Function at 0x140001350
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x1400344c8]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
xor esi, esi
mov rax, rdx
cmp ecx, 2
jne 0x140001394
mov rcx, qword [rax + 8]
lea rdx, str._nsis
call fcn.1400120a4
test eax, eax
mov eax, esi
je 0x140001399
mov eax, 1
lea rbx, [0x140036c20]
mov dword [0x140036d1c], eax
mov rdx, rbx
mov r8d, 0xfb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec eax
cmp eax, 0xf9
ja 0x1400018f0
mov qword [rsp + 0x920], r12
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x8e8], r14
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], sil
jne 0x1400013e0
dec eax
movsxd rcx, eax
test eax, eax
jle 0x140001412
movzx edx, byte [rcx + rbx]
cmp dl, 0x2f
je 0x14000140c
cmp dl, 0x5c
je 0x14000140c
dec eax
dec rcx
test rcx, rcx
jg 0x1400013f2
jmp 0x140001412
cdqe
mov byte [rax + rbx], sil
mov rcx, rbx
call fcn.140001910
lea rcx, str.SYSTEMDRIVE
call fcn.140010004
mov qword [0x140036c18], rax
test rax, rax
je 0x140001437
cmp byte [rax], sil
jne 0x140001445
lea rax, [0x140026824]
mov qword [0x140036c18], rax
lea rcx, str.This_program_will_remove_the_following_items:_n
call fcn.1400019e0
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0x104
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareVimGvim
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400014b3
lea rax, [rsp + 0x38]
mov r9d, 0x20219
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareVimGvim
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001540
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rbp - 0x80]
xor r8d, r8d
lea rdx, str.path
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140001540
lea rcx, str.___the__Edit_with_Vim__entry_in_the_popup_menu_n
call fcn.1400019e0
lea rdx, [rbp - 0x80]
lea rcx, str.___which_uses___s__n
call fcn.1400019e0
cmp dword [0x140036d1c], esi
je 0x140001536
lea rcx, str._nRemove_it__y_n__
call fcn.1400019e0
cmp dword [0x140036d1c], esi
je 0x140001536
call fcn.140001020
test eax, eax
je 0x1400015e7
call fcn.140002150
jmp 0x1400015e2
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0x104
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Applicationsgvim.exe_shelleditcommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400015e7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rbp - 0x80]
xor r8d, r8d
lea rdx, [0x140026440]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400015e7
lea rcx, str.___the_Vim__Open_With...__entry_in_the_popup_menu_n
call fcn.1400019e0
lea rdx, [rbp - 0x80]
lea rcx, str.___which_uses___s__n
call fcn.1400019e0
lea rcx, str._nRemove_it__y_n__
call fcn.1400019e0
call fcn.140001020
test eax, eax
je 0x1400015e7
call fcn.140001d90
lea rdx, str.desktop
lea rcx, [rbp + 0x90]
call fcn.1400010a0
lea r12, str.them
lea r14, [0x140026db4]
test eax, eax
je 0x14000175f
mov qword [rsp + 0x910], rdi
lea rcx, [0x140026d84]
mov qword [rsp + 0x8e0], r15
call fcn.1400019e0
mov rbx, rsi
lea rdi, str.gVim_9.0.lnk
lea r15, str.gVim_9.0
nop dword [rax]
mov r9, qword [rbx + rdi]
lea r8, [rbp + 0x90]
lea rdx, str._s_s
lea rcx, [rbp + 0x3b0]
call fcn.1400027b0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x3b0]
call fcn.1400108dc
test eax, eax
jne 0x140001685
mov rdx, qword [rbx + r15]
lea rcx, str.___the___s__icon_on_the_desktop_n
call fcn.1400019e0
inc esi
add rbx, 8
cmp rbx, 0x18
jl 0x140001640
mov r15, qword [rsp + 0x8e0]
test esi, esi
jle 0x140001757
cmp dword [0x140036d1c], 0
je 0x1400016d4
cmp esi, 1
lea rcx, str._nRemove__s__y_n__
mov rdx, r14
cmovg rdx, r12
call fcn.1400019e0
cmp dword [0x140036d1c], 0
je 0x1400016d4
call fcn.140001020
test eax, eax
je 0x140001757
lea rdx, str.desktop
lea rcx, [rbp + 0x5c0]
call fcn.1400010a0
test eax, eax
je 0x140001757
lea rbx, [0x1400344b8]
mov r9, qword [rdi]
lea r8, [rbp + 0x5c0]
lea rdx, str._s_s
lea rcx, [rbp + 0x1a0]
call fcn.1400027b0
lea rdx, [0x140026bc8]
lea rcx, [rbp + 0x1a0]
call fcn.14000715c
test rax, rax
je 0x14000174e
mov rcx, rax
call fcn.140006a9c
lea rdx, [rbp + 0x1a0]
lea rcx, str.removing__s_n
call fcn.1400019e0
lea rcx, [rbp + 0x1a0]
call fcn.140007500
add rdi, 8
cmp rdi, rbx
jl 0x1400016f2
mov rdi, qword [rsp + 0x910]
lea rdx, str.ProgramsVim_9.0
lea rcx, [rbp + 0x90]
call fcn.1400010a0
test eax, eax
je 0x1400017ca
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x90]
call fcn.1400108dc
test eax, eax
jne 0x1400017ca
lea rdx, str.ProgramsVim_9.0
lea rcx, str._n___the___s__entry_in_the_Start_Menu_n
call fcn.1400019e0
cmp dword [0x140036d1c], 0
je 0x1400017c5
lea rcx, str._nRemove_it__y_n__
call fcn.1400019e0
cmp dword [0x140036d1c], 0
je 0x1400017c5
call fcn.140001020
test eax, eax
je 0x1400017ca
call fcn.140002480
lea rcx, [0x140026d84]
call fcn.1400019e0
xor ecx, ecx
call fcn.140001ae0
test eax, eax
jle 0x14000181c
cmp dword [0x140036d1c], 0
je 0x140001812
cmp eax, 1
lea rcx, str._nRemove__s__y_n__
cmovg r14, r12
mov rdx, r14
call fcn.1400019e0
cmp dword [0x140036d1c], 0
je 0x140001812
call fcn.140001020
test eax, eax
je 0x14000181c
mov ecx, 1
call fcn.140001ae0
lea rdx, [0x140026bc8]
lea rcx, str.gvim.exe
call fcn.14000715c
mov r14, qword [rsp + 0x8e8]
mov r12, qword [rsp + 0x920]
test rax, rax
je 0x140001864
mov rcx, rax
call fcn.140006a9c
lea rcx, str.gvim.exe_detected.__Attempting_to_unregister_gvim_with_OLE_n
call fcn.1400019e0
lea rcx, str.gvim.exe__silent__unregister
call fcn.14001000c
mov r8d, pe_nt_image_headers64
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.0
mov rcx, 0xffffffff80000002
call fcn.140001a40
cmp dword [0x140036d1c], 0
je 0x1400018c9
lea rcx, str._nYou_may_now_want_to_delete_the_Vim_executables_and_runtime_files._n
call fcn.1400019e0
lea rcx, str._They_are_still_where_you_unpacked_them.__n
call fcn.1400019e0
cmp dword [0x140036d1c], 0
je 0x1400018c9
xor ecx, ecx
call fcn.140006888
mov rcx, rax
call fcn.1400076d0
lea rcx, str._nPress_Enter_to_exit...
call fcn.1400019e0
call fcn.1400072c8
jmp 0x1400018d4
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.1400028a0
add rsp, 0x8f0
pop rsi
pop rbx
pop rbp
ret
lea rcx, str.ERROR:_Cannot_get_name_of_executable_n
call fcn.1400019e0
mov ecx, 1
call fcn.1400019a0
int3