Function at 0x10000b6a4
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x24b0
call fcn.100017bc0
sub rsp, rax
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x24a0], rax
mov rdi, rcx
lea rax, [rsp + 0x108]
lea rcx, [rsp + 0x770]
mov r12d, 1
mov dword [rsp + 0x770], 0x11c
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x100], r12d
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx edx, byte [0x10001db35]
xor r14d, r14d
mov r13d, 0x104
cmp eax, r14d
mov rax, qword [0x10001c050]
cmovne edx, r12d
mov byte [0x10001db35], dl
mov word [rax], r14w
mov rax, qword [0x10001c860]
mov word [rax], r14w
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea esi, [r12 + 0x1f]
lea ecx, [rsi + 2]
mov rbx, rax
cmp word [rax], cx
jne 0x10000b77c
add rbx, 2
jmp 0x10000b77f
mov cx, si
mov ax, word [rbx]
cmp ax, r14w
je 0x10000b7a4
cmp ax, cx
je 0x10000b79a
add rbx, 2
mov ax, word [rbx]
cmp ax, r14w
jne 0x10000b788
cmp word [rbx], r14w
je 0x10000b7a4
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x10001db10], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x10001e050], rax
cmp rax, 0xffffffffffffffff
je 0x10000b7d1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, r14d
jne 0x10000b7d8
mov qword [0x10001e050], r14
mov edi, 0x7fe
lea rcx, [rsp + 0xca2]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0xb4], r14d
mov word [rsp + 0xca0], r14w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x14a2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x14a0], r14w
call sub.msvcrt.dll_memset
lea r11, [rsp + 0xca0]
lea r15, [rsp + 0x14a0]
mov qword [rsp + 0x80], r11
mov dword [rsp + 0x88], r14d
mov dword [0x10001db28], r14d
mov ebp, 9
cmp word [rbx], si
je 0x10000b851
cmp word [rbx], bp
jne 0x10000b857
add rbx, 2
jmp 0x10000b847
cmp word [rbx], 0x2f
je 0x10000b867
cmp word [rbx], 0x2d
jne 0x10000bb22
lea rax, [rbx + 2]
cmp rax, r14
je 0x10000bb22
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x10000bb22
add rbx, 4
mov qword [rsp + 0x60], rbx
cmp word [rbx], si
je 0x10000b897
cmp word [rbx], bp
jne 0x10000b89d
add rbx, 2
jmp 0x10000b888
lea rax, [rsp + 0xca0]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x78], rax
call fcn.10000b2f8
cmp al, r14b
jne 0x10000b91f
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000b8e5
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000b915
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x667
jmp 0x10000de65
mov eax, dword [rsp + reloc.msi.dll_MsiBeginTransactionA]
lea rdx, [0x100002b50]
mov r9d, 0x20019
add eax, eax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x9c], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x10000bad3
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
jne 0x10000ba3c
mov ebx, dword [rsp + 0x98]
shr ebx, 1
cmp ebx, r13d
jle 0x10000b9cf
mov edx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000b9d7
lea rdi, [rsp + 0x120]
cmp rdi, r14
je 0x10000ba81
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000b9fb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x110], rdi
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r14d
jne 0x10000bad3
cmp dword [rsp + 0x9c], r12d
jne 0x10000bad3
mov rbx, qword [rsp + 0x110]
mov rdx, rsi
movzx edi, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, dx
je 0x10000ba7b
cmp di, bp
jne 0x10000c18a
add rbx, 2
jmp 0x10000ba65
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000ba99
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000bac9
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0xe
jmp 0x10000de65
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000baeb
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000bb1b
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10000de65
mov ebp, 0x7fffffff
mov rax, rbx
mov rcx, rbp
cmp word [rax], r14w
je 0x10000bb3c
add rax, 2
sub rcx, r12
jne 0x10000bb2d
cmp rcx, r14
je 0x10000de18
mov rsi, rbp
sub rsi, rcx
inc esi
cmp esi, r13d
jle 0x10000bb68
movsxd rdx, esi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000bb70
lea rdi, [rsp + 0x120]
cmp rdi, r14
je 0x10000ba81
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000bb94
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [0x100000000]
lea rax, [0x100002bd8]
lea rcx, [rsp + 0xab0]
mov qword [rsp + 0xb00], rax
lea rax, [0x100002be8]
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0xb18], rax
lea rax, [0x100002c10]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], esi
mov qword [rsp + 0xb38], rax
mov word [rdi], r14w
lea rax, [0x100002c18]
mov qword [rsp + 0xb48], rax
lea rax, [0x100002c24]
lea rdi, [0x100002c00]
mov qword [rsp + 0xb50], rax
lea rax, [0x100002c30]
mov r8d, 0x20
mov qword [rsp + 0xb60], rax
lea rax, [0x100002c40]
mov qword [rsp + 0xb08], r14
mov qword [rsp + 0xb68], rax
lea rax, [0x100002c48]
mov byte [rsp + 0xb10], r14b
mov qword [rsp + 0xb78], rax
lea rax, [0x100002c58]
mov qword [rsp + 0xb20], r14
mov qword [rsp + 0xb80], rax
lea rax, [0x100002c88]
mov byte [rsp + 0xb28], r14b
mov qword [rsp + 0xb90], rax
lea rax, [0x100002ca0]
mov qword [rsp + 0xb30], rdi
mov qword [rsp + 0xb98], rax
lea rax, [0x100002cd0]
mov byte [rsp + 0xb40], r12b
mov qword [rsp + 0xba8], rax
lea rax, [0x100002cf0]
mov byte [rsp + 0xb58], r12b
mov qword [rsp + 0xbb0], rax
lea rax, [0x100002d10]
mov byte [rsp + 0xb70], r12b
mov qword [rsp + 0xbc0], rax
lea rax, [0x100002d30]
mov byte [rsp + 0xb88], r12b
mov qword [rsp + 0xbc8], rax
lea rax, [0x100002d50]
mov byte [rsp + 0xba0], r12b
mov qword [rsp + 0xbd8], rax
lea rax, [0x100002d58]
mov byte [rsp + 0xbb8], r12b
mov qword [rsp + 0xbe0], rax
mov eax, dword [rdx + 0x2d60]
mov byte [rsp + 0xbd0], r12b
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d64]
mov byte [rsp + 0xbe8], r12b
mov word [rcx + 4], ax
mov eax, dword [rdx + 0x2d68]
lea rcx, [rsp + 0xab8]
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d6c]
mov word [rcx + 4], ax
mov rax, qword [rdx + 0x2d70]
lea rcx, [rsp + 0xad0]
mov qword [rcx], rax
mov eax, dword [rdx + 0x2d78]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x2d7c]
lea rdx, [0x100002d80]
mov word [rcx + 0xc], ax
lea rcx, [rsp + 0xae0]
call sub.msvcrt.dll_memcpy
mov r11, rbp
mov rax, rdi
cmp word [rax], r14w
je 0x10000bda7
add rax, 2
sub r11, r12
jne 0x10000bd98
cmp r11, r14
je 0x10000de18
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
sub rbp, r11
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], r14
call fcn.100007abc
mov rdi, rax
cmp rax, r14
je 0x10000be9e
mov rsi, qword [rsp + 0x68]
cmp word [rdi], r14w
je 0x10000be9e
cmp word [rdi], 0x2d
je 0x10000bdf3
cmp word [rdi], 0x2f
jne 0x10000be6a
lea r12, [rsi - 1]
mov ecx, 1
cmp r12, rcx
jne 0x10000be30
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x100002da0]
mov edx, ecx
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf89
cmp rbp, r12
mov r12d, 1
jne 0x10000be6a
lea rax, [0x100002c00]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf8f
mov rsi, r14
mov qword [rsp + 0x68], r14
cmp qword [rsp + 0x78], r14
je 0x10000be92
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.100007abc
mov rsi, qword [rsp + 0x68]
mov rdi, rax
jmp 0x10000be95
mov rdi, r14
cmp rdi, r14
jne 0x10000bddd
lea rax, [rsp + 0xab8]
mov byte [rsp + 0xb10], r12b
mov byte [rsp + 0xb28], r12b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xab0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0xb20], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], r14
call fcn.100007abc
mov rbx, rax
cmp rax, r14
je 0x10000c07e
mov rdi, qword [rsp + 0x68]
cmp word [rbx], r14w
je 0x10000c07e
cmp word [rbx], 0x2d
je 0x10000bf0e
cmp word [rbx], 0x2f
jne 0x10000bf66
mov ebp, r14d
mov rsi, r14
lea r12, [rsp + 0xb00]
mov rax, qword [r12]
or dword [rsp + 0x28], 0xffffffff
lea r9d, [rdi - 1]
lea r8, [rbx + 2]
mov edx, 1
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bfbc
mov eax, 1
add r12, 0x18
add ebp, eax
add rsi, rax
cmp ebp, 0xa
jb 0x10000bf1c
xor r14d, r14d
mov r13d, 0x104
mov r12, rax
lea rcx, [rsp + 0x110]
mov r9b, r12b
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x11c], r13d
call fcn.100007bbc
jmp 0x10000c037
mov r12d, 1
lea rax, [rsp + 0xad0]
mov byte [rsp + 0xb10], r14b
mov byte [rsp + 0xb28], r14b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xae0]
jmp 0x10000bec6
lea rax, [rsi + rsi*2]
xor r14d, r14d
mov r13d, 0x104
mov r10, qword [rsp + rax*8 + 0xb08]
mov r9b, byte [rsp + rax*8 + 0xb10]
mov dword [rsp + 0x11c], r13d
mov r8, r14
cmp r10, r14
je 0x10000c013
mov r11d, 0x7fffffff
mov rcx, r10
mov edx, r14d
mov rax, r11
lea r8d, [r14 + 1]
cmp word [rcx], r14w
je 0x10000c00b
add rcx, 2
sub rax, r8
jne 0x10000bffc
cmp rax, r14
jne 0x10000c06a
mov r8, r14
mov edx, 0x80070057
cmp edx, r14d
jl 0x10000c0d4
lea rcx, [rsp + 0x110]
mov rdx, r10
call fcn.100007bbc
mov r12d, 1
mov ebx, eax
cmp eax, r14d
jne 0x10000c0d9
mov rdi, r14
mov qword [rsp + 0x68], r14
cmp qword [rsp + 0x78], r14
je 0x10000c072
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.100007abc
mov rdi, qword [rsp + 0x68]
mov rbx, rax
jmp 0x10000c075
mov r8, r11
sub r8, rax
jmp 0x10000c018
mov rbx, r14
cmp rbx, r14
jne 0x10000bef8
mov rbx, qword [rsp + 0x110]
mov rax, r14
cmp rbx, r14
je 0x10000c0b4
mov r8d, 0x7fffffff
mov rax, rbx
mov edx, r14d
mov rcx, r8
cmp word [rax], r14w
je 0x10000c0ac
add rax, 2
sub rcx, r12
jne 0x10000c09d
cmp rcx, r14
jne 0x10000c12c
mov rax, r14
mov edx, 0x80070057
cmp edx, r14d
jge 0x10000c134
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000de30
mov rcx, rbx
jmp 0x10000de2a
mov ebx, 0x65b
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000c0f1
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
jle 0x10000c125
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
jmp 0x10000de65
mov rax, r8
sub rax, rcx
jmp 0x10000c0b9
mov edx, 0x20
cmp rax, r14
jbe 0x10000c167
lea rcx, [rbx + rax*2 - 2]
lea eax, [rdx - 0x17]
cmp word [rcx], dx
je 0x10000c150
cmp word [rcx], ax
jne 0x10000c17c
cmp rcx, rbx
jb 0x10000c17c
mov word [rcx], r14w
mov rbx, qword [rsp + 0x110]
sub rcx, 2
jmp 0x10000c146
mov eax, 9
jmp 0x10000c17c
cmp di, dx
je 0x10000c178
cmp di, ax
jne 0x10000c18a
add rbx, 2
mov di, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, r14w
jne 0x10000c16e
mov r12, qword [0x10001e058]
mov eax, MsiGetPropertyW
mov esi, r14d
mov ebp, 0x667
lea r8, [0x100001a30]
lea r9d, [rax + 0xd]
cmp di, r14w
je 0x10000c890
cmp di, 0x2f
je 0x10000c2fc
cmp di, 0x2d
je 0x10000c2fc
lea rcx, [rsp + 0x8a0]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x8a0]
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x890], rax
mov dword [rsp + 0x898], r13d
mov dword [rsp + 0x89c], r13d
call fcn.10000b3c8
cmp eax, r14d
je 0x10000c78d
mov r12, qword [rsp + 0x890]
cmp r12, r14
je 0x10000c29f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10001db44]
lea edx, [rax + rcx + 2]
lea rcx, [0x10001c050]
mov edi, eax
call fcn.10000f278
cmp al, r14b
je 0x10000c297
mov rax, qword [0x10001c050]
movsxd rbx, dword [0x10001db44]
mov r8d, 0x20
mov rcx, rbx
inc ebx
mov word [rax + rcx*2], r8w
lea eax, [rdi + 1]
movsxd rcx, ebx
movsxd rdx, eax
mov rax, qword [0x10001c050]
mov r8, r12
lea rcx, [rax + rcx*2]
mov dword [0x10001db44], ebx
call fcn.100004d68
cmp eax, r14d
jl 0x10000c297
add ebx, edi
mov dword [0x10001db44], ebx
mov r12, qword [rsp + 0x890]
mov rbx, qword [rsp + 0x60]
mov edx, 0x20
lea r14d, [rdx - 0x17]
mov di, word [rbx]
cmp di, dx
je 0x10000c2bb
cmp di, r14w
jne 0x10000c2c6
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c2ad
cmp dword [rsp + 0x898], r13d
mov r14d, 0
jle 0x10000c2f0
cmp r12, r14
je 0x10000c2f0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12, qword [0x10001e058]
jmp 0x10000c76c
mov r12, qword [0x10001e058]
jmp 0x10000c771
add rbx, 2
mov qword [rsp + 0x60], rbx
movzx eax, word [rbx]
mov ecx, eax
or ecx, edx
cmp r14w, ax
je 0x10000c31b
add rbx, 2
mov qword [rsp + 0x60], rbx
mov r13, r8
mov eax, r9d
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x10000c339
add r13, 2
mov ax, word [r13]
cmp ax, r14w
jne 0x10000c321
cmp word [r13], r14w
je 0x10000c625
mov ecx, 9
cmp word [rbx], dx
je 0x10000c361
cmp word [rbx], r14w
je 0x10000c361
cmp word [rbx], cx
je 0x10000c361
lea edi, [rcx - 8]
mov r14d, edi
jmp 0x10000c366
mov edi, 1
cmp word [rbx], dx
je 0x10000c370
cmp word [rbx], cx
jne 0x10000c37b
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c366
lea rax, [rsp + 0xca0]
mov qword [rsp + 0x78], rax
xor eax, eax
cmp word [r13], 0x63
jne 0x10000c39b
cmp r14d, eax
jne 0x10000c7bf
cmp word [r13], 0x50
jne 0x10000c43d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 0xa]
mov eax, 1
cmp edi, eax
jle 0x10000c3d0
movsxd rdx, edi
lea ecx, [rax + 0x3f]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
jmp 0x10000c3d8
lea r12, [rsp + 0x108]
xor eax, eax
cmp r12, rax
je 0x10000c832
mov rcx, qword [rsp + 0xf8]
lea rax, [rsp + 0x108]
cmp rcx, rax
je 0x10000c3fe
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0xf8], r12
mov dword [rsp + 0x100], edi
mov qword [rsp + 0xa8], r12
call fcn.10000b2f8
xor ecx, ecx
cmp al, cl
je 0x10000c7d2
mov r12, qword [0x10001e058]
jmp 0x10000c471
cmp word [r13], 0x71
je 0x10000c44d
cmp word [r13], 0x63
jne 0x10000c452
cmp r14d, eax
je 0x10000c480
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2f8
xor ecx, ecx
cmp al, cl
je 0x10000c839
mov rbx, qword [rsp + 0x60]
mov ecx, 9
xor eax, eax
lea edx, [rcx + 0x17]
mov di, word [rbx]
cmp di, dx
je 0x10000c48d
cmp di, cx
jne 0x10000c498
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c480
cmp word [r13], 0x46
je 0x10000c4b8
cmp word [r13], 0x71
je 0x10000c4b8
cmp word [r13], 0x4a
je 0x10000c4b8
cmp word [r13], 0x6c
jne 0x10000c532
cmp r14d, eax
je 0x10000c532
cmp word [r13], 0x71
lea rax, [rsp + 0x14a0]
lea rdx, [rsp + 0x14a0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
lea r15, [rsp + 0xca0]
je 0x10000c53a
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2f8
xor r14d, r14d
cmp al, r14b
je 0x10000c874
mov rbx, qword [rsp + 0x60]
lea r8d, [r14 + 0x20]
lea r14d, [r8 - 0x17]
mov di, word [rbx]
cmp di, r8w
je 0x10000c527
cmp di, r14w
jne 0x10000c532
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c518
mov rdx, qword [rsp + 0x80]
xor r14d, r14d
cmp word [r13], 0x61
jb 0x10000c581
cmp word [r13], 0x7a
ja 0x10000c581
lea rax, [0x100001a30]
mov rcx, r15
lea r15, [0x100000000]
sub r13, rax
sar r13, 1
call qword [r15 + r13*8 + 0x1bf80]
cmp eax, r14d
jne 0x10000c87b
mov r12, qword [0x10001e058]
jmp 0x10000c73c
cmp r12, r14
je 0x10000c67b
cmp word [r13], 0x50
mov eax, 0x41
jne 0x10000c606
cmp word [r12], ax
jne 0x10000c606
lea rdx, [rsp + 0x1ca0]
mov ecx, eax
call fcn.1000099fc
cmp eax, r14d
jne 0x10000c625
lea rdx, [rsp + 0xc00]
mov ecx, 0x1e
mov r12, r13
mov qword [0x10001e058], r13
lea rax, [rsp + 0xc00]
sub r15, rdx
lea r8d, [rcx - 0x1d]
cmp rcx, r14
je 0x10000c5f9
movzx edx, word [rax + r15]
cmp dx, r14w
je 0x10000c5f4
mov word [rax], dx
add rax, 2
sub rcx, r8
jne 0x10000c5d8
cmp rcx, r14
jne 0x10000c5fd
sub rax, 2
mov word [rax], r14w
jmp 0x10000c73c
cmp word [r12], 0x50
jne 0x10000c625
cmp word [r13], ax
jne 0x10000c625
mov ecx, eax
call fcn.1000099fc
cmp eax, r14d
je 0x10000c73c
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
lea r15, [0x100000000]
call fcn.10000b650
cmp esi, r14d
jne 0x10000c94e
cmp qword [0x10001e058], r14
jne 0x10000ca26
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
mov edi, dword [rsp + 0x88]
cmp esi, r14d
jne 0x10000c94e
cmp edi, r14d
jne 0x10000ca3a
jmp 0x10000ca2d
cmp word [r13], 0x50
mov r12, r13
mov qword [0x10001e058], r13
je 0x10000c6e5
lea r8, [rsp + 0x1ca0]
mov ecx, 0x400
lea rax, [rsp + 0x1ca0]
sub rdx, r8
mov r8d, 1
mov qword [rsp + 0x80], rdx
cmp rcx, r14
je 0x10000c6db
movzx edx, word [rdx + rax]
cmp dx, r14w
je 0x10000c6d6
mov word [rax], dx
mov rdx, qword [rsp + 0x80]
add rax, 2
sub rcx, r8
jne 0x10000c6b3
cmp rcx, r14
jne 0x10000c6df
sub rax, 2
mov word [rax], r14w
jmp 0x10000c6eb
mov r8d, 1
lea rdx, [rsp + 0xc00]
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r14
je 0x10000c724
movzx edx, word [r15 + rax]
cmp dx, r14w
je 0x10000c71f
mov word [rax], dx
add rax, 2
sub rcx, r8
jne 0x10000c703
cmp rcx, r14
jne 0x10000c728
sub rax, 2
mov word [rax], r14w
mov eax, MsiGetPropertyW
cmp word [r13], ax
je 0x10000c890
lea r11, [rsp + 0xca0]
mov word [rsp + 0xca0], r14w
lea r15, [rsp + 0x14a0]
mov word [rsp + 0x14a0], r14w
mov r13d, 0x104
mov qword [rsp + 0x80], r11
mov edx, 0x20
cmp di, r14w
je 0x10000c88b
lea r8, [0x100001a30]
mov r9d, 0x52
jmp 0x10000c1b3
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
cmp dword [rsp + 0x898], r13d
mov esi, ebp
jle 0x10000c7b5
mov rcx, qword [rsp + 0x890]
cmp rcx, r14
je 0x10000c7b5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x60]
jmp 0x10000c630
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
xor r14d, r14d
jmp 0x10000c630
xor edx, edx
call fcn.100007d2c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c7f4
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c82b
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebp
jmp 0x10000de65
mov esi, 0xe
jmp 0x10000c7ca
xor edx, edx
call fcn.100007d2c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c85b
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], edi
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000c810
xor ecx, ecx
jmp 0x10000c7d2
xor edx, edx
xor ecx, ecx
call fcn.100007d2c
mov esi, ebp
jmp 0x10000c637
mov eax, MsiGetPropertyW
cmp r12, r14
je 0x10000c630
mov ebp, 0x59
lea edi, [rbp + 1]
cmp ax, word [r12]
je 0x10000c8c2
cmp bp, word [r12]
je 0x10000c8c2
cmp di, word [r12]
je 0x10000c8c2
call fcn.10000b650
mov r12, qword [0x10001e058]
cmp word [r12], 0x50
lea rax, [0x100001a30]
lea rdx, [rsp + 0x1ca0]
cmove rdx, qword [rsp + 0xf8]
sub r12, rax
lea r15, [0x100000000]
lea rcx, [rsp + 0xc00]
sar r12, 1
call qword [r15 + r12*8 + 0x1bf80]
mov rcx, qword [0x10001e058]
mov esi, eax
cmp word [rcx], bp
je 0x10000c94e
cmp word [rcx], di
je 0x10000c94e
cmp eax, r14d
jne 0x10000c93d
mov eax, MsiGetPropertyW
cmp word [rcx], ax
mov eax, 1
jne 0x10000c92f
mov dword [0x10001db28], eax
jmp 0x10000c65d
mov edi, eax
mov dword [rsp + 0x88], eax
jmp 0x10000c664
cmp eax, 0x8000
jne 0x10000c9a7
mov dword [0x10001db28], r14d
mov esi, r14d
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000c969
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
jle 0x10000c9a0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x10000de65
mov eax, 0x52
cmp word [rcx], ax
je 0x10000ca1a
cmp word [rcx], 0x55
je 0x10000ca1a
mov eax, 0x4eb
cmp esi, eax
jg 0x10000c9ee
je 0x10000c65d
cmp esi, 0xfffffffe
jl 0x10000ca1a
cmp esi, r14d
jl 0x10000c65d
mov eax, 1
cmp esi, eax
jle 0x10000ca1a
cmp esi, 3
jle 0x10000c9e7
cmp esi, 0x7b
jne 0x10000ca1a
mov esi, 0x653
jmp 0x10000ca1a
cmp esi, 0x642
jl 0x10000ca1a
cmp esi, 0x644
jle 0x10000c65d
cmp esi, 0x669
je 0x10000c65d
cmp esi, 0xbc2
je 0x10000c65d
mov ecx, esi
call fcn.10000ae1c
jmp 0x10000c65d
mov edi, dword [rsp + 0x88]
cmp dword [0x10001db28], r14d
je 0x10000c94e
xor ecx, ecx
cmp dword [0x10001db28], r14d
je 0x10000ca4f
xor edx, edx
call qword [0x10001a420]
jmp 0x10000ca61
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [0x100002da8]
call fcn.100016e3c
cmp edi, r14d
je 0x10000cac6
cmp dword [0x10001db28], r14d
jne 0x10000cad9
mov edi, r14d
mov r13d, 1
movsxd rcx, edi
lea r8, [0x1000019a8]
mov r9d, r13d
lea rax, [r15 + rcx*4 + 0x1d8d8]
lea rdx, [r15 + rcx*8 + 0x1c038]
shl rcx, 4
add rcx, r8
mov r8d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
cmp eax, r14d
jne 0x10000cabc
add edi, r13d
cmp edi, r13d
jl 0x10000ca78
jmp 0x10000cacc
mov dword [rsp + 0xb4], r13d
jmp 0x10000cacc
mov r13d, 1
cmp dword [0x10001db28], r14d
je 0x10000ddbe
xor eax, eax
mov r9d, r14d
lea edi, [rax + 0x20]
lea r11d, [rax + 0x30]
lea r10d, [rax + 1]
mov qword [rsp + 0xac0], rax
mov qword [rsp + 0xac8], rax
cmp word [rbx], r11w
jb 0x10000cb1d
cmp word [rbx], 0x39
ja 0x10000cb1d
mov eax, r9d
cdq
and eax, r10d
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, r11d
jmp 0x10000cb4b
mov eax, 0x41
cmp word [rbx], ax
jb 0x10000cbd4
cmp word [rbx], 0x46
ja 0x10000cbd4
mov eax, r9d
cdq
and eax, r10d
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, 0x37
and r8d, 0xfffffff1
add r8d, 0x10
imul r8d, eax
cmp r9d, edi
jge 0x10000cb78
mov eax, r9d
add r9d, r10d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
or byte [rsp + rcx + 0xac0], r8b
add rbx, 2
jmp 0x10000caf9
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cb93
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
mov eax, 1
cmp dword [rsp + 0x100], eax
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cbca
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x641
jmp 0x10000de65
cmp r9d, edi
jne 0x10000cb78
xor edi, edi
mov r15b, r14b
mov bpl, r14b
mov r12b, dil
mov r13b, dil
mov byte [rsp + 0x70], dil
cmp word [rbx], di
je 0x10000cbf5
add rbx, 2
cmp word [rbx], 0x43
jne 0x10000cc03
mov r15b, r10b
jmp 0x10000cca2
cmp word [rbx], 0x55
jne 0x10000cc14
mov r15b, r10b
mov r12b, r10b
jmp 0x10000cca2
cmp word [rbx], ax
jne 0x10000cc23
mov r13b, r10b
mov byte [rsp + 0x70], r10b
jmp 0x10000cca2
cmp word [rbx], 0x4d
je 0x10000cc48
mov ecx, 0x52
cmp word [rbx], cx
je 0x10000cc3b
lea eax, [rcx - 0xd]
cmp word [rbx], ax
jne 0x10000cca2
cmp word [rbx], cx
movzx r14d, r14b
cmove r14d, r10d
jmp 0x10000cc4e
mov r14b, r10b
mov bpl, r10b
lea r8, [rbx + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp rax, rdi
je 0x10000dda5
cmp rax, 0xffffffffffffffff
je 0x10000dda5
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp edi, eax
je 0x10000cca0
mov edx, edi
lea rcx, [0x100002e40]
jmp 0x10000ddb4
xor edi, edi
or qword [rsp + 0x90], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, 1
lea edx, [rbx + 1]
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp eax, edi
jne 0x10000cd1e
or qword [rsp + 0x90], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x10000cd1e
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cd02
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], ebx
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000cbaf
cmp bpl, dil
jne 0x10000cd29
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp bpl, dil
je 0x10000cd55
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xad0]
lea edx, [rdi + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
lea ebp, [rdi + 4]
cmp eax, ecx
je 0x10000ce19
cmp byte [0x10001e27a], cl
jne 0x10000cda2
lea rcx, [rsp + 0xa8]
call fcn.100005380
mov rbx, qword [rsp + 0xa8]
xor ecx, ecx
jmp 0x10000cdab
lea rbx, [0x10001e280]
mov eax, ecx
cmp eax, ecx
jne 0x10000ce04
mov rcx, qword [rsp + 0xad0]
lea rax, [rsp + 0xab8]
lea r8, [rsp + 0xc40]
mov r9d, reloc.msi.dll_MsiOpenDatabaseW
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor ecx, ecx
cmp eax, ecx
je 0x10000ce04
mov rcx, qword [rsp + 0xc40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov cl, r14b
neg cl
sbb edx, edx
xor ecx, ecx
and edx, 0xfffffffe
add edx, ebp
cmp eax, ecx
cmovne edi, edx
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
jmp 0x10000ce5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x892]
xor edx, edx
mov ebx, eax
xor eax, eax
mov r8d, 0x206
mov word [rsp + 0x890], ax
call sub.msvcrt.dll_memset
mov r9d, ebx
mov ebx, 0x104
lea r8, [0x100002eb0]
lea rcx, [rsp + 0x890]
mov rdx, rbx
call fcn.100004f90
xor eax, eax
cmp r12b, al
lea r12d, [rax + 1]
je 0x10000ce7f
cmp edi, r12d
jne 0x10000ce76
lea ecx, [rax + 9]
mov edi, ecx
jmp 0x10000ce84
cmp edi, eax
jne 0x10000ce94
mov edi, 8
mov ecx, 9
cmp r13b, al
je 0x10000cee7
cmp edi, eax
jne 0x10000cedd
mov edi, 6
jmp 0x10000cee7
lea rcx, [0x100002ef0]
xor edx, edx
call fcn.10000a84c
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], ebx
jle 0x10000ceb9
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], ebx
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000cbba
cmp edi, r12d
jne 0x10000cea2
mov edi, 7
mov r13d, 0x100
mov dword [rsp + 0xb0], r13d
cmp edi, eax
je 0x10000cf11
cmp edi, r12d
je 0x10000cf11
cmp edi, 6
je 0x10000cf11
cmp edi, 7
je 0x10000cf11
cmp edi, 8
je 0x10000cf11
cmp edi, ecx
jne 0x10000cf16
mov ebp, 4
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb00]
xor r9d, r9d
mov r8d, ebp
call fcn.100005490
xor ebp, ebp
mov ebx, eax
cmp eax, ebp
je 0x10000cf90
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000cf4d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000cf68
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
mov qword [rsp + 0x110], rax
jmp 0x10000c115
movsxd rbx, dword [rsp + 0xb0]
cmp ebx, r13d
mov dword [rsp + 0xab0], ebx
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0xc0], ebx
mov dword [rsp + 0xbc], ebx
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0x338], ebx
jle 0x10000cfef
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [rsp + 0x9c]
mov qword [rsp + 0x330], rax
cmp rax, rbp
jne 0x10000d011
mov dword [rsp + 0x338], ebp
jmp 0x10000d011
lea rcx, [rsp + 0x340]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x340]
mov qword [rsp + 0x330], r11
cmp ebx, r13d
mov dword [rsp + 0x558], ebx
jle 0x10000d03e
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x550], rax
cmp rax, rbp
jne 0x10000d060
mov dword [rsp + 0x558], ebp
jmp 0x10000d060
lea rcx, [rsp + 0x560]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x560]
mov qword [rsp + 0x550], r11
movsxd rax, dword [rsp + 0xc0]
cmp eax, r13d
mov dword [rsp + 0x668], eax
jle 0x10000d095
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x660], rax
cmp rax, rbp
jne 0x10000d0b7
mov dword [rsp + 0x668], ebp
jmp 0x10000d0b7
lea rcx, [rsp + 0x670]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x670]
mov qword [rsp + 0x660], r11
movsxd rax, dword [rsp + 0xbc]
cmp eax, r13d
mov dword [rsp + 0x448], eax
jle 0x10000d0ef
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
mov qword [rsp + 0x440], rax
cmp rax, rbp
jne 0x10000d111
mov dword [rsp + 0x448], ebp
jmp 0x10000d111
lea rcx, [rsp + 0x450]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rsp + 0x450]
mov qword [rsp + 0x440], rbx
movsxd rax, dword [rsp + 0xb8]
cmp eax, r13d
mov dword [rsp + 0x778], eax
jle 0x10000d14e
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, qword [rsp + 0x440]
mov qword [rsp + 0x770], rax
cmp rax, rbp
jne 0x10000d170
mov dword [rsp + 0x778], ebp
jmp 0x10000d170
lea rcx, [rsp + 0x780]
mov r8, r13
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x780]
mov qword [rsp + 0x770], rax
mov r9, qword [rsp + 0x550]
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x660]
lea r8, [rsp + 0xab0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9c]
lea rcx, [rsp + 0xb00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
cmp eax, ebp
jne 0x10000d2a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d205
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x778], r13d
jle 0x10000d222
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d222
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d23f
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d23f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d25c
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d25c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d279
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d279
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000cf4d
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000cf4d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000cf4d
mov rcx, qword [rsp + 0x330]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x10001a488]
mov ebx, eax
cmp eax, ebp
je 0x10000d3c0
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d2f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100002fc0]
mov edx, ebx
call fcn.10000a84c
cmp dword [rsp + 0x778], r13d
jle 0x10000d321
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d321
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d33e
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d33e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d35b
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d35b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d378
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d378
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000d395
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000d395
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000d3b0
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jmp 0x10000cec0
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
cmp rax, rbp
jne 0x10000d48f
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d3f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x778], r13d
jle 0x10000d40e
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d40e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], r13d
jle 0x10000d42b
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d42b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], r13d
jle 0x10000d448
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d448
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], r13d
jle 0x10000d465
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d465
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], r13d
jle 0x10000cb78
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
je 0x10000cb78
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000cb78
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r13, rax
cmp rax, rbp
jne 0x10000d540
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d4bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d4e0
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d4e0
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d4fc
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d4fc
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d518
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d518
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d534
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d534
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jmp 0x10000d46d
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x80], rbp
call fcn.10000b570
mov rbx, rax
cmp rax, rbp
jne 0x10000d5ad
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d573
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003020]
xor edx, edx
call fcn.10000a84c
mov rcx, qword [rsp + 0x80]
cmp rcx, rbp
je 0x10000d594
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x10000d4bf
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000d4bf
mov rax, qword [0x10001db38]
mov dword [rsp + 0xa0], ebp
mov dword [rsp + 0xc4], ebp
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x60], rbp
cmp rax, rbp
jne 0x10000d5f1
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001db38], rax
cmp rax, rbp
je 0x10000dd83
lea rdx, [0x100001cd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x10000dd83
lea r8, [rsp + 0x60]
lea rdx, [0x100001988]
lea rcx, [0x1000019e8]
call rax
cmp eax, ebp
jne 0x10000dd83
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0xa8]
lea r8, [0x1000019e8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbp, qword [rsp + 0xa8]
xor eax, eax
cmp rbp, rax
je 0x10000dd81
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
je 0x10000d673
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x68], rax
mov rax, qword [rbp]
lea r8, [rsp + 0x68]
lea rdx, [0x1000019d8]
mov rcx, rbp
call qword [rax]
mov r11, qword [rbp]
mov rcx, rbp
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
xor ebp, ebp
mov dword [rsp + 0x98], edi
cmp rcx, rbp
je 0x10000d6b4
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x80], rbp
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
lea r8, [rsp + 0xac0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa0]
lea rdx, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov r9d, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [r10 + 0x70]
cmp eax, ebp
je 0x10000d742
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d725
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003080]
xor edx, edx
call fcn.10000a84c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
jmp 0x10000d581
mov r8d, dword [rsp + 0xa0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
xor eax, eax
cmp rbp, rax
jne 0x10000d84e
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d779
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a84c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
xor ebx, ebx
cmp rcx, rbx
je 0x10000d7ac
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x10000d7bc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d7dd
mov rcx, qword [rsp + 0x770]
cmp rcx, rbx
je 0x10000d7dd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d7f9
mov rcx, qword [rsp + 0x440]
cmp rcx, rbx
je 0x10000d7f9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d815
mov rcx, qword [rsp + 0x660]
cmp rcx, rbx
je 0x10000d815
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d831
mov rcx, qword [rsp + 0x550]
cmp rcx, rbx
je 0x10000d831
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000cb78
mov rcx, qword [rsp + 0x330]
cmp rcx, rbx
jmp 0x10000d47e
mov rcx, qword [rsp + 0x80]
call qword [0x10001a4c0]
xor ecx, ecx
cmp eax, ecx
jne 0x10000d884
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000d876
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d797
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
lea rdx, [0x1000019f8]
mov rax, qword [rcx]
call qword [rax]
xor eax, eax
mov rdx, rax
cmp edi, dword [rsp + 0x98]
jne 0x10000d8b4
cmp edi, 8
je 0x10000d8b4
lea eax, [rdx + 9]
cmp edi, eax
jne 0x10000d8bc
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0xac0]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rsp + 0x78]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x78]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
mov r10, qword [rcx]
mov r9b, byte [rsp + 0x70]
mov edx, dword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc4]
mov r8b, r15b
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x20], r14b
call qword [r10 + 0x148]
mov rcx, qword [rsp + 0x90]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d94e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x90], 0xffffffffffffffff
xor r14d, r14d
cmp edi, r14d
je 0x10000da27
lea rcx, [0x100003160]
xor edx, edx
call fcn.10000a84c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
cmp rcx, r14
je 0x10000d985
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d995
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d9b6
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000d9b6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d9d2
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000d9d2
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d9ee
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000d9ee
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000da0a
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000da0a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000cb78
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
jmp 0x10000d47e
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x138]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x80]
cmp rcx, r14
je 0x10000da5a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000da6a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 3
or r15d, 0xffffffff
lea rdx, [rsp + 0xae0]
mov edi, 0x4ff
xor r8d, r8d
mov r9d, r15d
mov ecx, eax
mov dword [0x10001db20], eax
mov bl, r14b
mov qword [rsp + 0xae0], rbp
mov qword [rsp + 0xae8], r12
mov qword [rsp + 0xaf0], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov r13d, 1
cmp eax, r14d
je 0x10000dc93
cmp eax, r13d
je 0x10000dc8a
cmp eax, 2
jne 0x10000db19
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x60], r14d
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x160]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
cmp rax, r14
je 0x10000db99
mov qword [rsp + 0xae0], rax
jmp 0x10000db78
cmp eax, 3
jne 0x10000dc93
jmp 0x10000db4a
cmp dword [rsp + 0xd0], 0x12
je 0x10000db6c
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r14d
jne 0x10000db24
jmp 0x10000db6f
mov bl, r13b
cmp bl, r14b
jne 0x10000dc93
xor r8d, r8d
lea rdx, [rsp + 0xae0]
mov r9d, r15d
lea ecx, [r8 + 3]
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x10000dab9
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000dbad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a84c
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000dbe2
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000dbe2
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000dbfe
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000dbfe
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000dc1a
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000dc1a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000dc36
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000dc36
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000dc52
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
je 0x10000dc52
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], 0x104
jle 0x10000dc6d
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r13d
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jmp 0x10000cbaf
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000dcc8
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000dcc8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000dce4
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000dce4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000dd00
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000dd00
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000dd1c
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000dd1c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000dd38
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
je 0x10000dd38
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x88]
cmp eax, r14d
je 0x10000dd5e
cmp dword [0x10001db28], r14d
jne 0x10000dd5e
mov ecx, dword [0x10001d8d8]
cmp ecx, r14d
je 0x10000dd5e
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rsp + 0xb4], r14d
je 0x10000c94e
mov ecx, 0x641
call fcn.10000ae1c
jmp 0x10000dc52
xor ebp, ebp
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x10000dd97
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d581
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100002dd0]
mov edx, eax
call fcn.10000a84c
jmp 0x10000cb78
mov dword [0x10001db20], r13d
lea rcx, [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r14d
jne 0x10000ddfa
cmp dword [0x10001db40], r14d
je 0x10000dd38
cmp dword [0x10001db18], r14d
je 0x10000dd38
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10000ddc5
cmp dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
jle 0x10000de30
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x100], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + reloc.msi.dll_MsiBeginTransactionA], r13d
mov qword [rsp + 0x110], rax
jle 0x10000de60
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x65b
mov rcx, qword [rsp + 0x24a0]
xor rcx, rsp
call fcn.100017460
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret