Function at 0x1001f030
Capabilities:
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006579b
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x3bc]
push eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c0], 0
call fcn.1000b5c0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x14c], xmm0
mov byte [ebp - 0x134], 0
movq qword [ebp - 0x13c], xmm0
mov byte [ebp - 4], 1
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov word [ebp - 0x130], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
mov byte [ebp - 4], 2
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x3d4], 0x407
push eax
movups xmmword [ebp - 0x110], xmm0
call fcn.10002c50
mov ecx, dword [ebp - 0x3d4]
mov edx, eax
mov dword [ebp - 0xfc], ecx
xor eax, eax
mov dword [ebp - 0x110], edx
mov ecx, 0x200
mov dword [ebp - 0x100], 0x401
mov edi, edx
rep stosd dword es:[edi], eax
add esp, 8
stosw word es:[edi], ax
xor eax, eax
mov word [edx + 0x802], ax
mov byte [ebp - 4], 3
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], al
mov byte [ebp - 4], 4
xorps xmm0, xmm0
push 0xf
push 0x10096900
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x16c], eax
movups xmmword [ebp - 0x17c], xmm0
mov dword [ebp - 0x168], eax
call fcn.10002cb0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x17c]
mov edx, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x2fc]
push eax
call fcn.1000bef0
add esp, 4
mov byte [ebp - 4], 6
cmp byte [ebp - 0x130], 0
jne 0x1001f2e5
lea ecx, [ebp - 0x12c]
mov byte [ebp - 0x12f], 1
cmp ecx, eax
je 0x1001f1e7
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x1001f1da
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10006ea0
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001c5c0
mov byte [ebp - 4], 7
cmp byte [ebp - 0x12f], 0
je 0x1001f24e
cmp dword [ebp - 0xc4], 7
lea eax, [ebp - 0xd8]
push 0
cmova eax, dword [ebp - 0xd8]
push 0x1388
push 0x400
push 0x400
push 0xff
push 6
push 3
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp byte [ebp - 0x12f], 0
mov dword [ebp - 0x114], eax
jne 0x1001f791
cmp dword [ebp - 0xc4], 7
lea eax, [ebp - 0xd8]
push 0
cmova eax, dword [ebp - 0xd8]
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
jne 0x1001f791
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xc4]
cmp eax, 7
jbe 0x1001f2c8
mov ecx, dword [ebp - 0xd8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x1001f2bd
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x1001f2c8
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2fc]
call fcn.10005610
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x17c]
call fcn.10005610
xorps xmm0, xmm0
mov dword [ebp - 0xb0], 0
xor eax, eax
mov dword [ebp - 0xac], 0
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov byte [ebp - 4], 8
movups xmmword [ebp - 0xa8], xmm0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x404], eax
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x400], eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x3fc], eax
call fcn.1001cd60
cmp byte [eax + 0x1c], 0
je 0x1001f4c0
call fcn.1001cd60
mov dword [ebp - 0x3c4], eax
call fcn.1000a220
mov edi, eax
test edi, edi
je 0x100210f5
mov edx, dword [edi]
mov esi, dword [edx + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3d4]
push 0x15
push str.WAITING_HANDLE_ACCESS
call fcn.100117e0
call fcn.1000a220
mov edi, eax
test edi, edi
je 0x100210f5
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x3f0]
push 0
push 0x10093cf4
call fcn.100117e0
mov esi, dword [ebp - 0x3c4]
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1001f464
push str.AiEmbeddedDirectCall
push eax
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
cmp eax, 1
je 0x1001f464
lea eax, [ebp - 0x3d4]
mov ecx, esi
push eax
call fcn.1001cf80
mov byte [ebp - 4], 0xc
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3f0]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f492
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
mov byte [ebp - 4], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3d4]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f4c0
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
mov byte [ebp - 0x3c9], al
call fcn.1001cd60
cmp byte [eax + 0x1c], 0
je 0x1001f633
call fcn.1001cd60
mov dword [ebp - 0x3c4], eax
call fcn.1000a220
mov edi, eax
test edi, edi
je 0x100210f5
mov edx, dword [edi]
mov esi, dword [edx + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3d8], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x3d8]
push 0x16
push str.RECEIVE_HANDLE_ACCESS
call fcn.100117e0
cmp dword [ebp - 0xac], 7
lea edx, [ebp - 0xc0]
jbe 0x1001f54a
mov edx, dword [ebp - 0xc0]
test edx, edx
je 0x1001f56c
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f550
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3d8]
call fcn.100117e0
call fcn.1000a220
mov edi, eax
test edi, edi
je 0x100210f5
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x3ec]
push 0
push 0x10093cf4
call fcn.100117e0
mov esi, dword [ebp - 0x3c4]
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1001f5d7
push str.AiEmbeddedDirectCall
push eax
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
cmp eax, 1
je 0x1001f5d7
lea eax, [ebp - 0x3d8]
mov ecx, esi
push eax
call fcn.1001cf80
mov byte [ebp - 4], 0x16
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3ec]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f605
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
mov byte [ebp - 4], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3d8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f633
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
cmp dword [ebp - 0x94], 7
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x98], 0
cmova eax, dword [ebp - 0xa8]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0xac]
cmp ecx, 7
mov edx, dword [ebp - 0xb0]
cmova eax, dword [ebp - 0xc0]
cmp edx, 7
jne 0x1001f84c
mov edi, edx
mov esi, str.Resolve
test edi, edi
je 0x1001f6ae
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001f846
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001f690
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
cmp dword [ebp - 0xac], 7
lea edi, [ebp - 0xc0]
mov ecx, dword [ebp - 0xb0]
cmova edi, dword [ebp - 0xc0]
test ecx, ecx
je 0x1001f7db
xor esi, esi
mov edx, edi
test ecx, ecx
je 0x1001f711
cmp word [edi], 0x5b
je 0x1001f70f
nop dword [eax + eax]
cmp ecx, 1
je 0x1001f711
add edx, 2
dec ecx
cmp word [edx], 0x5b
jne 0x1001f700
mov esi, edx
test esi, esi
je 0x1001f7db
sub esi, edi
sar esi, 1
cmp esi, 0xffffffff
je 0x1001f7db
mov edx, dword [ebp - 0x3c8]
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x35c]
call fcn.1000bc00
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x1001f782
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x35c]
jmp 0x10020ef2
mov byte [ebp - 0x130], 1
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xc4]
cmp eax, 7
jbe 0x1001f2c8
mov ecx, dword [ebp - 0xd8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x1001f2bd
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
jmp 0x1001f2bd
mov edx, dword [ebp - 0x3c8]
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x314]
call fcn.1000bef0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x1001f837
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x314]
jmp 0x10020ef2
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
lea eax, [ebp - 0xc0]
cmp ecx, 7
cmova eax, esi
cmp edx, 4
jne 0x1001f9cc
mov edi, edx
mov esi, str.Eval
test edi, edi
je 0x1001f89e
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop word [eax + eax]
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001f9c0
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001f880
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
cmp dword [ebp - 0xac], 7
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiGetComponentStateW]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x1fc], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1f8], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x20c], xmm0
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f920
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x20c]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 1
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x20c]
xor eax, eax
and esi, 0xfffffffe
mov word [ebp - 0x20c], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1fc]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 9
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f8], 7
mov word [ebp - 0x20c], ax
jmp 0x10020ef7
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0xf
jne 0x1001fa2c
mov edi, edx
mov esi, str.GetFeatureState
test edi, edi
je 0x1001fa0a
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fa20
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001f9f0
push dword [sym.imp.msi.dll_MsiGetFeatureValidStatesW]
lea ecx, [ebp - 0x408]
call fcn.10021100
jmp 0x10020ef7
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0x15
jne 0x1001fca5
mov edi, edx
mov esi, str.GetFeatureValidStates
test edi, edi
je 0x1001fa72
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fc99
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001fa54
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
cmp dword [ebp - 0xac], 7
lea ecx, [ebp - 0x3f8]
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
push ecx
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiGetProductCodeW]
mov ecx, dword [ebp - 0x3f8]
mov esi, eax
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push ecx
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1e0], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1f4], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fb00
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1f4]
call fcn.10002cb0
mov edi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or edi, 8
mov dword [ebp - 0x3c0], edi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1f4]
xor eax, eax
and edi, 0xfffffff7
mov word [ebp - 0x1f4], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1e4]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 7
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa8]
push 0x100968fc
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], 7
mov word [ebp - 0x1f4], ax
call fcn.10006e20
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push esi
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x274], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x270], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x284], xmm0
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fbf0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x284]
call fcn.10002cb0
lea eax, [ebp - 0x284]
or edi, 4
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064d0
and edi, 0xfffffffb
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x270]
cmp eax, 7
jbe 0x1001fc77
mov ecx, dword [ebp - 0x284]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x1001fc6c
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x1001fc77
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
jmp 0x10020ef7
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0x11
jne 0x1001fd0c
mov edi, edx
mov esi, str.GetComponentState
test edi, edi
je 0x1001fcea
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop dword [eax]
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fd00
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001fcd0
push dword [sym.imp.msi.dll_MsiGetFeatureInfoA]
lea ecx, [ebp - 0x408]
call fcn.10021100
jmp 0x10020ef7
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0xb
jne 0x1001fed8
mov edi, edx
mov esi, str.DoMsiAction
test edi, edi
je 0x1001fd52
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001fecc
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001fd34
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
push 0x10093d00
push str.AiEmbeddedDirectCall
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x3c8]
mov edi, dword [ebp - 0x3c0]
or edi, 0x20
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x3c0], edi
and edi, 0xffffffdf
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 4], 0x23
sub esp, 0x18
or edi, 0x10
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x3c0], edi
mov ecx, esp
mov esi, dword [ebp - 0x3c8]
mov dword [ebp - 0x418], esp
push eax
call fcn.100057f0
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x23
mov ecx, esi
call fcn.1001e830
add esp, 0x18
lea ecx, [ebp - 0xa8]
push 1
push 0x10096a20
call fcn.10006ea0
cmp dword [ebp - 0x94], 7
lea edx, [ebp - 0xa8]
xorps xmm0, xmm0
mov dword [ebp - 0x2a4], 0
cmova edx, dword [ebp - 0xa8]
mov ecx, edx
mov dword [ebp - 0x2a0], 0
movups xmmword [ebp - 0x2b4], xmm0
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fe40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2b4]
call fcn.10002cb0
mov byte [ebp - 4], 0x26
lea edx, [ebp - 0x3dc]
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x2a0], 7
push 0
push edx
lea ecx, [eax + eax]
lea eax, [ebp - 0x2b4]
cmova eax, dword [ebp - 0x2b4]
push ecx
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2b4]
call fcn.10005610
and edi, 0xffffffef
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x410]
call fcn.10022570
jmp 0x10020ef7
mov ecx, dword [ebp - 0xac]
mov esi, dword [ebp - 0xc0]
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, esi
cmp edx, 0xb
jne 0x1001ff2a
mov edi, edx
mov esi, 0x10096a24
test edi, edi
je 0x1001ff20
sub eax, esi
mov dword [ebp - 0x3c4], eax
nop dword [eax]
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x1001ff24
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x1001ff00
mov ecx, dword [ebp - 0xac]
mov al, 1
jmp 0x1001ff2c
mov ecx, dword [ebp - 0xac]
xor al, al
test al, al
je 0x100200cc
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
xorps xmm0, xmm0
mov dword [ebp - 0x214], 0
xor eax, eax
mov dword [ebp - 0x210], 0
movups xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 7
mov word [ebp - 0x224], ax
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
cmp dword [ebp - 0x210], 7
lea ecx, [ebp - 0x224]
lea eax, [ebp - 0xc0]
cmova ecx, dword [ebp - 0x224]
cmp dword [ebp - 0xac], 7
push ecx
cmova eax, dword [ebp - 0xc0]
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1c8], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1dc], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020022
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1dc]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 0x40
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1dc]
xor eax, eax
and esi, 0xffffffbf
mov word [ebp - 0x1dc], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1cc]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], 7
mov word [ebp - 0x1dc], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x224]
jmp 0x10020ef2
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
cmp edx, 0xd
jne 0x1002011e
mov edi, edx
mov esi, str.SetTargetPath
test edi, edi
je 0x10020114
sub eax, esi
mov dword [ebp - 0x3c4], eax
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x10020118
mov eax, dword [ebp - 0x3c4]
add esi, 2
sub edi, 1
jne 0x100200f4
mov ecx, dword [ebp - 0xac]
mov al, 1
jmp 0x10020120
mov ecx, dword [ebp - 0xac]
xor al, al
test al, al
je 0x100205a0
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
xorps xmm0, xmm0
mov dword [ebp - 0x184], 0
xor eax, eax
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x194], xmm0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 7
mov word [ebp - 0x194], ax
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
mov edi, dword [ebp - 0x184]
test edi, edi
je 0x100204b0
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x2bc], 0
push str.AiDelayedActions
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0x2b8], 0
movups xmmword [ebp - 0x2cc], xmm0
call fcn.10002cb0
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x2cc]
mov edx, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x32c]
push eax
call fcn.1000bef0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x1002023f
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x32c]
call fcn.10005610
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x2cc]
call fcn.10005610
push str._SetTargetPath_
lea ecx, [ebp - 0xa8]
call fcn.10006e20
cmp dword [ebp - 0xac], 7
lea ecx, [ebp - 0xc0]
mov esi, dword [ebp - 0x98]
cmova ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0xb0]
sub eax, esi
mov dword [ebp - 0x3d0], edx
mov dword [ebp - 0x3f4], ecx
mov dword [ebp - 0x3c4], esi
cmp edx, eax
ja 0x100202f8
cmp dword [ebp - 0x94], 7
lea eax, [edx + esi]
mov dword [ebp - 0x98], eax
lea esi, [ebp - 0xa8]
cmova esi, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x3c4]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x3f4]
push ecx
call fcn.1004f2c0
mov eax, dword [ebp - 0x3d0]
add esp, 0xc
add eax, dword [ebp - 0x3c4]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x1002030c
push edx
push ecx
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xa8]
push edx
call fcn.100065f0
push 0x100968fc
lea ecx, [ebp - 0xa8]
call fcn.10006e20
cmp dword [ebp - 0x180], 7
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x98]
cmova edx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x94]
sub eax, ecx
mov dword [ebp - 0x3d0], ecx
cmp edi, eax
ja 0x10020386
cmp dword [ebp - 0x94], 7
lea eax, [edi + ecx]
lea esi, [ebp - 0xa8]
mov dword [ebp - 0x98], eax
cmova esi, dword [ebp - 0xa8]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.1004f2c0
mov eax, dword [ebp - 0x3d0]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x1002039a
push edi
push edx
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xa8]
push edi
call fcn.100065f0
cmp dword [ebp - 0x94], 7
lea eax, [ebp - 0xa8]
cmova eax, dword [ebp - 0xa8]
push eax
push str.AiDelayedActions
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1b0], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1c4], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020400
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 0x80
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1c4]
xor eax, eax
and esi, 0xffffff7f
mov word [ebp - 0x1c4], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x1b4]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], 7
mov word [ebp - 0x1c4], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x194]
jmp 0x10020ef2
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push 0xd
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x19c], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x198], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1ac], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100204f0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1ac]
call fcn.10002cb0
mov esi, dword [ebp - 0x3c0]
lea ecx, [ebp - 0xa8]
or esi, 0x100
mov dword [ebp - 0x3c0], esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x1ac]
xor eax, eax
and esi, 0xfffffeff
mov word [ebp - 0x1ac], ax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [ebp - 0x19c]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 7
mov dword [ebp - 0x3c0], esi
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], 7
mov word [ebp - 0x1ac], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x194]
jmp 0x10020ef2
cmp ecx, 7
lea eax, [ebp - 0xc0]
cmova eax, dword [ebp - 0xc0]
cmp edx, 0xc
jne 0x100205fa
mov edi, edx
mov esi, str.EnumCompCost
test edi, edi
je 0x100205f0
sub eax, esi
mov dword [ebp - 0x3d0], eax
nop dword [eax + eax]
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x100205f4
mov eax, dword [ebp - 0x3d0]
add esi, 2
sub edi, 1
jne 0x100205d0
mov ecx, dword [ebp - 0xac]
mov al, 1
jmp 0x100205fc
mov ecx, dword [ebp - 0xac]
xor al, al
test al, al
je 0x10020c89
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
xorps xmm0, xmm0
mov dword [ebp - 0xc8], 0
xor eax, eax
mov dword [ebp - 0xc4], 0
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
cmp dword [ebp - 0xc4], 7
lea eax, [ebp - 0xd8]
cmova eax, dword [ebp - 0xd8]
push eax
call fcn.10055341
mov edi, eax
mov dword [ebp - 0x154], 0
xorps xmm0, xmm0
mov dword [ebp - 0x150], 0
xor eax, eax
mov dword [ebp - 0x154], 0
movups xmmword [ebp - 0x164], xmm0
add esp, 4
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
cmp dword [ebp - 0x150], 7
lea eax, [ebp - 0x164]
cmova eax, dword [ebp - 0x164]
push eax
call fcn.10055341
mov esi, eax
mov dword [ebp - 0xe0], 0
xorps xmm0, xmm0
mov dword [ebp - 0xdc], 0
xor eax, eax
mov dword [ebp - 0x3e4], 0
movups xmmword [ebp - 0xf0], xmm0
add esp, 4
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 7
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xf0]
push eax
mov eax, 0x64
mov dword [ebp - 0x3e8], 0x64
sub eax, dword [ebp - 0xe0]
push eax
call fcn.100070c0
cmp dword [ebp - 0xdc], 7
lea ecx, [ebp - 0xf0]
lea edx, [ebp - 0x3e0]
cmova ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xc0]
cmp dword [ebp - 0xac], 7
push edx
cmova eax, dword [ebp - 0xc0]
lea edx, [ebp - 0x3e4]
push edx
lea edx, [ebp - 0x3e8]
push edx
push ecx
push esi
push edi
push eax
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiProvideAssemblyA]
mov edx, dword [ebp - 0x3e8]
mov esi, eax
mov ecx, dword [ebp - 0xe0]
cmp edx, ecx
ja 0x1002080d
cmp dword [ebp - 0xdc], 7
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xe0], edx
cmova ecx, dword [ebp - 0xf0]
xor eax, eax
mov word [ecx + edx*2], ax
jmp 0x1002081d
sub edx, ecx
lea ecx, [ebp - 0xf0]
push 0
push edx
call fcn.100070c0
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.100057f0
mov edi, dword [ebp - 0x3c0]
lea eax, [ebp - 0x2fc]
or edi, 0x200
lea ecx, [ebp - 0xa8]
push eax
mov dword [ebp - 0x3c0], edi
call fcn.100064d0
and edi, 0xfffffdff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x2fc]
call fcn.10005610
push 0x100968fc
lea ecx, [ebp - 0xa8]
call fcn.10006e20
mov eax, dword [ebp - 0x3e4]
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x258], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x26c], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100208c7
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.10002cb0
lea eax, [ebp - 0x26c]
or edi, 0x400
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064d0
and edi, 0xfffffbff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x258]
cmp eax, 7
jbe 0x10020954
mov ecx, dword [ebp - 0x26c]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020949
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x10020954
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x25c], 0
push 0x100968fc
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], ax
call fcn.10006e20
mov eax, dword [ebp - 0x3e0]
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x90]
push 0xa
push 0x40
push ecx
push eax
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x240], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x254], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100209c6
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.10002cb0
lea eax, [ebp - 0x254]
or edi, 0x800
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064d0
and edi, 0xfffff7ff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x240]
cmp eax, 7
jbe 0x10020a53
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020a48
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x10020a53
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x244], 0
push 0x100968fc
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
call fcn.10006e20
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x90]
push 0xa
push 0x40
push eax
push esi
call fcn.1005467e
xorps xmm0, xmm0
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x228], 0
add esp, 0x10
lea edx, [ecx + 2]
movups xmmword [ebp - 0x23c], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020ac0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.10002cb0
lea eax, [ebp - 0x23c]
or edi, 0x1000
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x3c0], edi
call fcn.100064d0
and edi, 0xffffefff
mov dword [ebp - 0x3c0], edi
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x228]
cmp eax, 7
jbe 0x10020b4d
mov ecx, dword [ebp - 0x23c]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020b42
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x10020b4d
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0xdc]
cmp eax, 7
jbe 0x10020bab
mov ecx, dword [ebp - 0xf0]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020ba0
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x10020bab
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 7
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x150]
cmp eax, 7
jbe 0x10020c09
mov ecx, dword [ebp - 0x164]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020bfe
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x10020c09
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xc4]
cmp eax, 7
jbe 0x10020c67
mov ecx, dword [ebp - 0xd8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020c5c
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210eb
test ecx, ecx
je 0x10020c67
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
jmp 0x10020ef7
test edx, edx
je 0x10020ef7
cmp ecx, 7
lea edi, [ebp - 0xc0]
cmova edi, dword [ebp - 0xc0]
cmp edx, 0xf
jne 0x10020cc9
mov esi, str.SetFeatureState
test edx, edx
je 0x10020cc5
sub edi, esi
movzx ecx, word [edi + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x10020cc9
add esi, 2
sub edx, 1
jne 0x10020cb1
mov al, 1
jmp 0x10020ccb
xor al, al
test al, al
je 0x10020ef7
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
lea ecx, [ebp - 0x14c]
call fcn.1001c4d0
xorps xmm0, xmm0
mov dword [ebp - 0x28c], 0
xor eax, eax
mov dword [ebp - 0x288], 0
movups xmmword [ebp - 0x29c], xmm0
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001be30
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], 0
push str.AiDelayedActions
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
call fcn.10002cb0
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x2e4]
mov edx, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x344]
push eax
call fcn.1000bef0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x10020ddc
mov ecx, eax
call fcn.10005610
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x344]
call fcn.10005610
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2e4]
call fcn.10005610
push str._SetFeatureState_
lea ecx, [ebp - 0xa8]
call fcn.10006e20
cmp dword [ebp - 0xac], 7
lea edx, [ebp - 0xc0]
mov ecx, dword [ebp - 0x98]
cmova edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x94]
mov edi, dword [ebp - 0xb0]
sub eax, ecx
mov dword [ebp - 0x3d0], ecx
cmp edi, eax
ja 0x10020e7a
cmp dword [ebp - 0x94], 7
lea eax, [ecx + edi]
lea esi, [ebp - 0xa8]
mov dword [ebp - 0x98], eax
cmova esi, dword [ebp - 0xa8]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.1004f2c0
mov eax, dword [ebp - 0x3d0]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x10020e8e
push edi
push edx
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xa8]
push edi
call fcn.100065f0
push 0x100968fc
lea ecx, [ebp - 0xa8]
call fcn.10006e20
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.100064d0
cmp dword [ebp - 0x94], 7
lea eax, [ebp - 0xa8]
cmova eax, dword [ebp - 0xa8]
push eax
push str.AiDelayedActions
push dword [ebp - 0x3c8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
push 1
push 0x10096a20
lea ecx, [ebp - 0xa8]
call fcn.10006ea0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x29c]
call fcn.10005610
cmp dword [ebp - 0x94], 7
lea edx, [ebp - 0xa8]
xorps xmm0, xmm0
mov dword [ebp - 0x16c], 0
cmova edx, dword [ebp - 0xa8]
mov ecx, edx
mov dword [ebp - 0x168], 0
movups xmmword [ebp - 0x17c], xmm0
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020f30
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x17c]
call fcn.10002cb0
mov byte [ebp - 4], 0x38
lea edx, [ebp - 0x414]
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x168], 7
push 0
push edx
lea ecx, [eax + eax]
lea eax, [ebp - 0x17c]
cmova eax, dword [ebp - 0x17c]
push ecx
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17c]
call fcn.10005610
cmp byte [ebp - 0x3c9], 0
je 0x1001f3a0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x94]
cmp eax, 7
jbe 0x10020fed
mov ecx, dword [ebp - 0xa8]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10020fe2
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210f0
test ecx, ecx
je 0x10020fed
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xac]
cmp eax, 7
jbe 0x1002104b
mov ecx, dword [ebp - 0xc0]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10021040
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100210f0
test ecx, ecx
je 0x1002104b
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x14c]
call fcn.1001c650
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x110]
call fcn.10005610
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x12c]
call fcn.10005610
mov byte [ebp - 4], 0
mov al, byte [ebp - 0x134]
test al, al
je 0x100210b0
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor al, al
lea ecx, [ebp - 0x134]
xchg byte [ecx], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3bc]
call fcn.1000b910
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d40a
mov esp, ebp
pop ebp
ret 4
call fcn.10050f8f
call fcn.10050f8f
push 0x80004005
call fcn.10005390
int3