Function at 0x1400061a0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140053018]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edi, edi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400062b5
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
lea r8d, [rdi + 0x57]
lea rdx, str.__Failed_to_check_if_Riot_Vanguard_is_installed__manually_check_and_uninstall__Error_6_
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
lea rcx, [0x140053ca0]
call fcn.14000c0d0
lea rdx, str._X_
call fcn.1400020f0
lea rcx, [0x140053c90]
call fcn.14000c0d0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.1400101d0
mov rcx, rax
call fcn.14000db50
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000671b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006749
jmp 0x140006716
mov ebx, edi
xor edx, edx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x70], pe_nt_image_headers64
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x60]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rcx, qword [rbp - 0x80]
test eax, eax
jne 0x140006666
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400065a8
mov dword [rbp - 0x6c], pe_nt_image_headers64
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140006364
lea rdx, str.Riot_Vanguard
lea rcx, [rbp + 0xa0]
call fcn.14003cda0
test eax, eax
je 0x140006377
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
mov edx, ebx
jmp 0x1400062b9
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14001510c
lea rsi, str.C:Program_FilesRiot_Vanguardinstaller.exe
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0x2c
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400033c0
nop
lea rcx, [rsp + 0x60]
call fcn.140004800
movzx ebx, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140006406
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006401
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000675b
call fcn.140016d84
test bl, bl
je 0x1400064f1
xor r9d, r9d
lea r8, str.installer.exe
mov rdx, rsi
xor ecx, ecx
call fcn.140024104
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x54
lea rdx, str.__Successfully_prompted_the_user_to_uninstall_Riot_Vanguard__press_Yes_to_uninstall_
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
lea rcx, [0x140053c40]
call fcn.14000c0d0
lea rdx, str.__
call fcn.1400020f0
lea rcx, [0x140053c90]
call fcn.14000c0d0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.1400101d0
lea rcx, [0x140053c80]
call fcn.14000c0d0
lea rdx, str.__CHANGED_
call fcn.1400020f0
mov rcx, rax
call fcn.14000db50
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000671b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000674f
jmp 0x140006716
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x41
lea rdx, str.__Failed_to_uninstall_Riot_Vanguard__manually_uninstall__Error_8_
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
lea rcx, [0x140053ca0]
call fcn.14000c0d0
lea rdx, str._X_
call fcn.1400020f0
lea rcx, [0x140053c90]
call fcn.14000c0d0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.1400101d0
mov rcx, rax
call fcn.14000db50
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000671b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006755
jmp 0x140006716
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x57
lea rdx, str.__Failed_to_check_if_Riot_Vanguard_is_installed__manually_check_and_uninstall__Error_7_
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
lea rcx, [0x140053ca0]
call fcn.14000c0d0
lea rdx, str._X_
call fcn.1400020f0
lea rcx, [0x140053c90]
call fcn.14000c0d0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.1400101d0
mov rcx, rax
call fcn.14000db50
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140006657
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006652
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006761
call fcn.140016d84
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000671b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8d, 0x20
lea rdx, str.__Riot_Vanguard_is_not_installed
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
lea rcx, [0x140053c40]
call fcn.14000c0d0
lea rdx, str.__
call fcn.1400020f0
lea rcx, [0x140053c90]
call fcn.14000c0d0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.1400101d0
lea rcx, [0x1400544d0]
call fcn.14000db50
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000671b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006743
call fcn.140016d84
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140016d20
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14001d9d8
int3
call fcn.14001d9d8
int3
call fcn.14001d9d8
int3
call fcn.14001d9d8
int3
call fcn.14001d9d8
int3
call fcn.14001d9d8
int3