Function at 0x140005200
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140051080]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor esi, esi
lea rcx, str.Checking_for_Riot_Vanguard
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140005348
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov r8d, 0x57
lea rdx, str.__Failed_to_check_if_Riot_Vanguard_is_installed__manually_check_and_uninstall__Error_6_
lea rcx, [rsp + 0x70]
call fcn.1400026b0
nop
lea rcx, [0x140051d00]
call fcn.14000a2d0
lea rdx, str._X_
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000e090
mov rcx, rax
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000531c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005983
call fcn.140014944
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400148e0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ebx, esi
mov dword [rbp - 0x70], 0x100
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140005452
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400058b5
mov dword [rbp - 0x6c], 0x100
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000540d
lea rdx, str.Riot_Vanguard
lea rcx, [rbp + 0xa0]
call fcn.14003a9a0
test eax, eax
je 0x140005513
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x70], 0x100
inc ebx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x60]
mov edx, ebx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140005390
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov r8d, 0x20
lea rdx, str.__Riot_Vanguard_is_not_installed
lea rcx, [rsp + 0x70]
call fcn.1400026b0
nop
lea rcx, [0x140051cf0]
call fcn.14000a2d0
lea rdx, str.__
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000e090
lea rcx, [0x140052500]
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000531c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005971
jmp 0x140005317
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r15, str.C:Program_FilesRiot_Vanguardinstaller.exe
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0x2c
call fcn.140012dd0
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400036a0
nop
mov qword [rsp + 0x70], rsi
lea rax, [0x140051d30]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400040a0
movzx ebx, al
cmp dword [rsp + 0x70], 0
jne 0x140005989
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400055d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005999
call fcn.140014944
test bl, bl
je 0x140005803
call fcn.140013658
mov rbx, rax
call fcn.14001363c
mov rcx, rax
movabs r14, 0xb2f4fc0794908cf3
cmp rbx, 0x989680
jne 0x140005601
imul rax, rcx, 0x64
jmp 0x140005670
cmp rbx, 0x16e3600
jne 0x140005655
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x140005670
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rdi, 0x2540be400
add rdi, rax
nop dword [rax]
call fcn.140013658
mov rbx, rax
call fcn.14001363c
mov rcx, rax
cmp rbx, 0x989680
jne 0x14000569f
imul rax, rcx, 0x64
jmp 0x14000570e
cmp rbx, 0x16e3600
jne 0x1400056f3
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x14000570e
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
xor ecx, ecx
cmp rax, rdi
jge 0x14000573f
mov r9d, 0x40
lea r8, str.Uninstall_Vanguard
lea rdx, str.When_prompted_to_uninstall_Vanguard__press_YES
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005680
xor r9d, r9d
lea r8, str.installer.exe
mov rdx, r15
call fcn.140021220
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov r8d, 0x54
lea rdx, str.__Successfully_prompted_the_user_to_uninstall_Riot_Vanguard__press_Yes_to_uninstall_
lea rcx, [rsp + 0x70]
call fcn.1400026b0
nop
lea rcx, [0x140051d00]
call fcn.14000a2d0
lea rdx, str._X_
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000e090
mov rcx, rax
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000531c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005977
jmp 0x140005317
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov r8d, 0x41
lea rdx, str.__Failed_to_uninstall_Riot_Vanguard__manually_uninstall__Error_8_
lea rcx, [rsp + 0x70]
call fcn.1400026b0
nop
lea rcx, [0x140051d00]
call fcn.14000a2d0
lea rdx, str._X_
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000e090
mov rcx, rax
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000531c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000597d
jmp 0x140005317
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov r8d, 0x57
lea rdx, str.__Failed_to_check_if_Riot_Vanguard_is_installed__manually_check_and_uninstall__Error_7_
lea rcx, [rsp + 0x70]
call fcn.1400026b0
nop
lea rcx, [0x140051d00]
call fcn.14000a2d0
lea rdx, str._X_
call fcn.1400023d0
lea rcx, [0x140051d50]
call fcn.14000a2d0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.14000e090
mov rcx, rax
call fcn.14000bfa0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000595b
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005956
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000596b
call fcn.140014944
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000531c
call fcn.14001aa40
int3
call fcn.14001aa40
int3
call fcn.14001aa40
int3
call fcn.14001aa40
int3
call fcn.14001aa40
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
call fcn.140004040
nop
call fcn.14001aa40
int3