Function at 0x140010860
Capabilities:
Check if file exists
Delete directory
Delete file
Delete registry key
Delete registry value
Get common file path
Move file
Query or enumerate registry value
Set file attributes

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14b0]
mov eax, 0x15b0
call fcn.140193d30
sub rsp, rax
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rsp + 0x15e0], rbx
mov qword [rsp + 0x15e8], rsi
mov qword [rsp + 0x15f0], rdi
mov rax, qword [0x140260d50]
xor rax, rsp
mov qword [rbp + 0x14a0], rax
xor r8d, r8d
lea rdx, str.Tool_UninstallDelete
lea rcx, [rbp - 0x70]
call fcn.14000b870
nop
call fcn.140050920
mov r14, qword [rax + 8]
xor esi, esi
mov r15d, esi
mov word [rbp + 0xa60], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0xa62]
call fcn.140193010
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.140193010
call fcn.14004cde4
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001091d
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
call fcn.14004cde4
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001094e
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
mov rcx, qword [r14 + 0x260]
cmp dword [rcx + 0x88], 0
je 0x140010be2
lea rdx, [rbp - 0x30]
call fcn.14000cc10
mov rcx, qword [rax]
cmp dword [rcx - 0x10], 0
setne dil
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400109ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [r14 + 0x260]
test dil, dil
je 0x140010abc
lea rdx, [rbp - 0x28]
call fcn.14000cc10
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140010a24
cmp dword [rdi + 0x10], 0
jl 0x140010a15
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140010a15
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140010a0a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140010a24
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400014d0
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140010a43
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x38]
mov rcx, qword [r14 + 0x260]
call fcn.14000cc10
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x68]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140010ab3
cmp dword [rdi + 0x10], 0
jl 0x140010aa4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140010aa4
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140010a99
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x140010ab3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400014d0
nop
mov rdx, qword [rbp - 0x38]
jmp 0x140010bb8
lea rdx, [rbp - 0x20]
call fcn.14000cbe0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140010b25
cmp dword [rdi + 0x10], 0
jl 0x140010b16
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140010b16
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140010b0b
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140010b25
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400014d0
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140010b44
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x18]
mov rcx, qword [r14 + 0x260]
call fcn.14000cbe0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x68]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140010bb4
cmp dword [rdi + 0x10], 0
jl 0x140010ba5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140010ba5
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140010b9a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x140010bb4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400014d0
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140010bd3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
jmp 0x140010cb6
mov rdx, qword [r14 + 0x1b8]
lea rcx, [rdx - 0x18]
lea rsi, [rbx - 0x18]
or r12, 0xffffffffffffffff
cmp rcx, rsi
je 0x140010c4d
cmp dword [rsi + 0x10], 0
jl 0x140010c3a
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140010c3a
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140010c2a
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x60], rbx
mov rdi, qword [rsp + 0x68]
jmp 0x140010c4d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400014d0
mov rbx, qword [rsp + 0x60]
mov rdx, qword [r14 + 0x1c0]
lea rcx, [rdx - 0x18]
lea rsi, [rdi - 0x18]
cmp rcx, rsi
je 0x140010cb4
cmp dword [rsi + 0x10], 0
jl 0x140010ca1
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140010ca1
call fcn.140001620
mov rdi, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140010c91
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x68], rdi
mov rbx, qword [rsp + 0x60]
jmp 0x140010cb4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400014d0
mov rdi, qword [rsp + 0x68]
xor esi, esi
cmp dword [rbx - 0x10], 0
je 0x140011e38
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011e38
mov dword [rsp + 0x54], 0x208
mov r13d, 1
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rbp - 0x40], 0x100
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x12a0]
call fcn.140193010
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x40]
lea r8, [rbp + 0x12a0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
cmove esi, r13d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140010e56
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, r13d
lea r8, str.return___08x
lea edx, [r13 + 1]
lea rcx, [rbp - 0x70]
call fcn.14000ba50
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140010e30
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140010e51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140011e93
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.IcnPath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call fcn.1400184c0
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call fcn.140018670
test eax, eax
je 0x140010f45
cmp esi, r13d
jne 0x140010f45
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x140010f45
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.140018670
test eax, eax
je 0x140010f45
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 0x80]
mov qword [rsp + 0x20], r11
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011070
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x54], 0x208
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.IcnPath
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.1400184c0
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call fcn.140018670
test eax, eax
je 0x140011066
cmp esi, r13d
jne 0x140011066
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x140011066
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.140018670
test eax, eax
je 0x140011066
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x78], r13d
mov rax, qword [r14 + 0x260]
xor esi, esi
cmp dword [rax + 0x88], esi
jne 0x140011412
mov word [rbp + 0x850], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x852]
call fcn.140193010
mov qword [rsp + 0x58], rsi
mov r9, qword [r14 + 0x1b8]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersion
lea rdx, str._sUninstall_s
lea rcx, [rbp + 0x850]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x20], r11
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x850]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001117a
lea rdx, str.Publisher
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.DisplayIcon
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.UninstallString
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, [rbp + 0x850]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000cc50
call fcn.140014c60
test eax, eax
jne 0x140011412
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.140193010
call fcn.140011ed0
mov rbx, rax
lea r9, str.Canon_Printer_Uninstaller
mov r8, rax
lea rdx, str._s_s
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
test rbx, rbx
je 0x140011291
lea rax, str..LNK
mov qword [rsp + 0x28], rax
lea rax, str.Uninstaller
mov qword [rsp + 0x20], rax
mov r9, qword [r14 + 0x1b8]
mov r8, rbx
lea rdx, str._s_s__s_s
lea rcx, [rbp + 0x220]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001122c
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001122f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r15d, r13d
lea rax, str..LNK
mov qword [rsp + 0x28], rax
lea rax, str.Uninstaller
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
lea rdx, str._s_s__s_s
lea rcx, [rbp + 0x220]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140011291
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001128e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140011291
mov r15d, esi
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.140193010
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1090]
call fcn.140193010
lea rdx, [rbp + 0xa60]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x78]
call fcn.140001110
nop
mov edx, 0x5c
mov rcx, qword [rsp + 0x78]
call fcn.14018f7cc
test rax, rax
jne 0x140011301
mov eax, r12d
jmp 0x140011309
sub rax, qword [rsp + 0x78]
sar rax, 1
mov r8d, eax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x78]
call fcn.140016750
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x78]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14001137a
cmp dword [rdi + 0x10], 0
jl 0x14001136b
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001136b
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140011360
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x14001137a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.1400014d0
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011399
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x1090]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rbp - 0x78], r15d
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400113ed
cmp word [rbp + 0x220], 0
je 0x1400113ed
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400113ea
lea rcx, [rbp + 0x1090]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400113ed
mov dword [rbp - 0x78], esi
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001140d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x68]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x640]
call fcn.140193010
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xc70]
call fcn.140193010
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x430]
call fcn.140193010
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xe80]
call fcn.140193010
mov r8d, 0x104
lea rdx, [rbp + 0xe80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r15d, eax
mov dword [rbp - 0x58], eax
mov rcx, qword [r14 + 0x260]
cmp dword [rcx + 0x88], 0
je 0x140011907
call fcn.14004cde4
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400114b0
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
test rax, 0xffffffffffff0000
jne 0x1400114ff
movzx edi, cx
mov ecx, edi
call fcn.14004cbb8
test rax, rax
je 0x1400115f7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400012a0
mov rbx, qword [rsp + 0x70]
jmp 0x1400115f7
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140011576
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400115f7
cmp dword [rdx + 0x10], eax
jge 0x140011548
cmp dword [rbx - 0xc], eax
jge 0x14001153d
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x1400115f7
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001155f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
jmp 0x1400115f7
mov r15d, dword [rbx - 0x10]
lea rsi, [rbp + 0x10]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
jns 0x140011593
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400115b3
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.1400015c0
mov rbx, qword [rsp + 0x70]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x1400115d7
lea r8, [rbx + rsi*2]
call fcn.14018e5f0
jmp 0x1400115e0
lea r8, [rbp + 0x10]
call fcn.14018e7d0
cmp edi, dword [rbx - 0xc]
jg 0x1400118fc
mov dword [rbx - 0x10], edi
xor esi, esi
mov word [r15 + rbx], si
mov r15d, dword [rbp - 0x58]
call fcn.14004cde4
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140011616
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x48], rdi
call fcn.14004cde4
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140011646
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rbp - 0x50], rsi
mov ecx, r13d
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, 0x100
or eax, ecx
jge 0x14001167b
mov edx, 0x100
lea rcx, [rbp - 0x50]
call fcn.1400015c0
mov rsi, qword [rbp - 0x50]
mov ecx, r13d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 3
or eax, ecx
jge 0x14001169d
mov edx, 3
lea rcx, [rbp - 0x48]
call fcn.1400015c0
mov rdi, qword [rbp - 0x48]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x100
mov r9, rsi
lea r8d, [rax + 3]
mov rdx, rdi
mov rcx, rbx
call fcn.1401912a0
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.14018f24c
test eax, eax
js 0x1400118f1
cmp eax, dword [rdi - 0xc]
jg 0x1400118f1
mov dword [rdi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rdi + rax*2], cx
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call fcn.14018f24c
test eax, eax
js 0x1400118e6
cmp eax, dword [rsi - 0xc]
jg 0x1400118e6
mov dword [rsi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rsi + rax*2], cx
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x48]
lea rcx, [rbp]
call fcn.1400167f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14001178a
cmp dword [rbx + 0x10], 0
jl 0x14001177b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14001177b
call fcn.140001620
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140011770
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14001178a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400014d0
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400117a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x70]
mov ecx, dword [rdi - 0x10]
lea eax, [rcx - 1]
test eax, eax
js 0x1400118db
cmp eax, ecx
jg 0x1400118db
cdqe
cmp word [rdi + rax*2], 0x5c
jne 0x140011862
lea r8d, [rcx - 1]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140016750
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14001183e
cmp dword [rdi + 0x10], 0
jl 0x14001182f
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001182f
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140011824
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14001183e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400014d0
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001185d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x70]
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.140190fb0
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011894
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400118b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400118d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x68]
jmp 0x140011907
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
nop
test r15d, r15d
je 0x140011951
cmp dword [r14 + 0x780], 0
jne 0x140011951
mov edx, 0x5c
lea rcx, [rbp + 0xe80]
call fcn.14018f7cc
mov rbx, rax
lea r8, [rbp + 0x10]
lea rcx, [rbp + 0x640]
test rax, rax
je 0x14001195c
mov r9, rax
lea rdx, [0x140212328]
call qword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
mov word [rbx], si
jmp 0x140011972
lea r8, [rbp + 0x10]
lea rcx, [rbp + 0x640]
lea r9, [0x140213298]
lea rdx, str._s_s
call qword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
lea r9, str.Uninst.ini
lea r8, [rbp + 0x10]
lea rdx, str._s_s
lea rcx, [rbp + 0xc70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x104
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0x104
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140011a1d
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rax + 2]
lea rcx, [rbp - 0x70]
call fcn.14000ba50
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400119ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140011a0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.14000ba00
xor eax, eax
jmp 0x140011e9f
lea r9, str.UNINSTAL.tmp
lea r8, [rbp + 0x430]
lea rdx, str._s_s
lea rcx, [rbp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x640]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140011b87
lea rcx, [rbp + 0x640]
cmp dword [r14 + 0x780], 0
je 0x140011af6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140011b87
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rax + 2]
lea rcx, [rbp - 0x70]
call fcn.14000ba50
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011ac5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140011ae6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.14000ba00
xor eax, eax
jmp 0x140011e9f
mov r8d, 2
lea rdx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140011b22
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x140011b87
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rbp - 0x70]
call fcn.14000ba50
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011b56
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140011b77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.14000ba00
xor eax, eax
jmp 0x140011e9f
lea rcx, [rbp + 0xc70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140011baa
lea rcx, [rbp + 0xc70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r15d, eax
jmp 0x140011bad
mov r15d, r13d
call fcn.14004cde4
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140011bcc
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x60], rbx
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
test rax, 0xffffffffffff0000
jne 0x140011c18
movzx edi, cx
mov ecx, edi
call fcn.14004cbb8
test rax, rax
je 0x140011d16
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400012a0
mov rbx, qword [rbp - 0x60]
jmp 0x140011d16
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140011c8e
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140011d16
cmp dword [rdx + 0x10], eax
jge 0x140011c61
cmp dword [rbx - 0xc], eax
jge 0x140011c56
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x140011d16
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011c78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x60], rbx
jmp 0x140011d16
mov eax, dword [rbx - 0x10]
mov dword [rbp - 0x58], eax
lea rsi, [rbp + 0x10]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
jns 0x140011cad
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140011ccb
mov edx, edi
lea rcx, [rbp - 0x60]
call fcn.1400015c0
mov rbx, qword [rbp - 0x60]
mov eax, dword [rbp - 0x58]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, rax
movsxd rax, edi
ja 0x140011cf4
add rax, rax
lea r8, [rbx + rsi*2]
mov rsi, rax
mov r9, rax
call fcn.14018e5f0
jmp 0x140011d04
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rbp + 0x10]
call fcn.14018e7d0
cmp edi, dword [rbx - 0xc]
jg 0x140011e2d
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [rbx + rsi], ax
lea rcx, [r14 + 0x218]
lea rsi, [rbx - 0x18]
mov rdi, qword [rcx]
sub rdi, 0x18
cmp rsi, rdi
je 0x140011d7a
cmp dword [rdi + 0x10], 0
jl 0x140011d6d
mov rax, qword [rdi]
cmp qword [rsi], rax
jne 0x140011d6d
mov rcx, rsi
call fcn.140001620
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140011d60
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [r14 + 0x218], rax
jmp 0x140011d7a
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
call fcn.1400014d0
nop
mov eax, r12d
lock xadd dword [rsi + 0x10], eax
dec eax
test eax, eax
jg 0x140011d94
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp r15d, 1
jne 0x140011dc4
lea r9, [r14 + 0x370]
lea rcx, [r14 + 0x578]
lea r8, [rbp + 0x10]
lea rdx, str._s_s
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [r14 + 0x36c], r13d
mov r15d, dword [rbp - 0x78]
mov r9d, r15d
lea r8, str.return___08x
mov edx, 2
lea rcx, [rbp - 0x70]
call fcn.14000ba50
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011dfe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140011e1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.14000ba00
mov eax, r15d
jmp 0x140011e9f
mov ecx, 0x80070057
call fcn.140001000
nop
mov r13d, 1
mov r9d, r13d
lea r8, str.return___08x
lea edx, [r13 + 1]
lea rcx, [rbp - 0x70]
call fcn.14000ba50
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140011e72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140011e93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x70]
call fcn.14000ba00
mov eax, r13d
mov rcx, qword [rbp + 0x14a0]
xor rcx, rsp
call fcn.14018e5d0
lea r11, [rsp + 0x15b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret