Function at 0x140002a00
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push r12
lea rbp, [rsp - 0xaa0]
sub rsp, 0xba0
mov rbx, rcx
lea r8, [0x140008010]
lea rcx, [rbp + 0x860]
xor r12b, r12b
lea rdx, str._sUpdates
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x860]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002f4b
mov qword [rsp + 0xb98], rsi
lea rcx, [rbp + 0x240]
mov qword [rsp + 0xb90], rdi
xor edx, edx
mov qword [rsp + 0xb88], r13
mov r8d, 0x200
mov qword [rsp + 0xb80], r14
mov qword [rsp + 0xb78], r15
call fcn.1400045b0
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x20a
call fcn.1400045b0
mov edi, 9
lea rcx, [rbp + 0x440]
xor r15d, r15d
xor edx, edx
mov r8d, 0x20c
mov r14d, r15d
lea esi, [rdi - 3]
lea r13d, [rdi + 0xb]
call fcn.1400045b0
xor edx, edx
lea rcx, [rbp + 0x650]
mov r8d, 0x20c
call fcn.1400045b0
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0xac8]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0xad8]
lea rax, [rbp + 0x30]
mov dword [rbp + 0xad8], 0x100
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x240]
lea rax, [rbp + 0xad0]
mov dword [rbp + 0xad0], r15d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], r15
mov dword [rbp + 0xac8], 0x20a
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea r15d, [rdi - 8]
cmp eax, 0x103
je 0x140002d9a
xor r12d, r12d
nop dword [rax]
test eax, eax
jne 0x140002d28
mov eax, dword [rbp + 0xac8]
test al, 1
jne 0x140002d28
cmp dword [rbp + 0xad0], 1
jne 0x140002d28
cmp eax, 0x20a
je 0x140002d28
movzx ecx, word [rbp + 0x240]
mov ebx, eax
shr rax, 1
mov r11d, r12d
mov word [rbp + rax*2 + 0x30], r12w
lea rax, [rbp + 0x240]
cmp cx, 0x30
jb 0x140002be0
movzx r8d, cx
movzx ecx, r8w
cmp r8w, 0x39
ja 0x140002be0
movzx ecx, r8w
lea r11d, [r11 + r11*4]
add rax, 2
lea r11d, [r11 - 0x18]
lea r11d, [rcx + r11*2]
movzx ecx, word [rax]
movzx r8d, cx
cmp cx, 0x30
jae 0x140002bb4
cmp cx, 0x2e
jne 0x140002d28
cmp r11d, edi
jl 0x140002d28
movzx ecx, word [rax + 2]
add rax, 2
mov r9d, r12d
cmp cx, 0x30
jb 0x140002c26
cmp cx, 0x39
ja 0x140002c26
movzx ecx, cx
lea r9d, [r9 + r9*4]
add rax, 2
lea r9d, [r9 - 0x18]
lea r9d, [rcx + r9*2]
movzx ecx, word [rax]
cmp cx, 0x30
jae 0x140002c04
cmp r11d, edi
jne 0x140002c34
cmp r9d, esi
jl 0x140002d28
movzx ecx, word [rax]
movzx r8d, cx
cmp cx, 0x2e
jne 0x140002c46
movzx r8d, word [rax + 2]
cmp cx, 0x2e
lea rdx, [rax + 2]
mov r10d, r12d
cmovne rdx, rax
cmp r8w, 0x30
jb 0x140002c86
nop dword [rax]
cmp r8w, 0x39
ja 0x140002c86
add rdx, 2
movzx eax, r8w
lea ecx, [r10 + r10*4]
lea r10d, [rcx - 0x18]
movzx r8d, word [rdx]
lea r10d, [rax + r10*2]
cmp r8w, 0x30
jae 0x140002c60
cmp r11d, edi
jne 0x140002c99
cmp r9d, esi
jne 0x140002c99
cmp r10d, r14d
jl 0x140002d28
movzx ecx, word [rdx]
movzx eax, cx
cmp cx, 0x2e
jne 0x140002ca9
movzx eax, word [rdx + 2]
cmp cx, 0x2e
lea r8, [rdx + 2]
mov ecx, r12d
cmovne r8, rdx
cmp ax, 0x30
jb 0x140002ce0
nop
cmp ax, 0x39
ja 0x140002ce0
movzx eax, ax
lea ecx, [rcx + rcx*4]
add r8, 2
lea ecx, [rcx - 0x18]
lea ecx, [rax + rcx*2]
movzx eax, word [r8]
cmp ax, 0x30
jae 0x140002cc0
cmp r11d, edi
jne 0x140002cf4
cmp r9d, esi
jne 0x140002cf4
cmp r10d, r14d
jne 0x140002cf4
cmp ecx, r13d
jle 0x140002d28
mov r13d, ecx
lea r8, [rbx + 2]
lea rcx, [rbp + 0x440]
mov edi, r11d
lea rdx, [rbp + 0x30]
mov esi, r9d
mov r14d, r10d
call fcn.140004580
lea r8, [rbx + 2]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x650]
call fcn.140004580
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0xac8]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0xad8]
lea rax, [rbp + 0x30]
mov dword [rbp + 0xad8], 0x100
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x240]
lea rax, [rbp + 0xad0]
mov dword [rbp + 0xad0], r12d
mov qword [rsp + 0x28], rax
mov edx, r15d
mov qword [rsp + 0x20], r12
mov dword [rbp + 0xac8], 0x20a
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc r15d
cmp eax, 0x103
jne 0x140002b60
mov rbx, qword [rbp + 0xac0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rbp + 0x440], 0
mov r13, qword [rsp + 0xb88]
je 0x140002f1b
lea rcx, [rbp + 0x440]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140002f1b
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 5
mov rsi, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0xcb
call fcn.140003a20
mov ecx, 0xca
mov rbx, rax
call fcn.140003a20
mov rcx, qword [0x140008428]
xor r15d, r15d
mov r14, qword [rbp + 0xac0]
mov rdi, rax
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 0x50
mov qword [rbp - 0x68], 0x84
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x60], 0x65
call qword [sym.imp.USER32.dll_MessageBoxIndirectW]
cmp eax, 6
jne 0x140002f09
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp + 0x650]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edx, edx
lea r8d, [r15 + 0x64]
lea rcx, [rbp - 0x3c]
call fcn.1400045b0
xor eax, eax
mov dword [rbp - 0x40], 0x68
mov qword [rsp + 0x58], rax
lea rcx, [rbp + 0x440]
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x650]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002f09
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12b, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0xb80]
movzx eax, r12b
mov rdi, qword [rsp + 0xb90]
mov rsi, qword [rsp + 0xb98]
mov r15, qword [rsp + 0xb78]
add rsp, 0xba0
pop r12
pop rbx
pop rbp
ret
movzx eax, r12b
add rsp, 0xba0
pop r12
pop rbx
pop rbp
ret