Function at 0x413b20
Capabilities:
Create process on windows
Get file attributes
Print debug messages
Reference sql statements
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d2ab
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x124], str.SELECT__Component_._Installed____Component_._RuntimeFlags____FeatureComponents_._RuntimeFlags____Feature_._Installed____Feature_._RuntimeFlags__FROM__Feature____FeatureComponents____Component____File__WHERE__Feature_._Action_1_AND__Component_._Action_1_AND__Feature_._Feature__FeatureComponents_._Feature___AND__Component_._Component__File_._Component___AND__Component_._Component__FeatureComponents_._Component__
xor eax, eax
mov dword [ebp - 0x120], str.SELECT__Component_._Installed____Component_._RuntimeFlags____FeatureComponents_._RuntimeFlags____Feature_._Installed____Feature_._RuntimeFlags__FROM__Feature____FeatureComponents____Component____Registry__WHERE__Feature_._Action_1_AND__Component_._Action_1_AND__Feature_._Feature__FeatureComponents_._Feature___AND__Component_._Component__Registry_._Component___AND__Component_._Component__FeatureComponents_._Component__
push 1
mov dword [ebp - 0xc0], str.Intel_0
mov dword [ebp - 0xbc], str.Mips_0
mov dword [ebp - 0xb8], str.Alpha_0
mov dword [ebp - 0xb4], str.Ppc_0
mov dword [ebp - 0xb0], str.Shx_0
mov dword [ebp - 0xac], str.Arm_0
mov dword [ebp - 0xa8], str.Intel64_0
mov dword [ebp - 0xa4], str.Alpha64_0
mov dword [ebp - 0xa0], str.Msil_0
mov dword [ebp - 0x9c], str.x64_0
mov dword [ebp - 0x98], str.Ia32_0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
movups xmmword [ebp - 0x184], xmm0
mov dword [ebp - 0x100], 0
movups xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x1a0], 0
movq qword [ebp - 0x118], xmm0
movups xmmword [ebp - 0x1b0], xmm0
mov dword [ebp - 0x144], 0
movq qword [ebp - 0x14c], xmm0
movq qword [ebp - 0x134], xmm0
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x12c], eax
movq qword [ebp - 0x140], xmm0
mov dword [ebp - 0x138], eax
movq qword [ebp - 0x19c], xmm0
mov dword [ebp - 0x194], eax
movq qword [ebp - 0x158], xmm0
mov dword [ebp - 0x150], eax
movq qword [ebp - 0x190], xmm0
mov dword [ebp - 0x188], eax
movq qword [ebp - 0x164], xmm0
mov dword [ebp - 0x15c], eax
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
mov esi, eax
mov dword [ebp - 0xfc], esi
push 0x30
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0042a4e0
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
add esp, 0xc
mov dword [ebp - 0x40], 0
cmp byte [0x45749b], 0
movups xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0xf8], 0x100
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0xf0], 0
mov byte [ebp - 0x108], 0
jne 0x413d5f
call fcn.0040b780
test al, al
je 0x413df3
push 0x208
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xdc], edi
test edi, edi
jne 0x413d8d
mov dword [0x45771c], 8
jmp 0x414ef4
push 0
push 2
call dword [sym.imp.msi.dll_MsiSetPropertyW]
lea eax, [ebp - 0xe8]
push eax
push 1
push str.E:msi_setup_netfx_Full_x64.msi
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
je 0x413dfa
push str.E:msi_setup_netfx_Full_x64.msi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x413de9
xor eax, 1
push eax
push str.E:msi_setup_netfx_Full_x64.msi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x413de9
lea eax, [ebp - 0xe8]
push eax
push 1
push str.E:msi_setup_netfx_Full_x64.msi
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
je 0x413dfa
mov dword [0x45771c], 5
xor edi, edi
jmp 0x414ef4
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push dword [ebp - 0xe8]
call dword [sym.imp.msi.dll_MsiGetUserInfoW]
test eax, eax
jne 0x414eda
lea eax, [ebp - 0xf8]
push eax
push edi
push 0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0xf
push dword [ebp - 0xf4]
call dword [sym.imp.msi.dll_MsiUseFeatureA]
movzx eax, word [ebp - 0x128]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0xf8]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0xf8], 0x100
push eax
push 7
push dword [ebp - 0xf4]
call dword [sym.imp.msi.dll_MsiUseFeatureA]
mov dword [0x45771c], eax
cmp eax, 0xea
jne 0x413ee7
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
lea eax, [eax*2 + 6]
push eax
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x413ee2
lea ecx, [ebp - 0xf8]
mov edi, eax
push ecx
push eax
push 0
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0xdc], edi
push eax
push 7
push dword [ebp - 0xf4]
call dword [sym.imp.msi.dll_MsiUseFeatureA]
mov dword [0x45771c], eax
cmp eax, 0xea
je 0x413e83
jmp 0x413ee7
mov eax, dword [0x45771c]
test eax, eax
jne 0x414eda
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xec], eax
test eax, eax
je 0x413f1b
nop
movzx ecx, word [edi]
cmp ecx, 0x20
je 0x413f0d
cmp ecx, 9
jne 0x413f1b
add edi, 2
sub eax, 1
mov dword [ebp - 0xec], eax
jne 0x413f00
movzx ecx, word [edi]
cmp ecx, 0x58
je 0x413f28
cmp ecx, 0x78
jne 0x413f90
add edi, 2
cmp word [edi], 0x36
jne 0x413f90
add edi, 2
cmp word [edi], 0x34
jne 0x413f90
sub eax, 3
add edi, 2
mov dword [ebp - 0xec], eax
test eax, eax
je 0x413f6b
nop word [eax + eax]
movzx ecx, word [edi]
cmp ecx, 0x20
je 0x413f5d
cmp ecx, 9
jne 0x413f6b
add edi, 2
sub eax, 1
mov dword [ebp - 0xec], eax
jne 0x413f50
movzx eax, word [edi]
cmp eax, 0x3b
je 0x413f81
cmp eax, 0x2c
je 0x413f81
test ax, ax
jne 0x414092
mov dword [ebp - 0xf0], 9
jmp 0x414092
cmp eax, 5
jbe 0x414092
push 1
mov eax, 0xa
mov dword [0x45641c], edi
push 0x456410
push 0x456418
mov dword [0x456414], 0x449578
mov word [0x456410], ax
mov word [0x456418], ax
call dword [0x457674]
movzx eax, al
test eax, eax
jne 0x414013
push 1
mov eax, 0xa
mov dword [0x45641c], edi
push 0x456410
push 0x456418
mov dword [0x456414], 0x449584
mov word [0x456410], ax
mov word [0x456418], ax
call dword [0x457674]
movzx edx, al
test al, al
je 0x414092
jmp 0x414015
xor edx, edx
mov eax, dword [ebp - 0xec]
add edi, 0xa
sub eax, 5
mov dword [ebp - 0xec], eax
test eax, eax
je 0x41404b
nop dword [eax + eax]
movzx ecx, word [edi]
cmp ecx, 0x20
je 0x41403d
cmp ecx, 9
jne 0x41404b
add edi, 2
sub eax, 1
mov dword [ebp - 0xec], eax
jne 0x414030
movzx eax, word [edi]
cmp eax, 0x3b
je 0x414083
cmp eax, 0x2c
je 0x414083
test ax, ax
je 0x414083
cmp eax, 0x36
jne 0x414092
cmp word [edi + 2], 0x34
jne 0x414092
movzx eax, word [edi + 4]
cmp eax, 0x3b
je 0x414077
test ax, ax
jne 0x414092
mov dword [ebp - 0xf0], 6
jmp 0x414092
neg edx
sbb edx, edx
and edx, 9
mov eax, edx
mov dword [ebp - 0xf0], eax
push dword [ebp - 0xf4]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov ecx, dword [ebp - 0xe8]
mov eax, 0x23
mov word [ebp - 0x94], ax
mov edi, 0x4575a4
xor al, al
mov byte [ebp - 0xd5], al
xor eax, eax
mov word [0x4575a4], ax
mov eax, 0xcccccccd
sub edi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
mov al, byte [ebp - 0xd5]
add ecx, 0x30
add al, 1
mov word [edi], cx
mov ecx, edx
mov byte [ebp - 0xd5], al
test ecx, ecx
jne 0x4140c5
cmp al, 0x17
jbe 0x414101
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x414127
movzx eax, al
mov dword [0x457638], eax
mov al, byte [ebp - 0xd5]
inc al
movzx eax, al
add eax, eax
push eax
lea eax, [ebp - 0x92]
push edi
push eax
call fcn.0043c9e0
add esp, 0xc
lea eax, [ebp - 0xd4]
push eax
push 1
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.msi.dll_Migrate10CachedPackagesW]
mov dword [0x45771c], eax
cmp eax, 0x657
jne 0x4141c2
lea eax, [ebp - 0xf4]
xor edi, edi
push eax
push 1
push edi
push dword [ebp - 0xe8]
call dword [sym.imp.msi.dll_MsiGetUserInfoW]
test eax, eax
je 0x414edc
mov eax, dword [ebp - 0xf0]
movzx eax, ax
push dword [ebp + eax*4 - 0xc0]
push edi
push edi
push 0x1e
push 7
push dword [ebp - 0xf4]
call dword [sym.imp.msi.dll_MsiVerifyPackageW]
test eax, eax
jne 0x41419b
push dword [ebp - 0xf4]
call dword [sym.imp.msi.dll_MsiUseFeatureW]
push dword [ebp - 0xf4]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0xd4]
push eax
push 1
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.msi.dll_Migrate10CachedPackagesW]
mov dword [0x45771c], eax
xor edi, edi
test eax, eax
jne 0x414edc
mov edi, dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0xec], 0xa
push eax
push str.VersionNT
push dword [ebp - 0xd4]
call edi
lea eax, [ebp - 0xec]
mov dword [ebp - 0xec], 0xa
push eax
lea eax, [ebp - 0x50]
push eax
push str.WindowsBuild
push dword [ebp - 0xd4]
call edi
lea eax, [ebp - 0xec]
mov dword [ebp - 0xec], 0xa
push eax
lea eax, [ebp - 0x3c]
push eax
push str.ServicePackLevel
push dword [ebp - 0xd4]
call edi
lea eax, [ebp - 0xec]
mov dword [ebp - 0xec], 0xa
push eax
lea eax, [ebp - 0x28]
push eax
push str.ServicePackLevelMinor
push dword [ebp - 0xd4]
call edi
mov edi, dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
push 0x44db14
push str.VersionNT
push dword [ebp - 0xd4]
call edi
mov eax, dword [ebp - 0xf0]
cmp ax, 9
je 0x414284
cmp ax, 6
jne 0x414296
push 0x44db14
push str.VersionNT64
push dword [ebp - 0xd4]
call edi
push 0x44db08
push str.WindowsBuild
push dword [ebp - 0xd4]
call edi
push 0x44db04
push str.ServicePackLevel
push dword [ebp - 0xd4]
call edi
push 0x44db00
push str.ServicePackLevelMinor
push dword [ebp - 0xd4]
call edi
mov edi, dword [ebp - 0xdc]
mov eax, dword [0x456428]
mov dword [edi], eax
mov eax, dword [0x45642c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xf0]
test ax, ax
jne 0x4143d4
mov ax, word [0x4576fc]
cmp ax, 9
je 0x414306
cmp ax, 6
jne 0x414569
movups xmm0, xmmword [str.Program_Files_]
push edi
push str.ProgramFilesFolder
movups xmmword [edi + 4], xmm0
mov byte [ebp - 0x108], 1
movups xmm0, xmmword [0x449638]
movups xmmword [edi + 0x14], xmm0
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
movups xmm0, xmmword [str.Program_FilesCommon_Files_]
push edi
push str.CommonFilesFolder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x449680]
movups xmmword [edi + 0x14], xmm0
movups xmm0, xmmword [0x449690]
movups xmmword [edi + 0x24], xmm0
movq xmm0, qword [0x4496a0]
movq qword [edi + 0x34], xmm0
movzx eax, word [0x4496a8]
mov word [edi + 0x3c], ax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
movups xmm0, xmmword [str.WindowsSystem32_]
push edi
push str.SystemFolder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x4496e0]
movups xmmword [edi + 0x14], xmm0
mov eax, dword [0x4496f0]
mov dword [edi + 0x24], eax
movzx eax, word [0x4496f4]
mov word [edi + 0x28], ax
push dword [ebp - 0xd4]
mov edi, dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
call edi
push 0x443b48
push str.VersionNT64
push dword [ebp - 0xd4]
call edi
jmp 0x414569
cmp ax, 9
je 0x4143e4
cmp ax, 6
jne 0x414569
cmp word [0x4576fc], 0
jne 0x414569
movups xmm0, xmmword [str.Program_Files_]
push edi
push str.ProgramFiles64Folder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x449638]
movups xmmword [edi + 0x14], xmm0
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
movups xmm0, xmmword [str.Program_FilesCommon_Files_]
push edi
push str.CommonFiles64Folder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x449680]
movups xmmword [edi + 0x14], xmm0
movups xmm0, xmmword [0x449690]
movups xmmword [edi + 0x24], xmm0
movq xmm0, qword [0x4496a0]
movq qword [edi + 0x34], xmm0
movzx eax, word [0x4496a8]
mov word [edi + 0x3c], ax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
movups xmm0, xmmword [str.WindowsSystem32_]
push edi
push str.System64Folder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x4496e0]
movups xmmword [edi + 0x14], xmm0
mov eax, dword [0x4496f0]
mov dword [edi + 0x24], eax
movzx eax, word [0x4496f4]
mov word [edi + 0x28], ax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
movups xmm0, xmmword [str.Program_Files__x86__]
push edi
push str.ProgramFilesFolder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x449798]
movups xmmword [edi + 0x14], xmm0
movq xmm0, qword [0x4497a8]
movq qword [edi + 0x24], xmm0
mov eax, dword [0x4497b0]
mov dword [edi + 0x2c], eax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
movups xmm0, xmmword [str.Program_Files__x86_Common_Files_]
push edi
push str.CommonFilesFolder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x4497c8]
movups xmmword [edi + 0x14], xmm0
movups xmm0, xmmword [0x4497d8]
movups xmmword [edi + 0x24], xmm0
movups xmm0, xmmword [0x4497e8]
movups xmmword [edi + 0x34], xmm0
mov eax, dword [0x4497f8]
mov dword [edi + 0x44], eax
movzx eax, word [0x4497fc]
mov word [edi + 0x48], ax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
movups xmm0, xmmword [str.WindowsSysWOW64_]
push edi
push str.SystemFolder
movups xmmword [edi + 4], xmm0
movups xmm0, xmmword [0x449810]
movups xmmword [edi + 0x14], xmm0
mov eax, dword [0x449820]
mov dword [edi + 0x24], eax
movzx eax, word [0x449824]
mov word [edi + 0x28], ax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
lea eax, [ebp - 0xe4]
push eax
push str.SELECT__InstallExecuteSequence_._Action____InstallExecuteSequence_._Condition__FROM__CustomAction____Directory____InstallExecuteSequence__WHERE__CustomAction_._Source__Directory_._Directory__AND__CustomAction_._Action__InstallExecuteSequence_._Action__ORDER_BY__InstallExecuteSequence_._Sequence_
push dword [ebp - 0xe8]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
mov edi, dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x414617
push 0
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiViewModify]
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe4]
call edi
test eax, eax
jne 0x4145ff
mov ecx, dword [ebp - 0xe0]
mov edx, 2
call fcn.0040c8f0
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
cmp eax, 1
jne 0x4145ec
mov ecx, dword [ebp - 0xe0]
mov edx, eax
call fcn.0040c8f0
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiEnumComponentQualifiersA]
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe4]
call edi
test eax, eax
je 0x4145b0
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiViewGetErrorW]
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov esi, dword [sym.imp.msi.dll_MsiEnumComponentQualifiersA]
push str.CostInitialize
push dword [ebp - 0xd4]
call esi
push str.FileCost
push dword [ebp - 0xd4]
call esi
push str.CostFinalize
push dword [ebp - 0xd4]
call esi
push str.ResolveSource
push dword [ebp - 0xd4]
call esi
mov edi, dword [sym.imp.msi.dll_MsiRecordSetStringW]
xor esi, esi
mov dword [ebp - 0xdc], esi
nop
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + esi*4 - 0x124]
push dword [ebp - 0xe8]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jne 0x41473c
push eax
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiViewModify]
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x414724
mov esi, dword [ebp - 0x100]
push 3
push 1
push dword [ebp - 0xe0]
call edi
push 3
push 2
push dword [ebp - 0xe0]
call edi
push 3
push 3
push dword [ebp - 0xe0]
call edi
push 3
push 4
push dword [ebp - 0xe0]
call edi
push 3
push 5
push dword [ebp - 0xe0]
call edi
push dword [ebp - 0xe0]
push 2
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiRecordClearData]
lea eax, [ebp - 0xe0]
inc esi
push eax
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
je 0x4146b0
mov dword [ebp - 0x100], esi
mov esi, dword [ebp - 0xdc]
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiViewGetErrorW]
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
inc esi
mov dword [ebp - 0xdc], esi
cmp esi, 2
jb 0x414660
lea eax, [ebp - 0xe4]
mov dword [ebp - 0x110], 0
push eax
push str.SELECT__InstallExecuteSequence_._Action____InstallExecuteSequence_._Condition____CustomAction_._Type____CustomAction_._Source____CustomAction_._Target__FROM__CustomAction____InstallExecuteSequence__WHERE__InstallExecuteSequence_._Action__CustomAction_._Action__AND___CustomAction_._Type_51_OR__CustomAction_._Type_35_OR__CustomAction_._Type_50_OR__CustomAction_._Type_34__ORDER_BY__InstallExecuteSequence_._Sequence_
push dword [ebp - 0xe8]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
mov esi, dword [ebp - 0xfc]
test eax, eax
jne 0x4149f3
push 0
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiViewModify]
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x4149db
nop word [eax + eax]
mov ecx, dword [ebp - 0xe0]
mov edx, 2
call fcn.0040c8f0
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
test eax, eax
je 0x4149c0
push 3
push dword [ebp - 0xe0]
call dword [sym.imp.msi.dll_MsiRecordReadStream]
mov ecx, dword [ebp - 0xe0]
cmp eax, 0x31
jle 0x41480a
mov edx, 1
call fcn.0040c8f0
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiEnumComponentQualifiersA]
jmp 0x4149c0
mov edx, 4
call fcn.0040c8f0
mov eax, dword [ebp - 0xe0]
test esi, esi
mov dword [ebp - 0x100], eax
mov edi, esi
mov eax, dword [ebp - 0xd4]
sete byte [ebp - 0xd5]
mov dword [ebp - 0x120], eax
xor ecx, ecx
mov eax, dword [0x4574a0]
mov dword [ebp - 0xdc], eax
mov eax, dword [0x4574a4]
mov word [eax], cx
test esi, esi
jne 0x41485f
push 1
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
mov edi, eax
mov eax, dword [0x4574a4]
lea ecx, [ebp - 0xdc]
push ecx
push eax
push 5
push dword [ebp - 0x100]
call dword [sym.imp.msi.dll_MsiRecordSetStreamA]
mov dword [0x45771c], eax
cmp eax, 0xea
jne 0x4148ec
mov esi, dword [ebp - 0x100]
nop word [eax + eax]
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
add eax, eax
push eax
push dword [0x4574a4]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x4148e6
mov ecx, dword [ebp - 0xdc]
mov dword [0x4574a0], ecx
lea ecx, [ebp - 0xdc]
push ecx
push eax
push 5
push esi
mov dword [0x4574a4], eax
call dword [sym.imp.msi.dll_MsiRecordSetStreamA]
mov dword [0x45771c], eax
cmp eax, 0xea
je 0x414890
mov esi, dword [ebp - 0xfc]
push dword [0x4574a4]
push 0
push edi
call dword [sym.imp.msi.dll_MsiReinstallFeatureW]
mov eax, dword [0x45749c]
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xdc]
push eax
push dword [0x4574a8]
push edi
push dword [ebp - 0x120]
call dword [sym.imp.msi.dll_MsiApplyPatchW]
mov dword [0x45771c], eax
cmp eax, 0xea
jne 0x41498d
mov esi, dword [ebp - 0x120]
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
add eax, eax
push eax
push dword [0x4574a8]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x414987
mov ecx, dword [ebp - 0xdc]
mov dword [0x45749c], ecx
lea ecx, [ebp - 0xdc]
push ecx
push eax
push edi
push esi
mov dword [0x4574a8], eax
call dword [sym.imp.msi.dll_MsiApplyPatchW]
mov dword [0x45771c], eax
cmp eax, 0xea
je 0x414932
mov esi, dword [ebp - 0xfc]
cmp byte [ebp - 0xd5], 0
je 0x41499d
push edi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
push dword [0x4574a8]
mov eax, dword [ebp - 0xdc]
push dword [0x4574a4]
mov dword [0x457638], eax
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiSummaryInfoPersist]
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
je 0x4147b0
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiViewGetErrorW]
push dword [ebp - 0xe4]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test byte [ebp - 0x104], 4
jne 0x414a25
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0x134]
push esi
push dword [ebp - 0xe8]
call fcn.0040eb50
mov edi, dword [ebp - 0x12c]
add esp, 8
mov dword [ebp - 0x11c], edi
jmp 0x414a27
xor edi, edi
mov edx, dword [ebp - 0xe8]
lea ecx, [ebp - 0x14c]
call fcn.0040e8a0
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0x118]
push esi
push dword [ebp - 0xe8]
call fcn.0040d860
push dword [ebp - 0xe8]
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x140]
call fcn.0040f1a0
add esp, 0xc
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x19c]
push esi
push dword [ebp - 0xe8]
push dword [ebp - 0xd4]
call fcn.0040f4a0
add esp, 0xc
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x158]
push esi
push dword [ebp - 0xe8]
push dword [ebp - 0xd4]
call fcn.0040fca0
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0x1b0]
add esp, 0xc
push esi
push dword [ebp - 0xe8]
call fcn.0040dd30
push dword [ebp - 0xe8]
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0x190]
call fcn.0040e4d0
add esp, 0xc
lea eax, [ebp - 0x190]
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x164]
push esi
push dword [ebp - 0xe8]
push dword [ebp - 0xd4]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.00410460
lea ecx, [ebp - 0x164]
call fcn.00415c10
push edi
push str.MsiMediaList_cMediaData__d_n
call fcn.00428ca0
add esp, 0x20
test edi, edi
je 0x414b62
mov edi, dword [ebp - 0x134]
mov esi, dword [ebp - 0x11c]
add edi, 0x38
nop dword [eax]
push dword [edi - 4]
movzx eax, word [edi]
push eax
push str.FileCount__d___cbFileSizeList__d_n
call fcn.00428ca0
add esp, 0xc
lea edi, [edi + 0x44]
sub esi, 1
jne 0x414b40
mov esi, dword [ebp - 0xfc]
push dword [ebp - 0x110]
push str.MsiFileList_cFileData__d_n
call fcn.00428ca0
mov edi, dword [ebp - 0x108]
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0x118]
push edi
push dword [ebp - 0x104]
push eax
call fcn.00413080
mov eax, dword [ebp - 0x138]
add esp, 0x14
test eax, eax
je 0x414bbf
mov eax, dword [ebp - 0x140]
push dword [eax]
push str.FileIndex_1__d_n
call fcn.00428ca0
mov eax, dword [ebp - 0x138]
add esp, 8
push eax
push str.MsiSelfRegList_cFileIndex__d_n
call fcn.00428ca0
push dword [ebp - 0x194]
push str.MsiShortcutList_cShortcutData__d_n
call fcn.00428ca0
push dword [ebp - 0x150]
push str.MsiServiceList_cServiceData__d_n
call fcn.00428ca0
push dword [ebp - 0x1a8]
push str.MsiRegList_cRegData__d_n
call fcn.00428ca0
push dword [ebp - 0x15c]
push str.MsiSecurityList_cSecurityData__d_n
call fcn.00428ca0
push str.PAUSE
call fcn.0042d1e9
add esp, 0x2c
lea edx, [ebp - 0x184]
lea ecx, [ebp - 0x1b0]
push edi
call fcn.00411760
add esp, 4
test al, al
je 0x414ce2
cmp dword [ebp - 0x174], 0
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
je 0x414c64
push str._AddReg__n
call edi
mov eax, dword [ebp - 0x184]
mov ecx, str._NULL_PTR_
test eax, eax
cmovne ecx, eax
push ecx
call edi
push 0x44a068
call edi
cmp dword [ebp - 0x168], 0
je 0x414c8e
push str._lpBackUpReg__n
call edi
mov eax, dword [ebp - 0x178]
mov ecx, str._NULL_PTR_
test eax, eax
cmovne ecx, eax
push ecx
call edi
push 0x44a068
call edi
cmp dword [ebp - 0x170], 0
je 0x414cb8
push str._DelRegUnst__n
call edi
mov eax, dword [ebp - 0x180]
mov ecx, str._NULL_PTR_
test eax, eax
cmovne ecx, eax
push ecx
call edi
push 0x44a068
call edi
cmp dword [ebp - 0x16c], 0
je 0x414ce2
push str._DelReg__n
call edi
mov eax, dword [ebp - 0x17c]
mov ecx, str._NULL_PTR_
test eax, eax
cmovne ecx, eax
push ecx
call edi
push 0x44a068
call edi
mov edi, dword [ebp - 0x144]
push edi
push str.MsiFeatureList_cFeatureData__d_n
mov dword [ebp - 0x104], edi
call fcn.00428ca0
push edi
push str.MsiFeatureList.cFeatureData__d_n
call fcn.00428ca0
add esp, 0x10
mov dword [ebp - 0xf0], 0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push str.C:UsersVjollcaRadaAppDataLocalTempMSIFeL.au3
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x108], eax
cmp eax, 0xffffffff
je 0x414eaf
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0xf0]
push 0
push ecx
push 0x1cd
push str.include__Array.au3__r_nGlobal__aString___aList_1__12____y__0___n__1___cLine_r_n_aString__StringSplit_FileRead__ScriptDir___MSIFeL.txt____ChrW_0___ChrW_0___ChrW_0___ChrW_0___1__r_nIf_NOT_IsArray__aString__Then_Exit_r_n_If__BitAND__aString_0___1___Then__aString_0____1_r_n_cLine__INT__aString_0____5__r_nReDim__aList__cLine__15__12__r_nFor__i__1_To__cLine_r_n_tFor__y__0_To_4__r_n_t_t_aList__i___y____aString__n__r_n_t_t_n__1_r_n_tNext_r_nNext_r_n_ArrayDisplay__aList___cLine__r_n
push eax
call edi
push dword [ebp - 0x108]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push str.C:UsersVjollcaRadaAppDataLocalTempMSIFeL.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xdc], eax
cmp eax, 0xffffffff
je 0x414eaf
push 0
lea ecx, [ebp - 0xf0]
push ecx
push 2
push 0x44e5a7
push eax
call edi
cmp dword [ebp - 0x144], 0
je 0x414e1b
mov esi, dword [ebp - 0x14c]
mov edi, 1
nop dword [eax + eax]
push 0
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [esi + edi*4 + 0x18]
add eax, eax
push eax
push dword [esi + edi*4]
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xf0]
push eax
push 8
push 0x44a170
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, 6
jb 0x414dc0
mov eax, dword [ebp - 0x104]
add esi, 0x48
dec eax
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x414db3
mov esi, dword [ebp - 0xfc]
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3c
lea eax, [ebp - 0xd0]
push 0
push eax
call fcn.0042a4e0
add esp, 0xc
mov dword [ebp - 0xd0], 0x3c
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xcc], 0x4040
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
push eax
mov dword [ebp - 0xc0], str.C:Program_Files__x86_AutoIt3AutoIt3.exe
mov dword [ebp - 0xbc], str.C:UsersVjollcaRadaAppDataLocalTempMSIFeL.au3
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0xb0], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xd4]
call fcn.004151b0
push 0x6f
push str.xxxxx__u_n
call fcn.00428ca0
push str.PAUSE
call fcn.0042d1e9
add esp, 0xc
mov edi, 1
jmp 0x414edc
xor edi, edi
push dword [ebp - 0xe8]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
push dword [ebp - 0xd4]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test esi, esi
je 0x414eff
push esi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret