword [rsp + 0xac8], rax
cmp word [rbx], r11w
jb 0x10000cb6d
cmp word [rbx], 0x39
ja 0x10000cb6d
mov eax, r9d
cdq
and eax, r10d
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, r11d
jmp 0x10000cb9b
mov eax, 0x41
cmp word [rbx], ax
jb 0x10000cc24
cmp word [rbx], 0x46
ja 0x10000cc24
mov eax, r9d
cdq
and eax, r10d
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, 0x37
and r8d, 0xfffffff1
add r8d, 0x10
imul r8d, eax
cmp r9d, edi
jge 0x10000cbc8
mov eax, r9d
add r9d, r10d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
or byte [rsp + rcx + 0xac0], r8b
add rbx, 2
jmp 0x10000cb49
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cbe3
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cc1a
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x641
jmp 0x10000deb5
cmp r9d, edi
jne 0x10000cbc8
xor edi, edi
mov r15b, r14b
mov bpl, r14b
mov r12b, dil
mov r13b, dil
mov byte [rsp + 0x70], dil
cmp word [rbx], di
je 0x10000cc45
add rbx, 2
cmp word [rbx], 0x43
jne 0x10000cc53
mov r15b, r10b
jmp 0x10000ccf2
cmp word [rbx], 0x55
jne 0x10000cc64
mov r15b, r10b
mov r12b, r10b
jmp 0x10000ccf2
cmp word [rbx], ax
jne 0x10000cc73
mov r13b, r10b
mov byte [rsp + 0x70], r10b
jmp 0x10000ccf2
cmp word [rbx], 0x4d
je 0x10000cc98
mov ecx, 0x52
cmp word [rbx], cx
je 0x10000cc8b
lea eax, [rcx - 0xd]
cmp word [rbx], ax
jne 0x10000ccf2
cmp word [rbx], cx
movzx r14d, r14b
cmove r14d, r10d
jmp 0x10000cc9e
mov r14b, r10b
mov bpl, r10b
lea r8, [rbx + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp rax, rdi
je 0x10000ddf5
cmp rax, 0xffffffffffffffff
je 0x10000ddf5
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp edi, eax
je 0x10000ccf0
mov edx, edi
lea rcx, [0x100002e40]
jmp 0x10000de04
xor edi, edi
or qword [rsp + 0x90], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, 1
lea edx, [rbx + 1]
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp eax, edi
jne 0x10000cd6e
or qword [rsp + 0x90], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x10000cd6e
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cd52
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], ebx
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000cbff
cmp bpl, dil
jne 0x10000cd79
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp bpl, dil
je 0x10000cda5
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xad0]
lea edx, [rdi + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
lea ebp, [rdi + 4]
cmp eax, ecx
je 0x10000ce69
cmp byte [0x10001e2ca], cl
jne 0x10000cdf2
lea rcx, [rsp + 0xa8]
call fcn.1000053d0
mov rbx, qword [rsp + 0xa8]
xor ecx, ecx
jmp 0x10000cdfb
lea rbx, [0x10001e2d0]
mov eax, ecx
cmp eax, ecx
jne 0x10000ce54
mov rcx, qword [rsp + 0xad0]
lea rax, [rsp + 0xab8]
lea r8, [rsp + 0xc40]
mov r9d, reloc.msi.dll_MsiOpenDatabaseW
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor ecx, ecx
cmp eax, ecx
je 0x10000ce54
mov rcx, qword [rsp + 0xc40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov cl, r14b
neg cl
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffe
add edx, ebp
cmp eax, ecx
cmovne edi, edx
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
jmp 0x10000ceaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x892]
xor edx, edx
mov ebx, eax
xor eax, eax
mov r8d, 0x206
mov word [rsp + 0x890], ax
call sub.msvcrt.dll_memset
mov r9d, ebx
mov ebx, 0x104
lea r8, [0x100002eb0]
lea rcx, [rsp + 0x890]
mov rdx, rbx
call fcn.100004fe0
xor eax, eax
cmp r12b, al
lea r12d, [rax + 1]
je 0x10000cecf
cmp edi, r12d
jne 0x10000cec6
lea ecx, [rax + 9]
mov edi, ecx
jmp 0x10000ced4
cmp edi, eax
jne 0x10000cee4
mov edi, 8
mov ecx, 9
cmp r13b, al
je 0x10000cf37
cmp edi, eax
jne 0x10000cf2d
mov edi, 6
jmp 0x10000cf37
lea rcx, [0x100002ef0]
xor edx, edx
call fcn.10000a89c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], ebx
jle 0x10000cf09
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], ebx
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000cc0a
cmp edi, r12d
jne 0x10000cef2
mov edi, 7
mov r13d, 0x100
mov dword [rsp + 0xb0], r13d
cmp edi, eax
je 0x10000cf61
cmp edi, r12d
je 0x10000cf61
cmp edi, 6
je 0x10000cf61
cmp edi, 7
je 0x10000cf61
cmp edi, 8
je 0x10000cf61
cmp edi, ecx
jne 0x10000cf66
mov ebp, 4
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb00]
xor r9d, r9d
mov r8d, ebp
call fcn.1000054e0
xor ebp, ebp
mov ebx, eax
cmp eax, ebp
je 0x10000cfe0
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000cf9d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cfb8
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
mov qword [rsp + 0x110], rax
jmp 0x10000c165
movsxd rbx, dword [rsp + 0xb0]
cmp ebx, r13d
mov dword [rsp + 0xab0], ebx
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0xc0], ebx
mov dword [rsp + 0xbc], ebx
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0x338], ebx
jle 0x10000d03f
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [rsp + 0x9c]
mov qword [rsp + 0x330], rax
cmp rax, rbp
jne 0x10000d061
mov dword [rsp + 0x338], ebp
jmp 0x10000d061
lea rcx, [rsp + 0x340]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x340]
mov qword [rsp + 0x330], r11
cmp ebx, r13d
mov dword [rsp + 0x558], ebx
jle 0x10000d08e
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x550], rax
cmp rax, rbp
jne 0x10000d0b0
mov dword [rsp + 0x558], ebp
jmp 0x10000d0b0
lea rcx, [rsp + 0x560]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x560]
mov qword [rsp + 0x550], r11
movsxd rax, dword [rsp + 0xc0]
cmp eax, r13d
mov dword [rsp + 0x668], eax
jle 0x10000d0e5
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x660], rax
cmp rax, rbp
jne 0x10000d107
mov dword [rsp + 0x668], ebp
jmp 0x10000d107
lea rcx, [rsp + 0x670]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x670]
mov qword [rsp + 0x660], r11
movsxd rax, dword [rsp + 0xbc]
cmp eax, r13d
mov dword [rsp + 0x448], eax
jle 0x10000d13f
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
mov qword [rsp + 0x440], rax
cmp rax, rbp
jne 0x10000d161
mov dword [rsp + 0x448], ebp
jmp 0x10000d161
lea rcx, [rsp + 0x450]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rsp + 0x450]
mov qword [rsp + 0x440], rbx
movsxd rax, dword [rsp + 0xb8]
cmp eax, r13d
mov dword [rsp + 0x778], eax
jle 0x10000d19e
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, qword [rsp + 0x440]
mov qword [rsp + 0x770], rax
cmp rax, rbp
jne 0x10000d1c0
mov dword [rsp + 0x778], ebp
jmp 0x10000d1c0
lea rcx, [rsp + 0x780]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x780]
mov qword [rsp + 0x770], rax
mov r9, qword [rsp + 0x550]
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x660]
lea r8, [rsp + 0xab0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9c]
lea rcx, [rsp + 0xb00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
cmp eax, ebp
jne 0x10000d2f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d255
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x778], r13d
jle 0x10000d272
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d272
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d28f
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d28f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d2ac
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d2ac
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d2c9
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d2c9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000cf9d
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000cf9d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000cf9d
mov rcx, qword [rsp + 0x330]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x10001a488]
mov ebx, eax
cmp eax, ebp
je 0x10000d410
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d346
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100002fc0]
mov edx, ebx
call fcn.10000a89c
cmp dword [rsp + 0x778], r13d
jle 0x10000d371
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d371
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d38e
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d38e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d3ab
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d3ab
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d3c8
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d3c8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000d3e5
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000d3e5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000d400
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jmp 0x10000cf10
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
cmp rax, rbp
jne 0x10000d4df
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d441
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x778], r13d
jle 0x10000d45e
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d45e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d47b
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d47b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d498
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d498
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d4b5
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d4b5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000cbc8
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000cbc8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000cbc8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r13, rax
cmp rax, rbp
jne 0x10000d590
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d50f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d530
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d530
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d54c
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d54c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d568
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d568
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d584
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d584
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jmp 0x10000d4bd
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x80], rbp
call fcn.10000b5c0
mov rbx, rax
cmp rax, rbp
jne 0x10000d5fd
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d5c3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003020]
xor edx, edx
call fcn.10000a89c
mov rcx, qword [rsp + 0x80]
cmp rcx, rbp
je 0x10000d5e4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x10000d50f
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000d50f
mov rax, qword [0x10001db88]
mov dword [rsp + 0xa0], ebp
mov dword [rsp + 0xc4], ebp
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x60], rbp
cmp rax, rbp
jne 0x10000d641
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001db88], rax
cmp rax, rbp
je 0x10000ddd3
lea rdx, [0x100001cd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x10000ddd3
lea r8, [rsp + 0x60]
lea rdx, [0x100001988]
lea rcx, [0x1000019e8]
call rax
cmp eax, ebp
jne 0x10000ddd3
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0xa8]
lea r8, [0x1000019e8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbp, qword [rsp + 0xa8]
xor eax, eax
cmp rbp, rax
je 0x10000ddd1
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
je 0x10000d6c3
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x68], rax
mov rax, qword [rbp]
lea r8, [rsp + 0x68]
lea rdx, [0x1000019d8]
mov rcx, rbp
call qword [rax]
mov r11, qword [rbp]
mov rcx, rbp
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
xor ebp, ebp
mov dword [rsp + 0x98], edi
cmp rcx, rbp
je 0x10000d704
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x80], rbp
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
lea r8, [rsp + 0xac0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa0]
lea rdx, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov r9d, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [r10 + 0x70]
cmp eax, ebp
je 0x10000d792
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d775
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003080]
xor edx, edx
call fcn.10000a89c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
jmp 0x10000d5d1
mov r8d, dword [rsp + 0xa0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
xor eax, eax
cmp rbp, rax
jne 0x10000d89e
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d7c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a89c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
xor ebx, ebx
cmp rcx, rbx
je 0x10000d7fc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x10000d80c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d82d
mov rcx, qword [rsp + 0x770]
cmp rcx, rbx
je 0x10000d82d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d849
mov rcx, qword [rsp + 0x440]
cmp rcx, rbx
je 0x10000d849
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d865
mov rcx, qword [rsp + 0x660]
cmp rcx, rbx
je 0x10000d865
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d881
mov rcx, qword [rsp + 0x550]
cmp rcx, rbx
je 0x10000d881
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000cbc8
mov rcx, qword [rsp + 0x330]
cmp rcx, rbx
jmp 0x10000d4ce
mov rcx, qword [rsp + 0x80]
call qword [0x10001a4c0]
xor ecx, ecx
cmp eax, ecx
jne 0x10000d8d4
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d8c6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d7e7
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
lea rdx, [0x1000019f8]
mov rax, qword [rcx]
call qword [rax]
xor eax, eax
mov rdx, rax
cmp edi, dword [rsp + 0x98]
jne 0x10000d904
cmp edi, 8
je 0x10000d904
lea eax, [rdx + 9]
cmp edi, eax
jne 0x10000d90c
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0xac0]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rsp + 0x78]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x78]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
mov r10, qword [rcx]
mov r9b, byte [rsp + 0x70]
mov edx, dword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc4]
mov r8b, r15b
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], r14b
call qword [r10 + 0x148]
mov rcx, qword [rsp + 0x90]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d99e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x90], 0xffffffffffffffff
xor r14d, r14d
cmp edi, r14d
je 0x10000da77
lea rcx, [0x100003160]
xor edx, edx
call fcn.10000a89c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
cmp rcx, r14
je 0x10000d9d5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d9e5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000da06
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000da06
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000da22
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000da22
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000da3e
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000da3e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000da5a
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000da5a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000cbc8
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
jmp 0x10000d4ce
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x138]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
cmp rcx, r14
je 0x10000daaa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000daba
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 3
or r15d, 0xffffffff
lea rdx, [rsp + 0xae0]
mov edi, 0x4ff
xor r8d, r8d
mov r9d, r15d
mov ecx, eax
mov dword [0x10001db70], eax
mov bl, r14b
mov qword [rsp + 0xae0], rbp
mov qword [rsp + 0xae8], r12
mov qword [rsp + 0xaf0], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov r13d, 1
cmp eax, r14d
je 0x10000dce3
cmp eax, r13d
je 0x10000dcda
cmp eax, 2
jne 0x10000db69
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x60], r14d
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x160]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
cmp rax, r14
je 0x10000dbe9
mov qword [rsp + 0xae0], rax
jmp 0x10000dbc8
cmp eax, 3
jne 0x10000dce3
jmp 0x10000db9a
cmp dword [rsp + 0xd0], 0x12
je 0x10000dbbc
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r14d
jne 0x10000db74
jmp 0x10000dbbf
mov bl, r13b
cmp bl, r14b
jne 0x10000dce3
xor r8d, r8d
lea rdx, [rsp + 0xae0]
mov r9d, r15d
lea ecx, [r8 + 3]
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x10000db09
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000dbfd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a89c
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000dc32
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000dc32
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000dc4e
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000dc4e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000dc6a
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000dc6a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000dc86
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000dc86
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000dca2
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
je 0x10000dca2
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000dcbd
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r13d
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000cbff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000dd18
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000dd18
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000dd34
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000dd34
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000dd50
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000dd50
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000dd6c
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000dd6c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000dd88
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
je 0x10000dd88
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x88]
cmp eax, r14d
je 0x10000ddae
cmp dword [0x10001db78], r14d
jne 0x10000ddae
mov ecx, dword [0x10001d928]
cmp ecx, r14d
je 0x10000ddae
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rsp + 0xb4], r14d
je 0x10000c99e
mov ecx, 0x641
call fcn.10000ae6c
jmp 0x10000dca2
xor ebp, ebp
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000dde7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d5d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100002dd0]
mov edx, eax
call fcn.10000a89c
jmp 0x10000cbc8
mov dword [0x10001db70], r13d
lea rcx, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r14d
jne 0x10000de4a
cmp dword [0x10001db90], r14d
je 0x10000dd88
cmp dword [0x10001db68], r14d
je 0x10000dd88
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10000de15
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000de80
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000deb0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x65b
mov rcx, qword [rsp + 0x24a0]
xor rcx, rsp
call fcn.100017610
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret