Function at 0x140083620
Capabilities:
Check if file exists
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r13, r8
mov qword [rsp + 0x68], rdx
movzx eax, cx
mov word [rsp + 0x44], cx
cmp dword [0x140455d78], 0
je 0x140083693
call fcn.14007f830
test eax, eax
je 0x140083dfc
mov eax, 4
mov qword [rsp + 0x60], 1
jmp 0x14008369d
mov eax, 2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rax
xor esi, esi
mov ebx, esi
mov qword [rsp + 0x58], rbx
lea r8, str.PESOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [0x14033c340]
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov edi, esi
mov dword [rsp + 0x48], esi
nop word [rax + rax]
cmp dword [0x140455b64], 0
jne 0x140083da4
movsxd rax, edi
mov rcx, qword [rcx + rbx*8]
imul rdx, rax, 0x208
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
cmp dword [0x140455d78], 0
je 0x140083702
add rdx, r8
jmp 0x140083705
add rdx, r9
mov r9d, 0x20019
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140083d7f
mov ebx, esi
mov dword [rbp - 0x30], 0x104
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x140083d70
xor edi, edi
nop dword [rax]
inc ebx
mov dword [rsp + 0x40], ebx
cmp dword [0x140455b64], 0
jne 0x140083d6a
mov qword [rbp - 0x58], rdi
mov r12, rdi
mov dword [rbp - 0x78], edi
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140083843
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140083d1f
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b1b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083843
mov eax, dword [rbp - 0x78]
test eax, eax
je 0x140083843
add eax, 4
mov dword [rbp - 0x78], eax
mov ecx, eax
call fcn.140125a94
mov r12, rax
test rax, rax
je 0x140083843
mov r8d, dword [rbp - 0x78]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b1b0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083838
cmp dword [rbp - 0x78], eax
ja 0x140083843
mov rcx, r12
call fcn.140125e14
mov r12, rdi
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140083856
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x58], rdi
test r12, r12
je 0x140083d1f
mov qword [rbp - 0x50], rdi
mov r15, rdi
mov dword [rbp - 0x74], edi
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008392f
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140083942
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b160]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008392f
mov eax, dword [rbp - 0x74]
test eax, eax
je 0x14008392f
add eax, 4
mov dword [rbp - 0x74], eax
mov ecx, eax
call fcn.140125a94
mov r15, rax
test rax, rax
je 0x14008392f
mov r8d, dword [rbp - 0x74]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b160]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083924
cmp dword [rbp - 0x74], eax
ja 0x14008392f
mov rcx, r15
call fcn.140125e14
mov r15, rdi
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140083942
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov r14, rdi
mov dword [rbp - 0x70], edi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140083a12
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140083a25
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b180]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083a12
mov eax, dword [rbp - 0x70]
test eax, eax
je 0x140083a12
add eax, 4
mov dword [rbp - 0x70], eax
mov ecx, eax
call fcn.140125a94
mov r14, rax
test rax, rax
je 0x140083a12
mov r8d, dword [rbp - 0x70]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b180]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083a07
cmp dword [rbp - 0x70], eax
ja 0x140083a12
mov rcx, r14
call fcn.140125e14
mov r14, rdi
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140083a25
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rdi
mov rsi, rdi
mov dword [rbp - 0x6c], edi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140083af5
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140083b08
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b1f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083af5
mov eax, dword [rbp - 0x6c]
test eax, eax
je 0x140083af5
add eax, 4
mov dword [rbp - 0x6c], eax
mov ecx, eax
call fcn.140125a94
mov rsi, rax
test rax, rax
je 0x140083af5
mov r8d, dword [rbp - 0x6c]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b1f8]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083aea
cmp dword [rbp - 0x6c], eax
ja 0x140083af5
mov rcx, rsi
call fcn.140125e14
mov rsi, rdi
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140083b08
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov dword [rbp - 0x68], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 3]
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140083bdc
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140083bf3
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b210]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083bdc
mov eax, dword [rbp - 0x68]
test eax, eax
je 0x140083bdc
add eax, 4
mov dword [rbp - 0x68], eax
mov ecx, eax
call fcn.140125a94
mov rdi, rax
test rax, rax
je 0x140083bdc
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x14044378c]
xor r8d, r8d
lea rdx, [0x14032b210]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140083bd2
cmp dword [rbp - 0x68], eax
ja 0x140083bdc
mov rcx, rdi
call fcn.140125e14
xor edi, edi
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140083bf3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x38], 0
test r15, r15
jne 0x140083c26
test r14, r14
jne 0x140083c04
test rsi, rsi
jne 0x140083c09
jmp 0x140083c18
test rsi, rsi
je 0x140083c0e
mov rcx, rsi
jmp 0x140083c29
test r14, r14
je 0x140083c18
mov rcx, r14
jmp 0x140083c29
test rdi, rdi
je 0x140083d15
mov rcx, rdi
jmp 0x140083c29
mov rcx, r15
test rcx, rcx
je 0x140083ce1
call fcn.140054780
mov rbx, rax
test rax, rax
je 0x140083cdd
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140083cdd
movzx eax, word [rsp + 0x44]
cmp ax, word [rbx]
jne 0x140083cdd
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x140083cdd
mov rax, qword [r13 + 0x10]
cmp qword [r13 + 8], rax
jne 0x140083c85
mov rcx, r13
call fcn.140056010
mov rcx, qword [r13 + 8]
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x80], rcx
test rcx, rcx
je 0x140083cd8
xor edx, edx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 8
jb 0x140083cb1
mov rax, qword [rcx]
jmp 0x140083cb4
mov rax, rcx
mov word [rax], dx
cmp word [rbx], dx
jne 0x140083cc1
mov r8, rdx
jmp 0x140083ccf
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], dx
jne 0x140083cc5
mov rdx, rbx
call fcn.14004db90
nop
add qword [r13 + 8], 0x20
mov ebx, dword [rsp + 0x40]
test r15, r15
je 0x140083cee
mov rcx, r15
call fcn.140125e14
test r14, r14
je 0x140083cfb
mov rcx, r14
call fcn.140125e14
test rsi, rsi
je 0x140083d08
mov rcx, rsi
call fcn.140125e14
test rdi, rdi
je 0x140083d15
mov rcx, rdi
call fcn.140125e14
mov rcx, r12
call fcn.140125e14
xor edi, edi
mov dword [rbp - 0x30], 0x104
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x20]
call fcn.1402767a0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x140083760
mov edi, dword [rsp + 0x48]
xor esi, esi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
inc edi
mov dword [rsp + 0x48], edi
cmp edi, dword [rsp + 0x50]
lea rcx, [0x14033c340]
lea r8, str.PESOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
jl 0x1400836d0
inc rbx
mov qword [rsp + 0x58], rbx
cmp rbx, qword [rsp + 0x60]
jl 0x1400836c0
cmp dword [0x140455d78], 0
je 0x140083dfc
lea rdx, [0x140326b98]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x140326bb0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x140326c58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140125a70
mov rbx, qword [rsp + 0x358]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret