Function at 0x3aaac6e1
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push 0x4cc
mov eax, 0x3ab50575
call fcn.3ab359d8
xor ebx, ebx
push ebx
sub esp, 0x1c
mov edi, ecx
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67310
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [ebp + 8]
mov dword [edi + 0x1150], eax
xor eax, eax
push 0x208
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.3ab033f0
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 0x105
call fcn.3ab3c1f6
lea eax, [ebp - 0x424]
push eax
call fcn.3ab3c1f6
test al, al
lea eax, [ebp - 0x424]
push eax
jne 0x3aaac83c
push 0x105d
lea eax, [ebp - 0x45c]
push eax
mov dword [ebp - 0x4a0], ebx
call fcn.3ab1c612
push ebx
sub esp, 0x1c
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x47c], esp
push 0x105f
push eax
lea esi, [ebp - 0x4a0]
call fcn.3ab1c5d7
sub esp, 0x1c
mov byte [ebp - 4], 1
lea eax, [ebp - 0x45c]
mov ecx, esp
mov dword [ebp - 0x4ac], esp
push eax
call fcn.3ab3c1f6
mov byte [ebp - 4], bl
call fcn.3ab3c1f6
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x4d8]
push 0x3aa67358
push eax
call fcn.3aa97158
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 2
call fcn.3ab3c1f6
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x4d8]
call fcn.3ab3c1f6
push ebx
push 2
sub esp, 0x1c
lea eax, [ebp - 0x45c]
mov ecx, esp
mov dword [ebp - 0x47c], esp
push eax
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push ebx
push 1
lea ecx, [ebp - 0x45c]
mov byte [edi + 0x1160], 1
call fcn.3ab3c1f6
mov eax, 0x80070057
jmp 0x3aaade50
call fcn.3ab168e2
test al, al
jne 0x3aaac8e6
lea eax, [ebp - 0x424]
push eax
push 0x105e
lea eax, [ebp - 0x45c]
push eax
mov dword [ebp - 0x4a0], ebx
call fcn.3ab1c612
push ebx
sub esp, 0x1c
mov dword [ebp - 4], 3
mov eax, esp
mov dword [ebp - 0x47c], esp
push 0x105f
push eax
lea esi, [ebp - 0x4a0]
call fcn.3ab1c5d7
sub esp, 0x1c
mov byte [ebp - 4], 4
lea eax, [ebp - 0x45c]
mov ecx, esp
mov dword [ebp - 0x4ac], esp
push eax
call fcn.3ab3c1f6
mov byte [ebp - 4], 3
call fcn.3ab3c1f6
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x4d8]
push 0x3aa67358
push eax
call fcn.3aa97158
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 5
call fcn.3ab3c1f6
mov byte [ebp - 4], 3
jmp 0x3aaac7ee
mov ecx, edi
call fcn.3ab3c1f6
cmp eax, ebx
mov dword [ebp - 0x480], eax
jge 0x3aaac921
push ebx
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67398
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
mov eax, dword [ebp - 0x480]
jmp 0x3aaade50
mov ecx, edi
call fcn.3aab7872
cmp eax, ebx
mov dword [ebp - 0x480], eax
jge 0x3aaac947
push ebx
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67410
jmp 0x3aaac90a
push edi
call fcn.3aab8a35
test al, al
jne 0x3aaac96d
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67480
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov ecx, edi
call fcn.3aad7751
cmp eax, ebx
mov dword [ebp - 0x480], eax
jge 0x3aaac996
push ebx
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67508
jmp 0x3aaac90a
mov ecx, edi
call fcn.3aab254d
and dword [ebp - 0x4a8], ebx
mov dword [ebp - 4], 6
mov ebx, dword [edi + 0x184]
push 0x3aa63fdc
lea ecx, [ebp - 0x494]
call fcn.3ab3c1f6
mov esi, eax
push 0x3aa63ff0
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 7
call fcn.3ab3c1f6
mov byte [ebp - 4], 8
mov esi, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebx]
lea edx, [ebp - 0x4a8]
push edx
push esi
push eax
push ebx
call dword [ecx + 0x20]
push dword [ebp - 0x4a0]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
call ebx
mov byte [ebp - 4], 6
push dword [ebp - 0x494]
call ebx
test esi, esi
jge 0x3aaaca4c
push dword [ebp - 0x4a8]
call ebx
and dword [ebp - 0x4a8], 0
lea edx, [ebp - 0x4a8]
lea eax, [edi + 0x80c]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67598
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
push dword [ebp - 0x4a8]
lea esi, [edi + 0x84c]
mov eax, dword [esi]
push esi
call dword [eax + 0x28]
push 0
push dword [ebp - 0x4a8]
lea ecx, [ebp - 0x45c]
call fcn.3ab3c1f6
mov dword [ebp - 0x4a0], eax
push 0x3aa676f8
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 9
call fcn.3ab3c1f6
sub esp, 0x1c
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x47c], esp
push dword [ebp - 0x4a0]
push eax
push ecx
call fcn.3aa971a4
add esp, 0xc
push edi
call fcn.3aab55fc
push 0
push 1
lea ecx, [ebp - 0x4d8]
call fcn.3ab3c1f6
push 0
push 1
lea ecx, [ebp - 0x45c]
call fcn.3ab3c1f6
and dword [ebp - 0x49c], 0
mov byte [ebp - 4], 0xb
cmp byte [edi + 0x2d8], 0
je 0x3aaacb66
push edi
call fcn.3aaac625
test eax, eax
jne 0x3aaacb66
xor edi, edi
mov dword [ebp - 0x480], edi
lea ecx, [ebp - 0x480]
push ecx
mov byte [ebp - 4], 0xc
mov eax, dword [esi]
push esi
call dword [eax + 0x24]
push 0x1367
lea eax, [ebp - 0x4d8]
push eax
call fcn.3ab1c5d7
cmp dword [eax + 0x18], 8
jb 0x3aaacb25
mov eax, dword [eax + 4]
jmp 0x3aaacb28
add eax, 4
push 0x30
push dword [ebp - 0x480]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 1
lea ecx, [ebp - 0x4d8]
call fcn.3ab3c1f6
push dword [ebp - 0x480]
call ebx
push dword [ebp - 0x49c]
call ebx
push dword [ebp - 0x4a8]
call ebx
xor eax, eax
inc eax
jmp 0x3aaade50
push dword [ebp - 0x49c]
call ebx
and dword [ebp - 0x49c], 0
mov esi, dword [edi + 0x184]
push 0x3aa63ea4
lea ecx, [ebp - 0x480]
call fcn.3ab3c1f6
mov dword [ebp - 0x4a0], eax
push 0x3aa63e7c
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 0xd
call fcn.3ab3c1f6
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x4a0]
mov ecx, dword [ecx]
mov eax, dword [eax]
lea edx, [ebp - 0x49c]
push edx
push ecx
mov dword [ebp - 0x4a0], eax
push dword [ebp - 0x4a0]
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
push dword [ebp - 0x494]
mov esi, eax
call ebx
mov byte [ebp - 4], 0xb
push dword [ebp - 0x480]
call ebx
test esi, esi
jl 0x3aaade1b
cmp esi, 1
je 0x3aaade1b
push dword [ebp - 0x49c]
call fcn.3ab3c1f6
test eax, eax
setne al
pop ecx
mov byte [edi + 0x2cb], al
call fcn.3aaae0b7
mov byte [edi + 0x1160], al
test al, al
je 0x3aaacc5f
mov ecx, edi
call fcn.3ab3c1f6
test al, al
jne 0x3aaacc5f
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa677a0
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
xor esi, esi
inc esi
push dword [ebp - 0x49c]
call ebx
push dword [ebp - 0x4a8]
call ebx
mov eax, esi
jmp 0x3aaade50
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x3aaacc68
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.3ab3c1f6
pop ecx
mov dword [ebp - 0x494], eax
test eax, eax
jne 0x3aaaccc0
push eax
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67828
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
mov esi, 0x8007000e
jmp 0x3aaacc48
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.3ab033f0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
push esi
push dword [ebp - 0x494]
call fcn.3ab3c1f6
push esi
mov esi, dword [ebp - 0x494]
push esi
call fcn.3ab3c1f6
push 0x3aa67890
push esi
call fcn.3ab3c1f6
add esp, 0x1c
test eax, eax
jne 0x3aaacd19
push 0x3aa678b8
push esi
call fcn.3ab3c1f6
pop ecx
pop ecx
mov byte [ebp - 0x481], 0
test eax, eax
je 0x3aaacd20
mov byte [ebp - 0x481], 1
push esi
call fcn.3ab3c1f6
pop ecx
lea ecx, [ebp - 0x4b4]
lea esi, [edi + 0x28]
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x38]
and dword [ebp - 0x488], 0
lea edx, [ebp - 0x488]
lea eax, [edi + 0x94c]
push edx
mov byte [ebp - 4], 0xf
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push dword [ebp - 0x488]
call fcn.3ab3c1f6
test eax, eax
setne byte [ebp - 0x48d]
xor eax, eax
mov dword [esp], 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.3ab033f0
add esp, 0xc
cmp byte [edi + 0x1155], 0
jne 0x3aaad0d9
cmp byte [edi + 0x2cb], 0
jne 0x3aaacdad
cmp word [ebp - 0x4b4], 0xffff
je 0x3aaad0d9
cmp byte [edi + 0x24e], 0
jne 0x3aaad0d9
cmp byte [edi + 0x1160], 0
jne 0x3aaad0d9
cmp byte [ebp - 0x48d], 0
jne 0x3aaad0d9
cmp byte [ebp - 0x481], 0
jne 0x3aaad0d9
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa678d8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [edi + 0x1158], eax
lea eax, [ebp - 0x4bc]
push eax
xor eax, eax
push eax
push edi
push 0x3aaac290
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateThread]
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67958
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
push 0xffffffffffffffff
push dword [edi + 0x1158]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa679d8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
push 0x243
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x115c]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67a68
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov ecx, dword [0x3ab7b3f4]
test ecx, ecx
je 0x3aaaceb7
mov eax, dword [ecx]
push 0x25
call dword [eax + 4]
push 2
call sub.msi.dll_MsiDatabaseExportA
push 0x3aa67ad4
push 0
push eax
mov dword [ebp - 0x480], eax
call sub.msi.dll_MsiReinstallFeatureW
push 1
push 1
push dword [ebp - 0x480]
call sub.msi.dll_MsiRecordSetStringW
push 0
push 2
push dword [ebp - 0x480]
call sub.msi.dll_MsiRecordSetStringW
mov eax, dword [esi]
push 0
push dword [ebp - 0x480]
push 0x7a000000
push esi
call dword [eax + 0x98]
push dword [ebp - 0x480]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
push dword [edi + 0x115c]
lea eax, [ebp - 0x218]
push 0x3aa665ac
push 0xffffffffffffffff
push 0x104
push eax
call fcn.3ab3c1f6
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x47c]
call fcn.3ab3c1f6
mov dword [ebp - 0x4a0], eax
push 0x3aa63d84
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 0x10
call fcn.3ab3c1f6
mov dword [ebp - 0x494], eax
push 0x3aa63d38
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x11
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x4a0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x494]
mov edx, dword [edx]
mov eax, dword [eax]
push ecx
push 0
push edx
mov dword [ebp - 0x4a0], eax
push dword [ebp - 0x4a0]
mov eax, dword [esi]
push esi
call dword [eax + 0x40]
push dword [ebp - 0x4b8]
mov dword [ebp - 0x480], eax
call ebx
push dword [ebp - 0x4ac]
call ebx
mov byte [ebp - 4], 0xf
push dword [ebp - 0x47c]
call ebx
cmp dword [ebp - 0x480], 0
jge 0x3aaad00d
cmp dword [ebp - 0x480], 0x80070057
je 0x3aaad01d
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67b00
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push dword [ebp - 0x488]
call ebx
mov esi, dword [ebp - 0x480]
jmp 0x3aaacc48
cmp dword [ebp - 0x480], 0x80070057
jne 0x3aaad0d9
and dword [ebp - 0x494], 0
push 0x3aa63d38
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0x13
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x14
mov eax, dword [eax]
mov ecx, dword [esi]
lea edx, [ebp - 0x494]
push edx
push eax
push esi
call dword [ecx + 0x3c]
push dword [ebp - 0x47c]
mov dword [ebp - 0x480], eax
call ebx
cmp dword [ebp - 0x480], 0
jl 0x3aaad0c5
push dword [ebp - 0x494]
lea ecx, [ebp - 0x480]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x16
mov eax, dword [eax]
mov ecx, dword [ebp - 0x47c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x28]
push dword [ebp - 0x4ac]
call ebx
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x480]
test eax, eax
je 0x3aaad0c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x494]
test eax, eax
je 0x3aaad0d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x48c], 0
mov byte [ebp - 4], 0x17
mov eax, dword [edi + 0x184]
push 0x3aa63e50
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x494], eax
call fcn.3ab3c1f6
mov dword [ebp - 0x47c], eax
push 0x3aa63ff0
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 0x18
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x47c]
mov eax, dword [eax]
mov ecx, dword [ecx]
lea edx, [ebp - 0x48c]
push edx
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x494]
mov eax, dword [eax]
push ecx
push dword [ebp - 0x47c]
push dword [ebp - 0x494]
call dword [eax + 0x20]
push dword [ebp - 0x4ac]
mov dword [ebp - 0x480], eax
call ebx
mov byte [ebp - 4], 0x17
push dword [ebp - 0x4b8]
call ebx
cmp dword [ebp - 0x480], 0
jl 0x3aaad18a
push 0x3aa61344
push dword [ebp - 0x48c]
call fcn.3ab3c1f6
pop ecx
pop ecx
test eax, eax
je 0x3aaad21f
lea eax, [edi + 0x1a8]
mov ecx, dword [eax + 4]
push dword [ecx]
lea ebx, [ebp - 0x47c]
push eax
call fcn.3aaa92e5
mov eax, dword [edi + 0x1ac]
mov ecx, dword [ebp - 0x47c]
cmp ecx, eax
je 0x3aaad219
mov eax, dword [ecx]
add eax, 8
push eax
lea ecx, [ebp - 0x45c]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x444], 8
mov eax, dword [ebp - 0x458]
jae 0x3aaad1db
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x47c]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x1b
mov ecx, dword [eax]
lea eax, [edi + 0xfcc]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x28]
push dword [ebp - 0x47c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
push 1
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x17
call fcn.3ab3c1f6
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67ba8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov ecx, edi
call fcn.3ab3c1f6
mov dword [ebp - 0x480], eax
test eax, eax
jl 0x3aaaddee
cmp eax, 1
je 0x3aaaddee
cmp byte [edi + 0x244], 0
mov byte [ebp - 0x481], 0
je 0x3aaad2a5
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67c90
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
push dword [ebp - 0x48c]
call ebx
push dword [ebp - 0x488]
call ebx
jmp 0x3aaacc45
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67cd8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
lea eax, [ebp - 0x481]
push eax
push edi
call fcn.3aab755d
mov dword [ebp - 0x480], eax
test eax, eax
jl 0x3aaaddee
cmp byte [ebp - 0x481], 0
jne 0x3aaad290
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
cmp byte [edi + 0x24e], 0
je 0x3aaad32e
push edi
call fcn.3ab3c1f6
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad290
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67d38
jmp 0x3aaade02
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67db0
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov ecx, edi
call fcn.3aad8dac
mov dword [ebp - 0x480], eax
push 0
test eax, eax
jge 0x3aaad37e
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67e10
jmp 0x3aaade02
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67e90
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
push edi
call fcn.3aad7e85
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad3cb
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67ee8
jmp 0x3aaade02
cmp byte [edi + 0x1160], 0
jne 0x3aaad3dc
push 0
push esi
call fcn.3ab1568e
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67f58
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov eax, edi
call fcn.3aad9113
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad42c
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67fb0
jmp 0x3aaade02
cmp byte [edi + 0x1160], 0
je 0x3aaad441
mov eax, edi
call fcn.3ab3c1f6
jmp 0x3aaad290
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
cmp byte [edi + 0x244], 0
jne 0x3aaad273
push dword [ebp - 0x49c]
call ebx
and dword [ebp - 0x49c], 0
lea edx, [ebp - 0x49c]
lea eax, [edi + 0xb8c]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x440]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x42c], 0
jbe 0x3aaad4fe
sub esp, 0x1c
lea eax, [ebp - 0x440]
mov ecx, esp
mov dword [ebp - 0x47c], esp
push eax
call fcn.3ab3c1f6
mov ecx, edi
call fcn.3aacd84f
mov dword [ebp - 0x480], eax
test eax, eax
jl 0x3aaad4c4
cmp eax, 1
jne 0x3aaad4fe
push edi
call fcn.3aa94ad4
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68018
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push 0
push 1
lea ecx, [ebp - 0x440]
call fcn.3ab3c1f6
jmp 0x3aaade0e
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68090
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov ecx, edi
call fcn.3ab3c1f6
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad54b
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa680f0
jmp 0x3aaad4de
and dword [ebp - 0x498], 0
lea edx, [ebp - 0x498]
lea eax, [edi + 0xe8c]
push edx
mov byte [ebp - 4], 0x1d
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push dword [ebp - 0x498]
call fcn.3ab3c1f6
pop ecx
test eax, eax
push 0
setne byte [ebp - 0x48d]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68168
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov ecx, edi
call fcn.3aab81aa
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad5e2
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa681c0
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push dword [ebp - 0x498]
call ebx
jmp 0x3aaad4ea
cmp eax, 1
jne 0x3aaad615
push dword [ebp - 0x498]
call ebx
xor esi, esi
inc esi
push 0
push esi
lea ecx, [ebp - 0x440]
call fcn.3ab3c1f6
push dword [ebp - 0x48c]
call ebx
push dword [ebp - 0x488]
call ebx
jmp 0x3aaacc48
cmp dword [edi + 0x1150], 1
jne 0x3aaad6c2
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov ecx, edi
call fcn.3ab3c1f6
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad655
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68230
jmp 0x3aaad5c9
cmp byte [ebp - 0x48d], 0
jne 0x3aaad690
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
push edi
call fcn.3aad4946
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad690
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa682c0
jmp 0x3aaad5c9
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
push edi
call fcn.3aad4b6d
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaad6c2
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68338
jmp 0x3aaad5c9
push 0
sub esp, 0x1c
cmp byte [edi + 0x244], 0
mov ecx, esp
mov dword [ebp - 0x47c], esp
je 0x3aaad6ed
push 0x3aa67c90
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
jmp 0x3aaad5e7
push 0x3aa683a8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov ecx, edi
call fcn.3aad7452
mov dword [ebp - 0x480], eax
push 0
test eax, eax
jge 0x3aaad730
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68408
jmp 0x3aaad5c9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68480
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov ecx, edi
call fcn.3aa9cc5c
push dword [ebp - 0x49c]
mov dword [edi + 0x2dc], eax
call ebx
and dword [ebp - 0x49c], 0
lea edx, [ebp - 0x49c]
lea eax, [edi + 0xbcc]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x478]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x464], 0
jbe 0x3aaad9b8
lea eax, [ebp - 0x48d]
push eax
lea eax, [ebp - 0x481]
push eax
lea eax, [ebp - 0x4a1]
push eax
lea eax, [ebp - 0x478]
push eax
mov byte [ebp - 0x4a1], 0
mov byte [ebp - 0x481], 0
mov byte [ebp - 0x48d], 0
call fcn.3ab3c1f6
cmp byte [ebp - 0x481], 0
je 0x3aaad8d1
cmp dword [ebp - 0x460], 8
mov eax, dword [ebp - 0x474]
jae 0x3aaad7fd
lea eax, [ebp - 0x474]
push eax
push 0x105c
lea eax, [ebp - 0x45c]
push eax
call fcn.3ab1c612
push 0
sub esp, 0x1c
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x45c]
mov ecx, esp
mov dword [ebp - 0x47c], esp
push eax
call fcn.3ab3c1f6
mov ebx, edi
call fcn.3aa9f22f
xor ebx, ebx
push ebx
push 0x3aa67358
lea ecx, [ebp - 0x4d8]
call fcn.3ab3c1f6
sub esp, 0x1c
mov ecx, esp
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x47c], esp
lea edx, [ebp - 0x45c]
push edx
push eax
push ecx
call fcn.3aa971a4
add esp, 0xc
push edi
call fcn.3aab55fc
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x4d8]
call fcn.3ab3c1f6
push ebx
push edi
lea ecx, [ebp - 0x45c]
call fcn.3ab3c1f6
push ebx
push edi
lea ecx, [ebp - 0x478]
call fcn.3ab3c1f6
push dword [ebp - 0x498]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push ebx
push edi
lea ecx, [ebp - 0x440]
call fcn.3ab3c1f6
push dword [ebp - 0x48c]
call esi
push dword [ebp - 0x488]
call esi
mov esi, 0x80070057
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x3aaacc48
cmp byte [ebp - 0x4a1], 0
je 0x3aaad964
push 0
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x47c], esp
push 0x3aa63e30
push 0x104d
push eax
call fcn.3ab1c612
mov ebx, edi
call fcn.3aa9f22f
xor ebx, ebx
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa684f8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
push ebx
push 1
lea ecx, [ebp - 0x478]
call fcn.3ab3c1f6
push dword [ebp - 0x498]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push ebx
push 1
lea ecx, [ebp - 0x440]
call fcn.3ab3c1f6
push dword [ebp - 0x48c]
call esi
push dword [ebp - 0x488]
call esi
mov esi, 0x80004005
jmp 0x3aaad8c6
cmp byte [ebp - 0x48d], 0
je 0x3aaad9b8
push 0
push 0x3aa685f0
lea ecx, [ebp - 0x4d8]
call fcn.3ab3c1f6
sub esp, 0x1c
mov ecx, esp
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x47c], esp
lea edx, [ebp - 0x478]
push edx
push eax
push ecx
call fcn.3aa971a4
add esp, 0xc
push edi
call fcn.3aab55fc
push 0
push 1
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x1e
call fcn.3ab3c1f6
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
cmp dword [ebp - 0x42c], 0
jbe 0x3aaadadc
sub esp, 0x1c
lea eax, [ebp - 0x440]
mov ecx, esp
mov dword [ebp - 0x47c], esp
push eax
call fcn.3ab3c1f6
mov ecx, edi
call fcn.3aace85e
mov dword [ebp - 0x480], eax
test eax, eax
jl 0x3aaadb48
cmp eax, 1
je 0x3aaadb48
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x3aaada0c
sub eax, edx
sar eax, 1
je 0x3aaadadc
and dword [ebp - 0x494], 0
push 0x3aa63d38
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0x22
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x23
mov eax, dword [eax]
mov ecx, dword [esi]
lea edx, [ebp - 0x494]
push edx
push eax
push esi
call dword [ecx + 0x3c]
push dword [ebp - 0x47c]
mov dword [ebp - 0x480], eax
call ebx
cmp dword [ebp - 0x480], 0
jl 0x3aaadac8
push dword [ebp - 0x494]
lea ecx, [ebp - 0x480]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x25
mov eax, dword [eax]
mov ecx, dword [ebp - 0x47c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x28]
push dword [ebp - 0x4ac]
call ebx
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x480]
test eax, eax
je 0x3aaadac8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x494]
test eax, eax
je 0x3aaadadc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x4b0], 0
lea edx, [ebp - 0x4b0]
lea eax, [edi + 0xf8c]
push edx
mov byte [ebp - 4], 0x26
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push 0x3aa61344
push dword [ebp - 0x4b0]
call fcn.3ab3c1f6
pop ecx
pop ecx
test eax, eax
jne 0x3aaadb82
push dword [edi + 0x115c]
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
call fcn.3ab3c1f6
push dword [ebp - 0x4b0]
call ebx
xor esi, esi
push 0
inc esi
push esi
lea ecx, [ebp - 0x478]
call fcn.3ab3c1f6
push dword [ebp - 0x498]
call ebx
jmp 0x3aaad5f2
push edi
call fcn.3aa94ad4
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68018
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push 0
push 1
lea ecx, [ebp - 0x478]
call fcn.3ab3c1f6
jmp 0x3aaad5d5
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68678
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
cmp byte [edi + 0x1b4], 0
je 0x3aaadbb8
mov ecx, edi
call fcn.3aa9f492
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
push edi
call fcn.3aa94ad4
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
cmp byte [edi + 0x244], 0
je 0x3aaadbfb
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67c90
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
jmp 0x3aaadb22
cmp byte [edi + 0x1155], 0
jne 0x3aaadcf7
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa686d8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov ecx, edi
call fcn.3ab3c1f6
mov dword [ebp - 0x480], eax
test eax, eax
jl 0x3aaaddc1
cmp eax, 1
je 0x3aaaddc1
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa687b0
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
cmp word [ebp - 0x4b4], 0xffff
jne 0x3aaadc95
push 1
mov ecx, edi
call fcn.3ab3c1f6
test al, al
je 0x3aaadb22
push 0
mov ecx, edi
call fcn.3ab3c1f6
test al, al
je 0x3aaadb22
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68808
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
cmp dword [edi + 0x1150], 1
jne 0x3aaadcf7
mov eax, dword [esi]
push esi
call dword [eax + 0x80]
mov eax, edi
call fcn.3ab3c1f6
mov dword [ebp - 0x480], eax
test eax, eax
jge 0x3aaadcee
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68860
jmp 0x3aaaddd5
cmp eax, 1
je 0x3aaadb22
push 2
call sub.msi.dll_MsiDatabaseExportA
push 0x3aa67ad4
push 0
push eax
mov dword [ebp - 0x480], eax
call sub.msi.dll_MsiReinstallFeatureW
push 1
push 1
push dword [ebp - 0x480]
call sub.msi.dll_MsiRecordSetStringW
push 0x64
push 2
push dword [ebp - 0x480]
call sub.msi.dll_MsiRecordSetStringW
mov eax, dword [esi]
push 0
push dword [ebp - 0x480]
push 0x7a000000
push esi
call dword [eax + 0x98]
push dword [ebp - 0x480]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
xor esi, esi
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4bc], esp
push 0x3aa688d8
call fcn.3ab3c1f6
push edi
call fcn.3aab55fc
push dword [ebp - 0x4b0]
call ebx
push esi
push 1
lea ecx, [ebp - 0x478]
call fcn.3ab3c1f6
push dword [ebp - 0x498]
call ebx
push esi
push 1
lea ecx, [ebp - 0x440]
call fcn.3ab3c1f6
push dword [ebp - 0x48c]
call ebx
push dword [ebp - 0x488]
call ebx
push dword [ebp - 0x49c]
call ebx
push dword [ebp - 0x4a8]
call ebx
xor eax, eax
jmp 0x3aaade50
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa68738
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push dword [ebp - 0x4b0]
call ebx
jmp 0x3aaadb6e
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x47c], esp
push 0x3aa67c10
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push dword [ebp - 0x48c]
call ebx
jmp 0x3aaacffa
push 0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4bc], esp
push 0x3aa67718
call fcn.3ab3c1f6
mov esi, edi
call fcn.3aab5930
push dword [ebp - 0x49c]
call ebx
push dword [ebp - 0x4a8]
call ebx
mov eax, 0x80004005
call fcn.3ab35a6a
ret 4