Function at 0x140004414
Capabilities:
Delete file
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, qword [rbp + 0x228]
mov rax, rcx
mov r15, qword [rbp + 0x230]
mov rbx, rdx
mov rdx, qword [rbp + 0x268]
mov rsi, r9
mov r13, qword [rbp + 0x240]
mov rdi, r8
mov r12, qword [rbp + 0x248]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rbp + 0x258]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x260]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rbp + 0x278]
mov qword [rbp - 0x70], rcx
mov rcx, qword [rbp + 0x280]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x290]
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x40], rcx
cmp dword [rax], ecx
je 0x140004c93
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x68]
cmp dword [rdx + 0x30], 7
jge 0x140004502
mov ebx, 0x8007139f
jmp 0x140004bdb
test rbx, rbx
je 0x140004bd6
test rdi, rdi
je 0x140004bd6
mov rdx, qword [rdx + 0x40]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x14000452e
add rbx, 2
test ecx, ecx
jne 0x14000451b
test eax, eax
je 0x14000453c
mov ebx, 0x80070005
jmp 0x140004bdb
lea rcx, [rsp + 0x50]
call fcn.14000ab1c
mov ebx, eax
test eax, eax
jne 0x140004bdb
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400045a4
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc3
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x1400045f4
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
jne 0x140004bc3
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x14000463d
mov rax, rdi
inc rax
cmp word [rsi + rax*2], cx
jne 0x140004600
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc3
mov ecx, 4
lea rax, [rbp + 0x220]
mov dword [rsp + 0x28], ecx
lea rdx, str.SystemComponent
mov r9d, ecx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc3
mov rcx, qword [rsp + 0x30]
lea rax, str.MSICD
mov dword [rsp + 0x28], 0xc
lea rdx, str.Installer
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc3
test r14, r14
je 0x1400046f1
mov rcx, qword [rsp + 0x30]
lea rdx, str.Expire
mov eax, 4
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov r9d, eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
jne 0x140004bc6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004745
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
test r15, r15
je 0x140004790
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r14w
jne 0x14000474d
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.CODEBASE
mov r9d, 1
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov esi, dword [rbp + 0x238]
test esi, esi
jne 0x1400049c1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rbp - 0x60]
mov word [rbp + 0x1a6], r14w
mov r15d, 0x103
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], r15d
lea rdx, [0x140013068]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004831
test r13, r13
je 0x140004804
lea rdx, [rbp - 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004831
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test r13, r13
jne 0x140004831
mov rcx, qword [rsp + 0x38]
lea rdx, [0x140013068]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x48], r15d
lea rax, [rbp - 0x60]
lea r15, [0x1400131c8]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x1a6], r14w
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048bd
test r12, r12
je 0x140004894
lea rdx, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x1400048bd
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test r12, r12
jne 0x1400048c2
mov rcx, qword [rsp + 0x38]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test r12, r12
je 0x140004904
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r14w
jne 0x1400048c5
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
test r13, r13
je 0x140004950
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x14000490c
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x140013068]
mov r9d, 1
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400049a4
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov rcx, qword [rsp + 0x30]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
jmp 0x140004a4f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004a15
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x250]
mov r9d, 4
lea rdx, str.Precache
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov rcx, qword [rsp + 0x70]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004a57
lea eax, [rax*2 + 2]
mov r15d, 1
mov dword [rsp + 0x28], eax
mov r9d, r15d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
test esi, esi
jne 0x140004bde
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004aed
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004aad
lea eax, [rax*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.LastModified
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140004b36
inc rdi
cmp word [rcx + rdi*2], r14w
jne 0x140004af6
lea eax, [rdi*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.Etag
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004b86
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004bc6
mov rax, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov r8d, dword [rbp + 0x270]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.14000224c
mov ebx, eax
test eax, eax
js 0x140004bde
mov r9, qword [rbp - 0x68]
mov r8d, dword [rbp + 0x288]
mov rdx, qword [rsp + 0x58]
call fcn.140002154
mov ebx, eax
jmp 0x140004bde
xor r14d, r14d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140004bde
mov ebx, 0x80070057
xor r14d, r14d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140004bf4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004c0a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004c20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140004c36
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004c4c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, qword [rsp + 0x68]
cmp dword [rax], r14d
je 0x140004c66
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14000f1e0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x8007000e
xor r14d, r14d
jmp 0x140004c51