Function at 0x100071d1
Capabilities:
Accept command line arguments
Create thread
Get process heap force flags
Query environment variable
Resolve function by parsing pe exports
Set environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x454
push ebx
push esi
push edi
push 0x100078df
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x1e
call dword [sym.imp.SHLWAPI.dll_IsOS]
xor ebx, ebx
test eax, eax
je 0x100072b7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
ja 0x100072b7
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2011f
push 5
push ebx
push ebx
push str.SoftwareClassesDism.RegTest
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10007250
push 0x80004005
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1e
push str._ProgramFiles_
push 2
push ebx
mov esi, str.PathToProgramFiles
push esi
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.10010fce
push eax
lea ecx, [esp + 0x10]
call fcn.10010df9
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
mov edx, esi
call fcn.10012026
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0xc]
push str.ProgramFiles_x86_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100072af
push 0xa002000a
jmp 0x1000724a
lea ecx, [esi - 0x10]
call fcn.100110af
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push ebx
push 0x400
call edi
mov esi, eax
test esi, esi
je 0x10007245
push ebx
push 0x18
lea eax, [esp + 0x68]
push eax
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jne 0x10007245
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push dword [esp + 0x74]
xor esi, esi
push esi
push 0x100440
call edi
mov edi, eax
test edi, edi
je 0x10007245
push esi
push esi
push edi
push 0x100078e8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call ebx
push esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x227
push 0x20
push 2
mov ebx, 0x10016d5c
mov dword [esp + 0x24], 0x10016b70
lea eax, [esp + 0x144]
mov dword [esp + 0x28], esi
push ebx
push eax
call fcn.100016a2
add esp, 0x14
lea eax, [esp + 0x1f8]
push 0x12
push 1
push ebx
push eax
call fcn.100016a2
mov esi, 0x220
lea eax, [esp + 0x1a8]
push esi
push 0x20
push 2
push ebx
push eax
call fcn.100016a2
xor eax, eax
mov dword [esp + 0x58], 2
add esp, 0x1c
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], al
lea ecx, [esp + 0x30]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x140]
push eax
mov dword [esp + 0x34], 0x10016c68
call fcn.10001a80
push ecx
push ecx
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x34]
call fcn.10001a80
push ecx
push ecx
lea eax, [esp + 0x200]
push eax
lea ecx, [esp + 0x34]
call fcn.10001a80
push 0x12
push 1
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.100016a2
add esp, 0xc
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x1c]
push eax
call fcn.10001e15
lea ecx, [esp + 0x78]
call fcn.10001773
push esi
push 0x20
push 2
push ebx
lea eax, [esp + 0xe8]
push eax
call fcn.100016a2
add esp, 0x10
lea eax, [esp + 0xdc]
lea ecx, [esp + 0x1c]
push eax
call fcn.10001ed8
lea ecx, [esp + 0xd8]
call fcn.10001773
push ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
call fcn.10001f9b
xor ebx, ebx
push ebx
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xffffffffffffffff
push dword [esp + 0x3c]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
je 0x10007472
push eax
jmp 0x1000724a
lea eax, [esp + 0x5c]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
lea ecx, [esp + 0x24]
push dword [esi]
push str.Global_
call fcn.100107cc
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.1001087d
pop ecx
push dword [eax]
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, dword [esp + 0x20]
mov ebx, eax
add ecx, 0xfffffff0
mov dword [esp + 0xc], ebx
call fcn.100110af
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.100110af
test ebx, ebx
jne 0x100074d5
push 0x57
jmp 0x1000724a
mov ebx, dword [sym.imp.msvcrt.dll_wcstoul]
push 0xa
push 0
push dword [esi + 0x10]
call ebx
add esp, 0xc
mov dword [0x10020028], eax
test eax, eax
je 0x10007527
push 0x10
push 0
push dword [esi + 0xc]
call ebx
add esp, 0xc
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x10007527
push 2
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0xffffffffffffffff
push eax
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x10007527
mov eax, dword [esp + 0x14]
mov dword [0x1002002c], eax
push dword [esi + 8]
push 0x10020030
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
call fcn.10010fce
push eax
lea ecx, [esp + 0x4c]
call fcn.10010df9
push dword [esi + 4]
lea ecx, [esp + 0x4c]
call fcn.1001029c
test eax, eax
jne 0x1000746c
mov ecx, dword [esp + 0x50]
mov edx, 0x60000
cmp ecx, edx
jae 0x10007571
push 0x80004002
jmp 0x1000724a
mov eax, ecx
sub eax, edx
je 0x1000769d
sub eax, 1
je 0x10007687
sub eax, 1
je 0x10007671
sub eax, 1
je 0x1000764c
mov eax, 0xa0000
cmp ecx, eax
ja 0x10007613
jb 0x100075ab
cmp dword [esp + 0x4c], 0x37fc0000
jae 0x100075d7
push 0x78
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x100076b5
mov ecx, esi
call fcn.1000a57b
mov dword [esi + 0x20], 0x3f0
mov dword [esi], 0x1001cee4
jmp 0x100076b7
cmp ecx, eax
ja 0x10007613
jb 0x100075e7
cmp dword [esp + 0x4c], 0x42b20000
jae 0x10007613
push 0x78
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x100076b5
mov ecx, esi
call fcn.1000a57b
mov dword [esi + 0x20], 0x3f0
mov dword [esi], 0x1001ce64
jmp 0x100076b7
push 0x78
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x100076b5
mov ecx, esi
call fcn.10005b15
and dword [esi + 0x38], 0
and dword [esi + 0x3c], 0
and dword [esi + 0x64], 0
and dword [esi + 0x70], 0
mov dword [esi + 0x20], 0x3f0
mov dword [esi], 0x1001cde4
jmp 0x100076b7
push 0x78
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x100076b5
mov ecx, esi
call fcn.1000a57b
mov dword [esi], 0x1001cba0
mov dword [esi + 0x20], 0x3f0
jmp 0x100076b7
push 0x78
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x100076b5
mov ecx, eax
call fcn.1000a57b
jmp 0x100076b1
push 0x38
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x100076b5
mov ecx, eax
call fcn.10005b15
jmp 0x100076b1
push 0x30
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x100076b5
mov ecx, eax
call fcn.1000251a
mov esi, eax
jmp 0x100076b7
xor esi, esi
mov edi, dword [esp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x58], 0
jne 0x10007709
push 0x104
lea eax, [esp + 0x25c]
push eax
push str._SystemRoot_LogsCBSOfflineCbs.log
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x258]
call fcn.10011296
lea eax, [esp + 0x258]
push eax
push str.COMPONENT_BASED_SERVICING_LOGFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [esp + 0x48]
mov ecx, esi
push eax
call fcn.100025a6
mov edi, eax
test esi, esi
je 0x10007724
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx + 0x64]
test edi, edi
je 0x1000772b
push edi
call ebx
push 0x10017b8c
push 0x10017b9c
push 4
call sym.CBSHost.dll_DismWriteLog
push 0
jmp 0x1000724a