Function at 0x140004028
Capabilities:
Delete file
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, qword [rbp + 0x228]
mov rax, rcx
mov r15, qword [rbp + 0x230]
mov rbx, rdx
mov rdx, qword [rbp + 0x268]
mov rsi, r9
mov r13, qword [rbp + 0x240]
mov rdi, r8
mov r12, qword [rbp + 0x248]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rbp + 0x258]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x260]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rbp + 0x278]
mov qword [rbp - 0x70], rcx
mov rcx, qword [rbp + 0x280]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x290]
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x40], rcx
cmp dword [rax], ecx
je 0x1400047b9
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rsp + 0x68]
cmp dword [rdx + 0x30], 7
jge 0x140004110
mov ebx, 0x8007139f
jmp 0x140004726
test rbx, rbx
je 0x140004721
test rdi, rdi
je 0x140004721
mov rdx, qword [rdx + 0x40]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x14000413c
add rbx, 2
test ecx, ecx
jne 0x140004129
test eax, eax
je 0x14000414a
mov ebx, 0x80070005
jmp 0x140004726
lea rcx, [rsp + 0x50]
call fcn.140009d14
mov ebx, eax
test eax, eax
jne 0x140004726
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400041a6
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000470e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
je 0x1400041ea
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ecx, ecx
test eax, eax
jne 0x14000470e
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x14000422d
mov rax, rdi
inc rax
cmp word [rsi + rax*2], cx
jne 0x1400041f6
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000470e
mov ecx, 4
lea rax, [rbp + 0x220]
mov dword [rsp + 0x28], ecx
lea rdx, str.SystemComponent
mov r9d, ecx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000470e
mov rcx, qword [rsp + 0x30]
lea rax, str.MSICD
mov dword [rsp + 0x28], 0xc
lea rdx, str.Installer
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000470e
test r14, r14
je 0x1400042cf
mov rcx, qword [rsp + 0x30]
lea rdx, str.Expire
mov eax, 4
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov r9d, eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r14d, r14d
test eax, eax
jne 0x140004711
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140004317
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140004711
test r15, r15
je 0x14000435c
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r14w
jne 0x14000431f
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.CODEBASE
mov r9d, 1
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004711
mov esi, dword [rbp + 0x238]
test esi, esi
jne 0x14000453c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rbp - 0x60]
mov word [rbp + 0x1a6], r14w
mov r15d, 0x103
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], r15d
lea rdx, [0x140012078]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400043e5
test r13, r13
je 0x1400043c4
lea rdx, [rbp - 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400043e5
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r13, r13
jne 0x1400043e5
mov rcx, qword [rsp + 0x38]
lea rdx, [0x140012078]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x48], r15d
lea rax, [rbp - 0x60]
lea r15, [0x1400121d8]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x1a6], r14w
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004459
test r12, r12
je 0x14000443c
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004459
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r12, r12
jne 0x14000445e
mov rcx, qword [rsp + 0x38]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test r12, r12
je 0x14000449a
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r14w
jne 0x140004461
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004711
test r13, r13
je 0x1400044e0
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x1400044a2
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x140012078]
mov r9d, 1
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004711
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140004528
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140004711
mov rcx, qword [rsp + 0x30]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400045b8
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140004584
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140004711
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x250]
mov r9d, 4
lea rdx, str.Precache
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004711
mov rcx, qword [rsp + 0x70]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400045c0
lea eax, [rax*2 + 2]
mov r15d, 1
mov dword [rsp + 0x28], eax
mov r9d, r15d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004711
test esi, esi
jne 0x140004729
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000464a
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004610
lea eax, [rax*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.LastModified
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004711
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14000468d
inc rdi
cmp word [rcx + rdi*2], r14w
jne 0x140004653
lea eax, [rdi*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.Etag
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004711
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400046d1
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140004711
mov rax, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov r8d, dword [rbp + 0x270]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140002128
mov ebx, eax
test eax, eax
js 0x140004729
mov r9, qword [rbp - 0x68]
mov r8d, dword [rbp + 0x288]
mov rdx, qword [rsp + 0x58]
call fcn.140002044
mov ebx, eax
jmp 0x140004729
xor r14d, r14d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140004729
mov ebx, 0x80070057
xor r14d, r14d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140004739
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004749
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004759
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140004769
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004779
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x68]
cmp dword [rax], r14d
je 0x14000478d
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14000e250
mov rbx, qword [rsp + 0x308]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x8007000e
xor r14d, r14d
jmp 0x14000477e