Function at 0x1400370d0
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x760
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140134780]
xor rax, rsp
mov qword [rsp + 0x750], rax
mov rbx, rcx
call fcn.14003c3f0
mov rdx, rax
xor r15d, r15d
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140037133
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
call fcn.14003c3f0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140037165
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.14003c3f0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140037197
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.14003c3f0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400371c9
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14003c3f0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400371fb
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov r12d, r15d
cmp dword [0x140139918], r15d
je 0x140037300
lea rdx, str.DIFx64
mov cx, 0x84
call fcn.1400024b0
test eax, eax
jne 0x140037300
lea r9d, [rax + 0x10]
lea r8, str.Error
lea rdx, str.The_DIFx_API_x64_is_invalid__
mov rcx, rbx
call fcn.140001a70
mov dword [0x1404301b8], 0xfffffffd
lea rdx, [rdi - 0x18]
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140037278
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037299
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400372ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400372db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400372f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x1400385eb
lea rdx, [rbx + 0x1bc]
mov rcx, rbx
call fcn.140019ac0
test eax, eax
jne 0x14003732b
lea r8, str.C:Program_Files
mov edx, 0x104
lea rcx, [rbx + 0x1bc]
call fcn.1400a1bd0
call fcn.14003c3f0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x14003734b
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x48], rdi
lea rdx, [0x1400f1ca8]
lea rcx, [0x1401398f8]
call fcn.140006560
lea rdx, str.SOFTWAREWow6432Node
lea rcx, [rbx + 0x198]
call fcn.140006560
mov dword [0x140136210], r15d
cmp dword [rbx + 0x3b0e4], 0
jne 0x1400373ae
cmp dword [rbx + 0x3b0ec], 0
jne 0x1400373ae
cmp dword [rbx + 0x3b0e8], 0
jne 0x1400373ae
cmp dword [rbx + 0x3b0f0], 0
je 0x1400373b6
mov rcx, rbx
call fcn.140014350
or rsi, 0xffffffffffffffff
cmp dword [rbx + 0x3b0f4], 0
je 0x1400373db
mov ebp, 1
mov dword [0x140136220], ebp
mov rcx, rbx
call fcn.140037030
jmp 0x140038520
cmp dword [rbx + 0x3b0e4], 0
jne 0x140038508
cmp dword [rbx + 0x3b0ec], 0
jne 0x140038508
mov eax, dword [rbx + 0x3b0e8]
test eax, eax
jne 0x140037413
cmp dword [rbx + 0x3b0f0], eax
jne 0x140037413
mov dword [0x1404301b8], r15d
jmp 0x140038520
mov ebp, 1
test eax, eax
je 0x140037422
mov dword [rbx + 0x1b0], ebp
cmp dword [rbx + 0x3b0f0], 0
je 0x140037431
mov dword [rbx + 0x1b4], ebp
mov dword [rbx + 0x1a0], r15d
call fcn.14003c3f0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x140037458
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rdx, [0x1400ef3e8]
test rdx, 0xffffffffffff0000
jne 0x1400374a1
movzx edi, dx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400374af
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400060c0
jmp 0x1400374af
lea rcx, [rsp + 0x80]
call fcn.140006560
nop
call fcn.14003c3f0
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400374cf
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea r14, str.MicrosoftWindowsCurrentVersionUninstall_
test r14, 0xffffffffffff0000
jne 0x140037513
movzx edi, r14w
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140037521
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400060c0
jmp 0x140037521
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.140006560
nop
lea r8, [rsp + 0x78]
lea rdx, [rbx + 0x198]
lea rcx, [rsp + 0xb8]
call fcn.140006b70
nop
lea r8, [rsp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140006b70
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rax]
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete dil
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003759e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400375c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400375e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037606
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x1400383a4
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x60], 0x258
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003825f
cmp dword [rbx + 0x3b0fc], eax
je 0x14003824f
cmp dword [rbx + 0x3b10c], eax
je 0x14003779b
lea rdx, [0x1400ef3c0]
lea rcx, [rsp + 0x98]
call fcn.140007bc0
nop
mov rdx, r14
lea rcx, [rsp + 0xa0]
call fcn.140007bc0
nop
lea r8, [rsp + 0xa0]
lea rdx, [rbx + 0x198]
lea rcx, [rsp + 0xc8]
call fcn.140006b70
nop
lea r8, [rsp + 0x98]
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.140006b70
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x20], rdx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rax]
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037715
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037739
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003775d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037780
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x14003778b
mov dword [rbx + 0x1b4], ebp
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400377a1
mov dword [rbx + 0x1b4], ebp
mov rcx, rbx
call fcn.14000b920
cmp eax, 0x2004e
jae 0x1400377cd
cmp dword [rbx + 0x3b10c], 0
je 0x1400377cd
cmp dword [rbx + 0x1b4], 0
je 0x1400377cd
cmp dword [rbx + 0x1b0], 0
cmove r12d, ebp
mov dword [rsp + 0x60], 0x258
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.BackUnString
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400380a8
test r12d, r12d
jne 0x1400380a8
mov rcx, rbx
call fcn.14000b2f0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x100]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
test ecx, ecx
jne 0x1400378a3
mov rax, qword [rsp + 0x50]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x140037931
cmp dword [rdx + 0x10], ecx
jge 0x140037875
cmp dword [rax - 0xc], ecx
jge 0x140037867
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rax - 0x10], r15d
mov word [rax], 0
jmp 0x140037931
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003788c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
jmp 0x140037931
mov rdi, qword [rsp + 0x50]
mov r12d, dword [rdi - 0x10]
lea r13, [rsp + 0x100]
sub r13, rdi
sar r13, 1
mov ecx, ebp
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x1400378d9
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140004410
mov rdi, qword [rsp + 0x50]
cmp r13, r12
ja 0x1400378f9
movsxd rax, ebx
lea r12, [rax + rax]
lea r8, [rdi + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rdi
call fcn.14009f850
jmp 0x140037916
movsxd rax, ebx
lea r12, [rax + rax]
mov r9, r12
lea r8, [rsp + 0x100]
mov rdx, r12
mov rcx, rdi
call fcn.14009f640
test ebx, ebx
js 0x14003809d
cmp ebx, dword [rdi - 0xc]
jg 0x14003809d
mov dword [rdi - 0x10], ebx
mov word [r12 + rdi], 0
lea rcx, [rsp + 0x50]
call fcn.140006ac0
mov rbx, qword [rsp + 0x50]
lea r14, [rbx - 0x10]
cmp dword [r14], 0
jl 0x140037d5c
lea rdx, str.RUNDLL32
mov rcx, rbx
call fcn.14009f5d0
test rax, rax
je 0x140037d5c
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140037d5c
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x100]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
test ecx, ecx
jne 0x1400379f7
mov rdi, qword [rsp + 0x30]
lea rdx, [rdi - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140037a85
cmp dword [rdx + 0x10], eax
jge 0x1400379c9
cmp dword [rdi - 0xc], eax
jge 0x1400379bd
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rdi - 0x10], r15d
mov word [rdi], ax
jmp 0x140037a85
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400379e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
jmp 0x140037a85
mov rdi, qword [rsp + 0x30]
mov r12d, dword [rdi - 0x10]
lea r13, [rsp + 0x100]
sub r13, rdi
sar r13, 1
mov ecx, ebp
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140037a2d
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140004410
mov rdi, qword [rsp + 0x30]
cmp r13, r12
ja 0x140037a4d
movsxd rax, ebx
lea r12, [rax + rax]
lea r8, [rdi + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rdi
call fcn.14009f850
jmp 0x140037a6a
movsxd rax, ebx
lea r12, [rax + rax]
mov r9, r12
lea r8, [rsp + 0x100]
mov rdx, r12
mov rcx, rdi
call fcn.14009f640
test ebx, ebx
js 0x140037d51
cmp ebx, dword [rdi - 0xc]
jg 0x140037d51
mov dword [rdi - 0x10], ebx
mov word [r12 + rdi], 0
mov r8d, dword [rdi - 0x10]
add r8d, 0xfffffff7
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.140005d90
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140007c80
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037ad1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.C:WindowsSysWOW64_
lea rcx, [rsp + 0x48]
call fcn.140006560
mov edx, 0x190
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140037c9e
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x360]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
test ecx, ecx
jne 0x140037b81
mov rax, qword [rsp + 0x48]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x140037c0c
cmp dword [rdx + 0x10], ecx
jge 0x140037b53
cmp dword [rax - 0xc], ecx
jge 0x140037b45
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rax - 0x10], r15d
mov word [rax], 0
jmp 0x140037c0c
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037b6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x140037c0c
mov rdi, qword [rsp + 0x48]
mov r13d, dword [rdi - 0x10]
lea r12, [rsp + 0x360]
sub r12, rdi
sar r12, 1
sub ebp, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ecx
or eax, ebp
jge 0x140037bb5
mov edx, ecx
lea rcx, [rsp + 0x48]
call fcn.140004410
mov rdi, qword [rsp + 0x48]
cmp r12, r13
ja 0x140037bd5
movsxd rax, ebx
lea rbp, [rax + rax]
lea r8, [rdi + r12*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rdi
call fcn.14009f850
jmp 0x140037bf2
movsxd rax, ebx
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x360]
mov rdx, rbp
mov rcx, rdi
call fcn.14009f640
test ebx, ebx
js 0x140037c93
cmp ebx, dword [rdi - 0xc]
jg 0x140037c93
mov dword [rdi - 0x10], ebx
mov word [rdi + rbp], 0
lea rdx, str.SysWOW64_
lea rcx, [rsp + 0x90]
call fcn.140007bc0
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xf0]
call fcn.140006b70
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140007c80
nop
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037c6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037c9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140037c9e
mov ecx, 0x80070057
call fcn.140001120
int3
lea rdx, str.RunDll32.exe
lea rcx, [rsp + 0x88]
call fcn.140007bc0
nop
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xb0]
call fcn.140006b70
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140007c80
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037d00
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037d23
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov r8, rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140037fc1
mov ecx, 0x80070057
call fcn.140001120
int3
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x100]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r12, rcx
test ecx, ecx
jne 0x140037de5
mov rax, qword [rsp + 0x40]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ecx
je 0x140037e76
cmp dword [rdx + 0x10], ecx
jge 0x140037db2
cmp dword [rax - 0xc], ecx
jge 0x140037da4
mov ecx, 0x80070057
call fcn.140001120
int3
mov dword [rax - 0x10], r15d
mov word [rax], 0
jmp 0x140037e76
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037dc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x50]
jmp 0x140037e76
mov rdi, qword [rsp + 0x40]
mov r15d, dword [rdi - 0x10]
lea r13, [rsp + 0x100]
sub r13, rdi
sar r13, 1
sub ebp, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ecx
or eax, ebp
jge 0x140037e19
mov edx, ecx
lea rcx, [rsp + 0x40]
call fcn.140004410
mov rdi, qword [rsp + 0x40]
cmp r13, r15
ja 0x140037e39
movsxd rax, r12d
lea rbp, [rax + rax]
lea r8, [rdi + r13*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rdi
call fcn.14009f850
jmp 0x140037e56
movsxd rax, r12d
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x100]
mov rdx, rbp
mov rcx, rdi
call fcn.14009f640
test r12d, r12d
js 0x140038092
cmp r12d, dword [rdi - 0xc]
jg 0x140038092
mov dword [rdi - 0x10], r12d
mov word [rdi + rbp], 0
xor r15d, r15d
cmp dword [r14], 0
jl 0x140037f48
lea rdx, str.SETUP.EXE
mov rcx, rbx
call fcn.14009f5d0
mov rdi, rax
test rax, rax
je 0x140037f48
sub rdi, rbx
sar rdi, 1
cmp edi, 0xffffffff
je 0x140037f48
lea r8d, [rdi + 0xa]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.140005f20
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140007c80
nop
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037ef2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax - 0x10]
sub r8d, edi
sub r8d, 0xa
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x40]
call fcn.140005d90
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140007c80
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037f96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140037f96
xor eax, eax
mov rcx, rsi
lea rdi, str._C:Program_Files__x86_InstallShield_Installation_InformationF132AF7F_7BCA_4EDE_8A7C_958108FE7DBCSetup.exe_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._C:Program_Files__x86_InstallShield_Installation_InformationF132AF7F_7BCA_4EDE_8A7C_958108FE7DBCSetup.exe_
lea rcx, [rsp + 0x58]
call fcn.140006310
xor eax, eax
mov rcx, rsi
lea rdi, str.__runfromtemp___removeonly
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.__runfromtemp___removeonly
lea rcx, [rsp + 0x30]
call fcn.140006310
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x58]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140037fe9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003800a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003802b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003804c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003806d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14003808b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x1400385eb
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80070057
call fcn.140001120
int3
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x89
call fcn.14003c170
test rax, rax
je 0x1400380f1
mov r8d, 0x89
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400060c0
test eax, eax
je 0x1400380f1
lea r8, str.Realtek_Audio
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140006f70
jmp 0x140038102
lea rdx, str._Do_you_want_to_remove_Realtek_Audio_driver__
lea rcx, [rsp + 0x38]
call fcn.140006560
cmp dword [rbx + 0x1b4], 0
je 0x140038154
cmp dword [rbx + 0x1b0], 0
jne 0x140038154
cmp dword [rbx + 0x3b10c], 0
je 0x140038154
mov ecx, 0x8a
call fcn.14003c170
test rax, rax
je 0x140038143
mov r8d, 0x8a
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400060c0
test eax, eax
jne 0x140038154
lea rdx, str._Do_you_want_to_remove_the_Realtek_HDMI_Audio_driver__
lea rcx, [rsp + 0x38]
call fcn.140006560
mov r9d, 0x34
lea r8, str.Realtek_Audio
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140001a70
cmp eax, 6
jne 0x14003817e
mov dword [rbx + 0x1a0], ebp
jmp 0x1400384e9
mov dword [0x1404301b8], r15d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400381a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400381c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400381e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140038209
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003822a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140038248
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x1400385eb
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400384e9
cmp dword [rbx + 0x1b4], 0
je 0x1400384e9
cmp dword [rbx + 0x3b0fc], 0
je 0x1400384e9
mov ecx, 0x8a
call fcn.14003c170
test rax, rax
je 0x14003829f
mov r8d, 0x8a
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400060c0
test eax, eax
jne 0x1400382b0
lea rdx, str._Do_you_want_to_remove_the_Realtek_HDMI_Audio_driver__
lea rcx, [rsp + 0x38]
call fcn.140006560
mov r9d, 0x34
lea r8, str.Realtek_Audio
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140001a70
cmp eax, 7
jne 0x1400384e9
mov dword [0x1404301b8], r15d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400382fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003831c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003833d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003835e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003837f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14003839d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x1400385eb
cmp dword [rbx + 0x1b4], 0
je 0x1400384e9
cmp dword [rbx + 0x3b0fc], 0
je 0x1400384e9
mov ecx, 0x8a
call fcn.14003c170
test rax, rax
je 0x1400383e4
mov r8d, 0x8a
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400060c0
test eax, eax
jne 0x1400383f5
lea rdx, str._Do_you_want_to_remove_the_Realtek_HDMI_Audio_driver__
lea rcx, [rsp + 0x38]
call fcn.140006560
mov r9d, 0x34
lea r8, str.Realtek_Audio
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140001a70
cmp eax, 7
jne 0x1400384e9
mov dword [0x1404301b8], r15d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140038440
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140038461
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140038482
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400384a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400384c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400384e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x1400385eb
mov rcx, rbx
call fcn.140001950
mov rcx, rbx
call fcn.140035440
mov rcx, rbx
call fcn.1400019e0
mov rdi, qword [rsp + 0x48]
jmp 0x140038520
mov rcx, rbx
call fcn.140001950
mov rcx, rbx
call fcn.140036f40
mov rcx, rbx
call fcn.1400019e0
mov ecx, VarCyFromDisp
call fcn.140001d80
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140038547
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140038568
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140038589
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400385aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400385cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400385e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
mov rcx, qword [rsp + 0x750]
xor rcx, rsp
call fcn.1400a1970
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret