Function at 0x140088280
Capabilities:
Check if file exists
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r13, r8
mov qword [rsp + 0x68], rdx
movzx eax, cx
mov word [rsp + 0x44], cx
cmp dword [0x14045ebc8], 0
je 0x1400882f3
call fcn.140084710
test eax, eax
je 0x140088a5c
mov eax, 4
mov qword [rsp + 0x60], 1
jmp 0x1400882fd
mov eax, 2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rax
xor esi, esi
mov ebx, esi
mov qword [rsp + 0x58], rbx
lea r8, str.PESOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [0x1403426c8]
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov edi, esi
mov dword [rsp + 0x48], esi
nop word [rax + rax]
cmp dword [0x14045e968], 0
jne 0x140088a04
movsxd rax, edi
mov rcx, qword [rcx + rbx*8]
imul rdx, rax, 0x208
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
cmp dword [0x14045ebc8], 0
je 0x140088362
add rdx, r8
jmp 0x140088365
add rdx, r9
mov r9d, 0x20019
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400889df
mov ebx, esi
mov dword [rbp - 0x30], 0x104
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400889d0
xor edi, edi
nop dword [rax]
inc ebx
mov dword [rsp + 0x40], ebx
cmp dword [0x14045e968], 0
jne 0x1400889ca
mov qword [rbp - 0x58], rdi
mov r12, rdi
mov dword [rbp - 0x78], edi
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400884a3
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14008897f
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x140331770]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400884a3
mov eax, dword [rbp - 0x78]
test eax, eax
je 0x1400884a3
add eax, 4
mov dword [rbp - 0x78], eax
mov ecx, eax
call fcn.14012a2dc
mov r12, rax
test rax, rax
je 0x1400884a3
mov r8d, dword [rbp - 0x78]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x140331770]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088498
cmp dword [rbp - 0x78], eax
ja 0x1400884a3
mov rcx, r12
call fcn.14012a2d4
mov r12, rdi
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400884b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], rdi
test r12, r12
je 0x14008897f
mov qword [rbp - 0x50], rdi
mov r15, rdi
mov dword [rbp - 0x74], edi
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008858f
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400885a2
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x140331750]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008858f
mov eax, dword [rbp - 0x74]
test eax, eax
je 0x14008858f
add eax, 4
mov dword [rbp - 0x74], eax
mov ecx, eax
call fcn.14012a2dc
mov r15, rax
test rax, rax
je 0x14008858f
mov r8d, dword [rbp - 0x74]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x140331750]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088584
cmp dword [rbp - 0x74], eax
ja 0x14008858f
mov rcx, r15
call fcn.14012a2d4
mov r15, rdi
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400885a2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov r14, rdi
mov dword [rbp - 0x70], edi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140088672
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140088685
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x140331730]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088672
mov eax, dword [rbp - 0x70]
test eax, eax
je 0x140088672
add eax, 4
mov dword [rbp - 0x70], eax
mov ecx, eax
call fcn.14012a2dc
mov r14, rax
test rax, rax
je 0x140088672
mov r8d, dword [rbp - 0x70]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x140331730]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088667
cmp dword [rbp - 0x70], eax
ja 0x140088672
mov rcx, r14
call fcn.14012a2d4
mov r14, rdi
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140088685
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rdi
mov rsi, rdi
mov dword [rbp - 0x6c], edi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140088755
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140088768
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x1403317f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088755
mov eax, dword [rbp - 0x6c]
test eax, eax
je 0x140088755
add eax, 4
mov dword [rbp - 0x6c], eax
mov ecx, eax
call fcn.14012a2dc
mov rsi, rax
test rax, rax
je 0x140088755
mov r8d, dword [rbp - 0x6c]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x1403317f8]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008874a
cmp dword [rbp - 0x6c], eax
ja 0x140088755
mov rcx, rsi
call fcn.14012a2d4
mov rsi, rdi
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140088768
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov dword [rbp - 0x68], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008883c
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140088853
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x1403317c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008883c
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x14008883c
add eax, 4
mov dword [rbp - 0x68], eax
mov ecx, eax
call fcn.14012a2dc
mov rdi, rax
test rax, rax
je 0x14008883c
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044b740]
xor r8d, r8d
lea rdx, [0x1403317c8]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088832
cmp dword [rbp - 0x68], eax
ja 0x14008883c
mov rcx, rdi
call fcn.14012a2d4
xor edi, edi
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140088853
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x38], 0
test r15, r15
jne 0x140088886
test r14, r14
jne 0x140088864
test rsi, rsi
jne 0x140088869
jmp 0x140088878
test rsi, rsi
je 0x14008886e
mov rcx, rsi
jmp 0x140088889
test r14, r14
je 0x140088878
mov rcx, r14
jmp 0x140088889
test rdi, rdi
je 0x140088975
mov rcx, rdi
jmp 0x140088889
mov rcx, r15
test rcx, rcx
je 0x140088941
call fcn.140054e40
mov rbx, rax
test rax, rax
je 0x14008893d
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14008893d
movzx eax, word [rsp + 0x44]
cmp ax, word [rbx]
jne 0x14008893d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x14008893d
mov rax, qword [r13 + 0x10]
cmp qword [r13 + 8], rax
jne 0x1400888e5
mov rcx, r13
call fcn.140056660
mov rcx, qword [r13 + 8]
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x80], rcx
test rcx, rcx
je 0x140088938
xor edx, edx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 8
jb 0x140088911
mov rax, qword [rcx]
jmp 0x140088914
mov rax, rcx
mov word [rax], dx
cmp word [rbx], dx
jne 0x140088921
mov r8, rdx
jmp 0x14008892f
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], dx
jne 0x140088925
mov rdx, rbx
call fcn.14004dd70
nop
add qword [r13 + 8], 0x20
mov ebx, dword [rsp + 0x40]
test r15, r15
je 0x14008894e
mov rcx, r15
call fcn.14012a2d4
test r14, r14
je 0x14008895b
mov rcx, r14
call fcn.14012a2d4
test rsi, rsi
je 0x140088968
mov rcx, rsi
call fcn.14012a2d4
test rdi, rdi
je 0x140088975
mov rcx, rdi
call fcn.14012a2d4
mov rcx, r12
call fcn.14012a2d4
xor edi, edi
mov dword [rbp - 0x30], 0x104
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x20]
call fcn.14027b2c0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400883c0
mov edi, dword [rsp + 0x48]
xor esi, esi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
inc edi
mov dword [rsp + 0x48], edi
cmp edi, dword [rsp + 0x50]
lea rcx, [0x1403426c8]
lea r8, str.PESOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
jl 0x140088330
inc rbx
mov qword [rsp + 0x58], rbx
cmp rbx, qword [rsp + 0x60]
jl 0x140088320
cmp dword [0x14045ebc8], 0
je 0x140088a5c
lea rdx, [0x14032daf8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x14032db10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x14032dbb8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x358]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret