Function at 0x140012a00
Capabilities:
Check if file exists
Delete directory
Delete file
Delete registry key
Delete registry value
Get common file path
Move file
Query or enumerate registry value
Set file attributes

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14b0]
mov eax, 0x15b0
call fcn.1401945e0
sub rsp, rax
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rsp + 0x15e0], rbx
mov qword [rsp + 0x15e8], rsi
mov qword [rsp + 0x15f0], rdi
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rbp + 0x14a0], rax
xor r8d, r8d
lea rdx, str.Tool_UninstallDelete
lea rcx, [rbp - 0x70]
call fcn.140017fc0
nop
call fcn.140054cb8
mov r14, qword [rax + 8]
xor esi, esi
mov r15d, esi
mov word [rbp + 0xa60], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0xa62]
call fcn.140192cb0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.140192cb0
call fcn.140051e58
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140012abd
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
call fcn.140051e58
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140012aee
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
mov rcx, qword [r14 + 0x260]
cmp dword [rcx + 0x88], 0
je 0x140012d82
lea rdx, [rbp - 0x30]
call fcn.1400181d0
mov rcx, qword [rax]
cmp dword [rcx - 0x10], 0
setne dil
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012b4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [r14 + 0x260]
test dil, dil
je 0x140012c5c
lea rdx, [rbp - 0x28]
call fcn.1400181d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140012bc4
cmp dword [rdi + 0x10], 0
jl 0x140012bb5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140012bb5
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012baa
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140012bc4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001c20
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012be3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x38]
mov rcx, qword [r14 + 0x260]
call fcn.1400181d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x68]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140012c53
cmp dword [rdi + 0x10], 0
jl 0x140012c44
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140012c44
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012c39
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x140012c53
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140001c20
nop
mov rdx, qword [rbp - 0x38]
jmp 0x140012d58
lea rdx, [rbp - 0x20]
call fcn.1400181a0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140012cc5
cmp dword [rdi + 0x10], 0
jl 0x140012cb6
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140012cb6
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012cab
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140012cc5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001c20
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012ce4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x18]
mov rcx, qword [r14 + 0x260]
call fcn.1400181a0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x68]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140012d54
cmp dword [rdi + 0x10], 0
jl 0x140012d45
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140012d45
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012d3a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x140012d54
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140001c20
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012d73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
jmp 0x140012e56
mov rdx, qword [r14 + 0x1b8]
lea rcx, [rdx - 0x18]
lea rsi, [rbx - 0x18]
or r12, 0xffffffffffffffff
cmp rcx, rsi
je 0x140012ded
cmp dword [rsi + 0x10], 0
jl 0x140012dda
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140012dda
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012dca
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x60], rbx
mov rdi, qword [rsp + 0x68]
jmp 0x140012ded
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001c20
mov rbx, qword [rsp + 0x60]
mov rdx, qword [r14 + 0x1c0]
lea rcx, [rdx - 0x18]
lea rsi, [rdi - 0x18]
cmp rcx, rsi
je 0x140012e54
cmp dword [rsi + 0x10], 0
jl 0x140012e41
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140012e41
call fcn.140001950
mov rdi, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140012e31
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x68], rdi
mov rbx, qword [rsp + 0x60]
jmp 0x140012e54
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140001c20
mov rdi, qword [rsp + 0x68]
xor esi, esi
cmp dword [rbx - 0x10], 0
je 0x140013fdd
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013fdd
mov dword [rsp + 0x54], 0x208
mov r13d, 1
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rbp - 0x40], 0x100
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x12a0]
call fcn.140192cb0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x40]
lea r8, [rbp + 0x12a0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
cmove esi, r13d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140012ff6
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, r13d
lea r8, str.return___08x
lea edx, [r13 + 1]
lea rcx, [rbp - 0x70]
call fcn.140017c80
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140012fd0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140012ff1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140014038
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.IcnPath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call fcn.140018e80
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call fcn.140019030
test eax, eax
je 0x1400130e5
cmp esi, r13d
jne 0x1400130e5
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400130e5
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.140019030
test eax, eax
je 0x1400130e5
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 0x80]
mov qword [rsp + 0x20], r11
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013210
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.IcnPath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.140018e80
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call fcn.140019030
test eax, eax
je 0x140013206
cmp esi, r13d
jne 0x140013206
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x140013206
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.140019030
test eax, eax
je 0x140013206
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x78], r13d
mov rax, qword [r14 + 0x260]
xor esi, esi
cmp dword [rax + 0x88], esi
jne 0x1400135b7
mov word [rbp + 0x850], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x852]
call fcn.140192cb0
mov qword [rsp + 0x58], rsi
mov r9, qword [r14 + 0x1b8]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersion
lea rdx, str._sUninstall_s
lea rcx, [rbp + 0x850]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x20], r11
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x850]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001331a
lea rdx, str.Publisher
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.DisplayIcon
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.UninstallString
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, [rbp + 0x850]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000c310
call fcn.14000de00
test eax, eax
jne 0x1400135b7
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.140192cb0
mov ecx, 0x17
call fcn.14000cfc0
mov rbx, rax
lea r9, str.Canon_Printer_Uninstaller
mov r8, rax
lea rdx, str._s_s
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
test rbx, rbx
je 0x140013436
lea rax, str..LNK
mov qword [rsp + 0x28], rax
lea rax, str.Uninstaller
mov qword [rsp + 0x20], rax
mov r9, qword [r14 + 0x1b8]
mov r8, rbx
lea rdx, str._s_s__s_s
lea rcx, [rbp + 0x220]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400133d1
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400133d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r15d, r13d
lea rax, str..LNK
mov qword [rsp + 0x28], rax
lea rax, str.Uninstaller
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
lea rdx, str._s_s__s_s
lea rcx, [rbp + 0x220]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140013436
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140013433
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140013436
mov r15d, esi
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.140192cb0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1090]
call fcn.140192cb0
lea rdx, [rbp + 0xa60]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x78]
call fcn.1400020c0
nop
mov edx, 0x5c
mov rcx, qword [rsp + 0x78]
call fcn.140193dc0
test rax, rax
jne 0x1400134a6
mov eax, r12d
jmp 0x1400134ae
sub rax, qword [rsp + 0x78]
sar rax, 1
mov r8d, eax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x78]
call fcn.140017f20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x78]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14001351f
cmp dword [rdi + 0x10], 0
jl 0x140013510
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140013510
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140013505
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x14001351f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140001c20
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001353e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x1090]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rbp - 0x78], r15d
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140013592
cmp word [rbp + 0x220], 0
je 0x140013592
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001358f
lea rcx, [rbp + 0x1090]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140013592
mov dword [rbp - 0x78], esi
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400135b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x68]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x640]
call fcn.140192cb0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xc70]
call fcn.140192cb0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x430]
call fcn.140192cb0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xe80]
call fcn.140192cb0
mov r8d, 0x104
lea rdx, [rbp + 0xe80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r15d, eax
mov dword [rbp - 0x58], eax
mov rcx, qword [r14 + 0x260]
cmp dword [rcx + 0x88], 0
je 0x140013aac
call fcn.140051e58
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140013655
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
test rax, 0xffffffffffff0000
jne 0x1400136a4
movzx edi, cx
mov ecx, edi
call fcn.140051c2c
test rax, rax
je 0x14001379c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140001b00
mov rbx, qword [rsp + 0x70]
jmp 0x14001379c
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14001371b
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001379c
cmp dword [rdx + 0x10], eax
jge 0x1400136ed
cmp dword [rbx - 0xc], eax
jge 0x1400136e2
mov ecx, 0x80070057
call fcn.140001010
int3
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x14001379c
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013704
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
jmp 0x14001379c
mov r15d, dword [rbx - 0x10]
lea rsi, [rbp + 0x10]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
jns 0x140013738
mov ecx, 0x80070057
call fcn.140001010
int3
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140013758
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.1400018f0
mov rbx, qword [rsp + 0x70]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x14001377c
lea r8, [rbx + rsi*2]
call fcn.140192c44
jmp 0x140013785
lea r8, [rbp + 0x10]
call fcn.140192bbc
cmp edi, dword [rbx - 0xc]
jg 0x140013aa1
mov dword [rbx - 0x10], edi
xor esi, esi
mov word [r15 + rbx], si
mov r15d, dword [rbp - 0x58]
call fcn.140051e58
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400137bb
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x48], rdi
call fcn.140051e58
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400137eb
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rbp - 0x50], rsi
mov ecx, r13d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, 0x100
or eax, ecx
jge 0x140013820
mov edx, 0x100
lea rcx, [rbp - 0x50]
call fcn.1400018f0
mov rsi, qword [rbp - 0x50]
mov ecx, r13d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 3
or eax, ecx
jge 0x140013842
mov edx, 3
lea rcx, [rbp - 0x48]
call fcn.1400018f0
mov rdi, qword [rbp - 0x48]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
mov r9, rsi
lea r8d, [rax + 3]
mov rdx, rdi
mov rcx, rbx
call fcn.1401967f4
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.14019442c
test eax, eax
js 0x140013a96
cmp eax, dword [rdi - 0xc]
jg 0x140013a96
mov dword [rdi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rdi + rax*2], cx
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call fcn.14019442c
test eax, eax
js 0x140013a8b
cmp eax, dword [rsi - 0xc]
jg 0x140013a8b
mov dword [rsi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rsi + rax*2], cx
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x48]
lea rcx, [rbp]
call fcn.1400182c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14001392f
cmp dword [rbx + 0x10], 0
jl 0x140013920
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140013920
call fcn.140001950
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140013915
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14001392f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140001c20
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001394e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x70]
mov ecx, dword [rdi - 0x10]
lea eax, [rcx - 1]
test eax, eax
js 0x140013a80
cmp eax, ecx
jg 0x140013a80
cdqe
cmp word [rdi + rax*2], 0x5c
jne 0x140013a07
lea r8d, [rcx - 1]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140017f20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400139e3
cmp dword [rdi + 0x10], 0
jl 0x1400139d4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400139d4
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400139c9
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x1400139e3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140001c20
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013a02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x70]
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.140195e58
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013a39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013a59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013a79
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x68]
jmp 0x140013aac
mov ecx, 0x80070057
call fcn.140001010
int3
mov ecx, 0x80070057
call fcn.140001010
int3
mov ecx, 0x80070057
call fcn.140001010
nop
mov ecx, 0x80070057
call fcn.140001010
nop
test r15d, r15d
je 0x140013af6
cmp dword [r14 + 0x780], 0
jne 0x140013af6
mov edx, 0x5c
lea rcx, [rbp + 0xe80]
call fcn.140193dc0
mov rbx, rax
lea r8, [rbp + 0x10]
lea rcx, [rbp + 0x640]
test rax, rax
je 0x140013b01
mov r9, rax
lea rdx, [0x1401c9460]
call qword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
mov word [rbx], si
jmp 0x140013b17
lea r8, [rbp + 0x10]
lea rcx, [rbp + 0x640]
lea r9, [0x1401cb4c8]
lea rdx, str._s_s
call qword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
lea r9, str.Uninst.ini
lea r8, [rbp + 0x10]
lea rdx, str._s_s
lea rcx, [rbp + 0xc70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x104
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0x104
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140013bc2
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rax + 2]
lea rcx, [rbp - 0x70]
call fcn.140017c80
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013b91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140013bb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.140018150
xor eax, eax
jmp 0x140014044
lea r9, str.UNINSTAL.tmp
lea r8, [rbp + 0x430]
lea rdx, str._s_s
lea rcx, [rbp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x640]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140013d2c
lea rcx, [rbp + 0x640]
cmp dword [r14 + 0x780], 0
je 0x140013c9b
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140013d2c
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rax + 2]
lea rcx, [rbp - 0x70]
call fcn.140017c80
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013c6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140013c8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.140018150
xor eax, eax
jmp 0x140014044
mov r8d, 2
lea rdx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140013cc7
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x140013d2c
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rbp - 0x70]
call fcn.140017c80
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013cfb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140013d1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.140018150
xor eax, eax
jmp 0x140014044
lea rcx, [rbp + 0xc70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140013d4f
lea rcx, [rbp + 0xc70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r15d, eax
jmp 0x140013d52
mov r15d, r13d
call fcn.140051e58
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140013d71
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x60], rbx
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
test rax, 0xffffffffffff0000
jne 0x140013dbd
movzx edi, cx
mov ecx, edi
call fcn.140051c2c
test rax, rax
je 0x140013ebb
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140001b00
mov rbx, qword [rbp - 0x60]
jmp 0x140013ebb
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140013e33
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140013ebb
cmp dword [rdx + 0x10], eax
jge 0x140013e06
cmp dword [rbx - 0xc], eax
jge 0x140013dfb
mov ecx, 0x80070057
call fcn.140001010
int3
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x140013ebb
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013e1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x60], rbx
jmp 0x140013ebb
mov eax, dword [rbx - 0x10]
mov dword [rbp - 0x58], eax
lea rsi, [rbp + 0x10]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
jns 0x140013e52
mov ecx, 0x80070057
call fcn.140001010
int3
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140013e70
mov edx, edi
lea rcx, [rbp - 0x60]
call fcn.1400018f0
mov rbx, qword [rbp - 0x60]
mov eax, dword [rbp - 0x58]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, rax
movsxd rax, edi
ja 0x140013e99
add rax, rax
lea r8, [rbx + rsi*2]
mov rsi, rax
mov r9, rax
call fcn.140192c44
jmp 0x140013ea9
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rbp + 0x10]
call fcn.140192bbc
cmp edi, dword [rbx - 0xc]
jg 0x140013fd2
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [rbx + rsi], ax
lea rcx, [r14 + 0x218]
lea rsi, [rbx - 0x18]
mov rdi, qword [rcx]
sub rdi, 0x18
cmp rsi, rdi
je 0x140013f1f
cmp dword [rdi + 0x10], 0
jl 0x140013f12
mov rax, qword [rdi]
cmp qword [rsi], rax
jne 0x140013f12
mov rcx, rsi
call fcn.140001950
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140013f05
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [r14 + 0x218], rax
jmp 0x140013f1f
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
call fcn.140001c20
nop
mov eax, r12d
lock xadd dword [rsi + 0x10], eax
dec eax
test eax, eax
jg 0x140013f39
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp r15d, 1
jne 0x140013f69
lea r9, [r14 + 0x370]
lea rcx, [r14 + 0x578]
lea r8, [rbp + 0x10]
lea rdx, str._s_s
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [r14 + 0x36c], r13d
mov r15d, dword [rbp - 0x78]
mov r9d, r15d
lea r8, str.return___08x
mov edx, 2
lea rcx, [rbp - 0x70]
call fcn.140017c80
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013fa3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140013fc4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.140018150
mov eax, r15d
jmp 0x140014044
mov ecx, 0x80070057
call fcn.140001010
nop
mov r13d, 1
mov r9d, r13d
lea r8, str.return___08x
lea edx, [r13 + 1]
lea rcx, [rbp - 0x70]
call fcn.140017c80
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140014017
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140014038
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.140018150
mov eax, r13d
mov rcx, qword [rbp + 0x14a0]
xor rcx, rsp
call fcn.1401945b0
lea r11, [rsp + 0x15b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret