Function at 0x140069b70
Capabilities:
Get installed programs
Set registry value

Disassembly:
push rbp
push rdi
push r13
push r14
sub rsp, 0x888
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rbp, rcx
mov rcx, qword [rcx]
mov r13, rdx
mov qword [rsp + 0x20], rdx
lea r9, str.lpUninstInfo_x
lea r8, str.ReplaceUninstallerStore
lea rdx, str.CRegistryIF
call fcn.140080c70
xor edi, edi
test r13, r13
mov r14d, edi
je 0x140069f19
mov r9, qword [r13]
test r9, r9
je 0x140069f19
mov rcx, qword [rbp + 8]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 0x400
call fcn.140013060
test eax, eax
je 0x140069f19
mov rcx, qword [rbp]
lea rax, [rsp + 0x50]
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
lea r8, str.OpenSubKey
mov qword [rsp + 0x28], rax
lea rdx, str.CRegistryIF
mov qword [rsp + 0x8c0], rbx
mov qword [rsp + 0x20], 0xffffffff80000002
call fcn.140081070
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140069c75
mov rax, qword [rsp + 0x58]
mov ebx, 1
mov qword [rsp + 0x50], rax
mov rcx, qword [rbp]
lea r9, [0x1400fb428]
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov dword [rsp + 0x20], ebx
call fcn.140081270
test ebx, ebx
je 0x140069f11
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x880], rsi
lea r8, str.DisplayName
mov rcx, rbp
mov qword [rsp + 0x878], r12
mov qword [rsp + 0x870], r15
call fcn.1400678e0
mov r12d, 0x3fffffff
test rax, rax
je 0x140069dda
mov rcx, qword [rbp + 8]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [r13 + 8]
test r15, r15
je 0x140069dda
mov rcx, r12
mov rax, r15
mov edx, edi
cmp word [rax], dx
je 0x140069d1a
add rax, 2
sub rcx, 1
jne 0x140069d01
mov edx, 0x80070057
mov rsi, rdi
jmp 0x140069d2f
test rcx, rcx
jne 0x140069d29
mov edx, 0x80070057
mov rsi, rdi
jmp 0x140069d2f
mov rsi, r12
sub rsi, rcx
test edx, edx
js 0x140069d38
add rsi, rsi
jmp 0x140069d3b
mov rsi, rdi
test edx, edx
jns 0x140069d44
mov rsi, rdi
jmp 0x140069d48
add rsi, 2
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbp]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
lea r14, str.DisplayName
lea r9, str.hKey_x__lpszEntry_s__dwType_u__lpbyVal_x__nSize_u
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
call fcn.140081070
mov r9d, 1
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, edi
lea r9, [0x1400fb428]
test eax, eax
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
sete cl
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp]
call fcn.140081270
mov r14d, 1
mov rdx, qword [rsp + 0x50]
lea r15, str.caption
mov rcx, rbp
mov r8, r15
call fcn.1400678e0
test rax, rax
je 0x140069eee
mov rcx, qword [rbp + 8]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [r13 + 0x18]
test r13, r13
je 0x140069eee
mov rcx, r12
mov rax, r13
mov edx, edi
cmp word [rax], dx
je 0x140069e3a
add rax, 2
sub rcx, 1
jne 0x140069e21
mov edx, 0x80070057
mov r12, rdi
jmp 0x140069e4c
test rcx, rcx
jne 0x140069e49
mov edx, 0x80070057
mov r12, rdi
jmp 0x140069e4c
sub r12, rcx
test edx, edx
js 0x140069e56
lea rsi, [r12 + r12]
jmp 0x140069e59
mov rsi, rdi
test edx, edx
jns 0x140069e62
mov rsi, rdi
jmp 0x140069e66
add rsi, 2
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbp]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 1
lea r9, str.hKey_x__lpszEntry_s__dwType_u__lpbyVal_x__nSize_u
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
call fcn.140081070
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp]
test eax, eax
lea r9, [0x1400fb428]
sete dil
lea r8, str.SetValueEx
lea rdx, str.CRegistryIF
mov dword [rsp + 0x20], edi
call fcn.140081270
or r14d, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x870]
mov r12, qword [rsp + 0x878]
mov rsi, qword [rsp + 0x880]
mov rbx, qword [rsp + 0x8c0]
mov rcx, qword [rbp]
lea r9, [0x1400fb428]
lea r8, str.ReplaceUninstallerStore
lea rdx, str.CRegistryIF
mov dword [rsp + 0x20], r14d
call fcn.140080e70
mov eax, r14d
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400cd6e0
add rsp, 0x888
pop r14
pop r13
pop rdi
pop rbp
ret