Function at 0x14001a710
Capabilities:
Get installed programs
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14005b060]
xor rax, rsp
mov qword [rbp], rax
call fcn.140005f10
test eax, eax
je 0x14001ab7a
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Queue_WinTUN_uninstall_for_next_boot__cant_uninstall_in_safe_mode
lea rcx, [rbp - 0x60]
call fcn.14000edc0
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14001a7b7
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a7b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b007
call fcn.14001c70c
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 9]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x14001aa96
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14001aa96
lea rcx, [rbp - 0x40]
call fcn.14001a390
nop
cmp qword [rbp - 0x30], rsi
je 0x14001aa4e
mov rbx, qword [0x14005eb48]
lea r9, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r9, qword [rbp - 0x40]
lea r8d, [rsi + 1]
lea rdx, str.Scheduling_WinTUN_removal_with_for_product__ls
lea rcx, [rbp - 0x60]
call fcn.14000edc0
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14001a88b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b00d
call fcn.14001c70c
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
mov word [rbp - 0x20], si
mov r8d, 0x12
lea rdx, str.msiexec.exe__qn__x
lea rcx, [rbp - 0x20]
call fcn.1400063f0
nop
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.140006800
mov eax, dword [rbp - 0x10]
lea eax, [rax*2 + 2]
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
lea r8, str.Private_Internet_Access_WinTUN_Uninstall
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14001aa0d
mov rbx, qword [0x14005eb48]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.140001820
nop
cmp qword [rax + 0x18], 0x10
jb 0x14001a93f
mov rax, qword [rax]
lea r9, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r9, qword [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 3
lea rdx, str.Cant_schedule_WinTUN_removal_for_product__ls___0x_X___s
lea rcx, [rbp - 0x80]
call fcn.14000edc0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14001a9c1
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a9bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b013
call fcn.14001c70c
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14001aa0d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b019
call fcn.14001c70c
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14001aa4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b01f
call fcn.14001c70c
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001afc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001afc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aff5
jmp 0x14001afc1
mov rbx, qword [0x14005eb48]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.140001820
nop
cmp qword [rax + 0x18], 0x10
jb 0x14001aab6
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8d, 2
lea rdx, str.Cant_remove_WinTUN__unable_to_find_uninstall_entry___0x_X:__s
lea rcx, [rbp - 0x80]
call fcn.14000edc0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14001ab27
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ab22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b025
call fcn.14001c70c
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14001afc6
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001afc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001affb
jmp 0x14001afc1
lea rdx, [0x14005eb60]
cmp qword [0x14005eb78], 8
cmovae rdx, qword [0x14005eb60]
lea rcx, [rsp + 0x40]
call fcn.140005b20
nop
xor esi, esi
mov rbx, qword [rsp + 0x40]
cmp rbx, qword [rsp + 0x48]
jne 0x14001ac20
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.WinTUN_package_is_not_installed__nothing_to_uninstall
lea rcx, [rbp - 0x60]
call fcn.14000edc0
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14001af1d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001af17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b001
jmp 0x14001af17
mov r14, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001ac2d
mov r14, qword [rbx]
lea r9, [0x14004f4c4]
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, r14
call qword [sym.imp.msi.dll_MsiGetFileVersionA]
mov rdi, qword [0x14005eb48]
mov r9, r14
test eax, eax
jne 0x14001acca
lea r8d, [rax + 1]
lea rdx, str.WinTUN_uninstall_of__ls_succeeded
lea rcx, [rbp - 0x80]
call fcn.14000edc0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov rcx, rdi
call fcn.14000f340
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14001acb6
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001acb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b031
call fcn.14001c70c
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
mov al, 1
jmp 0x14001ad47
mov dword [rsp + 0x20], eax
mov r8d, 2
lea rdx, str.WinTUN_uninstall_of__ls_failed____u
lea rcx, [rbp - 0x20]
call fcn.14000edc0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.14000f340
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14001ad35
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ad30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b037
call fcn.14001c70c
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], sil
xor al, al
test al, al
je 0x14001addf
mov rdi, qword [0x14005eb48]
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001ad63
mov r9, qword [rbx]
mov r8d, 1
lea rdx, str.Uninstalled_product__S
lea rcx, [rbp - 0x40]
call fcn.14000edc0
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
mov rcx, rdi
call fcn.14000f340
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14001adca
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001adc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b03d
call fcn.14001c70c
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], sil
jmp 0x14001aea2
mov dword [rsp + 0x58], 0x9f0
mov byte [rsp + 0x5c], sil
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
lea rdx, [rsp + 0x58]
mov ecx, 3
call fcn.14000e260
cmp eax, 2
jne 0x14001aea6
mov rdi, qword [0x14005eb48]
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001ae2b
mov r9, qword [rbx]
mov r8d, 1
lea rdx, str.User_ignored_WinTUN_uninstall_failure_for_product__S
lea rcx, [rbp - 0x60]
call fcn.14000edc0
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov rcx, rdi
call fcn.14000f340
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14001ae92
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ae8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b043
call fcn.14001c70c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], sil
add rbx, 0x20
cmp rbx, qword [rsp + 0x48]
jne 0x14001ac20
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Finished_uninstalling_products_for_WinTUN_package
lea rcx, [rbp - 0x80]
call fcn.14000edc0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14001af1d
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001af17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b02b
call fcn.14001c70c
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14001afc6
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x14001af91
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001af74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001af6f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001afef
mov rcx, r8
call fcn.14001c70c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
add rbx, 0x20
cmp rbx, rdi
jne 0x14001af35
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001afbe
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afef
mov rcx, rbx
call fcn.14001c70c
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14001c460
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3