Function at 0x140034810
Capabilities:
Get common file path
Get program files directory
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe30
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0xe20], rax
mov rbx, rcx
xor ebp, ebp
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14003487b
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140034871
mov rcx, rax
call fcn.140050830
jmp 0x140034874
mov rax, rbp
mov qword [0x1401370f0], rax
lea rdx, str.____FinishStep____
mov rcx, rax
call fcn.140050c00
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400733a0
nop
xor eax, eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
lea r8, [rbx + 0x410]
mov edx, 0x100
lea rcx, [rsp + 0x178]
call fcn.1400b1b70
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140034902
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400348f8
mov rcx, rax
call fcn.140050830
jmp 0x1400348fb
mov rax, rbp
mov qword [0x1401370f0], rax
mov r8d, dword [rbx + 0x1080]
lea rdx, str.___m_printerListIdx___d___1__REMOVEALLPRINTERS_
mov rcx, rax
call fcn.140050c00
cmp dword [rbx + 0x1084], 0
je 0x140034958
mov dword [rsp + 0x40], 0x110
mov dword [rsp + 0x44], 0x112
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0xe30]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1400349b7
lea rcx, [rbx + 0xe30]
call fcn.1400175f0
jmp 0x1400349b7
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14003498c
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140034982
mov rcx, rax
call fcn.140050830
jmp 0x140034985
mov rax, rbp
mov qword [0x1401370f0], rax
lea rdx, str.stopping_and_uninstalling_the_SI_service
mov rcx, rax
call fcn.140050c00
lea rcx, [0x1400eca20]
call fcn.1400175f0
mov dword [rsp + 0x40], 0x10f
mov dword [rsp + 0x44], 0x111
mov word [rsp + 0xa10], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xa12]
call fcn.1400b57e0
mov word [rsp + 0x800], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x802]
call fcn.1400b57e0
mov edx, 0x100
lea rcx, [rsp + 0xa10]
call fcn.140015c60
mov word [rsp + 0xc10], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xc12]
call fcn.1400b57e0
lea rdx, [rsp + 0xc10]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140034a6f
mov word [rsp + 0x800], 0
lea r8, [rsp + 0xc10]
mov edx, 0x104
lea rcx, [rsp + 0x800]
call fcn.1400b1b70
jmp 0x140034a92
mov word [rsp + 0x800], 0
lea r8, str.C:Program_Files
mov edx, 0x104
lea rcx, [rsp + 0x800]
call fcn.1400b1b70
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140034ac6
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140034abc
mov rcx, rax
call fcn.140050830
jmp 0x140034abf
mov rax, rbp
mov qword [0x1401370f0], rax
lea rcx, [rsp + 0x800]
mov qword [rsp + 0x20], rcx
lea r9, str.ProgFilesDir
lea r8, [rsp + 0xa10]
lea rdx, str.SaveStringToHKLM__s__s__s
mov rcx, rax
call fcn.140050c00
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x800]
repne scasw ax, word [rdi]
not rcx
lea esi, [rcx + rcx]
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140034b3c
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140034b32
mov rcx, rax
call fcn.140050830
jmp 0x140034b35
mov rax, rbp
mov qword [0x1401370f0], rax
lea r9, str.ProgFilesDir
lea r8, [rsp + 0xa10]
lea rdx, str.SaveValueToHKLM__s__s
mov rcx, rax
call fcn.140050c00
lea rdx, [rsp + 0xa10]
lea rcx, [rsp + 0x30]
call fcn.140048010
mov rdi, rax
test rax, rax
je 0x140034ba9
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0x800]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ProgFilesDir
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140034bf1
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140034bdd
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140034bd3
mov rcx, rax
call fcn.140050830
jmp 0x140034bd6
mov rax, rbp
mov qword [0x1401370f0], rax
lea r8, str.SaveValueToHKLM__RegCreateKeyEx_failed
mov edx, 0x3f3
mov rcx, rax
call fcn.140050e40
xor r8d, r8d
mov edx, 0x469
mov rcx, qword [rbx + 0x1040]
call fcn.140072000
mov dword [rsp + 0x58], 0xda
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x48], ebp
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rdx + 0x18], rax
lea rcx, [rsp + 0x70]
call fcn.14008e070
nop
lea rax, [0x1400fc718]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x750]
call fcn.140098abc
nop
lea rcx, [rsp + 0x6a8]
call fcn.140098abc
nop
lea rcx, [rsp + 0x600]
call fcn.140098abc
nop
lea rax, method.CDialog.virtual_0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x3a8]
test rcx, rcx
je 0x140034ca3
call fcn.140084dcc
mov qword [rsp + 0x3a8], rbp
mov qword [rsp + 0x3b0], rbp
mov qword [rsp + 0x3b8], rbp
mov rcx, qword [rsp + 0x388]
test rcx, rcx
je 0x140034ccd
call fcn.140084dcc
mov qword [rsp + 0x388], rbp
mov qword [rsp + 0x390], rbp
mov qword [rsp + 0x398], rbp
lea rcx, [rsp + 0x70]
call fcn.14008d55c
xor eax, eax
mov rcx, qword [rsp + 0xe20]
xor rcx, rsp
call fcn.1400b09d0
lea r11, [rsp + 0xe30]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret