Function at 0x140028478
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x370
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rsi, rcx
lea r8, str.CMsiUninstaller::UninstallMsiUsingProductCodes__
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
mov ebp, 0x64
mov r15d, ebp
cmp qword [rsi + 0x68], 0
jbe 0x1400284e9
xor edx, edx
mov eax, ebp
div dword [rsi + 0x68]
mov r15d, eax
xor r14d, r14d
xor r12d, r12d
mov qword [rsp + 0xe0], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0xd8], r12
mov byte [rsp + 0xc8], r12b
mov rcx, qword [rsi + 0x60]
mov rdx, qword [rcx]
mov qword [rsp + 0x48], rdx
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov rdi, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsi + 0x60]
test rdi, rdi
je 0x140028544
cmp rdi, qword [rsi + 0x38]
je 0x140028549
call fcn.14009861c
cmp r13, rbx
je 0x140028c2a
test rdi, rdi
jne 0x140028561
call fcn.14009861c
xor r11d, r11d
jmp 0x140028564
mov r11, qword [rdi]
cmp r13, qword [r11 + 0x28]
jne 0x14002856f
call fcn.14009861c
lea rbx, [r13 + 0x10]
cmp qword [rbx + 0x20], 0x10
jb 0x140028580
mov r9, qword [rbx + 8]
jmp 0x140028584
lea r9, [rbx + 8]
lea r8, str.CMsiUninstaller_looking_for__s_n
mov edx, 0x20
lea rcx, [0x14010f570]
call fcn.140001000
xor ebp, ebp
mov qword [rsp + 0x40], rbp
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x130], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x118], al
cmp rdi, rax
jne 0x1400285d3
call fcn.14009861c
xor r11d, r11d
jmp 0x1400285d6
mov r11, qword [rdi]
cmp r13, qword [r11 + 0x28]
jne 0x1400285e1
call fcn.14009861c
mov rcx, rbx
call fcn.14005c3ac
test eax, eax
jne 0x140028667
test rdi, rdi
jne 0x1400285fc
call fcn.14009861c
xor r11d, r11d
jmp 0x1400285ff
mov r11, qword [rdi]
cmp r13, qword [r11 + 0x28]
jne 0x14002860a
call fcn.14009861c
cmp qword [rbx + 0x20], 0x10
jb 0x140028617
mov r8, qword [rbx + 8]
jmp 0x14002861b
lea r8, [rbx + 8]
lea rdx, str.CMsiUninstaller::Delete____s_doesnt_exist_n
lea rcx, [0x14010f570]
call fcn.14004b7ec
add r14d, r15d
mov rcx, qword [rsi + 8]
xor ebx, ebx
cmp rcx, rbx
je 0x140028645
mov edx, r14d
call fcn.14002d3a0
nop
cmp qword [rsp + 0x130], 0x10
jb 0x14002865e
mov rcx, qword [rsp + 0x118]
call fcn.14006127c
nop
mov dword [rsp + 0x48], ebx
jmp 0x140028c04
cmp qword [rsi + 8], 0
je 0x140028777
mov r9d, 0x20019
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.14000bc38
test eax, eax
jne 0x140028757
mov byte [rsp + 0x140], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x141]
call fcn.1400988d0
mov dword [rsp + 0x50], 0x104
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rbp, qword [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14002872b
test rdi, rdi
jne 0x140028701
call fcn.14009861c
xor r11d, r11d
jmp 0x140028704
mov r11, qword [rdi]
cmp r13, qword [r11 + 0x28]
jne 0x14002870f
call fcn.14009861c
cmp qword [rbx + 0x20], 0x10
jb 0x14002871c
mov rdx, qword [rbx + 8]
jmp 0x140028720
lea rdx, [rbx + 8]
mov rcx, qword [rsi + 8]
call fcn.14002dba4
jmp 0x14002873c
lea rdx, [rsp + 0x140]
mov rcx, qword [rsi + 8]
call fcn.14002dba4
test rbp, rbp
je 0x140028750
mov rcx, rbp
call fcn.14004e608
xor ebp, ebp
mov qword [rsp + 0x40], rbp
and dword [rsp + 0x48], 0
jmp 0x14002875c
mov rbp, qword [rsp + 0x40]
mov eax, r12d
imul eax, eax, 0x64
xor edx, edx
div qword [rsi + 0x68]
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rsi + 8]
call fcn.14002d4bc
lea rcx, str.msiexec__x
call fcn.1400980d0
mov r8, rax
lea rdx, str.msiexec__x
lea rcx, [rsp + 0xc0]
call fcn.14000352c
test rdi, rdi
jne 0x1400287a9
call fcn.14009861c
xor r11d, r11d
jmp 0x1400287ac
mov r11, qword [rdi]
cmp r13, qword [r11 + 0x28]
jne 0x1400287b7
call fcn.14009861c
cmp qword [rbx + 0x20], 0x10
jb 0x1400287c4
mov rbx, qword [rbx + 8]
jmp 0x1400287c8
add rbx, 8
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.14000627c
lea rcx, str.__qn_REBOOTReallySuppress
call fcn.1400980d0
mov r8, rax
lea rdx, str.__qn_REBOOTReallySuppress
lea rcx, [rsp + 0xc0]
call fcn.14000627c
xor ebx, ebx
mov byte [rsp + 0x250], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x251]
call fcn.1400988d0
mov r9d, r12d
lea r8, str._MSI__d.log
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.14009841c
inc r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x108], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x100], rbx
mov byte [rsp + 0xf0], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x14011f008]
lea rcx, [rsp + 0xe8]
call fcn.140002458
nop
cmp qword [rsp + 0x100], rbx
ja 0x14002893c
mov byte [rsp + 0x140], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x141]
call fcn.1400988d0
lea rdx, [rsp + 0x140]
mov r12d, 0x104
mov ecx, r12d
call fcn.14005c0b0
lea r11, [rsp + 0x140]
cmp r11, rbx
je 0x140028900
lea rcx, [rsp + 0x140]
call fcn.1400980d0
cmp rax, rbx
jbe 0x140028900
cmp byte [rsp + rax + 0x13f], 0x5c
je 0x140028900
lea rdx, [rax + 2]
lea r8, [0x1400c55c0]
lea rcx, [rsp + 0x140]
call fcn.140098ed8
lea r8, str.hpzscr.log
mov rdx, r12
lea rcx, [rsp + 0x140]
call fcn.140098ed8
lea rcx, [rsp + 0x140]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0xe8]
call fcn.14000352c
lea rcx, str..log
call fcn.1400980d0
mov r9, rax
xor r8d, r8d
lea rdx, str..log
lea rcx, [rsp + 0xe8]
call fcn.140005be4
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140028992
lea rcx, [rsp + 0x250]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0xe8]
call fcn.14000627c
jmp 0x1400289d0
lea rcx, str..log
call fcn.1400980d0
mov rbx, rax
lea rcx, [rsp + 0x250]
call fcn.1400980d0
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x250]
mov r8, rbx
mov rdx, r12
lea rcx, [rsp + 0xe8]
call fcn.14001ef74
xor ebx, ebx
lea rcx, str.__lv__
call fcn.1400980d0
mov r8, rax
lea rdx, str.__lv__
lea rcx, [rsp + 0xc0]
call fcn.14000627c
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xc0]
call fcn.140006164
lea rcx, [0x1400c97ec]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c97ec]
lea rcx, [rsp + 0xc0]
call fcn.14000627c
lea r8, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae r8, qword [rsp + 0xc8]
lea rdx, str.CMsiUninstaller::Delete___launching__s_n
lea rcx, [0x14010f570]
call fcn.14004b9f0
lea rcx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae rcx, qword [rsp + 0xc8]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
or r8d, 0xffffffff
lea r12d, [r9 + 1]
mov edx, r12d
call fcn.14005cbfc
cmp eax, 0xbc2
jne 0x140028ab3
mov rax, qword [rsi + 0x88]
mov dword [rax + 0x7c8], r12d
jmp 0x140028b6e
cmp eax, ebx
je 0x140028b6e
mov ecx, eax
call fcn.14004d8f0
mov rbx, rax
mov qword [rsp + 0x78], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0x70], 0
mov byte [rsp + 0x60], 0
mov rcx, rax
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14000352c
nop
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x58]
mov r8d, 0x28
call fcn.140099ee0
lea r9, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae r9, qword [rsp + 0xc8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, str.failed:
mov qword [rsp + 0x20], rax
lea r8, str.MSI_Uninstall___s___s__s_n
mov edx, 0x20
lea rcx, [0x14010f570]
call fcn.140001000
nop
cmp qword [rsp + 0x78], 0x10
jb 0x140028b6c
mov rcx, qword [rsp + 0x60]
call fcn.14006127c
xor ebx, ebx
jmp 0x140028b6e
xor ebx, ebx
add r14d, r15d
mov rcx, qword [rsi + 8]
cmp rcx, rbx
je 0x140028b83
mov edx, r14d
call fcn.14002d3a0
nop
cmp qword [rsp + 0x108], 0x10
jb 0x140028b9b
mov rcx, qword [rsp + 0xf0]
call fcn.14006127c
mov qword [rsp + 0x108], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x100], rbx
mov byte [rsp + 0xf0], bl
cmp qword [rsp + 0x130], 0x10
jb 0x140028bce
mov rcx, qword [rsp + 0x118]
call fcn.14006127c
mov qword [rsp + 0x130], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x128], rbx
mov byte [rsp + 0x118], bl
cmp rbp, rbx
je 0x140028bfb
mov rcx, rbp
call fcn.14004e608
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
mov r12d, dword [rsp + 0x50]
cmp rdi, rbx
jne 0x140028c13
call fcn.14009861c
mov r11, rbx
jmp 0x140028c16
mov r11, qword [rdi]
cmp r13, qword [r11 + 0x28]
jne 0x140028c21
call fcn.14009861c
mov r13, qword [r13]
jmp 0x140028535
xor r8d, r8d
lea edx, [r8 + 0x64]
mov rcx, qword [rsi + 8]
call fcn.14002d4bc
lea r8, str.CMsiUninstaller::UninstallMsiUsingProductCodes__
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
nop
cmp qword [rsp + 0xe0], 0x10
jb 0x140028c6b
mov rcx, qword [rsp + 0xc8]
call fcn.14006127c
xor eax, eax
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140061100
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret