Function at 0x140002270
Capabilities:
Delete registry key
Extract resource via kernel32 functions
Get common file path
Set registry value

Disassembly:
push rbp
push rbx
push r12
push r13
lea rbp, [rsp - 0x3f]
sub rsp, 0xc8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r12d, r12d
mov r13, rdx
test ecx, ecx
mov qword [rbp - 0x31], r12
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallD17F1E1A_5919_4427_8F89_A1A8503CA3EB_ExplorerPatcher
je 0x14000268c
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x31]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x31]
mov ebx, eax
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400026ba
test ebx, ebx
jne 0x1400026b4
mov qword [rsp + 0xc0], r15
mov r15, 0xffffffffffffffff
mov rax, r15
nop dword [rax + rax]
cmp word [r13 + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140002310
lea eax, [rax*2 + 2]
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x28], eax
lea rdx, str.UninstallString
mov r9d, 1
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14000267a
mov rcx, qword [rbp - 0x31]
lea rax, [0x140027ad0]
mov dword [rsp + 0x28], 0x20
lea rdx, str.DisplayName
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14000267a
mov rcx, qword [rbp - 0x31]
lea rax, str.VALINET_Solutions_SRL
mov dword [rsp + 0x28], 0x2c
lea rdx, str.Publisher
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14000267a
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], 4
lea rdx, str.NoModify
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x21], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14000267a
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], 4
lea rdx, str.NoRepair
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x21], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14000267a
lea rcx, [r13 + 2]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [0x1400284f8]
mov edx, 0x102
lea rcx, [r13 + 2]
call fcn.140010fd8
xor edx, edx
lea rcx, [r13 + 2]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x39], rax
mov rdi, rax
test rax, rax
je 0x14000261f
mov qword [rsp + 0xf0], rsi
mov edx, 1
mov r8d, 0x10
mov qword [rsp + 0x108], r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, esi
xor ecx, ecx
mov rdi, rax
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.14001ddb0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea r9, [rbp - 0x19]
mov rcx, rsi
lea r8, [rbp - 0x29]
lea rdx, [0x140027a70]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rcx, qword [rbp - 0x29]
mov edx, dword [rcx + 0xc]
mov eax, edx
mov ebx, dword [rcx + 8]
mov rcx, rsi
shr eax, 0x10
mov dword [rbp - 0x1d], eax
movzx eax, dx
mov dword [rbp - 0x21], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rbp - 0x21]
lea r8, str._d._d._d._d
mov dword [rsp + 0x30], eax
mov edx, 0x1e
mov eax, dword [rbp - 0x1d]
movzx ecx, bx
mov dword [rsp + 0x28], eax
shr ebx, 0x10
mov dword [rsp + 0x20], ecx
mov r9d, ebx
lea rcx, [rbp - 0x11]
call fcn.140001070
mov r14, qword [rsp + 0x108]
lea rcx, [rbp - 0x11]
mov rsi, qword [rsp + 0xf0]
mov rax, r15
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140002573
mov rcx, qword [rbp - 0x31]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.DisplayVersion
lea rax, [rbp - 0x11]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140002611
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x1d]
mov dword [rsp + 0x28], 4
lea rdx, str.VersionMajor
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140002611
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], 4
lea rdx, str.VersionMinor
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x14000267a
mov edx, 0x104
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.explorer.exe
mov edx, 0x104
mov rcx, r13
call fcn.140010fd8
cmp word [r13 + r15*2 + 2], r12w
lea r15, [r15 + 1]
jne 0x140002641
mov rcx, qword [rbp - 0x31]
lea eax, [r15*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.DisplayIcon
mov r9d, 1
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rdi, qword [rsp + 0x100]
mov r15, qword [rsp + 0xc0]
jmp 0x1400026b0
lea r8, [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rbp - 0x31]
mov ebx, eax
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1400026ba
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete r12b
mov eax, r12d
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140005680
add rsp, 0xc8
pop r13
pop r12
pop rbx
pop rbp
ret