Function at 0x140011080
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rbp + 0x590], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdi, [0x140029ee8]
mov rdx, rdi
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x58]
xor esi, esi
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x380]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001153f
mov qword [rsp + 0x6b0], rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [0x14002bde0]
lea rdx, [0x14003ae60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rdx, rbx
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rbx, qword [rsp + 0x50]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
lea r8d, [rsi + 0xb]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1400111f9
mov word [rsp + 0x60], si
jmp 0x1400112b7
mov edx, 1
mov rcx, rdi
mov ebx, esi
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140011271
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
test rax, rax
je 0x140011271
cmp dword [rax], 0xfeef04bd
je 0x14001124c
nop word [rax + rax]
add rcx, 4
cmp dword [rcx], 0xfeef04bd
jne 0x140011240
mov eax, dword [rcx + 0x10]
mov ebx, eax
mov ecx, dword [rcx + 0x14]
shr ebx, 0x10
shl ebx, 8
movzx eax, ax
add ebx, eax
mov eax, ecx
shr eax, 0x10
shl ebx, 8
add ebx, eax
movzx eax, cx
shl ebx, 8
add ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov word [rsp + 0x68], si
shr eax, 0x18
add ax, 0x30
mov word [rsp + 0x60], ax
mov eax, 0x2e
mov word [rsp + 0x62], ax
mov eax, ebx
shr eax, 0x10
movzx ecx, al
shr ebx, 8
add cx, 0x30
movzx eax, bl
add ax, 0x30
mov word [rsp + 0x64], cx
mov word [rsp + 0x66], ax
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea rdx, str.DisplayVersion
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
lea rdi, [0x14002c328]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea rdx, str.Publisher
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [0x14003ae60]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, [0x14002c354]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea rdx, str.InstallLocation
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 0x22
lea rdx, [0x14003ae60]
lea rcx, [rsp + 0x62]
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x62]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, [0x14002bec8]
lea rcx, [rsp + 0x62]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14002c240]
lea rcx, [rsp + 0x62]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14002c378]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea rdx, str.UninstallString
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
lea rdi, str.https:__hp.vector.co.jp_authors_VA018351_
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea rdx, str.URLInfoAbout
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea rdx, str.HelpLink
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
lea rdi, str.https:__hp.vector.co.jp_authors_VA018351_claunch.html
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea rdx, str.URLUpdateInfo
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
lea rdi, str.pyonky_claunch_yahoo.co.jp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
lea rdx, str.Contact
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x6b0]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.140013ba0
lea r11, [rsp + 0x6a0]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret