Function at 0x1400041c0
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbfb0]
mov eax, 0xc0b0
call fcn.140019180
sub rsp, rax
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0xbfa0], rax
xor ebx, ebx
mov eax, dword [0x14002a048]
test eax, eax
je 0x140004905
cmp eax, 0x7fffffff
je 0x140004905
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r8d, [rbx + 0x13]
lea rdx, str.Updating_registry..
lea rcx, [rsp + 0x40]
call fcn.1400077c0
nop
lea rcx, [rsp + 0x40]
call fcn.1400014a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14000428d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004288
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004941
call fcn.140009910
mov eax, dword [0x14002a040]
shr rax, 1
add rax, rax
cmp rax, 0x40
jae 0x14000493b
lea rcx, [0x14002a050]
mov word [rax + rcx], bx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall53F49750_6209_4FBF_9CA8_7A333C87D1ED_is1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004905
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r8d, [rax + 0x24]
lea rdx, str.Checking_registry_install_location..
lea rcx, [rsp + 0x40]
call fcn.1400077c0
nop
lea rcx, [rsp + 0x40]
call fcn.1400014a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140004351
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000434c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004935
call fcn.140009910
mov dword [rsp + 0x38], 0x2000
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400048fa
mov edx, dword [rsp + 0x38]
shr edx, 1
mov dword [rsp + 0x38], edx
lea eax, [rdx - 1]
cmp word [rbp + rax*2 - 0x60], 0
je 0x1400043c0
lea rcx, [rdx + rdx]
lea eax, [rdx + 1]
mov dword [rsp + 0x38], eax
cmp rcx, 0x2000
jae 0x14000494d
mov word [rbp + rcx - 0x60], bx
mov eax, dword [rsp + 0x3c]
cmp eax, 2
jne 0x140004406
mov r8d, 0x1000
lea rdx, [rbp + 0x1fa0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x1000
ja 0x1400043fd
mov r8d, eax
add r8, r8
lea rdx, [rbp + 0x1fa0]
lea rcx, [rbp - 0x60]
call fcn.140019750
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x14000440f
cmp eax, 1
jne 0x1400048fa
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1fa0]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x1400048fa
mov r8d, 0x2000
lea rdx, [rbp + 0x1fa0]
lea rcx, [rbp - 0x60]
call fcn.140019750
xor r9d, r9d
lea r8, [rbp + 0x1fa0]
mov edx, 0x1000
lea rcx, [0x140023380]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 0x1000
jae 0x1400048fa
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea rax, [rbp - 0x60]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140004482
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.1400077c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rax, [rbp + 0x1fa0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400044c0
lea rdx, [rbp + 0x1fa0]
lea rcx, [rsp + 0x40]
call fcn.1400077c0
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rsp + 0x50]
sub rax, r15
cmp rax, 1
jb 0x140004947
lea r13, [rsp + 0x40]
mov r14, qword [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r13, r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
lea r12, [r15 + 1]
mov ebx, 7
lea rsi, [rsp + 0x60]
cmp r12, rbx
jbe 0x1400045bf
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x14000454e
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000457d
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140004959
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400045a9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004959
mov rcx, rax
call fcn.14000968c
test rax, rax
je 0x140004953
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400045ba
test rcx, rcx
je 0x1400045b8
call fcn.14000968c
mov rsi, rax
jmp 0x1400045ba
xor esi, esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x78], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.140019750
mov word [rbx + rsi], 0x5c
xor eax, eax
mov word [rsi + r12*2], ax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140004625
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004620
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004953
call fcn.140009910
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x14002a040]
shr eax, 1
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [0x14002a050]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_Desktop
lea rcx, [rbp + 0x3fa0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x3fa0]
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140004690
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x3fa0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_FZ_LLC
lea rcx, [rbp + 0x5fa0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x5fa0]
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400046f0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x5fa0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Publisher
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_Desktop
lea rcx, [rbp + 0x7fa0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x7fa0]
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140004750
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x7fa0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Inno_Setup:_Icon_Group
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx eax, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
mov dword [rsp + 0x20], eax
lea rdx, str._04d_02d_02d
lea rcx, [rbp + 0x9fa0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x9fa0]
nop dword [rax]
lea rdi, [rdi + 1]
cmp word [rax + rdi*2], 0
jne 0x1400047c0
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x9fa0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallDate
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
lea rbx, str.https:__desktop.telegram.org
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.HelpLink
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.URLInfoAbout
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.URLUpdateInfo
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rax, qword [rsp + 0x58]
cmp rax, 7
jbe 0x1400048be
lea rdx, [rax*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400048b5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000495f
mov rcx, r14
call fcn.140009910
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1400048fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004935
call fcn.140009910
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xbfa0]
xor rcx, rsp
call fcn.1400093d0
lea r11, [rsp + 0xc0b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140010394
int3
call fcn.1400094f8
int3
call fcn.140010394
nop
call fcn.140001200
nop
call fcn.1400094f8
nop
call fcn.140010394
int3
call fcn.140001160
nop
call fcn.140010394
int3