Function at 0x14000b2e0
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Get thread local storage value
Query or enumerate registry value
Set thread local storage value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe58]
sub rsp, 0xf30
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140022218]
xor rax, rsp
mov qword [rbp + 0xe20], rax
mov rdi, rdx
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea r13, [0x140024670]
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000b357
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000b357
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000b362
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, r13
lea rax, [0x14001b9c8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x40
mov r9d, 0xfb
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rsi
call fcn.140006c50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000b3cd
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000b3cd
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000b3d8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, r13
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rsi
mov eax, 0xff
mov dword [rsp + 0x70], eax
mov ecx, dword [0x14002346c]
cmp ecx, 0xffffffff
je 0x14000b449
cmp dword [0x140023470], 0xffffffff
je 0x14000b449
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x140023470]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
lea rdx, [0x14001da70]
mov ecx, dword [0x14002346c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x58]
mov ecx, dword [0x140023470]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x14000b457
mov rcx, rsi
call fcn.140005d90
nop
call fcn.140009c50
call fcn.1400098f0
mov r14d, r15d
mov r13d, r15d
mov esi, r15d
test r12d, r12d
jle 0x14000c1a4
mov rbx, r12
lea r12, [0x140000000]
mov edx, 1
mov rcx, qword [rdi]
movzx eax, word [rcx]
cmp ax, 0x2d
je 0x14000b494
cmp ax, 0x2f
jne case.0x14000b4b6.38
movzx eax, word [rcx + 2]
add eax, 0xffffffdf
cmp eax, 0x54
ja case.0x14000b4b6.38
cdqe
movzx eax, byte [r12 + rax + 0xc288]
mov ecx, dword [r12 + rax*4 + 0xc270]
add rcx, r12
jmp rcx
mov r14d, edx
jmp case.0x14000b4b6.38
mov r13d, edx
jmp case.0x14000b4b6.38
mov r15d, edx
jmp case.0x14000b4b6.38
mov esi, edx
jmp case.0x14000b4b6.38
call fcn.140009870
mov edx, 1
add rdi, 8
dec rbx
jne 0x14000b482
mov edi, 0x200
test esi, esi
je 0x14000bc0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000b516
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000b516
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000b525
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
lea rax, str.Indirect_execution_requested
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x126
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rsi
call fcn.140006dd0
mov word [rbp + 0x420], r12w
mov r8d, edi
lea rdx, [rbp + 0x420]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000bc10
cmp eax, edi
jae 0x14000bc10
mov word [rbp + 0x20], r12w
mov rcx, rdi
lea rax, [rbp + 0x20]
nop dword [rax + rax]
mov r11d, 0x7ffffffe
lea r10, [0x14001dab4]
cmp word [rax], r12w
je 0x14000b5be
add rax, 2
dec rcx
jne 0x14000b5a0
jmp 0x14000b61e
test rcx, rcx
je 0x14000b61e
mov rax, rdi
sub rax, rcx
lea rcx, [rbp + rax*2 + 0x20]
mov rdx, rdi
sub rdx, rax
cmp rdx, 1
jbe 0x14000b61e
test rdx, rdx
je 0x14000b616
mov r8, r11
sub r8, rdx
mov r9, r10
sub r9, rcx
nop dword [rax + rax]
lea rax, [r8 + rdx]
test rax, rax
je 0x14000b611
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14000b611
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14000b5f0
jmp 0x14000b616
test rdx, rdx
jne 0x14000b61a
sub rcx, 2
mov word [rcx], r12w
mov rcx, rdi
lea rax, [rbp + 0x20]
cmp word [rax], r12w
je 0x14000b636
add rax, 2
dec rcx
jne 0x14000b625
jmp 0x14000b695
test rcx, rcx
je 0x14000b695
mov rax, rdi
sub rax, rcx
lea rcx, [rbp + rax*2 + 0x20]
mov rdx, rdi
sub rdx, rax
cmp rdx, 1
jbe 0x14000b695
test rdx, rdx
je 0x14000b68d
mov r8, r11
sub r8, rdx
lea r9, [rbp + 0x420]
sub r9, rcx
lea rax, [r8 + rdx]
test rax, rax
je 0x14000b688
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14000b688
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14000b667
jmp 0x14000b68d
test rdx, rdx
jne 0x14000b691
sub rcx, 2
mov word [rcx], r12w
mov rcx, rdi
lea rax, [rbp + 0x20]
nop dword [rax]
cmp word [rax], r12w
je 0x14000b6b1
add rax, 2
dec rcx
jne 0x14000b6a0
jmp 0x14000b70e
test rcx, rcx
je 0x14000b70e
mov rax, rdi
sub rax, rcx
lea rcx, [rbp + rax*2 + 0x20]
mov rdx, rdi
sub rdx, rax
cmp rdx, 1
jbe 0x14000b70e
test rdx, rdx
je 0x14000b706
mov r8, r11
sub r8, rdx
sub r10, rcx
nop dword [rax + rax]
lea rax, [r8 + rdx]
test rax, rax
je 0x14000b701
movzx eax, word [r10 + rcx]
test ax, ax
je 0x14000b701
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14000b6e0
jmp 0x14000b706
test rdx, rdx
jne 0x14000b70a
sub rcx, 2
mov word [rcx], r12w
test r14d, r14d
je 0x14000b790
mov rcx, rdi
lea rax, [rbp + 0x20]
nop word [rax + rax]
cmp word [rax], r12w
je 0x14000b731
add rax, 2
dec rcx
jne 0x14000b720
jmp 0x14000b790
test rcx, rcx
je 0x14000b790
mov rax, rdi
sub rax, rcx
lea rcx, [rbp + rax*2 + 0x20]
mov rdx, rdi
sub rdx, rax
cmp rdx, 1
jbe 0x14000b790
test rdx, rdx
je 0x14000b788
mov r8, r11
sub r8, rdx
lea r9, [0x14001dab8]
sub r9, rcx
lea rax, [r8 + rdx]
test rax, rax
je 0x14000b783
movzx eax, word [rcx + r9]
test ax, ax
je 0x14000b783
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14000b762
jmp 0x14000b788
test rdx, rdx
jne 0x14000b78c
sub rcx, 2
mov word [rcx], r12w
test r13d, r13d
je 0x14000b810
mov rcx, rdi
lea rax, [rbp + 0x20]
nop dword [rax]
cmp word [rax], r12w
je 0x14000b7b1
add rax, 2
dec rcx
jne 0x14000b7a0
jmp 0x14000b810
test rcx, rcx
je 0x14000b810
mov rax, rdi
sub rax, rcx
lea rcx, [rbp + rax*2 + 0x20]
mov rdx, rdi
sub rdx, rax
cmp rdx, 1
jbe 0x14000b810
test rdx, rdx
je 0x14000b808
mov r8, r11
sub r8, rdx
lea r9, [0x14001dac0]
sub r9, rcx
lea rax, [rdx + r8]
test rax, rax
je 0x14000b803
movzx eax, word [rcx + r9]
test ax, ax
je 0x14000b803
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14000b7e2
jmp 0x14000b808
test rdx, rdx
jne 0x14000b80c
sub rcx, 2
mov word [rcx], r12w
test r15d, r15d
je 0x14000b88e
mov rcx, rdi
lea rax, [rbp + 0x20]
nop dword [rax]
cmp word [rax], r12w
je 0x14000b831
add rax, 2
dec rcx
jne 0x14000b820
jmp 0x14000b88e
test rcx, rcx
je 0x14000b88e
mov rax, rdi
sub rax, rcx
lea rcx, [rbp + rax*2 + 0x20]
mov rdx, rdi
sub rdx, rax
cmp rdx, 1
jbe 0x14000b88e
test rdx, rdx
je 0x14000b886
sub r11, rdx
lea r8, [0x14001dac8]
sub r8, rcx
nop
lea rax, [rdx + r11]
test rax, rax
je 0x14000b881
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000b881
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14000b860
jmp 0x14000b886
test rdx, rdx
jne 0x14000b88a
sub rcx, 2
mov word [rcx], r12w
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000b8b9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000b8b9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000b8c8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
mov qword [rsp + 0x48], r12
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [0x14001dad0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 0x135
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rsi
call fcn.140007080
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x50]
call fcn.140010250
mov dword [rbp - 0x50], 0x68
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x420]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000bb8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000b9b0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x14000b9b0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
jmp 0x14000b9c2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
mov rdi, rsi
mov qword [rsp + 0x48], r12
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x40], eax
lea rax, str.Waiting_for_Process__u_to_terminate
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 0x13b
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rdi
call fcn.140007080
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14000ba1b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], r12
mov edx, 0x222e0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete bl
mov dword [rsp + 0x50], r12d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000ba5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r12
mov r14d, 0xff
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x70], r14d
test bl, bl
je 0x14000bb02
test rcx, rcx
jne 0x14000bab0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000baa5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x14000baa5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
jmp 0x14000bab0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
lea rax, [0x14001b9c8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x52
mov r9d, 0x14b
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
call fcn.140006c50
mov ebx, dword [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1400044b0
mov eax, ebx
jmp 0x14000c240
test rcx, rcx
jne 0x14000bb40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000bb35
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x14000bb35
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
jmp 0x14000bb40
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
lea rax, str.Process_didnt_terminate_in_time
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0x50
mov r9d, 0x150
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
call fcn.140006dd0
nop
lea rcx, [rsp + 0x58]
call fcn.1400044b0
mov eax, 0x5b4
jmp 0x14000c240
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000bbba
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000bbba
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000bbc9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x156
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rsi
call fcn.140006dd0
jmp 0x14000bc10
xor r12d, r12d
test r13d, r13d
je 0x14000bd8f
xor bl, bl
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x14000ae80]
xor edx, edx
xor ecx, ecx
call fcn.14000da88
mov r12, rax
test rax, rax
je 0x14000bd8f
mov edx, 0x1d4c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r13, str.Thread_didnt_finish_in_time
test eax, eax
je 0x14000bccc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000bc88
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000bc88
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000bc97
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 3
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9d, 0x162
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rsi
call fcn.140006dd0
mov bl, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000bd8f
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14000b130]
xor edx, edx
xor ecx, ecx
call fcn.14000da88
mov r12, rax
test rax, rax
je 0x14000bd8f
mov edx, 0x3a98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000bd86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000bd44
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000bd44
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000bd53
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 3
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9d, 0x16e
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rsi
call fcn.140006dd0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x14000c02d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000bdc3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000bdc3
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000bdd2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [0x140024670]
mov dword [rsp + 0x20], 0x177
lea r12, [0x14001d4b8]
mov r9, r12
lea r8, str.Starting_AV_removal...
lea rdx, str.wmain
mov rcx, rsi
call fcn.140007a40
xor ebx, ebx
mov word [rbp + 0x820], bx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECenterToolsDLStatusAntivirus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000bea3
mov dword [rbp - 0x70], ebx
mov dword [rsp + 0x50], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x820]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, str.EngineCode
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000be85
mov eax, dword [rsp + 0x50]
shr eax, 1
cmp eax, 0x100
mov r14d, 0xff
cmovae eax, r14d
mov word [rbp + rax*2 + 0x820], bx
jmp 0x14000be97
lea rcx, [rbp + 0x820]
call fcn.140009be0
mov r14d, 0xff
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000bea9
mov r14d, 0xff
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.msi.dll_MsiSetPropertyW]
lea rdx, [rbp + 0xa20]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r11, rdi
lea rax, [rbp + 0xa20]
nop dword [rax]
cmp word [rax], bx
je 0x14000bee0
add rax, 2
dec r11
jne 0x14000bed0
jmp 0x14000bf3c
test r11, r11
je 0x14000bf3c
mov rcx, rdi
sub rcx, r11
sub rdi, rcx
lea rax, [rbp + rcx*2 + 0xa20]
je 0x14000bf35
lea rcx, [rdi + rcx + 0x7ffffdff]
lea r8, str.AVUninstall.log
sub r8, rax
nop word [rax + rax]
test rcx, rcx
je 0x14000bf30
movzx edx, word [rax + r8]
test dx, dx
je 0x14000bf30
mov word [rax], dx
add rax, 2
dec rcx
dec rdi
jne 0x14000bf10
jmp 0x14000bf35
test rdi, rdi
jne 0x14000bf39
sub rax, 2
mov word [rax], bx
mov r13d, 1
mov r8d, r13d
lea rdx, [rbp + 0xa20]
mov ecx, 0x1000
call qword [sym.imp.msi.dll_MsiGetComponentPathW]
mov dword [rsp + 0x20], 0x189
mov r9, r12
lea r8, [rbp + 0x820]
lea rdx, str._dump__Uninstalling_product
lea rcx, [0x140024670]
call fcn.140007a40
lea edi, [r13 + 0x77]
cmp word [rbp + 0x820], bx
je 0x14000c026
nop dword [rax]
lea r9, str.REMOVEALL_REBOOTReallySuppress
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp + 0x820]
call qword [sym.imp.msi.dll_MsiGetFileVersionA]
mov ebx, eax
test eax, eax
je 0x14000c001
cmp eax, 0xbc2
je 0x14000c001
mov dword [rsp + 0x28], 0x193
mov qword [rsp + 0x20], r12
mov r9d, eax
lea r8, str.MsiConfigureProductEx_failed
lea rdx, str._tmain
lea rcx, [0x140024670]
call fcn.140007d00
cmp ebx, 0x57
je 0x14000c026
cmp ebx, 0x645
je 0x14000c026
mov ecx, 0x2328
call qword [sym.imp.KERNEL32.dll_Sleep]
dec edi
test edi, edi
jg 0x14000bf90
jmp 0x14000c026
mov dword [rsp + 0x20], 0x19d
mov r9, r12
lea r8, str.MsiConfigureProductEx_succeeded
lea rdx, str._tmain
lea rcx, [0x140024670]
call fcn.140007a40
call fcn.14000a590
jmp 0x14000c039
mov r13d, 1
mov r14d, 0xff
test r15d, r15d
je 0x14000c1aa
xor sil, sil
mov r8d, r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14000c108
mov r8d, 4
lea rdx, str.pded
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r12, r12
cmovne esi, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r12, r12
je 0x14000c0b0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, 4
lea rdx, str.ClientDataManager
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx esi, sil
test r12, r12
cmovne esi, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r12, r12
je 0x14000c100
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x14000c11e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.SeSystemEnvironmentPrivilege
call fcn.14000aa40
call fcn.140009ea0
test sil, sil
je 0x14000c1aa
test al, al
jne 0x14000c1aa
mov dword [rsp + 0x70], r14d
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x14000c154
call fcn.140004c10
lea rcx, str.Disk_Protection_is_no_longer_supported_on_BIOS_systems__you_have_to_remove_Disk_Protection_before_updating
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0x52
mov r9d, 0x1b5
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
mov rcx, rax
call fcn.140006dd0
nop
lea rcx, [rsp + 0x58]
call fcn.1400044b0
mov eax, r13d
jmp 0x14000c240
mov r14d, 0xff
mov dword [rsp + 0x70], r14d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x14000c1f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000c1e7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x14000c1e7
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
jmp 0x14000c1f6
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [0x140024670]
lea rax, [0x14001b9c8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x52
mov r9d, 0x1ba
lea r8, str.MsiRemover.cpp
lea rdx, [0x14001da70]
call fcn.140006c50
nop
lea rcx, [rsp + 0x58]
call fcn.1400044b0
xor eax, eax
mov rcx, qword [rbp + 0xe20]
xor rcx, rsp
call fcn.14000c410
lea r11, [rsp + 0xf30]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret