Function at 0x1400045c4
Capabilities:
Delete file
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140017018]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, qword [rbp + 0x228]
mov rax, rcx
mov r12, qword [rbp + 0x230]
mov rbx, rdx
mov rdx, qword [rbp + 0x268]
mov rsi, r9
mov r13, qword [rbp + 0x240]
mov rdi, r8
mov r15, qword [rbp + 0x248]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rbp + 0x258]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x260]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rbp + 0x278]
mov qword [rbp - 0x70], rcx
mov rcx, qword [rbp + 0x280]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x290]
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x40], rcx
cmp dword [rax], ecx
je 0x140004e44
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x68]
cmp dword [rdx + 0x30], 7
jge 0x1400046b2
mov ebx, 0x8007139f
jmp 0x140004d8c
test rbx, rbx
je 0x140004d87
test rdi, rdi
je 0x140004d87
mov rdx, qword [rdx + 0x40]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x1400046de
add rbx, 2
test ecx, ecx
jne 0x1400046cb
test eax, eax
je 0x1400046ec
mov ebx, 0x80070005
jmp 0x140004d8c
lea rcx, [rsp + 0x50]
call fcn.14000b79c
mov ebx, eax
test eax, eax
jne 0x140004d8c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004754
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d75
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x1400047a4
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
jne 0x140004d75
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x1400047ed
mov rax, rdi
inc rax
cmp word [rsi + rax*2], cx
jne 0x1400047b0
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d75
mov ecx, 4
lea rax, [rbp + 0x220]
mov dword [rsp + 0x28], ecx
lea rdx, str.SystemComponent
mov r9d, ecx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d75
mov rcx, qword [rsp + 0x30]
lea rax, str.MSICD
mov dword [rsp + 0x28], 0xc
lea rdx, str.Installer
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d75
test r14, r14
je 0x1400048a1
mov rcx, qword [rsp + 0x30]
lea rdx, str.Expire
mov eax, 4
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov r9d, eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
jne 0x140004d7a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400048f5
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
test r12, r12
je 0x140004940
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r14w
jne 0x1400048fd
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.CODEBASE
mov r9d, 1
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov esi, dword [rbp + 0x238]
test esi, esi
jne 0x140004b73
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rbp - 0x60]
mov word [rbp + 0x1a6], r14w
mov r12d, 0x103
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], r12d
lea rdx, [0x140014118]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400049e1
test r13, r13
je 0x1400049b4
lea rdx, [rbp - 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x1400049e1
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test r13, r13
jne 0x1400049e1
mov rcx, qword [rsp + 0x38]
lea rdx, [0x140014118]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x48], r12d
lea rax, [rbp - 0x60]
lea r12, [0x140014278]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x1a6], r14w
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004a6f
test r15, r15
je 0x140004a44
lea rdx, [rbp - 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004a74
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test r15, r15
jne 0x140004a74
mov rcx, qword [rsp + 0x38]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
jmp 0x140004ab6
test r15, r15
je 0x140004ab6
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r14w
jne 0x140004a77
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
test r13, r13
je 0x140004b02
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x140004abe
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x140014118]
mov r9d, 1
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004b56
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov rcx, qword [rsp + 0x30]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
jmp 0x140004c01
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004bc7
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x250]
mov r9d, 4
lea rdx, str.Precache
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov rcx, qword [rsp + 0x70]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004c09
lea eax, [rax*2 + 2]
mov r15d, 1
mov dword [rsp + 0x28], eax
mov r9d, r15d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
test esi, esi
jne 0x140004d8f
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004c9f
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004c5f
lea eax, [rax*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.LastModified
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140004ce8
inc rdi
cmp word [rcx + rdi*2], r14w
jne 0x140004ca8
lea eax, [rdi*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.Etag
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004d38
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d7a
mov rax, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov r8d, dword [rbp + 0x270]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140004e54
mov ebx, eax
test eax, eax
js 0x140004d8f
mov r9, qword [rbp - 0x68]
mov r8d, dword [rbp + 0x288]
mov rdx, qword [rsp + 0x58]
call fcn.1400044d0
mov ebx, eax
jmp 0x140004d8f
xor r14d, r14d
test eax, eax
jle 0x140004d71
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140004d8f
mov ebx, 0x80070057
xor r14d, r14d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140004da5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004dbb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004dd1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140004de7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004dfd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, qword [rsp + 0x68]
cmp dword [rax], r14d
je 0x140004e17
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140001560
mov rbx, qword [rsp + 0x308]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x8007000e
xor r14d, r14d
jmp 0x140004e02