Function at 0x42dd60
Capabilities:
Connect network resource
Delete file
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x330
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x526014]
xor ecx, ebp
mov dword [esp + 0x328], ecx
xor ecx, ecx
dec ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], ecx
cmp byte [eax + 0xb], 0
js 0x42dda9
mov ecx, dword [eax + 8]
mov dword [esp + 0x68], ecx
movq xmm0, qword [eax]
movq qword [esp + 0x60], xmm0
jmp 0x42ddb7
lea ecx, [esp + 0x60]
push dword [eax + 4]
push dword [eax]
call fcn.0046e530
movzx ecx, byte [esp + 0x6b]
mov eax, ecx
test cl, cl
jns 0x42ddc6
mov eax, dword [esp + 0x64]
test eax, eax
je 0x42e3ed
test cl, cl
jns 0x42ddd8
mov edx, dword [esp + 0x60]
jmp 0x42dddc
lea edx, [esp + 0x60]
lea edi, [esp + 0xb0]
mov ecx, edi
push eax
push edx
call fcn.0046f130
push edi
call fcn.004489b0
add esp, 4
mov ebx, eax
mov ecx, edi
call fcn.0046f270
test bl, bl
jne 0x42e237
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x42de1c
cmp eax, 0x52e
jne 0x42e85d
xor ebx, ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004da800
add esp, 4
mov dword [esp + 0x14], eax
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x42de6f
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, 0xffffffff
je 0x42eda0
call fcn.00471300
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, esi
lea eax, [ebx + 1]
mov dword [esp + 0x10], eax
cmp eax, 1
mov dword [esp + 0xc], ebx
jbe 0x42e352
xor eax, eax
lea ecx, [esp + 0xa0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
pxor xmm0, xmm0
lea esi, [esp + 0x2d0]
movdqu xmmword [esi + 0xc], xmm0
movdqa xmmword [esi], xmm0
push 0x1c
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
jne 0x42e06a
mov eax, dword [esp + 0x2dc]
cmp eax, 0xffffffff
je 0x42e06a
cmp dword [esp + 0x2e8], 0x40000
jne 0x42e04a
push 0x20a
push 0
push edi
call fcn.00497b10
add esp, 0xc
push 0x104
push edi
push dword [esp + 0x2d8]
push ebx
call sub.KERNEL32.dll_K32GetMappedFileNameW
dec eax
cmp eax, 0x103
ja 0x42e043
push edi
call fcn.004ad646
add esp, 4
push 1
push 4
push str..msi
push eax
push edi
call fcn.0044a980
add esp, 0x14
test al, al
je 0x42e043
push edi
call fcn.004ad646
add esp, 4
cmp eax, 0x7ffffff0
jae 0x42f7d2
mov ebx, eax
cmp eax, 5
jae 0x42df82
mov byte [esp + 0x2cb], bl
cmp ebx, 3
jne 0x42e056
movzx eax, word [esp + 0xb4]
mov word [esp + 0x2c4], ax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x2c0], eax
lea esi, [esp + 0x2c0]
jmp 0x42dfc7
lea edi, [ebx + 8]
and edi, 0xfffffff8
lea eax, [edi + edi]
push eax
call fcn.00493d3d
add esp, 4
mov esi, eax
mov dword [esp + 0x2c0], eax
or edi, 0x80000000
mov dword [esp + 0x2c8], edi
lea edi, [esp + 0xb0]
mov dword [esp + 0x2c4], ebx
mov eax, ebx
add eax, ebx
push eax
push edi
push esi
call fcn.00497010
add esp, 0xc
mov word [esi + ebx*2], 0
mov eax, dword [esp + 0xa4]
cmp eax, dword [esp + 0xa8]
jae 0x42e00b
mov ecx, dword [esp + 0x2c8]
mov dword [eax + 8], ecx
movq xmm0, qword [esp + 0x2c0]
movq qword [eax], xmm0
add eax, 0xc
mov dword [esp + 0xa4], eax
mov ebx, dword [esp + 0xc]
lea esi, [esp + 0x2d0]
jmp 0x42e043
lea ecx, [esp + 0xa0]
lea eax, [esp + 0x2c0]
push eax
call fcn.0042fae0
cmp byte [esp + 0x2cb], 0
mov ebx, dword [esp + 0xc]
lea esi, [esp + 0x2d0]
jns 0x42e043
push dword [esp + 0x2c0]
call fcn.00493d6d
add esp, 4
mov eax, dword [esp + 0x2dc]
add eax, dword [esp + 0x2d0]
jmp 0x42dea8
lea esi, [esp + 0x2c0]
test ebx, ebx
jne 0x42dfb8
jmp 0x42dfc7
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0xa0]
cmp eax, 0xc
jne 0x42e5e9
lea esi, [esp + 0x90]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
call fcn.0046f0d0
mov eax, dword [esp + 0xa4]
movzx edx, byte [eax - 1]
test dl, dl
jns 0x42e0b1
mov edx, dword [eax - 8]
mov eax, dword [eax - 0xc]
jmp 0x42e0b4
add eax, 0xfffffff4
mov ecx, edi
push edx
push eax
call fcn.0046f130
push esi
push edi
call fcn.00448fb0
add esp, 8
mov ebx, eax
mov ecx, edi
call fcn.0046f270
test bl, bl
je 0x42e72f
cmp byte [esp + 0x7b], 0
movzx eax, byte [esp + 0x9b]
js 0x42eb14
test al, al
jns 0x42e108
lea ecx, [esp + 0x70]
push dword [esp + 0x94]
push dword [esp + 0x94]
call fcn.00444ca0
jmp 0x42e122
mov eax, dword [esp + 0x98]
mov dword [esp + 0x78], eax
movq xmm0, qword [esp + 0x90]
movq qword [esp + 0x70], xmm0
lea ecx, [esp + 0x90]
call fcn.0046f270
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x42e180
mov eax, dword [esp + 0xa4]
cmp eax, esi
je 0x42e43f
lea edi, [eax - 0xc]
cmp byte [eax - 1], 0
jns 0x42e15c
push dword [eax - 0xc]
call fcn.00493d6d
add esp, 4
mov eax, edi
cmp edi, esi
jne 0x42e148
mov eax, dword [esp + 0xa0]
lea edi, [esp + 0xb0]
mov dword [esp + 0xa4], esi
push eax
call fcn.00493d6d
add esp, 4
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x10]
cmp eax, 2
jb 0x42e19d
call fcn.00471300
push dword [esp + 0xc]
call fcn.00474440
add esp, 4
test bl, bl
je 0x42e320
movzx eax, byte [esp + 0x7b]
test al, al
jns 0x42e1b8
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
jmp 0x42e1bc
lea edx, [esp + 0x70]
mov ecx, edi
push eax
push edx
call fcn.0046f130
push edi
call fcn.004489b0
add esp, 4
mov ebx, eax
mov ecx, edi
call fcn.0046f270
test bl, bl
je 0x42e320
cmp byte [esp + 0x6b], 0
movzx eax, byte [esp + 0x7b]
js 0x42eab0
test al, al
jns 0x42e223
lea ecx, [esp + 0x60]
push dword [esp + 0x74]
push dword [esp + 0x74]
call fcn.00444ca0
mov bl, 1
cmp byte [esp + 0x7b], 0
jns 0x42e219
push dword [esp + 0x70]
call fcn.00493d6d
add esp, 4
test bl, bl
je 0x42e2ef
jmp 0x42e237
mov eax, dword [esp + 0x78]
mov dword [esp + 0x68], eax
movq xmm0, qword [esp + 0x70]
movq qword [esp + 0x60], xmm0
mov eax, dword [ebp + 0x10]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0xa0], xmm0
movzx ecx, byte [eax + 0xb]
mov edx, ecx
test cl, cl
jns 0x42e254
mov edx, dword [eax + 4]
test edx, edx
jne 0x42e298
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x14a
push str.GetPartnerPackageOverrideGUIDMarker
push 0
call fcn.0043bcc0
lea edi, [esp + 0xec]
mov ecx, edi
push 0x50d629
push str.partner_package_guid
call fcn.004be8c0
mov ecx, edi
push 0x50dcaf
push 0x50dc78
jmp 0x42e2e0
test cl, cl
jns 0x42e29e
mov eax, dword [eax]
lea ecx, [esp + 0xa0]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jns 0x42e3d9
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x151
push str.GetPartnerPackageOverrideGUIDMarker
push 0
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50de78
push str.Failed_to_decode_guid_string:_assuming_no_override_for_brand_package.
call fcn.004be8c0
mov ecx, esi
call fcn.0043bef0
mov esi, dword [ebp + 8]
mov dword [esi], 0
cmp byte [esp + 0x6b], 0
jns 0x42e308
push dword [esp + 0x60]
call fcn.00493d6d
add esp, 4
mov ecx, dword [esp + 0x328]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
dec eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
movzx eax, byte [esp + 0x6b]
test al, al
jns 0x42e446
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
jmp 0x42e44a
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 0x2d0]
push eax
push edi
call fcn.004c2100
add esp, 8
lea esi, [esp + 0xb0]
mov ecx, esi
push edi
push 0xea
push str.FindMsiDatabaseLocalCopy
push 1
call fcn.004c1f00
lea ebx, [esp + 0xb8]
lea ecx, [esp + 0xec]
push 0x50dd2c
push str.Failed_to_open_parent_process_id
call fcn.004be8c0
mov ecx, ebx
push dword [esp + 0x14]
call fcn.004be7e0
mov ecx, esi
call fcn.004c1f40
cmp byte [edi + 0xb], 0
jns 0x42e3c8
push dword [esp + 0x2d0]
call fcn.00493d6d
add esp, 4
xor ebx, ebx
mov esi, dword [ebp + 8]
lea edi, [esp + 0xb0]
jmp 0x42e183
cmp byte [esp + 0x6b], 0
jns 0x42e795
mov eax, dword [esp + 0x60]
jmp 0x42e799
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x12b
push 0x50dc60
push 0
call fcn.0043bcc0
lea edi, [esp + 0xec]
mov ecx, edi
push 0x50d614
push str.msi_database
call fcn.004be8c0
mov ecx, edi
push 0x50dcaf
push 0x50dc78
call fcn.004be8c0
mov ecx, esi
mov esi, dword [ebp + 8]
call fcn.0043bef0
jmp 0x42e2ef
mov eax, esi
jmp 0x42e170
lea edx, [esp + 0x60]
lea esi, [esp + 0x2d0]
mov ecx, esi
push eax
push edx
call fcn.0046f130
mov ecx, esi
push edi
call fcn.0046f7e0
cmp byte [esp + 0xbb], 0
jns 0x42e488
lea ecx, [esp + 0xa0]
push dword [esp + 0xb4]
push dword [esp + 0xb4]
call fcn.0046e530
jmp 0x42e4a8
mov eax, dword [esp + 0xb8]
mov dword [esp + 0xa8], eax
movq xmm0, qword [esp + 0xb0]
movq qword [esp + 0xa0], xmm0
lea ecx, [esp + 0xb0]
call fcn.0046f270
lea esi, [esp + 0x2d0]
mov ecx, esi
call fcn.0046f270
pxor xmm0, xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
cmp byte [esp + 0xab], 0
jns 0x42e4e2
mov eax, dword [esp + 0xa0]
jmp 0x42e4e9
lea eax, [esp + 0xa0]
mov dword [esp + 0x2e4], eax
mov eax, 0x50dd8e
push 8
push eax
push eax
push esi
call sub.MPR.dll_WNetAddConnection2W
test eax, eax
sete bl
jne 0x42e559
lea ecx, [esp + 0xb0]
push 0x123
push str.ConnectInteractiveToFileIfLogonFailure
push 0
call fcn.0043bcc0
lea esi, [esp + 0xec]
mov ecx, esi
push 0x50de0e
push str.Successfully_connected_to
call fcn.004be8c0
movzx eax, byte [esp + 0xab]
test al, al
jns 0x42e8c0
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
jmp 0x42e8c7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 0x90]
push eax
push edi
call fcn.004c2100
add esp, 8
lea ecx, [esp + 0xb0]
push edi
push 0x120
push str.ConnectInteractiveToFileIfLogonFailure
push 1
call fcn.004c1f00
lea edi, [esp + 0xb8]
lea ecx, [esp + 0xec]
push 0x50dddc
push str.Failed_WNetAddConnection2_with_error
call fcn.004be8c0
mov ecx, edi
push esi
call fcn.004be7e0
mov esi, eax
add esi, 0x34
mov ecx, esi
push 0x50ddf3
push str._during_connection_to
call fcn.004be8c0
movzx eax, byte [esp + 0xab]
test al, al
jns 0x42e922
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
jmp 0x42e929
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 0x2c0]
push eax
push edi
call fcn.004c2100
add esp, 8
lea esi, [esp + 0xb0]
mov ecx, esi
push edi
push 0x10c
push str.FindMsiDatabaseLocalCopy
push 1
call fcn.004c1f00
lea ebx, [esp + 0xb8]
lea ecx, [esp + 0xec]
push 0x50dd8c
push str.Unexpected_count_of_local_mapped_msi_
call fcn.004be8c0
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0xa0]
sar eax, 2
imul eax, eax, 0xaaaaaaab
mov ecx, ebx
push eax
call fcn.004bf0a0
mov ecx, esi
call fcn.004c1f40
cmp byte [edi + 0xb], 0
jns 0x42e673
push dword [esp + 0x2c0]
call fcn.00493d6d
add esp, 4
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x14], eax
cmp ebx, eax
je 0x42e721
lea esi, [esp + 0xb0]
mov edi, esi
mov ecx, esi
push 0x10e
push str.FindMsiDatabaseLocalCopy
push 0
call fcn.0043bcc0
movzx eax, byte [ebx + 0xb]
mov ecx, ebx
test al, al
jns 0x42e6b8
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
push eax
push ecx
lea esi, [esp + 0x2c8]
push esi
call fcn.00473260
add esp, 0xc
movzx eax, byte [esp + 0x2cb]
test al, al
jns 0x42e6e4
mov eax, dword [esp + 0x2c4]
mov esi, dword [esp + 0x2c0]
lea ecx, [esp + 0xec]
push eax
push esi
call fcn.0046d820
cmp byte [esp + 0x2cb], 0
mov esi, edi
jns 0x42e70d
push dword [esp + 0x2c0]
call fcn.00493d6d
add esp, 4
mov ecx, esi
call fcn.0043bef0
add ebx, 0xc
cmp ebx, dword [esp + 0x14]
jne 0x42e694
xor ebx, ebx
lea edi, [esp + 0xb0]
jmp 0x42e12e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0x80]
push eax
push esi
call fcn.004c2100
add esp, 8
lea ecx, [esp + 0xb0]
push esi
push 0x105
push str.FindMsiDatabaseLocalCopy
push 1
call fcn.004c1f00
lea esi, [esp + 0xec]
mov ecx, esi
push 0x50dd64
push str.DevicePathToDriveLetterPath_failed_for_path
call fcn.004be8c0
mov eax, dword [esp + 0xa4]
movzx ecx, byte [eax - 1]
test cl, cl
jns 0x42e9bd
mov ecx, dword [eax - 8]
mov eax, dword [eax - 0xc]
jmp 0x42e9c0
lea eax, [esp + 0x60]
sub esp, 0x1c
movdqa xmm0, xmmword [0x50d5f0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x42e80c
xor edi, edi
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x3ec
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50d916
push str.Failed_to_open_msi_file_for_reading
call fcn.004be8c0
mov ecx, esi
mov esi, dword [ebp + 8]
call fcn.0043bef0
mov dword [esi], edi
jmp 0x42ec49
lea eax, [esp + 0x58]
xor ecx, ecx
dec ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
xor edi, edi
push 2
push eax
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x42ea3f
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x3f4
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50d960
push str.Failed_to_get_source_file_size_for_extracted_package_validation.
jmp 0x42ec30
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 0x2d0]
push eax
push edi
call fcn.004c2100
add esp, 8
lea esi, [esp + 0xb0]
mov ecx, esi
push edi
push 0x139
push 0x50dc60
push 1
call fcn.004c1f00
lea edi, [esp + 0xb8]
lea ecx, [esp + 0xec]
push 0x50dcb9
push str.MSI_file
call fcn.004be8c0
cmp byte [esp + 0x6b], 0
jns 0x42eacd
mov eax, dword [esp + 0x60]
jmp 0x42ead1
lea ecx, [esp + 0xa0]
lea edi, [esp + 0x2c0]
push eax
push ecx
push edi
call fcn.00473260
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42e8ef
mov eax, dword [esp + 0x2c4]
mov edi, dword [esp + 0x2c0]
mov ecx, esi
push eax
push edi
call fcn.0046d820
cmp byte [esp + 0x2cb], 0
jns 0x42e911
push dword [esp + 0x2c0]
call fcn.00493d6d
add esp, 4
lea ecx, [esp + 0xb0]
call fcn.0043bef0
mov esi, dword [ebp + 8]
jmp 0x42e99b
lea ecx, [esp + 0xa0]
lea edi, [esp + 0x2c0]
push eax
push ecx
push edi
call fcn.00473260
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42e951
mov eax, dword [esp + 0x2c4]
mov edi, dword [esp + 0x2c0]
mov ecx, esi
push eax
push edi
call fcn.0046d820
cmp byte [esp + 0x2cb], 0
jns 0x42e973
push dword [esp + 0x2c0]
call fcn.00493d6d
add esp, 4
lea ecx, [esp + 0xb0]
call fcn.004c1f40
cmp byte [esp + 0x9b], 0
mov esi, dword [ebp + 8]
jns 0x42e99b
push dword [esp + 0x90]
call fcn.00493d6d
add esp, 4
cmp byte [esp + 0xab], 0
jns 0x42e206
push dword [esp + 0xa0]
call fcn.00493d6d
add esp, 4
jmp 0x42e206
add eax, 0xfffffff4
lea edi, [esp + 0x2c0]
push ecx
push eax
push edi
call fcn.00473260
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42e9e8
mov eax, dword [esp + 0x2c4]
mov edi, dword [esp + 0x2c0]
mov ecx, esi
push eax
push edi
call fcn.0046d820
cmp byte [esp + 0x2cb], 0
jns 0x42ea0a
push dword [esp + 0x2c0]
call fcn.00493d6d
add esp, 4
lea ecx, [esp + 0xb0]
call fcn.004c1f40
cmp byte [esp + 0x8b], 0
lea edi, [esp + 0xb0]
jns 0x42e122
push dword [esp + 0x80]
call fcn.00493d6d
add esp, 4
jmp 0x42e122
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xfffffff0
sub esp, 0x14
movq xmm0, qword [esp + 0x64]
movq qword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x42eb36
xor edi, edi
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x3fb
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50d98e
push str.Failed_to_move_file_pointer_for_guid_reading.
jmp 0x42ec30
test al, al
lea edx, [esp + 0x70]
cmovs eax, dword [edx + 4]
cmovs edx, dword [edx]
lea ecx, [esp + 0x60]
push eax
push edx
call fcn.00444ba0
jmp 0x42e204
lea eax, [esp + 0x60]
mov ecx, edi
push eax
call fcn.004bf020
lea ecx, [eax + 0x34]
push 0x50dcf1
push str.does_not_exist:_assuming_no_override_for_brand_package.
call fcn.004be8c0
mov ecx, esi
call fcn.004c1f40
cmp byte [esp + 0x2db], 0
jns 0x42e2ec
push dword [esp + 0x2d0]
call fcn.00493d6d
add esp, 4
jmp 0x42e2ec
test al, al
cmovs eax, dword [esp + 0x94]
cmovs esi, dword [esp + 0x90]
lea ecx, [esp + 0x70]
push eax
push esi
call fcn.00444ba0
jmp 0x42e122
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x90]
movdqa xmmword [eax], xmm0
xor edi, edi
mov dword [esp + 0xb0], edi
push edi
lea ecx, [esp + 0xb4]
push ecx
push 0x10
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ec06
cmp dword [esp + 0xb0], 0
je 0x42ec06
movdqa xmm0, xmmword [esp + 0xa0]
pcmpeqb xmm0, xmmword [esp + 0x90]
pmovmskb eax, xmm0
cmp eax, 0xffff
jne 0x42ec55
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffe8
sub esp, 0x14
movq xmm0, qword [esp + 0x5c]
movq qword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x42eda7
xor edi, edi
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x40f
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50da40
push str.Failed_to_move_file_pointer_for_target_position_reading.
jmp 0x42ec30
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x403
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50d9b1
push str.Failed_to_read_tailing_guid_marker
call fcn.004be8c0
mov ecx, esi
mov esi, dword [ebp + 8]
call fcn.0043bef0
mov dword [esi], edi
test ebx, ebx
je 0x42e2f5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42e2f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0x80]
push eax
push esi
call fcn.004c2100
add esp, 8
lea ecx, [esp + 0xb0]
push esi
push 0x409
push str.ExtractPartnerPackageOverridePackage
push 1
call fcn.004c1f00
lea edi, [esp + 0xec]
mov ecx, edi
push 0x50d9eb
push str.Tail_GUID_from_msi_does_not_match_specified_guid_marker:
call fcn.004be8c0
mov ecx, edi
push 0x50d9f8
push str.guid_marker
call fcn.004be8c0
movdqa xmm0, xmmword [esp + 0xa0]
lea eax, [esp + 0x2c0]
movdqa xmmword [eax], xmm0
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x2d0]
movdqa xmmword [esi + 0x40], xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push 0x28
push esi
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x42ed00
lea ecx, [esp + 0xb8]
push esi
call fcn.004bf020
mov ecx, edi
push 0x50da07
push str._tailing_guid
call fcn.004be8c0
movdqa xmm0, xmmword [esp + 0x90]
movdqa xmmword [esp + 0x2c0], xmm0
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x310], xmm0
movdqa xmmword [esp + 0x300], xmm0
movdqa xmmword [esp + 0x2f0], xmm0
movdqa xmmword [esp + 0x2e0], xmm0
movdqa xmmword [esp + 0x2d0], xmm0
push 0x28
push esi
lea eax, [esp + 0x2c8]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x42f213
lea ecx, [esp + 0xb0]
call fcn.004c1f40
cmp byte [esp + 0x8b], 0
jns 0x42ed92
push dword [esp + 0x80]
call fcn.00493d6d
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x42ec41
xor esi, esi
jmp 0x42de66
lea eax, [esp + 0x40]
xor ecx, ecx
dec ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
xor edi, edi
mov dword [esp + 0xb0], edi
push edi
lea ecx, [esp + 0xb4]
push ecx
push 8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ee42
cmp dword [esp + 0xb0], 0
je 0x42ee42
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], eax
sub esp, 0x14
movq xmm0, qword [esp + 0x4c]
movq qword [esp + 4], xmm0
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x42ee55
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x41d
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50da7f
push str.Failed_to_move_file_pointer_to_target_pos_for_package_reading.
jmp 0x42ec30
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x417
jmp 0x42ec14
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x80]
movdqa xmmword [eax], xmm0
mov dword [esp + 0xb0], edi
push edi
lea ecx, [esp + 0xb4]
push ecx
push 0x10
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f1e2
cmp dword [esp + 0xb0], 0
je 0x42f1e2
movdqa xmm0, xmmword [esp + 0xa0]
pcmpeqb xmm0, xmmword [esp + 0x80]
pmovmskb eax, xmm0
cmp eax, 0xffff
jne 0x42f225
xor edi, edi
lea eax, [esp + 0x34]
mov dword [eax], edi
mov dword [esp + 0xb0], edi
push edi
lea ecx, [esp + 0xb4]
push ecx
push 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f35a
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x42f35a
cmp eax, 4
jne 0x42f35a
mov eax, dword [esp + 0x34]
test eax, eax
je 0x42f35a
xor edi, edi
lea esi, [esp + 0x2c0]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov byte [esp + 0xb0], 0
mov ecx, esi
lea edx, [esp + 0xb0]
push edx
push eax
call fcn.004bf350
mov ecx, dword [esp + 0x34]
mov eax, dword [esi]
mov dword [esp + 0xb0], edi
push edi
lea edx, [esp + 0xb4]
push edx
mov esi, ecx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ef58
mov eax, dword [esp + 0xb0]
xor edi, edi
cmp esi, eax
jne 0x42f39a
lea eax, [esp + 0x30]
mov dword [eax], edi
mov dword [esp + 0xb0], edi
push edi
lea ecx, [esp + 0xb4]
push ecx
push 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f3c6
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x42f3c6
cmp eax, 4
jne 0x42f3c6
mov eax, dword [esp + 0x30]
test eax, eax
je 0x42f3c6
xor edi, edi
lea esi, [esp + 0x70]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov byte [esp + 0xb0], 0
mov ecx, esi
lea edx, [esp + 0xb0]
push edx
push eax
call fcn.004bf350
mov ecx, dword [esp + 0x30]
mov eax, dword [esi]
mov dword [esp + 0xb0], edi
push edi
lea edx, [esp + 0xb4]
push edx
mov esi, ecx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f000
mov eax, dword [esp + 0xb0]
cmp esi, eax
jne 0x42f4c4
mov edi, dword [ebp + 0x14]
lea ecx, [esp + 0xb0]
call fcn.004e0ab0
mov eax, dword [esp + 0x2c0]
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x2c4]
sub edx, eax
mov eax, dword [edi]
mov dword [esp + 0x10], eax
mov edi, dword [edi + 4]
sub edi, eax
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
sub esi, eax
lea ecx, [esp + 0xb0]
push edx
push dword [esp + 0x10]
push edi
push dword [esp + 0x1c]
push esi
push eax
call fcn.004e0cb0
mov byte [esp + 0xc], al
lea ecx, [esp + 0xb0]
call fcn.004e0ad0
cmp byte [esp + 0xc], 0
je 0x42f506
lea esi, [esp + 0x24]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea edi, [esp + 0xb0]
push edi
call fcn.0042c0b0
add esp, 4
push edi
push esi
call fcn.0042c3c0
add esp, 8
cmp byte [esp + 0xbb], 0
jns 0x42f0b5
push dword [esp + 0xb0]
call fcn.00493d6d
add esp, 4
movzx eax, byte [esp + 0x2f]
test al, al
jns 0x42f0c6
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
lea edi, [esp + 0xb0]
mov ecx, edi
push eax
push esi
call fcn.0046f130
push 0x1c
call fcn.00493d3d
add esp, 4
mov esi, eax
mov ecx, eax
push 0x261
push edi
call fcn.004456b0
mov ecx, edi
call fcn.0046f270
mov dword [esp + 0xc], esi
mov ecx, esi
call fcn.00473b90
test al, al
je 0x42f578
mov eax, dword [esp + 0x2c0]
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x2c4]
mov ecx, dword [esp + 0xc]
call fcn.004278b0
mov esi, eax
xor eax, eax
mov dword [esp + 0xb0], eax
push 2
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x42f47a
mov ecx, eax
sub edi, dword [esp + 0x10]
xor eax, eax
push eax
push edi
push eax
mov dword [esp + 0x20], ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
xor eax, eax
push eax
lea eax, [esp + 0xb4]
push eax
push edi
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x10], eax
xor eax, eax
push eax
push edi
push eax
push dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [esp + 0x10], 0
je 0x42f47a
cmp dword [esp + 0xb0], edi
jne 0x42f47a
mov ecx, dword [ebp + 0x18]
lea eax, [esp + 0x24]
cmp eax, ecx
sete dl
test ecx, ecx
je 0x42f447
test dl, dl
jne 0x42f447
cmp byte [ecx + 0xb], 0
movzx edx, byte [esp + 0x2f]
js 0x42f6ec
test dl, dl
jns 0x42f436
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.00444ca0
jmp 0x42f447
xor edi, edi
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x424
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50daa3
push str.Failed_to_read_starting_guid_marker
jmp 0x42ec30
lea ecx, [esp + 0xb8]
push esi
call fcn.004bf020
jmp 0x42ed6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0x70]
push eax
push esi
call fcn.004c2100
add esp, 8
lea ecx, [esp + 0xb0]
push esi
push 0x42a
push str.ExtractPartnerPackageOverridePackage
push 1
call fcn.004c1f00
lea edi, [esp + 0xec]
mov ecx, edi
push 0x50dae7
push str.Appendix_start_GUID_from_msi_does_not_match_specified_guid_marker:
call fcn.004be8c0
mov ecx, edi
push 0x50d9f8
push str.guid_marker
call fcn.004be8c0
movdqa xmm0, xmmword [esp + 0xa0]
lea eax, [esp + 0x2c0]
movdqa xmmword [eax], xmm0
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x2d0]
movdqa xmmword [esi + 0x40], xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push 0x28
push esi
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x42f2cd
lea ecx, [esp + 0xb8]
push esi
call fcn.004bf020
mov ecx, edi
push 0x50da07
push str._tailing_guid
call fcn.004be8c0
movdqa xmm0, xmmword [esp + 0x80]
movdqa xmmword [esp + 0x2c0], xmm0
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x310], xmm0
movdqa xmmword [esp + 0x300], xmm0
movdqa xmmword [esp + 0x2f0], xmm0
movdqa xmmword [esp + 0x2e0], xmm0
movdqa xmmword [esp + 0x2d0], xmm0
push 0x28
push esi
lea eax, [esp + 0x2c8]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x42f424
lea ecx, [esp + 0xb0]
call fcn.004c1f40
cmp byte [esp + 0x7b], 0
jns 0x42ed92
push dword [esp + 0x70]
jmp 0x42ed8a
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x433
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50daff
push str.Failed_to_read_zip_size
call fcn.004be8c0
mov ecx, esi
call fcn.0043bef0
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x42f41c
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x43a
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50db17
push str.Failed_to_read_zip_data
jmp 0x42f3f0
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x444
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50db35
push str.Failed_to_read_signature_size
call fcn.004be8c0
mov ecx, esi
call fcn.0043bef0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, dword [esp + 0x2c0]
test eax, eax
je 0x42f41c
mov dword [esp + 0x2c4], eax
push eax
call fcn.00493d6d
add esp, 4
mov esi, dword [ebp + 8]
jmp 0x42ec41
lea ecx, [esp + 0xb8]
push esi
call fcn.004bf020
jmp 0x42f33a
mov eax, dword [esp + 0x2c]
mov dword [ecx + 8], eax
movq xmm0, qword [esp + 0x24]
movq qword [ecx], xmm0
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
cmp byte [esp + 0x2f], 0
jns 0x42f463
push dword [esp + 0x24]
call fcn.00493d6d
add esp, 4
mov eax, dword [esp + 0x70]
test eax, eax
je 0x42f401
mov dword [esp + 0x74], eax
push eax
call fcn.00493d6d
add esp, 4
jmp 0x42f401
lea ecx, [esp + 0xb0]
push 0x467
push str.ExtractPartnerPackageOverridePackage
push 0
call fcn.0043bcc0
lea esi, [esp + 0xec]
mov ecx, esi
push 0x50dbbf
push str.Failed_to_write_file_data_to_output_file
call fcn.004be8c0
movzx eax, byte [esp + 0x2f]
test al, al
jns 0x42f5c2
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
jmp 0x42f5c6
xor edi, edi
lea esi, [esp + 0xb0]
mov ecx, esi
push 0x44c
push str.ExtractPartnerPackageOverridePackage
push edi
call fcn.0043bcc0
lea ecx, [esp + 0xec]
push 0x50db53
push str.Failed_to_read_signature_data
call fcn.004be8c0
mov ecx, esi
call fcn.0043bef0
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x42f463
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 0x2d0]
push eax
push edi
call fcn.004c2100
add esp, 8
lea esi, [esp + 0xb0]
mov ecx, esi
push edi
push 0x453
push str.ExtractPartnerPackageOverridePackage
push 1
call fcn.004c1f00
lea ecx, [esp + 0xec]
push 0x50db6d
push str.Zip_verification_failed:
call fcn.004be8c0
mov ecx, esi
call fcn.004c1f40
cmp byte [edi + 0xb], 0
jns 0x42f56a
push dword [esp + 0x2d0]
call fcn.00493d6d
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax], 0
jmp 0x42f463
lea ecx, [esp + 0xb0]
push 0x45e
push str.ExtractPartnerPackageOverridePackage
push 0
call fcn.0043bcc0
lea esi, [esp + 0xec]
mov ecx, esi
push 0x50db95
push str.Failed_to_open_target_file_for_reading
call fcn.004be8c0
movzx eax, byte [esp + 0x2f]
test al, al
jns 0x42f665
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
jmp 0x42f669
lea ecx, [esp + 0x24]
lea edi, [esp + 0x2d0]
push eax
push ecx
push edi
call fcn.00473260
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42f5ee
mov eax, dword [esp + 0x2d4]
mov edi, dword [esp + 0x2d0]
mov ecx, esi
push eax
push edi
call fcn.0046d820
cmp byte [esp + 0x2db], 0
jns 0x42f610
push dword [esp + 0x2d0]
call fcn.00493d6d
add esp, 4
lea ecx, [esp + 0xb0]
call fcn.0043bef0
cmp dword [esp + 0xc], 0
je 0x42f637
mov esi, dword [esp + 0xc]
mov ecx, esi
call fcn.0046f030
push esi
call fcn.00493d6d
add esp, 4
cmp byte [esp + 0x2f], 0
jns 0x42f644
mov eax, dword [esp + 0x24]
jmp 0x42f648
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x42f704
mov eax, dword [ebp + 8]
mov dword [eax], 0
jmp 0x42f450
lea ecx, [esp + 0x24]
lea edi, [esp + 0x2d0]
push eax
push ecx
push edi
call fcn.00473260
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42f691
mov eax, dword [esp + 0x2d4]
mov edi, dword [esp + 0x2d0]
mov ecx, esi
push eax
push edi
call fcn.0046d820
cmp byte [esp + 0x2db], 0
jns 0x42f6b3
push dword [esp + 0x2d0]
call fcn.00493d6d
add esp, 4
lea ecx, [esp + 0xb0]
call fcn.0043bef0
mov eax, dword [ebp + 8]
mov dword [eax], 0
cmp dword [esp + 0xc], 0
je 0x42f450
mov esi, dword [esp + 0xc]
mov ecx, esi
call fcn.0046f030
push esi
call fcn.00493d6d
add esp, 4
jmp 0x42f450
test dl, dl
cmovs edx, dword [esp + 0x28]
cmovs eax, dword [esp + 0x24]
push edx
push eax
call fcn.00444ba0
jmp 0x42f447
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0x18]
push eax
push esi
call fcn.004c2100
add esp, 8
lea ecx, [esp + 0xb0]
push esi
push 0x46a
push str.ExtractPartnerPackageOverridePackage
push 1
call fcn.004c1f00
lea esi, [esp + 0xec]
mov ecx, esi
push 0x50dbd7
push str.Unable_to_delete_file:
call fcn.004be8c0
movzx eax, byte [esp + 0x2f]
test al, al
jns 0x42f75c
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
jmp 0x42f760
lea ecx, [esp + 0x24]
lea edi, [esp + 0x2d0]
push eax
push ecx
push edi
call fcn.00473260
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42f788
mov eax, dword [esp + 0x2d4]
mov edi, dword [esp + 0x2d0]
mov ecx, esi
push eax
push edi
call fcn.0046d820
cmp byte [esp + 0x2db], 0
jns 0x42f7aa
push dword [esp + 0x2d0]
call fcn.00493d6d
add esp, 4
lea ecx, [esp + 0xb0]
call fcn.004c1f40
cmp byte [esp + 0x23], 0
jns 0x42f657
push dword [esp + 0x18]
call fcn.00493d6d
add esp, 4
jmp 0x42f657
lea ecx, [esp + 0x2c0]
call fcn.004d5dc0
int3