Function at 0x40e8e0
Capabilities:
Get token membership

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x004413e8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rdx
mov edi, ecx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov rdx, rsi
mov ecx, edi
call fcn.0040e0f0
mov ebx, eax
test eax, eax
js 0x40eda9
cmp byte [0x0044292a], 0
je 0x40e981
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cmp rax, 0xffffffffffffffff
je 0x40e967
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
or r12, 0xffffffffffffffff
jmp 0x40e985
or r12, 0xffffffffffffffff
mov r8, r12
lea rdx, str.MinimizeConsoleWindow_failed._hwdConsole___d
lea ecx, [r12 + 3]
call fcn.004139f0
jmp 0x40e985
or r12, 0xffffffffffffffff
call fcn.00413b30
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, str.PROCESSOR_ARCHITECTURE
lea rcx, [rsp + 0x78]
call fcn.004141f0
nop
xor eax, eax
lea rdi, [0x00433730]
mov rsi, qword [rsp + 0x78]
mov ecx, 4
repe cmpsw word [rsi], word [rdi]
je 0x40e9c1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne byte [0x00442928]
lea rdx, str.INSTALLER_WINNING_COMPONENT_IDENTITY
lea rcx, [rsp + 0x70]
call fcn.004141f0
nop
mov rax, qword [rsp + 0x70]
cmp dword [rax - 0x10], 0
setne dil
lea rdx, str.INSTALLER_SHADOWED_COMPONENT_PAYLOAD
lea rcx, [rsp + 0x68]
call fcn.004141f0
nop
mov rax, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
setne al
cmp dword [0x0044292c], 2
jne 0x40ea30
test dil, dil
je 0x40ea35
test al, al
je 0x40ea30
lea rdx, str.WFServicesReg.exe_custom_action_is_being_run_from_generic_command_for_uninstall_action
xor ecx, ecx
call fcn.004139f0
xor edi, edi
mov ebx, edi
jmp 0x40ecfb
test dil, dil
jne 0x40ea41
test al, al
jne 0x40ea41
mov byte [0x0044292b], al
jmp 0x40ea48
mov byte [0x0044292b], 1
xor edi, edi
mov dword [rsp + 0x60], edi
mov byte [rsp + 0xb8], dil
mov byte [rsp + 0xb9], dil
mov byte [rsp + 0xba], dil
mov byte [rsp + 0xbb], dil
mov byte [rsp + 0xbc], dil
mov byte [rsp + 0xbd], 5
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9d, 0x220
lea r8d, [rdi + 0x20]
mov dl, 2
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x40eae7
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, edi
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], edi
jne 0x40eb11
lea rdx, str.Please_run_this_program_with_administrator_privileges
mov ecx, 2
call fcn.004139f0
jmp 0x40ecfb
mov eax, dword [0x00442930]
cmp eax, 2
setne sil
cmp eax, 1
setne r13b
cmp eax, 2
sete r14b
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
movzx edx, byte [0x00442928]
lea rcx, [rsp + 0x88]
call fcn.004055f0
mov ebx, eax
test eax, eax
jns 0x40eb8b
mov r8d, eax
lea rdx, str.Failed_to_copy_config_files_to_temp_directory._Error_code:_0x_x
mov ecx, 2
call fcn.004139f0
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x40eb86
call fcn.00416450
nop
jmp 0x40ecfb
cmp dword [0x0044292c], 1
jne 0x40ec43
cmp dword [0x00442930], 2
jne 0x40ebe7
movzx edx, byte [0x00442928]
lea rcx, [rsp + 0x88]
call 0x404420
test al, al
jne 0x40ebe7
lea rdx, str.Cannot_install_web_script_maps_because_base_configuration_is_not_installed.
mov ecx, 2
call fcn.004139f0
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x40ebe2
call fcn.00416450
nop
jmp 0x40ecfb
movzx r9d, r14b
movzx r8d, r13b
movzx edx, sil
lea rcx, [rsp + 0x88]
call fcn.004069a0
mov ebx, eax
test eax, eax
jns 0x40ec33
mov r8d, eax
lea rdx, str.Setup_failed._Error_code:_0x_x
mov ecx, 2
call fcn.004139f0
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x40ec2e
call fcn.00416450
nop
jmp 0x40ecfb
lea rdx, str.Installation_succeeded.
xor ecx, ecx
call fcn.004139f0
jmp 0x40ec9a
movzx r9d, r14b
movzx r8d, r13b
movzx edx, sil
lea rcx, [rsp + 0x88]
call fcn.00406740
mov ebx, eax
test eax, eax
jns 0x40ec8c
mov r8d, eax
lea rdx, str.Setup_failed._Error_code:_0x_x
mov ecx, 2
call fcn.004139f0
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x40ec8a
call fcn.00416450
nop
jmp 0x40ecfb
lea rdx, str.Uninstallation_succeeded.
xor ecx, ecx
call fcn.004139f0
movzx edx, byte [0x00442928]
lea rcx, [rsp + 0x88]
call fcn.00405980
mov ebx, eax
test eax, eax
jns 0x40ecde
mov r8d, eax
lea rdx, str.Failed_to_copy_modified_config_files_from_temp_directory._Error_code:_0x_x
mov ecx, 2
call fcn.004139f0
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x40ecdc
call fcn.00416450
nop
jmp 0x40ecfb
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x40ecf1
call fcn.00416450
nop
jmp 0x40ecfb
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [0x0044292a], 0
je 0x40ed3a
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cmp rax, 0xffffffffffffffff
je 0x40ed26
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40ed3a
mov r8, r12
lea rdx, str.RestoreConsoleWindow_failed._hwdConsole___d
mov ecx, 2
call fcn.004139f0
mov ecx, ebx
call fcn.00413b50
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40ed64
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40ed86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40eda7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.00417510
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret