Function at 0x140004bd0
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbfc0]
mov eax, 0xc0c0
call fcn.140008f50
sub rsp, rax
mov rax, qword [0x1400260e0]
xor rax, rsp
mov qword [rbp + 0xbfb0], rax
xor esi, esi
mov eax, dword [0x140026cd8]
test eax, eax
je 0x1400052d1
cmp eax, 0x7fffffff
je 0x1400052d1
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov ebx, 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], si
lea r8d, [rsi + 0x13]
lea rdx, str.Updating_registry..
lea rcx, [rsp + 0x48]
call fcn.140002290
nop
lea rcx, [rsp + 0x48]
call fcn.140005350
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140004ca5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000530d
call fcn.140008948
mov eax, dword [0x140026cdc]
shr rax, 1
add rax, rax
cmp rax, 0x40
jae 0x140005307
lea rcx, [0x140026cf0]
mov word [rax + rcx], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall53F49750_6209_4FBF_9CA8_7A333C87D1ED_is1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400052d1
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], si
lea r8d, [rax + 0x24]
lea rdx, str.Checking_registry_install_location..
lea rcx, [rsp + 0x48]
call fcn.140002290
nop
lea rcx, [rsp + 0x48]
call fcn.140005350
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140004d6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005301
call fcn.140008948
mov dword [rsp + 0x40], 0x2000
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400052c6
mov edx, dword [rsp + 0x40]
shr edx, 1
mov dword [rsp + 0x40], edx
lea eax, [rdx - 1]
cmp word [rbp + rax*2 - 0x50], 0
je 0x140004ddb
lea rcx, [rdx + rdx]
lea eax, [rdx + 1]
mov dword [rsp + 0x40], eax
cmp rcx, 0x2000
jae 0x140005319
mov word [rbp + rcx - 0x50], si
mov eax, dword [rsp + 0x44]
cmp eax, 2
jne 0x140004e21
mov r8d, 0x1000
lea rdx, [rbp + 0x1fb0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x1000
ja 0x140004e18
mov r8d, eax
add r8, r8
lea rdx, [rbp + 0x1fb0]
lea rcx, [rbp - 0x50]
call fcn.14000aaf0
mov eax, dword [rsp + 0x44]
cmp eax, 2
je 0x140004e2a
cmp eax, 1
jne 0x1400052c6
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1fb0]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x1400052c6
mov r8d, 0x2000
lea rdx, [rbp + 0x1fb0]
lea rcx, [rbp - 0x50]
call fcn.14000aaf0
xor r9d, r9d
lea r8, [rbp + 0x1fb0]
mov edx, 0x1000
lea rcx, [0x140019a08]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 0x1000
jae 0x1400052c6
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rbx
mov word [rbp - 0x78], si
lea rax, [rbp - 0x50]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140004ea0
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x78]
call fcn.140002290
nop
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], si
lea rax, [rbp + 0x1fb0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004ee0
lea rdx, [rbp + 0x1fb0]
lea rcx, [rsp + 0x48]
call fcn.140002290
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rsp + 0x58]
sub rax, r15
cmp rax, 1
jb 0x140005313
lea r13, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
setae byte [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmovae r13, r14
mov qword [rsp + 0x68], rsi
lea r12, [r15 + 1]
lea rsi, [rsp + 0x68]
cmp r12, 7
jbe 0x140004f7c
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x140004f5a
mov rbx, rcx
jmp 0x140004f66
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x68]
call fcn.140002190
mov rsi, rax
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x80], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.14000aaf0
mov eax, 0x5c
mov word [rbx + rsi], ax
xor eax, eax
mov word [rsi + r12*2], ax
mov rbx, qword [rbp - 0x60]
cmp rbx, 8
setae sil
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
setae al
test al, al
je 0x140004ff4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000531f
call fcn.140008948
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x140026cdc]
shr eax, 1
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea r15, [0x140026cf0]
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, r15
lea rdx, str.Telegram_Desktop_version__s
lea rcx, [rbp + 0x3fb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x3fb0]
mov rax, rdi
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140005060
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x3fb0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_FZ_LLC
lea rcx, [rbp + 0x5fb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x5fb0]
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400050c0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x5fb0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Publisher
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Telegram_Desktop
lea rcx, [rbp + 0x7fb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x7fb0]
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140005120
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x7fb0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Inno_Setup:_Icon_Group
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx eax, word [rsp + 0x6e]
movzx r9d, word [rsp + 0x6a]
movzx r8d, word [rsp + 0x68]
mov dword [rsp + 0x20], eax
lea rdx, str._04d_02d_02d
lea rcx, [rbp + 0x9fb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x9fb0]
nop dword [rax]
lea rdi, [rdi + 1]
cmp word [rax + rdi*2], 0
jne 0x140005190
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x9fb0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
lea rdi, str.https:__desktop.telegram.org
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.HelpLink
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.URLInfoAbout
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x3a
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.URLUpdateInfo
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp byte [rsp + 0x30], 0
je 0x14000528f
mov rdx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140005286
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005325
mov rcx, r14
call fcn.140008948
nop
test sil, sil
je 0x1400052c6
lea rdx, [rbx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005301
call fcn.140008948
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xbfb0]
xor rcx, rsp
call fcn.140008fb0
lea r11, [rsp + 0xc0c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000f278
int3
call fcn.140008ca8
int3
call fcn.14000f278
nop
call fcn.140001d40
nop
call fcn.140008ca8
nop
call fcn.14000f278
nop
call fcn.14000f278
int3