Function at 0x180034a90
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
cmp qword [rsp + 0xf0], 0
je 0x180034ac4
mov rax, qword [rsp + 0xf0]
movzx eax, word [rax]
test eax, eax
jne 0x180034ada
mov ecx, 3
call fcn.1800357e0
mov rax, 0xffffffffffffffff
jmp 0x180034fd6
cmp dword [rsp + 0x110], 1
jb 0x180034aee
cmp dword [rsp + 0x110], 5
jbe 0x180034b04
mov ecx, 0x57
call fcn.1800357e0
mov rax, 0xffffffffffffffff
jmp 0x180034fd6
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
movzx eax, al
test eax, eax
jne 0x180034b3d
mov ecx, 3
call fcn.1800357e0
mov rax, 0xffffffffffffffff
jmp 0x180034fd6
mov dword [rsp + 0xa0], 0
mov eax, dword [rsp + 0x118]
and eax, 0x2000000
test eax, eax
je 0x180034b6c
mov eax, dword [rsp + 0xa0]
bts eax, 0xe
mov dword [rsp + 0xa0], eax
jmp 0x180034b7d
mov eax, dword [rsp + 0xa0]
or eax, 0x40
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x118]
and eax, 0x4000000
test eax, eax
je 0x180034bb1
mov eax, dword [rsp + 0xa0]
bts eax, 0xc
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xf8]
bts eax, 0x10
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0x118]
and eax, 0x200000
test eax, eax
je 0x180034bd3
mov eax, dword [rsp + 0xa0]
bts eax, 0x15
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x118]
and eax, 0x100000
test eax, eax
je 0x180034bf5
mov eax, dword [rsp + 0xa0]
bts eax, 0x16
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x118]
and eax, 0x40000000
test eax, eax
je 0x180034c18
mov eax, dword [rsp + 0xa0]
or eax, 0x20
mov dword [rsp + 0xa0], eax
jmp 0x180034c29
mov eax, dword [rsp + 0xa0]
or eax, 0x10
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x118]
and eax, 0x10000000
test eax, eax
je 0x180034c4b
mov eax, dword [rsp + 0xa0]
bts eax, 0xb
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x118]
and eax, 0x20000000
test eax, eax
je 0x180034c6c
mov eax, dword [rsp + 0xa0]
or eax, 8
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x118]
and eax, 0x80000000
test eax, eax
je 0x180034c8d
mov eax, dword [rsp + 0xa0]
or eax, 2
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x118]
and eax, 0x7fb7
mov dword [rsp + 0x118], eax
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], 0
cmp qword [rsp + 0x108], 0
je 0x180034cd2
mov rax, qword [rsp + 0x108]
mov rax, qword [rax + 8]
mov qword [rsp + 0xd0], rax
jmp 0x180034cde
mov qword [rsp + 0xd0], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], MsiGetProductInfoW
cmp qword [rsp + 0x108], 0
je 0x180034d3f
mov rax, qword [rsp + 0x108]
cmp dword [rax + 0x10], 0
je 0x180034d3f
mov eax, dword [rsp + 0x88]
or eax, 2
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0xf8]
or eax, 0x100080
mov dword [rsp + 0xf8], eax
mov qword [rsp + 0xa8], 0
mov eax, dword [rsp + 0x110]
dec eax
mov eax, eax
lea rcx, [0x1801a8200]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x40], edx
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0xf8]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_ZwCreateFile]
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 0
je 0x180034fc0
mov qword [rsp + 0xa8], 0xffffffffffffffff
cmp dword [rsp + 0xa4], 0xc0000043
jne 0x180034e2d
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov ecx, dword [rsp + 0xa4]
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call fcn.1800357e0
mov rax, qword [rsp + 0xa8]
jmp 0x180034fd6
cmp qword [rsp + 0xa8], 0xffffffffffffffff
jne 0x180034fc0
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], 0
cmp qword [rsp + 0x108], 0
je 0x180034e84
mov rax, qword [rsp + 0x108]
mov rax, qword [rax + 8]
mov qword [rsp + 0xd8], rax
jmp 0x180034e90
mov qword [rsp + 0xd8], 0
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], MsiGetProductInfoW
cmp qword [rsp + 0x108], 0
je 0x180034ef1
mov rax, qword [rsp + 0x108]
cmp dword [rax + 0x10], 0
je 0x180034ef1
mov eax, dword [rsp + 0x88]
or eax, 2
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0xf8]
or eax, 0x100080
mov dword [rsp + 0xf8], eax
mov eax, dword [rsp + 0x110]
dec eax
mov eax, eax
lea rcx, [0x1801a8200]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x40], edx
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0xf8]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_ZwCreateFile]
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 0
je 0x180034fc0
mov qword [rsp + 0xa8], 0xffffffffffffffff
cmp dword [rsp + 0xa4], 0xc0000035
jne 0x180034fad
mov ecx, 0x50
call fcn.1800357e0
jmp 0x180034fc0
mov ecx, dword [rsp + 0xa4]
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call fcn.1800357e0
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov rax, qword [rsp + 0xa8]
add rsp, 0xe8
ret