Function at 0x140038580
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x2a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r12, r9
mov rbp, r8
mov rdi, rdx
mov qword [rsp + 0x78], rdx
lea r8, str.CRemoveProgramUninstaller::UninstallExists
mov edx, 2
lea r14, [0x14010f570]
mov rcx, r14
call fcn.140001000
mov qword [rsp + 0x70], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0x68], 0
mov byte [rsp + 0x58], 0
or rbx, 0xffffffffffffffff
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140002458
nop
mov r9, rbx
xor r8d, r8d
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140006164
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
lea r8, str.CRemoveProgramUninstaller_looking_for__s_n
mov ebx, 0x20
mov edx, ebx
mov rcx, r14
call fcn.140001000
and qword [rsp + 0x38], 0
and dword [rsp + 0x40], 0
lea esi, [rbx - 0x1f]
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r8, qword [rsp + 0x58]
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rsp + 0x38]
call fcn.14000bc38
test eax, eax
jne 0x1400387a0
mov byte [rsp + 0x80], al
xor edx, edx
mov r8d, 0x207
lea rcx, [rsp + 0x81]
call fcn.1400988d0
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.uninstallstring
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003875e
lea rcx, [rsp + 0x80]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x80]
mov rcx, r12
call fcn.14000352c
mov byte [rsp + 0x80], 0
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140038785
lea rcx, [rsp + 0x80]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x80]
mov rcx, rbp
call fcn.14000352c
jmp 0x140038785
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
lea r8, str.CRemoveProgramUninstaller::Delete____s_____UninstallString_doesnt_exist_n
mov edx, 0x20
mov rcx, r14
call fcn.140001000
xor esi, esi
test rbx, rbx
je 0x140038799
mov rcx, rbx
call fcn.14004e608
xor ebx, ebx
mov qword [rsp + 0x38], rbx
and dword [rsp + 0x40], 0
jmp 0x1400387c9
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
lea r8, str.CRemoveProgramUninstaller::Delete____s____UninstallString_doesnt_exist_n
mov edx, ebx
mov rcx, r14
call fcn.140001000
xor esi, esi
mov rbx, qword [rsp + 0x38]
lea r8, str.CRemoveProgramUninstaller::UninstallExists
mov edx, 4
mov rcx, r14
call fcn.140001000
nop
test rbx, rbx
je 0x1400387ec
mov rcx, rbx
call fcn.14004e608
nop
cmp qword [rsp + 0x70], 0x10
jb 0x1400387fe
mov rcx, qword [rsp + 0x58]
call fcn.14006127c
mov qword [rsp + 0x70], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0x68], 0
mov byte [rsp + 0x58], 0
cmp qword [rdi + 0x20], 0x10
jb 0x140038822
mov rcx, qword [rdi + 8]
call fcn.14006127c
mov qword [rdi + 0x20], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rdi + 0x18], 0
mov byte [rdi + 8], 0
mov eax, esi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140061100
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret