Function at 0x140004604
Capabilities:
Delete file
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140018018]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, qword [rbp + 0x228]
mov rax, rcx
mov r12, qword [rbp + 0x230]
mov rbx, rdx
mov rdx, qword [rbp + 0x268]
mov rsi, r9
mov r13, qword [rbp + 0x240]
mov rdi, r8
mov r15, qword [rbp + 0x248]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rbp + 0x258]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x260]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rbp + 0x278]
mov qword [rbp - 0x70], rcx
mov rcx, qword [rbp + 0x280]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x290]
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x40], rcx
cmp dword [rax], ecx
je 0x140004dcc
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rsp + 0x68]
cmp dword [rax + 0x30], 7
jge 0x1400046f2
mov ebx, 0x8007139f
jmp 0x140004dd1
test rbx, rbx
je 0x140004dc5
test rdi, rdi
je 0x140004dc5
mov rdx, qword [rax + 0x40]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x14000471e
add rbx, 2
test ecx, ecx
jne 0x14000470b
test eax, eax
je 0x14000472c
mov ebx, 0x80070005
jmp 0x140004dd1
lea rcx, [rsp + 0x50]
call fcn.14000b970
mov ebx, eax
test eax, eax
jne 0x140004dd1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004794
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x1400047e4
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
jne 0x1400048d5
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x14000482d
mov rax, rdi
inc rax
cmp word [rsi + rax*2], cx
jne 0x1400047f0
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov ecx, 4
lea rax, [rbp + 0x220]
mov dword [rsp + 0x28], ecx
lea rdx, str.SystemComponent
mov r9d, ecx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rsp + 0x30]
lea rax, str.MSICD
mov dword [rsp + 0x28], 0xc
lea rdx, str.Installer
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
test r14, r14
je 0x1400048e2
mov rcx, qword [rsp + 0x30]
lea rdx, str.Expire
mov eax, 4
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov r9d, eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
je 0x1400048e2
jg 0x140004dba
mov ebx, eax
jmp 0x140004dd1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004932
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.DownloadInformation
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
test r12, r12
je 0x14000497d
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r14w
jne 0x14000493a
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.CODEBASE
mov r9d, 1
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov esi, dword [rbp + 0x238]
test esi, esi
jne 0x140004bb0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rbp - 0x60]
mov word [rbp + 0x1a6], r14w
mov r12d, 0x103
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], r12d
lea rdx, [0x140014138]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004a1e
test r13, r13
je 0x1400049f1
lea rdx, [rbp - 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004a1e
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test r13, r13
jne 0x140004a1e
mov rcx, qword [rsp + 0x38]
lea rdx, [0x140014138]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x48], r12d
lea rax, [rbp - 0x60]
lea r12, [0x140014298]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x1a6], r14w
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004aac
test r15, r15
je 0x140004a81
lea rdx, [rbp - 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004ab1
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test r15, r15
jne 0x140004ab1
mov rcx, qword [rsp + 0x38]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
jmp 0x140004af3
test r15, r15
je 0x140004af3
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r14w
jne 0x140004ab4
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
test r13, r13
je 0x140004b3f
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x140004afb
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x140014138]
mov r9d, 1
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004b93
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.InstalledVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rsp + 0x30]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
jmp 0x140004c3e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004c04
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.AvailableVersion
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x250]
mov r9d, 4
lea rdx, str.Precache
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rsp + 0x70]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004c46
lea eax, [rax*2 + 2]
mov r15d, 1
mov dword [rsp + 0x28], eax
mov r9d, r15d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
test esi, esi
jne 0x140004dd4
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004cdc
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004c9c
lea eax, [rax*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.LastModified
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140004d25
inc rdi
cmp word [rcx + rdi*2], r14w
jne 0x140004ce5
lea eax, [rdi*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.Etag
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004d79
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
lea rdx, str.Contains
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048d5
mov rax, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov r8d, dword [rbp + 0x270]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140004e90
mov ebx, eax
test eax, eax
js 0x140004dd1
mov r9, qword [rbp - 0x68]
mov r8d, dword [rbp + 0x288]
mov rdx, qword [rsp + 0x58]
call fcn.140004510
mov ebx, eax
test eax, eax
js 0x140004dd1
jmp 0x140004dd4
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140004dd1
mov ebx, 0x80070057
jmp 0x140004dd1
mov ebx, 0x8007000e
xor r14d, r14d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140004dea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004e00
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004e16
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140004e2c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004e42
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
cmp dword [rcx], r14d
je 0x140004e5c
add rcx, 8
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140001580
mov rbx, qword [rsp + 0x308]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret