Function at 0x140095fe9
Capabilities:
Check if file exists
Create thread

Disassembly:
test rdx, rdx
je 0x14009635e
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd10]
sub rsp, 0xe10
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xe50], rbx
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0xd00], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp - 0x10]
call fcn.14027b2c0
mov rcx, qword [rdi + 0xc68]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
call qword [rax + 0x50]
nop
xor edx, edx
mov r8d, 0x88
lea rcx, [rsp + 0x60]
call fcn.14027b2c0
mov rcx, qword [rdi + 0xc70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x50]
nop
mov rsi, qword [rbp - 0x10]
mov r14, qword [rsp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x58], r15
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor edx, edx
mov r8d, 0xa70
lea rcx, [rbp + 0x80]
call fcn.14027b2c0
lea rcx, [rbp + 0x80]
call fcn.1400b6d40
nop
mov dword [rsp + 0x40], 0x80000000
mov dword [rsp + 0x38], 0x80000000
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x80b
mov r9d, 0x96c80000
lea r8, [0x140335918]
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.1400ca6e0
lea rcx, [rbp + 0x80]
call fcn.1400ca890
mov eax, dword [rbp + 0xae8]
dec eax
cmp eax, 7
ja case.default.0x14009611f
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x96360]
add rcx, rdx
jmp rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], 0
jne 0x140096125
add eax, eax
mov dword [rsp + 0x20], eax
mov r9, r14
lea r8, str.LastKey
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit
mov rcx, 0xffffffff80000001
call fcn.140060450
mov r9d, 1
xor r8d, r8d
lea rdx, str._C:Windows_regedit.exe___m
lea rcx, str.C:Windows_regedit.exe
call fcn.14005efb0
jmp case.default.0x14009611f
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400961ac
mov rcx, rbx
call fcn.1400b6820
test eax, eax
je 0x1400961ac
movzx eax, word [0x14045e53c]
mov word [str.X:WindowsInstaller], ax
lea rcx, str.X:WindowsInstaller
call fcn.14004d660
jmp case.default.0x14009611f
mov rcx, rsi
call fcn.14004d660
jmp case.default.0x14009611f
lea rax, [rbx + 0x210]
lea r9, [rbx + 8]
mov qword [rsp + 0x20], rax
lea r8, [0x140335950]
mov edx, 0x104
lea rcx, [rbp + 0xaf0]
call fcn.14004ebd0
mov r8d, 0x1e
mov rdx, qword [rbx + 0x418]
mov rcx, qword [rdi + 8]
call fcn.1400850d0
test eax, eax
je case.default.0x14009611f
lea rdx, [rbp + 0xaf0]
mov rcx, qword [rbx]
call fcn.1400607a0
jmp case.default.0x14009611f
mov r8d, 0x1e
mov rdx, rsi
mov rcx, qword [rdi + 8]
call fcn.1400850d0
test eax, eax
je case.default.0x14009611f
mov rcx, rsi
call fcn.140084d80
test eax, eax
jne case.default.0x14009611f
mov r9, rsi
lea r8, [0x140084d40]
jmp 0x140096290
mov rdx, rbx
mov rcx, rdi
call fcn.140097ed0
jmp case.default.0x14009611f
mov rdx, rbx
mov rcx, rdi
call fcn.1400974e0
jmp case.default.0x14009611f
mov rdx, rbx
mov rcx, rdi
call fcn.140097c10
jmp case.default.0x14009611f
mov r8d, 0x1e
mov rdx, qword [rbx + 0x418]
mov rcx, qword [rdi + 8]
call fcn.1400850d0
test eax, eax
je case.default.0x14009611f
mov r9, rbx
lea r8, [0x140097220]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rax, vtable.CUninstMenuManage.1.0
mov qword [rbp + 0x80], rax
lea rax, vtable.CUninstMenuManage.2.0
mov qword [rbp + 0xa0], rax
lea rax, vtable.CUninstMenuManage.4.0
mov qword [rbp + 0xb8], rax
lea rax, vtable.CUninstMenuManage.0
mov qword [rbp + 0xc0], rax
lea rax, vtable.CUninstMenuManage.5.0
mov qword [rbp + 0xc8], rax
lea rax, vtable.CUninstMenuManage.3.0
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0x80]
call fcn.140065e00
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x140096327
call fcn.1402804a8
nop
lea rax, [rbp - 8]
mov rcx, qword [rbp - 0x10]
cmp rcx, rax
je 0x140096339
call fcn.1402804a8
mov rcx, qword [rbp + 0xd00]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0xe50]
add rsp, 0xe10
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret