Function at 0x140003d60
Capabilities:
Check if file exists
Create process on windows
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x800]
sub rsp, 0x900
movzx edi, dl
movzx ebx, cl
xor edx, edx
lea rcx, [rbp + 0x5f0]
mov r8d, 0x208
call fcn.1400045b0
lea rcx, [rbp + 0x5f0]
call fcn.140002f60
test al, al
je 0x140004146
xor edx, edx
lea rcx, [rbp + 0x3e0]
mov r8d, 0x208
call fcn.1400045b0
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x208
call fcn.1400045b0
lea rcx, [rbp + 0x1d0]
call fcn.140004170
test al, al
je 0x140004146
mov ecx, 0x104
lea rax, [rbp + 0x1d0]
cmp word [rax], 0
je 0x140003e05
add rax, 2
sub rcx, 1
jne 0x140003df5
xor esi, esi
mov eax, 0x104
sub rax, rcx
mov edx, esi
test rcx, rcx
cmovne rdx, rax
je 0x140003e71
mov r8d, 0x104
lea rcx, [rbp + 0x1d0]
lea rcx, [rcx + rdx*2]
sub r8, rdx
je 0x140003e63
lea rax, [rdx + 0x7ffffefa]
add rax, r8
lea r9, str._ngen.exe
sub r9, rcx
test rax, rax
je 0x140003e63
movzx edx, word [r9 + rcx]
test dx, dx
je 0x140003e63
mov word [rcx], dx
dec rax
add rcx, 2
sub r8, 1
jne 0x140003e44
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], si
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140004146
lea r8, [rbp + 0x1d0]
mov edx, 0x104
lea rcx, [rbp + 0x3e0]
call fcn.1400010b0
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x226
call fcn.1400045b0
test bl, bl
lea rax, str.install__
lea r9, str.uninstall__
mov edx, 0x113
cmovne r9, rax
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
mov r8d, edx
sub r9, rax
nop word [rax + rax]
lea rax, [r8 + 0x7ffffeeb]
test rax, rax
je 0x140003f03
movzx eax, word [r9 + rcx]
test ax, ax
je 0x140003f03
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x140003ee0
lea rax, [rcx - 2]
test r8, r8
cmovne rax, rcx
mov rcx, rdx
mov word [rax], si
lea rax, [rbp - 0x60]
cmp word [rax], si
je 0x140003f27
add rax, 2
sub rcx, 1
jne 0x140003f18
mov rax, rdx
mov r9, rsi
sub rax, rcx
test rcx, rcx
cmovne r9, rax
je 0x140003f8f
mov r8, rdx
lea rcx, [rbp - 0x60]
lea rcx, [rcx + r9*2]
sub r8, r9
je 0x140003f81
lea rax, [r9 + 0x7ffffeeb]
add rax, r8
lea r10, [rbp + 0x5f0]
sub r10, rcx
nop dword [rax]
test rax, rax
je 0x140003f81
movzx r9d, word [r10 + rcx]
test r9w, r9w
je 0x140003f81
mov word [rcx], r9w
dec rax
add rcx, 2
sub r8, 1
jne 0x140003f60
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], si
mov rcx, rdx
lea rax, [rbp - 0x60]
cmp word [rax], si
je 0x140003fa5
add rax, 2
sub rcx, 1
jne 0x140003f96
mov rax, rdx
mov r8, rsi
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x140004007
lea rcx, [rbp - 0x60]
lea rcx, [rcx + r8*2]
sub rdx, r8
je 0x140003ff9
lea rax, [r8 + 0x7ffffeeb]
add rax, rdx
lea r9, [0x140005dc8]
sub r9, rcx
test rax, rax
je 0x140003ff9
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140003ff9
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140003fd8
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], si
test dil, dil
je 0x14000407b
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x70]
call fcn.1400045b0
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x30], 0x70
mov qword [rsp + 0x48], rax
lea rdx, str.runas
lea rax, [rbp - 0x60]
mov dword [rsp + 0x34], 0x40
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x60], esi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000409e
mov rcx, qword [rbp - 0x68]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000409e
mov dword [rsp + 0x28], esi
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x3e0]
mov qword [rsp + 0x20], rsi
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rax, [rbp + 0x820]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140008010]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test bl, bl
je 0x14000411d
test eax, eax
jne 0x140004142
lea rbx, [0x140005530]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x820]
lea rdx, str.NgenVersion
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140004148
test eax, eax
jne 0x140004142
mov rcx, qword [rbp + 0x820]
lea rdx, str.NgenVersion
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140004148
xor al, al
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret